- Daily - CERT.at

Tageszusammenfassung - Donnerstag 19-03-2015
by Daily end-of-shift report 19 Mar '15

19 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 18-03-2015 18:00 − Donnerstag 19-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Sicherheitsforscher: Unsichtbare Apps unter iOS 8 weiterhin möglich *** --------------------------------------------- Mit einer neuen Methode ist es möglich, für den Nutzer praktisch unsichtbare iOS-Software zu installieren und diese als Spyware einzusetzen, erklärt ein Sicherheitsforscher – dies funktioniere auch auf Jailbreak-freien iPhones. --------------------------------------------- http://heise.de/-2579429 *** Experten warnen vor Risiken vernetzter medizinischer Geräte *** --------------------------------------------- "Wenn vernetztes Gerät in menschlichen Körper implantiert wurde, sind Konsequenzen eines Cyberangriffs besonders bedrohlich" --------------------------------------------- http://derstandard.at/2000013144564 *** Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001 *** --------------------------------------------- https://www.drupal.org/SA-CORE-2015-001 *** SA-CONTRIB-2015-079 - Chaos tool suite (ctools) - Multiple vulnerabilities *** --------------------------------------------- https://www.drupal.org/node/2454909 *** SA-CONTRIB-2015-078 - Webform - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2454903 *** Introduction to GSM Security *** --------------------------------------------- Introduction The Global System for Mobile Communication or GSM is a wireless communication that uses digital technology and is widely deployed across the globe for mobile communications, such as mobile phones. This technology utilizes microwaves, and its signal transmission is divided by time, .. --------------------------------------------- http://resources.infosecinstitute.com/introduction-to-gsm-security/ *** New BIOS Implant, Vulnerability Discovery Tool to Debut at CanSecWest *** --------------------------------------------- Researchers are expected to present at CanSecWest a BIOS rootkit that automates BIOS vulnerability discovery and implants persistent malware. --------------------------------------------- http://threatpost.com/new-bios-implant-vulnerability-discovery-tool-to-debu… *** Freak-Attacke: Noch immer tausende Android- und iOS-Apps gefährdet *** --------------------------------------------- Im Vergleich zu früheren OpenSSL-Lücken wie Heartbleed sind die Auswirkungen der vor einigen Wochen aufgetauchten Freak-Attacke vergleichsweise begrenzt. Dies liegt nicht zuletzt daran, dass für einen Angriff sowohl Client als auch Server verwundbar sein müssen, und mittlerweile viele Browser-Hersteller mit Updates die entsprechende Lücke abgedichtet haben. --------------------------------------------- http://derstandard.at/2000013168279 *** Cisco will an falsche Adressen liefern, um NSA zu täuschen *** --------------------------------------------- Router und andere Hardware soll an leerstehende Wohnungen versandt werden, um Empfänger zu verschleiern --------------------------------------------- http://derstandard.at/2000013170564 *** Ransomware - should you pay? *** --------------------------------------------- The big question, usually left unanswered in technical discussions of ransomware, is, "Should you pay?" We help you make up your mind. --------------------------------------------- https://nakedsecurity.sophos.com/2015/03/19/ransomware-should-you-pay/ *** Critical Vulnerability in Microsoft Translator hub writeup *** --------------------------------------------- A month back I was hunting for Vulnerabilities in Microsoft Web services, as Microsoft has large online infrastructure, finding a vulnerability which could lead to Microsoft hall of fame for security researchers wasn't difficult. While browsing around their online services, one of their services, .. --------------------------------------------- https://haiderm.com/critical-vulnerability-in-microsoft-translator-hub-writ… *** The Impacts of a Hacked Website *** --------------------------------------------- Today, with the proliferation of open-source technologies like WordPress, Joomla! and other Content Management Systems (CMS) people around the world are able to quickly establish a virtual presence with little to no cost. In the process however, a lot is being lost in terms of what it means to own a .. --------------------------------------------- http://blog.sucuri.net/2015/03/the-impacts-of-a-hacked-website.html *** Intrusion Detection (IDS) for Analysts *** --------------------------------------------- IDS device installed? Check. IDS seeing traffic? Check. IDS generating Events? Check. Analysts investigating Events? Ummm .. Investigating IDS alerts is a process like any other; however the variable nature of Information Security often makes this process difficult to adhere to. Maintaining .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/intrusion-detection-id… *** OpenSSL Security Advisory [19 Mar 2015] *** --------------------------------------------- https://www.openssl.org/news/secadv_20150319.txt *** Google Analytics by Yoast <= 5.3.2 - Stored Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7856 *** Erschlichenes Zertifikat: Microsoft antwortet vier Jahre nicht auf Warnung *** --------------------------------------------- Zum fälschlicherweise ausgestellten Zertifikat für die Microsoft-Domain live.fi sind weitere Details bekannt. Demnach hatte sich Microsoft Wochen Zeit gelassen, um zu reagieren. In einem ähnlichen Fall ließ Microsoft sogar vier Jahre verstreichen. --------------------------------------------- http://www.golem.de/news/gefaelschtes-zertifikat-microsoft-antwortet-vier-j… *** TLS-Zertifikate: Comodo stellt fälschlicherweise Microsoft-Zertifikat aus *** --------------------------------------------- Für die Domain live.fi, die Microsoft für die finnische Version seiner Live-Services nutzt, ist ein unberechtigtes Zertifikat von Comodo ausgestellt worden. Dabei wird eine Reihe von Schwächen des Zertifikatssystems deutlich. --------------------------------------------- http://www.golem.de/news/tls-zertifikate-comodo-stellt-gefaelschtes-microso… *** Aktiver Angriff auf Shop-System xt:Commerce *** --------------------------------------------- Angreifer nutzen die Sicherheitslücke in einem Versionszweig des Online-Shop-Systems xt:Commerce aktiv aus, um an sensible Kundendaten zu gelangen. Wer den Hotfix noch nicht eingespielt hat, sollte dies jetzt schleunigst tun. --------------------------------------------- http://heise.de/-2580640 *** Cisco IOS Software Autonomic Networking Infrastructure Overwrite Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37935 *** Linux-Entwickler erschweren Rowhammer-Angriffe *** --------------------------------------------- Momentan kann ein Programm mit einfachen Nutzerrechten beim Kernel erfragen, wo im Speicher die Daten eines Prozesses liegen. Das vereinfacht den Rowhammer-Angriff. Ab Linux .. --------------------------------------------- http://heise.de/-2580654

1 0

Tageszusammenfassung - Mittwoch 18-03-2015
by Daily end-of-shift report 18 Mar '15

18 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 17-03-2015 18:00 − Mittwoch 18-03-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** Malware Hunting with the Sysinternals Tools *** --------------------------------------------- This session provides an overview of several Sysinternals tools, including Process Monitor, Process Explorer, and Autoruns, focusing on the features useful for malware analysis and removal. These utilities enable deep inspection and control of processes, file system and registry activity, and autostart execution points. Mark Russinovich demonstrates their malware-hunting capabilities by presenting several real-world cases that used the tools to identify and clean malware, and concludes by... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/03/17/malware-hunting-with… *** Pass the hash!, (Wed, Mar 18th) *** --------------------------------------------- No, this isnt about sharing a hallucinogen-laced bong for a smoke. The hash were referring to here is the one that Wikipedia aptly but unhelpfully defines as a derivation of data, notably used in cryptographic hash functions. Passing the hash is a form of login credential theft that is quite prevalent. In it, an attacker captures the encoded session password (the hash) from one computer, and then re-uses it to illicitly access another computer. On (most configurations of) the Microsoft Windows... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19479&rss *** SSL Labs unveils free open source tool, new APIs *** --------------------------------------------- Qualys SSL Labs now includes free assessment APIs, accompanied by a free open source tool that can be used for bulk and automated testing of websites. These new enhancements provide the same results a... --------------------------------------------- http://www.net-security.org/secworld.php?id=18096 *** Apple-Browser: Update für drei Safari-Versionen behebt Sicherheitslücken *** --------------------------------------------- Apple hat in der Nacht zum Mittwoch Aktualisierungen für Safari unter OS X Mountain Lion, OS X Mavericks und OS X Yosemite veröffentlicht. Damit werden teils schwerwiegende Fehler ausgebügelt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Apple-Browser-Update-fuer-drei-Safar… *** Fatally flawed RC4 should just die, shout angry securobods *** --------------------------------------------- Its the Swiss Cheese of infosec and were all gazing through its holes Security researchers have banged another nail into the coffin of the ageing RC4 encryption algorithm. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/18/kill_rc4_sa… *** Mobile Android, iOS Apps Still Vulnerable to FREAK Attacks *** --------------------------------------------- FireEye scanned iOS and Android apps downloaded billions of times in aggregate and determined that, despite the availability of patches, because the apps still connect to vulnerable HTTPS servers, they're subject to FREAK attacks. --------------------------------------------- http://threatpost.com/mobile-android-ios-apps-still-vulnerable-to-freak-att… *** Cisco Content Services Switch (11500) Unauthenticated Port Forwarding Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37889 *** VU#868948: HP ArcSight contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#868948 HP ArcSight contains multiple vulnerabilities Original Release date: 17 Mar 2015 | Last revised: 17 Mar 2015 Overview HP ArcSight contains multiple vulnerabilities. Description CWE-434: Unrestricted Upload of File with Dangerous Type - CVE PendingHP ArcSight Logger 5.3.1.6838.0 configuration import file upload capability does not sanitize file names, which allows a remote, authenticated attacker to put arbitrary files into the document root. This vulnerability... --------------------------------------------- http://www.kb.cert.org/vuls/id/868948 *** Security Advisory - Resource Management Vulnerability in the AR1220 *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - Directory File Deletion Vulnerability in UDS *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - Multiple Injection Vulnerabilities in UDS *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [DSA 3195-1] php5 security update *** --------------------------------------------- Multiple vulnerabilities have been discovered in the PHP language: CVE-2015-2305 - Guido Vranken discovered a heap overflow in the ereg extension (only applicable to 32 bit systems). ... CVE-2015-0231 - Stefan Esser discovered a use-after-free in the unserialisation of objects. CVE-2015-0232 - Alex Eubanks discovered incorrect memory management in the exif extension. CVE-2015-0273 - Use-after-free in the unserialisation of DateTimeZone. --------------------------------------------- https://lists.debian.org/debian-security-announce/2015/msg00080.html *** XZERES 442SR Wind Turbine Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cross-site request forgery vulnerability in XZERES's 442SR turbine generator operating system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-076-01 *** Honeywell XL Web Controller Directory Traversal Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a directory traversal vulnerability in Honeywell's XL Web Controller. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-076-02

1 0

Tageszusammenfassung - Dienstag 17-03-2015
by Daily end-of-shift report 17 Mar '15

17 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 16-03-2015 18:00 − Dienstag 17-03-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** 3046310 - Improperly Issued Digital Certificates Could Allow Spoofing - Version: 1.0 *** --------------------------------------------- Microsoft is aware of an improperly issued SSL certificate for the domain “live.fi” that could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. It cannot be used to issue other certificates, impersonate other domains, or sign code. This issue affects all supported releases of Microsoft Windows. Microsoft is not currently aware of attacks related to this issue. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/3046310 *** Man who obtained Windows Live cert said his warnings went unanswered *** --------------------------------------------- "I tried, just for fun," said man who reported hole to Microsoft and authorities. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/GS2QPGGMdJ0/ *** Forthcoming OpenSSL releases *** --------------------------------------------- The OpenSSL project team would like to announce the forthcoming release of OpenSSL versions 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf. These releases will be made available on 19th March. They will fix a number of security defects. The highest severity defect fixed by these releases is classified as "high" severity. --------------------------------------------- https://mta.openssl.org/pipermail/openssl-users/2015-March/000778.html *** From PEiD To YARA, (Tue, Mar 17th) *** --------------------------------------------- Some time ago, Jim Clausing had a diary entry about PeID (a packer identifier) and since then he has a PEiD signature database on his handler page. Now, wouldnt it be great if we could reuse these signatures? For example as YARA rules? Thats why I wrote a Python program that converts PEiD signatures to YARA rules: peid-userdb-to-yara-rules.py Here is an example: PEiD signature: [!EP (ExE Pack) V1.0 - Elite Coding Group] signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 ep_only = true Generated... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19473&rss *** Zweifaktor-Dienst Authy ließ jeden rein *** --------------------------------------------- Zwei-Faktor-Authentifizierung ist eine sichere Sache - wenn sie denn funktioniert. Authy, das von vielen prominenten Sites eingesetzt wird, ließ sich bis vor kurzem mit dem Generalschlüssel "../sms" umgehen. --------------------------------------------- http://heise.de/-2576764 *** D-Link patches critical flaws in wireless range extender, Wi-Fi cameras firmware *** --------------------------------------------- D-Link has released new firmware for its DAP-1320 wireless range extender and the DCS-93xL family of Wi-Fi cameras in order to patch two critical vulnerabilities that can lead to device hijacking. ... --------------------------------------------- www.net-security.org/secworld.php?id=18093 *** Search for vulnerable servers unearths weak, thousands-times repeated RSA keys *** --------------------------------------------- A group of researchers from the Information Security Group from Royal Holloway, University of London, wanted to see how many TLS servers still supported the weak, export-grade (512-bit) RSA public key... --------------------------------------------- http://www.net-security.org/secworld.php?id=18094 *** Cisco Virtual TelePresence Server Serial Console Privileged Access Vulnerability *** --------------------------------------------- Cisco Virtual TelePresence Server Software contains a vulnerability that could allow an authenticated, local attacker to gain unauthorized access with elevated privileges. Updates are available. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37869 *** DSA-3192 checkpw - security update *** --------------------------------------------- Hiroya Ito of GMO Pepabo, Inc. reported that checkpw, a passwordauthentication program, has a flaw in processing account names whichcontain double dashes. A remote attacker can use this flaw to cause adenial of service (infinite loop). --------------------------------------------- https://www.debian.org/security/2015/dsa-3192 *** Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability *** --------------------------------------------- Topic: Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability Risk: High Text:/* Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability Vendor: Intel Product webpage: http://www.intel.co... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030110 *** TYPO3 CMS 6.2.11 released *** --------------------------------------------- The TYPO3 Community announces the version 6.2.11 LTS of the TYPO3 Enterprise Content Management System. --------------------------------------------- http://www.typo3.org/news/article/typo3-cms-6211-released/ *** HPSBHF03293 rev.1 - HP Virtual Connect 8Gb 24-Port FC Module running OpenSSL and Bash, Remote Denial of Service (DoS), Code Execution, Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Virtual Connect 8Gb 24-Port FC Module running OpenSSL and Bash including: The OpenSSL vulnerability known as "Heartbleed" which could be exploited remotely resulting in Denial of Service (DoS) or disclosure of information. The SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" also known as "Poodle", which could be exploited remotely resulting in disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Montag 16-03-2015
by Daily end-of-shift report 16 Mar '15

16 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 13-03-2015 18:00 − Montag 16-03-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** ICS-CERT Monitor Quarterly Report - Phishing Reigns Supreme (March 12, 2015) *** --------------------------------------------- According to a quarterly report from the US Industrial Control System Computer Emergency Response Team (ICS-CERT), industrial control systems were targets of cyber attacks at least 245 times in the 12-month period between October 1, 2013 and September 30, 2014....... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/20/200 *** Security Advisory - NTPd Security Vulnerability in Multiple Huawei Products *** --------------------------------------------- Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet. Multiple Huawei products have this vulnerability. ( Vulnerability ID: HWPSIRT-2014-1276) --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** TeslaCrypt ransomware attacks gamers - "all your files are belong to us!" *** --------------------------------------------- TeslaCrypt is a new ransomware that goes above and beyond CryptoLocker in the types of files it seeks out to hold for ransom, including those related to video games. SophosLabs dug in to find out what TeslaCrypt has in store for gamers, and everyone else. --------------------------------------------- https://nakedsecurity.sophos.com/2015/03/16/teslacrypt-ransomware-attacks-g… *** Safari: Alte Sicherheitslücke speichert URLs auch im Private-Browsing-Modus *** --------------------------------------------- Normalerweise sollte ein Browser alle angesurften Adressen vergessen, wenn er im 'Privatmodus' genutzt wird. Apples Safari tut das allerdings nicht - die besuchten Adressen landen in einer ungeschützten Datenbank. --------------------------------------------- http://heise.de/-2575426 *** Attacks Only Get Better: Password Recovery Attacks Against RC4 in TLS *** --------------------------------------------- We provide new attacks against RC4 in TLS that are focussed on recovering user passwords, still the pre-eminent means of user authentication on the Web today. Our attacks enhance the statistical techniques used in the previous attacks and exploit specific features of the password setting to produce attacks that are much closer to being practical. We report on extensive simulations that illustrate this. --------------------------------------------- http://www.isg.rhul.ac.uk/tls/RC4mustdie.html *** Talk at Troopers15 *** --------------------------------------------- Peter Kieseberg and Sebastian Schrittwieser give a talk about 'iAnalyze - Automated security analysis of iOS apps' at the 'Hacking Mobiles Vol. 2.1 - MMA: Mobile Malicious Apps' workshop, which is held at Troopers15 conference in Heidelberg, Germany. --------------------------------------------- https://www.sba-research.org/2015/03/16/talk-at-troopers15/ *** Cisco Security Advisories *** * Cisco AnyConnect Secure Mobility Client Arbitrary File Write Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37863 * Cisco AnyConnect Secure Mobility Client Hostscan Path Traversal Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37862 * Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37861 * Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37860

1 0

Tageszusammenfassung - Freitag 13-03-2015
by Daily end-of-shift report 13 Mar '15

13 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 12-03-2015 18:00 − Freitag 13-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB15-05) *** --------------------------------------------- A Security Bulletin (APSB15-05) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using the instructions referenced in the security bulletin. This... --------------------------------------------- https://blogs.adobe.com/psirt/?p=1185 *** After Delays, Samsung Patches Social Media Vulnerability in Millions of Devices *** --------------------------------------------- Samsung patched a vulnerability last month in SNS Provider that if exploited could have given attackers the ability to access to any personal information users stored on Facebook, LinkedIn and Twitter. --------------------------------------------- http://threatpost.com/after-delays-samsung-patches-social-media-vulnerabili… *** Blind SQL Injection against WordPress SEO by Yoast, (Fri, Mar 13th) *** --------------------------------------------- WordPress has released an advisory for the WordPress plugin SEO by Yoast. Version up to and including 1.7.3.3 can be exploited with a blind SQL injection. According to WordPress, this plugin has more than one million downloads. A description of the SQL injection with proof of concept is described here and the latest update is available here. [1] https://wordpress.org/plugins/wordpress-seo/ [2] https://downloads.wordpress.org/plugin/wordpress-seo.1.7.4.zip [3] --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19457&rss *** Achievement Locked: New Crypto-Ransomware Pwns Video Gamers *** --------------------------------------------- Gamers may be used to paying to unlock downloadable content in their favorite games, but a new crypto-ransomware variant aims to make gamers pay to unlock what they already own. Data files for more than 20 games can be affected by the threat, increasing what is already a large target for cybercriminals. Another file type... --------------------------------------------- http://labs.bromium.com/2015/03/12/achievement-locked-new-crypto-ransomware… *** VIRLOCK Combines File Infection and Ransomware *** --------------------------------------------- Analysis by Jaaziel Carlos, Jonh Chua, and Rodwin Fuentes Ransomware has become one of the biggest problems for end users are as of late. In the past months alone, we have reported on several variants of both ransomware and crypto-ransomware, each with their own "unique" routines. We recently came across one malware family, detected as... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/eJWas-XoY6I/ *** Microsoft EMET 5.2 is available, (Fri, Mar 13th) *** --------------------------------------------- Microsoft has announced a new release of the Enhanced Mitigation Experience Toolkit (EMET) 5.2. The main the main changes and improvements as the following: Control Flow Guard:EMETs native DLLs have been compiled with Control Flow Guard(CFG). CFG is a new feature introduced in Visual Studio 2015 (and supported by Windows 8.1 and Windows 10) that helps detect and stop attempts of code hijacking. EMET native DLLs (i.e. EMET.DLL) are injected into the application process EMET protects. Since we --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19461&rss *** Adobe schließt kritische Lücken in Flash *** --------------------------------------------- Ein neues Update für den Flash-Player schließt elf Sicherheitslücken und ist für alle Plattformen verfügbar. Eine zügige Installation ist ratsam, da Angreifer im schlimmsten Fall das System übernehmen könnten. --------------------------------------------- http://heise.de/-2574278 *** Bootschleife nach SHA-2-Update für Windows 7 *** --------------------------------------------- Böse Überraschung für einige Nutzer mit Linux-Dual-Boot: Ein Windows-7-Update vom letzten Patchday stürzt den Rechner in eine Bootschleife. Das scheint allerdings nur beim Booten über das klassische BIOS aufzutreten, UEFI-Nutzer haben Glück. --------------------------------------------- http://heise.de/-2574289 *** BlackBerry has no fix for devices vulnerable to FREAK security flaw *** --------------------------------------------- Summary:The company, lauded for having the worlds most protected devices for encrypted messaging, warns that devices will be vulnerable to a serious security flaw until a patch is released. --------------------------------------------- http://www.zdnet.com/article/blackberry-slow-to-respond-to-freak-flaw-says-… *** Mozilla Releases Open Source Masche Forensics Tool *** --------------------------------------------- Mozilla has released an open source memory forensics tool that some college students designed and built during the company's recent Winter of Security event. The new tool, known as Masche, is designed specifically for investigating server memory and has the advantage of being able to scan running processes without causing any problems with the machine. --------------------------------------------- http://threatpost.com/mozilla-releases-open-source-masche-forensics-tool/11… *** Google-Panne: Inhaberdaten von 300.000 geschützten Domains einsehbar *** --------------------------------------------- Google bietet seinen Kunden die Möglichkeit, Domains zu registrieren, ohne dass dabei persönliche Daten in den Whois-Einträgen auftauchen. Durch einen Bug waren die Informationen trotzdem abrufbar. --------------------------------------------- http://heise.de/-2574423 *** Bypassing ASLR with CVE-2015-0071: An Out-of-Bounds Read Vulnerability *** --------------------------------------------- Almost every Patch Tuesday cycle contains one bulletin that (for convenience) rolls up multiple Internet Explorer vulnerabilities into a single bulletin. February's Patch Tuesday cumulative IE bulletin (MS15-009) included a fix for a particularly interesting vulnerability that could be used to bypass one of the key anti-exploit technologies in use today, address space layout randomization... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/35xufNRKED8/ *** Security Afterworks: Cybercrime - Lessons From the Field & Best Of Troopers15 *** --------------------------------------------- Cybercrime – wie reagieren nach einem Vorfall? Die Frage ist schon längst nicht mehr ob, sondern wann Sie zum Ziel werden. Andreas Tomek informiert beim Security Afterworks im April über Lessons from the field – Incident Response & Cybercrime in Österreich. Danach geht es mit den Hot Topics der Troopers15 weiter. Lassen Sie sich von uns auf den neuesten Stand bringen! Dienstag, 14. April 2015 16.30 Uhr ab 17.30 Uhr gemütlicher Ausklang SBA Research --------------------------------------------- https://www.sba-research.org/events/security-afterworks-cybercrime-lessons-… https://www.sba-research.org/wp-content/uploads/2015/03/Security-Afterworks… *** Cisco FREAKs out, starts epic OpenSSL bug-splat *** --------------------------------------------- Happy weekend, network admins Cisco admins will be watching and waiting for fixes, with the company announcing that many of its OpenSSL implementations are carrying a bunch of post-POODLE fleas. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/13/cisco_freak… *** Samsung SNS Provider Application For Android Access Theft *** --------------------------------------------- Topic: Samsung SNS Provider Application For Android Access Theft Risk: Low Text: Fundacion Dr. Manuel Sadosky - Programa STIC Advisory www.fundacionsadosky.org.ar *Vulnerabilities in the Samsung SNS ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030093 *** HP Security Bulletins *** --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** DSA-3186 nss - security update *** --------------------------------------------- It was discovered that the Mozilla Network Security Service library(nss) incorrectly handled certain ASN.1 lengths. A remote attacker couldpossibly use this issue to perform a data-smuggling attack. --------------------------------------------- https://www.debian.org/security/2015/dsa-3186 *** DSA-3185 libgcrypt11 - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in libgcrypt: --------------------------------------------- https://www.debian.org/security/2015/dsa-3185 *** DSA-3184 gnupg - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in GnuPG, the GNU Privacy Guard: --------------------------------------------- https://www.debian.org/security/2015/dsa-3184 *** WPML Multiple Vulnerabilities (Including SQLi) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7843 *** Schneider Electric Pelco DS-NVs Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in the Schneider Electric Pelco DS-NVs software package. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-071-01 *** Xen Multiple Flaws Let Local Guest Users Deny Service or Obtain Information From Other Guest Systems *** --------------------------------------------- http://www.securitytracker.com/id/1031806

1 0

Tageszusammenfassung - Donnerstag 12-03-2015
by Daily end-of-shift report 12 Mar '15

12 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 11-03-2015 18:00 − Donnerstag 12-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Cyber Security in Supply Chain Management: Part 1 *** --------------------------------------------- Introduction Cyber security is generally thought of as various types of security devices like firewalls, Web Application Firewall (WAF), IDS/IPS, SIEM, DLP etc. to safeguard network, applications and data. But what if, for example, the deployed security solutions have a bug inside? The latest example of this is exposing of a vulnerability in Lenovo notebooks. --------------------------------------------- http://resources.infosecinstitute.com/cyber-security-in-supply-chain-manage… *** Paper: Windows 10 patching process may leave enterprises vulnerable to zero-day attacks *** --------------------------------------------- Aryeh Goretsky gives advice on how to adapt to Windows 10s patching strategy.Patching is hard, especially when the code base is old and the bugs are buried deeply. This was highlighted once again this week when Microsoft released a patch for a vulnerability that was thought to have been patched almost five years ago, but which could still be exploited.In fact, six out of the last eight Patch Tuesdays have included patches that have caused problems for some Windows users.Probably in response to... --------------------------------------------- http://www.virusbtn.com/blog/2015/03_12.xml?rss *** Microsoft SHA-2 Advisory Causing "Infinite Loop" Issues *** --------------------------------------------- Windows users are having issues with a security update issued this week meant to add SHA-2 code-signing and verification support to Windows 7 and Windows Server 2008 R2 machines. --------------------------------------------- http://threatpost.com/microsoft-sha-2-advisory-causing-infinite-loop-issues… *** Schwerwiegende Sicherheitslücke im Shop-System xt:Commerce *** --------------------------------------------- Derzeit klafft eine Sicherheitslücke im aktuellen Versionszweig des verbreiteten Online-Shop-Systems xt:Commerce. Ein Patch ist bereits verfügbar. --------------------------------------------- http://heise.de/-2573755 *** Who got the bad SSL Certificate? Using tshark to analyze the SSL handshake., (Thu, Mar 12th) *** --------------------------------------------- Ever wonder if any of your users connect to sites with bad SSL certificates? I ran into this issue recently when debugging some SSL issues, and ended up with thisquick tshark and shell script trickto extract the necessary information from a packet capture. First, you may want to compare the host name your clients connect to, to the host name returned as part of the certificate. While the Host header is encrypted and not accessible, modern SSL libraries use Server Name Indication (SNI) as part... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19455&rss *** Defending Against PoS RAM Scrapers *** --------------------------------------------- Stealing payment card data has become an everyday crime that yields quick monetary gains. Attackers aim to steal the data stored in the magnetic stripe of payment cards, optionally clone the cards, and run charges on the accounts associated with them. The topic of PoS RAM scraper malware always prompts businesses and retailers to ask... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/CYPwDbRGFfc/ *** Dropbox Patches Remotely Exploitable Vulnerability in SDK *** --------------------------------------------- Developers at Dropbox recently fixed a remotely exploitable vulnerability in the Android SDK version of the app that enabled attackers to connect applications on some devices to a Dropbox account without the users consent. --------------------------------------------- http://threatpost.com/dropbox-patches-remotely-exploitable-vulnerability-in… *** Inverted WordPress Trojan *** --------------------------------------------- Trojan (or trojan horse) is software that does (or pretends to be doing) something useful but also contains a secret malicious payload that inconspicuously does something bad. In WordPress, typical trojans are plugins and themes (usually pirated) which may have backdoors, or send out spam, create doorways, inject hidden links or malware. The trojan modelRead More --------------------------------------------- http://blog.sucuri.net/2015/03/inverted-wordpress-trojan.html *** RSA Digital Certificate Manager Input Validation Flaws Permit Cross-Site Scripting and Denial of Service Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031912 *** EMC Secure Remote Services GHOST / SQL Injection / Command Injection *** --------------------------------------------- Topic: EMC Secure Remote Services GHOST / SQL Injection / Command Injection Risk: High Text:ESA-2015-040: EMC Secure Remote Services Virtual Edition Security Update for Multiple Vulnerabilities CVE Identifier: CVE-2... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030076 *** Google Android Integer Oveflow / Heap Corruption *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030079 *** phpMyAdmin Bug May Disclose CSRF Token to Remote Users *** --------------------------------------------- http://www.securitytracker.com/id/1031871 *** Elipse E3 Process Control Vulnerability (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-069-04 Elipse E3 Process Control Vulnerability that was published March 10, 2015, on the NCCIC/ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-069-04A *** IBM Security Bulletin: Apache Tomcat request smuggling affects Algo Audit and Compliance (CVE-2014-0227) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21698437 *** IBM Security Bulletin: IBM PowerVC - Ceilometer DB2/MongoDB Backend Password Leak (CVE-2013-6384) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=nas8N1020585 *** IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM/Cisco Switches and Directors (CVE-2015-0235) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ssg1S1005122 *** IBM Security Bulletin: Multiple IBM InfoSphere Information Server components are affected by a vulnerability in the XML4C parser (CVE-2014-8901) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21696312 *** SA-CONTRIB-2015-077 - OG tabs - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2450427 *** SA-CONTRIB-2015-076 - Image Title - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2450393 *** SA-CONTRIB-2015-075 - Perfecto - Open Redirect *** --------------------------------------------- https://www.drupal.org/node/2450391 *** SA-CONTRIB-2015-074 - Site Documentation - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2450387 *** Pie Register 2.0.14 - Cross Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7842

1 0

Tageszusammenfassung - Mittwoch 11-03-2015
by Daily end-of-shift report 11 Mar '15

11 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 10-03-2015 18:00 − Mittwoch 11-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Inside the EquationDrug Espionage Platform *** --------------------------------------------- EquationDrug represents the main espionage platform from the Equation Group. It's been in use for over 10 years, replacing EquationLaser until it was itself replaced itself by the even more sophisticated GrayFish platform. --------------------------------------------- http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage… *** DroppedIn: Remotely Exploitable Vulnerability in the Dropbox SDK for Android *** --------------------------------------------- The IBM X-Force Application Security Research Team has discovered a vulnerability in the Dropbox SDK for Android (CVE-2014-8889) which allows attackers to connect applications on mobile devices to a Dropbox account controlled by the attacker without the victim's knowledge or authorization. This is a serious flaw in the authentication mechanism within any Android app using a Dropbox SDK Version 1.5.4 through 1.6.1 (note: this vulnerability was resolved in Dropbox SDK for Android v1.6.2). --------------------------------------------- http://securityintelligence.com/droppedin-remotely-exploitable-vulnerabilit… *** Unpatched security vulnerabilities affecting Facebook *** --------------------------------------------- A web security researcher from Portugal has discovered several vulnerabilities affecting Facebook that he considers to be serious, but hasnt had much success convincing the company of that, so he sha... --------------------------------------------- http://www.net-security.org/secworld.php?id=18069 *** Reconnect tool for hacking Facebook is publicly available *** --------------------------------------------- The security expert Egor Homakov from Sakurity firm has released the Reconnect tool that allows hackers to hijack accounts on sites that use Facebook logins. The security expert Security Egor Homakov has developed a hacking tool dubbed Reconnect that exploit a flaw in Facebook to hijack accounts on sites that use Facebook logins. Homakov, with works for... --------------------------------------------- http://securityaffairs.co/wordpress/34705/hacking/reconnect-hacking-faceboo… *** DDoS on UPNP Devices *** --------------------------------------------- Denial of service (DOS) attack is an attempt to make a machine or a network resource unavailable to its users. It basically consists of methods to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet, and these attacks are sent by one person or a system. One common method of... --------------------------------------------- http://resources.infosecinstitute.com/ddos-upnp-devices/ *** Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix *** --------------------------------------------- In early January 2015, researcher Michael Heerklotz approached the Zero Day Initiative with details of a vulnerability in the Microsoft Windows operating system. We track this issue as ZDI-15-086. Unless otherwise noted, the technical details in this blog post are based on his detailed research. --------------------------------------------- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Full-details-on-CVE-… *** Threatglass has pcap files with exploit kit activity, (Tue, Mar 10th) *** --------------------------------------------- Threatglassis a one way to find up-to-date examples of exploit kit traffic. Not all of it is exploit kit traffic, but all of it represents some sort of malicious activity. Threatglassdoesnt explain what type of traffic youre looking at from the pcaps the site provides. Letslook at a page from last week on Thursday, March 5th 2015 [1]. This one isexploit kit activity. In the image below, youll find a link to the packet capture in the lower right-hand corner" /> Download the pcap and open... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19433&rss *** n00bs CTF Labs by Infosec Institute *** --------------------------------------------- n00bs CTF (Capture the Flag) Labs is a web application presented by Infosec Institute. It has 15 mini Capture the Flag challenges intended for beginners and newbies in the information security field or for any average infosec enthusiasts who haven't attended hacker conventions yet. So what is a CTF? In hacker conventions, CTF or Capture... --------------------------------------------- http://resources.infosecinstitute.com/n00bs-ctf-labs-infosec-institute/ *** Achtung: Panda-Virenscanner zerschießt Windows, nicht Neustarten! *** --------------------------------------------- Die Antivirenschutz-Produkte von Panda Security haben wegen fehlerhaften Signaturen etliche Windows-Rechner lahm gelegt. Wer betroffen ist, soll die Füße still halten und das System nicht neu starten - da es unter Umständen nicht mehr hochfährt. --------------------------------------------- http://heise.de/-2573233 *** Panda Antivirus: Gravierender Fehler im Virenscanner löscht Systemdateien *** --------------------------------------------- Ein gravierender Fehler in Pandas Antivirensoftware kann unter Umständen zu einem vollkommen unbrauchbaren System führen. Panda bestätigt das Problem. Golem.de hat erste Hinweise erhalten, wie der Fehler zu stoppen ist. (Virenscanner, Applikationen) --------------------------------------------- http://www.golem.de/news/panda-antivirus-gravierender-fehler-im-virenscanne… *** Doctor Web: February 2015 virus activity review *** --------------------------------------------- March 4, 2015 The shortest month of the year had its share of new malware. In early February, Doctor Web security researchers finished examining a complex multi-purpose malicious program for Linux, while at month's end, they published the results of their analysis of a new version of a backdoor for Mac OS X. As before, malicious programs for Android remained active throughout the month. PRINCIPAL TRENDS IN JANUARY New Linux Trojans Virus makers are still showing an interest in Mac OS X. --------------------------------------------- http://news.drweb.com/show/?i=9316&lng=en&c=9 *** Ein Blick in die Zukunft der Handy-Malware *** --------------------------------------------- Kaspersky hat eine Analyse zu einer Android-Malware veröffentlicht, die zwar aktuell nur in Russland aktiv ist, aber einen Vorgeschmack gibt, was demnächst auch bei uns passieren könnte: Wichtige Punkte daraus: Das Teil ist inzwischen so modular und gut geschützt, wie typische Windows Malware Frameworks Es enthält Code zum Anmelden des Opfers bei diversen Premium-Services Dabei kann es automatisch... --------------------------------------------- http://www.cert.at/services/blog/20150311102554-1454.html *** DSA-3177 mod-gnutls - security update *** --------------------------------------------- Thomas Klute discovered that in mod-gnutls, an Apache module providingSSL and TLS encryption with GnuTLS, a bug caused the servers clientverify mode not to be considered at all, in case the directorysconfiguration was unset. Clients with invalid certificates were thenable to leverage this flaw in order to get access to that directory. --------------------------------------------- https://www.debian.org/security/2015/dsa-3177 *** DSA-3182 libssh2 - security update *** --------------------------------------------- Mariusz Ziulek reported that libssh2, a SSH2 client-side library, wasreading and using the SSH_MSG_KEXINIT packet without doing sufficientrange checks when negotiating a new SSH session with a remote server. Amalicious attacker could man in the middle a real server and cause aclient using the libssh2 library to crash (denial of service) orotherwise read and use unintended memory areas in this process. --------------------------------------------- https://www.debian.org/security/2015/dsa-3182 *** Manage Engine AD Audit Manager Plus Cross Site Scripting *** --------------------------------------------- Topic: Manage Engine AD Audit Manager Plus Cross Site Scripting Risk: Low Text: # Title:- Reflected cross-site scripting(XSS) Vulnerability in Manage Engine AD Audit Manager Plus Admin Panel(Bui... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030060 *** tcpdump Denial Of Service / Code Execution *** --------------------------------------------- Topic: tcpdump Denial Of Service / Code Execution Risk: High Text:Hi, please find tcpdump 4.7.2 source code at: http://www.ca.tcpdump.org/beta/tcpdump-4.7.2.tar.gz http://www.ca.tcpdu... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030064 *** Cisco Intrusion Prevention System MainApp Secure Socket Layer Denial of Service Vulnerability *** --------------------------------------------- cisco-sa-20150311-ips --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco TelePresence Video Communication Server, Cisco Expressway, and Cisco TelePresence Conductor *** --------------------------------------------- cisco-sa-20150311-vcs --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** IBM Security Bulletin: Multiple vulnerabilities fixed in Current Release of Liberty for Java for IBM Bluemix (CVE-2012-6153, CVE-2014-3577, CVE-2015-0178) *** --------------------------------------------- 2015-03-11T10:06:12-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21696864 *** Citrix XenServer Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in Citrix XenServer. These vulnerabilities could, if exploited, allow ... --------------------------------------------- http://support.citrix.com/article/CTX200484 *** HPSBNS03280 rev.1 - HP NonStop Servers running SAMBA, Remote Execution of Arbitrary Code *** --------------------------------------------- A potential security vulnerability has been identified with HP NonStop Servers running SAMBA. The vulnerability could be exploited remotely resulting in execution of arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBUX03281 SSRT101968 rev.1 - HP-UX running Java7, Remote Unauthorized Access, Disclosure of Information and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** USN-2524-1: eCryptfs vulnerability *** --------------------------------------------- Ubuntu Security Notice USN-2524-110th March, 2015ecryptfs-utils vulnerabilityA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Ubuntu 10.04 LTSSummarySensitive information in encrypted home and Private directories could beexposed if an attacker gained access to your files.Software description ecryptfs-utils - eCryptfs cryptographic filesystem utilities DetailsSylvain Pelissier discovered that eCryptfs did not generate a random --------------------------------------------- http://www.ubuntu.com/usn/usn-2524-1/ *** USN-2522-3: ICU vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2522-310th March, 2015icu vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTSSummaryICU could be made to crash or run programs as your login if it processedspecially crafted data. Software description icu - International Components for Unicode library DetailsUSN-2522-1 fixed vulnerabilities in ICU. On Ubuntu 12.04 LTS, the fontpatches caused a regression when using LibreOffice Calc. The patches havenow been updated --------------------------------------------- http://www.ubuntu.com/usn/usn-2522-3/ *** VU#794095: Telerik Analytics Monitor Library allows DLL hijacking *** --------------------------------------------- Vulnerability Note VU#794095 Telerik Analytics Monitor Library allows DLL hijacking Original Release date: 10 Mar 2015 | Last revised: 10 Mar 2015 Overview Telerik Analytics Monitor Library is a third-party application analytics service that collects detailed application metrics for vendors. Some versions of the Telerik library allow DLL hijacking, allowing an attacker to load malicious code in the context of the Telerik-based application. Description CWE-114: Process ControlTelerik --------------------------------------------- http://www.kb.cert.org/vuls/id/794095 *** WordPress SEO by Yoast <= 1.7.3.3 - Blind SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7841

1 0

Tageszusammenfassung - Dienstag 10-03-2015
by Daily end-of-shift report 10 Mar '15

10 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 09-03-2015 18:00 − Dienstag 10-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** MS15-MAR - Microsoft Security Bulletin Summary for March 2015 - Version: 1.0 *** --------------------------------------------- This bulletin summary lists security bulletins released for March 2015. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-MAR *** Apple Patches for iOS, OS X and Apple TV, (Tue, Mar 10th) *** --------------------------------------------- With yesterdays updates for iOS, OS X and Apple TV, Apple also addressed a number of security vulnerabilities, most notably the Freak vulnerability. After updating, the affected operating systems no longer support export quality ciphers. However, Apple browsers continue to support SSLv3 and as a result, continue to be vulnerable to POODLE. Quick Summary of the security content of Apples updates: XCode 6.2: This update addresses 4 vulnerabilities in subversion and 1 in git. OS X: 5... --------------------------------------------- https://isc.sans.edu/diary/Apple+Patches+for+iOS%2C+OS+X+and+Apple+TV/19443 *** Exploiting the DRAM rowhammer bug to gain kernel privileges *** --------------------------------------------- "Rowhammer" is a problem with some recent DRAM devices in which repeatedly accessing a row of memory can cause bit flips in adjacent rows. We tested a selection of laptops and found that a subset of them exhibited the problem. We built two working privilege escalation exploits that use this effect. One exploit uses rowhammer-induced bit flips to gain kernel privileges on x86-64 Linux when run as an unprivileged userland process. When run on a machine vulnerable to the rowhammer... --------------------------------------------- http://googleprojectzero.blogspot.co.at/2015/03/exploiting-dram-rowhammer-b… *** Network Forensics What Are Your Investigations Missing - SANS DFIR WEBCAST *** --------------------------------------------- Traditionally, computer forensic investigations focused exclusively on data from the seized media associated with a system of interest.Recently, memory analysis has become an integral part of forensic analysis, resulting in a new and significantly different way for digital examiners and investigators to perform their craft.Now another evolution in computer forensics is at hand - one that includes data collected from network devices as well as the from wires themselves. Every day, more and more... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/03/09/network-forensics-wh… *** Yahoo Patches Critical eCommerce, Small Business Vulnerabilities *** --------------------------------------------- Yahoo has fixed a handful of vulnerabilities that could have given an attacker free reign over all of its user-run eCommerce websites and caused multiple headaches for small business owners. --------------------------------------------- http://threatpost.com/yahoo-patches-critical-ecommerce-small-business-vulne… *** Attackers targeting Elasticsearch remote code execution hole *** --------------------------------------------- Devs ring patch alarm bells, drop shell code Attackers are targeting a patched remote code execution vulnerability in Elasticsearch that grants unauthenticated bad guys access through a buggy API. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/10/elastic_sea… *** SMS Trojan bypasses CAPTCHA *** --------------------------------------------- Trojan-SMS.AndroidOS.Podec proved to be remarkable: it can send messages to premium-rate numbers employing tools that bypass the Advice of Charge system. It can also subscribe users to premium-rate services while bypassing CAPTCHA. --------------------------------------------- http://securelist.com/analysis/publications/69169/sms-trojan-bypasses-captc… *** Xen Security Advisory CVE-2015-2150 / XSA-120 *** --------------------------------------------- Non-maskable interrupts triggerable by guests --------------------------------------------- http://xenbits.xen.org/xsa/advisory-120.html *** Xen Security Advisory CVE-2015-2151 / XSA-123 *** --------------------------------------------- Hypervisor memory corruption due to x86 emulator flaw --------------------------------------------- http://xenbits.xen.org/xsa/advisory-123.html *** Xen Security Advisory XSA-124 *** --------------------------------------------- Non-standard PCI device functionality may render pass-through insecure --------------------------------------------- http://xenbits.xen.org/xsa/advisory-124.html *** Exploiting the DRAM "Row Hammer" Bug *** --------------------------------------------- IBM has determined that all IBM System z, System p, and System x products are not vulnerable to this attack. IBM is analyzing other IBM products to determine if they are potentially impacted by this issue. Please actively monitor both your IBM Support Portal for available fixes and/or remediation steps and this blog for additional information. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/exploiting_the_dram_r… *** Row Hammer Privilege Escalation Vulnerability *** --------------------------------------------- cisco-sa-20150309-rowhammer --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products *** --------------------------------------------- cisco-sa-20150310-ssl --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Varnish 4.0.3 heap-buffer-overflow while parsing backend server HTTP response *** --------------------------------------------- Topic: Varnish 4.0.3 heap-buffer-overflow while parsing backend server HTTP response Risk: High Text:Hi there, Latest varnish-cache 4.0.3 (https://www.varnish-cache.org/) seem to have a problem with parsing HTTP responses fro... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030056 *** Foxit Reader Update Service Unsafe Service Path Lets Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031879 *** Foxit Reader GIF File LZWMinimumCodeSize Memory Corruption Error Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1031878 *** Foxit Reader GIF File Ubyte Size Memory Corruption Error Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1031877 *** Red Hat Enterprise MRG Messaging Qpid Daemon Bugs Let Remote Users Deny Service and Access the System *** --------------------------------------------- http://www.securitytracker.com/id/1031872 *** Rails ActiveModel::Name Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031873 *** Security Advisory: MainWP-Child WordPress Plugin *** --------------------------------------------- Security Risk: Critical Exploitation level: Very Easy/Remote DREAD Score: 9/10 Vulnerability: Password bypass / Privilege Escalation Patched Version: 2.0.9.2 During a routine audit of our Website Firewall (WAF), we found a critical vulnerability affecting the popular MainWP Child WordPress plugin. According to worpdress.org, it is installed on more than 90,000 WordPress sites as as remote administration... --------------------------------------------- http://blog.sucuri.net/2015/03/security-advisory-mainwp-child-wordpress-plu… *** Google Analytics by Yoast 5.3.2 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7838 *** Fraction Theme <= 1.1.1 - Privilege Escalation via CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7840

1 0

Tageszusammenfassung - Montag 9-03-2015
by Daily end-of-shift report 09 Mar '15

09 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 06-03-2015 18:00 − Montag 09-03-2015 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** Attackers concealing malicious macros in XML files *** --------------------------------------------- XML files are harmless text files right? Wrong! The group behind the malicious Microsoft Office document campaigns have started to utilize Microsoft Office XML formats to hide malicious macros. This week, our spam traps were flooded with spam with XML... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Attackers-concealing-ma… *** Samba Remote Code Execution Vulnerability - CVE-2015-0240 *** --------------------------------------------- The Samba team reported CVE-2015-0240 last February 23, 2015. This vulnerability is very difficult to exploit and we are not aware of successful exploitation. However, it is quite interesting from the point for view of detection. There are two important facts: The vulnerability resides in the Netlogon Remote Protocol implementation of Samba which is a... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/samba-remote-cod… *** How Malware Generates Mutex Names to Evade Detection, (Mon, Mar 9th) *** --------------------------------------------- Malicious software sometimes uses mutex objects to avoid infecting the system more than once, as well as to coordinate communications among its multiple components on the host. Incident responders can look for known mutex names to spot the presence of malware on the system. To evade detection, some malware avoids using a hardcoded name for its mutex, as is the case with the specimen discussed in this note. Static Mutex Names as Indicators of Compromise For background details about mutex... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19429&rss *** New crypto ransomware in town : CryptoFortress *** --------------------------------------------- This post has been heavily edited to fix my mistake. --------------------------------------------- http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html *** Seagate Confirms NAS Zero Day, Won't Patch Until May *** --------------------------------------------- Seagate confirmed a publicly disclosed vulnerability in one of its network attached storage products, but said it wont have a patch available until May. --------------------------------------------- http://threatpost.com/seagate-confirms-nas-zero-day-wont-patch-until-may/11… *** OpenSSL Audit *** --------------------------------------------- IntroductionThe reputation built by NCC Group, including iSEC Partners, Matasano Security, Intrepidus Group and NGS Secure, has led compani ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/03/openssl-audit/ *** l+f: Vernetzte Wetterstation funkte WLAN-Passwort zum Hersteller *** --------------------------------------------- Die Netatmo-Wetterstationen schickten nicht nur ihre Messwerte ins Netz, sondern auch SSID und WLAN-Passwort des Nutzers. --------------------------------------------- http://heise.de/-2571218 *** Update - Notizen zu FREAK *** --------------------------------------------- In den letzten Tagen gab es wieder einmal große mediale Aufmerksamkeit für eine Schwachstelle in OpenSSL und anderen Crypto-Libraries. Der Eintrag für die zugehörige CVE-ID CVE-2015-0204 besteht seit November letzten Jahres, aktualisierte Versionen von OpenSSL wurden heuer im Jänner veröffentlicht. | Update 2015-03-09 | Ergänzung: Auflistungen betroffener Bibliotheken/Anbieter finden sich auf... --------------------------------------------- http://www.cert.at/services/blog/20150306175713-1442.html *** Mono TLS vulnerabilities *** --------------------------------------------- Topic: Mono TLS vulnerabilities Risk: Medium Text:Hi A TLS impersonation attack was discovered in Monos TLS stack by researchers at Inria. During checks on our TLS stack, w... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030042 *** IBM Security Bulletin: Multiple Vulnerabilities in the IBM Java SDK affect IBM Notes and Domino (Oracle January 2015 Critical Patch Update) *** --------------------------------------------- 2015-03-09T11:05:28-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21698222 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Worklight and IBM MobileFirst Platform Foundation (CVE-2014-3570, CVE-2014-3572, CVE-2015-0204) *** --------------------------------------------- 2015-03-09T11:04:47-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21698574 *** IBM Security Bulletin: Vulnerability in SSLv3 Affects Power Hardware Management Console (CVE-2014-3513, CVE-2014-3566, CVE-2014-3567, CVE-2014-3568) *** --------------------------------------------- 2015-03-09T11:01:43-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=nas8N1020593 *** IBM Security Bulletin: Vulnerability in SSLv3 enabled in IBM Host On-Demand affects Rational Functional Tester (CVE-2014-3566) *** --------------------------------------------- 2015-03-09T11:01:10-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697348 *** IBM Security Bulletin: Fixes available for Security Vulnerabilities in IBM WebSphere Portal (CVE-2014-6214; CVE-2015-0139; CVE-2015-0177) *** --------------------------------------------- 2015-03-09T11:10:19-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697213 *** HPSBUX03235 SSRT101750 rev.3 - HP-UX Running BIND, Remote Denial of Service (DoS) *** --------------------------------------------- A potential security vulnerability has been identified with HP-UX running BIND. This vulnerability could be exploited remotely to create a Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Vulnerabilities in WordPress Pluins *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7826 https://wpvulndb.com/vulnerabilities/7827 https://wpvulndb.com/vulnerabilities/7828 https://wpvulndb.com/vulnerabilities/7829 https://wpvulndb.com/vulnerabilities/7830 https://wpvulndb.com/vulnerabilities/7831 https://wpvulndb.com/vulnerabilities/7832 https://wpvulndb.com/vulnerabilities/7833 https://wpvulndb.com/vulnerabilities/7834 https://wpvulndb.com/vulnerabilities/7835 https://wpvulndb.com/vulnerabilities/7836 https://wpvulndb.com/vulnerabilities/7837

1 0

Tageszusammenfassung - Freitag 6-03-2015
by Daily end-of-shift report 06 Mar '15

06 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 05-03-2015 18:00 − Freitag 06-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Oracle hängt Adware an den Java-Installer für Mac OS X *** --------------------------------------------- Bei der Installation von Java wird nun auch Mac-Nutzern Adware angedreht - dabei handelt es sich aktuell um eine Browser-Erweiterung. --------------------------------------------- http://heise.de/-2568995 *** Intuit Failed at 'Know Your Customer' Basics *** --------------------------------------------- Intuit, the makers of TurboTax, recently introduced several changes to beef up the security of customer accounts following a spike in tax refund fraud at the state and federal level. Unfortunately, those changes dont go far .. --------------------------------------------- http://krebsonsecurity.com/2015/03/intuit-failed-at-know-your-customer-basi… *** Why A Free Obfuscator Is Not Always Free. *** --------------------------------------------- We all love our code but some of us love it so much that we don't want anyone else to read or understand it. When you think about it, that's understandable - hours and hours of hard dev work, days of testing and weeks .. --------------------------------------------- http://blog.sucuri.net/2015/03/why-a-free-obfuscator-is-not-always-free.html *** Cisco IOS Autonomic Networking Infrastructure Self-Referential Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Contact Form DB 2.8.29 - CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7826 *** Cisco IOS Software and Cisco IOS XE Software Crafted RADIUS Packet Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco IOS XR Software Malformed SNMP Packet Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Freak: Auch Windows von SSL-Lücke betroffen *** --------------------------------------------- Deutlich mehr Clients gefährdet als bisher angenommen - Neben Android und iOS auch Opera unter Linux .. --------------------------------------------- http://derstandard.at/2000012569585 *** Internetdienst Onlinetvrecorder.com gehackt *** --------------------------------------------- Der Internet-Aufnahmedienst Onlinetvrecorder.com ist Opfer eines Hackangriffes geworden. Der Anbieter empfiehlt allen Nutzern, ihr Passwort zu ändern. --------------------------------------------- http://heise.de/-2569350 *** Multiple vulnerabilities in Siemens products *** --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-064-01 https://ics-cert.us-cert.gov//advisories/ICSA-15-064-02 https://ics-cert.us-cert.gov//advisories/ICSA-15-064-03 https://ics-cert.us-cert.gov//advisories/ICSA-15-064-04 https://ics-cert.us-cert.gov//advisories/ICSA-15-064-05 *** Verbraucherschützer warnen vor falschen E-Mails von Paketdiensten *** --------------------------------------------- Links führen laut deutscher Verbraucherzentrale zu Schadsoftware - Falsche Mails nutzen Namen von DHL und UPS --------------------------------------------- http://derstandard.at/2000012593805 *** Powerspy: Stalking über den Akkuverbrauch *** --------------------------------------------- Statt über Bluetooth und per GPS lassen sich Smartphone-Benutzer auch anhand ihres Akkuverbrauchs verfolgen. Powerspy macht's möglich. --------------------------------------------- http://www.golem.de/news/powerspy-stalking-ueber-den-akkuverbrauch-1503-112… *** Adobe drückt sich vor Finderlohn für gemeldete Lücken *** --------------------------------------------- Wer Lücken im Adobe Reader, Flash und Co. findet, kann diese jetzt über ein Belohnungsprogramm an den Hersteller melden. Eine geldwerte Belohnung gibt es allerdings nicht – zumindest nicht von Adobe. --------------------------------------------- http://heise.de/-2569878 *** The Ongoing Debate about the Gap between Compliance and Security *** --------------------------------------------- Companies required to comply with the Payment Card Industry Data Security Standard (PCI DSS) must meet a wide range of technical and operation requirements. The challenge organizations face regarding PCI compliance has shifted from achieving the minimum level required to satisfy PCI audit .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/the-ongoing-debate-abo…

1 0

Tageszusammenfassung - Donnerstag 5-03-2015
by Daily end-of-shift report 05 Mar '15

05 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 04-03-2015 18:00 − Donnerstag 05-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** MICROSYS PROMOTIC Stack Buffer Overflow *** --------------------------------------------- This advisory provides mitigation details for a stack-based buffer overflow vulnerability in the MICROSYS, spol. s r.o. PROMOTIC application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-062-01 *** Adobe Launches Web Application Vulnerability Disclosure Program on HackerOne *** --------------------------------------------- In recognition of the important role that independent security researchers play in keeping Adobe customers safe, today Adobe launches a web application .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1179 *** SA-CONTRIB-2015-063 - Webform - Cross Site Scripting (XSS) *** --------------------------------------------- The module doesn't sufficiently escape user data presented to administrative users in the webform results table. This issue affects the 7.x-4.x branch only. This vulnerability is mitigated by the fact that an attacker .. --------------------------------------------- https://www.drupal.org/node/2445935 *** Cisco IOS XR Software Malformed RSVP Packet Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco Secure Access Control Server Default Tomcat Administration Interface Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Toshiba Bluetooth Stack Untrusted Service Path Lets Local Users Gain System Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031825 *** BIND DNSSEC Guide *** --------------------------------------------- ISC has new documentation introducing DNSSEC, configuring BIND for common DNSSEC features, and basic DNSSEC troubleshooting. ISCs BIND DNSSEC Guide, co-written with DeepDive Networking, covers DNSSEC requirements, setting up a validating resolver, maintaining signed authoritative zones, and .. --------------------------------------------- http://users.isc.org/~jreed/dnssec-guide/dnssec-guide.html *** SANS ICS410 Vienna *** --------------------------------------------- SANS presents the essential ICS/SCADA training course, ICS410 ICS Security Essentials. This specialist training event is running with the support of the International Atomic Energy Agency (IAEA) and follows the IAEAs International Conference on Computer Security in a Nuclear World which takes place the preceding week in Vienna. --------------------------------------------- https://www.sans.org/event/ics410-vienna-with-iaea *** Malware "Casper": Wie die Franzosen in Syrien spionieren *** --------------------------------------------- Sicherheitsforscher analysieren Schadprogramm, das wohl von Frankreichs Geheimdiensten eingesetzt wird --------------------------------------------- http://derstandard.at/2000012513213 *** Format Injection Vulnerability in Duo Security Web SDK *** --------------------------------------------- Format Injection is not a new bug, but it was never described as a subclass of A1 Injection. You probably already hate me for giving it a name (at least I didn't create a logo!) but calling it an 'injection' is too general. --------------------------------------------- http://sakurity.com/blog/2015/03/03/duo_format_injection.html *** The State Of The Internet *** --------------------------------------------- One great idea behind the internet is to connect devices from nearly every position on earth. Well, this idea sometimes has its drawbacks. In order to get an overview about devices that are actually connected, the University of .. --------------------------------------------- https://splone.com/blog/2015/3/4/the-state-of-the-internet *** Schutz vor Freak Attack: Diese Browser sind betroffen *** --------------------------------------------- Der Freak-Angriff kompromittiert unzählige verschlüsselte Webseiten und Angreifer könnten sensible Daten ausspionieren. Ob man für die Attacke anfällig ist, hängt aber vom eingesetzten Betriebssystem, Webbrowser und der besuchten Internetseite ab. --------------------------------------------- http://heise.de/-2567655 *** OpenSSL Cookbook 2nd Edition released *** --------------------------------------------- Today we're releasing the second edition of OpenSSL Cookbook, Feisty Ducks free OpenSSL book. This edition is a major update, with some improvements to the existing text and new content added. The new edition has about 95 pages, an increase of about 35 pages. --------------------------------------------- http://blog.ivanristic.com/2015/03/openssl-cookbook-second-edition-released… *** Utilizing NLP To Detect APT in DNS *** --------------------------------------------- Imagine that after a nice, relaxing long weekend, you come in to work Monday morning at your job at the bank. While waking up with a cup of coffee, you begin checking email. Among the usual messages, there's a message about a security update and you click it. Security updates are so common these days that it's .. --------------------------------------------- https://labs.opendns.com/2015/03/05/nlp-apt-dns/ *** l+f: Abgelaufenes SSL-Zertifikat bei Visa *** --------------------------------------------- Wenn der Browser beim Besuch von Visa.de einen Zertifikatswarnung anzeigt, kann ein Angriff im Gange sein – oder der Admin hat vergessen, wann das Zertifikat abläuft. --------------------------------------------- http://heise.de/-2568054 *** VB2014 paper: Leaving our ZIP undone: how to abuse ZIP to deliver malware apps *** --------------------------------------------- Gregory Panakkal explains there are different ways of looking at APK files - and that sometimes has unintended consequences.Since the close of the VB2014 conference in Seattle in October, we have been sharing VB2014 conference papers as well as video recordings of the presentations. Today, we .. --------------------------------------------- http://www.virusbtn.com/blog/2015/03_05.xml *** Domain Trusts: Why You Should Care *** --------------------------------------------- Red teams have been abusing Windows domain trusts for years with great success, but the topic is still underrepresented in public infosec discussions. While the community has started to talk more about Active Directory .. --------------------------------------------- http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/ *** Decoding ZeuS Disguised as an .RTF File *** --------------------------------------------- While going through emails that were reported by our internal users using Reporter, I came across a particularly nasty looking phishing email that had a .doc attachment. At first when I detonated the sample in my VM, it seemed that the attackers weaponized the attachment incorrectly. .. --------------------------------------------- http://phishme.com/decoding-zeus-disguised-as-an-rtf-file/

1 0

Tageszusammenfassung - Mittwoch 4-03-2015
by Daily end-of-shift report 04 Mar '15

04 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 03-03-2015 18:00 − Mittwoch 04-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Datensicherheit: Smartphones sollen sicherer werden - zumindest ein bisschen *** --------------------------------------------- Wie lassen sich mobile Geräte wenn schon nicht sicher, dann zumindest weniger unsicher machen? In Barcelona stellen Silent Circle, Jolla und Qualcomm ihre Ideen vor. --------------------------------------------- http://www.golem.de/news/datensicherheit-smartphones-sollen-sicherer-werden… *** phpMoAdmin 0-day Nmap Script *** --------------------------------------------- An 0-day vulnerability has been posted on Full-Disclosure this morning. It affects the MongoDB GUI phpMoAdmin. The GUI is similar to the well-known phpMyAdmin and allows the DB administrator to perform maintenance tasks on the .. --------------------------------------------- http://blog.rootshell.be/2015/03/04/phpmoadmin-0-day-nmap-script/ *** Freak Attack: SSL-Verschlüsselung von Millionen Webseiten angreifbar *** --------------------------------------------- Wenn Nutzer von Apple- und Android-Geräten eine der Millionen für den Angriff Freak anfälligen Webseiten ansurfen, kann ein Man-in-the-Middle die verschlüsselten Verbindungen knacken. Angreifer können nicht nur Daten mitlesen, sondern auch manipulieren. --------------------------------------------- http://heise.de/-2566444 *** CryptoFortress : Teerac.A (aka TorrentLocker) got a new identity *** --------------------------------------------- Blitz post. I was hunting for Gootkit (pushed in a Nuclear Pack instance in France those days) but instead I got a Teerac.A. --------------------------------------------- http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html *** SuperFish SSL Sniffing *** --------------------------------------------- Let's start off by saying that SuperFish may top Adobe's ColdFusion un-authenticated remote code executions versions 6-10. Although, Adobe may not have put those vulnerabilities in there themselves and knowingly, Lenovo has no excuse. --------------------------------------------- http://pashakravtsov.com/2015/03/03/SuperFish-SSL-Sniffing/ *** Forensik-Training: Shellshock-Hinweise in Serverlogs aufspüren *** --------------------------------------------- Die europäische Sichereitsbehörde ENISA hat ihr Trainingsmaterial für netzwerkforensische Analysen aktualisiert und um neue Themen ergänzt. --------------------------------------------- http://heise.de/-2566554 *** Threat Spotlight: Angler Lurking in the Domain Shadows *** --------------------------------------------- Over the last several months Talos researchers have been monitoring a massive exploit kit campaign that is utilizing hijacked registrant accounts to create large amounts .. --------------------------------------------- http://blogs.cisco.com/security/talos/angler-domain-shadowing *** A Few Thoughts on Cryptographic Engineering *** --------------------------------------------- This is the story of how a handful of cryptographers hacked the NSA. Its also a story of encryption backdoors, and why they never quite work out the way you want them to. --------------------------------------------- http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-fac… *** Google: Chrome-Support für Android 4.0 wird eingestellt *** --------------------------------------------- Der Chrome-Browser wird für Android 4.0 nur noch wenige Wochen mit Updates versorgt. Nach Version 42 wird der Support beendet. Der steigende Wartungsaufwand für das dreieinhalb Jahre alte Android sei nicht mehr gerechtfertigt, sagt Google. --------------------------------------------- http://www.golem.de/news/google-chrome-support-fuer-android-4-0-wird-einges… *** Skyfall Meets Skype *** --------------------------------------------- The portmanteau-named SKYPEFALL.EXE is the latest, very active, malware-spamming campaign spreading through Skype. --------------------------------------------- http://securelist.com/blog/incidents/69065/skyfall-meets-skype/

1 0

Tageszusammenfassung - Dienstag 3-03-2015
by Daily end-of-shift report 03 Mar '15

03 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 02-03-2015 18:00 − Dienstag 03-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Ads Gone Bad *** --------------------------------------------- FireEye Labs tracks malvertising activity and recently discovered hundreds of sites that may have been exposed to malvertisements via abuse of ad networks that use real-time bidding (RTB). Since February 4, 2015, FireEye Labs has seen over 1,700 advertiser RTB requests that resulted in downloading of malicious SWF files. We believe this activity is part of an active malvertising operation. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/03/ads_gone_bad.html *** D-Link Routers Haunted by Remote Command Injection Bug *** --------------------------------------------- Some D-Link routers contain a vulnerability that leaves them open to remote attacks that can give an attacker root access, allow DNS hijacking and other attacks. The vulnerability affects affects a number of D-Link's home routers and the key .. --------------------------------------------- http://threatpost.com/d-link-routers-haunted-by-remote-command-injection-bu… *** Older Keen Team Use-After-Free IE Exploit Added to Angler Exploit Kit *** --------------------------------------------- Attackers behind one of the more popular exploit kits, Angler, have added a tweaked version of an exploit from last fall, a use after free vulnerability in Microsofts Internet Explorer browser. --------------------------------------------- http://threatpost.com/older-keen-team-use-after-free-ie-exploit-added-to-an… *** How to keep your Smart Home safe *** --------------------------------------------- The Internet of Things (IoT) devices can help you save time and hassle and improve your quality of life. As an example, you can check the contents of your fridge and turn on the oven while at the grocery store thus saving money, uncertainty, and .. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002792.html *** Symantec NetBackup OpsCenter Server Javascript Injection RCE *** --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** SSH-Client Putty: Fast vergessene Sicherheitslücke geschlossen *** --------------------------------------------- Der Schöpfer von Putty entschuldigt sich dafür, eine Sicherheitslücke erst nach eineinhalb Jahren vollständig geschlossen zu haben und ergänzt die neue Version um weitere Bugfixes und zwei neue Funktionen. --------------------------------------------- http://heise.de/-2563230 *** SA-CONTRIB-2015-050 - Services Basic Authentication - Access bypass *** --------------------------------------------- https://www.drupal.org/node/2428851 *** New gTLD Portals Taken Offline by ICANN Due to Security Flaw *** --------------------------------------------- The Internet Corporation for Assigned Names and Numbers (ICANN) shut down two new generic top-level domain (gTLD) portals on February 27 after learning of a vulnerability that could have been exploited to view users' data. --------------------------------------------- http://www.securityweek.com/new-gtld-portals-taken-offline-icann-due-securi… *** Cyber criminals target call center operators in Apple Pay fraud schema *** --------------------------------------------- Cybercriminals are targeting call centers operators in Apple Pay fraud to circumvent the checks implemented by Apple, banks and card issuers. The security expert Cherian Abraham revealed a spike in the fraud on Apple's .. --------------------------------------------- http://securityaffairs.co/wordpress/34359/cyber-crime/apple-pay-fraud.html *** Captcha <= 4.0.6 - Captcha Bypass *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7822 *** Financial Trojans in 2014: Takedowns contributed to 53 percent drop in infections, but threat is still prevalent *** --------------------------------------------- While the number of financial Trojan detections decreased in 2014, the threat was still .. --------------------------------------------- http://www.symantec.com/connect/blogs/financial-trojans-2014-takedowns-cont… *** phpMoAdmin Zero-day Vulnerability Puts Websites Using MongoDB at Risk *** --------------------------------------------- About two weeks back, over 40,000 organizations running MongoDB were found unprotected and vulnerable to hackers. Now, once again the users of MongoDB database are at risk because of a critical zero-day vulnerability making .. --------------------------------------------- http://thehackernews.com/2015/03/phpMoAdmin-mongoDB-exploit.html *** Ted Unangst: OpenBSD will Browser sicherer machen *** --------------------------------------------- Mindestens ein Webbrowser soll durch die Umsetzung einer Speicherrichtlinie aus OpenBSD abgesichert werden. Dafür bezahlt die Stiftung des Betriebssystems einen Entwickler mit Erfahrung bei Libressl. --------------------------------------------- http://www.golem.de/news/ted-unangst-openbsd-will-browser-sicherer-machen-1… *** Thanks for the Memories: Identifying Malware from a Memory Capture *** --------------------------------------------- Weve all seen attackers try and disguise their running malware as something legitimate. They might use a file name of a legitimate Windows file or even inject code into a legitimate process thats already running. Regardless of how its done, that code has to run, which means it has to be in memory. Somewhere. --------------------------------------------- http://www.contextis.com/resources/blog/thanks-memories-identifying-malware… *** LogPOS - New Point of Sale Malware Using Mailslots *** --------------------------------------------- There has been an explosion in POS malware in the last year. At Morphick, Jeremy Humble and I found 2 undiscovered families in 2014 and we just found our first new family of 2015. This new malware which were calling .. --------------------------------------------- http://morphick.com/blog/2015/2/27/mailslot-pos *** Change to Lollipop Encryption Policy May Not Have Much Effect, Experts Say *** --------------------------------------------- Google has made a subtle, but important, shift in the requirements for Android handset makers, saying now that OEMs manufacturing phones that will run Lollipop do not have to enable disk encryption by default. This is a major change from the .. --------------------------------------------- http://threatpost.com/change-to-lollipop-encryption-policy-may-not-have-muc… *** Cisco Network Analysis Module Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Montag 2-03-2015
by Daily end-of-shift report 02 Mar '15

02 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 27-02-2015 18:00 − Montag 02-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Abusing Blu-ray Players Pt. 1 - Sandbox Escapes *** --------------------------------------------- tl;drIn today's (28 February) closing keynote talk at the Abertay Ethical Hacking Society's Secuir-Tay conference I discussed how it was po ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/02/abusing-blu-ray-players-pt-1-sandb… *** dnstest - Monitor Your DNS for Hijacking *** --------------------------------------------- In light of the latest round of attacks against and/or hijacking of DNS, it occurred to me that most people really don't know what to do about it. More importantly, many companies don't even notice they've been attacked until a customer complains. Especially for smaller companies who may not have as many customers, or only... --------------------------------------------- https://blog.whitehatsec.com/dnstest-monitor-your-dns-for-hijacking/ *** Virtualization Incident Response *** --------------------------------------------- Virtualization is a game changer, this session looks at the new world of virtualization and the impact on Incident Response & Computer Forensics. Details include answers to several important questions: Is forensics more difficult or perhaps actually easier in the virtual realm? What do I image if the Data Store has PI from 200 different companies on it that are not subjects to the investigation? Where are virtual machine files stored? What files are of forensic value? What about all of... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/02/27/virtualization-incid… *** TorrentLocker campaign uses email authentication to tune the operations *** --------------------------------------------- The emails of a new TorrentLocker campaign use Domain-based Message Authentication, Reporting and Conformance (DMARC) to avoid detection and collect data. Cyber criminals are continuously improving the technique to spread malicious code and avoid detection systems. Recently security experts at Trend Micro noticed an improvement in the evasion techniques implemented by malware authors to spread the... --------------------------------------------- http://securityaffairs.co/wordpress/34268/cyber-crime/new-torrentlocker-cam… *** The Rmnet botnet is very much alive! *** --------------------------------------------- February 27, 2015 Despite the numerous reports of news agencies that Europol held massive operation to stop the Rmnet botnet, Doctor Webs analysts continue to monitor this botnets activity. According to the media reports, the staff of British polices office engaged in combating cyber crimes, together with experts from Germany, Italy and the Netherlands, has suppressed the activity of several major Rmnets command and control servers. According to the news reports, on February 24, 2015 command... --------------------------------------------- http://news.drweb.com/show/?i=9310&lng=en&c=9 *** The return of the dangerous Trojan for Mac OS X *** --------------------------------------------- February 27, 2015 Doctor Web analysts conducted a research of a new version of the backdoor Trojan for Mac OS X named Mac.BackDoor.OpinionSpy.3. This malicious program is intended to spy on Mac users: it can collect and transmit information about loaded web pages to the attackers, analyze the traffic passing through the computers network card, intercept the network packets sent by instant messaging programs and perform some other dangerous features. Mac.BackDoor.OpinionSpy programs have been... --------------------------------------------- http://news.drweb.com/show/?i=9309&lng=en&c=9 *** OWASP ProActive Controls: Part 1 *** --------------------------------------------- What is OWASP ProActive Controls? In one line, this project can be explained as "Secure Coding Practices by Developers for Developers". OWASP ProActive Controls is a document prepared for developers who are developing or are new to developing software/application with secure software development. This OWASP project lists 10 controls that can help a developer implement... --------------------------------------------- http://resources.infosecinstitute.com/owasp-proactive-controls-part-1/ *** Xen Hypervisor Flaws Force Amazon, Rackspace to Reboot Servers (SecurityWeek) *** --------------------------------------------- Rackspace, Amazon, Linode and likely other cloud providers will reboot some of their servers over the next week after they patch several vulnerabilities affecting the Xen open-source hypervisor. --------------------------------------------- http://www.securityweek.com/xen-hypervisor-flaws-force-amazon-rackspace-reb… *** Zero-Day-Lücken in Seagates Business NAS *** --------------------------------------------- Wer ein Business-NAS von Seagate nutzt, sollte sicherstellen, dass es nicht über das Internet erreichbar ist. Im Webinterface klaffen kritische Lücken, zu denen bereits ein passender Exploit kursiert. --------------------------------------------- http://heise.de/-2563240 *** Cisco ACE 4710 Application Control Engine and Application Networking Manager Cross-Site Request Forgery Vulnerability *** --------------------------------------------- CVE-2015-0651 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco Unified Web Interaction Manager Cross-Site Scripting Vulnerability *** --------------------------------------------- CVE-2015-0655 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** IBM Security Bulletin: A page in IBM Curam Universal Access contains a risk of Sensitive Information Exposure(CVE-2014-4804) *** --------------------------------------------- 2015-02-27T18:10:56-05:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21695931 *** Jetty 9.2.8 Shared Buffer Leakage *** --------------------------------------------- Topic: Jetty 9.2.8 Shared Buffer Leakage Risk: High Text:GDS LABS ALERT: CVE-2015-2080 JetLeak Vulnerability Remote Leakage Of Shared Buffers In Jetty Web Server SYNOPSIS == Go... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015020151 *** Apache Standard Taglibs 1.2.1 XXE / Remote Command Execution *** --------------------------------------------- Topic: Apache Standard Taglibs 1.2.1 XXE / Remote Command Execution Risk: High Text:CVE-2015-0254 XXE and RCE via XSL extension in JSTL XML tags Severity: Important Vendor: The Apache Software Foundation ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015020154 *** HPSBST03274 rev.1 - HP XP P9000 Command View Advanced Edition Software Online Help for Windows and Linux, Remote Cross-site Scripting (XSS) *** --------------------------------------------- Potential security vulnerabilities have been identified with HP XP P9000 Command View Advanced Edition Software Online Help for Windows and Linux. The vulnerabilities could be exploited resulting in remote Cross-site scripting (XSS). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** IP Blacklist Cloud - SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7816 *** WP-ViperGB 1.3.10 - XSS Weakness and CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7817

1 0

Tageszusammenfassung - Freitag 27-02-2015
by Daily end-of-shift report 27 Feb '15

27 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 26-02-2015 18:00 − Freitag 27-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** #JetLeak: Jetty-Webserver gibt Verbindungsdaten preis *** --------------------------------------------- Der Jetty-Server steckt unter anderem in Hadoop, Heroku, Eclipse und der Google AppEngine. Angreifer können eine jetzt entdeckte Lücke dazu nutzen, Daten aus den Verbindungen anderer Nutzer auszuspionieren. --------------------------------------------- http://heise.de/-2560894 *** Spam Uses Default Passwords to Hack Routers *** --------------------------------------------- In case you needed yet another reason to change the default username and password on your wired or wireless Internet router: Phishers are sending out links that, when clicked, quietly alter the settings on vulnerable routers to harvest online banking credentials and other sensitive data from victims. Sunnyvale, Calif. based security firm Proofpoint said it recently detected a four-week spam... --------------------------------------------- http://krebsonsecurity.com/2015/02/spam-uses-default-passwords-to-hack-rout… *** Adventures in Xen exploitation *** --------------------------------------------- tl;drThis post is about my experience trying to exploit the Xen SYSRET bug (CVE-2012-0217).This issue was patched in June 2012 and was dis ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/02/adventures-in-xen-exploitation/ *** Sicherheits-Tool PrivDog telefoniert nach Hause - unverschlüsselt *** --------------------------------------------- Das vermeintliche Sicherheits-Tool PrivDog steht erneut in der Kritik, denn es sendet alle besuchten URLs unverschlüsselt an den Hersteller. --------------------------------------------- http://heise.de/-2560926 *** Dridex Downloader Analysis *** --------------------------------------------- Introduction Yesterday I received in my company inbox an email with an attached .xlsm file named D92724446.xlsm coming from Clare588(a)78-83-77-53.spectrumnet.bg. Central and local AV engines did not find anything malicious, and a multiengine scan got 0/57 as result. I decided to investigate a little more in-depth in order to confirm that was a malicious file... --------------------------------------------- http://resources.infosecinstitute.com/dridex-downloader-analysis/ *** D-Link remote access vulnerabilities remain unpatched *** --------------------------------------------- D-Link routers have several unpatched vulnerabilities, the worst of which could allow an attacker to gain total control over a device, according to a systems engineer in Canada. Peter Adkins, who does security research in his free time, released details of the flaws on Thursday. Adkins said in a phone interview that he has been in intermittent contact with D-Link since Jan. 11 on the issues, but the company has not indicated when it might patch. --------------------------------------------- http://www.cio.com/article/2889994/dlink-remote-access-vulnerabilities-rema… *** Microsoft Malware Protection Center assists in disrupting Ramnit *** --------------------------------------------- Recent disruption of the Ramnit malware family was successful due to a multinational collaboration, led by Europol's European Cybercrime Center (EC3), in partnership with Financial Services and Information Sharing & Analysis Center (FS-ISAC), Symantec, AnubisNetworks, Microsoft's Digital Crimes Unit (DCU), and the Microsoft Malware Protection Center (MMPC). The MMPC has been closely monitoring Ramnit since its discovery in April 2010, as you can see by reading: Ramnit - The... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/02/25/microsoft-malware-protec… *** The Evil CVE: CVE-666-666 - "Report Not Read" *** --------------------------------------------- I had an interesting discussion with a friend this morning. He explained that, when he is conducting a pentest, he does not hesitate to add sometimes in his report a specific finding regarding the lack of attention given to the previous reports. If some companies are motivated by good intentions and ask for regular pentests against their infrastructure or a specific application, what if they even don't... --------------------------------------------- http://blog.rootshell.be/2015/02/26/the-evil-cve-cve-666-666-report-not-rea… *** Weekly Metasploit Wrapup *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2015/02/26/weekly-me… *** Threatpost News Wrap, February 27, 2015 *** --------------------------------------------- Mike Mimoso and Dennis Fisher discuss the news of the last week, including the Superfish fiasco, the Gemalto SIM hack controversy and the continuing NSA drama. --------------------------------------------- http://threatpost.com/threatpost-news-wrap-february-27-2015/111312 *** VMSA-2015-0001.1 *** --------------------------------------------- VMware vCenter Server, ESXi, Workstation, Player, and Fusion updates address security issues --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0001.html *** Security Advisory: BIG-IP ASM cross-site scripting (XSS) vulnerability CVE-2015-1050 *** --------------------------------------------- (SOL16081) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/000/sol16081.htm… *** Security Advisory: OpenSSL vulnerability CVE-2014-0160 *** --------------------------------------------- (SOL15159) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/100/sol15159.htm… *** Security Advisory: XSS vulnerability in echo.jsp CVE-2014-4023 *** --------------------------------------------- (SOL15532) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/500/sol15532.htm… *** Cisco Security Notices *** --------------------------------------------- *** Vulnerability in IPv6 Neighbor Discovery in Cisco IOS and IOS-XE Software *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Vulnerability in Authentication Proxy Feature in Cisco IOS Software *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Common Services Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco ACE 4710 Application Control Engine and Application Neworking Manager Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- *** DSA-3176 request-tracker4 - security update *** --------------------------------------------- Multiple vulnerabilities have been discovered in Request Tracker, anextensible trouble-ticket tracking system. The Common Vulnerabilitiesand Exposures project identifies the following problems: --------------------------------------------- https://www.debian.org/security/2015/dsa-3176 *** Network Vision IntraVue Code Injection Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a code injection vulnerability in Network Vision's IntraVue software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-057-01 *** [2015-02-27] Multiple vulnerabilities in Loxone Smart Home *** --------------------------------------------- Multiple design and implementation flaws within Loxone Smart Home enable an attacker to control arbitrary devices connected to the system, execute JavaScript code in the users browser, steal the users credentials and cause a denial of service. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** TYPO3 CMS 6.2.10 released *** --------------------------------------------- The TYPO3 Community announces the version 6.2.10 LTS of the TYPO3 Enterprise Content Management System. --------------------------------------------- http://www.typo3.org/news/article/typo3-cms-6210-released/ *** IBM Security Bulletin: Rational Integration Tester component in Rational Test Workbench affected by Netty vulnerability (CVE-2014-3488) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21695042 *** IBM Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server affected by Castor Library vulnerablity (CVE-2014-3004) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21695037 --------------------------------------------- *** Huge-IT Slider - SQL Injection *** https://wpvulndb.com/vulnerabilities/7811 *** CrossSlide jQuery Plugin <= 2.0.5 - Stored XSS & CSRF *** https://wpvulndb.com/vulnerabilities/7812 *** WPBook - CSRF *** https://wpvulndb.com/vulnerabilities/7813 *** WPBook <= 2.7 - Cross-Site Request Forgery (CSRF) *** https://wpvulndb.com/vulnerabilities/7813 *** WP Media Cleaner <= 2.2.6 - Cross-Site Scripting (XSS) *** https://wpvulndb.com/vulnerabilities/7814 ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 26-02-2015
by Daily end-of-shift report 26 Feb '15

26 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 25-02-2015 18:00 − Donnerstag 26-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** 2014 Spam Landscape: UPATRE Trojan Still Top Malware Attached to Spam *** --------------------------------------------- The malware UPATRE was first spotted in August 2013 following the demise of the Blackhole Exploit kit. It was since known as one of the top malware seen attached to spammed messages and continues to be so all throughout 2014 with particularly high numbers seen in the fourth quarter of the year. We have released... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/jUSb_mMOQCc/ *** Webnic Registrar Blamed for Hijack of Lenovo, Google Domains *** --------------------------------------------- Two days ago, attackers allegedly associated with the fame-seeking group Lizard Squad briefly hijacked Googles Vietnam domain (google.com.vn). On Wednesday, Lenovo.com was similarly attacked. Sources now tell KrebsOnSecurity that both hijacks were possible because the attackers seized control over Webnic.cc, the Malaysian registrar that serves both domains and 600,000 others. --------------------------------------------- http://krebsonsecurity.com/2015/02/webnic-registrar-blamed-for-hijack-of-le… *** Why Websites Get Hacked *** --------------------------------------------- I spend a good amount of time engaging with website owners across a broad spectrum of businesses. Interestingly enough, unless I'm talking large enterprise, there is a common question that often comes up: Why would anyone ever hack my website? Depending on who you are, the answer to this can vary. Nonetheless, it often revolves... --------------------------------------------- http://blog.sucuri.net/2015/02/why-websites-get-hacked.html *** 5 New Vulnerabilities Uncovered In SAP *** --------------------------------------------- ERP security researchers at Onapsis have discovered five new vulnerabilities in SAP BusinessObjects and SAP HANA, three of them high-risk. One in particular gives attackers the power to overwrite data within mission-critical systems. --------------------------------------------- http://www.darkreading.com/application-security/5-new-vulnerabilities-uncov… *** Electronic Arts Origin Client 9.5.5 Multiple Privilege Escalation Vulnerabilities *** --------------------------------------------- Title: Electronic Arts Origin Client 9.5.5 Multiple Privilege | Escalation Vulnerabilities | Advisory ID: ZSL-2015-5231 | Type: Local | Impact: Privilege Escalation | Risk: (3/5) | Release Date: 26.02.2015 --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5231.php *** Ubisoft Uplay 5.0 Insecure File Permissions Local Privilege Escalation *** --------------------------------------------- Title: Ubisoft Uplay 5.0 Insecure File Permissions Local Privilege | Escalation | Advisory ID: ZSL-2015-5230 | Type: Local | Impact: Privilege Escalation | Risk: (2/5) | Release Date: 25.02.2015 --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5230.php *** HPSBUX03273 SSRT101951 rev.1 - HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities *** --------------------------------------------- Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04580241 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04580241 Version: 1 HPSBUX03273 SSRT101951 rev.1 - HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBUX03244 SSRT101885 rev.2 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilites *** --------------------------------------------- Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04556853 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04556853 Version: 2 HPSBUX03244 SSRT101885 rev.2 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilites --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM Sterling Connect:Direct File Agent (CVE-2014-3065, CVE-2014-6468) *** --------------------------------------------- 2015-02-26T11:42:30-05:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21696580 *** Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution (CVE-2014-3566, CVE-2014-6558) *** --------------------------------------------- 2015-02-25T12:49:31-05:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697112 *** Security Advisory-Multiple Vulnerabilities on Huawei Tecal Server Products *** --------------------------------------------- Feb 26, 2015 09:44 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory-Glibc Buffer Overflow Vulnerability *** --------------------------------------------- Feb 26, 2015 16:35 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** EasyCart 1.1.30 - 3.0.20 - Privilege Escalation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7808 *** WP All Import Pro <= 4.1.0 - RCE *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7810 *** WP All Import <= 3.2.3 - RCE *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7809 *** Security Advisories for Drupal Third-Party Modules *** --------------------------------------------- *** SA-CONTRIB-2015-062 - Watchdog Aggregator - Cross Site Request Forgery (CSRF) - Unsupported *** https://www.drupal.org/node/2437993 *** SA-CONTRIB-2015-061 - Ubercart Webform Integration - Cross Site Scripting (XSS) - Unsupported *** https://www.drupal.org/node/2437991 *** SA-CONTRIB-2015-060 - Custom Sitemap - Cross Site Request Forgery (CSRF) - Unsupported *** https://www.drupal.org/node/2437985 *** SA-CONTRIB-2015-059 - Spider Video Player - Multiple vulnerabilities - Unsupported *** https://www.drupal.org/node/2437981 *** SA-CONTRIB-2015-058 - Spider Catalog - Cross Site Request Forgery (CSRF) - Unsupported *** https://www.drupal.org/node/2437977 *** SA-CONTRIB-2015-057 - Spider Contacts - Multiple vulnerabilities - Unsupported *** https://www.drupal.org/node/2437973 *** SA-CONTRIB-2015-056 - inLinks Integration - Cross Site Scripting (XSS) - Unsupported *** https://www.drupal.org/node/2437969 *** SA-CONTRIB-2015-055 - Services single sign-on server helper - Open Redirect - Unsupported *** https://www.drupal.org/node/2437965 *** SA-CONTRIB-2015-054 - SMS Framework - Cross Site Scripting (XSS) *** https://www.drupal.org/node/2437943 *** SA-CONTRIB-2015-053 - Entity API - Cross Site Scripting (XSS) *** https://www.drupal.org/node/2437905 *** SA-CONTRIB-2015-041 - Feature Set - Cross Site Request Forgery (CSRF) *** https://www.drupal.org/node/2424409 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 25-02-2015
by Daily end-of-shift report 25 Feb '15

25 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 24-02-2015 18:00 − Mittwoch 25-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Security Advisory - WP-Slimstat 3.9.5 and lower *** --------------------------------------------- Advisory for: WP-Slimstat Security Risk: Very high Exploitation level: Remote DREAD Score: 8/10 Vulnerability: Weak Cryptographic keys leading to SQL injections Patched Version: 3.9.6 WP-Slimstat's users should update as soon as possible! During a routine audit for our WAF, we discovered a security bug that an attacker could, by breaking the plugin's weak "secret" key, use to perform a SQL... --------------------------------------------- http://blog.sucuri.net/2015/02/security-advisory-wp-slimstat-3-9-5-and-lowe… *** Finding Unknown Malware *** --------------------------------------------- If you have ever been given the mission to "Find Evil" on a compromised system, you understand the enormity of that tasking. In this technical presentation, Alissa will introduce sound methodology for identifying malware, using strategies based on "Knowing Normal", "Data Reduction" and "Least Frequency of Occurrence" in order to identify malicious binaries and common methods of persistence. The skills and tools presented here will aid in efficient... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/02/24/finding-unknown-malw… *** A new strain of banking trojan VAWTRAK uses Macros and abuses Windows PowerShell *** --------------------------------------------- Security experts at TrendMicro observed significant improvements in VAWTRAK banking trojan which couples use malicious macros and Windows PowerShell. Early 2015 the Microsoft Malware Protection Center (MMPC) issued an alert about a surge in the infections of malware using macros to spread their malicious code. The experts MMPC have observed a significant increase in enable-macros ... --------------------------------------------- http://securityaffairs.co/wordpress/34107/cyber-crime/vawtrak-uses-macros-w… *** Scanning Internet-exposed Modbus devices for fun & fun *** --------------------------------------------- [...] here is a scan I have run against the whole IPv4 address space, looking for Internet-exposed Modbus services. --------------------------------------------- http://pierre.droids-corp.org/blog/html/2015/02/24/scanning_internet_expose… *** "Surreptitiously Weakening Cryptographic Systems" *** --------------------------------------------- New paper: "Surreptitiously Weakening Cryptographic Systems," by Bruce Schneier, Matthew Fredrikson, Tadayoshi Kohno, and Thomas Ristenpart. Abstract: Revelations over the past couple of years highlight the importance of understanding malicious and surreptitious weakening of cryptographic systems. We provide an overview of this domain, using a number of historical examples to drive development of a weaknesses taxonomy. This allows comparing different... --------------------------------------------- https://www.schneier.com/blog/archives/2015/02/surreptitiously_1.html *** Mozilla Thunderbird Flaws Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information and Let Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031792 *** Mozilla Firefox Multiple Flaws Let Remote Users Deny Service, Execute Arbitrary Code, Bypass Security Restrictions, and Obtain Potentially Sensitive Information and Let Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031791 *** FreeBSD IGMP Integer Overflow Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031798 *** Splunk Enterprise 6.2.2 addresses two vulnerabilities *** --------------------------------------------- Description Splunk Enterprise version 6.2.2 addresses two vulnerabilities Multiple vulnerabilities in OpenSSL prior to 1.0.1k (SPL-95203, CVE-2014-3572, CVE-2015-0204) Splunk Web crashes due to specific HTTP requests (SPL-93754) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on our Splunk Product Security Portal. Use SPL numbers when referencing issues in... --------------------------------------------- http://www.splunk.com/view/SP-CAAANV8 *** Software Toolbox Top Server Resource Exhaustion Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a resource exhaustion vulnerability in the Software Toolbox Top Server application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-055-01 *** Kepware Resource Exhaustion Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a resource exhaustion vulnerability in the Kepware Technologies DNP Master Driver for the KEPServerEX Communications Platform. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-055-02 *** Schneider Electric Invensys Positioner Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in the Device Type Manager software for Schneider Electric's Invensys SRD Control Valve Positioner product line. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-055-03 *** HPSBMU03260 rev.1 - HP System Management Homepage running OpenSSL on Linux and Windows, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP System Management Homepage running OpenSSL on Linux and Windows. This vulnerability is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** IBM Security Bulletins *** --------------------------------------------- Rational Reporting for Development Intelligence - OpenSSL support for SSL 3.0 Fallback protection + 3 other CVEs http://www.ibm.com/support/docview.wss?uid=swg21697194 AppScan Enterprise can be affected by multiple vulnerabilities (CVE-2014-6136, CVE-2014-8918) http://www.ibm.com/support/docview.wss?uid=swg21697249 Rational Insight - Jazz Reporting Service report results can be viewed without user log-in (CVE-2014-6115) http://www.ibm.com/support/docview.wss?uid=swg21697034 Rational Reporting for Development Intelligence - Jazz Reporting Service report results can be viewed without user log-in (CVE-2014-6115) http://www.ibm.com/support/docview.wss?uid=swg21697035 Tivoli Storage Manager client encryption key password vulnerability (CVE-2014-4818) http://www.ibm.com/support/docview.wss?uid=swg21697022 Tivoli Common Reporting(TCR) iFixes for Security Vulnerability http://www.ibm.com/support/docview.wss?uid=swg21695800 Multiple vulnerabilities in IBM Java SDK affects multiple IBM Rational products based on IBM Jazz technology (CVE-2014-3566, CVE-2014-6457, CVE-2014-6468) http://www.ibm.com/support/docview.wss?uid=swg21697112 Vulnerabilities in OpenSSL affect IBM Systems Director (CVE-2014-3513 and CVE-2014-3567) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097159 Rational Insight - OpenSSL support for SSL 3.0 Fallback protection + 3 other CVEs http://www.ibm.com/support/docview.wss?uid=swg21697193 --------------------------------------------- *** Cisco UCS C-Series Integrated Management Controller Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Dienstag 24-02-2015
by Daily end-of-shift report 24 Feb '15

24 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 23-02-2015 18:00 − Dienstag 24-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Open Source Threat Intelligence - Developing a Threat intelligence program using open source tools and public sources *** --------------------------------------------- Overview of building a threat intelligence program outlining the processes, tasks and activities associated with the development of a functional intelligence program. Developing an Open Source Threat Intelligence Program from Open Source Tools and Public Sources is aimed at bringing business value and technical mitigation efforts, while dispelling common myths like "We're too small", "Who would attack us, we make widgets?" and "We have nothing anyone would... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/02/23/open-source-threat-i… *** RIG Exploit Kit - Diving Deeper into the Infrastructure *** --------------------------------------------- Following our previous blog post about the leaking of the RIG exploit kits source code, we dug deeper into the architecture that facilitates the massive infections using RIG. The screen shot below diagrams RIGs infrastructure. RIG Exploit Kit Infrastructure Most... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Exploit-Kit-%e2%80%… *** Insider threats continue to dominate *** --------------------------------------------- Ordinary employees, privileged users and the supply chain - such as contractors and third party service providers - are all conduits for a traditional insider threat, according to Vormetric. But the s... --------------------------------------------- http://www.net-security.org/secworld.php?id=17993 *** Overview of handheld malware for 2014 *** --------------------------------------------- February 24, 2015 Russian anti-virus company Doctor Web presents its 2014 overview of malware for handheld devices. The last year proved to be rather turbulent and rich in terms of information security events. We witnessed the emergence of a variety of new malicious applications for Android. In particular, the number of banking Trojans whose numerous modifications attacked devices in many countries increased significantly. Furthermore, 2014 saw the discovery of the first ransomware programs as... --------------------------------------------- http://news.drweb.com/show/?i=9222&lng=en&c=9 *** Bypassing Windows Lock Screen via Flash Screensaver *** --------------------------------------------- bypass windows lock screen We have recently discovered an easy method to bypass the Windows Lock screen when a flash screensaver is running. The method allows an attacker to gain unauthorized access to a user’s Windows session if he has physical access to a locked machine. --------------------------------------------- http://securitycafe.ro/2015/02/23/bypassing-windows-lock-screen-via-flash-s… *** Windows Exploit Mitigation Technology - Part 2 *** --------------------------------------------- In Part 1, we explained GS cookies and Safe SEH. If you haven't read that part, it is highly recommended to read it first. The Enhanced Mitigation Experience Toolkit, or EMET, is rudimentally a shield or a shell that runs over Windows applications and protects them, regardless of how those applications have authentically been coded... --------------------------------------------- http://resources.infosecinstitute.com/windows-exploit-mitigation-technology… *** Announcing TYPO3 CMS 7.1 *** --------------------------------------------- The TYPO3 Community has just released TYPO3 CMS 7.1, the second version within the CMS 7 development cycle. --------------------------------------------- http://typo3.org/news/article/typo3-cms-71-released-home-improvement/ *** DSA-3171 samba - security update *** --------------------------------------------- Richard van Eeden of Microsoft Vulnerability Research discovered thatSamba, a SMB/CIFS file, print, and login server for Unix, contains aflaw in the netlogon server code which allows remote code execution withroot privileges from an unauthenticated connection. --------------------------------------------- https://www.debian.org/security/2015/dsa-3171 *** DSA-3170 linux - security update *** --------------------------------------------- Several vulnerabilities have been discovered in the Linux kernel thatmay lead to a denial of service, information leaks or privilegeescalation. --------------------------------------------- https://www.debian.org/security/2015/dsa-3170

1 0

Tageszusammenfassung - Montag 23-02-2015
by Daily end-of-shift report 23 Feb '15

23 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 20-02-2015 18:00 − Montag 23-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Wichtige Sicherheitsupdates für PHP *** --------------------------------------------- Neue PHP-Versionen schließen unter anderem eine kritische Sicherheitslücke, zu der bereits ein Exploit kursiert. Admins sollten daher keine Zeit verlieren. --------------------------------------------- http://heise.de/-2557586 *** Data Traffic & Network Security *** --------------------------------------------- Introduction Last year - dubbed "the Year of the Hack" - saw numerous major cyber attacks against prominent corporations, including JP Morgan bank and Sony Pictures Entertainment. And after Target in 2013, another retailer, Home Depot, suffered a data breach with more than 56 million credit cards stolen. The consequences of these incidents can be... --------------------------------------------- http://resources.infosecinstitute.com/data-traffic-network-security/ *** Flaw makes Cisco routing hardware vulnerable to DoS attacks *** --------------------------------------------- A serious vulnerability affecting the software of some of Ciscos routing hardware systems for telecommunications and Internet service providers could be exploited to mount DoS attacks, the company ha... --------------------------------------------- http://www.net-security.org/secworld.php?id=17990 *** Samba vulnerability (CVE-2015-0240) *** --------------------------------------------- CVE-2015-0240 is a security flaw in the smbd file server daemon. It can be exploited by a malicious Samba client, by sending specially-crafted packets to the Samba server. No authenticated is required to exploit this flaw. It can result in remotely controlled execution of arbitrary code as root. --------------------------------------------- https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-024… *** Superfish not the only app using Komodias SSL-busting code *** --------------------------------------------- As Lenovo backtracked on its initial position that the Superfish adware pre-installed on some of its notebooks is not a security danger, and released a security advisory about the "vulnerability" that... --------------------------------------------- http://www.net-security.org/secworld.php?id=17991 *** Privdog: Comodo-Adware hebelt HTTPS-Sicherheit aus *** --------------------------------------------- Die Adware Privdog hebelt ähnlich wie Superfish den Schutz von HTTPS komplett aus. Pikant daran: Privdog wurde von Comodo verbreitet, einer der größten Zertifizierungsstellen für TLS-Zertifikate. --------------------------------------------- http://www.golem.de/news/privdog-comodo-adware-hebelt-https-sicherheit-aus-… *** FireEye shares details on Masque Attack II affecting iOS devices *** --------------------------------------------- Masque Attack II entails bypassing an iOS prompt for trust and app URL scheme hijacking, FireEye said. --------------------------------------------- http://www.scmagazine.com/fireeye-shares-details-on-masque-attack-ii-affect… *** Cisco Intrusion Prevention System Key Regeneration HTTPS Denial of Service Vulnerability *** --------------------------------------------- CVE-2015-0631 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AsyncOS Software HTTP Redirect Vulnerability *** --------------------------------------------- CVE-2015-0624 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** IBM Security Bulletins *** --------------------------------------------- Tivoli Storage Manager Stack-based Buffer Overflow Elevation of Privilege: CVE-2014-6184 http://www.ibm.com/support/docview.wss?uid=swg21695878 Vulnerability in SSLv3 affects Tivoli Storage Manager for Virtual Environments 7.1 and FlashCopy Manager for VMware 4.1 (CVE-2014-3566) http://www.ibm.com/support/docview.wss?uid=swg21690828 OpenSSL vulnerabilities announced August 6th 2014 affect Juniper EX Series Network Switches sold by IBM for use in IBM Products (9 CVEs) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097073 Vulnerabilities in OpenSSL. Juniper EX Series Network Switches sold by IBM for use in IBM Products. (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097126 --------------------------------------------- *** Siemens SIMATIC STEP 7 TIA Portal Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two vulnerabilities in the Siemens SIMATIC STEP 7 TIA Portal application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-050-01 *** Vibe 3.4 - Hot Patch 1 *** --------------------------------------------- Abstract: This patch addresses the Padding Oracle On Downgraded Legacy Encryption (POODLE) vulnerability and also provides a number of general bug fixes for Novell Vibe 3.4.Document ID: 5198730Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:NV-Vibe60DayEval-001.xml (719 bytes)NV-Vibe10Usr-001.xml (730 bytes)novell-vibe-3.4.0-windows.zip (185.69 MB)readme-Vibe-3.4-HP1.txt (4.13 kB)novell-vibe-3.4.0-linux.tar (187.8 MB)Products:Vibe 3.4Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=EaNhJs2Offs~ *** Bugtraq: iTunes 12.1.1 for Windows: still outdated and VULNERABLE 3rd party libraries, still UNQUOTED and VULNERABLE pathnames C:\Program Files\... *** --------------------------------------------- http://www.securityfocus.com/archive/1/534728 *** MyBB 1.8.3 Multiple stored XSS-vulnerabilities *** --------------------------------------------- Topic: MyBB 1.8.3 Multiple stored XSS-vulnerabilities Risk: Low Text: The researchers adamziaja, Devilshakerz, DingjieYang and me found multiple stored XSS-vulnerabilities in the administrative ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015020109 *** DSA-3169 eglibc - security update *** --------------------------------------------- Several vulnerabilities have been fixed in eglibc, Debians version ofthe GNU C library: --------------------------------------------- https://www.debian.org/security/2015/dsa-3169 *** DSA-3164 typo3-src - security update *** --------------------------------------------- Pierrick Caillon discovered that the authentication could be bypassed inthe Typo 3 content management system. Please refer to the upstreamadvisory for additional information: --------------------------------------------- https://www.debian.org/security/2015/dsa-3164 *** Security Advisory: Elasticsearch vulnerability CVE-2015-1427 *** --------------------------------------------- Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerabilities allow an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM. We have been assigned CVE-2015-1427 for this. Fixed versions: Versions 1.3.8 and 1.4.3 disable sandboxing for Groovy by default. As a consequence, dynamic script execution is disabled for Groovy. CVSS: Overall CVSS score: 5.8 --------------------------------------------- http://securityvulns.com/docs31742.html *** HPSBUX03240 SSRT101872 rev.1 - HP-UX Running NTP, Remote Execution of Code, Denial of Service (DoS), or Other Vulnerabilties *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running NTP. These could be exploited remotely to execute code, create a Denial of Service (DoS), or other vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Freitag 20-02-2015
by Daily end-of-shift report 20 Feb '15

20 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 19-02-2015 18:00 − Freitag 20-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Gemalto hack - lessons learned *** --------------------------------------------- In der Nacht auf FR, 20.2.2015 ist die nächste Bombe aus den Snowden leaks eingeschlagen: der niederländische Chipkartenhersteller Gemalto ist zumindest im Zeitraum Jänner 2010 bis März 2010 von GCHQ und NSA gehackt worden. Hierbei sind angeblich .. --------------------------------------------- https://www.cert.at/services/blog/20150220150747-1386.html *** Superfish - Eine Zusammenfassung *** --------------------------------------------- Die meisten im Handel erhältlichen Notebooks werden mit einer vorinstallierten Version von Windows in Kombination mit weiterer "nützlicher" Software - gemeinhin als "Bloatware" bezeichnet - ausgeliefert. Für die meisten Leute ist diese auf Notebooks vorinstallierte Bloatware .. --------------------------------------------- http://www.cert.at/services/blog/20150220162905-1395.html *** The Great SIM Heist - How Spies Stole the Keys to the Encryption Castle *** --------------------------------------------- American and british spies hacked into the internal computer network of the largest manufacturer of SIM cards in the world, stealing encryption keys used to protect the privacy of cellphone communications across the globe, according to top-secret documents provided to The Intercept by National Security Agency whistleblower Edward Snowden. --------------------------------------------- https://firstlook.org/theintercept/2015/02/19/great-sim-heist/ *** Hackers now popping Cisco VPN portals *** --------------------------------------------- Crackers are popping customised Cisco virtual private networks, stealing credentials and spraying malware using a flaw reported by Aussie hacker Alec Stuart-Muirk, the company warns. Organisations running the Cisco Clientless SSL .. --------------------------------------------- http://www.theregister.co.uk/2015/02/20/hackers_popping_cisco_vpn_portals/ *** Suit Up and Protect WordPress *** --------------------------------------------- In the final part of the series, I am going to show a few practical tips and tricks for protecting your WordPress blog. --------------------------------------------- https://blog.gaborszathmari.me/2015/02/19/suit-up-and-protect-wordpress/ *** Evil CSS injection bug warning: Dont let hackers cross paths with your website (The Register) *** --------------------------------------------- http://www.theregister.co.uk/2015/02/20/prssi_web_vuln/ *** Filme, Musik, Logindaten: 190.000 Festplatten sind ungesichert im Netz *** --------------------------------------------- Junger Informatiker grast das Netz mit eigenem Tool ab und wundert sich über "Fahrlässigkeit" --------------------------------------------- http://derstandard.at/2000011951714 *** 'TNT' gang has released a new hardware TDoS tool in the criminal underground *** --------------------------------------------- Telephone DDoS attacks are on the rise, the criminal group known as 'TNT' gang has released a new hardware tool in the underground ecosystem. The IntelCrawler cyber threat intelligence company has discovered a new advanced tool, dubbed .. --------------------------------------------- http://securityaffairs.co/wordpress/33867/cyber-crime/tnt-gang-released-tdo… *** IETF verbietet RC4-Verschlüsselung in TLS *** --------------------------------------------- Das Gremium für Internet-Standards will den Einsatz des als geknackt betrachteten Verschlüsselungsverfahrens RC4 offenbar den Garaus machen. --------------------------------------------- http://heise.de/-2556520 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Donnerstag 19-02-2015
by Daily end-of-shift report 19 Feb '15

19 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 18-02-2015 18:00 − Donnerstag 19-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** SA-CONTRIB-2015-052 - RESTful Web Services - Access Bypass *** --------------------------------------------- This module enables you to expose Drupal entities as RESTful web services. It provides a machine-readable interface to exchange resources in JSON, XML and RDF. The RESTWS Basic Auth submodule doesn't sufficiently disable page caching for ... --------------------------------------------- https://www.drupal.org/node/2428863 *** SA-CONTRIB-2015-048 - Avatar Uploader - Arbitrary PHP code execution *** --------------------------------------------- Avatar Uploader module provides an alternative way to upload user pictures. The module doesn't sufficiently enforce file extensions when an avatar is uploaded, allowing users to bypass Drupal's normal file upload protections to .. --------------------------------------------- https://www.drupal.org/node/2428793 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** BIND: A Problem with Trust Anchor Management Can Cause named to Crash *** --------------------------------------------- BIND servers which are configured to perform DNSSEC validation and which are using managed-keys (which occurs implicitly when using "dnssec-validation auto;" or "dnssec-lookaside auto;") may terminate with an assertion failure when . --------------------------------------------- https://kb.isc.org/article/AA-01235/0 *** OWASP AppSensor - implement real-time intrusion detection within in your software *** --------------------------------------------- Free, open source, DevOps friendly and cloud compatible AppSensor provides real-time application-layer attack detection and response. --------------------------------------------- https://www.owasp.org/images/8/8e/Appsensor_intro_for_developers.pdf *** Lenovo-Laptops durch Superfish-Adware angreifbar *** --------------------------------------------- Eine Adware namens Superfish wird offenbar schon seit mehreren Monaten auf Laptops von Lenovo ausgeliefert. Diese fügt Werbung in fremde Webseiten ein und installiert dafür ein Root-Zertifikat - eine riesige Sicherheitslücke. --------------------------------------------- http://www.golem.de/news/adware-lenovo-laptops-durch-superfish-adware-angre… *** Macros? Really?! *** --------------------------------------------- .. macro-based malware is now making a "successful" comeback. Last week, we saw a significant Dridex malware run that was using macros in Excel files (.XLSM), and earlier this week, the crooks behind the banking spyware "Vawtraq" started to spam the usual "Fedex Package" and "Tax Refund" emails, .. --------------------------------------------- https://isc.sans.edu/diary/Macros%3F+Really%3F!/19349 *** Automating Removal of Java Obfuscation *** --------------------------------------------- In this post we detail a method to improve analysis of Java code for a particular obfuscator, we document the process that was followed and demonstrate the results of automating our method. Obscurity will not stop an attacker and once the method is known, methodology can be developed to automate the process. --------------------------------------------- http://www.contextis.com/resources/blog/automating-removal-java-obfuscation/ *** IETF: RC4 in TLS offiziell nicht mehr erlaubt *** --------------------------------------------- Die RC4-Verschlüsselung darf laut dem neuen RFC 7465 nicht mehr für TLS-Verbindungen genutzt werden. Der Algorithmus gilt schon lange als problematisch, Details über neue Angriffe sollen in Kürze veröffentlicht werden. --------------------------------------------- http://www.golem.de/news/ietf-rc4-in-tls-offiziell-nicht-mehr-erlaubt-1502-… *** Cross-Site Tracing (XST): The misunderstood vulnerability *** --------------------------------------------- Alas, the 'XS' in XST evokes similarity to XSS (Cross-Site Scripting) which has the consequence of leading people to mistake XST as a method for injecting JavaScript. (Thankfully, character encoding attacks have avoided the term Cross-Site Unicode, XSU.) Although XST attacks rely on browser scripting .. --------------------------------------------- http://deadliestwebattacks.com/2010/05/18/cross-site-tracing-xst-the-misund… *** Duplicator 0.5.8 - Privilege Escalation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7799 *** Technology doping: Competitive advantage by abusing security flaws in smart sports equipment *** --------------------------------------------- The term 'Technology doping' has recently been used [1] to mean the practice of gaining a competitive advantage through using sports equipment e.g. The LZR Racer bodysuit [2] that was used by many of the swimmers during the Beijing Olympics, resulting in world records being broken. Shortly afterwards, FINA (Federation Internationale de Natation), the international .. --------------------------------------------- https://www.nccgroup.com/en/blog/2015/02/technology-doping-competitive-adva… *** l+f: Geklonte SSH-Schlüssel sind böse *** --------------------------------------------- Tausende von Geräten im Netz verwenden ein und den selben SSH-Schlüssel. Das birgt Gefahren. --------------------------------------------- http://heise.de/-2555229 *** Erpressungs-Software im Aufstieg: Wenn Daten zur Geisel werden *** --------------------------------------------- Immer mehr Kriminelle setzen auf "Ransomware", um Lösegeld zu erpressen. Ihr nächstes Ziel: Mobiltelefone. --------------------------------------------- http://derstandard.at/2000011389615

1 0

Tageszusammenfassung - Mittwoch 18-02-2015
by Daily end-of-shift report 18 Feb '15

18 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 17-02-2015 18:00 − Mittwoch 18-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Sicher surfen trotz Android 4.3 *** --------------------------------------------- Der WebView-Bug von Android 4.3 könnte sich stärker auswirken als bisher bekannt. Auch wenn die Angriffsszenarien bisher nur theoretische Proof-of-Concepts sind, sollten Sie ein paar Vorsichtsmaßnahmen ergreifen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Sicher-surfen-trotz-Android-4-3-2552… *** Bug des Tages: Der FreeBSD-Zufallszahlengenerator war ... *** --------------------------------------------- Bug des Tages: Der FreeBSD-Zufallszahlengenerator war seit vier Monaten kaputt. Das betrifft glaube ich nur FreeBSD-current. Wer in der Zeit PGP- oder SSH- oder sonstige Krypto-Keys generiert hat, sollte die dann wohl auch mal zurückrufen und neue machen. --------------------------------------------- http://blog.fefe.de/?ts=aa1d7111 *** Fuzzing for MS15-010 *** --------------------------------------------- Intro This past Patch Tuesday Microsoft released MS15-010: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution. This patch addressed multiple privately reported vulnerabilities in .. --------------------------------------------- http://blog.beyondtrust.com/fuzzing-for-ms15-010 *** Siemens SIMATIC STEP 7 TIA Portal Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for authentication vulnerabilities in the Siemens SIMATIC STEP 7 TIA Portal application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-048-01 *** Siemens SIMATIC WinCC TIA Portal Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for authentication vulnerabilities in the Siemens SIMATIC WinCC TIA Portal application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-048-02 *** Yokogawa HART Device DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights GmbH HART Device Type Manager (DTM) library utilized in Yokogawa's HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-048-03 *** D-Link DSL-2640B DNS hijacking *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/100955 *** Duplicate SSH Keys Everywhere *** --------------------------------------------- Back in December when I revamped the SSH banner and started collecting the fingerprint I noticed an odd behavior. It turns out that a few SSH keys are used a lot more than once. --------------------------------------------- https://blog.shodan.io/duplicate-ssh-keys-everywhere/ *** Beware of fake Facebook "Copyright Violations" warnings *** --------------------------------------------- The latest Facebook-themed phishing messages doing rounds are trying to trick users into believing they are "making copyright violations" on their Facebook page. "Please review your .. --------------------------------------------- http://www.net-security.org/secworld.php *** Microsoft wirbt mit Sicherheit nach ISO 27018 *** --------------------------------------------- Microsofts Cloud-Dienste Office 365 und Dynamics CRM Online sind von dem British Standards Institute (BSI) nach den Sicherheitsstandards zertifiziert worden, wie sie in ISO/IEC 27018 definiert sind. Diese Standards sollen für Microsoft weltweit gelten. Azure hat bereits eine solche .. --------------------------------------------- http://www.golem.de/news/cloud-dienste-microsoft-wirbt-mit-sicherheit-nach-… *** Kippo Modifications - New Features *** --------------------------------------------- Since summer last year I've been working on extensions and contributions to the well known Kippo honeypot developed by desaster. ... New Features: SFTP support, Exec support, SSH tunnelling (direct-tcpip) support, SSH Fingerprint .. --------------------------------------------- http://www.micheloosterhof.com/kippo-modifications/ *** ENISA's recommendations for Certifying ICS/SCADA professionals *** --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa2019s-recommendations-… *** Die Geister, die ich rief: Netgear-Router über Genie-App angreifbar *** --------------------------------------------- Eine Reihe von Netgear-Routerm plaudern durch die Schnittstelle für die Fernwartungs-App Genie wichtige Informationen über das eigene Netzwerk aus. Unter anderem können Angreifer aus dem Netz so Passwörter auslesen. --------------------------------------------- http://heise.de/-2553224

1 0

Tageszusammenfassung - Dienstag 17-02-2015
by Daily end-of-shift report 17 Feb '15

17 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 16-02-2015 18:00 − Dienstag 17-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** HITBSecConf2015 Amsterdam *** --------------------------------------------- Held once again at De Beurs van Berlage, HITB2015AMS takes place from the 26th till the 29th of May 2015 and runs alongside HITB Haxpo - our 3-day technology expo for hackers, makers, builders and breakers. --------------------------------------------- http://conference.hitb.org/hitbsecconf2015ams/ *** Anunak (aka Carbanak) Update *** --------------------------------------------- ... basically Anunak is the name the malware author gave to the main malware used in these attacks. Carbanak is the name the AV industry gave to this malware, which is a combination of the .. --------------------------------------------- http://www.fox-it.com/en/press-releases/anunak-aka-carbanak-update/ *** HTTP Strict Transport Security comes to Internet Explorer *** --------------------------------------------- As part of our ongoing commitment to help build an interoperable, secure web that just works, were excited to announce support for HTTP Strict Transport Security (HSTS) in Internet Explorer. This change can be previewed using Internet Explorer in the Windows 10 Technical Preview, and will come to Project Spartan in a later update. --------------------------------------------- http://blogs.msdn.com/b/ie/archive/2015/02/16/http-strict-transport-securit… *** TYPO3-EXT-SA-2015-005: Cross-Site Scripting in extension Gridelements (gridelements) *** --------------------------------------------- The extension fails to properly escape user input in HTML context. Backend Editor permissions with access to any text field within any data table are required to exploit this vulnerability. --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… *** MongoDB: Tipps für sichere Benutzung veröffentlicht *** --------------------------------------------- Nach Schlagzeilen über ungesicherte Online-Installationen der Datenbank MongoDB gibt der Hersteller der kommerziellen Variante Sicherheits-Empfehlungen. Sie zeigen, wie man die populäre Software ohne Datenleck übers Netz nutzen kann. --------------------------------------------- http://www.heise.de/newsticker/meldung/MongoDB-Tipps-fuer-sichere-Benutzung… *** TYPO3: Important Security-Bulletin Pre-Announcement *** --------------------------------------------- A TYPO3 4.5.40 release containing a security fix will be published the day after tomorrow, Thursday 19th of February at about 10:00 am CET. --------------------------------------------- http://typo3.org/news/article/important-security-bulletin-pre-announcement/ *** Bericht: Lightning-Anschluss gehackt *** --------------------------------------------- Einem Entwickler hat es geschafft, den von Apple verwendeten Sicherheitschip für die Anschlusskabel von iPhone und Co. teilweise zu entschlüsseln und eine serielle Konsole aufzurufen. Das könnte zu ganz neuen Angriffsformen führen. --------------------------------------------- http://heise.de/-2550921 *** Defeating TrueCrypt: Practical Attacks against TrueCrypt Security *** --------------------------------------------- The need to defend confidentiality of our sensitive information against persistently rising cyber threats has turned most of us toward using encryption on a daily basis. This is facilitated by easy-to-use GUI tools like TrueCrypt that offer advanced encryption without hassles. TrueCrypt .. --------------------------------------------- http://resources.infosecinstitute.com/defeating-truecrypt-practical-attacks… *** SSA-315836 (Last Update 2015-02-17): Vulnerabilities in SIMATIC STEP 7 (TIA Portal) V12 and V13 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Vawtrack malware peddlers turn to malicious macros *** --------------------------------------------- Cybercriminals spreading new versions of the Vawtrak banking Trojan are the latest ones to use the once again popular macro-based attack. Popular in the early 2000s, this type of attack was abandon... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2967 *** APT Groups Emerging in Middle East *** --------------------------------------------- Since security researchers and vendors began exposing the inner workings of APT groups a few years ago, virtually all of the operations that have been made public have been the work of attackers in Europe, Asia or North America. But .. --------------------------------------------- http://threatpost.com/apt-groups-emerging-in-middle-east/111124 *** Inside nls_933w.dll, the Equation APT Persistence Module *** --------------------------------------------- The persistence module used by the Equation APT Group uncovered by researchers at Kaspersky Lab has been called the ultimate cyberattack tool. --------------------------------------------- http://threatpost.com/inside-nls_933w-dll-the-equation-apt-persistence-modu… *** Keeping Up with SSL *** --------------------------------------------- SSL is becoming an evermore important aspect of serving and consuming content on the Internet, so its only fit that Shodan extends the information that it gathers for every SSL-capable service. The banners for SSL services, such as HTTPS, have included the certificate in PEM format for a long time and youve been able to access that data through the REST API or real-time stream. --------------------------------------------- https://blog.shodan.io/ssl-update/

1 0

Tageszusammenfassung - Montag 16-02-2015
by Daily end-of-shift report 16 Feb '15

16 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 13-02-2015 18:00 − Montag 16-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Microsoft February Patch Failures Continue: KB3023607 vs. Cisco AnyConnect Client *** --------------------------------------------- Another patch released by Microsoft this month is causing problems. This time it is KB3023607,which was supposed to mitigate the POODLE vulnerability. Once applied, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19331 *** PostgreSQL Bugs Let Remote Authenticated Users Obtain Potentially Sensitive Information, Execute Arbitrary Code, and Deny Service *** --------------------------------------------- Several vulnerabilities were reported in PostgreSQL. A remote authenticated user can execute arbitrary code on the target system. A remote authenticated user can cause denial of service conditions. A remote authenticated user can obtain .. --------------------------------------------- http://www.securitytracker.com/id/1031742 *** SSA-234789 (Last Update 2015-02-13): Vulnerabilities in SIMATIC STEP 7 (TIA Portal) V13 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** PowerShell: Better phishing for all! *** --------------------------------------------- PowerShell is able to import functions from any DLL, this allows you to use functions like VirtualAlloc, memset and CreateThread. This will allow you to allocate executable memory, fill it with your program and execute it. --------------------------------------------- http://d.uijn.nl/?p=116 *** Analysis of the Fancybox-For-WordPress Vulnerability *** --------------------------------------------- We were alerted last week of a malware outbreak affecting WordPress sites using version 3.0.2 and lower of the fancybox-for-wordpress plugin. As announced, here are some of the details explaining how attackers could use this .. --------------------------------------------- http://blog.sucuri.net/2015/02/analysis-of-the-fancybox-for-wordpress-vulne… *** Probleme mit Windows RT: Microsoft zieht PowerPoint-Patch zurück *** --------------------------------------------- Per Patch wollte Microsoft die Stabilität von PowerPoint verbessern. Nutzer von Windows RT-Geräten hatten jedoch nach der Installation des Patches berichtet, dass sich Powerpoint nicht mehr starten lasse. Jetzt hat Microsoft den Patch zurückgezogen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Probleme-mit-Windows-RT-Microsoft-zi… *** Sicherheitslücke in Gruppenrichtlinien: Mit dem Patchen allein ist es nicht getan *** --------------------------------------------- Admins aufgepasst: Eines der am Februar-Patchday ausgelieferten Updates schützt nur, wenn man eine Reihe von Anweisungen befolgt. Tut man das nicht, bleibt die Infrastruktur für Man-in-the-Middle-Angriffe anfällig. --------------------------------------------- http://heise.de/-2550209 *** The Great Bank Heist, or Death by 1,000 Cuts? *** --------------------------------------------- I received a number of media requests and emails from readers over the weekend to comment on a front-page New York Times story about an organized gang of cybercriminals pulling off 'one of the largest bank heists ever.' Turns out, I reported on this gang's activities in December 2014, although my story ran minus many of the superlatives in the Times piece. --------------------------------------------- http://krebsonsecurity.com/2015/02/the-great-bank-heist-or-death-by-1000-cu… *** The research: Mobile Internet traffic hijacking via GTP and GRX *** --------------------------------------------- Most users assume that mobile network access is much safer because a big mobile-telecoms provider will protect subscribers. Unfortunately, as practice shows, mobile Internet is a great opportunity for the attacker. --------------------------------------------- http://blog.ptsecurity.com/2015/02/the-research-mobile-internet-traffic.html *** Angriffsziel Bitcoinbörse: Bter und Exco.in gehackt *** --------------------------------------------- Die Jagdsaison auf Bitcoinbörsen scheint wieder loszugehen: Unbekannte haben die Handelsplattform Bter um Coins im Wert von fast 1,5 Millionen Euro erleichtern können. Die Börse Exco.in wurde gleich aller Bitcoins beraubt. --------------------------------------------- http://heise.de/-2550175

1 0

Tageszusammenfassung - Freitag 13-02-2015
by Daily end-of-shift report 13 Feb '15

13 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 12-02-2015 18:00 − Freitag 13-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Open-Xchange Access Control Flaw Lets Remote Authenticated Users Access Restricted Files *** --------------------------------------------- A vulnerability was reported in Open-Xchange. A remote authenticated user can access certain files on the target system. A remote authenticated user with access to publications can access shared files without permission to access them. --------------------------------------------- http://www.securitytracker.com/id/1031744 *** Security Advisory-Information Leakage Vulnerability in Huawei P7 Smartphone *** --------------------------------------------- MeWidget is a plug-in of Huawei Emotion UI. The MeWidget module on Huawei smartphone P7 has a vulnerability that could lead to the disclosure of contact information. Attackers can obtain the name and URI information of mobile phone users through the malware installed on the smartphones. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Apple: Zwei-Faktor-Schutz für iMessage und FaceTime *** --------------------------------------------- Apple bietet ab sofort die Zwei-Faktor-Authentifizierung auch für seine Dienste FaceTime und iMessage an. Dieses schützt das Konto mit einem zweiten Passwort. --------------------------------------------- http://futurezone.at/digital-life/apple-zwei-faktor-schutz-fuer-imessage-un… *** NetGear WNDR Authentication Bypass / Information Disclosure *** --------------------------------------------- .. viewing and setting of certain router parameters, such as: WLAN credentials and SSIDs. Connected clients. Guest WLAN credentials and SSIDs. Parental control settings. ... As this SOAP service is called via the built-in HTTP / CGI daemon, unauthenticated queries will be answered from the WAN if remote management has been enabled on the device. As a result, affected devices can be interrogated and hijacked with as little as a well placed HTTP query. --------------------------------------------- https://github.com/darkarnium/secpub/blob/master/NetGear/SOAPWNDR/README.md *** vBulletin XSS (Cross-Site Scripting) Security Vulnerabilities *** --------------------------------------------- Vulnerable Versions: 5.1.3, 5.0.5, 4.2.2, 3.8.7, 3.6.7, 3.6.0, 3.5.4 Vulnerability Details: vBulletin has a security problem. It can be exploited by XSS attacks. The vulnerability occurs at "forum/help" page. Add "hash symbol" first. Then add script at the end of it. CVE Reference: CVE-2014-9469 CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) --------------------------------------------- http://securityrelated.blogspot.co.at/2015/02/cve-2014-9469-vbulletin-xss-c… *** Netatmo Weather Station Sends WPA Passwords In the Clear *** --------------------------------------------- UnderAttack writes The SANS Internet Storm Center is writing that Netatmo weather stations will send the users WPA password in the clear back to Netatmo. Netatmo states that this is some forgotten debug code that was left in the device. Overall, the device doesnt bother with encryption, but sends all data, not just the password, in the clear. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/-VdGyumpxjY/story01.htm *** Windows Exploit Mitigation Technology - Part 1 *** --------------------------------------------- The spree of exploits on Windows has led to the creation of a certain type of exploit protection mechanism on Windows. Protection from things like buffer overflow, heap overwrite and return originated exploits have been deployed on Windows compilers and OS. --------------------------------------------- http://resources.infosecinstitute.com/windows-exploit-mitigation-technology…

1 0

Tageszusammenfassung - Donnerstag 12-02-2015
by Daily end-of-shift report 12 Feb '15

12 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 11-02-2015 18:00 − Donnerstag 12-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Advantech EKI-1200 Buffer Overflow *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in Advantech EKI-1200 product line. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-041-01 *** MSRT February: Escad and NukeSped *** --------------------------------------------- This month we added three new families to the Microsoft Malicious Software Removal Tool (MSRT) to help protect our customers: Win32/Escad, Win32/Jinupd and Win32/NukeSped. While this blog focuses on Escad and NukeSped, we want to note that Jinupd is point-of-sale malware that steals sensitive data, such as credit card information and sends it to a malicious hacker. The Escad and NukeSped malware families have backdoor capabilities that have been used as part of targeted attacks. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/02/10/msrt-february-escad-and-… *** February 2015 Updates *** --------------------------------------------- Today, as part of Update Tuesday, we released nine security bulletins - three rated Critical and six rated Important in severity, to address 56 unique Common Vulnerabilities and Exposures (CVEs) in Microsoft Windows, Microsoft Office, Internet Explorer, and Microsoft Server software. We encourage you to apply all of these updates. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/02/10/february-2015-updates.as… *** A Crypto Trick That Makes Software Nearly Impossible to Reverse-Engineer *** --------------------------------------------- Software reverse engineering, the art of pulling programs apart to figure out how they work, is what makes it possible for sophisticated hackers to scour code for exploitable bugs. It's also what allows those same hackers' dangerous malware to be deconstructed and neutered. Now a new encryption trick could make both those tasks much, much harder. --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/434d3df8/sc/4/l/0L0Swired0N0C20A1… *** Decrypting TLS Browser Traffic With Wireshark - The Easy Way *** --------------------------------------------- It turns out that Firefox and the development version of Chrome both support logging the symmetric session key used to encrypt TLS traffic to a file. You can then point Wireshark at said file and presto! decrypted TLS traffic. Read on to learn how to set this up. --------------------------------------------- https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wiresh… *** Elasticsearch vulnerability CVE-2015-1427 *** --------------------------------------------- Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerabilities allow an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM. We have been assigned CVE-2015-1427 for this. ... CVSS: Overall CVSS score: 5.8 --------------------------------------------- http://www.securityfocus.com/archive/1/534689 *** NIST requests final comments on ICS security guide *** --------------------------------------------- Included in the final draft are updates on ICS vulnerabilities and risk management practices, along with information on security capabilities and tools for industrial control systems. Also added to the guide were methods for aligning guidance with other ICS security standards and guidelines. --------------------------------------------- http://www.scmagazine.com/nist-requests-final-comments-on-ics-security-guid… *** Pannen-Patch: Microsoft probierts noch mal *** --------------------------------------------- Unangekündigt hat Microsoft erneut damit begonnen, den Patch KB3001652 über Windows Update zu verteilen. Im ersten Anlauf hatte das Unternehmen damit zahlreiche Rechner lahm gelegt. Unterdessen beschweren sich Nutzer über einen weiteren Patch. --------------------------------------------- http://www.heise.de/newsticker/meldung/Pannen-Patch-Microsoft-probierts-noc… *** Cisco Security Advisories *** --------------------------------------------- Cisco IOS Software Access Control List Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Adaptive Security Appliance WebVPN Embedded Web Server Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 11-02-2015
by Daily end-of-shift report 11 Feb '15

11 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 10-02-2015 18:00 − Mittwoch 11-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** MS15-FEB - Microsoft Security Bulletin Summary for February 2015 - Version: 1.0 *** --------------------------------------------- MS15-009 Security Update for Internet Explorer MS15-010 Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution MS15-011 Vulnerability in Group Policy Could Allow Remote Code Execution MS15-012 Vulnerabilities in Microsoft Office Could Allow Remote Code Execution MS15-013 Vulnerability in Microsoft Office Could Allow Security Feature Bypass MS15-014 Vulnerability in Group Policy Could Allow Security Feature Bypass MS15-015 Vulnerability in Microsoft Windows Could Allow Elevation of Privilege MS15-016 Vulnerability in Microsoft Graphics Component Could Allow Information Disclosure MS15-017 Vulnerability in Virtual Machine Manager Could Allow Elevation of Privilege --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-FEB *** Vorsicht! Microsoft-Patch legt Rechner lahm *** --------------------------------------------- An seinem Februar-Patchday schließt Microsoft 56 Lücken - und beschert Windows-Nutzern auch neue Probleme. Durch ein älteres Update, das nun automatisch verteilt wird, hängt der Rechner beim Installieren fest. --------------------------------------------- http://heise.de/-2545913 *** SSL Is Officially Declared Dead *** --------------------------------------------- On January 30, 2015, QSAs received the latest edition of the Council's Assessor Newsletter. Buried in that edition was the following statement. "The impacting change is related to several vulnerabilities in the SSL protocol. Because of this, no version of SSL meets PCI SSCs definition of strong cryptography, and updates to the standards are needed to address this issue." ... Therefore, those of you still using SSL to secure transmissions containing cardholder data (CHD) need to ... --------------------------------------------- https://pciguru.wordpress.com/2015/02/07/ssl-is-officially-declared-dead/ *** MS15-011 & MS15-014: Hardening Group Policy *** --------------------------------------------- Today we are releasing MS15-011 & MS15-014 which harden group policy and address network access vulnerabilities that can be used to achieve remote code execution (RCE) in domain networks. The MS15-014 update addresses an issue in Group Policy update which can be used to disable client-side global SMB Signing requirements, bypassing an existing security feature built into the product. MS15-011 adds new functionality, hardening network file access to block access to untrusted, attacker --------------------------------------------- http://blogs.technet.com/b/srd/archive/2015/02/10/ms15-011-amp-ms15-014-har… *** Internet of Thieves: All that shiny home security gear is crap, warns HP *** --------------------------------------------- If you can monitor your house across the web, so can everyone else In a recent study, every connected home security system tested by HP contained significant vulnerabilities, including but not limited to password security, encryption, and authentication issues. --------------------------------------------- http://www.theregister.co.uk/2015/02/10/iot_home_insecurity/ *** ZDI-15-041: Samsung Security Manager ActiveMQ Broker Service DELETE Method Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to delete files of their choosing from systems running vulnerable installations of Samsung Security Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-041/ *** Security Advisory- Local Denial of Service Vulnerability in Huawei Ascend P7 *** --------------------------------------------- Huawei Ascend P7 (Sophia-L09) uses Android 4.4, which is the upgrade version of EMUI 3.0. The phone module crashes when a third-party app sends specific broadcast messages or enables specific UIs. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - Privilege Escalation Vulnerability in Huawei Mate7 *** --------------------------------------------- Android versions earlier than 5.0 are affected by the vulnerability, which allows an attacker to escalate privilege. Huawei Mate7 is affected by the vulnerability CVE-2014-7911 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Offene Key-Value Stores *** --------------------------------------------- Offene Key-Value Stores11. Februar 2015Wie Heise berichtet wurden in den letzten Tagen von einer Gruppe Studenten zehntausende vollständig ungesicherte Instanzen der NoSQL-Datenbank MongoDB im Internet entdeckt. In den meisten Fällen war nicht nur lesender Zugriff sondern auch die Manipulation von Datensätzen möglich. --------------------------------------------- http://www.cert.at/services/blog/20150211085411-1367.html *** Research, Low-Level, Vulnerabilities, Exploitation *** --------------------------------------------- Today, Microsoft released their latest Patch Tuesday. This Patch includes a fix for vulnerability CVE-2015-0057, an IMPORTANT-rated exploitable vulnerability which we responsibly disclosed to Microsoft a few months ago. As part of our research, we revealed this privilege escalation vulnerability which, if exploited, enables a threat actor to complete control of a Windows machine. --------------------------------------------- http://breakingmalware.com/vulnerabilities/one-bit-rule-bypassing-windows-1… *** Google Play Store X-Frame-Options (XFO) Gaps Enable Android Remote Code Execution (RCE) *** --------------------------------------------- Due to a lack of complete coverage for X-Frame-Options (XFO) support on Googles Play Store web application domain, a malicious user can leverage either a Cross-Site Scripting (XSS) vulnerability in a particular area of the Google Play Store web application, or a Universal XSS (UXSS) targeting affected browsers, to remotely install and launch the main intent of an arbitrary Play Store provided Android package (APK). Affected Platforms: Many versions of Android 4.3 (Jelly Bean) and earlier ship ... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2015/02/10/r7-2015-0… *** NetFlow Collection and Analysis Using NFCAPD, Python, and Splunk *** --------------------------------------------- NetFlow data is often collected for network monitoring and management, but it has many applications for the security analyst. NetFlow data can be used to identify variations from established traffic baselines, traffic originating from critical systems, and communications with known bad external hosts. Many edge devices support the generation of NetFlow data, but the collection and analysis often requires commercial tools. Options based on open source and free tools will allow an analyst to ... --------------------------------------------- https://www.sans.org/reading-room/whitepapers/incident/netflow-collection-a… *** Firmware: Hacker veröffentlicht Anleitung für UEFI-Rootkits *** --------------------------------------------- Ein russischer Hacker hat eine Anleitung veröffentlicht, wie Rootkits über manipulierte UEFIs eingepflanzt werden können. Wie leicht es ist, aktuelle UEFI-Implementierungen anzugreifen, hatten Hacker bereits auf dem 31C3 demonstriert. --------------------------------------------- http://www.golem.de/news/firmware-hacker-veroeffentlicht-anleitung-fuer-uef… *** Cisco Security Advisories *** --------------------------------------------- Cisco Secure Access Control System SQL Injection Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- Cisco IOS Measurement, Aggregation, and Correlation Engine Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS Measurement, Aggregation, and Correlation Engine Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS Measurement Aggregation and Correlation Engine Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS Measurement Aggregation and Correlation Engine Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS ACL Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco TelePresence IX5000 Series Web Management Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 10-02-2015
by Daily end-of-shift report 10 Feb '15

10 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 09-02-2015 18:00 − Dienstag 10-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Safer Internet Day: BSI-Poster für mehr Sicherheit im Netz *** --------------------------------------------- Mit 40 "leicht umsetzbaren" Tipps sollen Internetnutzer die allermeisten Standardangriffe im Internet abwehren können, meint das Bundesamt für Sicherheit in der Informationstechnik. Deswegen hat es die auf Postern zusammengefasst und online gestellt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Safer-Internet-Day-BSI-Poster-fuer-m… *** European Cyber Security Month reporting to the benefit of EU citizen *** --------------------------------------------- ENISA publishes a report on the deployment of the European Cyber Security Month. The objective of this report is to: * Present its preparatory work * Carry out an objective evaluation * Draw conclusions that can be used in future editions of the ECSM --------------------------------------------- http://www.enisa.europa.eu/media/news-items/european-cyber-security-month-r… *** TR-32 - key-value store and NoSQL security recommendations *** --------------------------------------------- Key-value stores, caches or NoSQL databases became an important piece of software in today's internet and web services. In contrast to conventional DB sytems, the security model of NoSQL data stores is often very limited due to their inherent nature to be used within internal trusted networks. Strong attention should be given to the configuration of key-value stores especially regarding their access from the Internet. --------------------------------------------- http://www.circl.lu/pub/tr-32/ *** PlugX, Go-To Malware for Targeted Attacks, More Prominent Than Ever *** --------------------------------------------- The popular remote access tool PlugX enjoyed an ascent in popularity in 2014 and is now a go-to malware for attack groups. --------------------------------------------- http://threatpost.com/plugx-go-to-malware-for-targeted-attacks-more-promine… *** Cisco Security Advisories *** --------------------------------------------- Cisco Prime Infrastructure Cross-Site Scripting Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco Prime Infrastructure Cross-Site Request Forgery Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco IOS Software Zone-Based Firewall Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS Software Kernel Timer Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Prime Security Manager Cross-Site Scripting Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco Prime Infrastructure Cross-Frame Scripting Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco IOS Shell Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Montag 9-02-2015
by Daily end-of-shift report 09 Feb '15

09 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 06-02-2015 18:00 − Montag 09-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Analyzing Angler: The World's Most Sophisticated Exploit Kit *** --------------------------------------------- Anglers unique obfuscation, ability to detect antivirus and virtual machines, encrypted payload and fileless infection have some calling it the most sophisticated exploit kit. --------------------------------------------- http://threatpost.com/analyzing-angler-the-worlds-most-sophisticated-exploi… *** Bindead - a static analysis tool for binaries. *** --------------------------------------------- Bindead is an analyzer for executable machine code. It features a disassembler that translates machine code bits into an assembler like language (RREIL) that in turn is then analyzed by the static analysis component using abstract interpretation. As Bindead operates on the machine code level, it can be used without having the source code of the program to be analyzed. In fact, the purpose of Bindead is to help with the reverse engineering of executable code or binaries. --------------------------------------------- https://bitbucket.org/mihaila/bindead/wiki/Home *** ENISA: Threat Landscape for Smart Home and Media Convergence *** --------------------------------------------- The study identifies threats to all asset classes, across the several alternative design pathways to smart homes. As it develops, the smart home will exhibit a high cyber security risk profile for the individual context, with additional systematic effects on broader information security. --------------------------------------------- https://www.enisa.europa.eu/activities/risk-management/evolving-threat-envi… *** Online Windows Binary Analyzer *** --------------------------------------------- http://labs.nccgroup.com/NCCGroupWindowsBinaryAnalyzer/ *** Firmware Forensics: Diffs, Timelines, ELFs and Backdoors *** --------------------------------------------- This post covers some common techniques that I use to analyze and reverse firmware images. These techniques are particularly useful to dissect malicious firmwares, spot backdoors and detect unwanted modifications. --------------------------------------------- http://w00tsec.blogspot.co.at/2015/02/firmware-forensics-diffs-timelines-el… *** Moodle Directory Traversal Flaw Lets Remote Users View Arbitrary Files *** --------------------------------------------- A vulnerability was reported in Moodle. A remote user can view files on the target system. The software does not properly validate user-supplied input to some scripts that serve JavaScript. A remote user can supply a specially crafted request containing the '../' string to view files on target system that are located outside of the document directory. --------------------------------------------- http://www.securitytracker.com/id/1031712 *** Cisco Security Advisories *** --------------------------------------------- Cisco AsyncOS Software Uuencode Email Filtering Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Adaptive Security Appliance WebVPN Content Rewriter Denial of Service Vunerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… --------------------------------------------- Cisco AsyncOS Software Uuencoded Email Filtering Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Adaptive Security Appliance WebVPN Content Rewriter Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013…

1 0

Tageszusammenfassung - Freitag 6-02-2015
by Daily end-of-shift report 06 Feb '15

06 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 05-02-2015 18:00 − Freitag 06-02-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Filmkan: Mysterious Turkish Botnet Grows Through Facebook *** --------------------------------------------- On January 31, a security researcher named Mohammad Faghani posted an analysis of malware that was being distributed through Facebook posts. Based on the number of .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/02/filmkan-mysterious-turki… *** Microsoft: Firmen entdecken Cyberattacken erst nach 243 Tagen *** --------------------------------------------- Firmen brauchen nach Angaben von Microsoft durchschnittlich 243 Tage, um eine Cyberattacke auf ihr Netzwerk zu entdecken. "Sie haben 243 Tage lang .. --------------------------------------------- http://derstandard.at/2000011347067 *** Revetons design refreshed - Winter 2015 *** --------------------------------------------- Those days Reveton is mainly pushed on adult traffic via "standalone" CVE-2015-0311 flash (posing as advert) calling an Xtea encoded stream. After not far from 2 years with the same design it's now showing some .. --------------------------------------------- http://malware.dontneedcoffee.com/2015/02/RevetonWinter2015.html *** The Anthem Breach: What We Know Now *** --------------------------------------------- I learned about the breach directly from the CEO before all the hype and speculation hit. This is the level of caring and responsibility I personally expect as an Anthem customer. So now that the news is out there, let's talk about the technical aspects of the breach. --------------------------------------------- http://blog.beyondtrust.com/the-anthem-breach-what-we-know-now *** GE and MACTek HART Device DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the HART Device Type Manager (DTM) library utilized in GE and MACTek's HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-036-01 *** Pepperl+Fuchs Hart Device DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights GmbH HART Device DTM library utilized in Pepperl+Fuchs' HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-036-02 *** CodeWrights GmbH HART Device DTM Vulnerability (Update C) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-15-012-01B CodeWrights GmbH HART DTM Vulnerability that was published January 27, 2015, .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-012-01C *** Datenschutz: Wie sicher ist die IP-Telefonie? *** --------------------------------------------- Können Dritte ohne großen Aufwand IP-Telefonate mithören? Die Antwort ist wie so oft: Jein. Denn trotz mangelnder Verschlüsselung ist die IP-Telefonie nicht ganz so unsicher wie behauptet - zumindest ist es für Angreifer schwierig, Telefonate abzuhören. --------------------------------------------- http://www.golem.de/news/datenschutz-wie-sicher-ist-die-ip-telefonie-1502-1… *** Preparing for the unknown - A peek into Cyber Europe *** --------------------------------------------- ENISA is supporting Member States to cope with major cybersecurity crises with its flagship Cyber Europe programme. Five years after the first ever European wide cyber exercise, Cyber Europe evolved into a unique multinational crisis simulation which immerses participants into the unknown. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/preparing-for-the-unknown-a-pee… *** 7 Best WordPress Security Plugins *** --------------------------------------------- WordPress is the most popular blogging platform in the world. Millions of websites including various popular blogs are using WordPress as a content publishing platform. So, hackers are also more interested in hacking .. --------------------------------------------- http://resources.infosecinstitute.com/7-best-wordpress-security-plugins/ *** Neue Spuren im Sony-Hack führen nach Russland *** --------------------------------------------- Neue Indizien im Fall des Sony-Hacks sollen belegen, dass russische Hacker in den Vorfall involviert sind. Einem Bericht zufolge haben diese aktuell immer noch Zugriff auf das Netzwerk von Sony Pictures Entertainment. --------------------------------------------- http://heise.de/-2543005 *** Fessleak malvertising campaign used to serve ransomware *** --------------------------------------------- Invincea has been monitoring the Fessleak campaign in which hackers leveraged Adobe Flash Player exploits and file-less infections to serve ransomware. --------------------------------------------- http://securityaffairs.co/wordpress/33153/cyber-crime/fessleak-malvertising…

1 0

Tageszusammenfassung - Donnerstag 5-02-2015
by Daily end-of-shift report 05 Feb '15

05 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 04-02-2015 18:00 − Donnerstag 05-02-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Zero-day in the Fancybox-for-WordPress Plugin *** --------------------------------------------- Our research team was alerted to a possible malware outbreak affecting many WordPress websites. All the infections had a similar malicious iframe from '203koko' injected into the website. We were also directed to a forum thread .. --------------------------------------------- http://blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugi… *** SA-CONTRIB-2015-037 - Path Breadcrumbs - Access Bypass *** --------------------------------------------- https://www.drupal.org/node/2420139 *** Analyzing CVE-2015-0313: The New Flash Player Zero Day *** --------------------------------------------- Adobe has started rolling out an update to Flash Player which fixes the zero-day vulnerability we discussed earlier this week. This particular vulnerability can be exploited .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-20… *** Russische Malware zielt auf iOS-Geräte, saugt alle Daten ab *** --------------------------------------------- Die IT-Sicherheitsfirma "TrendLabs" berichtet, dass eine SpyWare namens XAgent sich mittlerweile auf iPhone und iPads ausgebreitet hat. Bereits vergangenes Jahr war von dem Schadprogramm die Rede, damals griff die Anwendung Windows-Rechner in Regierungsorganisationen, .. --------------------------------------------- http://derstandard.at/2000011311181 *** Sicherheitsstandards ignoriert: BMW-Hack war vermeidbar *** --------------------------------------------- Der kürzlich bekannt gewordene Hack von Autos der Marke BMW wäre auf einfache Weise vermeidbar gewesen. Das Computermagazin c’t zeigt im Detail, wie der Autokonzern zentrale .. --------------------------------------------- http://derstandard.at/2000011322698 *** Flash Zero Days Dominate Exploit Landscape *** --------------------------------------------- The recent Flash zero-day vulnerabilities and exploits have uncovered the relatively quiet Hanjuan exploit kit, and further exposed the dangers of malvertising. --------------------------------------------- http://threatpost.com/flash-zero-days-dominate-exploit-landscape/110871 *** Internet Explorer Cross-Site Scripting Vulnerability Now Public *** --------------------------------------------- Security researcher David Leo has disclosed a new vulnerability in Microsoft Internet Explorer. The vulnerability allows the same origin policy of the browser to be violated. The same-origin policy restricts how a document or .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/internet-explore… *** Anatomy of a Brute Force Campaign: The Story of Hee Thai Limited *** --------------------------------------------- This is the tale of an ongoing SSH brute forcing campaign, targeting servers and network devices, that distributes a new family of Linux rootkit malware named 'XOR.DDoS'. While typical DDoS bots are straightforward in operation and often programmed in a high-level script such as PHP or Perl, the XOR.DDoS family is programming in C/C++ and incorporates multiple .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/02/anatomy_of_a_brutef.ht… *** Security updates available for Adobe Flash Player (APSB15-04) *** --------------------------------------------- A Security Bulletin (APSB15-04) has been published regarding security updates for Adobe Flash Player. These updates address CVE-2015-0313, which is being actively exploited in the wild via drive-by-download attacks against systems .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1175

1 0

Tageszusammenfassung - Mittwoch 4-02-2015
by Daily end-of-shift report 04 Feb '15

04 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 03-02-2015 18:00 − Mittwoch 04-02-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New Wave of CTB-Locker/Critroni Ransomware Hitting Victims *** --------------------------------------------- There is a new wave of attacks delivering the CTB-Locker or Critroni crypto ransomware, arriving through spam messages with a variety of lures in several different countries. CTB-Locker is one of the newer variants in the crypto .. --------------------------------------------- http://threatpost.com/new-wave-of-ctb-lockercritroni-ransomware-hitting-vic… *** Advisory - Dangerous "nonce" leak in UpdraftPlus *** --------------------------------------------- Advisory for: UpdraftPlus Security Risk: High Exploitation level: Remote DREAD Score: 7/10 Vulnerability: Privilege Escalation Patched Version: 1.9.51 If you're a user of the UpdraftPlus plugin for WordPress, now is the time to update. During .. --------------------------------------------- http://blog.sucuri.net/2015/02/advisory-dangerous-nonce-leak-in-updraftplus… *** UpdraftPlus <= 1.9.50 - Privilege Escalation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7781 *** 1,800 Domains Overtaken by Flash Zero Day *** --------------------------------------------- Researchers at Cisco say that a Flash zero day exploit has compromised 1,800 domains, the majority of those during a 48-hour period last week. --------------------------------------------- http://threatpost.com/1800-domains-overtaken-by-flash-zero-day/110835 *** Multiple vulnerabilities in Cisco Unified IP Phone 9900 *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** MIT Kerberos Multiple Flaws in kadmind Let Remote Users Obtain Potentially Sensitive Information and Remote Authenticted Users Execute Arbitrary Code *** --------------------------------------------- MIT Kerberos Multiple Flaws in kadmind Let Remote Users Obtain Potentially Sensitive Information and Remote Authenticted Users Execute Arbitrary Code --------------------------------------------- http://www.securitytracker.com/id/1031691 *** Siemens SCALANCE X-200IRT Switch Family User Impersonation Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a user impersonation vulnerability in the Siemens SCALANCE X-200IRT Switch Family. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-034-01 *** Siemens Ruggedcom WIN Vulnerability *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities in the Siemens Ruggedcom WIN firmware. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-034-02 *** An In-depth analysis of the Fiesta Exploit Kit: An infection in 2015 *** --------------------------------------------- A while ago I blogged about the Fiesta exploit kit, this was back in September 2013 [Fiesta Exploit Kit analysis serving MSIE exploit CVE-2013-2551] in this blog I focused on the integration of the MSIE exploit and parts of the landing page. --------------------------------------------- http://blog.0x3a.com/post/110052845124/an-in-depth-analysis-of-the-fiesta-e… *** Play Store: Weit verbreitete Apps zeigen Adware verzögert an *** --------------------------------------------- Apps aus Googles Play Store mit Downloadzahlen von stellenweise über 5 Millionen beinhalten Adware, die den Nutzer zu dubiosen Appstores oder Anwendungen mit Premium-SMS-Versand weiterleiten. Interessant ist dabei die Art und Weise, wie die Werbung an den Nutzer gebracht wird. --------------------------------------------- http://www.golem.de/news/play-store-weit-verbreitete-apps-zeigen-adware-ver… *** Threat Analysis Template For BYOD Applications *** --------------------------------------------- Your IT department is certainly not at a loss when it comes to worrying about BYOD applications. Indeed, the list of threats to enterprise applications and the data they contain is a long one, and security professionals are .. --------------------------------------------- http://resources.infosecinstitute.com/threat-analysis-template-byod-applica… *** So schützen Sie sich vor der Flash-Lücke *** --------------------------------------------- Während Adobe weiterhin keine konkreten Schutzmaßnahmen kennt oder nennt, rät das BSI ganz klar zur Deinstallation des Flash Player. Wer nicht handelt und Flash weiterhin aktiv lässt, geht ein großes Risiko ein. --------------------------------------------- http://heise.de/-2539858 *** Cisco WebEx Meetings Server Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Pawn Storm Update: iOS Espionage App Found *** --------------------------------------------- In our continued research on Operation Pawn Storm, we found one interesting poisoned pawn - spyware specifically designed for espionage on iOS devices. While spyware targeting Apple users is highly notable by itself, this particular spyware is also involved in a targeted attack. Background .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-updat…

1 0

Tageszusammenfassung - Dienstag 3-02-2015
by Daily end-of-shift report 03 Feb '15

03 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 02-02-2015 18:00 − Dienstag 03-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Cisco Anyconnect and Cisco HostScan Web Launch XSS Vulnerability *** --------------------------------------------- A vulnerability in Cisco AnyConnect Secure Mobility Client and Cisco Host Scan could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the client when AnyConnect is launched through the web interface. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco UCS C-Series Rack Servers Integrated Management Controller Cross-Frame Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web interface of the Cisco Integrated Management Controller of the Cisco Unified Computing System C-Series Rack Servers could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Remember Me Safely - Secure Long-Term Authentication Strategies *** --------------------------------------------- Lets say you have a web application with a user authentication system, wherein users must provide a username (or email address) and password to access certain resources. Lets also say that its properly designed (it uses .. --------------------------------------------- https://resonantcore.net/blog/2015/02/remember-me-safely-secure-long-term-a… *** How a penetration test helps you meet PCI compliance guidelines *** --------------------------------------------- In order to protect credit card data, sometimes businesses have to think like a hacker. Every year, merchants who transmit, process, or store payment card data must conduct a suite of security test... --------------------------------------------- http://www.net-security.org/article.php?id=2213 *** Trotz Update: Adobe warnt vor neuer Flash Player-Lücke *** --------------------------------------------- Nachdem vor einer Woche kritische Sicherheitslücken geschlossen wurden, muss Adobe erneut warnen --------------------------------------------- http://derstandard.at/2000011209756 *** DSA-3151 python-django - security update *** --------------------------------------------- Several vulnerabilities were discovered in Django, a high-level Pythonweb development framework. The Common Vulnerabilities and Exposuresproject identifies the following problems: --------------------------------------------- https://www.debian.org/security/2015/dsa-3151 *** Creative Evasion Technique Against Website Firewalls *** --------------------------------------------- During one of our recent in-house Capture The Flag (CTF) events, I was playing with the idea of what could be done with Non-Breaking Spaces. I really wanted to win and surely there had to be a way through the existing evasion controls. This post is going to be a bit code-heavy for most end-users,Read More --------------------------------------------- http://blog.sucuri.net/2015/02/creative-evasion-technique-against-website-f… *** XSS, XFS, Open Redirect Vulnerabilities Found on About.com (SecurityWeek) *** --------------------------------------------- http://www.securityweek.com/xss-xfs-open-redirect-vulnerabilities-found-abo… *** Beware of emails pushing Google Chrome updates! *** --------------------------------------------- Google Chrome users are being actively targeted with a spam email campaign impersonating the Internet giant, urging them to download a newer version of the popular browser because theirs .. --------------------------------------------- http://www.net-security.org/malware_news.php *** Online-Erpresser verschlüsseln Datenbank und fordern 50.000 US-Dollar Lösegeld *** --------------------------------------------- Sicherheitsexperten habe eine perfide Erpressungsmasche entdeckt: Die Täter manipulieren Web-Dienste so, dass sie die von den Nutzern eingegebenen Daten verschlüsselt speichern. --------------------------------------------- http://heise.de/-2535621 *** Low VirusTotal detection rates for new malware, do they matter? *** --------------------------------------------- It is not as important as is often suggested - and doesn't mean the malware is allowed to execute.It is fairly common these days for security researchers to write about new malware attacks and point to low anti-virus detection rates when the affected sample is uploaded to VirusTotals multi-AV .. --------------------------------------------- http://www.virusbtn.com/blog/2015/02_03.xml? *** Google belohnt auch Sicherheitsforscher, die keine Lücken finden *** --------------------------------------------- Wer nach neuen Schwachstellen sucht, weiss nie, ob sich die investierte Zeit rechnet. Bei traditionellen Bug Bounties winkt schliesslich nur im Erfolgsfall Bares. Google experimentiert nun mit einem neuen Ansatz. --------------------------------------------- http://heise.de/-2535890 *** Dumping Git Data from Misconfigured Web Servers *** --------------------------------------------- Every so often when performing a penetration test against a web application or a range of external/internal servers I come across publicly accessible .git directories. Git is a revision control tool that helps keep track of .. --------------------------------------------- https://blog.netspi.com/dumping-git-data-from-misconfigured-web-servers/

1 0

Tageszusammenfassung - Montag 2-02-2015
by Daily end-of-shift report 02 Feb '15

02 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 30-01-2015 18:00 − Montag 02-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Security Advisory for Adobe Flash Player (APSA15-02) *** --------------------------------------------- A Security Advisory (APSA15-02) has been published regarding a critical vulnerability (CVE-2015-0313) in Adobe Flash Player 16.0.0.296 and earlier versions for Windows, Macintosh and Linux. We are aware of reports that this .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1171 *** Cisco NX-OS Software TACACS+ Command Authorization Vulnerability *** --------------------------------------------- The vulnerability is due to incorrect processing of very long command-line interface (CLI) commands by the TACACS+ command authorization feature. An attacker could exploit this vulnerability by being locally authenticated and executing a long CLI command that is subject to command authorization. An exploit could allow the attacker to cause the device to reload. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cobham Sailor 900 VSAT Buffer Overflow Vulnerability *** --------------------------------------------- This alert provides early notice of uncoordinated buffer overflow vulnerability disclosure of the Cobham Sailor 900 VSAT. --------------------------------------------- https://ics-cert.us-cert.gov//alerts/ICS-ALERT-15-030-01 *** Analysis Of An Interesting Windows Kernel Change Mitigating Vulnerabilities In Some Security Products *** --------------------------------------------- Last year I started researching into the Windows kernel to get a better understanding of privilege escalation vulnerabilities. Vulnerabilities in the kernel are a serious issue as they could be used to bypass browsers sandboxes and end up compromising the entire system. In general most people .. --------------------------------------------- https://www.greyhathacker.net/?p=818 *** Akamai's state of the internet security *** --------------------------------------------- A significant increase in the number of DDoS attacks was measured in Q4 2014: a 57 percent increase compared to last quarter and a 90 percent increase compared to Q4 2013. No attack size records were broken. A new attack vector using a Christmas tree packet generated one of the quarters nine largest attacks. --------------------------------------------- http://www.stateoftheinternet.com/downloads/pdfs/2014-internet-security-rep… *** Check autorun entries with VirusTotal - Autoruns v13 *** --------------------------------------------- Version 13 of Autoruns which was release January 29, 2015 includes a very handy feature to check unknown autorun entries with Virustotal 'automatically'. It's integrated .. --------------------------------------------- http://infected.io/41/check-autorun-entries-with-virustotal-autoruns-v13 *** HipChat Security Notice and Password Reset *** --------------------------------------------- Atlassian's security team has discovered and blocked suspicious activity on the HipChat service that resulted in unauthorized access to names, usernames, email addresses, and encrypted passwords for a very small percentage (<2%) of our users. We have no evidence that any payment information was accessed. --------------------------------------------- https://blog.hipchat.com/2015/02/01/hipchat-security-notice-and-password-re… *** Dshell *** --------------------------------------------- An extensible network forensic analysis framework. Enables rapid development of plugins to support the dissection of network packet captures. Key features: Robust stream reassembly IPv4 and IPv6 support Custom output handlers Chainable decoders --------------------------------------------- https://github.com/USArmyResearchLab/Dshell *** Multiple vulnerabilities in Wordpress-plugins *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7777 https://wpvulndb.com/vulnerabilities/7779 https://wpvulndb.com/vulnerabilities/7778 *** RansomWeb ransomware targets companies databases *** --------------------------------------------- Encryption first added as a patch, key only removed when all backups are encrypted.Make backups, they said. Then you wont have to worry about ransomware, they said.Ransomware has quickly become one of the most frustrating kinds of cyber attack. We all know that our devices could suddenly die, and if .. --------------------------------------------- http://www.virusbtn.com/blog/2015/02_02.xml *** Internet Explorer 11 lässt Webseiten Anwender ausspionieren *** --------------------------------------------- Sicherheitsexperten haben eine Schwachstelle im Internet Explorer 11 gefunden, über die Angreifer Webseiten so manipulieren können, dass sie den Anwender ausspionieren. Ein Patch lässt noch auf sich warten – andere Web-Browser sind aber nicht anfällig. --------------------------------------------- http://heise.de/-2534975 *** Flash-Player deaktivieren! Schon wieder Angriffe auf ungepatchte Lücke *** --------------------------------------------- Und täglich grüßt die Flash-Lücke: Nur eine Woche war Ruhe, jetzt ist die nächste kritische Schwachstelle aufgetaucht. Da diese bereits ausgenutzt wird, sollte Flash wieder ein mal abgeschaltet werden. --------------------------------------------- http://heise.de/-2535100 *** OpenSSH: Key-Rotation für die Secure Shell *** --------------------------------------------- Bei der nächsten Version von OpenSSH wird es möglich sein, Server-Keys mit einem automatisierten Verfahren zu rotieren. Bislang ließen sich Schlüssel bei SSH nur mit viel .. --------------------------------------------- http://www.golem.de/news/openssh-key-rotation-fuer-die-secure-shell-1502-11…

1 0

Tageszusammenfassung - Freitag 30-01-2015
by Daily end-of-shift report 30 Jan '15

30 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 29-01-2015 18:00 − Freitag 30-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** The Vast World of Fraudulent Routing *** --------------------------------------------- As network security engineers have attempted to categorize blocks of IP addresses associated with spam or malware for subsequent filtering at their firewalls, the bad guys have had to evolve to continue to target their victims. Since routing ... --------------------------------------------- http://research.dyn.com/2015/01/vast-world-of-fraudulent-routing/ *** Neue Outlook-App: Microsoft liest auch bei Firmenmails mit *** --------------------------------------------- Neue App für Android und iOS mit zweifelhafter Funktionalität - Exchange- und iCloud-Passwörter online gespeichert --------------------------------------------- http://derstandard.at/2000011053283 *** The Internet of Dangerous Things *** --------------------------------------------- Distributed denial-of-service (DDoS) attacks designed to silence end users and sideline Web sites grew with alarming frequency and size last year, according to new data released this week. Those findings dovetail quite closely with .. --------------------------------------------- http://krebsonsecurity.com/2015/01/the-internet-of-dangerous-things/ *** Microsoft Publishes Information Sharing Guidelines *** --------------------------------------------- Microsoft publishes a framework and guidelines on how to effectively set up and operate threat information sharing exchanges in hopes that organizations will actually share data. --------------------------------------------- http://threatpost.com/microsoft-publishes-information-sharing-guidelines/11… *** Blubrry PowerPress <= 6.0 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7773 *** Honeywell HART DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights GmbH HART .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-029-01 *** Multiple vulnerabilities in Cisco WebEx Meetings *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** D-Link routers vulnerable to DNS hijacking *** --------------------------------------------- Todor Donev, a member of the Ethical Hacker research team, says that the vulnerability is found in the ZynOS firmware of the device, D-Links DSL-2740R ADSL modem/wireless router. The firmware in question is implemented in many networking equipment manufactured by D-Link, TP-Link Technologies and ZTE, he noted ... Donev hasnt notified D-Link of this flaw, but has released exploit code for the flaw in a security advisory. --------------------------------------------- http://www.net-security.org/secworld.php?id=17888 *** Drei neue Versionen von Safari: Sicherheitslücken geschlossen *** --------------------------------------------- Für OS X 10.10, OS X 10.9 und OS X 10.8 stehen Updates für den Apple-Browser zur Verfügung. Sie beheben vor allem Sicherheitslücken. --------------------------------------------- http://heise.de/-2530322 *** Nearly half of all DDoS attacks uses multiple attack vectors *** --------------------------------------------- Akamai released a new security report that provides analysis and insight into the global attack threat landscape including DDoS attacks. Akamai observed a 52 percent increase in average peak band... --------------------------------------------- http://www.net-security.org/secworld.php?id=17896 *** GHOST glibc Vulnerability Affects WordPress and PHP applications *** --------------------------------------------- ... security researchers have discovered that PHP applications, including the WordPress Content Management System (CMS), could also be affected by the bug. ... According to the Sucuri researcher Marc-Alexandre Montpas, GHOST vulnerability could be a big issue for WordPress CMS, as it uses wp_http_validate_url() function to validate every pingback post URL. --------------------------------------------- http://thehackernews.com/2015/01/ghost-linux-security-vulnerability_29.html *** BMW-Patzer schürt Angst vor Hackerangriffen auf Autos *** --------------------------------------------- Schwachstelle beim deutschen Autohersteller inzwischen behoben - --------------------------------------------- http://derstandard.at/2000011080438 *** We got hacked! Now what? *** --------------------------------------------- Almost a year ago, I experienced my first real security incident. The companys bulletin board was compromised and it was my job to oversee and coordinate the incident response. The teams and I where pretty much thrown into the cold water, as weve never experienced an incident of that size before. --------------------------------------------- https://www.hashtagsecurity.com/we-got-hacked-now-what/ *** Vertipper-Domains als Geschäftsmodell *** --------------------------------------------- Einer Studie zufolge können Markeninhaber kaum verhindern, dass sogenannte Typosquatter Internet-Domains registrieren, die dem eigenen Namen nur fast entsprechen. --------------------------------------------- http://heise.de/-2533708

1 0

Tageszusammenfassung - Donnerstag 29-01-2015
by Daily end-of-shift report 29 Jan '15

29 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 28-01-2015 18:00 − Donnerstag 29-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** IT-Security-Links #69 *** --------------------------------------------- Trojan.Tubrosa is a new click-fraud malware. The attackers compromise victims' computers via Spam campaigns to use them to automatically inflate their YouTube video views. The malware .. --------------------------------------------- http://securityblog.switch.ch/2015/01/27/it-security-links-69/ *** Asterisk Project Security Advisory - AST-2015-002 *** --------------------------------------------- CVE-2014-8150 reported an HTTP request injection vulnerability in libcURL. Asterisk uses libcURL in its func_curl.so module (the CURL() dialplan function), as well as its res_config_curl.so (cURL realtime backend) modules. Since Asterisk .. --------------------------------------------- http://downloads.asterisk.org/pub/security/AST-2015-002.html *** ENISA Cloud Certification Schemes Metaframework *** --------------------------------------------- ENISA publishes a meta-framework and an online tool to help customers with cloud security when buying cloud services. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa-cloud-certification-s… *** Debian Security Advisory DSA-3143-1 virtualbox -- security update *** --------------------------------------------- CVE-2015-0377, CVE-2015-0418. Two vulnerabilities have been discovered in VirtualBox, a x86 virtualisation solution, which might result in denial of service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3143 *** CVE-2015-0311 (Flash up to 16.0.0.287) integrating Exploit Kits *** --------------------------------------------- Patched with Flash 16.0.0.296 the CVE-2015-0311 has been first seen exploited by Angler EK ( 2015-01-20 ) , soon after used in "standalone" mode in huge malvert campaign (pushing either Reveton, either Bedep (doing adfraud and .. --------------------------------------------- http://malware.dontneedcoffee.com/2015/01/cve-2015-0311-flash-up-to-1600287…

1 0

Tageszusammenfassung - Mittwoch 28-01-2015
by Daily end-of-shift report 28 Jan '15

28 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 27-01-2015 18:00 − Mittwoch 28-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** 2755801 - Update for Vulnerabilities in Adobe Flash Player in Internet Explorer - Version: 36.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/2755801 *** USN-2486-1: OpenJDK 6 vulnerabilities *** --------------------------------------------- Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial .. --------------------------------------------- http://www.ubuntu.com/usn/usn-2486-1/ *** VMware Security Advisories - 1 New, 1 Updated, (Wed, Jan 28th) *** --------------------------------------------- VMware has released an new and updated security advisory today. The two security advisories, listed below, address numerous vulnerabilities in the VMware .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19241 *** Magnetrol HART DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input validation vulnerability in the CodeWrights GmbH HART DTM library utilized by some Magnetrol products. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-027-01 *** Schneider Electric Multiple Products Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in Schneider Electric's SoMove Lite software package. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-027-02 *** CodeWrights GmbH HART DTM Vulnerability (Update B) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-15-012-01A CodeWrights GmbH HART DTM Vulnerability that was published January 13, 2015, on the ICS-CERT web site. This updated advisory provides mitigation details for an improper input validation vulnerability in CodeWrights .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-012-01B *** Bug in ultra secure BlackPhone let attackers decrypt texts, stalk users *** --------------------------------------------- A recently fixed vulnerability in the BlackPhone instant messaging application gave attackers the ability to decrypt messages, steal contacts, and control vital functions of the device, which is marketed as a more secure way to protect communications from government and criminal snoops. --------------------------------------------- http://arstechnica.com/security/2015/01/bug-in-ultra-secure-blackphone-let-… *** CVE-2015-0016: Escaping the Internet Explorer Sandbox *** --------------------------------------------- I analyzed this vulnerability (designated as CVE-2015-0016) because it may be the first vulnerability in the wild that showed the capability to escape the Internet Explorer sandbox. As sandboxing represents a key part of exploit mitigation techniques, any exploit that can break established sandboxes is worth a second look. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2015-0016-es… *** Multiple vulnerabilities in the FreeBSD kernel code *** --------------------------------------------- Francisco Falcon from the Core Exploit Writers Team found multiple vulnerabilities in the FreeBSD kernel code that implements the vt console driver (previously known as Newcons) and the .. --------------------------------------------- http://www.net-security.org/secworld.php?id=17882 *** Neue Apple-TV-Software behebt zahlreiche Sicherheitslücken *** --------------------------------------------- Neben iOS 8.1.3 und OS X 10.10.2 hat Apple am Dienstagabend auch noch ein Update der Software seiner Multimediabox veröffentlicht. Neue Funktionen hat die offenbar nicht, dafür jede Menge Fixes. --------------------------------------------- http://heise.de/-2530119 *** Apple security updates 27 Jan 2015 *** --------------------------------------------- http://support.apple.com/en-us/HT1222

1 0

Tageszusammenfassung - Dienstag 27-01-2015
by Daily end-of-shift report 27 Jan '15

27 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 26-01-2015 18:00 − Dienstag 27-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Java is the biggest vulnerability for US computers *** --------------------------------------------- Oracles Java poses the single biggest security risk to US desktops, according to a new report from Copenhagen-based security vendor Secunia ApS, because of its penetration rate, number of vulnerabilities, and patch status.According to the report, 48 percent of users arent running the .. --------------------------------------------- http://www.csoonline.com/article/2875535/application-security/java-is-the-b… *** Beyond "fake invoice" scams - crooks can get money out of real invoices, too! *** --------------------------------------------- If I told you to change your record of a suppliers bank account so I got all the payments, would you do so? 1000s of companies did, and didnt spot the misdirected payments until an average of $100,000 had gone west... --------------------------------------------- https://nakedsecurity.sophos.com/2015/01/26/beyond-fake-invoice-scams-crook… *** ENISA draws the Cyber Threat Landscape 2014: 15 top cyber threats, cyber threat agents, cyber-attack methods and threat trends for emerging technology areas *** --------------------------------------------- ENISA's Threat Landscape 2014 (ETL 2014) published today is the third yearly report in sequence, consolidating and analysing the top cyber threats and the evolution, encountered in 2014. ENISA Threat Landscape 2014, an activity contributing towards achieving the objectives formulated in the Cyber Security Strategy for the EU, stresses the importance of threat analysis and the identification of emerging trends in cyber security. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa-draws-the-cyber-threa… *** Critical glibc update (CVE-2015-0235) in gethostbyname() calls *** --------------------------------------------- A heap-based buffer overflow was found in glibc's __nss_hostname_digits_dots() function, which is used by the gethostbyname() and gethostbyname2() glibc function calls. A remote attacker able to make an application call either of these functions could use this flaw to execute arbitrary code with the permissions of the user running the application. --------------------------------------------- http://ma.ttias.be/critical-glibc-update-cve-2015-0235-gethostbyname-calls/ *** Security updates available for Adobe Flash Player *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of reports that CVE-2015-0311 is actively being exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below. Adobe recommends .. --------------------------------------------- https://helpx.adobe.com/security/products/flash-player/apsb15-03.html

1 0

Tageszusammenfassung - Montag 26-01-2015
by Daily end-of-shift report 26 Jan '15

26 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 23-01-2015 18:00 − Montag 26-01-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** System Center Endpoint Protection support for Windows Server 2003 *** --------------------------------------------- >From July 14, 2015, Windows Server 2003 will cease to be a supported operating system. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/01/23/system-center-endpoint-p… *** Sicherheitslücke in Millionen Android-Geräten: Google empfiehlt Chrome oder Firefox als Abhilfe *** --------------------------------------------- Scharfe Kritik gibt es seit bekannt wurde, dass Google Sicherheitslücken im alten Standard-Browser von Android nicht mehr schließen will. Die Abhilfe, die Google nun empfiehlt, ist nicht so recht befriedigend. --------------------------------------------- http://heise.de/-2528130 *** OS X 10.10.2: Apple patcht "Thunderstrike"-Angriff und Googles Zeroday-Lücken *** --------------------------------------------- In der jüngsten Yosemite-Beta sollen gleich mehrere problematische Fehler behoben sein. Wann die Finalversion erscheint, bleibt unklar. Der Entdeckter von "Thunderstrike" kritisierte Apple. --------------------------------------------- http://www.heise.de/newsticker/meldung/OS-X-10-10-2-Apple-patcht-Thunderstr… *** Firewall-Update: IPFire 2.15 auf Core Update 86 aktualisiert *** --------------------------------------------- Die Aktualisierung stopft etliche Sicherheitslücken in diversen Paketen. Die Entwickler empfehlen daher dringend, das Update umgehend einzuspielen und die Firewall anschließend neu zu starten. --------------------------------------------- http://heise.de/-2528391 *** Adobe stiftet Verwirrung mit falschen Versionsangaben für Flash *** --------------------------------------------- Die Flash-Macher haben die kritische Lücke in ihrer Software endlich geschlossen. Leider vermitteln sie auf der offiziellen Flash-Webseite noch den Eindruck, die verwundbare Version wäre die neueste und damit sicher. --------------------------------------------- http://www.heise.de/newsticker/meldung/Adobe-stiftet-Verwirrung-mit-falsche… *** Factsheet: Help! My website is vulnerable to SQL injection *** --------------------------------------------- SQL injection is a popular and frequently used attack on websites, which attackers use to steal large volumes of (client) information. Although there are other types of attacks for capturing this information, SQL injection appears to be a frequently used method.A website becomes vulnerable to SQL injection when attackers are able to influence the queries sent by a website to a database. --------------------------------------------- https://www.ncsc.nl/english/services/expertise-advice/knowledge-sharing/fac… *** Demystifying Cross-Site Request Forgery *** --------------------------------------------- Continuously ranked in the OWASP Top Ten, a large majority of the development community still doesnt understand Cross-Site Request Forgery (CSRF). After years of penetration tests and code reviews, my experiences show that a high percentage of applications, especially new applications, do not have proper CSRF protections in place. This post provides a refresher on CSRF and provides a common defense for this issue. --------------------------------------------- http://software-security.sans.org/blog/2015/01/23/demystifying-cross-site-r… *** Analyzing CVE-2015-0311: Flash Zero Day Vulnerability *** --------------------------------------------- Last week a major zero-day vulnerability (was found in Adobe Flash Player. Over the weekend, Adobe started releasing an update to fix the vulnerability: users who have enabled auto-update have already received the newest version (16.0.0.296). Our analysis has confirmed that the vulnerable code has been modified. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/2RZECpZzdak/ *** Cisco 2900 Series Integrated Services Router Network-Based Application Recognition Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Network-Based Application Recognition (NBAR) protocol process of the Cisco 2900 Series Integrated Services Router could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability occurs when the NBAR process locks. An attacker could exploit this vulnerability by sending simple IP version 4 (IPv4) packets through the router. An exploit could allow the attacker to cause a DoS condition that would require a router restart. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Freitag 23-01-2015
by Daily end-of-shift report 23 Jan '15

23 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 22-01-2015 18:00 − Freitag 23-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Malvertising leading to Flash Zero Day via Angler Exploit Kit *** --------------------------------------------- Background As part of our daily research activity, we came across this blog mentioning an Angler Exploit Kit (EK) instance serving a possible zero day Adobe Flash exploit .. --------------------------------------------- http://research.zscaler.com/2015/01/malvertising-leading-to-flash-zero-day.… *** UPDATED: Security updates available for Adobe Flash Player (APSB15-02) *** --------------------------------------------- A Security Bulletin (APSB15-02) has been published regarding security updates for Adobe Flash Player. These updates address a vulnerability (CVE-2015-0310) that .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1157 *** New RATs Emerge from Leaked Njw0rm Source Code *** --------------------------------------------- In the middle of my research on the remote access Trojan (RAT) known as 'njrat' or 'Njw0rm', I stumbled upon dev-point.com, a site that disguises itself as a site for 'IT enthusiasts' but actually hosts various downloaders, different types of spyware, and RATs. I explored the site and found that they host .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-… *** Multiple vulerabilities in McAffee products *** --------------------------------------------- http://www.securitytracker.com/id/1031618 http://www.securitytracker.com/id/1031617 http://www.securitytracker.com/id/1031616 *** Google Apps Flaw Allowed Hacker to Hijack Account and Disable Two-factor Authentication *** --------------------------------------------- A critical cross-site scripting (XSS) vulnerability in the Google Apps administrator console allowed cyber criminals to force a Google Apps admins to execute just about .. --------------------------------------------- http://thehackernews.com/2015/01/google-account-hacking.html *** Google veröffentlicht weitere OS-X-Lücken *** --------------------------------------------- Im vergangenen Jahr gegründet, dreht Googles Project Zero derzeit so etwas wie eine Vorstellungstour bei den großen Softwareherstellern. Wenn auch wohl nicht ganz in deren Sinne. Nach einer Reihe von Fehlern in Microsofts Windows, ist nun offenbar Apples OS X an der Reihe. --------------------------------------------- http://derstandard.at/2000010780464 *** Microsoft lässt Server-2003-Lücke ungepatcht *** --------------------------------------------- Eine Sicherheitslücke im Netzwerkerkennungsdienst NLA von Windows Server 2003 wird nicht geschlossen, obwohl das Betriebssystem eigentlich noch Sicherheitsupdates erhalten sollte. --------------------------------------------- http://heise.de/-2526994 *** Scareware App Downloaded Over a Million Times from Google Play *** --------------------------------------------- We have recently been investigating an antivirus app in the Google Play store that was displaying fake virus detection results to scare users into purchasing .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/scareware-app-downloaded… *** Adobe will Flash-Lücke erst nächste Woche schliessen *** --------------------------------------------- Im Flash Player klafft eine kritische Lücke, über die Angreifer das System komplett übernehmen können. Diese wird bereits aktiv ausgenutzt. Adobe will sich trotzdem bis nächste Woche mit dem Patch Zeit lassen. --------------------------------------------- http://heise.de/-2527107 *** The Likelihood of Cyber-Terrorism Today *** --------------------------------------------- Introduction The virtual space has over time become something of real importance for business, politics, work, communities and communications. In becoming gradually more and more dependent and addicted to the Internet, .. --------------------------------------------- http://resources.infosecinstitute.com/likelihood-cyber-terrorism-today/ *** How Vulnerabilities Happen: Input Validation Problems, (Fri, Jan 23rd) *** --------------------------------------------- We would like to thank Richard Ackroyd of RandomStormfor reporting a critical input validation error in our site to us. As we have done before, here is how it happened so hopefully you can learn from it as well. Lets start with a bit of ,, --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19221 *** The Internet of Gas Station Tank Gauges *** --------------------------------------------- Automated tank gauges (ATGs) are used to monitor fuel tank inventory levels, track deliveries, raise alarms that indicate problems with the tank or gauge (such as a fuel spill), and to perform leak tests in accordance with environmental regulatory .. --------------------------------------------- https://community.rapid7.com/community/infosec/blog/2015/01/22/the-internet… *** Siemens SIMATIC S7-1200 CPU Web Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an open redirect vulnerability in the SIMATIC S7-1200 CPU family. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-022-01 *** 1&1: Kundenportal akzeptierte jedes Passwort *** --------------------------------------------- Durch eine schwerwiegende Panne stand ein Reseller-Kundenportal von 1&1 sperrangelweit offen. Mit einem beliebigen Passwort bekam man administrativen Zugriff auf Hosting-Pakete und Domains - offenbar sogar auf 1und1.de, gmx.de und web.de. --------------------------------------------- http://heise.de/-2527421 *** Deja vu: PHP-Entwickler schliessen Sicherheitslücke zum zweiten Mal *** --------------------------------------------- Sicherheitsforscher Stefan Esser hat wieder zugeschlagen: Dieses Mal musste er eine von ihm entdeckte Lücke zweimal stopfen lassen. Diese erlaubt es, PHP-Applikationen unter bestimmten Bedingungen aus der Ferne anzugreifen. --------------------------------------------- http://heise.de/-2527525

1 0

Tageszusammenfassung - Donnerstag 22-01-2015
by Daily end-of-shift report 22 Jan '15

22 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 21-01-2015 18:00 − Donnerstag 22-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** "Zero-Day"-Sicherheitslücke in Adobe Flash Player (aktiv ausgenützt) *** --------------------------------------------- Wie der bekannte Sicherheitsforscher "Kafeine" in seinem Blog berichtet (http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-f…), scheint es eine neue, noch ungepatchte Sicherheitslücke im Adobe Flash Player zu geben, die aktiv von zumindest einem Exploit Kit ausgenützt wird. --------------------------------------------- https://cert.at/warnings/all/20150122.html *** Security updates available for Adobe Flash Player (APSB15-02) *** --------------------------------------------- A Security Bulletin (APSB15-02) has been published regarding security updates for Adobe Flash Player. These updates address a vulnerability (CVE-2015-0310) that could be used to circumvent memory randomization mitigations on the Windows platform. Adobe is aware of reports that an .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1157 *** Security Advisory - Vulnerabilities in Pagelines/Platform theme for WordPress *** --------------------------------------------- Users of both the Pagelines and Platform themes should update as soon as possible. During a routine audit for our WAF, we found two dangerous issues: A Privilege Escalation vulnerability .. --------------------------------------------- http://blog.sucuri.net/2015/01/security-advisory-vulnerabilities-in-pagelin… *** Tubrosa threat drives millions of views to scammers' YouTube gaming videos *** --------------------------------------------- Cybercriminals are fraudulently earning advertising revenue by spreading click-fraud threat Trojan.Tubrosa, which sends compromised computers to their .. --------------------------------------------- http://www.symantec.com/connect/blogs/tubrosa-threat-drives-millions-views-… *** CTB-Locker Ransomware Includes Freemium Feature, Extends Deadline *** --------------------------------------------- Last July we came across a crypto-ransomware variant known as Critroni or Curve-Tor-Bitcoin (CTB) Locker. We observed recent improvements to the CTB malware, which now offer a 'free decryption' service, extended deadline to .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/ctb-locker-ranso… *** Multiple vulnerabilities in third-party Drupal-modules *** --------------------------------------------- https://www.drupal.org/node/2411737 https://www.drupal.org/node/2411539 https://www.drupal.org/node/2411527 *** Energy Harvesting: Tastatur erkennt Benutzer durch Eigenheiten beim Tippen *** --------------------------------------------- Tippe, und ich sage dir, wer du bist: Forscher in den USA und China haben eine Tastatur entwickelt, die ihren Besitzer am Tippen erkennt. Das könnte eine Ergänzung zu herkömmlichen Passwörtern sein. Die Tastatur gewinnt per Energy Harvesting elektrische Energie aus den Tippbewegungen. --------------------------------------------- http://www.golem.de/news/energy-harvesting-tastatur-erkennt-benutzer-durch-… *** Is 123456 Really The Most Common Password? *** --------------------------------------------- I recently worked with SplashData to compile their 2014 Worst Passwords List and yes, 123456 tops the list. In the data set of 3.3 million passwords I used for SplashData, almost 20,000 of those were in fact 123456. But how often do you really see people using that, or the second most common .. --------------------------------------------- https://xato.net/passwords/123456-common-password/ *** An analysis of Regins Hopscotch and Legspin *** --------------------------------------------- Perhaps one of the most interesting things we observed in the Regin malware operation are the forgotten codenames for some of its modules. We decided to analyse two of these modules in more detail. --------------------------------------------- http://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-a… *** Confluence Security Advisory - 2015-01-21 *** --------------------------------------------- We have discovered and fixed a vulnerability in our fork of WebWork. Attackers can use this vulnerability to execute Java code of their choice on systems that use this framework. The attacker needs to have an account and be able to access the Confluence web interface. --------------------------------------------- https://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+-… *** Yes, Every Freeware Download Site is Serving Crapware *** --------------------------------------------- When we wrote about what happens when you install the top ten apps from CNET Downloads, about half of the comments were from people saying, 'Well you should download from a trusted source.' The only problem is that there isn't a freeware download site that is free of crapware or adware. And here's the result of our investigation to prove it. --------------------------------------------- http://www.howtogeek.com/207692/yes-every-freeware-download-site-is-serving… *** Contact Form 3.82 - Unauthorized Language Manipulation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7761 *** Dataurization of URLs for A More Effective Phishing Campaign *** --------------------------------------------- Phishing with data: URIs is not a new idea. The concept is relatively simple, taking advantage of many user's inexperience with how data: URIs function in order to trick them into entering credentials into a phishing page. We've seen this .. --------------------------------------------- https://thehackerblog.com/dataurization-of-urls-for-a-more-effective-phishi…

1 0

Tageszusammenfassung - Mittwoch 21-01-2015
by Daily end-of-shift report 21 Jan '15

21 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 20-01-2015 18:00 − Mittwoch 21-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Windows Firewall Hook Enumeration *** --------------------------------------------- tl;dr: We're going look in detail at Microsoft Windows Firewall Hook drivers from Windows 2000, XP and 20003. This functionality was leverage ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/01/windows-firewall-hook-enumeration/ *** DSA-3133 privoxy - security update *** --------------------------------------------- https://www.debian.org/security/2015/dsa-3133 *** Siemens SCALANCE X-300/X408 Switch Family DOS Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for denial-of-service vulnerabilities in the Siemens SCALANCE X-300/X408 switch family. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-020-01 *** Schneider Electric ETG3000 FactoryCast HMI Gateway Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities in Schneider Electric's ETG3000 series FactoryCast HMI Gateways. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-020-02 *** Oracle Critical Patch Update Advisory - January 2015 *** --------------------------------------------- Description A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the .. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html *** Google publiziert ungepatchte Lücke in OS X 10.9.5 *** --------------------------------------------- Nachdem der Internetriese im Rahmen seiner Responsible-Disclosure-Politik in den vergangenen Monaten gleich drei offene Windows-Lücken öffentlich machte, ist nun erstmals auch Apple dran. Der Konzern hatte offenbar nicht in der geforderten Zeit reagiert. --------------------------------------------- http://heise.de/-2523449 *** Cisco 2015 Annual Security Report: Java ist sicherer geworden *** --------------------------------------------- 2013 war kein gutes Jahr für Java, denn etliche Sicherheitslücken sorgten für verunsicherte Anwender. Gut, dass Oracle offenbar die richtigen Weichen gestellt hat, denn im vergangenen Jahr wurden deutlich weniger Lücken festgestellt. --------------------------------------------- http://heise.de/-2523408 *** Windows Server 2003 Reaches End of Life In July *** --------------------------------------------- Several readers sent word that were now less than six months away from the end of support for Windows Server 2003. Though the operating systems usage peaked in 2009, it still runs on millions of machines, and many IT departments are just now starting to look at replacements. Although .. --------------------------------------------- http://tech.slashdot.org/story/15/01/21/0423229/windows-server-2003-reaches… *** Bash data exfiltration through DNS (using bash builtin functions) *** --------------------------------------------- After gaining 'blind' command execution access to a compromised Linux host, data exfiltration can be difficult when the system ibinbash2s protected by a firewall. --------------------------------------------- https://forsec.nl/2015/01/bash-data-exfiltration-through-dns-using-bash-bui… *** Discovering and remediating an active but disused botnet *** --------------------------------------------- On a network I help manage, we kept getting malicious DNS alerts for 'luna1.pw' on an appliance we had installed. Due to the way the network was configured, we were able to see the name request coming in but no traffic activity. This .. --------------------------------------------- http://colin.keigher.ca/2015/01/discovering-and-remediating-active-but.html *** rt-sa-2014-010 *** --------------------------------------------- The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if the victim confirms an update on the webinterface during a MITM attack. --------------------------------------------- https://www.redteam-pentesting.de/advisories/rt-sa-2014-010.txt *** Unpatched Vulnerability (0day) in Flash Player is being exploited by Angler EK *** --------------------------------------------- This is a fast post. I will update it heavily in the coming hours/days. I spotted an instance of Angler EK which is sending three different bullets targeting Flash Player : --------------------------------------------- http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-f…

1 0

Tageszusammenfassung - Dienstag 20-01-2015
by Daily end-of-shift report 20 Jan '15

20 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 19-01-2015 18:00 − Dienstag 20-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** How Was Your Credit Card Stolen? *** --------------------------------------------- Almost once a week, I receive an email from a reader who has suffered credit card fraud and is seeking help figuring out which hacked merchant was responsible. I generally reply that this is a fruitless pursuit, and instead encourage readers to keep a close eye on their card statements and .. --------------------------------------------- http://krebsonsecurity.com/2015/01/how-was-your-credit-card-stolen/ *** Symantec Data Center Security: Server Advanced, Multiple Security Issues on Management Server and Protection Policies Rule Bypass *** --------------------------------------------- The management server for Symantec Critical System Protection (SCSP) 5.2.9 and Data Center Security: Server Advanced (SDCS:SA) 6.0.x is susceptible to security issues which could enable privileged access to the management server. Rules in the prevention policies could be bypassed if deployed to SCSP/SDCS:SA agents to restrict access to specific host functionality. --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Verschlüsselung: Neue Angriffe auf RC4 *** --------------------------------------------- Zwei Forscherteams kündigen unabhängig voneinander an, bald neue Angriffe gegen den RC4-Verschlüsselungsalgorithmus vorzustellen. Knapp ein Prozent der Webserver setzt immer noch ausschließlich auf RC4. --------------------------------------------- http://www.golem.de/news/verschluesselung-neue-angriffe-auf-rc4-1501-111805… *** PlugX Malware Found in Official Releases of League of Legends, Path of Exile *** --------------------------------------------- Hacks in Taiwan (HITCON), a security conference hosted in that country, has discovered an attack involving several online games. Official releases of two popular online games were found to be compromised, downloading malware onto computers. HITCON worked with Trend Micro to provide a clean-up .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/plugx-malware-fo… *** Symantec Critical System Protection Multiple Flaws Let Remote Authenticated Users Execute Arbitrary Code, Inject SQL Commands, Conduct Cross-Site Scripting Attacks, and Obtain Potentially Sensitive Information *** --------------------------------------------- Multiple vulnerabilities were reported in Symantec Critical System Protection. A remote authenticated user can execute arbitrary code on the target system. A remote user can conduct cross-site scripting attacks. A remote authenticated .. --------------------------------------------- http://www.securitytracker.com/id/1031566 *** Moodle Bugs Permit Cross-Site Scripting, Cross-Site Request Forgery, and Information Disclosure Attacks *** --------------------------------------------- Multiple vulnerabilities were reported in Moodle. A remote user can cause denial of service conditions. A remote user can conduct cross-site scripting and cross-site request forgery attacks. A remote user can obtain potentially sensitive information. --------------------------------------------- http://www.securitytracker.com/id/1031557 *** F-Secure: Bios-Trojaner aufzuspüren, ist "fast aussichtslos" *** --------------------------------------------- Weil die Antivirenhersteller keine Muster von Regierungs-Malware haben, die PC-Komponenten auf Firmware-Ebene infiziert, können sie diese kaum entdecken. Mikko Hypponen von F-Secure sieht vor allem die Hardwarehersteller in der Pflicht. --------------------------------------------- http://www.golem.de/news/f-secure-bios-trojaner-aufzuspueren-ist-fast-aussi… *** Glorious Leaders Not-That-Glorious Malwares - Part 2 *** --------------------------------------------- This is second (and last) part of the analysis of Korean Central News Agency Malware. If you havent read the first part yet, I would suggest reading that first here. First of all I should mention that its not launch.exe and .. --------------------------------------------- https://www.codeandsec.com/Glorious-Leaders-Not-That-Glorious-Malwares-Part… *** Owning Modems And Routers Silently *** --------------------------------------------- Do you have cable internet? Own a surfboard modem? Since most of my buddies in AZ do, I sent them to this page and to my amusement, they got knocked off the net for a few minutes. How? Javascript. Specifically a CSRF in the Motorolla Surfboard. --------------------------------------------- http://www.gironsec.com/blog/2015/01/owning_modems_and_routers_silently/ *** Libavcodec: Fehler erlauben Codeausführung in VLC-Codecbibliothek *** --------------------------------------------- Speziell präparierte Videodateien können zur Codeausführung unter anderem in VLC genutzt werden. Dessen Entwickler verhalten sich aber zurückhaltend, zudem werfen die Berichte einige Fragen auf. --------------------------------------------- http://www.golem.de/news/libavcodec-fehler-erlauben-codeausfuehrung-in-vlc-… *** Go Static or Go Home - Inviting the Trojan Horse Inside *** --------------------------------------------- And then, after all that spending on all that complexity for defense, some of us go on to install a DCMS (Dynamic Content Management System) as our public-facing web server. This approach is like building a mighty walled city and then inviting the Trojan horse inside, or making Achilles invulnerable to harm except for his heel. --------------------------------------------- http://queue.acm.org/detail.cfm?id=2721993 *** ENISA Warns of Internet Vulnerabilities (InfoRiskToday) *** --------------------------------------------- The Internet infrastructure remains susceptible to a variety of threats, including routing attacks, DNS spoofing and poisoning attacks and distributed denial-of-service disruptions. But a number of best practices can help prevent related exploits, a new EU government study says. --------------------------------------------- http://www.inforisktoday.com/enisa-warns-internet-vulnerabilities-a-7814 *** Session Hijacking Cheat Sheet *** --------------------------------------------- 'Session Hijacking' is an old and routine topic in the field of application security. To make it more interesting, in this article, we are going to focus on different ways it can be performed. Introduction for beginners Web .. --------------------------------------------- http://resources.infosecinstitute.com/session-hijacking-cheat-sheet/ *** Paper: Nesting doll: unwrapping Vawtrak *** --------------------------------------------- Raul Alvarez unwraps the many layers of an increasingly prevalent banking trojan.Banking trojans remain one of the most prevalent kinds of malware. Among them, trojans based on Zeus have long been the most prevalent, but in recent months a relatively new trojan has been challenging the reign of Zeus: Vawtrak.Also known as Neverquest or Snifula, Vawtrak initially targeted users of Japanese banking systems, but it has since broadened its scope. In a recent paper (pdf), Sophos researcher James --------------------------------------------- http://www.virusbtn.com/blog/2015/01_20.xml *** GoDaddy CSRF Vulnerability Allows Domain Takeover *** --------------------------------------------- tl;dr: An attacker can leverage a CSRF vulnerability to take over domains registered with GoDaddy. The vulnerability has been patched. --------------------------------------------- http://breakingbits.net/2015/01/18/taking-over-godaddy-accounts-using-csrf/ *** Finding Privilege Escalation Flaws in Linux *** --------------------------------------------- We often tend to ignore privilege escalation flaws. In order to take advantage of these vulnerabilities, an attacker first needs to have access to the system itself. But in particular for systems that many users have access to, it can be difficult to monitor them all for compromised .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19207

1 0

Tageszusammenfassung - Montag 19-01-2015
by Daily end-of-shift report 19 Jan '15

19 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 16-01-2015 18:00 − Montag 19-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Survey says security products waste our time *** --------------------------------------------- A survey of information-technology professionals published on Friday found that the average large organization has to sift through nearly 17,000 malware alerts each week to find the 19 percent that are considered reliable. The efforts at .. --------------------------------------------- http://arstechnica.com/security/2015/01/survey-says-security-products-waste… *** A Lot of Security Purchases Remain Shelfware *** --------------------------------------------- Companies may be investing more in security, but many are either underutilizing their new purchases or not using them at all, an Osterman Research survey shows. --------------------------------------------- http://www.darkreading.com/a-lot-of-security-purchases-remain-shelfware/d/d… *** Report: Mercenaries Behind APT Attacks *** --------------------------------------------- An increasing number of sophisticated cyber-attacks are not being launched by governments - or their intelligence services - but rather by opportunistic mercenaries who sell whatever they can steal to the highest bidder, according to a new .. --------------------------------------------- http://www.inforisktoday.com/report-mercenaries-behind-apt-attacks-a-7806 *** Dridex Banking Trojan Begins 2015 with a Bang *** --------------------------------------------- In October, we called out a series of attacks installing the Dridex Trojan using macros in Microsoft Word documents. Those attacks continued over the last few ... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/dridex-banking-trojan-be… *** Use-after-Free: New Protections, and how to Defeat them *** --------------------------------------------- The Problem Memory corruption has plagued computers for decades, and these bugs can often be transformed into working cyber-attacks. Memory corruption is a situation where an attacker (malicious user of an application or network protocol) is .. --------------------------------------------- http://labs.bromium.com/2015/01/17/use-after-free-new-protections-and-how-t… *** Bypassing the Android PIN using fast tapping - Lock screens are still hard *** --------------------------------------------- It turns out that during that brief period we have access to the phone and if we time our actions right, we can start programs or change settings by quickly tapping on the screen. Surely it's a bit tedious to do so, but .. --------------------------------------------- http://itinsight.hu/en/posts/articles/2015-01-28-android-bypass/ *** New Guide by ENISA: Actionable Information for Security Incident Response *** --------------------------------------------- ENISA publishes a good practice guide on Actionable Information for Security Incident Response, aiming to provide a picture of the challenges national CERTs and other security organizations encounter ... --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/new-guide-by-enisa-actionab… *** VB2014 paper: OPSEC for security researchers *** --------------------------------------------- Vicente Diaz teaches researchers the basics of OPSEC.Since the close of the VB2014 conference in Seattle in October, we have been sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added OPSEC for security researchers by Kaspersky researchers Vicente .. --------------------------------------------- http://www.virusbtn.com/blog/2015/01_19.xml *** DSA-3131 xdg-utils - security update *** --------------------------------------------- John Houwer discovered a way to cause xdg-open, a tool that automaticallyopens URLs in a users preferred application, to execute arbitrarycommands remotely. --------------------------------------------- https://www.debian.org/security/2015/dsa-3131 *** Hacked. A Short Story. *** --------------------------------------------- It all started when I was asked (as a freelancer) to configure exim4, so that newsletters would not fall into spam folders. They even sent me a link to a tutorial. I thought the work would take a couple of hours, including the DNS update, but I was wrong. After logging in as root, I started my favorite .. --------------------------------------------- http://kukuruku.co/hub/infosec/hacked-a-short-story-of-a-hack *** 2013-11-08: Remote code execution vulnerability in CAP 501 / CAP 505 / SMS 510 *** --------------------------------------------- http://search.abb.com/library/Download.aspx?DocumentID=1MRS757865&LanguageC… *** Tyupkin ATM Malware Analysis *** --------------------------------------------- Introduction Some time ago, Kaspersky discovered and reported a new type of malicious program called Tyupkin, which targets ATM machines by moving beyond targeting consumers with card skimmers that steal debit card numbers to directly getting cash .. --------------------------------------------- http://resources.infosecinstitute.com/tyupkin-atm-malware-analysis/ *** China: Attacke gegen Microsofts Outlook *** --------------------------------------------- Offenbar Versuch einer Man-in-the-Middle-Attacke - Angreifer wollten Verschlüsselung austricksen --------------------------------------------- http://derstandard.at/2000010596970 *** Certified Secure Advisory 14-01-2015-0.1 - PolarSSL *** --------------------------------------------- During a routine research session, Certified Secure found a "Use of uninitialized memory" vulnerability in the PolarSSL (https://polarssl.org) library. The vulnerability is present in the asn1_get_sequence_of routine that is .. --------------------------------------------- https://www.certifiedsecure.com/polarssl-advisory/ *** Traffic Patterns For CryptoWall 3.0 *** --------------------------------------------- This is a guest diary submitted by Brad Duncan. Various sources have reported version 3 of CryptoWall has appeared [1] [2] [3]. This malware is currently seen from exploit kits and phishing emails. CryptoWall is one of many ransomware trojans that encrypt the personal files on your computer .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19203

1 0

Tageszusammenfassung - Freitag 16-01-2015
by Daily end-of-shift report 16 Jan '15

16 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 15-01-2015 18:00 − Freitag 16-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Definitions matter. For crying out loud, securobods, BE SPECIFIC - ENISA *** --------------------------------------------- Use your words or the DDoSers will GET you.... Definitions matter when your infrastructure is under threat says European Union Agency for Network and Information Security (ENISA). --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/15/if_you_want… *** Critical Patch Update - January 2015 - Pre-Release Announcement *** --------------------------------------------- This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Critical Patch Update for January 2015, which will be released on Tuesday, January 20, 2015. While this Pre-Release Announcement is as accurate as possible at the time of publication, the information it contains may change before publication of the Critical Patch Update Advisory. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html *** Google AdWords Campaigns Hijacked by Malvertisers *** --------------------------------------------- Two Google AdWords campaigns have been hijacked by malvertisers and users are being redirected to fraud sites without even clicking the poisoned ads. --------------------------------------------- http://threatpost.com/google-adwords-campaigns-hijacked-by-malvertisers/110… *** Telekom-Tools für sichere Server-Konfiguration *** --------------------------------------------- Die Telekom nimmt Admins an die Hand und liefert kostenlose Tools, die bei der Härtung von nginx, MySQL und Co. helfen. --------------------------------------------- http://heise.de/-2517840 *** Sicherheitsfirmen warnen vor "Je Suis Charlie"-Trojaner *** --------------------------------------------- Vermeintliches Solidaritätsvideo lädt tatsächlich Schadsoftware auf den Rechner --------------------------------------------- http://derstandard.at/2000010489196 *** Seven Months' Worth of Mistakes: A Longitudinal Study of Typosquatting Abuse *** --------------------------------------------- In particular we reveal that, even though 95 percent of the popular domains we investigated are actively targeted by typosquatters, only few trademark owners protect themselves against this practice by proactively registering their own typosquatting domains. A small fraction of those typosquatted domains -- such as gooogle.com for google.com -- were registered by the legitimate website in a bid to foil typosquatters. --------------------------------------------- https://lirias.kuleuven.be/bitstream/123456789/471369/3/typos-final.pdf *** Employee Threat Assessment Template for Large Organizations *** --------------------------------------------- Despite the popular image of the hacker cracking distant servers from his basement, studies show that people with legitimate access to your information pose an even bigger threat. And when information is stolen from within, it's often harder to trace and determine the extent of the problem. The larger your [...]The post Employee Threat Assessment Template for Large Organizations appeared first on InfoSec Institute. --------------------------------------------- http://resources.infosecinstitute.com/employee-threat-assessment-template-l… *** Details zur kritischen Lücke im Telnet-Server von Windows *** --------------------------------------------- Auf einer chinesischen Website ist eine detaillierte Analyse der gerade erst gepatchten Telnet-Lücke aufgetaucht - und ein Proof-of-Concept. --------------------------------------------- http://heise.de/-2518951 *** Cisco Adaptive Security Appliance DHCPv6 Relay Denial of Service Vulnerability *** --------------------------------------------- CVE-2015-0578 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco Hosted WebEx Meeting Center Information Disclosure *** --------------------------------------------- CVE-2015-0590 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** T-Mobile Internet Manager UpdateCfg.ini SEH buffer overflow *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99945 *** Alienvault OSSIM Web UI command execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99951 *** Arbiter Systems 1094B GPS Clock Spoofing Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a GPS clock spoofing vulnerability in the Arbiter Systems 1094B clock. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-345-01 *** GE Proficy HMI/SCADA CIMPLICITY CimView Memory Access Violation *** --------------------------------------------- This advisory provides mitigation details for a memory access violation vulnerability in GE's CIMPLICITY CimView application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-289-02 *** Windows: Impersonation Check Bypass With CryptProtectMemory and CRYPTPROTECTMEMORY_SAME_LOGON flag *** --------------------------------------------- Platform: Windows 7, 8.1 Update 32/64 bit Class: Security Bypass/Information Disclosure The function CryptProtectMemory allows an application to encrypt memory for one of three scenarios, process, logon session and computer. When using the logon session option (CRYPTPROTECTMEMORY_SAME_LOGON flag) the encryption key is generated based on the logon session identifier, this is for sharing memory between processes running within the same logon. --------------------------------------------- https://code.google.com/p/google-security-research/issues/detail?id=128 *** DSA-3129 rpm - security update *** --------------------------------------------- Two vulnerabilities have been discovered in the RPM package manager. --------------------------------------------- https://www.debian.org/security/2015/dsa-3129 *** Information Disclosure in Direct Mail Subscription (direct_mail_subscription) *** --------------------------------------------- It has been discovered that the extension "Direct Mail Subscription" (direct_mail_subscription) is susceptible to Information Disclosure. --------------------------------------------- http://www.typo3.org/news/article/information-disclosure-in-direct-mail-sub… *** WiFi File Browser Pro v2.0.8 Code Execution Vulnerability *** --------------------------------------------- Topic: WiFi File Browser Pro v2.0.8 Code Execution Vulnerability Risk: High Text:Document Title: WiFi File Browser Pro v2.0.8 - Code Execution Vulnerability References (Source): == http:/... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010087

1 0

Tageszusammenfassung - Donnerstag 15-01-2015
by Daily end-of-shift report 15 Jan '15

15 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 14-01-2015 18:00 − Donnerstag 15-01-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** CryptoWall 3.0 Uses I2P Anonymity Network For CC Communications (SecurityWeek) *** --------------------------------------------- Almost two months have passed since the developers of CryptoWall released an updated version of the threat, but now they’re back to work. The malware, distributed via spam and malvertising campaigns, helped cybercriminals make a lot of money last year so it’s not surprising that its authors continue improving it. --------------------------------------------- http://www.securityweek.com/cryptowall-30-uses-i2p-anonymity-network-cc-com… *** AdSense Abused with Malvertising Campaign *** --------------------------------------------- Last weekend we noticed a large number of requests to scan websites for malware because they randomly redirected to some "magazine" websites. Most of them mentioned the lemode-mgz .com site. In all cases, the symptoms were the same. Some users randomly got redirected when they clicked on links or loaded new pages. They all reported... --------------------------------------------- http://blog.sucuri.net/2015/01/adsense-abused-with-malvertising-campaign.ht… *** Anatomy Of A Cyber-Physical Attack (Dark Reading) *** --------------------------------------------- "If you only consider hackers, you don’t have to be concerned that much. They won't be able to take down a power grid or blow up chemical facilities," says Ralph Langer, founder of Langner Communications and a top Stuxnet expert. The danger is when attackers have an understanding of the physical and engineering aspects of the plant or site they are targeting, he says. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/anatomy-of-a-cyber-phy… *** Kritik an Apples Zwei-Faktor-Schutz *** --------------------------------------------- Apples zweistufige Bestätigung deckt mehrere Cloud-Dienste des Konzerns gar nicht ab, bemängelt eine Nutzerin - ein Angreifer könne auf diese Weise tiefe Einblicke erhalten. --------------------------------------------- http://heise.de/-2517903 *** Private Schlüssel: Gitrob sucht sensible Daten bei Github *** --------------------------------------------- Immer wieder tauchen Daten wie private Schlüssel oder Passwörter in Github-Repositories auf. Mit Hilfe von Gitrob sollen diese gefunden werden können, um sich besser zu schützen. Das öffnet aber auch die Möglichkeiten für einen interessanten Angriff. --------------------------------------------- http://www.golem.de/news/private-schluessel-gitrob-sucht-sensible-daten-bei… *** Security and Military Experts Fall For "Open" Wi-Fi *** --------------------------------------------- According to The Local, an English-language newspaper in Sweden, Gustav Nipe watched earlier this week as around 100 politicians, military officers and journalists logged into a network called “Open Guest” and proceeded to search for various non-work-related things including “forest hikes” and monitor eBay auctions. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002783.html *** ATM: Attacking Multichannel Fraud (InfoRiskToday) *** --------------------------------------------- The increasing globalization of fraud perpetrated by sophisticated organized crime rings has spurred unprecedented growth in cross-channel attacks, security experts from three of the world's leading ATM manufacturers say. That's why ATM deployers can no longer build defenses that focus solely on the ATM channel, executives from Diebold Inc., Wincor Nixdorf AG and NCR Corp. say in this final part of an exclusive three-part interview with Information Security Media Group. --------------------------------------------- http://www.inforisktoday.com/interviews/atm-attacking-multichannel-fraud-i-… *** Patchday: Adobe schließt neun Lücken in Flash *** --------------------------------------------- Die Lücken, die Adobe nun in Flash geschlossen hat, betreffen alle Plattformen. Nutzer sollten die Updates schnellstmöglich installieren, da sie Angriffe aus dem Netz ermöglichen. --------------------------------------------- http://heise.de/-2517426 *** Cybercrime: Hacking als aufstrebender Wirtschaftszweig in Österreich *** --------------------------------------------- Internet-Sicherheitsbericht 2014 präsentiert - Ungeschützte Smartphones und Tablets als Ziele --------------------------------------------- http://derstandard.at/2000010445114 *** JSA10669 - 2015-01 Security Bulletin: Junos: Multiple vulnerabilities in libxml2 library *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10669&actp=RSS *** JSA10667 - 2015-01 Security Bulletin: Junos: Privilege escalation vulnerability (CVE-2014-6384) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10667&actp=RSS *** Cisco Identity Services Engine Cross-Site Scripting Vulnerability *** --------------------------------------------- CVE-2014-8022 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Unified Communications Domain Manager Admin GUI DoS Vulnerability *** --------------------------------------------- CVE-2015-0591 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Simple Security plugin for WordPress wp-admin/users.php script cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99931 *** SA-CONTRIB-2015-022 - nodeauthor - Cross Site Scripting (XSS) - Unsupported *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-022Project: nodeauthor (third-party module)Version: 7.xDate: 2015-January-14Security risk: 12/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site ScriptingDescriptionThis module displays node author information in a jQuery slider.The module doesnt sufficiently sanitize Profile2 fields in a provided block.This vulnerability is mitigated by the fact that an attacker must have a user account allowed to --------------------------------------------- https://www.drupal.org/node/2407401 *** SA-CONTRIB-2015-021 - Content Analysis - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-021Project: Content Analysis (third-party module)Version: 6.xDate: 2014-January-14Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThe Content Analysis module is an API designed to help modules that need to analyze content.The module fails to sanitize user input in log messages, leading to a Cross Site Scripting (XSS) vulnerability.This vulnerability is mitigated by the fact --------------------------------------------- https://www.drupal.org/node/2407395 *** SA-CONTRIB-2015-020 - Contact Form Fields - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-020Project: Contact form fields (third-party module)Version: 6.xDate: 2014-January-14Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionThe Contact Form Fields module enables you to create additional fields to site-wide contact form.Some links were not properly protected from CSRF. A malicious user could cause an administrator to delete fields by getting the --------------------------------------------- https://www.drupal.org/node/2407357 *** SA-CONTRIB-2015-018 - Video - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-018Project: Video (third-party module)Version: 7.xDate: 2015-January-14Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site ScriptingDescriptionThis module enables you to upload, convert and playback videos.The module doesnt sufficiently sanitize node titles when using the video WYSIWYG plugin, thereby opening a Cross Site Scripting (XSS) vulnerability.This vulnerability is mitigated by --------------------------------------------- https://www.drupal.org/node/2407341 *** SA-CONTRIB-2015-015 - Term Merge - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-015Project: Term merge (third-party module)Version: 7.xDate: 2015-January-14Security risk: 12/25 ( Moderately Critical) AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThis module enables you to merge (synonymous) taxonomy terms among themselves.The module doesnt sufficiently filter user input under certain conditions, thereby opening a Cross Site Scripting (XSS) vulnerability.This vulnerability is --------------------------------------------- https://www.drupal.org/node/2407315 *** PHPKIT result cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99904

1 0

Tageszusammenfassung - Mittwoch 14-01-2015
by Daily end-of-shift report 14 Jan '15

14 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 13-01-2015 18:00 − Mittwoch 14-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** AMD plugs firmware holes that allowed command injection *** --------------------------------------------- Bug your notherboard vendor for a fix, says boffin VID Chip maker AMD has patched holes across its firmware lines that could allow hackers to inject malware. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/14/amd_plugs_c… *** Hintergrund: Universeller SSL-Tester SSLyze *** --------------------------------------------- SSL mit Kommandozeilen-Tools von Hand zu testen, ist mühselig; SSLyze nimmt Admins viel dieser Arbeit ab. --------------------------------------------- http://www.heise.de/security/artikel/Universeller-SSL-Tester-SSLyze-2470008… *** Patchday: Microsoft stopft acht Lücken in Windows *** --------------------------------------------- Am Januar-Patchday überrascht die Firma damit, ausschließlich Lücken in Windows zu schließen. Für den Internet Explorer wird lediglich ein Patch vom Dezember noch einmal aufgewärmt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Patchday-Microsoft-stopft-acht-Lueck… *** MMD-0030-2015 New ELF malware on Shellshock: the ChinaZ *** --------------------------------------------- BackgroundThe bash Shellshock vulnerability is still proven to be one of the fastest way to spread ELF malware infection to NIX boxes in internet, along with Linux system that is still serving the vulnerable version. This fact that is not knowing only by internet security folks, but by the threat actors themself. Previously we announced linux/Mayhem malwarere was utilizing the shellshock previously, and now ELF malware actors in China is starting to utilized set of tools to spread more... --------------------------------------------- http://blog.malwaremustdie.org/2015/01/mmd-0030-2015-new-elf-malware-on.html *** Security updates available for Adobe Flash Player *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. ... CVE number: CVE-2015-0301, CVE-2015-0302, CVE-2015-0303, CVE-2015-0304, CVE-2015-0305, CVE-2015-0306, CVE-2015-0307, CVE-2015-0308, CVE-2015-0309 --------------------------------------------- http://helpx.adobe.com/security/products/flash-player/apsb15-01.html *** Asus schließt kritische Router-Lücke *** --------------------------------------------- Liefert wenige Tage nach Bekanntwerden Updates für zahlreiche Geräte --------------------------------------------- http://derstandard.at/2000010378742 *** Amsterdam 2015 FIRST Technical Colloquium *** --------------------------------------------- The FIRST Amsterdam Technical Colloquium (TC) 2015 will be hosted by Cisco Systems in Amsterdam, Netherlands. The event will be a plenary style conference held on the 5th and 6th of May 2015, with optional, free training sessions on May 4th. FIRST is looking for speakers that would like to present at this Technical Colloquium. This is a GREAT opportunity to give something back to FIRST and the industry, while practicing your speaking skills and sharing your hard work. --------------------------------------------- http://www.first.org/events/colloquia/amsterdam2015 *** At this rate it will hit the launch codes in... 5.3 minutes. *** --------------------------------------------- Hello everyone, in this post I would like to analyze an Android application which purpose is to manage and generate passwords securely. On their Play Store page they claim to use DES to encrypt passwords on local device and that DES key is derivated from you PIN code... --------------------------------------------- https://bughardy.me/at-this-rate-it-will-hit-the-launch-codes-in-5-3-minute… *** MSRT January 2015 - Dyzap *** --------------------------------------------- This month we added the Win32/Emotet and Win32/Dyzap malware families to the Malicious Software Removal Tool. Both Emotet and Dyzap are trojans that steal personal information, including banking credentials. In a previous blog we detailed how Emotet targets German-language banking websites. In this blog, we will focus on Dyzap - another prevalent banking trojan that predominantly targets English-speaking countries. Dyzap variants target credentials for online banking, crypto... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/01/13/msrt-january-2015-dyzap.… *** 4 Mega-Vulnerabilities Hiding in Plain Sight (Dark Reading) *** --------------------------------------------- How four recently discovered, high-impact vulnerabilities provided "god mode" access to 90% of the Internet for 15 years, and what that means for the future. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/4-mega-vulnerabilities… *** Phony Oracle Patches Making the Rounds *** --------------------------------------------- Attackers are circulating fake fixes for Oracle error messages and the company is warning users not to download any patches that don't come directly from Oracle. --------------------------------------------- http://threatpost.com/phony-oracle-patches-making-the-rounds/110415 *** Akamai: Probleme mit alten SSL-Implementierungen *** --------------------------------------------- Akamai verarbeitet eine Billiarde an Verbindungen pro Jahr. Brian Sniffen gibt Einblicke, was das bedeutet - und welche Schwierigkeiten darin bestehen, alte SSL-Implementierungen auszusperren. (Akamai, Android) --------------------------------------------- http://www.golem.de/news/akamai-probleme-mit-alten-ssl-implementierungen-15… *** JSA10670 - 2015-01 Security Bulletin: Junos: Malformed BGP FlowSpec prefix triggers rpd crash (CVE-2014-6386) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10670&actp=RSS *** JSA10668 - 2015-01 Security Bulletin: Junos: Fragmented OSPFv3 packets with IPsec AH may trigger kernel crash (CVE-2014-6385) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10668&actp=RSS *** JSA10666 - 2015-01 Security Bulletin: Junos: Firewall filter fails to match on port (CVE-2014-6383) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10666&actp=RSS *** JSA10665 - 2015-01 Security Bulletin: Junos: jpppd core when MX Series router receives crafted PAP Authenticate-Request (CVE-2014-6382) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10665&actp=RSS *** Cisco ASA DHCPv6 Relay DoS Vulnerability *** --------------------------------------------- CVE-2015-0578 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco TelePresence VCS and Expressway High CPU Utilization Vulnerability *** --------------------------------------------- CVE-2015-0579 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AsyncOS ISQ XSS Vulnerability *** --------------------------------------------- CVE-2015-0577 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AnyConnect User Interface Dialog Rendered When Connecting to Arbitrary Hosts Vulnerability *** --------------------------------------------- CVE-2014-3314 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** VU#117604: Panasonic Arbitrator Back-End Server (BES) uses unencrypted communication *** --------------------------------------------- Vulnerability Note VU#117604 Panasonic Arbitrator Back-End Server (BES) uses unencrypted communication Original Release date: 13 Jan 2015 | Last revised: 13 Jan 2015 Overview Panasonic Arbitrator Back-End Server (BES) uses an unencrypted channel to transmit data. Description CWE-319: Cleartext Transmission of Sensitive InformationPanasonic Arbitrator Back-End Server (BES) uses an unencrypted channel to transmit data between the client and server. It has been reported that Active Directory --------------------------------------------- http://www.kb.cert.org/vuls/id/117604 *** Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Conduct Cross-Site Request Forgery Attacks, and Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1031533 *** Foxit MobilePDF 4.4.0 Local File Inclusion / Arbitrary File Upload *** --------------------------------------------- Topic: Foxit MobilePDF 4.4.0 Local File Inclusion / Arbitrary File Upload Risk: High Text:Document Title: Foxit MobilePDF v4.4.0 iOS - Multiple Web Vulnerabilities References (Source): == http://w... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010071 *** Lexmark MarkVision Enterprise Arbitrary File Upload *** --------------------------------------------- This module exploits a code execution flaw in Lexmark MarkVision Enterprise before 2.1. A directory traversal in the fdFileUploadServlet servlet allows an unauthenticated attacker to upload arbitrary files, including arbitrary JSP code. This module has been tested successfully on Lexmark MarkVision Enterprise 2.0 with Windows 2003 SP2. --------------------------------------------- http://www.exploit-db.com/exploits/35776/ *** Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness *** --------------------------------------------- This tool checks whether a BMC machine is vulnerable to CVE-2014-8272 (http://www.kb.cert.org/vuls/id/843044) by logging the TemporarySessionID/SessionID in each IPMI v1.5 session, and checking that these values are incremental... --------------------------------------------- http://www.exploit-db.com/exploits/35770/ *** Simple Security <= 1.1.5 - Two Cross-Site Scripting (XSS) Vulnerabilities *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7753

1 0

Tageszusammenfassung - Dienstag 13-01-2015
by Daily end-of-shift report 13 Jan '15

13 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 12-01-2015 18:00 − Dienstag 13-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Remember Corel? Its just entered .DLL hell *** --------------------------------------------- Hijack hole found in Corel Draw and other doodleware Local zero day vulnerabilities have been disclosed in Corel applications, potentially affecting more than 100 million users. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/13/hijack_hole… *** Windows logging cheat sheet - Win 7/Win 2008 or later *** --------------------------------------------- This "Windows Logging Cheat Sheet" is intended to help you get started setting up basic and necessary Windows Audit Policy and Logging. By no means is this list extensive; but it does include some very common items that should be enabled, configured, gathered and harvested for any Log Management Program. Start with these settings and add to it as you understand better what is in your logs and what you need. --------------------------------------------- http://sniperforensicstoolkit.squarespace.com/storage/logging/Windows%20Log… *** Docker Secure Deployment Guidelines *** --------------------------------------------- The GitHub repository referenced below aims at providing some deployment guidelines for Docker developers and system administrators alike, that can be used to improve the security posture of Linux containers within a Dockerized environment. --------------------------------------------- http://blog.gdssecurity.com/labs/2015/1/12/docker-secure-deployment-guideli… *** Alert on unauthorized use of domain administrative account for Active Directory *** --------------------------------------------- At JPCERT/CC, we have observed multiple targeted attacks against domestic organizations where attackers intruded and stay within a corporate network for long periods of time and steal information. One characteristic of these attacks is that the attackers in the network steal credentials for the domain administrator account (herein, administrator account) in Active Directory, and leverage this administrator account to launch various attacks across the network. --------------------------------------------- https://www.jpcert.or.jp/english/at/2014/at140054.html *** Skeleton Key Malware Analysis *** --------------------------------------------- Dell SecureWorks Counter Threat Unit(TM) (CTU) researchers discovered malware that bypasses authentication on Active Directory (AD) systems that implement single-factor (password only) authentication. Threat actors can use a password of their choosing to authenticate as any user. ... Skeleton Key is deployed as an in-memory patch on a victims AD domain controllers to allow the threat actor to authenticate as any user, while legitimate users can continue to authenticate as normal. --------------------------------------------- http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-m… *** KeySweeper - Arduino-based Keylogger for Wireless Keyboards *** --------------------------------------------- Security researcher has developed a cheap USB wall charger that is capable to eavesdrop on almost any Microsoft wireless keyboard. MySpace mischief-maker Samy Kamkar has released a super-creepy keystroke logger for Microsoft wireless keyboards cunningly hidden in what appears to be a rather cheap, but functioning USB wall charger. The stealthy Arduino-based device,... --------------------------------------------- http://thehackernews.com/2015/01/KeySweeper-Arduino-Keyboard-Keylogger.html *** Gitrob: Putting the Open Source in OSINT *** --------------------------------------------- Sometimes employees might publish things that should not be publicly available. Things that contain sensitive information or things that could even lead to direct compromise of a system. This can happen by accident or because the employee does not know the sensitivity of the information. Gitrob is a command line tool that can help organizations and security professionals find such sensitive information. --------------------------------------------- http://michenriksen.com/blog/gitrob-putting-the-open-source-in-osint/ *** Aggressive Riskware Installation on Amazon Kindle (and Android) *** --------------------------------------------- As malware continues to grow on Android (900K malicious samples and 1,300 new per day), we sometimes forget attacks can also affect other devices... like Amazons Kindle. The Kindle indeed runs Fire OS, a fork of Android. Thus, in several cases, Android malware also work on Fire OS, and reciprocally. Proof below. ... --------------------------------------------- http://blog.fortinet.com/post/aggressive-riskware-installation-on-amazon-ki… *** OSXCollector: Forensic Collection and Automated Analysis for OS X *** --------------------------------------------- OSXCollector is an open source forensic evidence collection and analysis toolkit for OS X. It was developed in-house at Yelp to automate the digital forensics and incident response (DFIR) our crack team of responders had been doing manually. --------------------------------------------- http://engineeringblog.yelp.com/2015/01/osxcollector-forensic-collection-an… *** ICS London 2015 *** --------------------------------------------- SANS ICS London 2015 hosts four dedicated training courses for those tasked with securing Industrial Control Systems. This specialist training event takes place at the Grand Connaught Rooms in Londons West End, from April 27th to May 2nd 2015. --------------------------------------------- https://www.sans.org/event/ics-london-2015 *** Millionen Android-Geräte mit Sicherheitslücken auf Lebenszeit *** --------------------------------------------- Eine Kernkomponente von Android wird auf Geräten mit älteren Versionen nicht mehr mit Patches versorgt. Dabei ist vor allem deren Standardbrowser Einfallstor für Angreifer. --------------------------------------------- http://www.heise.de/security/meldung/Millionen-Android-Geraete-mit-Sicherhe… *** [2015-01-13] Multiple critical vulnerabilities in all snom desktop IP phones *** --------------------------------------------- All snom desktop IP phones are affected by multiple critical security issues in all available firmware versions. Attackers are able to completely compromise the phone with root access rights and install backdoors to the device which will even survive a factory reset. Furthermore, tapping into phone calls or surveilling the room is possible. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** [2015-01-13] Privilege Escalation & XSS & Missing Authentication in Ansible Tower *** --------------------------------------------- Attackers are able to elevate privileges and gain access to sensitive data of other organizations in Ansible Tower. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** [2015-01-13] Cross site request forgery vulnerability in XBMC / Kodi *** --------------------------------------------- An attacker could potentially gain access to sensitive information stored on the system where XBMC / Kodi is installed by exploiting CSRF issues. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** VU#533140: Tianocore UEFI implementation reclaim function vulnerable to buffer overflow *** --------------------------------------------- Vulnerability Note VU#533140 UEFI EDK1 vulnerable to buffer overflow Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview The EDK1 UEFI reference implementation contains a buffer overflow vulnerability. Description The open source EDK1 project provides a reference implementation of the Unified Extensible Firmware Interface (UEFI). Commercial UEFI implementations may incorporate portions of the EDK1 source code.According to Rafal Wojtczuk and Corey Kallenberg, a buffer... --------------------------------------------- http://www.kb.cert.org/vuls/id/533140 *** Cisco WebEx Meetings Server Information Disclosure Vulnerability *** --------------------------------------------- CVE-2015-0583 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** SSA-311299 (Last Update 2015-01-13): Vulnerabilities in iOS App SIMATIC WinCC Sm@rtClient *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** DFN-CERT-2015-0037 - Red Hat JBoss Data Virtualization: Mehrere Schwachstellen ermöglichen u. a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0037/

1 0

Tageszusammenfassung - Montag 12-01-2015
by Daily end-of-shift report 12 Jan '15

12 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 09-01-2015 18:00 − Montag 12-01-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** SnoopSnitch Android app notifies users of IMSI catchers, SS7 attacks *** --------------------------------------------- SnoopSnitch requires a rooted device with a Qualcomm chipset that runs stock Android 4.1 or higher. --------------------------------------------- http://www.scmagazine.com/free-app-flags-attempts-to-spy-on-mobile-phones/a… *** Cisco WebEx Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SAP NetWeaver Business Client for HTML Input Validation Flaws Permit Cross-Site Scripting Attacks *** --------------------------------------------- A vulnerability was reported in SAP NetWeaver Business Client for HTML. A remote user can conduct cross-site scripting attacks. The Business Client for HTML component does not properly filter HTML code from user-supplied input before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. --------------------------------------------- http://www.securitytracker.com/id/1031509 *** PLAID: Die seltsame Welt der ISO-Standards *** --------------------------------------------- Auf der Real World Crypto berichten Sicherheitsforscher über ihre Erfahrungen mit der ISO. Bei der Standardisierung des Authentifizierungsprotokolls PLAID offenbart sich teilweise eine erschreckende Unkenntnis in Sachen Kryptographie. --------------------------------------------- http://www.golem.de/news/plaid-die-seltsame-welt-der-iso-standards-1501-111… *** Dan J. Bernstein: Krypto-Algorithmen sicher designen *** --------------------------------------------- Der Kryptograph Dan Bernstein fordert auf der Real World Crypto seine Kollegen auf, kryptographische Algorithmen so zu designen, dass ein fehlerhafter Einsatz vermieden wird. Es sei keine gute Idee, immer den Programmierern die Schuld zu geben. --------------------------------------------- http://www.golem.de/news/dan-j-bernstein-krypto-algorithmen-sicher-designen… *** Google No Longer Provides Patches for WebView Jelly Bean and Prior *** --------------------------------------------- Google will no longer be providing security patches for vulnerabilities reported to affect only versions of Android's native WebView prior to 4.4. In other words, Google is now only supporting the current named version of Android (Lollipop, or 5.0) and the prior named version (KitKat, or 4.4). Jelly Bean (versions 4.0 through 4.3) and earlier will no longer see security patches for WebView from Google ... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2015/01/11/google-no… *** Securitys revamped index of pain readies for release *** --------------------------------------------- Comments sought on draft Common Vulnerability Scoring System 3.0 bug rating scheme The great unwashed has been afforded an opportunity to comment on a new scheme for classifying the severity of infosec vulnerabilities issued by the National Institute of Standards and Technology. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/12/securitys_r… *** Ntpdc Local Buffer Overflow *** --------------------------------------------- Alejandro Hdez (@nitr0usmx) recently tweeted about a trivial buffer overflow in ntpdc, a deprecated NTP query tool still available and packaged with any NTP install. He posted a screenshot of the crash as the result of a large buffer passed into a vulnerable gets call. After digging into it a bit, I decided it'd be a fun exploit to write, and it was. There are a few quarks to it that make it of particular interest, of which I've detailed below. --------------------------------------------- http://hatriot.github.io/blog/2015/01/06/ntpdc-exploit/ *** Deciphering the landscape for Privacy by Design. ENISA publishes its recommendations for policy makers, data protection authorities and experts *** --------------------------------------------- http://www.enisa.europa.eu/media/news-items/deciphering-the-landscape-for-p… *** Windows Elevation of Privilege in User Profile Service *** --------------------------------------------- Platform: Windows 8.1 Update 32/64 bit (No other OS tested) When a user logs into a computer the User Profile Service is used to create certain directories and mount the user hives (as a normal user account cannot do so). ... However there seems to be a bug in the way it handles impersonation, the first few resources in the profile get created under the user's token, but this changes to impersonating Local System part of the way through. --------------------------------------------- https://code.google.com/p/google-security-research/issues/detail?id=123 *** Do we need regular IT security fire drills? *** --------------------------------------------- IT security 'fire drills', supported by executive management and the risk committee should be conducted regularly in organizations, in order to understand the appropriate course of action in advance of a security breach. ... Organizations need to move beyond focusing purely on the prevention of security incidents, and start to concentrate on what they will do when an incident occurs. --------------------------------------------- http://www.net-security.org/secworld.php?id=17810 *** Diving into a Silverlight Exploit and Shellcode - Analysis and Techniques *** --------------------------------------------- http://www.checkpoint.com/downloads/partners/TCC-Silverlight-Jan2015.pdf *** Open-Source USB Exploitation Library - Teensyduino *** --------------------------------------------- What is Paensy? Paensy [pan-zee] is a combination of the word payload and Teensy - Paensy is an attacker-oriented, C-based library written for the development of Teensy devices. Paensy simplifies and optimizes mundane tasks and allows an easier platform for scripting. --------------------------------------------- http://malware.cat/?p=89 *** Protecting yourself from Powershell based VBA Macro Attacks *** --------------------------------------------- As some of you may know, I released a standalone Powershell script that will automatically generate a malicious VBA macro using different payloads and persistence methods. This can be found here: https://github.com/enigma0x3/Generate-Macro/blob/master/Generate-Macro.ps1 As a response, I have gotten a few questions from sysadmins about protecting their organizations from an attack like this. Since this type of attack relies on social engineering, there are only a handful of things you can do to --------------------------------------------- https://enigma0x3.wordpress.com/2015/01/11/protecting-yourself-from-powersh…

1 0

Tageszusammenfassung - Freitag 9-01-2015
by Daily end-of-shift report 09 Jan '15

09 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 08-01-2015 18:00 − Freitag 09-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** AIX for penetration testers (SANS Reading Room) *** --------------------------------------------- AIX is a widely used operating system by banks, insurance companies, power stations and universities. The operating system handles various sensitive or critical information for these services. There is limited public information for penetration testers about AIX hacking, compared the other common operating systems like Windows or Linux. --------------------------------------------- https://www.sans.org/reading-room/whitepapers/unix/aix-penetration-testers-… *** Datenschutzpanne in Mac OS X Yosemite *** --------------------------------------------- Die Spotlight genannte Suchfunktion der aktuellen Mac-OS-X-Version hat erneut ein Datenschutzproblem: Stößt sie auf HTML-Mails, lädt sie ungefragt Inhalte aus externen Quellen nach - zur Freude der Spammer. --------------------------------------------- http://www.heise.de/security/meldung/Datenschutzpanne-in-Mac-OS-X-Yosemite-… *** Netflix Credentials Targeted By Phishing Campaign *** --------------------------------------------- A new malicious email campaign has been observed by security researchers to target customers of Netflix by feeding them a message purporting to be an important notification from the media streaming service. ... Users are advised to check the legitimacy of the emails straight on the official page of the service and to avoid clicking on the provided link. All phishing messages can be forwarded to phishing(a)netflix.com for investigation. --------------------------------------------- http://news.softpedia.com/news/Netflix-Credentials-Targeted-By-Phishing-Cam… *** Microsoft advanced notification service changes. , (Fri, Jan 9th) *** --------------------------------------------- Quite a few of you have written in to let us know that Microsoft is changing the way in which they provide information (thanks to you all). ">You can read the full blog here --">/archive/2015/01/08/evolving-advance-notification-service-ans-in-2015.aspx In a nutshell if you want to be advised in advance younow need to register, select the products used and you will then be provided with information relating to the patches that will be released. If you are a premier customer your... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19167&rss *** Banking Trojans Disguised As ICS/SCADA Software Infecting Plants *** --------------------------------------------- Researcher spots spike in traditional financial malware hitting ICS/SCADA networks -- posing as popular GE, Siemens, and Advantech HMI products. A renowned ICS/SCADA security researcher has discovered a surprising twist in cyberattacks hitting plant floor networks: traditional banking Trojan malware posing as legitimate ICS software updates and files rather than the dreaded nation-state custom malware in the wake of Stuxnet. --------------------------------------------- http://www.darkreading.com/attacks-breaches/banking-trojans-disguised-as-ic… *** OpenBSD Releases a Portable Version of OpenNTPD *** --------------------------------------------- Noryungi (70322) writes Theo De Raadt roundly criticized NTP due to its recent security advisories, and pointed out that OpenBSD OpenNTPD was not vulnerable. However, it also had not been made portable to other OS in a long time. Brent Cook, also known for his work on the portable version of LibreSSL (OpenBSD cleanup and refactoring of OpenSSL) decided to take the matter in his own hands and released a new portable version of OpenNTPD. Everyone rejoice, compile and report issues! --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/NJ1R-3x9MVI/story01.htm *** No, the Linux leap second bug WONT crash the web *** --------------------------------------------- Fear the fear, not the second There's a reason space missions don't launch on the day a leap second is added to international clocks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/09/leap_second… *** Asus-Router schutzlos bei Angriffen aus dem eigenen Netz *** --------------------------------------------- Mindestens die Router RT-AC66 und RT-N66U können von Angreifern aus dem LAN komplett gekapert werden. Wahrscheinlich sind weitere Modelle betroffen. Firmware-Updates, die das Loch stopfen, gibt es noch nicht. --------------------------------------------- http://www.heise.de/security/meldung/Asus-Router-schutzlos-bei-Angriffen-au… *** USN-2456-1: GNU cpio vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2456-18th January, 2015cpio vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Ubuntu 10.04 LTSSummaryThe GNU cpio program could be made to crash or run programs if itopened a specially crafted file or received specially crafted input.Software description cpio - a program to manage archives of files DetailsMichal Zalewski discovered an out of bounds write issue in theprocess_copy_in... --------------------------------------------- http://www.ubuntu.com/usn/usn-2456-1/ *** Cisco Unified Communications Domain Manager Platform High CPU DoS Vulnerability *** --------------------------------------------- CVE-2014-8020 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco WebEx Meetings Server Authentication Bypass Vulnerability *** --------------------------------------------- CVE-2014-8033 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** DSA-3122 curl - security update *** --------------------------------------------- Andrey Labunets of Facebook discovered that cURL, an URL transferlibrary, fails to properly handle URLs with embedded end-of-linecharacters. An attacker able to make an application using libcurl toaccess a specially crafted URL via an HTTP proxy could use this flaw todo additional requests in a way that was not intended, or insertadditional request headers into the request. --------------------------------------------- https://www.debian.org/security/2015/dsa-3122 *** DSA-3121 file - security update *** --------------------------------------------- Multiple security issues have been found in file, a tool/library todetermine a file type. Processing a malformed file could result indenial of service. Most of the changes are related to parsing ELFfiles. --------------------------------------------- https://www.debian.org/security/2015/dsa-3121 *** Emerson HART DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights HART DTM library utilized in Emerson's HART DTM. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-008-01-0 *** Schneider Electric Wonderware InTouch Access Anywhere Server Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a stack-based buffer overflow vulnerability in the Wonderware InTouch Access Anywhere Server product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-008-02 *** TP-Link TL-WR840N Cross Site Request Forgery *** --------------------------------------------- Topic: TP-Link TL-WR840N Cross Site Request Forgery Risk: Low Text:Classification: //Dell SecureWorks/Confidential - Limited External Distribution: # # * Title: TP-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010041 *** Wireshark Security Advisories *** --------------------------------------------- wnpa-sec-2015-05. TLS/SSL decryption crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-04. SMTP dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-03. DEC DNA Routing Protocol dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-02. LPP dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-01. WCCP dissector crash. Fixed in 1.12.3, 1.10.12. --------------------------------------------- https://www.wireshark.org/security/ *** Several vulnerabilities have been found in the third party TYPO3 extensions *** --------------------------------------------- extension "Content Rating": http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… | extension "Content Rating Extbase": http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… --------------------------------------------- http://typo3.org/teams/security/security-bulletins

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily