- Daily - CERT.at

Tageszusammenfassung - Mittwoch 30-09-2015
by Daily end-of-shift report 30 Sep '15

30 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 29-09-2015 18:00 − Mittwoch 30-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Analyzing Black Hat URL Shorteners *** --------------------------------------------- Hackers are known to use URL shortening services to obfuscate their real landing pages. It's very effective in clickbait scams on social networks. Some hackers think that using URL shorteners in site injections makes it less likely to be .. --------------------------------------------- https://blog.sucuri.net/2015/09/analyzing-black-hat-url-shorteners.html *** Updated PClock Ransomware Still Comes Up Short *** --------------------------------------------- In recent years, ransomware families are often glamorized as being some of the most dangerous types of malware. They've certainly caused a wealth of damage to end users with some of the .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/09/updated-pclock-ransomwar… *** New Tactic Finds RAT Operators Fast *** --------------------------------------------- Low tolerance for latency makes RAT operators less likely to use proxies, easier to track back home. --------------------------------------------- http://www.darkreading.com/analytics/new-tactic-finds-rat-operators-fast/d/… *** Tricks for DLL analysis *** --------------------------------------------- Very often I get questions on how to perform analysis on DLL files. The reason being that it is easier to perform behavioral analysis on executables, either using external sandboxes or a vmware with tools like the ones from the Sysinternals .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20195 *** Honeywell Experion PKS Directory Traversal Vulnerability *** --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-272-01 *** Mitsubishi Electric MELSEC FX-Series Controllers Denial of Service *** --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-146-01 *** Baxter SIGMA Spectrum Infusion System Vulnerabilities *** --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-181-01 *** RSA Web Threat Detection Bugs Let Remote Authenticated Users Obtain the AnnoDB Password and Local Users Gain Root Privileges *** --------------------------------------------- Two vulnerabilities were reported in RSA Web Threat Detection. A local user can obtain root privileges on the target system. A remote authenticated user can obtain passwords on the target system. --------------------------------------------- http://www.securitytracker.com/id/1033672 *** RSA Certificate Manager and Registration Manager Input Validation Flaw in OneStep Component Lets Remote Users Traverse the Directory to View Files on the Target System *** --------------------------------------------- A vulnerability was reported in RSA Certificate Manager and RSA Registration Manager. A remote user can view files on the target system. --------------------------------------------- http://www.securitytracker.com/id/1033671 *** freeswitch Heap Overflow *** --------------------------------------------- A carefully crafted json string supplied to cJSON_Parse will trigger a heap overflow with user controlled data. The underlying vulnerability occurs in the parse_string function. --------------------------------------------- https://cxsecurity.com/issue/WLB-2015090190 *** Kontodaten via App ergaunert: Salzburgerin geschädigt *** --------------------------------------------- http://derstandard.at/2000022994264 *** WordPress Malware - VisitorTracker Campaign Update *** --------------------------------------------- For the last 3 weeks we have been tracking a malware campaign that has been compromising thousands of WordPress sites with the VisitorTracker malware code. We initially .. --------------------------------------------- https://blog.sucuri.net/2015/09/wordpress-malware-visitortracker-campaign-u… *** Companies leave vulnerabilities unpatched for up to 120 days *** --------------------------------------------- Kenna studied the proliferation of non-targeted attacks and companies' ability to mitigate these threats through the timely remediation of security vulnerabilities .. --------------------------------------------- http://www.net-security.org/secworld.php?id=18911 *** Security Advisory - Multiple Vulnerabilities in Huawei FusionServer Products *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Multiple vulnerabilities in Typo3 extensions *** --------------------------------------------- http://www.typo3.org/news/article/sql-injection-in-extension-httpbl-blockin… http://www.typo3.org/news/article/cross-site-request-forgery-in-extension-t… http://www.typo3.org/news/article/cross-site-scripting-in-extension-news-sy… http://www.typo3.org/news/article/information-disclosure-in-extension-ldap-… *** Pwn The Docs: Vulnerability in readthedocs.org *** --------------------------------------------- If youre not familiar with readthedocs.org its a really popular place for developers to post documentation on their open source code. Its a really great platform and we in fact use it regularly. Honestly, Ive struggled with whether I want to release this vulnerability because its maintained by a few dudes .. --------------------------------------------- http://alex.hyperiongray.com/posts/302352-pwn-the-docs *** The Cost of a Data Breach: How Harmful Can a Data Breach Be? *** --------------------------------------------- There is this belief that businesses that have suffered a data security breach very often do not recover. But is that really so? What does it take to actually destroy a company with a data breach? Before we go to the analysis, .. --------------------------------------------- http://resources.infosecinstitute.com/the-cost-of-a-data-breach-how-harmful… *** That Big Security Fix for Credit Cards Won't Stop Fraud *** --------------------------------------------- The new chip cards and readers wont stop card fraud but will simply shift it to a different area. --------------------------------------------- http://www.wired.com/2015/09/big-security-fix-credit-cards-wont-stop-fraud/ *** User Education, Carrot vs. Stick *** --------------------------------------------- It's a perennial problem, after hours of presentations, online training, reminder emails, poster campaigns and memos, the phone rings, and a senior member of staff has opened a malicious email attachment, .. --------------------------------------------- https://blog.team-cymru.org/2015/09/user-education-carrot-vs-stick/ *** Sicherheitslücken gestopft: SAP macht HANA sicherer *** --------------------------------------------- SAP hat im Mai und April dieses Jahres zwölf Sicherheitslücken in der In-Memory-Plattform HANA geschlossen. Onapsis hat die Lücken erst jetzt gebündelt offengeleg, geht aus einer am gestrigen Dienstag veröffentlichten Sicherheitswarnung von Onapsis hervor. --------------------------------------------- http://heise.de/-2835049 *** Europol: Cyber-Kriminelle werden immer aggressiver *** --------------------------------------------- In Den Haag beraten 300 Experten von Europol und Interpol über wirksame Strategien gegen die Internet-Kriminalität. --------------------------------------------- http://heise.de/-2835263 *** Russian hacker, nabbed in Spain, cops 4+ years for Citadel botnet *** --------------------------------------------- Should have stayed under the skirt of Mother Russia. Just a thought Dimitry Belorossov - a Russian cyber-criminal who used the Citadel banking trojan - has been .. --------------------------------------------- www.theregister.co.uk/2015/09/30/rainerfox_sentenced/ *** New 'Ghost Push' Variants Sport Guard Code; Malware Creator Published Over 600 Bad Android Apps *** --------------------------------------------- Halloween is still a month from now and yet Android users are already being haunted by the previously reported 'Ghost Push' malware, which roots .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/new-ghost-push-v…

1 0

Tageszusammenfassung - Dienstag 29-09-2015
by Daily end-of-shift report 29 Sep '15

29 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 28-09-2015 18:00 − Dienstag 29-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Hacker nutzen Imgur-Lücke beim Angriff auf Reddit und 8chan *** --------------------------------------------- Eine Lücke in einem beliebten Bilder-Hoster wie Imgur kann fatale Folgen haben. Wie im vorliegenden Fall, als Hacker über Bande die Nutzer von Reddit und 8chan ins Visier nahmen. --------------------------------------------- http://heise.de/-2828142 *** Revisiting Apple IPC: (1) Distributed Objects *** --------------------------------------------- Earlier this year I gave a talk at the inaugural Jailbreak Security Summit entitled Auditing and Exploiting Apple IPC [ slides | video ]. As part of my research for that talk I wanted to find at least one bug involving each of the available IPC mechanisms on OS X/iOS; many of which remain unexplored and poorly-documented from .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/09/revisiting-apple-ipc-1-distri… *** Regaining Control Over Edge *** --------------------------------------------- Getting stuck in a loop is no fun especially when it makes your browser unusable. Microsoft Edge has a bigger chance of that happening due to its default settings. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/09/regaining-control-ove… *** CryptoWall's 'Customer Journey' Sounds Like A Real Nightmare *** --------------------------------------------- The latest episode of Radiolab has what is without a doubt the best malware victim interview I've ever heard. Inna Simone's computer was infected by CryptoWall late last year and based on her telling of it, the worst part of the experience was trying to buy the Bitcoin she needed to pay off the extortionists. --------------------------------------------- https://labsblog.f-secure.com/2015/09/28/cryptowalls-customer-journey/ *** ZDI-15-451: InduSoft Web Studio Remote Agent Remote Code Execution Vulnerability *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-451/ *** VeraCrypt Patched Against Two Critical TrueCrypt Flaws *** --------------------------------------------- Two privilege escalation vulnerabilities in the last TrueCrypt build were discovered by James Forshaw of Google Project Zero, and patched in VeraCrypt. --------------------------------------------- http://threatpost.com/veracrypt-patched-against-two-critical-truecrypt-flaw… *** Oysters tablet comes preinstalled with Trojanized Android firmware *** --------------------------------------------- Keeping your mobile device free of malware requires intentional care, but sometimes even that is not enough. As Dr. Web researchers recently pointed out, a device you buy from .. --------------------------------------------- http://www.net-security.org/malware_news.php?id=3115 *** NodeBB v0.8.2 - Client Side Cross Site Web Vulnerability *** --------------------------------------------- https://cxsecurity.com/issue/WLB-2015090182 *** Lebenswichtige medizinische Geräte ungeschützt im Internet *** --------------------------------------------- Herzschrittmacher, Infusionsgeräte, Magnetresonanztomographen: Sicherheitsforscher haben Zehntausende medizinische Geräte entdeckt, die über das Internet leicht angegriffen werden können - weil sie meist noch mit Windows XP laufen. Die Forscher setzten Defibrillatoren und MRTs als Honeypots ein. --------------------------------------------- http://www.golem.de/news/it-sicherheit-lebenswichtige-medizinische-geraete-… *** Abusing GDI for ring0 exploit primitives *** --------------------------------------------- Not long ago I came across a certain font related vulnerability, it was a 0day being exploited in the wild. The vulnerability was in a driver I was somewhat familiar with ATFMD.SYS. --------------------------------------------- https://blog.coresecurity.com/2015/09/28/abusing-gdi-for-ring0-exploit-prim… *** Botnet preying on Linux computers delivers potent DDoS attacks *** --------------------------------------------- XOR DDoS bombards as many as 20 targets per day, sometimes with 150 GBpS of traffic. --------------------------------------------- http://arstechnica.com/security/2015/09/botnet-preying-on-linux-computers-d… *** There is an app commandlet for that *** --------------------------------------------- Allegedly dubbed as Microsoft's post-exploitation language powershell is Microsoft attempt to provide good command-line interface for administrators, developers and power users. Despite being 8 years old it only recently started getting widespread adoption with enterprises moving on to Windows 7 and 2008 environments. --------------------------------------------- https://dfirblog.wordpress.com/2015/09/27/dissecting-powershell-attacks/ *** Reverse Engineering Virtual Machine Protected Binaries *** --------------------------------------------- In code obfuscation, a virtual machine is a mechanism used to execute a different instruction set than the one used by machine that runs the program. For example, a virtual machine can support executing the ARM instruction set on a 32-bit x86 architecture. Virtual machines used in code obfuscation are completely .. --------------------------------------------- http://resources.infosecinstitute.com/reverse-engineering-virtual-machine-p… *** Disclosing Vulnerabilities, Using Data Dumps & Sharing Threat Intelligence *** --------------------------------------------- In recent years, there has been an explosion in the number of information security conferences held around the world. Despite this, the weeks leading up to Black Hat in Las Vegas are still reserved for some of the most significant security announcements, advancements and hacks of .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/disclosing-vulnerabili… *** ATM Skimmer Gang Firebombed Antivirus Firm *** --------------------------------------------- Its notable whenever cybercime spills over into real-world, physical attacks. This is the story of a Russian security firm whose operations were pelted with Molotov cocktail attacks after exposing an organized crime gang that developed and sold malicious software to steal cash from ATMs. --------------------------------------------- http://krebsonsecurity.com/2015/09/atm-skimmer-gang-firebombed-antivirus-fi… *** Warning: Malicious emails claiming to be from Doctor Web *** --------------------------------------------- Virus makers often use names of well-known anti-virus companies to gain their victims trust and make them install some malicious program on their computers. At the end of September, cybercriminals employed this method to distribute a dangerous Trojan designed .. --------------------------------------------- http://news.drweb.com/show/?i=9631&lng=en&c=9 *** Security Advisory 2015-01: Vulnerability in OTRS iPhoneHandle interface allows user with valid session privilege escalation *** --------------------------------------------- September 29, 2015 - Please read carefully and check if the version of your OTRS system is affected by this vulnerability. Please send information regarding vulnerabilities in OTRS to: security(a)otrs.org PGP Key pub 2048R/9C227C6B 2011-03-21 [expires at: 2016-03-02] uid OTRS Security Team GPG Fingerprint E330 4608 DA6E 34B7 1551 C244 7F9E 44E9 9C22 --------------------------------------------- https://www.otrs.com/security-advisory-2015-01-vulnerability-in-otrs-iphone… *** Security Advisory 2015-02: Scheduler Process ID File Access *** --------------------------------------------- September 29, 2015 - Please read carefully and check if the version of your OTRS system is affected by this vulnerability. Please send information regarding vulnerabilities in OTRS to: security(a)otrs.org PGP Key pub 2048R/9C227C6B 2011-03-21 [expires at: 2016-03-02] uid OTRS Security Team GPG Fingerprint E330 4608 DA6E 34B7 1551 C244 7F9E 44E9 9C22 --------------------------------------------- https://www.otrs.com/security-advisory-2015-02-scheduler-process-id-file-ac…

1 0

Tageszusammenfassung - Montag 28-09-2015
by Daily end-of-shift report 28 Sep '15

28 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 25-09-2015 18:00 − Montag 28-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Fake online Avast scanner *** --------------------------------------------- Thanks to a tip from a friend, we came across a fake online scanner that abuses the good name of Avast. The idea to get you to visit this site is by waiting for someone to make a typo and end up at facebooksecuryti(dot)com. The site shows a .. --------------------------------------------- https://blog.malwarebytes.org/social-engineering/2015/09/fake-online-avast-… *** Compromised WordPress Campaign - Spyware Edition *** --------------------------------------------- The Zscaler security research team started investigating multiple WordPress related security events earlier this month and came across a new widespread compromised WordPress campaign leading to the download of unwanted applications. This has been briefly covered by dynamoo and has been reported by some users on official WordPress forums. --------------------------------------------- http://research.zscaler.com/2015/09/compromised-wordpress-campaign-spyware.… *** Cisco TelePresence Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- A vulnerability in the web interface of Cisco TelePresence Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against the user of the web interface. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41128 *** Banks: Card Breach at Hilton Hotel Properties *** --------------------------------------------- Multiple sources in the banking industry say they have traced a pattern of credit card fraud that suggests hackers have compromised point-of-sale registers in gift shops and restaurants at a large number of Hilton Hotel and franchise properties across the United States. Hilton says it is investigating the claims. --------------------------------------------- http://krebsonsecurity.com/2015/09/banks-card-breach-at-hilton-hotel-proper… *** Splunk Input Validation Flaw in Splunk Web Lets Remote Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1033655 *** McAfee Enterprise Security Manager Filename Processing Flaw Lets Remote Authenticated Users Execute Arbitrary Commands on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033654 *** Android Security Symposium - Videos online *** --------------------------------------------- The Android Security Symposium was a huge success and we are happy that the Videos are available online now. Thank you to Usmile for making this possible! --------------------------------------------- https://www.sba-research.org/2015/09/26/android-security-symposium-videos-o… *** Yahoo! Launches Free Web Application Security Scanner *** --------------------------------------------- Yahoo! has open-sourced Gryffin - a Web Application Security Scanner - in an aim to improve the safety of the Web for everyone. Currently in its beta, Project Gryffin has made available on Github under the BSD-style license that Yahoo! has been using for a .. --------------------------------------------- https://thehackernews.com/2015/09/web-application-security-scanner.html *** Android 6.0: Wie Google den Nutzern die Kontrolle zurückgeben will *** --------------------------------------------- Das neue Berechtigungsmodell von "Marshmallow" bringt signifikante Verbesserungen --------------------------------------------- http://derstandard.at/2000022756525 *** Git-1.9.5 ssh-agent.exe Buffer Overflow *** --------------------------------------------- https://cxsecurity.com/issue/WLB-2015090161 *** Kim Jong Un: Ein Mobilfunknetz nur für mich *** --------------------------------------------- Ein eigenes Mobilfunknetz für die nordkoreanische Führung: Was nach einem merkwürdigen Statussymbol klingt, soll die Sicherheit der Regierungskommunikation in dem abgeschotteten Land erhöhen. --------------------------------------------- http://www.golem.de/news/kimg-jong-un-ein-mobilfunknetz-nur-fuer-mich-1509-… *** How I hacked my IP camera, and found this backdoor account *** --------------------------------------------- The time has come. I bought my second IoT device - in the form of a cheap IP camera. As it was the cheapest among all others, my expectations regarding security was low. But this camera was still able to surprise me. Maybe I will disclose the camera model used in my hack in this blog later, but first .. --------------------------------------------- http://jumpespjump.blogspot.co.at/2015/09/how-i-hacked-my-ip-camera-and-fou… *** 332M Kick Ass pirates get asses kicked by scareware ass-kickers *** --------------------------------------------- Welcome to internet technical support. Please give us your computer The worlds most popular pirate torrent site KickAss Torrents is serving scareware advertising, helping dodgy call centre operators con users into handing over remote access to their machines. --------------------------------------------- www.theregister.co.uk/2015/09/28/332m_kick_ass_pirates_get_asses_kicked_by_… *** HTTP Evasions Explained - Part 3 - Chunked Transfer *** --------------------------------------------- This is the third article in a series which will explain the evasions done by HTTP Evader. It covers the failure of several firewalls (and some browsers) to support the Transfer-Encoding chunked in the correct way. For example it is possible to bypass .. --------------------------------------------- http://noxxi.de/research/http-evader-explained-3-chunked.html *** Mobile Ad Networks as DDoS Vectors: A Case Study *** --------------------------------------------- CloudFlare servers are constantly being targeted by DDoSes. We see everything from attempted DNS reflection attacks to L7 HTTP floods involving large botnets. --------------------------------------------- https://blog.cloudflare.com/mobile-ad-networks-as-ddos-vectors/ *** Android-Sicherheit: Fehlende Updates als Achillesferse *** --------------------------------------------- Hersteller nehmen ihre Verantwortung nicht wahr - Zeit für die Politik zu handeln --------------------------------------------- http://derstandard.at/2000022489460 *** Microsoft: Weniger als 1 Prozent aller Windows-PCs mit Malware infiziert *** --------------------------------------------- Dem Leiter von Microsofts Antiviren-Abteilung zufolge finden sich lediglich auf 0,6 Prozent aller vom ihm untersuchten .. --------------------------------------------- http://heise.de/-2824369 *** Saudi Arabia: They liked Hacking Team so much they tried to buy the company *** --------------------------------------------- Might be nice to avoid new spy tech export laws The Saudi Arabian government came close to buying a majority stake in Italian surveillance software firm Hacking Team last year. --------------------------------------------- www.theregister.co.uk/2015/09/28/saudi_arabia_hacking_team/ *** Cybercrime-Bekämpfung: "Kooperation ist der Schlüssel" *** --------------------------------------------- Interpol-Direktor Noboru Nakatani sprach sich am Montag in Wien für eine bessere Zusammenarbeit zwischen Behörden und Wirtschaft bei der Bekämpfung von Cyberkriminalität aus. --------------------------------------------- http://futurezone.at/digital-life/cybercrime-bekaempfung-kooperation-ist-de… *** (Angebliche) Sicherheitslücke: Remote Code Execution durch infizierte Winrar-Archive *** --------------------------------------------- Selbst entpackende Archive können mit einfachen Mitteln mit Schadcode infiziert werden, der dann auf dem Rechner der Nutzer ausgeführt wird. Die Winrar-Entwickler geben jedoch Entwarnung und kritisieren die Veröffentlichung. --------------------------------------------- http://www.golem.de/news/angebliche-sicherheitsluecke-remote-code-execution…

1 0

Tageszusammenfassung - Freitag 25-09-2015
by Daily end-of-shift report 25 Sep '15

25 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 24-09-2015 18:00 − Freitag 25-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Google's Three Tips for Sabotaging the Cybercrime Economy *** --------------------------------------------- In a broad study, a team of Googlers and academic researchers suggest attacking the cybercrime supply chain.The post Google's Three Tips for Sabotaging the Cybercrime Economy appeared first on WIRED. --------------------------------------------- http://www.wired.com/2015/09/google-offers-3-lessons-crippling-online-crime… *** Facebook-Betrüger locken mit Dislike-Button *** --------------------------------------------- Klicken Sie hier, wenn Sie als Erster den neuen Dislike-Knopf testen wollen: So funktioniert eine neue Betrugsmasche auf Facebook. Auf den Link sollten Sie aber nicht klicken. --------------------------------------------- http://futurezone.at/digital-life/facebook-betrueger-locken-mit-dislike-but… *** Multiple XSS vulnerabilities in FortiManager GUI *** --------------------------------------------- http://www.fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortiman… *** Microsoft puts a bullet in blundering D-Links leaked key that made malware VIPs on PCs *** --------------------------------------------- Private code-signing cert revoked at last Microsoft has finally revoked D-Links leaked code-signing key, which gave malware the red carpet treatment on millions of Windows PCs. --------------------------------------------- www.theregister.co.uk/2015/09/24/dlink_key_revoked/ *** SSL Malvertising Campaign Targets Top Adult Sites *** --------------------------------------------- A long running malvertising campaign hits major adult sites with a carefully crafted advert. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/09/ssl-malvertising-campa… *** Cryptowar: Hintertür für verschlüsselte Smartphone-Daten gesucht *** --------------------------------------------- Experten haben im Auftrag der US-Regierung darüber nachgedacht, wie Behörden Zugang zu verschlüsselten Daten auf Smartphones bekommen können - und vier Optionen entwickelt. Doch alle bringen große technische Probleme mit sich. --------------------------------------------- http://www.golem.de/news/cryptowar-hintertuer-fuer-verschluesselte-smartpho… *** Security: Cookies können Sicherheitslücke sein *** --------------------------------------------- Alle gängigen Browser sind über manipulierte Cookies angreifbar. Angreifer können mit einem Man-in-the-Middle-Angriff vertrauliche Nutzerdaten auslesen. --------------------------------------------- http://www.golem.de/news/security-cookies-sind-eine-sicherheitsluecke-1509-… *** Windows 10 IoT: Verschlüsselung für das Internet der Dinge *** --------------------------------------------- Nutzer von IoT-Core können ihre Daten künftig mit Bitlocker verschlüsseln und Elektromotoren steuern. Ausserdem kann das Betriebssystem jetzt im Paket mit dem Raspberry-Pi 2 bestellt werden. --------------------------------------------- http://www.golem.de/news/windows-10-iot-verschluesselung-fuer-das-internet-… *** Aktuelle Masche: Spam über Bande *** --------------------------------------------- Durch den Missbrauch von Beschwerde-Formularen oder Bug-Tracking-Systemen umgehen Spammer die Spam-Filter - auch die mühsam antrainierten der Anwender. --------------------------------------------- http://heise.de/-2826159 *** Endress+Hauser Fieldcare/CodeWrights HART Comm DTM XML Injection Vulnerability *** --------------------------------------------- This advisory provides mitigation details for two vulnerabilities within the Endress+Hauser HART DTM software libraries. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-267-01 *** Belkin vergisst PGP-Schlüssel in Lichtschalter-Firmware *** --------------------------------------------- Ein Lichtschalter mit Linux-Firmware. Praktisch, dachte sich Linux-Kernelentwickler Matthew Garrett und warf einen Blick auf die Software. Was er fand, überraschte ihn allerdings sehr: Den PGP-Key, mit dem Belkin seine Firmware unterschreibt. --------------------------------------------- http://heise.de/-2826218 *** l+f: Ormandy auf Killing Spree *** --------------------------------------------- Nach NOD32 und Kaspersky ist nun Avast an der Reihe. --------------------------------------------- http://heise.de/-2826654

1 0

Tageszusammenfassung - Donnerstag 24-09-2015
by Daily end-of-shift report 24 Sep '15

24 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 23-09-2015 18:00 − Donnerstag 24-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco IOS and IOS XE Software SSH Version 2 RSA-Based User Authentication Bypass Vulnerability *** --------------------------------------------- A vulnerability in the SSH version 2 (SSHv2) protocol implementation of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to bypass user authentication. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco AnyConnect Secure Mobility Client for Linux and Mac OS X Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in the code responsible for the self-updating feature of Cisco AnyConnect Secure Mobility Client for Linux and the Cisco AnyConnect Secure Mobility Client for Mac OS X could allow an authenticated, local .. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41135 *** Bidding for Breaches, Redefining Targeted Attacks *** --------------------------------------------- A growing community of private and highly-vetted cybercrime forums is redefining the very meaning of "targeted attacks." These bid-and-ask forums match crooks who are looking for access to specific data, resources or systems within major corporations with hired muscle who are up to the task or who already have access to those resources. --------------------------------------------- http://krebsonsecurity.com/2015/09/bidding-for-breaches-redefining-targeted… *** Custom Sidebars 2.1.0.1 - XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8196 *** Multiple vulnerabilities in Kaseya Virtual System Administrator *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-450/ http://www.zerodayinitiative.com/advisories/ZDI-15-449/ http://www.zerodayinitiative.com/advisories/ZDI-15-448/ *** Healthcare Organizations Twice As Likely To Experience Data Theft *** --------------------------------------------- Bad guys very willing to invest in attacking medical data, but healthcare not very willing to invest in defending it. --------------------------------------------- http://www.darkreading.com/risk/healthcare-organizations-twice-as-likely-to… *** Chinese Actors Use '3102' Malware in Attacks on US Government and EU Media *** --------------------------------------------- On May 6 and May 11, 2015, Unit 42 observed two targeted attacks, the first against the U.S. government and the second on a European media company. Threat actors delivered the same document via .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/09/chinese-actors-use-3102-… *** An Update on Nuclear (Reverse) Engineering *** --------------------------------------------- Although Angler continues to be the leading exploit kit, Nuclear is a significant threat to web surfers and seems to have been very active lately. ThreatLabZ recently encountered a Nuclear campaign originating from a variety of compromised .. --------------------------------------------- http://research.zscaler.com/2015/09/an-update-on-nuclear-reverse-engineerin… *** Quaverse RAT: Remote-Access-as-a-Service *** --------------------------------------------- Quaverse RAT or QRAT is a fairly new Remote Access Tool (RAT) introduced in May 2015. This RAT is marketed as an undetectable Java RAT. As you might expect from a RAT, the tool is capable of grabbing passwords, .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Quaverse-RAT--Remote-Ac… *** UltraEdit 22.20 Buffer Overflow *** --------------------------------------------- https://cxsecurity.com/issue/WLB-2015090142 *** Fingerabdrücke von Millionen US-Bediensteten gestohlen *** --------------------------------------------- Eine China zugeschriebene Hacker-Attacke auf die US-Bundespersonalbehörde OPM war noch schwerer als ohnehin schon gedacht. Demnach verschafften sich die Cyber-Angreifer neben .. --------------------------------------------- http://derstandard.at/2000022711754 *** Tracking Administrator Sessions in Windows Environments *** --------------------------------------------- Tracking users with privileged access is a critical task in your security policy (SANS Critical Security Control #12). If the key point is to restrict the number of 'power users' to the lowest, it's not always easy. Most of them .. --------------------------------------------- https://blog.rootshell.be/2015/09/24/tracking-administrator-sessions-in-win… *** Exploiting Corporate Printers *** --------------------------------------------- Printer exploitation and vulnerability in printers are serious problems, similar to those faced with computers and other hard drive devices, since they are connected to the network like other devices. Nowadays, most corporate offices or organizations .. --------------------------------------------- http://resources.infosecinstitute.com/exploiting-corporate-printers/ *** General HTML5 Security *** --------------------------------------------- HTML5 is a living standard and new features are being added as we speak. New features will continue to arrive and browsers will keep becoming better and better at supporting them. However, those new features also bring with them new opportunities for .. --------------------------------------------- http://resources.infosecinstitute.com/general-html5-security/ *** XcodeGhost: Apple veröffentlicht "Top 25" der infizierten Apps *** --------------------------------------------- Apple hat die 25 populärsten unter den kompromittierten Apps genannt, für manche ist bereits ein Update erhältlich. Die Einschätzungen zur Gesamtzahl der durch XcodeGhost betroffenen iOS-Programme variieren weiterhin deutlich. --------------------------------------------- http://heise.de/-2824927 *** Kovter malware learns from Poweliks with persistent fileless registry update *** --------------------------------------------- A variant of the Kovter malware is the first to use Trojan.Poweliks' pioneering tricks by residing only in the registry to evade detection. --------------------------------------------- http://www.symantec.com/connect/blogs/kovter-malware-learns-poweliks-persis… *** One Year After Shellshock, Are Your Servers and Devices Safer? *** --------------------------------------------- Security researchers were the first to respond during the Shellshock attacks of 2014. After news of the fatal flaw in the prevalent Bash (Bourne Again Shell)- found in most versions of the Unix and Linux operating systems as well as in Mac OSX - was released, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/one-year-after-s…

1 0

Tageszusammenfassung - Mittwoch 23-09-2015
by Daily end-of-shift report 23 Sep '15

23 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 22-09-2015 18:00 − Mittwoch 23-09-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Cisco AnyConnect Secure Mobility Client for Windows Privilege Escalation Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41136 *** Bypass Developed for Microsoft Memory Protection, Control Flow Guard *** --------------------------------------------- A researcher at Bromium is expected at DerbyCon to disclose a memory corruption mitigation bypass of Microsoft Control Flow Guard. --------------------------------------------- http://threatpost.com/bypass-developed-for-microsoft-memory-protection-cont… *** Hack Brief: Mobile Manager's Security Hole Would Let Hackers Wipe Phones *** --------------------------------------------- The vulnerability in the SAP Afaria mobile management system affected all mobile phones used by 6,300 companies. --------------------------------------------- http://www.wired.com/2015/09/hack-brief-popular-mobile-phone-manager-open-l… *** Cisco TelePresence Video Communication Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41128 *** Making our users unlearn what we taught them, (Wed, Sep 23rd) *** --------------------------------------------- Remember back in the ancient days, when macro viruses were rampant, and we security geeks instructed our flock of virus scared users to never click on a .DOC attachment in an email, but that a .PDF was perfectly fine? Fast forward a couple .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20177 *** Hackers upload bot code to Imgur in 8Chan attack *** --------------------------------------------- A nasty vulnerability in Imgur was used by attackers to hide malicious code in images, commandeer visitors browsers, and hose the 4Chan and 8Chan image .. --------------------------------------------- www.theregister.co.uk/2015/09/23/imgur_attack/ *** New security features in HPs printers can detect rogue BIOS and firmware modifications *** --------------------------------------------- HP refers to this capability as "self-healing security," but its actually a set of code integrity checking mechanisms that security researchers have asked embedded .. --------------------------------------------- http://www.infoworld.com/article/2985389/printers/hp-adds-protection-agains… *** Kaspersky: Mo Unpackers, Mo Problems. *** --------------------------------------------- As well as fuzzing, I've been auditing and reviewing the design, resulting in identifying multiple major flaws that Kaspersky are actively working on resolving. These issues affect everything from network intrusion detection, ssl interception .. --------------------------------------------- http://googleprojectzero.blogspot.de/2015/09/kaspersky-mo-unpackers-mo-prob… *** PHP Malware Finder *** --------------------------------------------- PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells. ... Detection is performed by crawling the filesystem and testing files against a set of YARA rules. Yes, its that simple! --------------------------------------------- https://github.com/nbs-system/php-malware-finder *** .htaccess Tricks in Global.asa Files *** --------------------------------------------- As you might know a lot of hacks use Apache configuration .htaccess files to override default web site behavior: add conditional redirects, create virtual paths (e.g mod_rewrite), auto-append code to PHP scripts, etc. In the world of IIS/ASP there is also an equivalent - Global.asa .. --------------------------------------------- https://blog.sucuri.net/2015/09/htaccess-tricks-in-global-asa-files.html *** XCodeGhost iOS app infection toll rises to FOUR THOUSAND *** --------------------------------------------- The number of XCodeGhost-infected iOS apps, initially pegged at 39, has exploded to more than 4,000. ... The Register has asked FireEye for the names of some of the prominent affected .. --------------------------------------------- http://www.theregister.co.uk/2015/09/23/xcodeghost_ios_app_infection_toll_r… *** iOS 9: Erneut Umgehung der Gerätesperre möglich *** --------------------------------------------- Neues Betriebssystem, neuer Trick: Erneut wurde ein Lockscreen-Bug entdeckt, mit dem der Zugriff auf Daten von iPhone & Co. auch ohne Eingabe von PIN-Code oder Fingerabdruckfreigabe möglich ist. --------------------------------------------- http://heise.de/-2824001 *** Security: Lenovo sammelt seit fast einem Jahr Nutzerdaten *** --------------------------------------------- Ein dritter Fall von fraglichem Umgang mit Nutzerdaten ist bei Lenovo bekanntgeworden. Auf Geräten der Thinkpad-, Thinkcentre- und Thinkstation-Modellreihen kann sich Lenovo-Software befinden, die seit fast einem Jahr das Nutzerverhalten beobachtet. --------------------------------------------- http://www.golem.de/news/security-lenovo-sammelt-nutzerdaten-seit-fast-eine… *** Firefox 41 ist da: Mehr Sicherheit und Instant Messaging *** --------------------------------------------- http://derstandard.at/2000022666280 *** Reflected Cross-Site Scripting (XSS) in iTop *** --------------------------------------------- High-Tech Bridge Security Research Lab discovered vulnerability in iTop, which can be exploited to perform Cross-Site Scripting (XSS) attacks against web application users. iTop is a critical application, which is used to cover the entire set of ITIL processes. Successful attack on this web .. --------------------------------------------- https://www.htbridge.com/advisory/HTB23268 *** ENISA Cyber Europe 2014 - After Action Report *** --------------------------------------------- ENISAs After Action Report of the pan-European cybersecurity exercise Cyber Europe 2014 (CE2014) was approved by the EU Member States and gives a high-level overview of the complex cybersecurity exercise that was carried out in 2014. The full after action report includes an engaging action plan which ENISA and Member States are committed to implement. --------------------------------------------- https://www.enisa.europa.eu/activities/Resilience-and-CIIP/cyber-crisis-coo… *** Open-Xchange Security Advisory 2015-09-23 *** --------------------------------------------- Vulnerability Details: Dialogs for printing content were vulnerable to execute injected script code at object properties that get printed. Risk: Malicious script code can be executed within a users context. This can lead to session hijacking .. --------------------------------------------- http://www.securityfocus.com/archive/1/536523 *** Apple will betroffene Nutzer über XcodeGhost-Apps informieren *** --------------------------------------------- Der iPhone-Hersteller hat eine 'Top 25'-Liste der infizierten Apps angekündigt und will Angriffen in XcodeGhost-Manier die Grundlage entziehen. Nutzer sollen zudem in Kenntnis gesetzt werden, wenn sie kompromittierte Apps heruntergeladen haben. --------------------------------------------- http://heise.de/-2824328

1 0

Tageszusammenfassung - Dienstag 22-09-2015
by Daily end-of-shift report 22 Sep '15

22 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 21-09-2015 18:00 − Dienstag 22-09-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Leaked D-Link security key allows hackers to disguise malware as legit *** --------------------------------------------- A leak of a major technology companys security key has been discovered, allowing hackers to convince Windows that their malware is legit. ... While the key expired in early September, that still means that potential cyber-criminals had six months with which to sign their malware with D-Link's leaked key and bypass Microsoft Windows security measures by masquerading as a trusted piece of software. --------------------------------------------- http://www.scmagazine.com/leaked-d-link-security-key-allows-hackers-to-disg… *** Apple watchOS2 Includes Host of Code-Execution Patches *** --------------------------------------------- Apple watchOS2 arrived with a host of security patches, including fixes for more than a dozen code-execution bugs. --------------------------------------------- http://threatpost.com/apple-watchos2-includes-host-of-code-execution-patche… *** How Exploit Kit Operators are Misusing Diffie-Hellman Key Exchange *** --------------------------------------------- Feedback from the Trend Micro Smart Protection Network has allowed us to discover that the notorious Angler and Nuclear exploit kits have included the latest Flash vulnerability (CVE-2015-5560) in their regular update. This means that systems with Adobe Flash Player 18.0.0.209 and earlier are vulnerable; however users running the latest version of Flash (18.0.0.232) are not affected. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/XRj7PRLQnjU/ *** Swiss Advertising network compromised and distributing a Trojan *** --------------------------------------------- On September 11, 2015, MELANI / GovCERT.ch got informed by security researcher Kafeine about a popular advertising network in Switzerland that obviously got compromised by cybercriminals, leading to an exploit kit called Niteris. ... While investigating the incident, we noticed that the Exploit Kit that was injected into the Ad network was only serving malware when the visitor had a German or French User-Agent (HTTP Header Accept-Language). --------------------------------------------- http://www.govcert.admin.ch/blog/13/swiss-advertising-network-compromised-a… *** Xen Security Advisory 142 - libxl fails to honour readonly flag on disks with qemu-xen *** --------------------------------------------- Callers of libxl can specify that a disk should be read-only to the guest. However, there is no code in libxl to pass this information to qemu-xen (the upstream-based qemu); and indeed there is no way in qemu to make a disk read-only. ... Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. --------------------------------------------- http://lists.xenproject.org/archives/html/xen-announce/2015-09/msg00003.html *** NCSC publishes revised ICT security guidelines for web applications *** --------------------------------------------- In February 2012 the National Cyber Security Centre (NCSC) published the ICT security guidelines for web applications, a guide to developing, administering and providing web applications and the associated infrastructure more securely. The guidelines are broadly applicable to ICT solutions based on web applications. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/ncsc-publishes-revised-ict-… *** Cisco Spark Mobile Application Man-in-the-Middle Vulnerability *** --------------------------------------------- A vulnerability in the Cisco Spark mobile application could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41127 *** HOW TO: Setting up Encrypted Communications Channels in Oracle Database *** --------------------------------------------- In this article, I will explain how to set up an encrypted communications channel in Oracle Database. This is the third in a series of blog posts Ive published about encryption as it relates to databases. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/HOW-TO--Setting-up-Encr… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Tivoli Workload Scheduler (CVE-2015-0478 and others) *** http://www.ibm.com/support/docview.wss?uid=swg21966551 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Algorithmics One Core, Algo Risk Application, and Counterparty Credit Risk (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21965555 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in NTP, Hivex, glibc, libuser, BIND affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance *** http://www.ibm.com/support/docview.wss?uid=swg21966274 --------------------------------------------- *** IBM Security Bulletin: Cross-Site Scripting vulnerabilities affect IBM Emptoris Strategic Supply Management Platform, Emptoris *** http://www.ibm.com/support/docview.wss?uid=swg21966754 --------------------------------------------- *** IBM Security Bulletin: OpenSSH vulnerability affects IBM WebSphere Cast Iron *** http://www.ibm.com/support/docview.wss?uid=swg21967077 --------------------------------------------- *** IBM Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect IBM Algorithmics One Core, Algo Risk Application, and Counterparty Credit Risk (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21965554 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Struts affects SAN Volume Controller and Storwize Family (CVE-2015-1831) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005335 --------------------------------------------- *** Security Bulletin: Venom vulnerability affects IBM Flex System Manager (FSM) (CVE-2015-3456) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098681 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in IBM Java SDK affects IBM SAN Volume Controller and Storwize Family (CVE-2015-0488, CVE-2015-2808, CVE-2015-1916, CVE-2015-0204) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005334

1 0

Tageszusammenfassung - Montag 21-09-2015
by Daily end-of-shift report 21 Sep '15

21 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 18-09-2015 18:00 − Montag 21-09-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Unconventional Malvertising Attack Uses New Tricks *** --------------------------------------------- Cyber criminals are creative when using their creative, as seen in this malvertising campaign experimenting with new obfuscation tricks. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/09/unconventional-malvert… *** Cisco Unity Connection Web Interface SQL Injection Vulnerability *** --------------------------------------------- A vulnerability in the web interface of Cisco Unity Connection (UC) could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41074 *** Cisco ASR 9000 Series Aggregation Services Routers Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the DHCP version 6 (DHCPv6) server implementation of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41101 *** DSA-3361 qemu - security update *** --------------------------------------------- Several vulnerabilities were discovered in qemu, a fast processoremulator. --------------------------------------------- https://www.debian.org/security/2015/dsa-3361 *** Insistent router botnet *** --------------------------------------------- Not so long ago, monitoring attackers in our telnet honeypots helped reveal an interesting botnet composed of ASUS brand home routers. A botnet trying to log into our SSH honeypot running on Turris routers most frequently in the last two weeks is a botnet whose IP addresses, according to Shodan, often have one common characteristic: they respond with cookie AIROS_SESSIONID on port 80. This cookie points at AirOS running on Ubiquiti airRouter. --------------------------------------------- http://en.blog.nic.cz/2015/09/18/insistent-router-botnet/ *** Harman-Kardon Uconnect Vulnerability *** --------------------------------------------- This advisory is a follow-up to the ICS-ALERT titled ICS-ALERT-15-203-01 FCA Uconnect Vulnerability that was published July 22, 2015, on the NCCIC/ICS-CERT web site. This advisory provides mitigation details for an unauthorized remote access to Fiat-Chrysler Automobile US (FCA US) LLC Uconnect telematics infotainment system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-260-01 *** Deutsche Cyber-Sicherheitsorganisation DCSO gegründet *** --------------------------------------------- Vier deutsche DAX-Konzerne wollen sich in Deutschland um die Cyber-Sicherheit kümmern. Volkswagen, Allianz, BASF und Bayer gründen einen eigenen Sicherheits-Dienstleister. --------------------------------------------- http://heise.de/-2821882 *** AVG Antivirus Plans to Collect & Sell Your Personal Data to Advertisers *** --------------------------------------------- We at The Hacker News are big fans of Security Software - The first thing we install while setting our Computers and Devices. Thanks to Free Security Software that protects Internet users without paying for their security. But, Remember: Nothing comes for FREE "Free" is just a relative term, as one of the worlds most popular anti-virus companies is now admitting. --------------------------------------------- http://thehackernews.com/2015/09/avg-antivirus.html *** Certificate Transparency: Symantec stellt falsches Google-Zertifikat aus *** --------------------------------------------- Offenbar zu Testzwecken ist von Symantec unberechtigterweise ein gültiges TLS-Zertifikat für Google.com ausgestellt worden. Entdeckt hat Google das über die Logs des Certificate-Transparency-Systems. --------------------------------------------- http://www.golem.de/news/certificate-transparency-symantec-stellt-falsches-… *** Brief survey on methods for attacking Tor hidden service *** --------------------------------------------- cently, MIT published an article for their recent work of identifying the hidden service of Tor by circuit fingerprinting with website fingerprinting to eventually trace down the hidden service users. This paper has been discussed on reddit and many other forums, and the question that whether Tor can be compromised becomes hot again. Here I want to have a brief overview of recent research on the methods and attempts for attacking Tor hidden services over the past years. --------------------------------------------- http://translate.wooyun.io/2015/09/19/Brief-survey-on-methods-for-attacking… *** SYNful Knock *** --------------------------------------------- Introduction On 15 September 2015, FireEye published information about potentially compromised Cisco routers under the name SYNful Knock. As soon as Shadowserver became aware of these potential compromises, Shadowserver and Cisco worked together and cooperated to scan the internet to detect this affected routers to allow a more accurate notification of the affected end-users. --------------------------------------------- http://blog.shadowserver.org/2015/09/21/synful-knock/ *** Inside Target Corp., Days After 2013 Breach *** --------------------------------------------- In December 2013, just days after a data breach exposed 40 million customer debit and credit card accounts, Target Corp. hired security experts at Verizon to probe its networks for weaknesses. The results of that confidential investigation -- until now never publicly revealed -- confirm what pundits have long suspected: Once inside Targets network, there was nothing stop attackers from gaining direct and complete access to every single cash register in every Target store. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/yLzOrODU9Vc/ *** BitPay Hacked, 5 000 Bitcoins Stolen *** --------------------------------------------- Bitcoin payments processor BitPay Inc. is the latest victim in a series of massive hacking scandals that have rocked the cryptocurrency community. The Atlanta-based Bitpay was hacked on three separate occasions in December of 2014. More than 5 000 bitcoins were stolen. Subsequent to this, BitPay sent a claim to its insurer Massachusetts Bay Insurance Company, and the latter declined to pay. The matter is now in court. --------------------------------------------- https://www.cryptocoinsnews.com/bitpay-hacked-5-000-bitcoins-stolen/ *** App Store: Apple bestätigt "XcodeGhost"-Infektionen *** --------------------------------------------- Der Konzern hat laut eigenen Angaben infizierte Apps aus einem Onlineladen entfernt. Ob es alle sind, weiß niemand. --------------------------------------------- http://heise.de/-2822207 *** Risiko Firmware *** --------------------------------------------- Firmware ist nur was für Profis? Von wegen: Heute hängen alltägliche Dinge im Internet und lassen sich darüber fernsteuern. Wenn die Heizungsanlage durchdreht und der DSL-Router für Angreifer offen steht, ist nicht selten veraltete Firmware schuld. --------------------------------------------- http://www.heise.de/newsticker/meldung/Risiko-Firmware-2822449.html?wt_mc=r… *** Typo3 über XSS-Lücke verwundbar *** --------------------------------------------- In Typo3 klafft eine Schwachstelle, über die Angreifer JavaScript in das Content Management System schmuggeln können. --------------------------------------------- http://www.heise.de/newsticker/meldung/Typo3-ueber-XSS-Luecke-verwundbar-28… *** Cisco Wireless LAN Controller RADIUS Packet of Disconnect Vulnerability *** --------------------------------------------- A vulnerability in the RADIUS implementation of the Cisco Wireless LAN Controller (WLC) could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition by disconnecting user sessions. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41102 *** Security Updates Available for Adobe Flash Player (APSB15-23) *** --------------------------------------------- A security bulletin (APSB15-23) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1273

1 0

Tageszusammenfassung - Freitag 18-09-2015
by Daily end-of-shift report 18 Sep '15

18 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 17-09-2015 18:00 − Freitag 18-09-2015 17:55 Handler: Alexander Riepl Co-Handler: n/a *** Important security notice regarding signing key and distribution of Red Hat Ceph Storage on Ubuntu and CentOS *** --------------------------------------------- Last week, Red Hat investigated an intrusion on the sites of both the Ceph community project (ceph.com) and Inktank (download.inktank.com), which were hosted on a computer system outside of Red Hat infrastructure. download.inktank.com provided .. --------------------------------------------- https://securityblog.redhat.com/2015/09/17/important-security-notice-regard… *** Analyzing Proxy Based Spam Networks *** --------------------------------------------- We are no strangers to Blackhat SEO techniques, we've actually spent a great deal of time working and sharing various bits of information related to Blackhat SEO techniques over the years. What we haven't shared, however, is the idea of Proxy-based Spam Networks (PSN). It's not because it wasn't interesting, it's .. --------------------------------------------- https://blog.sucuri.net/2015/09/analyzing-proxy-based-spam-networks.html *** Cisco Prime Network Registrar Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in the default configuration of the Cisco Prime Network Registrar (CPNR) virtual appliance (OVA) which could allow an authenticated, local attacker to gain root privileges. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41041 *** WordPress Malware - Active VisitorTracker Campaign *** --------------------------------------------- We are seeing a large number of WordPress sites compromised with the 'visitorTracker_isMob' malware code. This campaign started 15 days ago, but only in the last few days have we started to see it gain traction; really affecting a large number of .. --------------------------------------------- https://blog.sucuri.net/2015/09/wordpress-malware-active-visitortracker-cam… *** WP Shop <= 3.4.3.18 - Cross-Site Scripting (XSS) & CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8192 *** Researchers seek ransomware samples for their generic solution *** --------------------------------------------- VB2015 presentation to include demonstration of technique against recent samples.The scary hack thats on the rise is how Wireds Kim Zetter described ransomware in an overview article posted yesterday. Indeed, encrypting your files and demanding a ransom to decrypt them has become a very lucrative cybercriminal .. --------------------------------------------- http://www.virusbtn.com/blog/2015/09_18.xml *** Router Security / SYNful Knock *** --------------------------------------------- Wir bekamen Anfragen zum Thema SYNful Knock. Uns war das keine Warnung wert, daher fasst dieser Blogpost unseren Standpunkt zusammen:Management Summary Der SYNful Knock Angriff ist keine neue Kategorie von Bedrohungen. Es gibt .. --------------------------------------------- http://www.cert.at/services/blog/20150918112023-1598.html *** Sicherheitslücke: D-Link vergisst private Code-Signing-Schlüssel im Quellcode *** --------------------------------------------- Dem Hardwarehersteller D-Link ist ein peinlicher Fehler unterlaufen. Im Quellcode der Firmware für eine Überwachungskamera vergaßen die Entwickler private Code-Signing-Schlüssel. Der Hersteller hat bereits reagiert. --------------------------------------------- http://www.golem.de/news/peinlich-d-link-vergisst-private-code-signing-schl… *** Pwnage Per Port - 22/open/tcp//ssh *** --------------------------------------------- Hello and welcome to the first installment of Pwnage Per Port! Today we will be discussing the oh-so-important SSH service which runs (most commonly) on TCP port 22. Not sure what Pwnage Per Port is? Head on over here for a quick rundown on what you can expect! --------------------------------------------- http://l.avala.mp/blog/pwnage-per-port-22opentcpssh/ *** Triaging PowerShell Exploitation with Rekall *** --------------------------------------------- David recently published his article Spotting the Adversary so I figured Id continue the trend and focus on Blue Team tactics in this post. --------------------------------------------- http://www.redblue.team/2015/09/triaging-powershell-exploitation-with.html *** Cisco ASA Software Version Information Disclosure Vulnerability *** --------------------------------------------- A vulnerability in the SSL VPN code of Cisco ASA Software could allow an unauthenticated, remote attacker to obtain information about the Cisco ASA Software version. This information could be used for reconnaissance attacks. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=35946 *** Kritische Sicherheitslücke: Bug in Bugzilla *** --------------------------------------------- Die Bugverwaltung von Firefox gibt schon zum zweiten Mal im September vertrauliche Daten preis - doch diesmal sind auch andere Projekte betroffen. Ein Patch steht bereit. --------------------------------------------- http://www.golem.de/news/kritische-sicherheitsluecke-bug-in-bugzilla-1509-1…

1 0

Tageszusammenfassung - Donnerstag 17-09-2015
by Daily end-of-shift report 17 Sep '15

17 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 16-09-2015 18:00 − Donnerstag 17-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** A Brief Introduction to #totalhash *** --------------------------------------------- #totalhash is Team Cymru's malware analysis database, providing static and dynamic analysis of malware samples free for non-commercial use. Haven't tried #totalhash yet? Here's a brief video with a few highlights on how to upload samples, search our database, and go down the rabbit hole .. --------------------------------------------- https://blog.team-cymru.org/2015/09/a-brief-introduction-to-totalhash/ *** Bugtraq: [security bulletin] HPSBGN03393 rev.2 - HP Operations Manager i, Remote Code Execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/536478 *** Stagefrightened? *** --------------------------------------------- There's been a lot of attention recently around a number of vulnerabilities in Android's libstagefright. There's been a lot of confusion about the remote exploitability of the issues, especially on modern devices. In this blog post we will demonstrate an exploit for one of the libstagefright vulnerabilities .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/09/stagefrightened.html *** ZDI-15-444: Symantec Web Gateway Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-444/ *** ZDI-15-443: Symantec Web Gateway Arbitrary PHP File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is required to exploit this vulnerability, however it can be bypassed via reflected cross-site scripting. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-443/ *** ZDI-15-445: (0Day) Avira Management Console Update Manager Service HTTP Header Use-After-Free Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Avira Management Console. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-445/ *** CMS Updater - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-150 *** --------------------------------------------- The module does not sufficiently protect the settings page allowing any user with the permission "access administration pages" to change settings. --------------------------------------------- https://www.drupal.org/node/2569599 *** Drupal 7 driver for SQL Server and SQL Azure - Moderately Critical - SQL Injection - SA-CONTRIB-2015-148 *** --------------------------------------------- Certain characters aren't properly escaped by the Drupal database API. A malicious user may be able to access restricted information by performing a specially-crafted search. --------------------------------------------- https://www.drupal.org/node/2569577 *** Who's Behind Bluetooth Skimming in Mexico? *** --------------------------------------------- In the previous two stories, I documented the damage wrought by an organized crime gang in Mexico that has been systematically bribing ATM technicians to install Bluetooth skimming components that allow thieves to steal card and PIN data wirelessly. What follows is a look at a mysterious new ATM company in Mexico that sources say may be tied to the skimming activity. --------------------------------------------- http://krebsonsecurity.com/2015/09/whos-behind-bluetooth-skimming-in-mexico/ *** iTunes 12.3: Mehr Sicherheit, weniger Fehler und ein grosser Download *** --------------------------------------------- Zusammen mit iOS 9 hat Apple auch eine neue Version von iTunes freigegeben. Apple beseitigte insbesondere unter Windows Sicherheitslücken, die sogar das Abgreifen von verschlüsselten Zugangsdaten im Netzwerk erlaubten. Zudem erhöht Apple die Sicherheit bei der Verwendung von Apple IDs. --------------------------------------------- http://www.golem.de/news/itunes-12-3-mehr-sicherheit-weniger-fehler-und-ein… *** Behind the scenes at BruCON, a European hacker conference *** --------------------------------------------- Setting up a local conference seems to be a popular way for infosec pros that havent got the time or means to travel to bring the people they want to meet and the knowledge they want to attain .. --------------------------------------------- http://www.net-security.org/secworld.php?id=18863 *** Seven years of malware linked to Russian state-backed cyber espionage *** --------------------------------------------- F-Secure report details "The Dukes" malware family and its Russian connections. For the past seven years, a cyber-espionage group operating out of Russia .. --------------------------------------------- http://arstechnica.com/security/2015/09/seven-years-of-malware-linked-to-ru… *** Throwback Thursday: Virus Writer and Distributors Attributable Viruses *** --------------------------------------------- This Throwback Thursday, we turn the clock back to July 1990, when VB looked at virus origins and some of the rare cases of attributable viruses.This week saw the confession of a former teenage virus writer: the author of the Leprosy .. --------------------------------------------- http://www.virusbtn.com/blog/2015/09_17.xml *** Studie: In den USA droht ein Wahlmaschinen-Debakel *** --------------------------------------------- on den 50 US-Staaten werden 43 im kommenden Jahr besonders fehleranfällige Wahlcomputer einsetzen, die mindestens zehn Jahre alt sind, heißt es in einer Analyse der New York University. Dies berge große Risiken. --------------------------------------------- http://heise.de/-2820268 *** MMD-0042-2015 - Polymorphic in ELF malware: Linux/Xor.DDOS *** --------------------------------------------- The threat of Linux/XOR.DDoS, a China-made ELF backdoor ddoser malware, its still on going. I received a good question from (I assumed from a victim of infection) asked about why the found malware is not the same as what was firstly executed ELF malware binary. This writing is short and covering .. --------------------------------------------- http://blog.malwaremustdie.org/2015/09/mmd-0042-2015-polymorphic-in-elf.html *** HTTP Evasions Explained - Part 2 - Deflate Compression *** --------------------------------------------- This is the second article in a series which will explain the evasions done by HTTP Evader. It covers the failure of several firewalls to support content some compressions supported by all or most browsers, notable the deflate compression. In short, it is possible to bypass the malware inspection of several firewalls by simply sending a response compressed by deflate: --------------------------------------------- http://noxxi.de/research/http-evader-explained-2-deflate.html

1 0

Tageszusammenfassung - Mittwoch 16-09-2015
by Daily end-of-shift report 16 Sep '15

16 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 15-09-2015 18:00 − Mittwoch 16-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** CoreBot Adds New Capabilities, Transitions to Banking Trojan *** --------------------------------------------- As many researchers expected it would, CoreBot, the credential-stealing malware that first surfaced last month, has added a bevy of new capabilities and reinvented itself as a robust banking Trojan. --------------------------------------------- http://threatpost.com/corebot-adds-new-capabilities-transitions-to-banking-… *** Hacking Team looks to hire hacker *** --------------------------------------------- Following the compromising of nearly all its databases and emails, and then the subsequent release of those company details, Hacking Team posted a job listing for a "hacker/developer." --------------------------------------------- http://www.scmagazine.com/hacking-team-looks-to-expand-team-after-breach/ar… *** WordPress Brute Force Attacks - 2015 Threat Landscape *** --------------------------------------------- One of the first server-level compromises I had to deal with in my life was around 15 years ago, and it was caused by an SSH brute force attack. A co-worker set up a test server and chose a very weak root password. A few days later, the box was compromised .. --------------------------------------------- https://blog.sucuri.net/2015/09/wordpress-brute-force-attacks-2015-threat-l… *** Malicious spam with zip attachments containing .js files, (Wed, Sep 16th) *** --------------------------------------------- On 2015-07-29, the ISC publisheda diary covering malicious spam (malspam) with zip archives of javascript (.js) files [1]. Since then, weve received notifications from others who have found this type of malspam. Lets revisit the spam filters, search for this type of email, and see if anything .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20153 *** "Unternehmen wollen Sicherheitslösungen aus Europa" *** --------------------------------------------- SBA Research hat den ersten österreichischen Inkubator für Cybersicherheits-Start-ups ins Leben gerufen. Die futurezone hat die Geschäftsführer des Kompetenzentrums befragt. --------------------------------------------- http://futurezone.at/thema/start-ups/unternehmen-wollen-sicherheitsloesunge… *** In Search of SYNful Routers *** --------------------------------------------- On Tuesday, September 15, 2015, Mandiant and FireEye disclosed SYNful Knock, a router implant discovered on fourteen Cisco routers in India, Mexico, the Philippines, and Ukraine. The implant consists a modified version of the Cisco firmware that provides attackers with unrestricted access to the router including the ability to load additional modules. The attack is .. --------------------------------------------- https://zmap.io/synful/ *** Can an inevitable evil be conquered? *** --------------------------------------------- Scanning an object (a file or web resource) with an Internet security program essentially comes down to making a binary decision: dangerous or safe? An antivirus engine puts forward the hypothesis that an object is malicious and then checks .. --------------------------------------------- http://securelist.com/blog/opinions/72180/can-an-inevitable-evil-be-conquer… *** Enthüllungsplattform Cryptome: PGP-Schlüssel kompromittiert *** --------------------------------------------- Mit Zugang zu den Schlüsseln der Plattform und des Gründers John Young könnten Angreifer verschlüsselte Mails lesen und sich als Betreiber der Webseite ausgeben. --------------------------------------------- http://heise.de/-2817797 *** Cyberkriminalität in Österreich: Fragen und Antworten *** --------------------------------------------- Das Bundeskriminalamt präsentiert gemeinsam mit der futurezone den Cybercrime-Report 2014. Wir laden am Montagabend zur Diskussion über Trends in der Cyberkriminalität. --------------------------------------------- http://futurezone.at/digital-life/cyberkriminalitaet-in-oesterreich-fragen-… *** Android-Passwortsperre lässt sich zum Teil leicht austricksen *** --------------------------------------------- Bei Nexus-Geräten demonstriert, unklar ob andere Geräte betroffen sind – Google liefert bereits Update --------------------------------------------- http://derstandard.at/2000022284907 *** Schneider Electric StruxureWare Building Expert Plaintext Credentials Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cleartext transmission vulnerability in Schneider Electric's StruxureWare Building Expert product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-01 *** 3S CODESYS Gateway Server Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a heap-based buffer overflow vulnerability in 3S-Smart Software Solutions GmbH's CODESYS Gateway Server. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-02 *** GE MDS PulseNET Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two vulnerabilities in GE's MDS PulseNET and MDS PulseNET Enterprise Network Management Software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-03 *** Advantech WebAccess Stack-Based Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a stack-based buffer overflow vulnerability in Advantech's WebAccess application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-04 *** Attacks over DNS *** --------------------------------------------- DNS is a naming system used for all devices connected to the Internet or a network. DNS is easy to remember instead of IP addresses for users. It is a method in which domain names are translated into an IP (Internet Protocol) addresses. The DNS works .. --------------------------------------------- http://resources.infosecinstitute.com/attacks-over-dns/ *** SYNful Knock - A Cisco router implant - Part II *** --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis0.h… *** Trojan.MWZLesson.a Trojan for POS terminals *** --------------------------------------------- For many years POS terminals remain one the most favorite targets for virus makers. Due to the fact that this technology is used by a large number of sales organizations around the world to process payments made using bank cards, cybercriminals just .. --------------------------------------------- http://news.drweb.com/show/?i=9615&lng=en&c=9 *** Einstweilige Verfügung: Fireeye geht juristisch gegen Sicherheitsforscher vor *** --------------------------------------------- Ein Team von Sicherheitsforschern wollte auf einer Konferenz über Sicherheitslücken in Fireeye-Produkten berichten. Fireeye sah durch die Präsentation Geschäftsgeheimnisse bedroht und hat eine einstweilige Verfügung erwirkt. --------------------------------------------- http://www.golem.de/news/einstweilige-verfuegung-fireeye-geht-juristisch-ge… *** TeslaCrypt 2.0: Cyber Crime Malware Behavior, Capabilities and Communications *** --------------------------------------------- As part of our normal course of operations as a cyber threat intelligence provider, we monitor the cyber crime underground and provide analysis to our clients on new and emerging threats. As you can imagine, we naturally run into large quantities of malware on a daily basis. From time to time, we .. --------------------------------------------- http://www.isightpartners.com/2015/09/teslacrypt-2-0-cyber-crime-malware-be… *** Free and Commercial Tools to Implement the SANS Top 20 Security Controls, Part 2 *** --------------------------------------------- This is Part 2 of a How-To is an effort to compile a list of tools (free and commercial) that can help an IT administrator comply with the Security Controls. In Part 1 we looked at Inventory of Authorized and Unauthorized Devices. The controls (ordered 1-20) are in order of importance. In other words, completing .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/free-and-commercial-to…

1 0

Tageszusammenfassung - Dienstag 15-09-2015
by Daily end-of-shift report 15 Sep '15

15 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 14-09-2015 18:00 − Dienstag 15-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Enabling QR codes in Internet Explorer, or a story of a cross-platform memory disclosure *** --------------------------------------------- Posted by Mateusz Jurczyk of Google Project ZeroIn the previous series of posts (parts #1 #2 #3 #4), we discussed the exploitation process of a serious 'blend' vulnerability (CVE-2015-0093 / CVE-2015-3052), which was special .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/09/enabling-qr-codes-in-internet… *** Mapping How Tor's Anonymity Network Spread Around the World *** --------------------------------------------- Germany has overtaken the US in total nodes, with France, the Netherlands, and Russia coming close behind.The post Mapping How Tor's Anonymity Network Spread Around the World appeared first on WIRED. --------------------------------------------- http://www.wired.com/2015/09/mapping-tors-anonymity-network-spread-around-w… *** Large Malvertising Campaign Goes (Almost) Undetected *** --------------------------------------------- A very stealthy malvertising campaign has gone under everybodys noses and exposed a large amount of people to malware. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/09/large-malvertising-cam… *** Tracking Bluetooth Skimmers in Mexico, Part II *** --------------------------------------------- I spent four days last week in Mexico, tracking the damage wrought by an organized crime ring that is bribing ATM technicians to place Bluetooth skimmers inside of cash machines in and around the tourist areas of Cancun. Today's piece chronicles the work of this gang in coastal regions farther south, following a trail of hacked ATMs from Playa Del Camen down to the ancient Mayan ruins in Tulum. --------------------------------------------- http://krebsonsecurity.com/2015/09/tracking-bluetooth-skimmers-in-mexico-pa… *** SYNful Knock - A Cisco router implant - Part I *** --------------------------------------------- Router implants, from any vendor in the enterprise space, have been largely believed to be theoretical in nature and especially in use. However, recent vendor advisories indicate that these have been seen in the wild. Mandiant can confirm the existence of at least 14 such router implants spread across four different countries: Ukraine, Philippines, Mexico, and India. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.ht… *** Hey, Oracle, whats in that VirtualBox security update? *crickets* *** --------------------------------------------- Debian team bit miffed about secretive vuln fixes in hypervisor software Its not just Microsoft keeping schtum on exactly whats inside its software updates. --------------------------------------------- www.theregister.co.uk/2015/09/15/oracle_virtualbox_security_updates/ *** Von Flugzeugen bis Mars-Rovern: Lücke im Echtzeitbetriebssystem VxWorks *** --------------------------------------------- Das Echtzeitbetriebssystem VxWorks ist verwundbar und Angreifer können eigenen Code ausführen. Das System kommt in rund 1,5 Milliarden Geräten zum Einsatz - darunter auch im Mars-Rover Curiosity. --------------------------------------------- http://heise.de/-2812783 *** Another LinkedIn Sockpuppet *** --------------------------------------------- According to LinkedIn, 11 of my connections can introduce me to someone who 'knows' Anna. I'm not so sure about that. According to IMDb, Anna Sentina is really Anna Akana. Maybe LinkedIn should start charging to 'verify' recruiter .. --------------------------------------------- https://labsblog.f-secure.com/2015/09/15/another-linkedin-sockpuppet/ *** Our First Certificate Is Now Live *** --------------------------------------------- Let's Encrypt passed another major milestone by issuing our first certificate. You can see it in action here. --------------------------------------------- https://letsencrypt.org/2015/09/14/our-first-cert.html *** KCI Attacks against TLS *** --------------------------------------------- Protection of Internet communication is crucial in todays hyperconnected world. The industry standard for encrypting private and sensitive communication data over potentially adversarial controlled network cables and radio signals is TLS. ESSE, the security team of RISE GmbH, discovered a .. --------------------------------------------- https://kcitls.org/ *** Hunting Asynchronous Vulnerabilities *** --------------------------------------------- As the video of my 44Con presentation Hunting Asynchronous Vulnerabilities probably wont be available for a while, I thought Id provide a mildly abridged (and less vendor-neutral) writeup of the core technical content. You can download the slides here. --------------------------------------------- http://blog.portswigger.net/2015/09/hunting-asynchronous-vulnerabilities.ht… *** WordPress 4.3.1 Security and Maintenance Release *** --------------------------------------------- https://wordpress.org/news/2015/09/wordpress-4-3-1/ *** VB2015 last-minute papers announced *** --------------------------------------------- Ten talks covering hot research added to the VB2015 programme.There are just over two weeks to go until more than 400 security professionals descend on Prague for VB2015, the 25th Virus Bulletin International Conference.With the addition of ten last-minute papers, the conference programme is now almost complete: two keynotes (by Ross Anderson and Costin Raiu), seven Small Talks and 51 regular presentations mean the three conference days are packed with interesting talks and discussions on a --------------------------------------------- http://www.virusbtn.com/blog/2015/09_15.xml?rss *** Finding Vulnerabilities in Core WordPress: A Bug Hunter�s Trilogy, Part III - Ultimatum *** --------------------------------------------- In this series of blog posts, Check Point vulnerability researcher Netanel Rubin tells a story in three acts - describing his long path of discovered flaws and vulnerabilities in core WordPress, leading him from a read-only 'Subscriber' user, through creating, editing and deleting posts, and all the way to performing SQL injection and persistent XSS attacks on 20% of the popular web. --------------------------------------------- http://blog.checkpoint.com/2015/09/15/finding-vulnerabilities-in-core-wordp…

1 0

Tageszusammenfassung - Montag 14-09-2015
by Daily end-of-shift report 14 Sep '15

14 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 11-09-2015 18:00 − Montag 14-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** FireEye wegen Umgang mit Sicherheitsforschern in der Kritik *** --------------------------------------------- Ein deutscher Forscher, der Lücken in Sicherheits-Gateways der Firma FireEye entdeckt hat, wurde per einstweiliger Verfügung dazu gezwungen, seinen Vortrag zu zensieren. Sein Firmenchef spricht von unprofessionellem Verhalten seitens FireEye. --------------------------------------------- http://heise.de/-2811690 *** Tracking a Bluetooth Skimmer Gang in Mexico *** --------------------------------------------- -Sept. 9, 12:30 p.m. CT, Yucatan Peninsula, Mexico: Halfway down the southbound four-lane highway from Cancun to the ancient ruins in Tulum, traffic inexplicably slowed to a halt. There was some sort of checkpoint ahead by the Mexican Federal Police. I began to wonder whether it was a good idea to have .. --------------------------------------------- http://krebsonsecurity.com/2015/09/tracking-a-bluetooth-skimmer-gang-in-mex… *** Neuer Android-Trojaner erpresst mit Lock-Screen-Sperre *** --------------------------------------------- Versucht über Trick Device-Admin-Rechte einzuholen – Nur jenseits des Play Stores verbreitet --------------------------------------------- http://derstandard.at/2000022182737 *** How Command and Control Servers Remain Resilient *** --------------------------------------------- One of the ways that malware activity on a network is spotted is via the activity of their network activity. However, in many cases this can be difficult to detect: there have been incidents where command-and-control (C&C) servers were able to stay .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/adapting-to-chan… *** "Die Gefahr ist real": Auto-Hacks schrecken Branche auf *** --------------------------------------------- IT-Forscher übernahmen mehrmals Kontrolle über Fahrzeuge --------------------------------------------- http://derstandard.at/2000022195679 *** Österreichische Forscher entdecken TLS-Schwachstelle *** --------------------------------------------- Facebook vergibt Bug Bounty-Award an Rise – "Sicherheits-Desaster" verhindert --------------------------------------------- http://derstandard.at/2000022197161 *** Bundestag-Hack war ein Phishing-Angriff über un.org *** --------------------------------------------- Die Angreifer auf den Bundestag haben wohl Mails mit gefälschter Absendeadresse verschickt, die einen Link auf Malware enthielten. Nicht nur der Bundestag, sondern mehrere internationale Organisationen seien gleichzeitig angegriffen worden. --------------------------------------------- http://heise.de/-2811847 *** The Wordpress Plugins Playground *** --------------------------------------------- This morning, I had a quick look at my web serverlog file and searched for malicious activity. Attacks like brute-force generate a lot of entries and thuscan be easily detected.Other scanners are working below the radar and search for very specific vulnerabilities. In this case, a single request is often .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20147 *** The Shade Encryptor: a Double Threat *** --------------------------------------------- A family of ransomware Trojans emerged in late 2014/early 2015, and quickly established itself among the top three most widespread encryptors. This threat has been assigned the verdict Trojan-Ransom.Win32.Shade according to Kaspersky Labs classification. The original name given to the encryptor by its creator is not known. --------------------------------------------- http://securelist.com/analysis/publications/72087/the-shade-encryptor-a-dou… *** HTTP Evasions Explained - Part 1 - Evading Using HTTP 0.9 *** --------------------------------------------- This is the first article in a series which will explain the evasions done by HTTP evader. It covers the case that most firewalls only block what they detected as explicitly bad and simply pass what they dont understand. The main technique used in this part is the old but still working HTTP 0.9 protocol. --------------------------------------------- http://noxxi.de/research/http-evader-explained-1-http09.html *** Exploiting CSRF against search with Lucene *** --------------------------------------------- Cross domain timing attacks can be used against Lucene to reliably extract information contained within its index. By repeatedly timing HTTP requests using JavaScript Lucene search boxes can be exploited in a similar way to time based blind-sql injection. --------------------------------------------- https://www.idontplaydarts.com/2015/09/cross-domain-timing-attacks-against-… *** Brief analysis of a SQL injection in Cacti 0.8.8b *** --------------------------------------------- Back in September 2013 I wanted to practice some code auditing and picked the latest version of Cacti (v0.8.8b at the time). I spent a few hours looking into the code and also assessing a running instance of Cacti and this exercise resulted in a few vulnerabilities. I was motivated to finally put together this .. --------------------------------------------- http://blog.whatever.io/2015/09/12/brief-analysis-of-a-sql-injection-in-cac… *** Addressing the Delayed Message Attack in Wireless IoT Environments *** --------------------------------------------- While many years have passed while we're waiting for IoT to take over the world, there are some recent signs that it might indeed eventually happen. With this in mind, issues related to IoT security tend to become more and more important. In this article, we won't be talking about current IoT security .. --------------------------------------------- http://ithare.com/addressing-the-delayed-message-attack-in-wireless-iot-env…

1 0

Tageszusammenfassung - Freitag 11-09-2015
by Daily end-of-shift report 11 Sep '15

11 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 10-09-2015 18:00 − Freitag 11-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Bundeslagebild Cybercrime: Crime-as-a-Service wächst weiter *** --------------------------------------------- Das Bundeskriminalamt hat auf seiner Cybercrime-Konferenz C³ das Lagebild Cybercrime veröffentlicht. Demnach steigt die Bedrohung auf allen Gebieten der computerunterstützen Kriminalität. --------------------------------------------- http://heise.de/-2810254 *** VMSA-2015-0003.11 *** --------------------------------------------- Oracle JRE is updated in VMware products to address a critical security issue that existed in earlier releases of Oracle JRE. VMware products running JRE 1.7 Update 75 or newer and JRE 1.6 Update 91 or newer are not vulnerable to CVE-2014-6593, .. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** OpenLDAP Bug in ber_get_next() Lets Remote Users Cause the Target Service to Crash *** --------------------------------------------- A vulnerability was reported in OpenLDAP. A remote user can cause the target service to crash. A remote user can send a specially crafted packet to cause the target slapd service to crash. --------------------------------------------- http://www.securitytracker.com/id/1033534 *** Yokogawa Multiple Products Buffer Overflow Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for stack-based buffer overflow vulnerabilities in multiple Yokogawa products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-253-01 *** Von T-Systems: Der Bundestag bekommt eine neue IT-Infrastruktur *** --------------------------------------------- Als Reaktion auf den Hackerangriff werden im Bundestag nun mehr als 10.000 Webseiten dauerhaft gesperrt. Außerdem soll T-Systems ein neues Netzwerk aufbauen. Bundestags-Mitarbeiter müssen ihre USB-Sticks bald zu Hause lassen. --------------------------------------------- http://www.golem.de/news/von-t-systems-der-bundestag-bekommt-eine-neue-it-i… *** Google veröffentlicht erstes monatliches Sicherheitsupdate *** --------------------------------------------- Nach der Entdeckung der Stagefright-Sicherheitslücke hatte Google angekündigt, einen monatlichen Patchday mit Sicherheitsupdates einzuführen. Jetzt sind die ersten Builds veröffentlicht worden. --------------------------------------------- http://www.golem.de/news/android-google-veroeffentlicht-erstes-monatliches-… *** Simulation zeigte Millionen Hacker-Angriffe auf Zug-Steuersysteme *** --------------------------------------------- Falle "HoneyTrain": Wer würde tatsächlich versuchen, in die originalgetreue Nachbildung eines Zug-Steuerungssystems einzudringen? --------------------------------------------- http://derstandard.at/2000022056115 *** Cyber criminal crew DD4BC extorts businesses via DDoS *** --------------------------------------------- According to a report recently issued by Akamai, the DD4BC criminal group has been responsible for at least 114 DDoS attacks on its customers. According the Akamai firm, the criminal crews known as DD4BC has carried out at least 114 .. --------------------------------------------- http://securityaffairs.co/wordpress/40034/cyber-crime/dd4bc-group-extortion… *** Analysing a new eBanking Trojan called Fobber *** --------------------------------------------- Some weeks ago we read an interesting blog by Malwarebytes about Fobber, a new e-banking focussed malware in the arena that seems to be a Tinba spinoff. We decided to have a closer look at it to find out whether Swiss critical infrastructures are targeted by it. Wed like to share our findings with you, because it contains some interesting advanced techniques .. --------------------------------------------- http://www.govcert.admin.ch/blog/12/analysing-a-new-ebanking-trojan-called-… *** SUCEFUL: Next Generation ATM Malware *** --------------------------------------------- You dip your debit card in an automated teller machine (ATM) and suddenly realize it is stuck inside, what happened? --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/09/suceful_next_genera.ht… *** A Retrospective on Ashely Madison and the Value of Threat Modeling *** --------------------------------------------- One of my favourite authors in the field of computer security is Gary McGraw. If you are not familiar with him, I'd suggest you start by reading his book Software Security: Building Security In. One of the key points he makes is a distinction .. --------------------------------------------- https://littlemaninmyhead.wordpress.com/2015/09/08/a-retrospective-on-ashel… *** A Peek Inside an Affiliate's Malspam Operation: Kovter and Miuref/Boaxxe Infections *** --------------------------------------------- In March of this year, reports of malspam campaigns utilizing an email attached '.doc.js' files, which tied back to the Kovter and Boaxxe clickfraud trojans. The analysis of these malware families have already been well documented .. --------------------------------------------- http://phishme.com/a-peek-inside-an-affiliates-malspam-operation-kovter-and…

1 0

Tageszusammenfassung - Donnerstag 10-09-2015
by Daily end-of-shift report 10 Sep '15

10 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 09-09-2015 18:00 − Donnerstag 10-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The Security Risks of Third-Party Data *** --------------------------------------------- Most of us get to be thoroughly relieved that our e-mails werent in the Ashley Madison database. But dont get too comfortable. Whatever secrets you have, even the ones you dont think of as secret, are more likely than you think to get dumped on the Internet. Its .. --------------------------------------------- https://www.schneier.com/blog/archives/2015/09/the_security_ri_4.html *** RESTful - Moderately Critical - Access bypass - SA-CONTRIB-2015-147 *** --------------------------------------------- This module enables you to expose your Drupal backend by generating a RESTful API.The module doesnt sufficiently account for cores page cache generation for anonymous users, when using non-cookie authentication providers. Authenticated users, .. --------------------------------------------- https://www.drupal.org/node/2565875 *** Twitter - Moderately Critical - Access bypass - SA-CONTRIB-2015-146 *** --------------------------------------------- This module enables you to pull in public tweets from Twitter accounts, post messages to Twitter to announce content changes, and authenticate using Twitter.The module doesnt sufficiently check for access when using the Twitter Post .. --------------------------------------------- https://www.drupal.org/node/2565827 *** A look through the spam filters - examining waves of Upatre malspam, (Thu, Sep 10th) *** --------------------------------------------- Any email filtering worth its cost should block numerous messages every day. however, Im always interested to see what exactly is being blocked. Perhaps the most common type of malicious spam (malspam) I see from the spam filters is Upatre-based malspam. Ive written diaries before about specific waves of Upatre malspam sending the Dyre banking Trojan [1, 2]. Ive only noticed emails with .zip .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20135 *** MSRT September 2015: Teerac *** --------------------------------------------- As part of our ongoing effort to provide better malware protection, the September release of the Microsoft Malicious Software Removal Tool (MSRT) will include detection for the prevalent ransomware family Win32/Teerac. We first detected Teerac in early 2014. Since then, the family has joined Win32/Crowti .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/09/08/msrt-september-2015-teer… *** How Do You Solve A Problem Like Attribution? *** --------------------------------------------- There was an advert for weed-killer a while back, the tagline was something along the lines of 'Kill the root, kill the weed'. That's true of many problems, better to get to the heart of the issue and deal with it there, rather than .. --------------------------------------------- https://blog.team-cymru.org/2015/09/how-do-you-solve-a-problem-like-attribu… *** Obfuscated URLs, where is that link taking you? *** --------------------------------------------- We take a look at ways to obfuscate URL the way scammers do by using shortening services and encoded search engine URLs. --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/09/obfuscated-urls-where-is-t… *** Ein Patch, zwei offene Lücken in Cisco-Gateways *** --------------------------------------------- In der Software von Ciscos Web Security Appliance (WSA) und der Email Security Appliance (ESA) der Firma klaffen Lücken, die es Angreifern aus der Ferne erlauben, die Gateways lahmzulegen. Nur für eine der drei Lücken gibt es Abhilfe. --------------------------------------------- http://heise.de/-2809896 *** Free and Commercial Tools to Implement the SANS Top 20 Security Controls, Part 1 *** --------------------------------------------- This is the first in a series about the tools available to implement the SANS Top 20 Security Controls. The SANS Top 20 Security Controls are not standards. If you want standards and procedures, check out the NIST 800 series Special Publications (SP). The controls are recommendations made by .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/free-and-commercial-to… *** The Latest on Stagefright: CVE-2015-1538 Exploit is Now Available for Testing Purposes *** --------------------------------------------- More than a month has passed since Zimperium first broke the news of zLabs' VP of Platform Research and Exploitation Joshua J. Drake's discovery of multiple critical vulnerabilities in Android's media library - libstagefright. In that time frame, the number and importance of the events that have unfolded is nothing short of amazing. Back in April and May we reported two sets of vulnerabilities to Google, both .. --------------------------------------------- https://blog.zimperium.com/the-latest-on-stagefright-cve-2015-1538-exploit-… *** Ashley Madison: Hacker knacken 11,2 Millionen Passwörter *** --------------------------------------------- Die Login-Dateien im Ashley-Madison-Fundus galten bislang als sicher, weil der Anbieter eine sichere Hashfunktion verwendet haben soll. Doch jetzt haben Hacker eine Schwachstelle gefunden, um einen Teil der Passwörter zu knacken. --------------------------------------------- http://www.golem.de/news/ashley-madison-hacker-knacken-11-2-millionen-passw…

1 0

Tageszusammenfassung - Mittwoch 9-09-2015
by Daily end-of-shift report 09 Sep '15

09 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 08-09-2015 18:00 − Mittwoch 09-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** PMASA-2015-4 *** --------------------------------------------- This vulnerability allows to complete the reCaptcha test and subsequently perform a brute force attack to guess user credentials without having to complete further reCaptcha tests. --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2015-4/ *** Cisco Application Visibility and Control FlexConnect UDP Vulnerability *** --------------------------------------------- A vulnerability in Cisco Application Visibility and Control (AVC) software for wireless networking could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40845 *** Cisco Security Management Appliance Log Rollover Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the web interface of the Cisco Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on a targeted device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40847 *** [20150908] - Core - XSS Vulnerability *** --------------------------------------------- http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerabi… *** MS15-SEP - Microsoft Security Bulletin Summary for September 2015 - Version: 1.1 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-SEP *** Malicious Google Search Console Verifications *** --------------------------------------------- This past summer we noticed a trend of more and more Blackhat SEO hacks trying to verify additional accounts as owners of compromised sites in Google Search Console (formerly Webmaster Tools). Google Search Console provides really useful .. --------------------------------------------- https://blog.sucuri.net/2015/09/malicious-google-search-console-verificatio… *** Advantech WebAccess Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a stack-based overflow vulnerability in Advantech's WebAccess application to NCCIC/ICS-CERT. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-251-01 *** Patchday: Microsoft stopft 55 Lücken, Adobe nur zwei *** --------------------------------------------- Während Microsoft diesen Monat an der Sicherheit von mehreren Anwendungen schraubt, konzentriert sich Adobe ausschließlich auf den Shockwave Player. --------------------------------------------- http://heise.de/-2808452 *** Turla APT Group Abusing Satellite Internet Links *** --------------------------------------------- Researchers at Kaspersky Lab have revealed that the Turla APT gang is using satellite-based Internet links to hide command-and-control activities. --------------------------------------------- http://threatpost.com/turla-apt-group-abusing-satellite-internet-links/1145… *** A Brief Examination of Hacking Team's Crypter: core-packer. *** --------------------------------------------- In this blog entry we investigate how Italian malware vendor Hacking Team obfuscated their malware, specifically the custom software they developed for this task called core-packer2. This analysis was a joint project between Will Cummings and Ethan Heilman. --------------------------------------------- http://ethanheilman.tumblr.com/post/128708937890/a-brief-examination-of-hac…

1 0

Tageszusammenfassung - Dienstag 8-09-2015
by Daily end-of-shift report 08 Sep '15

08 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 07-09-2015 18:00 − Dienstag 08-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The state of Ransomware in 2015 *** --------------------------------------------- Ransomware has been a threat for quite some years, although the ransomware as its currently known, encrypting files, has only been around a few years. This change started with the initial 2013 CryptoLocker infections authored by the .. --------------------------------------------- http://blog.fox-it.com/2015/09/07/the-state-of-ransomware-in-2015/ *** Adult Player: Porno-App erpresst Android-Nutzer mit Selfies *** --------------------------------------------- Die Porno-App Adult Player schießt ein Selbstporträt des Nutzers, sperrt das Smartphone und fordert zur Zahlung von 500 US-Dollar auf. Nutzer können sich mit einfachen Mitteln schützen. --------------------------------------------- http://www.golem.de/news/adult-player-porno-app-erpresst-android-nutzer-mit… *** Sofacy Recycles Carberp and Metasploit Code *** --------------------------------------------- The Sofacy Group (also known as Pawn Storm or APT28) is well known for deploying zero-day exploits in their APT campaigns. For example, two recent zero-days used by the Sofacy Group were exploiting vulnerabilities in Microsoft .. --------------------------------------------- https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasp… *** Unauthenticated Path Disclosure *** --------------------------------------------- It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation. --------------------------------------------- http://www.typo3.org/news/article/unauthenticated-path-disclosure/ *** Jeep-Hack: Fiat Chrysler ruft weitere Modelle zurück *** --------------------------------------------- Aufgrund einer Sicherheitslücke im Infotainmentsystem ruft Fiat Chrysler in den USA 7810 SUV-Modelle zurück. Davon sollen sich rund die Hälfte noch bei Händlern befinden, die das Update vor dem Verkauf einspielen können. Nach Bekanntwerden .. --------------------------------------------- http://heise.de/-2807879 *** Ashley Madison, Why Do Our Honeypots Have Accounts On Your Website? *** --------------------------------------------- She is 33 years old, from Los Angeles, 6 feet tall, sexy, aggressive, and a 'woman who knows what she wants', according to her profile. She is intriguing. However, her intrigue doesn't end .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/ashley-madison-w… *** Cyber Security - Getting the Message *** --------------------------------------------- There is a concept in the health and safety industry known as 'sign blindness'. This occurs when safety notices become so numerous, or so familiar, that the human brain simply filters .. --------------------------------------------- https://blog.team-cymru.org/2015/09/cyber-security-getting-the-message/ *** FireEye untersucht Root-Lücken in Sicherheits-Appliances *** --------------------------------------------- Sicherheitsforscher hatten schwerwiegende Lücken in den Appliances der Firma entdeckt. Ihre Hinweise blieben nach eigenen Angaben 18 Monate lang unbeantwortet. FireEye sagt, man wisse erst seit Montag von den Lücken. --------------------------------------------- http://heise.de/-2807930 *** iOS 8.4.1 Kernel Vulnerabilities in AppleHDQGasGaugeControl *** --------------------------------------------- When auditing iOS kernel executable, we found that the code quality of com.apple.driver.AppleHDQGasGaugeControl is very bad. In this blog, we will disclose 3 vulnerabilities in this kernel extension on the latest public iOS (version 8.4.1). More .. --------------------------------------------- http://blog.pangu.io/ios-8-4-1-kernel-vulns/ *** WhatsApp 'MaliciousCard' Vulnerabilities Allowed Attackers to Compromise Hundreds of Millions of WhatsApp Users *** --------------------------------------------- WhatsApp Web is a web-based extension of the WhatsApp application on your phone. The web application mirrors all messages sent and received, and fully synchronize your phone and your desktop computer so that users can see all messages on both devices. --------------------------------------------- http://blog.checkpoint.com/2015/09/08/whatsapp-maliciouscard-vulnerabilitie… *** Security Update Available for Adobe Shockwave Player (APSB15-22) *** --------------------------------------------- A security bulletin (APSB15-22) has been published regarding a security update for Adobe Shockwave Player. This update addresses critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1268

1 0

Tageszusammenfassung - Montag 7-09-2015
by Daily end-of-shift report 07 Sep '15

07 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 04-09-2015 18:00 − Montag 07-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Paper: Custom packer defeats multiple automation systems *** --------------------------------------------- Combination of anti-automation, anti-VM and anti-reverse engineering to make researchers lives harder.Ever since the number of new malware samples became so large we could no longer list them in Virus Bulletin magazine, security researchers .. --------------------------------------------- http://www.virusbtn.com/blog/2015/09_04.xml *** Neutrino exploit used to inject Teslascrypt into sites using outdated CMS tools *** --------------------------------------------- Heimdal Security reported an increase in malicious scripts infecting legitimate websites that then redirect the victim to the Neurtino exploit kit server that could potentially impact more than 400 million web users. --------------------------------------------- http://www.scmagazine.com/outdated-websites-deliver-teslacrypt-via-neutrino… *** Firefox-Sicherheitslücken: Angreifer hatte Zugriff auf Mozilla-Bugtracker *** --------------------------------------------- Ein priviligierter Account für den Mozilla-Bugtracker ist unter der Kontrolle eines Angreifers gewesen. Dadurch gelang es diesem, Informationen über noch nicht behobene Sicherheitslücken in Firefox zu erhalten. --------------------------------------------- http://www.golem.de/news/firefox-sicherheitsluecken-angreifer-hatte-zugriff… *** Extorting money from Ashley Madison customers is actually pretty easy *** --------------------------------------------- 1.05 bitcoins, or $243, is a low enough price to avoid further embarrassment. In the wake of the recent Ashley Madison e-mail dump, some customers have gotten demand e-mails like .. --------------------------------------------- http://arstechnica.com/business/2015/09/extorting-money-from-ashley-madison… *** Baby-Monitore sind leicht zu hacken *** --------------------------------------------- Wie ein Sicherheitsforscher herausfand, sind acht von neun Babyfons mit Internet-Verbindung relativ einfach als Spionage-Kameras einsetzbar. --------------------------------------------- http://futurezone.at/digital-life/baby-monitore-sind-leicht-zu-hacken/151.0… *** Auto-Hacking: Kritik an Sicherheitsupdates per Post *** --------------------------------------------- Wie stopft man kritische Sicherheitslücken in der Software von Autos? Nach Ansicht eines Sicherheitsexperten ist der von Fiat Chrysler gewählte Weg eine Einladung an Hacker. --------------------------------------------- http://www.golem.de/news/auto-hacking-kritik-an-sicherheitsupdates-per-post… *** Files on Seagate wireless disks can be poisoned, purloined *** --------------------------------------------- Download everything, seed with malware, move on to next sucker CERT.org has reported Seagate wireless hard drives include 'undocumented Telnet services' accessible with a hard-coded password and allowing unrestricted file .. --------------------------------------------- www.theregister.co.uk/2015/09/07/files_on_seagate_wireless_disks_can_be_poi… *** CryptDB: Angriff auf verschlüsselte Datenbanken *** --------------------------------------------- Ein Team von Microsoft-Wissenschaftlern hat einen Angriff auf die verschlüsselte Datenbank-Software CryptDB vorgestellt. Als Demonstrationsobjekt nutzte es US-Gesundheitsdatenbanken. Ein ehemaliger Entwickler kritisiert den Angriff jedoch als unrealistisch. --------------------------------------------- http://www.golem.de/news/cryptdb-angriff-auf-verschluesselte-datenbanken-15… *** Arrests Tied to Citadel, Dridex Malware *** --------------------------------------------- Authorities in Europe have arrested alleged key players behind the development and deployment of ultra-sophisticated banking malware, including Citadel and Dridex. The arrests involved a Russian national and a Moldovan man, both of whom were traveling .. --------------------------------------------- http://krebsonsecurity.com/2015/09/arrests-tied-to-citadel-dridex-malware/ *** Crypto-trouble in Poison Ivys C2 protocol *** --------------------------------------------- During the course of some research regarding the security of RAT C2 protocols and infrastructure i came across a stack buffer overflow disclosed in 2011 (OSVDB-83774) affecting the C2 server component of the Poison Ivy RAT. Poison Ivy (PIVY) is a golden oldie RAT probably everyone in infosec circles is familiar .. --------------------------------------------- https://samvartaka.github.io/malware/2015/09/07/poison-ivy-reliable-exploit… *** Ghost Got Secrets - Ghostbins Guts Part 1 *** --------------------------------------------- Privacy and anonymity are critical tools for maintaining freedom in our growingly-digital world. Even so, privacy and anonymity are commonly used by individuals performing malicious activities. These two sides of the same coin are what .. --------------------------------------------- http://l.avala.mp/blog/ghost-got-secrets-ghostbins-guts-part-1/

1 0

Tageszusammenfassung - Freitag 4-09-2015
by Daily end-of-shift report 04 Sep '15

04 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 03-09-2015 18:00 − Freitag 04-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** More Adult Themed Android Ransomware *** --------------------------------------------- During the course of our daily malware hunt, we came across a new mobile ransomware variant that leverages pornography to lure victims into downloading and installing it. Wed previously .. --------------------------------------------- http://research.zscaler.com/2015/09/more-adult-themed-android-ransomware.ht… *** Analyzing Popular Layer 7 Application DDoS Attacks *** --------------------------------------------- Distributed Denial of Service (DDoS) attacks have been a major concern for website owners for a while. All types of sites, from small to big, have been taken down and kept offline because of them. Even over-provisioned servers can be .. --------------------------------------------- https://blog.sucuri.net/2015/09/analyzing-popular-layer-7-application-ddos-… *** Cogent DataHub Code Injection Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a code injection vulnerability affecting the Cogent DataHub application produced by Cogent Real-Time Systems, Inc. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-246-01 *** Schneider Electric Modicon PLC Vulnerabilities *** --------------------------------------------- This advisory is a follow-up to the alert titled ICS-ALERT-15-224-02 Schneider Electric Modicon M340 PLC Station P34 Module Vulnerabilities that was published August 12, 2015, to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for vulnerabilities in the Schneider Electric Modicon PLC. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02 *** Moxa Industrial Managed Switch Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Moxa EDS-405A/EDS-408A series managed Ethernet switches. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-246-03 *** SMA Solar Technology AG Sunny WebBox Hard-coded Account Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a hard-coded account vulnerability in the SMA Solar Technology AG Sunny WebBox product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-181-02 *** APPLE-SA-2015-09-03-1 OS X: Flash Player plug-in blocked *** --------------------------------------------- Due to security issues in older versions, Apple has updated the web plug-in blocking mechanism to disable all versions prior to Flash Player 18.0.0.232. --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/Sep/msg00000.ht… *** Google, Mozilla, Microsoft to Sever RC4 Support in Early 2016 *** --------------------------------------------- Google and Mozilla today announced they've settled on a timeframe to permanently deprecate the shaky RC4 encryption algorithm. --------------------------------------------- http://threatpost.com/google-mozilla-microsoft-to-sever-rc4-support-in-earl… *** How to Kick-Out the Bad Guy? *** --------------------------------------------- A quick blog post about an issue I faced this morning. While drinking my morning coffee and reviewing what happened during the last night in my logs, I detected that one of my website (leakedin.com) was entirely mirrored by a guy from Brazil. I'm not against sharing information but in this case, it was consuming bandwidth and server resources for nothing. I was time to .. --------------------------------------------- https://blog.rootshell.be/2015/09/04/kick-bad-guy/ *** CVE-2014-7216: A Journey Through Yahoo's Bug Bounty Program *** --------------------------------------------- I have published another security advisory about a vulnerability, which I have 'recently' reported to Yahoo! via their Bug-Bounty program hosted by HackerOne. So this blog post is about the technical details of the CVE-2014-7216 (which is not very thrilling), but more about my experience with Yahoo's Bug Bounty program. --------------------------------------------- https://www.rcesecurity.com/2015/09/cve-2014-7216-a-journey-through-yahoos-… *** LinkedIn Sockpuppets Are Targeting Security Researchers *** --------------------------------------------- Multiple LinkedIn accounts recently targeted numerous security specialists in an attempt to map their social graphs. Several of our researchers received these LinkedIn invitations themselves and Daavid from our Threat Intelligence team decided to investigate. Here's an example of one so-called 'recruiter' account. --------------------------------------------- https://labsblog.f-secure.com/2015/09/03/linkedin-sockpuppets-targeting-sec… *** Office Malware: AGB gegen Spammer *** --------------------------------------------- Ein russischer Entwickler möchte nicht, dass seine Office Malware MWI von Spammern verwendet wird. Doch seine allgemeinen Geschäftsbedingungen zeigen nur begrenzt Wirkung. Ein kurioser Blick in den Malware-Markt. --------------------------------------------- http://www.golem.de/news/office-malware-agb-gegen-spammer-1509-116130.html *** Sleepy Puppy: Netflix-Tool jagt XXS-Lücken *** --------------------------------------------- Sicherheitsforscher können mit Sleepy Puppy tief in Netzwerken graben und an verschiedenen Stellen Schwachstellen für Cross-Site-Scripting ausfindig machen. --------------------------------------------- http://heise.de/-2805316 *** Nach Erpressungsversuch: Webhoster 1blu tauscht tausende SSL-Zertifikate *** --------------------------------------------- Vor zwei Monaten Erfuhr die Hosting-Firma, dass sich ein Angreifer weitreichenden Zugriff auf Kundendaten verschaffen konnte. Jetzt stellt sich heraus, dass offenbar auch die SSL-Zertifikate der Kunden betroffen sind. --------------------------------------------- http://heise.de/-2803573

1 0

Tageszusammenfassung - Donnerstag 3-09-2015
by Daily end-of-shift report 03 Sep '15

03 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 02-09-2015 18:00 − Donnerstag 03-09-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Neuer Banking-Trojaner taucht auch in Österreich auf *** --------------------------------------------- IBM-Forscher haben mit "Shifu" einen neuen Trojaner identifiziert, der es auf Banken aus Deutschland, Japan und Österreich abgesehen hat. --------------------------------------------- http://futurezone.at/digital-life/neuer-banking-trojaner-taucht-auch-in-oes… *** New Versions of Carbanak Banking Malware Seen Hitting Targets in U.S. and Europe *** --------------------------------------------- New variants of the notorious Carbanak Trojan has surfaced in Europe and the United States, and researchers say that the malware now has its own proprietary communications protocol and the samples seen so far have been digitally signed. Carbanak has been in use for several years, and researchers at Kaspersky Lab earlier this year revealed the... --------------------------------------------- http://threatpost.com/new-versions-of-carbanak-banking-malware-seen-hitting… *** Cross-Site-Scripting: Netflix stellt Tool zum Auffinden von Sicherheitslücken vor *** --------------------------------------------- Der Streamingdienst Netflix erstellt nicht nur aufwendige Eigenproduktionen, sondern entwickelt auch Sicherheitstools. Jetzt hat das Unternehmen ein Werkzeug zum Auffinden von Schwächen von Cross-Site-Scripting vorgestellt. --------------------------------------------- http://www.golem.de/news/cross-site-scripting-netflix-stellt-tool-zum-auffi… *** New Android Ransomware Communicates over XMPP *** --------------------------------------------- A new strain of Android ransomware disguised as a video player app uses an instant messaging protocol called XMPP to receive commands and communicate with the command and control server. --------------------------------------------- http://threatpost.com/new-android-ransomware-communicates-over-xmpp/114530 *** CVE-2015-5722: Parsing malformed keys may cause BIND to exit due to a failed assertion in buffer.c *** --------------------------------------------- Parsing a malformed DNSSEC key can cause a validating resolver to exit due to a failed assertion in buffer.c. It is possible for a remote attacker to deliberately trigger this condition, for example by using a query which requires a response from a zone containing a deliberately malformed key. --------------------------------------------- https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bi… *** CVE-2015-5986: An incorrect boundary check can trigger a REQUIRE assertion failure in openpgpkey_61.c *** --------------------------------------------- An incorrect boundary check in openpgpkey_61.c can cause named to terminate due to a REQUIRE assertion failure. This defect can be deliberately exploited by an attacker who can provide a maliciously constructed response in answer to a query. --------------------------------------------- https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-tri… *** Cisco Integrated Management Controller Supervisor and Cisco UCS Director Remote File Overwrite Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Symantec Ghost Explorer Utility Tool Out-of-Bounds Array Indexing *** --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** EMC Atmos XML External Entity Processing Flaw Lets Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1033456 *** Bugtraq: [SYSS-2015-016] Avaya one-X Agent - Hard-coded Cryptographic Key *** --------------------------------------------- http://www.securityfocus.com/archive/1/536386 *** Bugtraq: Checkmarx CxQL Sandbox bypass (CVE-2014-8778) *** --------------------------------------------- http://www.securityfocus.com/archive/1/536387 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in IBM Java Runtime affect Watson Explorer, Watson Content Analytics, and OmniFind Enterprise Edition (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625, CVE-2015-1931) *** http://www.ibm.com/support/docview.wss?uid=swg21965348 *** IBM Security Bulletin: Vulnerability in OpenSSL affects IBM Security Proventia Network Enterprise Scanner (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792, CVE-2015-3216) *** http://www.ibm.com/support/docview.wss?uid=swg21965845 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Security Network Controller (CVE-2015-1793) *** http://www.ibm.com/support/docview.wss?uid=swg21965725 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Security Network Controller (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21964035 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Sterling Connect:Direct Browser User Interface *** http://www.ibm.com/support/docview.wss?uid=swg21965448 *** IBM Security Bulletin: Multiple Security Issues in IBM Media Server Due to OpenSSL Issues *** http://www.ibm.com/support/docview.wss?uid=swg21963783 *** IBM Security Bulletin: Multiple security vulnerabilities have been identified in IBM Security Identity Manager Virtual Appliance (CVE-2015-1788 and CVE-2015-1885) *** http://www.ibm.com/support/docview.wss?uid=swg21964241 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects Flex System Power Compute Node Firmware (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022656 *** ZDI-15-418: (0Day) Borland AccuRev Reprise License Server edit_lf_process Remote Code Execution Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Ejh3XZSEdr0/ *** ZDI-15-417: (0Day) Borland AccuRev Reprise License Server edit_lf_get_data Command lf Parameter Path Traversal Read Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/hC9GLRY4Jiw/ *** ZDI-15-416: (0Day) Borland AccuRev Reprise License Server service_setup_doit Command Stack Buffer Overflow Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/BQougUpI_Ys/ *** ZDI-15-415: (0Day) Borland AccuRev Reprise License Management Server Path Traversal Remote Code Execution Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/WM0upaoUI1c/ *** ZDI-15-414: (0Day) Borland AccuRev Reprise License Server activate_doit Command actserver Parameter Stack Buffer Overflow Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Nr36Je9oEJU/ *** ZDI-15-413: (0Day) Borland AccuRev Reprise License Server diagnostics_doit Command outputfile Parameter File Overwrite Denial of Service Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/fhh7V-Xsyjc/ *** ZDI-15-412: (0Day) Borland AccuRev Reprise License Server activate_doit Command akey Parameter Stack Buffer Overflow Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/q60XWhjbHKo/ *** ZDI-15-411: (0Day) Borland AccuRev SaveContentServiceImpl Servlet Path Traversal Remote File Read And Deletion Vulnerabilities *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/oMSmmw2PaFA/

1 0

Tageszusammenfassung - Mittwoch 2-09-2015
by Daily end-of-shift report 02 Sep '15

02 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 01-09-2015 18:00 − Mittwoch 02-09-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Demystifying File and Folder Permissions *** --------------------------------------------- If you have poked around a server before you have probably encountered file permissions. In fact, all computer file systems offer permissions based on the same core ideas. The file permissions in Linux, Mac, and Windows computers are very similar to the file and folder permissions in Apache, Nginx, and IIS servers. You can right-clickRead More The post Demystifying File and Folder Permissions appeared first on Sucuri Blog. --------------------------------------------- https://blog.sucuri.net/2015/09/demystifying-file-and-folder-permissions.ht… *** Whats the situation this week for Neutrino and Angler EK?, (Wed, Sep 2nd) *** --------------------------------------------- Introduction Last month in mid-August 2015, an actor using Angler exploit kit (EK) switched to Neutrino EK [1]. A few days later, we found that actor using Angler again [2]. This week, were back to seeingNeutrino EK from the same actor. Neutrino EK from this actor is sending TeslaCrypt 2.0 as the payload. We also saw another actor use Angler EK to pushBedep during the same timeframe. Todays diary looks at two infection chains from Tuesday 2015-09-01, one for Angler EK and another for Neutrino. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20101&rss *** Verschlüsselung: Microsoft, Google und Mozilla schalten RC4 2016 ab *** --------------------------------------------- Es ist ein überfälliger Schritt: Microsoft, Google und Mozilla haben angekündigt, den unsicheren Verschlüsselungsalgorithmus RC4 ab 2016 in ihren Produkten endgültig nicht mehr zu verwenden. Ein konkretes Datum nennt bislang jedoch nur Mozilla. --------------------------------------------- http://www.golem.de/news/verschluesselung-microsoft-google-und-mozilla-scha… *** Per Web und USB-Stick: Smart-TVs vielfältig angreifbar *** --------------------------------------------- Mit vergleichsweise simplen Methoden haben Sicherheitsforscher App-Nutzerdaten von Medienabspielern und Smart TVs ausgelesen. Dabei konnten sie auch die Kamera aktivieren und bis auf die Root-Ebene vordringen. --------------------------------------------- http://heise.de/-2797227 *** Router-Lücken: Belkin N600 DB macht es den Hackern einfach *** --------------------------------------------- Die Beschreibung der Lücken in Belkins Heimrouter liest sich wie ein Handbuch mit Negativbeispielen der Firmware-Programmierung. Angreifer können die Nutzer des Routers unter anderem auf beliebige Webseiten umleiten. Abhilfe gibt es nicht. --------------------------------------------- http://heise.de/-2800853 *** IBM: CoreBot malware - simple but dangerous info stealer *** --------------------------------------------- IBMs X-Force research team has uncovered a new piece of data-swiping malware whose modular design allows it to be quickly altered and made even more dangerous. --------------------------------------------- http://www.scmagazine.com/x-force-team-uncovers-data-swiping-malware/articl… *** Factoring RSA Keys With TLS Perfect Forward Secrecy *** --------------------------------------------- What is being disclosed today? Back in 1996, Arjen Lenstra described an attack against an optimization (called the Chinese Remainder Theorem optimization, or RSA-CRT for short). If a fault happened during the computation of a signature (using the RSA-CRT optimization),... --------------------------------------------- https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perf… *** Adware-Installer erschleicht Zugriff auf den Mac-Schlüsselbund *** --------------------------------------------- Ein neuer Adware-Installer nutzt nach Angabe von Sicherheitsforschern einen simplen Trick, um sich ohne weiteres Zutun des Nutzers Zugang zum Schlüsselbund von OS X einzuräumen. --------------------------------------------- http://heise.de/-2802238 *** Cisco NX-OS Malformed ARP Header Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40748 *** VU#903500: Seagate 36C wireless hard-drive contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#903500 Seagate 36C wireless hard-drive contains multiple vulnerabilities Original Release date: 01 Sep 2015 | Last revised: 01 Sep 2015 Overview The Seagate 36C wireless hard-drive contains multiple vulnerabilities. Description CWE-798: Use of Hard-coded Credentials - CVE-2015-2874 The Seagate 36C wireless hard-drive provides undocumented Telnet services accessible by using the default credentials of root as username and the default password.CWE-425: Direct Request --------------------------------------------- http://www.kb.cert.org/vuls/id/903500 *** ZDI-15-408: Hewlett-Packard LoadRunner Controller Scenario File Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability could allow attackers to execute arbitrary code on vulnerable installations of HP LoadRunner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-408/ *** Siemens RUGGEDCOM ROS IP Forwarding Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an IP forwarding vulnerability in older versions of Siemens RUGGEDCOM ROS. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-244-01 *** Edimax BR6228nS/BR6228nC - Multiple vulnerabilities *** --------------------------------------------- Topic: Edimax BR6228nS/BR6228nC - Multiple vulnerabilities Risk: Medium Text:# Title: Edimax BR6228nS/BR6228nC - Multiple vulnerabilities # Date: 01.09.15 # Vendor: edimax.com # Firmware version: 1.22 ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015090013 *** Security Advisory - No Authentication Vulnerability on the Serial Port of the UAP2105 *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [HTB23269]: Cross-Site Request Forgery in Cerb *** --------------------------------------------- Product: Cerb v7.0.3Vulnerability Type: Cross-Site Request Forgery [CWE-352]Risk level: Medium Creater: Webgroup Media LLCAdvisory Publication: August 12, 2015 [without technical details]Public Disclosure: September 2, 2015 CVE Reference: CVE-2015-6545 CVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P) Vulnerability Details: High-Tech Bridge Security Research Lab discovered CSRF vulnerability in Cerb platform, which can be exploited to perform Cross-Site Request Forgery attacks against --------------------------------------------- https://www.htbridge.com/advisory/HTB23269 *** DFN-CERT-2015-1353: Xen: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1353/ *** Bugtraq: ESA-2015-137: EMC Atmos XML External Entity Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536377 *** SiS Windows VGA Display Manager Multiple Privilege Escalation *** --------------------------------------------- Topic: SiS Windows VGA Display Manager Multiple Privilege Escalation Risk: Medium Text:KL-001-2015-003 : SiS Windows VGA Display Manager Multiple Privilege Escalation Title: SiS Windows VGA Display Manager Mult... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015090019 *** XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation *** --------------------------------------------- Topic: XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation Risk: Medium Text:KL-001-2015-004 : XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation Title: XGI Windows VGA Display Manag... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015090018 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects IBM SONAS (CVE-2015-2613) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005343 *** IBM Security Bulletin: HTTP Request smuggling vulnerability may affect IBM HTTP Server (CVE-2015-3183) *** http://www.ibm.com/support/docview.wss?uid=swg21963361 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Tealeaf Customer Experience *** http://www.ibm.com/support/docview.wss?uid=swg21960713 *** IBM Security Bulletin: IBM WebSphere MQ 7.0.1 potential denial of service (CVE-2015-2013) *** http://www.ibm.com/support/docview.wss?uid=swg21962479 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects TS3100/TS3200 (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005368&myns=s034&m… *** IBM Security Bulletin: IBM Maximo Asset Management could allow a local attacker to obtain information due to the autocomplete feature on password input fields (CVE-2015-1933) *** http://www.ibm.com/support/docview.wss?uid=swg21965080 *** IBM Security Bulletin: Default Password Requirements are weak on new installations of IBM Maximo Asset Management (CVE-2015-1934) *** http://www.ibm.com/support/docview.wss?uid=swg21964855 *** Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Flex System Manager (FSM) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098599

1 0

Tageszusammenfassung - Dienstag 1-09-2015
by Daily end-of-shift report 01 Sep '15

01 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 31-08-2015 18:00 − Dienstag 01-09-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** How the SIEM Solution Can Help in Achieving PCI-DSS *** --------------------------------------------- We all know that PCI-DSS is one of the toughest compliances/certifications to hold, but organizations that seek to be PCI-DSS compliant can greatly benefit if they incorporate a SIEM solution around the Card Holder Data Environment (CDE). In this article, we will learn how the SIEM solution can be leveraged to satisfy a majority of... --------------------------------------------- http://resources.infosecinstitute.com/how-the-siem-solution-can-help-in-ach… *** Microsoft accused of adding spy features to Windows 7, 8 *** --------------------------------------------- The privacy impact of Windows telemetry features continues to be scrutinized. --------------------------------------------- http://arstechnica.com/information-technology/2015/08/microsoft-accused-of-… *** ORX Locker, the new Darknet Ransomware-as-a-service platform *** --------------------------------------------- Security experts at Sensecy have uncovered ORX-Locker, a Darknet Ransomware-as-a-service platform that could allow everyone to become a cyber criminal. It is becoming even easier to become a cyber-criminal thanks to the model of sale known as malware-as-a-service that offers off-the-shelf malware for rent or sale. Recently malware authors started to offer also Ransomware-as-a-Service (RaaS), in... --------------------------------------------- http://securityaffairs.co/wordpress/39753/cyber-crime/orx-locker-raas.html 3430 *** l+f: Simuliertes Firmennetz als Spielwiese für Hacker *** --------------------------------------------- Im simulierten Netzwerk des Penetration Test Lab kann man virtuellen Systemen mit echten Pentesting-Tools auf den Zahn fühlen. --------------------------------------------- http://heise.de/-2795897 *** Android: Mehr Smartphones mit vorinstallierter Malware *** --------------------------------------------- Zwischenhändler sollen immer mehr Modelle aus dem Android-Lager vor dem Verkauf manipulieren, indem sie beliebte Apps mit Malware-Komponenten ausstatten und auf den Geräten installieren. --------------------------------------------- http://heise.de/-2794608 *** MassVet finds unknown malicious apps in app stores in 10 Sec *** --------------------------------------------- A group of researchers have developed a method dubbed Mass Vetting (MassVet) to find unknown malicious apps in app stores in 10 Seconds. A group of University researchers has created a new method for detecting malicious apps running on an Android devices called MassVet. MassVet doesn't use the old method of signatures scanning, instead it compares... --------------------------------------------- http://securityaffairs.co/wordpress/39762/malware/massvet-android-scan.html *** iOS-Trojaner ermöglichte Einkauf im App Store mit gehackten Accounts *** --------------------------------------------- Palo Alto Networks hat Details zu der letzte Woche entdeckten Hintertür in mehreren in China verteilten Jailbreak-Apps und Tweaks genannt. Demnach arbeitet die Malware äußerst trickreich. Gestohlen wurden 225.000 iCloud-Accounts. --------------------------------------------- http://heise.de/-2795857 *** Tired of memorizing passwords? A Turing Award winner came up with this algorithmic trick *** --------------------------------------------- Passwords are a bane of life on the Internet, but one Turing Award winner has an algorithmic approach that he thinks can make them not only easier to manage but also more secure.The average user has some 20 passwords today, and in general the easier they are to remember, the less secure they are. When passwords are used across multiple websites, they become even weaker.Manuel Blum, a professor of computer science at Carnegie Mellon University who won the Turing Award in 1995, has been working... --------------------------------------------- http://www.csoonline.com/article/2978170/data-protection/tired-of-memorizin… *** What Can you Learn from Metadata? *** --------------------------------------------- An Australian reporter for the ABC, Will Ockenden published a bunch of his metadata, and asked people to derive various elements of his life. They did pretty well, even though they were amateurs, which should give you some idea what professionals can do.... --------------------------------------------- https://www.schneier.com/blog/archives/2015/09/what_can_you_le.html *** Cisco AsyncOS for Cisco Email Security Appliance and Cisco Web Security Appliance Cluster Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39785 *** Cisco ASR 1000 Series Aggregation Services Routers Data-Plane Processing Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40708 *** DSA-3346 drupal7 - security update *** --------------------------------------------- Several vulnerabilities were discovered in Drupal, a content managementframework: --------------------------------------------- https://www.debian.org/security/2015/dsa-3346 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_gb *** Bugtraq: [security bulletin] HPSBMU03401 rev.1 - HP Operations Manager for UNIX and Linux, Remote Unauthorized Modification, Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/536363 *** Bugtraq: [security bulletin] HPSBGN03403 rev.1 - HP Virtualization Performance Viewer, Remote Unauthorized Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/536364 *** DFN-CERT-2015-1329: MediaWiki: Mehrere Schwachstellen ermöglichen u.a. einen Denial-of-Service-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1329/ *** Security Advisory: Apache HTTP server vulnerability CVE-2008-0455 *** --------------------------------------------- (SOL17201) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/200/sol17201.htm… *** USN-2727-1: GnuTLS vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2727-11st September, 2015gnutls28 vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04SummaryGnuTLS could be made to crash or run programs if it processed a speciallycrafted certificate.Software description gnutls28 - GNU TLS library DetailsIt was discovered that GnuTLS incorrectly handled parsing CRL distributionpoints. A remote attacker could possibly use this issue to cause a denialof service, or execute arbitrary --------------------------------------------- http://www.ubuntu.com/usn/usn-2727-1/ *** USN-2726-1: Expat vulnerability *** --------------------------------------------- Ubuntu Security Notice USN-2726-131st August, 2015expat vulnerabilityA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryExpat could be made to crash or run programs as your login if it opened aspecially crafted file.Software description expat - XML parsing C library DetailsIt was discovered that Expat incorrectly handled malformed XML data. If auser or application linked against Expat were tricked into opening acrafted --------------------------------------------- http://www.ubuntu.com/usn/usn-2726-1/ *** VU#361684: Router devices do not implement sufficient UPnP authentication and security *** --------------------------------------------- Vulnerability Note VU#361684 Router devices do not implement sufficient UPnP authentication and security Original Release date: 31 Aug 2015 | Last revised: 31 Aug 2015 Overview Home routers implementing the UPnP protocol do not sufficiently randomize UUIDs in UPnP control URLs, or implement other UPnP security measures. Description The UPnP protocol allows automatic device discovery and interaction with devices on a network. The UPnP protocol was originally designed with the threat model of --------------------------------------------- http://www.kb.cert.org/vuls/id/361684 *** VU#201168: Belkin N600 DB Wireless Dual Band N+ router contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#201168 Belkin N600 DB Wireless Dual Band N+ router contains multiple vulnerabilities Original Release date: 31 Aug 2015 | Last revised: 31 Aug 2015 Overview Belkin N600 DB Wireless Dual Band N+ router, model F9K1102 v2 with firmware version 2.10.17 and possibly earlier, contains multiple vulnerabilities. Description CWE-330: Use of Insufficiently Random Values - CVE-2015-5987DNS queries originating from the Belkin N600, such as those to resolve the names of firmware --------------------------------------------- http://www.kb.cert.org/vuls/id/201168

1 0

Tageszusammenfassung - Montag 31-08-2015
by Daily end-of-shift report 31 Aug '15

31 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 28-08-2015 18:00 − Montag 31-08-2015 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** OWASP veröffentlicht Handbuch zum Schutz gegen automatisierte Angriffe *** --------------------------------------------- Als Hilfe für das Absichern von Webanwendungen hat die Non-Profit-Organisation OWASP ein Handbuch für Entwickler herausgebracht, das bislang wenig beachtete Angriffe beschreibt. --------------------------------------------- http://heise.de/-2794167 *** Spionage-Trojaner Regin: Symantec entdeckt 49 weitere Module *** --------------------------------------------- Das Sicherheitsunternehmen Symantec hatte Ende des vergangenen Jahres die Ausspähungssoftware "Regin" entdeckt. Nun warten die Experten mit neuen Einzelheiten auf. --------------------------------------------- http://heise.de/-2794176 *** Linux Foundation releases PARANOID internal infosec guide *** --------------------------------------------- Workstation security tips for system administrators. Linux Foundation project director Konstantin Ryabitsev has publicly-released the penguinistas internal hardening requirements to help sysadmins and other paranoid tech bods and system administrators secure their workstations. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/31/harden_like… *** Detecting file changes on Microsoft systems with FCIV, (Mon, Aug 31st) *** --------------------------------------------- Microsoft releases often interesting tools to help system administrators and incident handlers to investigate suspicious activities on Windows systems. In 2012, they released a free tool called FCIV(File Checksum Integrity Verifier)(1). It is a stand alone executable which does not require any DLL or other resources. Just launch it from any location.Its goal is to browse a file system or some directories recursively and to generate MD5/SHA1 hashes of all the files found. The results are saved in a... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20091&rss *** Schwachstellen in Kontrollsoftware von Kraftwerken und Raffinerien *** --------------------------------------------- Siemens und Schneider Electric haben eine Reihe von Lücken in SCADA-Systemen geschlossen. Zum Teil kommt die betroffene Software auch in deutschen Kraftwerken zum Einsatz. --------------------------------------------- http://heise.de/-2794724 *** Security: Standardpasswörter bei Heimroutern entdeckt *** --------------------------------------------- Mindestens fünf Router diverser Hersteller haben leicht zu erratene Standardpasswörter für den administrativen Zugang. Mit ihnen lassen sich die Geräte aus der Ferne manipulieren. --------------------------------------------- http://www.golem.de/news/security-standardpasswoerter-bei-heimroutern-entde… *** Contributor Conference: Owncloud führt Programm für Bug-Bounties ein *** --------------------------------------------- Hacker können nun auch mit der Sicherheitsprüfung von Owncloud Geld verdienen. Die Prämien können sich allerdings noch nicht mit denen von großen Unternehmen wie Google oder Microsoft messen. --------------------------------------------- http://www.golem.de/news/contributor-conference-owncloud-fuehrt-programm-fu… *** Whos afraid of shadow IT? *** --------------------------------------------- One of the biggest disruptions in the IT world is the quantity and quality of SaaS tools. From email and storage, to phone systems and infrastructure, it has never been easier to use top of the range ... --------------------------------------------- http://www.net-security.org/article.php?id=2373 *** KeyRaider Malware Steals Certificates, Keys and Account Data From Jailbroken iPhones *** --------------------------------------------- Researchers have discovered a new strain of iOS malware dubbed KeyRaider that targets jailbroken devices and has the ability to steal certificates, private keys, and Apple account information. The malware already has claimed the private Apple account data of more than 225,000 victims. The KeyRaider malware was discovered by researchers at Palo Alto Networks, who... --------------------------------------------- http://threatpost.com/keyraider-malware-steals-certificates-keys-and-accoun… *** SSD Advisory - AppLock Multiple Vulnerabilities *** --------------------------------------------- The following report describes three ( 3 ) different vulnerabilities found in the AppLock, an Android application, with over 10 Millions of downloads, used to secure pictures, videos and application with a PIN code. --------------------------------------------- https://blogs.securiteam.com/index.php/archives/2558 *** DRDoS, UDP-Based protocols and BitTorrent *** --------------------------------------------- On July 1st, 2015, the security team at BitTorrent received a report [1] from Florian Adamsky about Distributed Reflective Denial of Service (DRDoS) vulnerabilities affecting several BitTorrent products making use of UDP-based [2] protocols. uTorrent, BitTorrent and BitTorrent Sync use the Micro Transport Protocol (µTP) [3] implementation in libuTP [4] as the preferred transport backend running on top of UDP. While these vulnerabilities have been described before in other alerts [5] in... --------------------------------------------- http://engineering.bittorrent.com/2015/08/27/drdos-udp-based-protocols-and-… *** Patch für Schwachstelle in Hewlett Packard lt4112 LTE/HSPA+ Gobi 4G Module (Remote Execution of Arbitrary Code) *** --------------------------------------------- Hewlett Packard hat ein Security Bulletin zu einer Sicherheitslücke im HP lt4112 LTE/HSPA+ Gobi 4G Module veröffentlicht. Die Schwachstelle erlaubt einem entfernten Angreifer das Ausführen beliebigen Codes. Ein Firmware-Update, welches das Problem behebt, ist verfügbar. CVE-Nummern: CVE-2015-5367, CVE-2015-5367 CVSS2 Base Score: 6.9... --------------------------------------------- http://www.cert.at/services/blog/20150831172201-1588.html *** TA15-240A: Controlling Outbound DNS Access *** --------------------------------------------- Original release date: August 28, 2015 Systems Affected Networked systems Overview US-CERT has observed an increase in Domain Name System (DNS) traffic from client systems within internal networks to publically hosted DNS servers. Direct client access to Internet DNS servers, rather than controlled access through enterprise DNS servers, can expose an organization to unnecessary security risks and system inefficiencies. This Alert provides recommendations for improving security related to... --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-240A *** NetIQ Access Manager 4.1 Support Pack 1 Hot Fix 1 4.1.1.1-9 *** --------------------------------------------- Abstract: NetIQ Access Manager 4.1 Support Pack 1 Hot Fix 1 build (version 4.1.1.1-9). This file contains updates for services contained in the NetIQ Access Manager 4.1 product and requires 4.1 SP1 to be installed as a minimum. NetIQ recommends that all customers running Access Manager 4.1 release code apply this patch. The purpose of the patch is to provide a bundle of fixes for security issues that have surfaced since NetIQ Access Manager 4.1 SP1 was released. These fixes include updates to... --------------------------------------------- https://download.novell.com/Download?buildid=ceIVdhBEV2o~ *** Edimax PS-1206MF Web Admin Auth Bypass *** --------------------------------------------- Topic: Edimax PS-1206MF Web Admin Auth Bypass Risk: High Text:# Title: Edimax PS-1206MF - Web Admin Auth Bypass # Date: 30.08.15 # Vendor: edimax.com # Firmware version: 4.8.25 # Author... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080183 *** HPSBMU03416 rev.1 - HP Data Protector, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Data Protector. This is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" also known as "Poodle", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04776510 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Potential Information Disclosure vulnerability could expose user personal data in WebSphere Commerce (CVE-2015-4980) *** http://www.ibm.com/support/docview.wss?uid=swg21965013 *** IBM Security Bulletin: Java CVE-2015-2590 *** http://www.ibm.com/support/docview.wss?uid=nas8N1020888 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Sterling Connect:Direct for HP NonStop (CVE-2015-1792, CVE-2015-1789, CVE-2015-1790) *** http://www.ibm.com/support/docview.wss?uid=swg21963603 *** IBM Security Bulletin: Apache Tomcat Vulnerability in Algo Audit and Compliance (CVE-2014-0230 ) *** http://www.ibm.com/support/docview.wss?uid=swg21963664 *** IBM Security Bulletin: Apache Tomcat vulnerability affects IBM Storwize V7000 Unified (CVE-2014-0230) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005258 *** IBM Security Bulletin: Vulnerability in Rational DOORS Next Generation and Rational Requirements Composer with potential for Cross Site Scripting attack (CVE-2015-1917) *** http://www.ibm.com/support/docview.wss?uid=swg21713610 *** IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM Storwize V7000 Unified (CVE-2013-7423) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005316 *** Security Bulletin: Multiple vulnerabilities in libxml2 affect IBM Flex System Manger (FSM) (CVE-2013-2877, CVE-2014-0191, CVE-2014-3660) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098592 *** Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Flex System Manager (FSM) (Multiple CVEs) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098591 *** WordPress Responsive Thumbnail Slider 1.0 Shell Upload *** --------------------------------------------- Topic: WordPress Responsive Thumbnail Slider 1.0 Shell Upload Risk: High Text:<!-- # Exploit Title: Wordpress Responsive Thumbnail Slider Arbitrary File Upload # Date: 2015/8/29 # Exploit Author: Arash ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080170

1 0

Tageszusammenfassung - Freitag 28-08-2015
by Daily end-of-shift report 28 Aug '15

28 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 27-08-2015 18:00 − Freitag 28-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security Update: Hotfix Available for ColdFusion (APSB15-21) *** --------------------------------------------- A Security Bulletin (APSB15-21) has been published regarding a hotfix for ColdFusion. This hotfix addresses an important vulnerability that could result in information disclosure. Adobe recommends users apply the hotfix using the instructions provided .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1262 *** DSA-3344 php5 - security update *** --------------------------------------------- https://www.debian.org/security/2015/dsa-3344 *** Cisco Identity Services Engine Guest Portal Unauthorized Access Vulnerability *** --------------------------------------------- A vulnerability in the Cisco Identity Services Engine (ISE) guest portal could allow an unauthenticated, remote attacker to view a customized page on the guest portal. The vulnerability is due to lack of access control for the uploaded HTML files. An attacker could exploit this vulnerability .. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40691 *** BitTorrent kills bug that turns networks into a website-slaying weapon *** --------------------------------------------- Reflective technique would let attacker amplify traffic and flood targets BitTorrent has fixed a flaw in its technology that quietly turns file-sharing networks into weapons .. --------------------------------------------- www.theregister.co.uk/2015/08/28/bittorrent_blasts_bug/ *** Google makes it official: Chrome will freeze Flash ads on sight from Sept 1 *** --------------------------------------------- Browser to make most stuff click-to-play by default Google is making good on its promise to strangle Adobe Flashs ability to .. --------------------------------------------- www.theregister.co.uk/2015/08/28/google_says_flash_ads_out_september/ *** BSI warnt vor Risiko bei Intels Fernwartungstechnik AMT *** --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnik rät dazu, die Konfiguration von Notebooks und Desktop-PCs mit Intels Active Management Technology zu prüfen: Bei manchen .. --------------------------------------------- http://heise.de/-2792791 *** Business Email Scams: A Growing Threat *** --------------------------------------------- Business Email Scams: is that email from the CEO asking for a wire transfer the real deal? Learn to spot .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/08/business-email-scams-… *** Moxa SoftCMS Buffer Overflow Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for buffer overflow vulnerabilities in the Moxa SoftCMS software package. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-239-01 *** Siemens SIMATIC S7-1200 CSRF Vulnerability *** --------------------------------------------- This advisory provides mitigation details for Cross-Site Request Forgery vulnerability in the SIMATIC S7 1200 CPUs. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-239-02 *** Innominate mGuard VPN Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a denial-of-service vulnerability in the Innominate mGuard device --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-239-03 *** This PUP Alerts You of a Zombie Invasion *** --------------------------------------------- Apps are constantly created to address certain needs. The more helpful an app claims to be, especially in times of crisis, the more users would likely take interest in .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/08/draft-this-pup-alerts… *** Fake EFF site serving espionage malware was likely active for 3+ weeks *** --------------------------------------------- A spear-phishing campaign some researchers say is linked to the Russian government masqueraded as the Electronic Frontier Foundation in an attempt to infect targets with malware .. --------------------------------------------- http://arstechnica.com/security/2015/08/fake-eff-site-serving-espionage-mal…

1 0

Tageszusammenfassung - Donnerstag 27-08-2015
by Daily end-of-shift report 27 Aug '15

27 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 26-08-2015 18:00 − Donnerstag 27-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Paper: Not a GAMe maKER *** --------------------------------------------- Raul Alvarez performs low-level analysis of information-stealing trojan.The Gamker information-stealing trojan (also known as Shiz) has been around for a few years. It made the news back in 2013 when it was found to target SAP .. --------------------------------------------- http://www.virusbtn.com/blog/2015/08_26.xml *** Patched Ins0mnia Vulnerability Keeps Malicious iOS Apps Hidden *** --------------------------------------------- Apple's monster security update of Aug. 13 included a patch for an iOS vulnerability that could beacon out location data and other personal information from a device, even if a .. --------------------------------------------- http://threatpost.com/patched-ins0mnia-vulnerability-keeps-malicious-ios-ap… *** Concerns new Tor weakness is being exploited prompt dark market shutdown *** --------------------------------------------- A dark market website that relies on the Tor privacy network to keep its operators anonymous is temporarily shutting down amid concerns attackers are exploiting a newly reported weakness .. --------------------------------------------- http://arstechnica.com/security/2015/08/concerns-new-tor-weakness-is-being-… *** Cisco ACE 4710 Application Control Engine CLI Privilege Escalation Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40666 *** PDF + maldoc1 = maldoc2 *** --------------------------------------------- I received another example of a PDF file that contains a malicious MS Office document. Sample (MD5 0c044fd59cc6ccc28a48937bc69cc0c4). This time I want to focus on the analysis of such a sample. First we run pdfid to identify the sample. It contains .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20079 *** Taking root *** --------------------------------------------- We analyzed the statistics we had collected from May to August 2015 and identified three main Trojan families that use root privileges on the device to achieve their goals. --------------------------------------------- http://securelist.com/blog/mobile/71981/taking-root/ *** Throwback Thursday: Safe Hex in the 21st Century *** --------------------------------------------- This Throwback Thursday, we turn the clock back to July 2000, when we were already being warned that virus scanners were no longer enough.How many times have we heard commentators claim that anti-virus is dead? After all, in the current .. --------------------------------------------- http://www.virusbtn.com/blog/2015/08_27.xml *** Phisher greifen iranische Aktivisten an, umgehen Googles Multifaktor-Anmeldung *** --------------------------------------------- Eine Serie von Phishing-Angriffen hat es anscheinend auf iranische Aktivisten und Dissidenten abgesehen. Auch eine hochrangige Mitarbeiterin der EFF wurde angegriffen. --------------------------------------------- http://heise.de/-2792580 *** Important Notice Regarding Public Availability of Stable Patches *** --------------------------------------------- Grsecurity has existed for over 14 years now. During this time it has been the premier solution for hardening Linux against security exploits and served as a role model for many mainstream commercial applications elsewhere. All modern OSes took our lead and implemented to varying degrees a number of security .. --------------------------------------------- https://grsecurity.net/announce.php *** Angler Exploit Kit Strikes on MSN.com via Malvertising Campaign *** --------------------------------------------- The same actors behind the recent Yahoo and Azure malvertising attacks went after MSN.com this time. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/08/angler-exploit-kit-str…

1 0

Tageszusammenfassung - Mittwoch 26-08-2015
by Daily end-of-shift report 26 Aug '15

26 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 25-08-2015 18:00 − Mittwoch 26-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Windows 10^H^H Symbolic Link Mitigations *** --------------------------------------------- For the past couple of years I've been researching Windows elevation of privilege attacks. This might be escaping sandboxing or gaining system privileges. One of the techniques I've used multiple times is abusing the symbolic link facilities of the Windows operating system to redirect privileged code to create .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/windows-10hh-symbolic-link-mi… *** VB2015 preview: advanced persistent threats *** --------------------------------------------- There was a time when analyses of malware and viruses at the Virus Bulletin conference used the number of infections as a measure of the harm done. And while there are still many talks on what is now referred to as opportunistic malware, targeted .. --------------------------------------------- http://www.virusbtn.com/blog/2015/08_25.xml *** Dropbox Phishing via Compromised Wordpress Site, (Tue, Aug 25th) *** --------------------------------------------- I got a couple of emails today notifying me of a Compulsory Email Account Update for my Dropbox account. The e-mails do overall mimic the Dropbox look and feel, and use dropbox(a)smtp.com .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20073 *** Cisco TelePresence Video Communication Server Expressway TFTP Information Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40620 *** FunWebProducts UserAgent Bloating Traffic *** --------------------------------------------- Every once in a while we get a case that makes us dig deep to find answers. We have spoken before about the trouble with forensics and reasons why websites get hacked. Sometimes though, the answer is not clear and we can only gather clues to make .. --------------------------------------------- https://blog.sucuri.net/2015/08/funwebproducts-useragent-bloating-traffic.h… *** Actor that tried Neutrino exploit kit now back to Angler *** --------------------------------------------- Last week, we saw the group behind a significant amount of Angler exploit kit (EK) switch to Neutrino EK. We didnt know if the change was permanent, and I also noted that criminal groups using EKs have quickly changed tactics .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20075 *** l+f: https-fuer-Fortgeschrittene *** --------------------------------------------- Googles Chrome und die Open-Source-Basis Chromium laden eine Reihe von Web-Seiten immer via gesichertem HTTPS - darunter auch viele deutsche. --------------------------------------------- http://heise.de/-2790788 *** Endress+Hauser HART Device DTM Vulnerability *** --------------------------------------------- Alexander Bolshev and Svetlana Cherkasova of Digital Security have identified an improper input vulnerability in the CodeWrights GmbH HART Device Type Manager (DTM) library used in Endress+Hauser HART Device DTM. CodeWrights GmbH has addressed the vulnerability with a new library, which Endress+Hauser has begun to integrate. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-237-01 *** Dynamic DNS and You Part 2: Identifying the Threat *** --------------------------------------------- Greetings! You all really seemed to like my last post on Dynamic DNS, so Ive been invited to come back and talk more about it. In part 1 , we discussed the uses of Dynamic DNS, as well as the various providers of the service and how it all .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/dynamic-dns-and-you-pa… *** Netflix Is Dumping Anti-Virus, Presages Death Of An Industry *** --------------------------------------------- For years, nails have been hammering down on the coffin of anti-virus. But none have really put the beast to bed. An industry founded in the 1980s, a time when John McAfee was known as a pioneer rather than a tequila-downing rascal, .. --------------------------------------------- http://www.forbes.com/sites/thomasbrewster/2015/08/26/netflix-and-death-of-… *** CryptoGirl on StageFright: A Detailed Explanation *** --------------------------------------------- Detecting the PoCs published by Zimperium is not difficult: you can fingerprint the PoCs, for example. Detecting variants of the PoCs, i.e., MP4s that use one of the discovered vulnerabilities, is far more difficult. Ill explain why in a .. --------------------------------------------- http://blog.fortinet.com/post/cryptogirl-on-stagefright-a-detailed-explanat…

1 0

Tageszusammenfassung - Dienstag 25-08-2015
by Daily end-of-shift report 25 Aug '15

25 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 24-08-2015 18:00 − Dienstag 25-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Signed Dridex Campaign *** --------------------------------------------- Malware authors use various means to make their malware look similar to legitimate software. One such approach involves signing a malware sample with a digital certificate. Recently we saw Dridex malware authors using this technique while .. --------------------------------------------- http://research.zscaler.com/2015/08/signed-dridex-campaign.htm *** AlienSpy RAT Resurfaces as JSocket *** --------------------------------------------- The dismantled AlientSpy remote access Trojan, the same malware found on the phone of dead Argentine prosecutor Alberto Nisman, has resurfaced with new crypto and a new name. --------------------------------------------- http://threatpost.com/alienspy-rat-resurfaces-as-jsocket/114385 *** Cisco Prime Infrastructure Web Interface Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40652 *** RTF Exploit Installs Italian RAT: uWarrior *** --------------------------------------------- Unit 42 researchers have observed a new Remote Access Tool (RAT) constructed by an unknown actor of Italian origin. This RAT, referred to as uWarrior because of embedded PDB strings, has been previously described .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/08/rtf-exploit-installs-ita… *** Multiple vulnerabilities in Hewlett-Packard KeyView IDOL *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-405 http://www.zerodayinitiative.com/advisories/ZDI-15-404 http://www.zerodayinitiative.com/advisories/ZDI-15-403 http://www.zerodayinitiative.com/advisories/ZDI-15-402 http://www.zerodayinitiative.com/advisories/ZDI-15-401 http://www.zerodayinitiative.com/advisories/ZDI-15-400 http://www.zerodayinitiative.com/advisories/ZDI-15-399 http://www.zerodayinitiative.com/advisories/ZDI-15-398 http://www.zerodayinitiative.com/advisories/ZDI-15-397 *** Ask Sucuri: How Did My WordPress Website Get Hacked? *** --------------------------------------------- With the proliferation of Infrastructure and Platform as a Service providers, it is no surprise that a majority of today's websites are hosting in the proverbial cloud. This is great because it allows organizations and individuals alike to quickly deploy their websites, with relatively little overhead .. --------------------------------------------- https://blog.sucuri.net/2015/08/ask-sucuri-how-did-my-wordpress-website-get… *** What I learned from cracking 4000 Ashley Madison passwords *** --------------------------------------------- When the Ashley Madison database first got dumped, there was an interesting contingent of researchers talking about how pointless it would be to crack the passwords, .. --------------------------------------------- http://www.pxdojo.net/2015/08/what-i-learned-from-cracking-4000.html *** Browsefox variant High Stairs *** --------------------------------------------- https://blog.malwarebytes.org/security-threat/2015/08/browsefox-variant-hig… *** Datenschutz: Ashley Madison wusste von gravierenden Sicherheitsmängeln *** --------------------------------------------- Einige Wochen vor dem Angriff des Impact Teams warnten interne Sicherheitsexperten vor gravierenden Mängeln in der Infrastruktur der Webseite. --------------------------------------------- http://www.golem.de/news/datenschutz-ashley-madison-wusste-von-gravierenden… *** Ashley Madison: Gehackte Seitensprung-Site hackte eigene Konkurrenz *** --------------------------------------------- Die Dating-Webseite, die vor kurzem Opfer eines Hacker-Angriffs und Datenleck wurde, hat vor einigen Jahren selbst eine Konkurrenzplattform angegriffen. Dabei soll der Technikchef von Ashley Madison die Datenbank der Konkurrenz kopiert haben. --------------------------------------------- http://heise.de/-2790189 *** Are Data Breaches Getting Larger? *** --------------------------------------------- This research says that data breaches are not getting larger over time. "Hype and Heavy Tails: A Closer Look at Data Breaches," by Benjamin Edwards, Steven Hofmeyr, and Stephanie Forrest: Abstract: Recent widely publicized data breaches have .. --------------------------------------------- https://www.schneier.com/blog/archives/2015/08/are_data_breach.html *** You are the weakest link - goodbye! *** --------------------------------------------- On my first visit to Team Cymru's HQ in Lake Mary, Florida, I found myself reading the wall hangings and looking at the pictures depicting specific times in history. Many of them depicting the inspiring words of leaders such as Churchill. It lead me to think about the many lessons that can we learn from .. --------------------------------------------- https://blog.team-cymru.org/2015/08/you-are-the-weakest-link-goodbye/ *** Github Mitigates DDoS Attack *** --------------------------------------------- Github said it turned back a distributed denial of service attack; it's unknown whether this attack is related to a similar attack this March. --------------------------------------------- http://threatpost.com/github-mitigates-ddos-attack/114403 *** Gehackter Samsung-Kühlschrank verrät Gmail-Anmeldedaten *** --------------------------------------------- Auf der Hackerkonferenz DEFCON wurde eine Methode präsentiert, mit der ein Kühlschrank-Modell von Samsung dazu gebracht werden kann, Gmail-Log-ins zu verraten. --------------------------------------------- http://futurezone.at/digital-life/gehackter-samsung-kuehlschrank-verraet-gm… *** Certifi-Gate: Missbräuchliche App im Google Play Store entdeckt *** --------------------------------------------- Sicherheitsforscher präsentierten vor wenigen Wochen eine Schwachstelle, die Fernverwaltungs-Software wie Teamviewer betrifft. Im Nachgang fanden die Forscher eine App in Googles Play Store, die genau diese Schwäche ausnutzt. --------------------------------------------- http://heise.de/-2790706

1 0

Tageszusammenfassung - Montag 24-08-2015
by Daily end-of-shift report 24 Aug '15

24 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 21-08-2015 18:00 − Montag 24-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Extortionists Target Ashley Madison Users *** --------------------------------------------- People who cheat on their partners are always open to extortion by the parties involved. But when the personal details of millions of cheaters gets posted online for anyone to download - as is the case with the recent hack of infidelity hookup .. --------------------------------------------- http://krebsonsecurity.com/2015/08/extortionists-target-ashley-madison-user… *** Exploring a 'Malwarebytes Anti-Malware for Windows 10 - website' *** --------------------------------------------- Here at Malwarebytes, we offer support for a wide variety of Windows Operating Systems - from XP right up to Windows 10. The latter OS is the starting point for this blog post, with a website located .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/08/exploring-an-mbam-for… *** One font vulnerability to rule them all #4: Windows 8.1 64-bit sandbox escape exploitation *** --------------------------------------------- This is the final part #4 of the 'One font vulnerability to rule them all' blog post series. In the previous posts, we introduced the 'blend' PostScript operator vulnerability and successfully used it to first exploit Adobe Reader, and later escape .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/one-font-vulnerability-to-rul… *** Cisco Wireless LAN Controller IPv6 IAPP WIPS Report Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40586 *** BSI: Richtlinie für sicheren Mail-Transport zeigt bereits Wirkung *** --------------------------------------------- Mit dem Erscheinen der Richtlinie wird leichter verständlich, weshalb Web.de und GMX nicht nur die PGP-Verschlüsselung für Mails eingeführt haben, sondern überraschend auch auf die Sicherheitstechniken DNSSEC und DANE setzen. --------------------------------------------- http://heise.de/-2788316 *** MMD-0039-2015 - ChinaZ made new malware: ELF Linux/BillGates.Lite *** --------------------------------------------- There are tweets I posted which is related to this topic, Our team spotted the sample a week ago. And this post is the promised details, I am sorry for the delay for limited resource that we have since for a week I focused to help .. --------------------------------------------- http://blog.malwaremustdie.org/2015/08/mmd-0039-2015-chinaz-made-new-malwar… *** Google Analyticator <= 6.4.9.4 - Multiple Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8159 *** Sending Windows Event Logs to Logstash *** --------------------------------------------- This topic is not brand new, there exists plenty of solutions to forward Windows event logs to Logstash (OSSEC, Snare or NXlog amongst many others). They perform a decent job to collect events on running systems .. --------------------------------------------- https://blog.rootshell.be/2015/08/24/sending-windows-event-logs-to-logstash/ *** Mass FTP Crawling *** --------------------------------------------- The combination of interesting files one can find on public FTP servers plus the technical expertise required to make a decent search engine motivated me to write Findex and ultimately this article. --------------------------------------------- http://findex.cedsys.nl/research/mass-ftp-crawling/ *** Bundestags-IT nach Reparatur wieder online *** --------------------------------------------- Das IT-System des Deutschen Bundestags ist nach mehrtägigen Reparaturarbeiten am Montag wieder hochgefahren worden. Nach Behebung der Folgen eines Hackerangriffs ging das System wieder ans Netz, wie eine Parlamentssprecherin bestätigte. Die Abgeordneten und Mitarbeiter wurden demnach per Lautsprecher am Montagvormittag über den Neustart des Systems informiert. --------------------------------------------- http://derstandard.at/2000021189218 *** Compromising a honeypot network through the Kippo password when logstash exec is used *** --------------------------------------------- We have been playing with Honeypots lately (shoutout to Theo and Sebastian for adding their honeypots to the network), collecting and visualizing the data from the honeypots is done .. --------------------------------------------- https://forsec.nl/2015/08/compromising-a-honeypot-network-through-the-kippo… *** Exploiting the Mercury Browser for Android *** --------------------------------------------- The Mercury Browser for Android suffers from an insecure Intent URI scheme implementation and a path traversal vulnerability within a custom web server used to support its WiFi Transfer feature. Chaining these vulnerabilities together can allow a .. --------------------------------------------- http://rotlogix.com/2015/08/23/exploiting-the-mercury-browser-for-android/ *** Username Enumeration against OpenSSH/SELinux with CVE-2015-3238 *** --------------------------------------------- I recently disclosed a low-risk vulnerability in Linux-PAM versions prior to 1.2.1 which allows attackers to conduct username enumeration and denial of service attacks. The purpose of this post is to provide more technical details around this vulnerability. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Username-Enumeration-ag…

1 0

Tageszusammenfassung - Freitag 21-08-2015
by Daily end-of-shift report 21 Aug '15

21 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 20-08-2015 18:00 − Freitag 21-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Top 3 biggest mistakes enterprises make in application security *** --------------------------------------------- Enterprise information security encompasses a broad set of disciplines and technologies, but at the highest level it can be broken down into three main categories: network security, endpoint security ... --------------------------------------------- http://www.net-security.org/article.php?id=2362 *** Apple Patches QuickTime Crash and Code Execution Flaws *** --------------------------------------------- Apple pushed out a new version of QuickTime that patched nine vulnerabilities, including a handful of denial of service and code execution bugs. --------------------------------------------- http://threatpost.com/apple-patches-quicktime-crash-and-code-execution-flaw… *** Security Awareness for Managers: Protecting Yourself and Your Company *** --------------------------------------------- Nowadays, security awareness training (SAT) is a top priority for organizations of any sizes. Thanks to SAT, management and employees can understand IT governance issues and control solutions as well as recognize concerns, understand their relevance and respond accordingly. Many companies invest heavily in cybersecurity education programs for employees to learn how to protect their... --------------------------------------------- http://resources.infosecinstitute.com/security-awareness-for-managers-prote… *** WordPress Compromises Behind Spike in Neutrino EK Traffic *** --------------------------------------------- A rash of compromised WordPress websites is behind this week's surge in Neutrino Exploit Kit traffic --------------------------------------------- http://threatpost.com/wordpress-compromises-behind-spike-in-neutrino-ek-tra… *** National Cyber Security Strategies: the latest news *** --------------------------------------------- http://www.enisa.europa.eu/media/news-items/national-cyber-security-strateg… *** APPLE-SA-2015-08-20-1 QuickTime 7.7.8 *** --------------------------------------------- APPLE-SA-2015-08-20-1 QuickTime 7.7.8QuickTime 7.7.8 is now available and addresses the following:QuickTimeAvailable for: Windows 7 and Windows VistaImpact: Processing a maliciously crafted file may lead to anunexpected application termination or arbitrary code execution [...] --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/Aug/msg00004.ht… *** ZDI-15-395: Foxit Reader GIF Conversion Heap Corruption Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-395/ *** ZDI-15-396: ManageEngine Service Desk File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine ServiceDesk. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-396/ *** Splunk Input Validation Flaw in Splunk Web Lets Remote Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1033339 *** Bugtraq: ESA-2015-132: EMC Documentum D2 Fail Open Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536278 *** Bugtraq: [oCERT-2015-009] VLC arbitrary pointer dereference *** --------------------------------------------- http://www.securityfocus.com/archive/1/536287

1 0

Tageszusammenfassung - Donnerstag 20-08-2015
by Daily end-of-shift report 20 Aug '15

20 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 19-08-2015 18:00 − Donnerstag 20-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Inside the Unpatched OS X Vulnerabilities *** --------------------------------------------- Italian researcher Luca Todesco explains how exploiting two vulnerabilities in OS X gain enable root access for a hacker. He wont, however, say why he went public with details and exploit code before Apple patched. --------------------------------------------- http://threatpost.com/inside-the-unpatched-os-x-vulnerabilities/114344 *** Three bypasses and a fix for one of Flashs Vector. mitigations *** --------------------------------------------- Posted by Chris Evans, Cookie MonsterWith the release of Flash 18.0.0.209, two mitigations were introduced to combat abuse of Vector corruptions -- we covered these in a previous blog post. Flash 18.0.0.232 has just been released and it includes a change to the way one of the mitigations is implemented, to address Project Zero bug 482.This blog post notes some ways to bypass the way Adobe implemented the Vector. length checking mitigation. They are already fixed. It's not uncommon for new... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/three-bypasses-and-fix-for-on… *** AdBlocker Plus exploit puts OSX users at risk *** --------------------------------------------- A visit to the Apple store will give any consumer a false sense of security, you will be told that by buying a Mac you are safe from threats and malware. I have... --------------------------------------------- http://www.webroot.com/blog/2015/08/19/adblocker-plus-puts-osx-at-risk/ *** Evaluating the security of open source software *** --------------------------------------------- The Core Infrastructure Initiative (CII), a project managed by The Linux Foundation, is developing a new free Badge Program, seeking input from the open source community on the criteria to be used to ... --------------------------------------------- http://www.net-security.org/secworld.php?id=18786 *** A light-weight forensic analysis of the AshleyMadison Hack *** --------------------------------------------- So Ashley Madison(AM) got hacked, it was first announced about a month ago and the attackers claimed theyd drop the full monty of user data if the AM website did not cease operations. The AM parent company Avid Life Media(ALM) did not cease business operations for the site and true to their word; the attackers seemed of have leaked everything they promised on August 18th 2015 including:... --------------------------------------------- http://blog.includesecurity.com/2015/08/forensic-analysis-of-the-AshleyMadi… *** Popular Tools for Brute-force Attacks *** --------------------------------------------- The brute-force attack is still one of the most popular password cracking methods. Nevertheless, it is not just for password cracking. Brute-force attacks can also be used to discover hidden pages and content in a web application. This attack is basically "a hit and try" until you succeed. This attack sometimes takes longer, but its... --------------------------------------------- http://resources.infosecinstitute.com/popular-tools-for-brute-force-attacks/ *** Web.de und GMX führen PGP-Verschlüsselung für Mail ein *** --------------------------------------------- Sehr einfach zu bedienen, aber dennoch sicher soll die PGP-Erweiterung der Mail-Dienste von Web.de und GMX sein, die sich per Web-Oberfläche und Mobil-Apps nutzen lässt. --------------------------------------------- http://heise.de/-2786133 *** Yet another Android security flaw: This time EVERYTHING is affected *** --------------------------------------------- Multitasking security flap places entire user base at risk of neer-do-well activity Security researchers have discovered yet another source of security flaws in Android. This time the problem affects the mobile operating systems multitasking functionality rather than the handling of multimedia messages, the crux of a cyber of recent vulnerabilities* including the infamous Stagefright flaw. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/20/android_mul… *** [R1] Apache Vulnerabilities Affects Tenable SecurityCenter *** --------------------------------------------- http://www.tenable.com/security/tns-2015-11 *** Cisco Aggregation Services Router ASR 5000 and ASR 5500 OSPF Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40585 *** VU#276148: Dedicated Micros DVR products use plaintext protocols and require no password by default *** --------------------------------------------- Vulnerability Note VU#276148 Dedicated Micros DVR products use plaintext protocols and require no password by default Original Release date: 20 Aug 2015 | Last revised: 20 Aug 2015 Overview Dedicated Micros DVR products, including the DV-IP Express, SD Advanced, SD, EcoSense, and DS2, by default use plaintext protocols and require no password. Description CWE-311: Missing Encryption of Sensitive DataDedicated Micros DVR products by default use HTTP, telnet, and FTP rather than secure --------------------------------------------- http://www.kb.cert.org/vuls/id/276148 *** Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2015-003 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CORE-2015-003Project: Drupal core Version: 6.x, 7.xDate: 2015-August-19Security risk: 18/25 ( Critical) AC:Complex/A:User/CI:All/II:All/E:Proof/TD:AllVulnerability: Cross Site Scripting, Access bypass, SQL Injection, Open Redirect, Multiple vulnerabilitiesThis security advisory fixes multiple vulnerabilities. See below for a list.Cross-site Scripting - Ajax system - Drupal 7A vulnerability was found that allows a malicious user to perform a cross-site scripting attack by --------------------------------------------- https://www.drupal.org/SA-CORE-2015-003

1 0

Tageszusammenfassung - Mittwoch 19-08-2015
by Daily end-of-shift report 19 Aug '15

19 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 18-08-2015 18:00 − Mittwoch 19-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** SANS Incident Response Survey 2015 Infographic *** --------------------------------------------- So, you have a security policy, a blue team tasked with protecting your organization and an incident response plan. What happens when the inevitable occurs - you are attacked? SANS just released their 2015 Incident Response survey, summarizing results from 507 survey respondents who shared the top attack types they are seeing, and what is (and it not) working today in terms of incident response. The good news: malware, data breaches and Advanced Persistent Threats (APT's) were all... --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/sans-incident-response… *** Who should be responsible for IT security? *** --------------------------------------------- Hot potato, or hot job? Typically, when a cybersecurity problem arises, it's the IT department that gets it in the neck. Ostensibly, that makes sense. After all, if someone is in your network mining your database for corporate secrets, it's hardly the office manager or the accounts receivable department's lookout, right? --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/18/responsibil… *** Kehrtwende bei Mail-Sicherheit: Web.de und GMX führen DANE ein *** --------------------------------------------- Mit seinen beiden Diensten gehört United Internet zu den Gründern der Initiative "E-Mail made in Germany", die ein eigenes Verfahren für die Absicherung des Mail-Transports einsetzt. Dennoch soll nun die moderne DANE-Technik hinzukommen. --------------------------------------------- http://heise.de/-2782473 *** Später lesen: Schwerwiegende Backend-Lücken in Pocket nachgewiesen *** --------------------------------------------- Ohne viel Aufwand hat ein Sicherheitsforscher auf die Backend-Infrastruktur von Pocket zugreifen können. Die Fehler sind zwar inzwischen behoben, dem Streit um die Aufnahme der App zum späteren Lesen in den Firefox-Browser könnte dies aber neuen Anschub geben. --------------------------------------------- http://www.golem.de/news/spaeter-lesen-schwerwiegende-backend-luecken-in-po… *** Outsourcing critical infrastructure (such as DNS), (Wed, Aug 19th) *** --------------------------------------------- Migrating everything to cloud or various online services is becoming increasingly popular in last couple of years (and will probably not stop). However, leaving our most valuable jewels with someone else makes a lot of security people (me included) nervous. During some of the latest external penetration tests I noticed an increasing trend of companies moving some of their services to various cloud solutions or to their providers.target.com. IN ANSWER SECTION: target.com. 1365 IN NS --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20057&rss *** IE Bug Exploited In Wild After Microsoft Releases Out-Of-Band Patch *** --------------------------------------------- Remote code execution vulnerability in Internet Explorer versions 7 through 11 being used to drop PlugX RAT. --------------------------------------------- http://www.darkreading.com/attacks-breaches/ie-bug-exploited-in-wild-after-… *** MS15-093 - Critical: Security Update for Internet Explorer (3088903) - Version: 1.0 *** --------------------------------------------- This security update resolves a vulnerability in Internet Explorer. The vulnerability could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-093 *** Security Hotfix Available for LiveCycle Data Services (APSB15-20) *** --------------------------------------------- A Security Bulletin (APSB15-20) has been published regarding a hotfix for LiveCycle DS. This hotfix addresses an important vulnerability that could result in information disclosure. Adobe recommends users apply the hotfix using the instructions provided in the "Solution" section of the Security Bulletin. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1259 *** Fortinet FortiGate/FortiOS MAC Authentication Flaw Lets Remote Users Modify Data on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033256 *** Security Notice - Statement on "Fingerprints on Mobile Devices: Abusing and Leaking" at the Black Hat Conference *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** DSA-3337 gdk-pixbuf - security update *** --------------------------------------------- Gustavo Grieco discovered a heap overflow in the processing of BMP imageswhich may result in the execution of arbitrary code if a malformed imageis opened. --------------------------------------------- https://www.debian.org/security/2015/dsa-3337 *** Security Advisory: ICMP packet processing vulnerability CVE-2015-5058 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/000/sol17047.htm… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime and IBM WebSphere Application Server Liberty Profile affect WebSphere Appliance Management Center *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21963684 *** IBM Security Bulletin: Websphere Message Broker and IBM Integration Bus are affected by access control vulnerability (CVE-2015-2018) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21961734 *** Security Bulletin: Vulnerabilities in SSLv3 and GNU C library (glibc) affect multiple products shipped with Intelligent Cluster (CVE-2014-3566, CVE-2015-0235) *** --------------------------------------------- http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098516 *** Cisco TelePresence Video Communication Server Expressway Command Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40522 *** Cisco Unified Interaction Manager Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40555 *** Cisco TelePresence Video Communication Server Expressway Arbitrary File Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40518 *** Multiple Cisco Finesse Cross-Site Scripting Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40436

1 0

Tageszusammenfassung - Dienstag 18-08-2015
by Daily end-of-shift report 18 Aug '15

18 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 17-08-2015 18:00 − Dienstag 18-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Attacking ECMAScript Engines with Redefinition *** --------------------------------------------- Posted by Natalie Silvanovich = function () { return n; }ECMAScript has a property where almost all functions and variables can be dynamically redefined. This can lead to vulnerabilities in situations where native code assumes a function or variable behaves a certain way when accessed or does not have certain side effects when it can in fact be redefined. Project Zero has discovered 24 vulnerabilities involving ECMAScript redefinition in Adobe Flash in the past few months and similar issues... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/attacking-ecmascript-engines-… *** Tool Tip: Kansa Stafford released, PowerShell for DFIR, (Mon, Aug 17th) *** --------------------------------------------- In his most recent post, Guy asked Are You a Hunter?. Heres one way to become one. Dave Hull has just published the Stafford release of his exemplary PowerShell DFIR tool, Kansa. For the uninitiated, Kansa is amodular incident response framework in Powershell.(PS v3 or higher preferred)that uses Powershell Remoting to run user contributed modules across hosts in an enterprise to collect data for use during incident response, breach hunts, or for building an environmental baseline. Per Daves... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20049&rss *** Risky Schneider Electric SCADA Vulnerabilities Remain Unpatched *** --------------------------------------------- Vulnerabilities in Schneider Electric SCADA gear remain unpatched close to two weeks after they were disclosed during DEF CON. --------------------------------------------- http://threatpost.com/risky-schneider-electric-scada-vulnerabilities-remain… *** Ransomware goes OPEN SOURCE in the name of education *** --------------------------------------------- Won't somebody think of the script kiddies? Turkish security bod Utku Sen has published what appears to be the first open source ransomware that anyone to download and spread. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/18/ransomware_… *** How Not to Start an Encryption Company *** --------------------------------------------- Probably the quickest way for a security company to prompt an overwhelmingly hostile response from the security research community is to claim that its products and services are "unbreakable" by hackers. The second-fastest way to achieve that outcome is to have that statement come from an encryption company CEO who served several years in federal prison for running a $210 million Ponzi scheme. Heres the story of a company that managed to accomplish both at the same time and is now... --------------------------------------------- http://krebsonsecurity.com/2015/08/how-not-to-start-an-encryption-company/ *** Sicherheitsrisiko Mainframe: Großrechner aus dem Internet erreichbar *** --------------------------------------------- Ein Sicherheitsforscher warnt, dass Mainframes zu einem leichten Angriffsziel werden könnten. --------------------------------------------- http://www.heise.de/newsticker/meldung/Sicherheitsrisiko-Mainframe-Grossrec… *** 1&1, GMX und Web.de: Millionen E-Mail-Postfächer waren angreifbar *** --------------------------------------------- Bei den E-Mail-Anbietern 1&1, Gmx und Web.de klaffte bis vor wenigen Tagen eine Sicherheitslücke, über die Angreifer unter bestimmten Umständen Zugriff auf fremde Konten bekommen konnten. --------------------------------------------- http://heise.de/-2782618 *** When You Can't ARPSpoof *** --------------------------------------------- There are times during a penetration test when you are having difficulty gaining the credentials you want from a host that has already been compromised. You have successfully socially engineered a system administrator or other user with privileges to a web application and you have established a meterpreter shell. You can dump the password hashes... --------------------------------------------- http://resources.infosecinstitute.com/when-you-cant-arpspoof/ *** Reflection DDoS Attacks Abusing RPC Portmapper *** --------------------------------------------- Level 3 Communications has discovered a new type of reflection DDoS attack that takes advantage of RPC Portmapper to overwhelm networking services. --------------------------------------------- http://threatpost.com/reflection-ddos-attacks-abusing-rpc-portmapper/114318 *** SAP Afaria 7 Buffer Overflow *** --------------------------------------------- Topic: SAP Afaria 7 Buffer Overflow Risk: High Text:Application: SAP Afaria 7 Versions Affected: SAP Afaria 7, probably others Vendor URL: http://SAP.com Bugs: Buffer Overflow ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080088 *** DSA-3336 nss - security update *** --------------------------------------------- Several vulnerabilities have been discovered in nss, the Mozilla NetworkSecurity Service library. The Common Vulnerabilities and Exposures projectidentifies the following problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3336 *** Bugtraq: EMC Documentum Content Server: arbitrary code execution (incomplete fix in CVE-2015-4532) *** --------------------------------------------- http://www.securityfocus.com/archive/1/536244 *** ZDI-15-393: Foxit Reader TIFF Conversion Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-393/ *** GnuTLS ServerKeyExchange Validation Flaw May Let Remote Users Forge Signatures *** --------------------------------------------- http://www.securitytracker.com/id/1033225 *** DFN-CERT-2015-1277. Linux-Kernel: Mehrere Schwachstellen ermöglichen einen Denial-of-Service-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1277/ *** Security Notice - Statement about the Stagefright Security Vulnerability in Android OS Disclosed by Zimperium *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Security Advisory - DoS Vulnerability in Huawei MBB Product *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM UrbanCode Deploy and IBM UrbanCode Deploy with Patterns *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21964039 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM GPFS Native RAID (CVE-2015-2638, CVE-2015-4760, CVE-2015-2619, CVE-2015-2613) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1022565 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Rational RequisitePro (CVE-2015-1788, CVE-2015-1789, CVE-2015-1791) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21964441 *** Apache ActiveMQ Directory Traversal Flaw Lets Remote Users Upload Files and Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1033315 *** USN-2710-2: OpenSSH regression *** --------------------------------------------- Ubuntu Security Notice USN-2710-218th August, 2015openssh regressionA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryUSN-2710-1 introduced a regression in OpenSSH.Software description openssh - secure shell (SSH) for secure access to remote machines DetailsUSN-2710-1 fixed vulnerabilities in OpenSSH. The upstream fix forCVE-2015-5600 caused a regression resulting in random authenticationfailures in non-default... --------------------------------------------- http://www.ubuntu.com/usn/usn-2710-2/ *** VU#248692: Trend Micro Deep Discovery threat appliance contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#248692 Trend Micro Deep Discovery threat appliance contains multiple vulnerabilities Original Release date: 18 Aug 2015 | Last revised: 18 Aug 2015 Overview Multiple versions of the Trend Micro Deep Discovery threat appliance are vulnerable to cross-site scripting and authentication bypass. Description The Trend Micro Deep Discovery platform "enables you to detect, analyze, and respond to today's stealthy, targeted attacks in real time." It may be... --------------------------------------------- http://www.kb.cert.org/vuls/id/248692 *** Cisco TelePresence Video Communication Server Expressway Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40523

1 0

Tageszusammenfassung - Montag 17-08-2015
by Daily end-of-shift report 17 Aug '15

17 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 14-08-2015 18:00 − Montag 17-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** My browser visited Weather.com and all I got was this lousy malware (Updated) *** --------------------------------------------- New rash of malvertising attacks threatens millions of Web surfers. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/e7WRDtjeLUI/ *** Security: Neuer digitaler Erpressungsdienst aufgetaucht *** --------------------------------------------- Encryptor RaaS nennt sich ein neuer digitaler Erpressungsdienst, der im Tor-Netzwerk aufgetaucht ist. Sein Erschaffer hat offenbar bei Reddit dafür geworben. Angeblich soll es bereits erste Kunden geben. --------------------------------------------- http://www.golem.de/news/security-neuer-digitaler-erpressungsdienst-aufgeta… *** Unsicheres Smart Home: "Nutzer können nichts tun" *** --------------------------------------------- Wiener Sicherheitsforscher warnen davor aufs vernetzte Heim mit Funk-Alarmanlagen oder Türschlösser zu setzen, weil die funkgesteuerten Anlagen viele Risiken mit sich bringen. --------------------------------------------- http://futurezone.at/digital-life/unsicheres-smart-home-nutzer-koennen-nich… *** Five points of failure in recovering from an attack *** --------------------------------------------- An over emphasis on defense is leaving the financial sector exposed to cyber attack. An increase in threat levels has seen the sector bolster defenses by focusing on detection and attack response but ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/28f1ShUbbgo/secworld.php *** MediaServer Takes Another Hit with Latest Android Vulnerability *** --------------------------------------------- The "hits" keep on coming for Android's mediaserver component. We have discovered yet another Android mediaserver vulnerability, which can be exploited to perform attacks involving arbitrary code execution. With this new vulnerability, an attacker would be able to run their code with the same permissions that the mediaserver program already has as part of its... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/G8BEug87d7k/ *** Google plugs Google Admin app sandbox bypass 0-day *** --------------------------------------------- After having had some trouble with fixing a sandbox bypass vulnerability in the Google Admin Android app, the Google Security team has finally released on Friday an update that plugs the hole. Goog... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/Mf7jUvjZmF0/secworld.php *** Wieder Root-Lücke in OS X Yosemite - inklusive 10.10.5 *** --------------------------------------------- Nachdem das jüngste Update eine Rechteausweitung behoben hatte, ist nun die nächste entdeckt worden. Demonstrationscode für einen Exploit wurde bereits veröffentlicht. --------------------------------------------- http://heise.de/-2780509 *** BitTorrent clients can be made to participate in high-volume DoS attacks *** --------------------------------------------- A group of researchers have discovered a new type of DoS attack that can be pulled off by a single attacker exploiting weaknesses in the BitTorrent protocol family. The weaknesses in the Micro Tran... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/FUSeWaDyIkU/secworld.php *** In eigener Sache: Wartungsarbeiten Dienstag, 18. August 2015 *** --------------------------------------------- In eigener Sache: Wartungsarbeiten Dienstag, 18. August 2015 | 17. August 2015 | Am Dienstag, 18. August 2015, werden wir Wartungsarbeiten an unserer Infrastruktur vornehmen. Dies kann zu kurzen Service-Ausfällen führen (jeweils im Bereich weniger Minuten). Es gehen dabei keine Daten (zb Emails) verloren, es kann sich nur die Bearbeitung etwas verzögern. In dringenden Fällen können sie uns wie gewohnt... --------------------------------------------- http://www.cert.at/services/blog/20150817120322-1581.html *** Windows Platform Binary Table (WPBT) - BIOS PE backdoor *** --------------------------------------------- [...] This feature allows a BIOS to deliver the payload of an executable, which is run in memory, silently, each time a system is booted. The executable code is run under under Session Manager context (i.e. SYSTEM). --------------------------------------------- http://www.securityfocus.com/archive/1/536181/30/0/threaded *** VMSA-2015-0003.10 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** TOTOLink Backdoor Persistence *** --------------------------------------------- Topic: TOTOLink Backdoor Persistence Risk: High Text:Hello, This is an update to: - Backdoor and RCE found in 8 TOTOLINK router models (http://seclists.org/fulldisclosure/20... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080073 *** Bugtraq: BFS-SA-2015-002: OpenSSH PAM Privilege Separation Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536220 *** OSIsoft PI Data Archive Server Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for 56 vulnerabilities that were identified in OSIsoft PI System software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-225-01 *** Cisco Nexus Operating System Address Resolution Protocol Denial of Service Vulnerability *** --------------------------------------------- 40469 --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40469 *** Cisco TelePresence Video Communication Server Expressway Access Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40442 *** Cisco NX-OS Internet Group Management Protocol Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40470 *** F5 Security Advisories *** --------------------------------------------- *** Security Advisory: Multiple MySQL vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/17000/100/sol17115.htm… *** Security Advisory: Linux kernel vulnerability CVE-2015-1465 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/100/sol17124.htm… *** Security Advisory: Apache Commons FileUpload vulnerability CVE-2014-0050 *** https://support.f5.com:443/kb/en-us/solutions/public/15000/100/sol15189.htm… *** Security Advisory: Linux kernel vulnerability CVE-2015-2042 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/100/sol17118.htm… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in IBM Java SDK affect IBM Notes and Domino *** http://www.ibm.com/support/docview.wss?uid=swg21963812 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Rational RequisitePro (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21960340 *** IBM Security Bulletin: Security Vulnerability in Apache Batik (CVE-2015-0250) *** http://www.ibm.com/support/docview.wss?uid=swg21963994 *** IBM Security Bulletin: IBM WebSphere Application Server Liberty Profile vulnerability affects IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2015-1885) *** http://www.ibm.com/support/docview.wss?uid=swg21964102 *** IBM Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Content Classification CVE-2015-4760 *** http://www.ibm.com/support/docview.wss?uid=swg21963680 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM DataQuant for Workstation (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625) *** http://www.ibm.com/support/docview.wss?uid=swg21963822 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM InfoSphere Discovery (CVE-2015-1931 CVE-2015-2601 CVE-2015-2613 CVE-2015-2625) *** http://www.ibm.com/support/docview.wss?uid=swg21963191 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Version 5, affects: Websphere Dashboard Framework *** http://www.ibm.com/support/docview.wss?uid=swg21963164 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Version 5, affects: Lotus Widget Factory. *** http://www.ibm.com/support/docview.wss?uid=swg21963161 *** Bugtraq: ESA-2015-130: EMC Documentum WebTop and WebTop Clients Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536237 *** Bugtraq: ESA-2015-131: EMC Documentum Content Server Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536236 *** Bugtraq: ESA-2015-094: RSA Archer GRC Multiple Cross-Site Request Forgery Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536235 *** Bugtraq: ESA-2015-081: RSA BSAFE Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536234 *** WP REST API (WP API) <= 1.2.2 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8152 *** WP OAuth Server <= 3.1.4 - Insecure Pseudorandom Number Generation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8153

1 0

Tageszusammenfassung - Freitag 14-08-2015
by Daily end-of-shift report 14 Aug '15

14 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 13-08-2015 18:00 − Freitag 14-08-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** One font vulnerability to rule them all #3: Windows 8.1 32-bit sandbox escape exploitation *** --------------------------------------------- This is part #3 of the "One font vulnerability to rule them all" blog post series. In the previous posts, we introduced the "blend" PostScript operator vulnerability, discussed the Charstring primitives necessary to fully control the stack contents and used them to develop a reliable user-mode Adobe Reader exploit executing arbitrary C++ code embedded in the PDF file:One font vulnerability to rule them all #1: introducing the BLEND vulnerabilityOne font vulnerability to... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/one-font-vulnerability-to-rul… *** Adwind: another payload for botnet-based malspam, (Fri, Aug 14th) *** --------------------------------------------- Introduction Since mid-July 2015, Ive noticed an increase in malicious spam (malspam) caught by my employers spamfilters with java archive (.jar file) attachments. These .jar files are most often identified as Adwind. Adwind is a Java-based remote access tool (RAT) used by malware authors to infect computers with backdoor access. Theres no vulnerability involved. To infect a Windows computer, the user has to execute the malware by double-clicking on the .jar file. Im currently seeing enough... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20041&rss *** Windows 10: Gefährlicher Zertifikats-Wirrwarr *** --------------------------------------------- Windows 10 sammelt fleißig Benutzerdaten und überträgt sie an Microsoft. Ausgerechnet dabei verzichtet das Betriebssystem auf einen ansonsten verwendeten Schutz vor falschen Zertifikaten - sensible Daten könnten so zur leichten Beute werden. --------------------------------------------- http://heise.de/-2776810 *** CaVer: Neue Technik findet Schwachstellen in C++-Code *** --------------------------------------------- US-Wissenschaftler haben ein Verfahren entwickelt, das fehlerhafte Typumwandlungen in C++-Programmen zur Laufzeit identifiziert. Es hat bereits mehrere inzwischen behobene Schwachstellen in der GNU-libstd++ und in Firefox aufgespürt. --------------------------------------------- http://heise.de/-2778993 *** Was tun bei Handy-Verlust? *** --------------------------------------------- Besitzer sollten Sicherheitsvorkehrungen treffen --------------------------------------------- http://derstandard.at/2000020734740 *** Android-Sicherheitslücke: Googles Stagefright-Patch ist fehlerhaft *** --------------------------------------------- Google muss einen der Stagefright-Patches überarbeiten. Der Patch schließt die Sicherheitslücke nicht, und Android-Geräte sind weiterhin angreifbar. Ein korrigierter Patch für die Nexus-Modelle wird diesen Monat aber nicht mehr erscheinen. --------------------------------------------- http://www.golem.de/news/android-sicherheitsluecke-googles-stagefright-patc… *** Auslaufendes A-Trust Root-Zertifikat "A-Trust-nQual-03" *** --------------------------------------------- Auslaufendes A-Trust Root-Zertifikat "A-Trust-nQual-03" | 14. August 2015 | In den diversen Certificate Stores (Browser, Windows) ist ein Root-Zertifkat von A-Trust mit Gültigkeit bis 18. August 2015: A-Trust-nQual-03 SHA-1 Fingerprint D3:C0:63:F2:19:ED:07:3E:34:AD:5D:75:0B:32:76:29:FF:D5:9A:F2 | Unseren (limitierten) Recherchen nach gibt es im Certificate Store von Windows noch andere A-Trust Root-Zertifikate (auch mit SHA256, vgl. Microsoft Root Certificate Program). In den Certificate... --------------------------------------------- http://www.cert.at/services/blog/20150814120852-1571.html *** Eurocentric Ransomware Spam in Circulation *** --------------------------------------------- A number of spam runs are gunning for customers of various European businesses. Fake delivery messages and online bills quickly give way to Ransomware...Categories: Fraud/Scam AlertTags: emailmalwarephishransomwarespamtorrentlocker(Read more...) --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/08/eurocentric-ransomware-spa… *** Lampen, Schlösser, Alarmanlagen hackbar: Wiener fanden Schwachstelle in ZigBee-Standard *** --------------------------------------------- Sicherheitsfirma Cognosec weist auf Sicherheitsprobleme beim "smarten" Zuhause hin --------------------------------------------- http://derstandard.at/2000020752533 *** Why Vulnerability Research Is A Good Thing *** --------------------------------------------- Earlier this week Oracle's CSO released a blog post that talked about why people should stop looking for vulnerabilities in their software products. Needless to say, this did not go down well with the security community - and the post was soon taken down with a statement from the company adding that the post "does not reflect our... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Laorf2GvBCU/ *** Security, Reverse Engineering and EULAs *** --------------------------------------------- Like more than a few others, I experienced the infosec outrage against Mary Ann Davidson, Oracle's Chief Security Officer, before I actually read the now-redacted blog post. After taking the time to read what she actually wrote (still available through Google's web cache), I think there's more discussion to be had than I've seen so far. --------------------------------------------- http://www.tripwire.com/state-of-security/risk-based-security-for-executive… *** Apple Patches Critical OS X DYLD Flaw in Monster Update *** --------------------------------------------- Apple released hordes of patches for OS X, iOS, Safari and iOS Server, including fixes for the DYLD vulnerability disclosed in July. --------------------------------------------- http://threatpost.com/apple-patches-critical-os-x-dyld-flaw-in-monster-upda… *** Apple Security Updates *** --------------------------------------------- *** iOS 8.4.1 *** https://support.apple.com/kb/HT205030 *** OS X Yosemite 10.10.5 and Security Update 2015-006 *** https://support.apple.com/kb/HT205031 *** Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 *** https://support.apple.com/kb/HT205033 *** OS X Server v4.1.5 *** https://support.apple.com/kb/HT205032 *** Cisco Advisories *** --------------------------------------------- *** Cisco TelePresence Video Communication Server Expressway Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40441 *** Cisco TelePresence Video Communication Server Expressway Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40444 *** Cisco TelePresence Video Communication Server Expressway Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40443 *** ICS-CERT Alerts *** --------------------------------------------- *** Rockwell Automation 1769-L18ER and A LOGIX5318ER Vulnerability *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-225-01 *** Rockwell Automation 1766-L32 Series Vulnerability *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-225-02 *** KAKO HMI Hard-coded Password *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-01 *** Schneider Electric Modicon M340 PLC Station P34 Module Vulnerabilities *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-02 *** Prisma Web Vulnerabilities *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-03 *** Moxa ioLogik E2210 Vulnerabilities *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-04 *** DFN-CERT-2015-1258: Request Tracker: Eine Schwachstelle ermöglicht einen Cross-Site-Scripting-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1258/

1 0

Tageszusammenfassung - Donnerstag 13-08-2015
by Daily end-of-shift report 13 Aug '15

13 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 12-08-2015 18:00 − Donnerstag 13-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New SMiShing Campaign Targets T-Mobile Subscribers *** --------------------------------------------- Criminals after online credentials have homed in on T-Mobile users, luring them with a $20 discount in exchange for .. --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/08/new-smishing-campaign-targ… *** Android: Und noch eine schwere Sicherheitslücke *** --------------------------------------------- Forscher von IBM haben in Googles mobilem Betriebssystem eine Lücke entdeckt, die über die Hälfte aller Android-Geräte betrifft. Sie erlaubt das Übernehmen privilegierter Prozesse durch einen Angreifer. Google hat die Lücke bereits geschlossen. --------------------------------------------- http://heise.de/-2777648 *** Cisco ASA Unicast Reverse Path Forwarding (uRPF) Bypass Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40440 *** Cisco Warns Customers About Attacks Installing Malicious IOS Bootstrap Images *** --------------------------------------------- Cisco is warning enterprise customers about a spike in attacks in which hackers use valid credentials on IOS devices to log in as administrators and then upload malicious ROMMON images to take control of the devices. The ROM Monitor is the .. --------------------------------------------- http://threatpost.com/cisco-warns-customers-about-attacks-installing-malici… *** Cisco TelePresence Video Communication Server Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40433 *** Volkswagen-Hack nach langer Sperrverfügung veröffentlicht *** --------------------------------------------- Vor einigen Jahren haben Forscher entdeckt, dass sich Motorolas Megamos-Transponder, der in den Autoschlüsseln unter anderem von Volkswagen verwendet wird, angreifen lässt. VW ließ damals gerichtlich untersagen, Detailinformationen über die Lücke zu veröffentlichen. Jetzt ist dies gelungen. --------------------------------------------- http://www.golem.de/news/autoschluessel-volkswagen-hack-nach-langer-sperrve… *** Script injection vulnerability discovered in Salesforce *** --------------------------------------------- Elastica discovered an injection vulnerability in Salesforce which opened the door for attackers to use a trusted Salesforce application as a platform to conduct phishing attacks to steal end-users l... --------------------------------------------- http://www.net-security.org/secworld.php?id=18759 *** Spam and phishing in Q2 2015 *** --------------------------------------------- In Q2 2015, the percentage of spam in email traffic accounted for 53.4%. The USA (14.6%) and Russia (7.8%) remained the biggest sources of spam. China came third with 7.1%. The Anti-Phishing system was triggered 30,807,071 times on computers of Kaspersky Lab users. --------------------------------------------- http://securelist.com/analysis/quarterly-spam-reports/71759/spam-and-phishi… *** Berliner Internet-Provider 1blu Opfer einer Hacker-Attacke *** --------------------------------------------- Bislang unbekannte Angreifer haben sich Zugriff auf das interne System verschafft und erpressen den Berliner Internet-Provider nun. --------------------------------------------- http://futurezone.at/digital-life/berliner-internet-provider-1blu-opfer-ein… *** VoIP Fraud - Brute Force and Ignorance *** --------------------------------------------- The topic of VoIP fraud seems to ebb and flow within the IT-industry press, but struggle to break the surface of mainstream media. Specialist publications report flaws in commonly-used home routers and widespread campaigns against corporate VoIP PBXes while these stories are bypass .. --------------------------------------------- https://blog.team-cymru.org/2015/08/voip-fraud-brute-force-and-ignorance/ *** YARA: Simple and Effective Way of Dissecting Malware *** --------------------------------------------- In this article, we will learn about the YARA tool, which gives a very simple and highly effective way of identifying and classifying malware. We all know that Reverse Engineering is the highly recommended method for performing a complete post-mortem .. --------------------------------------------- http://resources.infosecinstitute.com/yara-simple-effective-way-dissecting-… *** Erster Nexus Patch Day: Google schliesst 21 Sicherheitslücken *** --------------------------------------------- Acht davon "kritisch" - Neben Bugs in Stagefright noch zahlreiche andere Probleme bereinigt --------------------------------------------- http://derstandard.at/2000020697116 *** TOTOLINK Update - How to NOT handle security issues *** --------------------------------------------- This post is an an update to: Backdoor and RCE found in 8 TOTOLINK router models Backdoor credentials found in 4 TOTOLINK router models 4 TOTOLINK router models vulnerable to CSRF and XSS attacks 15 TOTOLINK router models vulnerable to multiple RCEs --------------------------------------------- https://pierrekim.github.io/blog/2015-08-13-TOTOLINK-how-to-NOT-handle-secu…

1 0

Tageszusammenfassung - Mittwoch 12-08-2015
by Daily end-of-shift report 12 Aug '15

12 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 11-08-2015 18:00 − Mittwoch 12-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** MS15-AUG - Microsoft Security Bulletin Summary for August 2015 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-AUG *** Adobe, MS Push Patches, Oracle Drops Drama *** --------------------------------------------- Adobe today pushed another update to seal nearly three dozen security holes in its Flash Player software. Microsoft also released 14 patch bundles, including a large number of fixes for computers running its new Windows 10 operating system. Not to be left out of Patch Tuesday, Oracles chief security officer lobbed something .. --------------------------------------------- http://krebsonsecurity.com/2015/08/adobe-ms-push-patches-oracle-drops-drama/ *** Defending against CVE-2015-1769: a logical issue exploited via a malicious USB stick *** --------------------------------------------- Today Microsoft released update MS15-085 to address CVE-2015-1769, an important severity security issue in Mount Manager. It affects both client and server versions, from Windows Vista to Windows 10. The goal of this blog post .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2015/08/11/defending-against-cve-201… *** MSRT August 2015: Vawtrak *** --------------------------------------------- As part of our ongoing effort to provide better malware protection, we are adding the following detections to the Microsoft Malicious Software Removal Tool (MSRT) this month: Win32/Vawtrak Win32/Critroni Win32/Kasidet Critroni is a ransomware malware family that can lock your files and ask .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/08/11/msrt-august-2015-vawtrak… *** Emerging ransomware: Troldesh *** --------------------------------------------- Troldesh (detected as variants of Win32/Troldesh) started to show up in the early part of 2015 and became more prevalent in June this year. Overall detections have so far lessened in July - except for a notable spike around the 8th of the month, .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/08/09/emerging-ransomware-trol… *** OpenSSH 7.0 Released *** --------------------------------------------- An anonymous reader writes: Today the OpenSSH project maintainers announced the release of version 7.0. This release is focusing on deprecating weak and unsafe cryptographic methods, though some of the work wont be complete until 7.1. This release removes support for the following: the legacy SSH v1 protocol, .. --------------------------------------------- http://it.slashdot.org/story/15/08/11/2340247/openssh-70-released *** IoT security is RUBBISH says IoT vendor collective *** --------------------------------------------- Online Trust Alliance calls on gadget vendors to stop acting like clowns A vendor group whose membership includes Microsoft, Symantec, Verisign, ADT and TRUSTe reckons the Internet of Things (IoT) market is being pushed with no regard to either .. --------------------------------------------- http://www.theregister.co.uk/2015/08/12/iot_security_is_rubbish_says_iot_ve… *** KCI-Angriff auf TLS missbraucht Clientzertifikate *** --------------------------------------------- Ein komplexer Angriff nutzt eine trickreiche Kombination aus Clientzertifikaten und einem statischen Diffie-Hellman-Schlüsselaustausch. Der Angriff ist nur in sehr speziellen Situationen relevant, doch es zeigt sich wieder einmal, dass das TLS-Protokoll selbst Sicherheitslücken hat. --------------------------------------------- http://www.golem.de/news/schluesselaustausch-kci-angriff-auf-tls-missbrauch… *** Hacker ermöglichen Börsen-Insidergeschäfte in Millionenhöhe *** --------------------------------------------- Pressemitteilungen beinhalten gelegentlich Informationen, die an der Börse viel Geld wert sind - vor allem, wenn sie vor ihrer Veröffentlichung in die Hände von Tätern gelangen, die damit Insidergeschäfte machen. In den USA wurde ein Verbrecherring zerschlagen, der über 100 Millionen US-Dollar damit verdient haben soll. --------------------------------------------- http://www.golem.de/news/pressemitteilungen-hacker-ermoeglichen-boersen-ins… *** Schneider Electric IMT25 DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a memory corruption vulnerability in Schneider Electric IMT25 DTM component. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-223-01 *** Blacklists miss 90% of malware blogged IP love *** --------------------------------------------- Correlate all the things. Threat intelligence firm RecordedFuture says popular web blacklists are missing thousands of IP addresses linked to malware data theft. --------------------------------------------- http://www.theregister.co.uk/2015/08/12/two_shady_men_walk_into_a_bar_black… *** Security: Lenovos sanktioniertes Rootkit *** --------------------------------------------- Nach einer kompletten Neuinstallation von Windows auf einem Lenovo-Laptop wurde zur Überraschung eines Anwenders plötzlich auch ein Lenovo-Dienst gestartet. Er vermutete eine Art Bios-Rootkit und lag damit offenbar gar nicht so falsch. --------------------------------------------- http://www.golem.de/news/security-lenovos-sanktioniertes-rootkit-1508-11571… *** Windows Service Accounts - Why They're Evil and Why Pentesters Love them! *** --------------------------------------------- Windows Service Accounts have been one of those enterprise neccessary evils - things that you have to have, but nobody ever talks about or considers to be a problem. All too often, these service accounts are in the Domain Admins group, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20029 *** August 2015 Security Update Release Summary *** --------------------------------------------- Today we released security updates to provide protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are .. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/08/11/august-2015-security-upd… *** Thunderstrike 2: Mac firmware worm details *** --------------------------------------------- This is the annotated transcript of our DefCon 23 / BlackHat 2015 talk, which presented the full details of Thunderstrike 2, the first firmware worm for Apples Macs that can spread via both software or Thunderbolt hardware accessories and writes .. --------------------------------------------- https://trmm.net/Thunderstrike2_details *** Firefox Under Fire: Anatomy of latest 0-day attack *** --------------------------------------------- On the August 6th, the Mozilla Foundation released a security update for the Firefox web browser that fixes the CVE-2015-4495 vulnerability in Firefox's embedded PDF viewer, PDF.js. This vulnerability allows attackers to bypass the same-origin policy and execute JavaScript remotely that will be .. --------------------------------------------- http://www.welivesecurity.com/2015/08/11/firefox-under-fire-anatomy-of-late… *** Finding Vulnerabilities in Core WordPress: A Bug Hunter's Trilogy, Part II - Supremacy *** --------------------------------------------- In this series of blog posts, Check Point vulnerability researcher Netanel Rubin tells a story in three acts - describing his long path of discovered flaws and vulnerabilities in .. --------------------------------------------- http://blog.checkpoint.com/2015/08/11/finding-vulnerabilities-in-core-wordp… *** SSD Advisory - ZendXml Multibyte Payloads XXE/XEE *** --------------------------------------------- The XML standard defines a concept of an external entites. XXE (XML eXternal Entity) attack is an attack on an application that parses XML input from untrusted sources using incorrectly configured XML parser. The application may be forced to open arbitrary files and/or network resources. Exploiting XXE issues on PHP applications may also lead to denial of service or in some cases (for example, when an 'expect' PHP module is installed) lead to command execution. --------------------------------------------- https://blogs.securiteam.com/index.php/archives/2550

1 0

Tageszusammenfassung - Dienstag 11-08-2015
by Daily end-of-shift report 11 Aug '15

11 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 10-08-2015 18:00 − Dienstag 11-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Beliebige SSL-Zertifikate durch Missbrauch der Uralt-Internettechnik BGP *** --------------------------------------------- Das für das globale Internet unabdingbare Border Gateway Protocol (BGP) lässt sich leicht manipulieren. Ein Hacker beschrieb auf der Black Hat, wie man darüber gültige SSL-Zertifikate für beliebige Domains ausstellen lassen kann. --------------------------------------------- http://heise.de/-2774454 *** Cisco WebEx Meetings Server Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=36968 *** Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=33996 *** CVE-2015-2419 - Internet Explorer Double-Free in Angler EK *** --------------------------------------------- The Angler Exploit Kit (EK) recently added support for an Internet Explorer (IE) vulnerability (CVE-2015-2419) that was patched in July 2015. Quickly exploiting recently patched vulnerabilities is standard for Angler EK authors, but the target has been Adobe Flash Player since the .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/08/cve-2015-2419_inte.html *** The Italian Connection: An analysis of exploit supply chains and digital quartermasters *** --------------------------------------------- On July 5, 2015 an unknown hacker publicly announced on Twitter that he had breached the internal network of Hacking Team - an Italian pentesting company known .. --------------------------------------------- http://blog.shadowserver.org/2015/08/10/the-italian-connection-an-analysis-… *** QNAP Turbo NAS Series Devices Multiple Flaws Let Remote Users Conduct Cross-Site Scripting Attacks, Traverse the Directory, Execute Arbitrary Code, and Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1033224 *** QNAP Logging Error Lets Local Users Obtain Disk Encryption Keys *** --------------------------------------------- http://www.securitytracker.com/id/1033223 *** Internal modem can be exploited by malware to gain persistence *** --------------------------------------------- Two security experts at the last Def Con hacking conference have demonstrated how Internal LTE/3G modems can be hacked to help malware survive OS reinstalls Many users totally ignore that LTE/3G modems built into new business laptops and .. --------------------------------------------- http://securityaffairs.co/wordpress/39252/hacking/internal-modem-hacking.ht… *** Who's Behind Your Proxy? Uncovering Bunitu's Secrets *** --------------------------------------------- In our previous analysis we showed how the Bunitu Trojan was distributed via the Neutrino exploit kit in various malvertising campaigns. After spending more time analyzing .. --------------------------------------------- https://blog.malwarebytes.org/botnets/2015/08/whos-behind-your-proxy-uncove… *** Watch out for Costly Mobile Ads *** --------------------------------------------- There are lots of ways you can have a bad hair day with a mobile device - a rogue app from the Play Store, a dubious file from a non-official source or even a phish attack which takes advantage of a mobile's smaller screen size. A less annoying issue is pop-ups, adverts .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/08/watch-out-for-costly-… *** Tanksysteme ungeschützt im Netz: Leichte Beute für Hacker *** --------------------------------------------- Bankomatkassen an Zapfsäulen wurden bereits zum Ziel von Hackerangriffen, um Daten zu stehlen. Doch Tankstellen könnten von Kriminellen im Internet auch für weitaus gefährlichere Attacken ins Visier genommen werden. Das Forscherteam von Rapid7 fand laut "Wired" .. --------------------------------------------- http://derstandard.at/2000020547838 *** Vulnerabilities iframe <= 3.0 *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8150 https://wpvulndb.com/vulnerabilities/8149 *** Threat Group-3390 Targets Organizations for Cyberespionage *** --------------------------------------------- Dell SecureWorks Counter Threat Unit(TM) (CTU) researchers investigated activities associated with Threat Group-3390[1] (TG-3390). Analysis of TG-3390s operations, targeting, and tools led CTU researchers to assess with moderate confidence .. --------------------------------------------- http://www.secureworks.com/cyber-threat-intelligence/threats/threat-group-3… *** Instant KARMA Might Still Get You *** --------------------------------------------- About a year ago, I started looking into Android applications that arent validating SSL certificates. Users of these applications could be at risk if they fall victim to a man-in-the-middle (MITM) attack. Earlier this year, I also wrote about .. --------------------------------------------- https://insights.sei.cmu.edu/cert/2015/08/instant-karma-might-still-get-you… *** Dynamic DNS Security and Potential Threats *** --------------------------------------------- Recently I began to notice a trend that Dynamic DNS providers have been repeatedly abused as a part of malware campaigns. How is dynamic DNS a threat to your enterprise? What can be done to mitigate this threat? Before we answer these questions, .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-a… *** Another Android hole: "OCtoRuTA" - One (Java) Class to Rule Them All *** --------------------------------------------- Yet another large-scale vulnerability has been revealed in Android. This one lets an otherwise innocent-looking app go rogue, and enjoy privileges normally limited to the trusted parts of Android. --------------------------------------------- https://nakedsecurity.sophos.com/2015/08/11/another-android-hole-octoruta-o… *** Kali Linux 2.0 Released *** --------------------------------------------- We're still buzzing and recovering from the Black Hat and DEF CON conferences where we finished presenting our new Kali Linux Dojo, which was a blast. With the help of a few good people, the Dojo rooms were set up ready for the masses - where many .. --------------------------------------------- https://www.kali.org/releases/kali-linux-20-released/ *** Security Updates Available for Adobe Flash Player (APSB15-19) *** --------------------------------------------- A security bulletin (APSB15-19) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1254 *** Mobilfunkdaten bei Facebook massenhaft auslesbar *** --------------------------------------------- Einem Entwickler ist es gelungen, mit einem kleinen Skript binnen weniger Minuten zahlreiche Mobilfunknummern von Nutzern über Facebook abzufragen. Sicherheitsexperten drängen auf eine andere Voreinstellung. --------------------------------------------- http://heise.de/-2776623

1 0

Tageszusammenfassung - Montag 10-08-2015
by Daily end-of-shift report 10 Aug '15

10 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 07-08-2015 18:00 − Montag 10-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Tech Firm Ubiquiti Suffers $46M Cyberheist *** --------------------------------------------- Networking firm Ubiquiti Networks Inc. disclosed this week that cyber thieves recently stole $46.7 million using an increasingly common scam in which crooks spoof communications from executives at the victim firm in a bid to initiate unauthorized international wire transfers. --------------------------------------------- http://krebsonsecurity.com/2015/08/tech-firm-ubiquiti-suffers-46m-cyberheis… *** Welcome to The Internet of Compromised Things *** --------------------------------------------- This post is a bit of a public service announcement, so Ill get right to the point: Every time you use WiFi, ask yourself: could I be connecting to the Internet through a compromised router with malware?Its becoming more and .. --------------------------------------------- http://blog.codinghorror.com/welcome-to-the-internet-of-compromised-things/ *** Black Hat: Schadsoftware per Windows-Update mit WSUS *** --------------------------------------------- Zwei Sicherheitsforscher demonstrierten auf der Black-Hat-Konferenz, wie sich die Windows Server Update Services (WSUS) zum Verteilen von gefälschten Windows-Updates in einem Unternehmensnetz benutzen lassen. Es gibt jedoch ein schlichtes Gegenmittel. --------------------------------------------- http://heise.de/-2775156 *** Black Hat: SMM weiterhin grosses Einfallstor *** --------------------------------------------- Ein Computerwissenschaftler zeigt ein Scheunentor, das schon zwanzig Jahre offen steht. --------------------------------------------- http://heise.de/-2775248 *** RIG Reloaded - Examining the Architecture of RIG Exploit Kit 3.0 *** --------------------------------------------- A few months ago the RIG exploit kit took quite a hit when its source code was leaked by a disgruntled reseller. At the time we wrote a blog post detailing the inner workings of RIGs infrastructure and business model,... --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/RIG-Reloaded---Examining-the… *** Stagefright: Online-Ganoven tarnen Android-Trojaner als Sicherheitsupdate *** --------------------------------------------- Während die meisten Hersteller keine oder wenige Firmware-Updates anbieten, die vor den gefährlichen Stagefright-Lücken schützen, können Online-Abzocker vermeintlich schon liefern. Es handelt sich dabei allerdings um einen Trojaner. --------------------------------------------- http://heise.de/-2775388 *** WP Statistics <= 9.5.1 - Referer Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8145 *** Stagefright: Motorola verspricht umfassende Updates *** --------------------------------------------- Auch wenn es bisher noch keine Hinweise auf entsprechende Angriffe gibt – die vor zwei Wochen bekannt gewordenen Sicherheitslücken im Media Framework Stagefright haben ordentlich Bewegung in die Android-Welt gebracht. Nach Google, LG und Samsung meldet sich mit Motorola nun der nächste Hersteller zu Wort – und verspricht umfassende Updates. --------------------------------------------- http://derstandard.at/2000020502273 *** Data, Technologies and Security - Part 1 *** --------------------------------------------- A lot of technologies present themselves as solutions for multiple challenges. At BinaryEdge, we are big adepts of analyzing all the different technologies until we see what correctly adapts and fits our environment. From a security .. --------------------------------------------- http://blog.binaryedge.io/2015/08/10/data-technologies-and-security-part-1/ *** What's Next in Malware After Kuluoz? *** --------------------------------------------- Regular readers of this blog have heard all about the infamous Kuluoz malware. This family was the latest evolution of the Asprox malware and at its peak in 2014 it accounted for 80% of .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/08/whats-next-in-malware-af… *** Getting in with the Proxmark 3 and ProxBrute *** --------------------------------------------- As a member of the Physical Security team here at SpiderLabs, some of my job responsibilities include getting into a facility by any (non-destructive) means necessary. When a client has decided once and for all that theyve trained their guards and fortified the gates, its time to test those defenses to measure just how resilient they actually are to an attack. And thats where we come in. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Getting-in-with-the-Pro… *** Google Analytics by Yoast <= 5.4.4 - Authenticated Stored Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8147 *** Mass Dark Web Scanning With PunkSPIDER *** --------------------------------------------- A while back we did some work in scanning Tor hidden services for vulnerabilities (read about it here - btw I love this article for its use of dark web and explaining that the term is highly disputed). Basically, if you dont want to read it, we did a massive scan of the Tor network for web app vulnerabilities as part of our .. --------------------------------------------- http://alex.hyperiongray.com/posts/289994-scanning-the-dark-web *** Stagefright Vulnerability Disclosure *** --------------------------------------------- StageFright which handles multiple media formats, is a system service for Android. This service is implemented by Native C++. The following diagram shows how media applications interact with .. --------------------------------------------- http://translate.wooyun.io/2015/08/08/Stagefright-Vulnerability-Disclosure.… *** Darkhotel APT Latest to Use Hacking Team Zero Day *** --------------------------------------------- The Darkhotel APT gang has extended its geographic reach to victims in a host of additional countries, and has added to its cache of zero days with its use of a HackingTeam exploit for a Flash zero-day vulnerability. --------------------------------------------- http://threatpost.com/darkhotel-apt-latest-to-use-hacking-team-zero-day/114…

1 0

Tageszusammenfassung - Freitag 7-08-2015
by Daily end-of-shift report 07 Aug '15

07 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 06-08-2015 18:00 − Freitag 07-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Updated DGA Changer Malware Generates Fake Domain Stream *** --------------------------------------------- Researchers at Seculert have discovered the latest twist to DGA Changer, which now is able to generate a fake stream of domains if it detects it's being executed in a virtual machine. --------------------------------------------- http://threatpost.com/updated-dga-changer-malware-generates-fake-domain-str… *** BLEKey Device Breaks RFID Physical Access Controls *** --------------------------------------------- A device called BEKey which is the size of a quarter and can be installed in 60 seconds on a proximity card reader could potentially be used to break physical access controls in 80 percent of deployments. --------------------------------------------- http://threatpost.com/blekey-device-breaks-rfid-physical-access-controls/11… *** BIND Denial of Service Vulnerability Blamed on Windows 2000 Compatibility Code *** --------------------------------------------- The BIND implementation of the Domain Name System (DNS) is a critical part of the infrastructure of the Internet. For example, almost all of the 13 root name servers use BIND. On July 28 a vulnerability was published in BIND that could be anonymously exploited by an attacker. To crash the server, all an attacker would have to... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/OQsKsP-w1DU/ *** Schwachstelle: Certifi-Gate erlaubt Zertifikatsmissbrauch unter Android *** --------------------------------------------- Bösartige Apps können in Android legitime Zertifikate nutzen, um erhöhte Rechte zu erhalten. Die Entdecker der Schwachstelle haben dieser den Namen Certifi-Gate gegeben. Google bestätigt die Lücke, betont aber, dass Apps im Play Store auf ein solches Missbrauchspotential überprüft würden. --------------------------------------------- http://www.golem.de/news/schwachstelle-certifi-gate-erlaubt-zertifikatsmiss… *** HTTPS: BGP-Angriff gefährdet TLS-Zertifikatssystem *** --------------------------------------------- Auf der Black Hat weisen Sicherheitsforscher auf ein Problem mit TLS-Zertifizierungsstellen hin: Die Prüfung, wem eine Domain gehört, findet über ein ungesichertes Netz statt. Dieser Weg ist angreifbar - beispielsweise mittels des Routingprotokolls BGP. --------------------------------------------- http://www.golem.de/news/https-bgp-angriff-gefaehrdet-tls-zertifikatssystem… *** Kryptographie: Rechenfehler mit großen Zahlen *** --------------------------------------------- Kryptographische Algorithmen benötigen oft Berechnungen mit großen Ganzzahlen. Immer wieder werden Fehler in den entsprechenden Bibliotheken gefunden. Diese können zu Sicherheitslücken werden. --------------------------------------------- http://www.golem.de/news/kryptographie-rechenfehler-mit-grossen-zahlen-1508… *** Zwölf Sicherheitslücken in PHP geschlossen, Support für Version 5.5 ausgelaufen *** --------------------------------------------- Das PHP-Entwickerteam hat seinen Interpreter sicherer gemacht und weist darauf hin, dass der Support für Version 5.5 vor kurzem abgelaufen ist. Wer kann, sollte auf Version 5.6 umsteigen. --------------------------------------------- http://heise.de/-2774343 *** The GasPot experiment: Hackers target gas tanks *** --------------------------------------------- Physically tampering with gasoline tanks is dangerous enough, given how volatile gas can be. Altering a fuel gauge can cause a tank to overflow, and a simple spark can set everything ablaze. But imagi... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/5bYYfndJK74/secworld.php *** Auto-Hacking: Gehackte Teslas lassen sich bei voller Fahrt ausschalten *** --------------------------------------------- Insgesamt sechs Lücken haben IT-Sicherheitsforscher in der Software der Automobile von Tesla entdeckt. Über sie gelang es ihnen, die Kontrolle über das Fahrzeug zu übernehmen. --------------------------------------------- http://www.golem.de/news/auto-hacking-gehackte-teslas-lassen-sich-bei-volle… *** Firefox exploit found in the wild *** --------------------------------------------- Yesterday morning, August 5, a Firefox user informed us that an advertisement on a news site in Russia was serving a Firefox exploit that searched for sensitive files and uploaded them to a server that appears to be in Ukraine. This morning Mozilla released security updates that fix the vulnerability. All Firefox users are urged to update to Firefox 39.0.3. The fix has also been shipped in Firefox ESR 38.1.1. https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/ --------------------------------------------- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-w… *** CrackLord: Gratis-Tool zum Steuern von Cracking-Clustern *** --------------------------------------------- Forscher haben mit CrackLord eine Open-Source-Software vorgestellt, die CPU-/GPU-Cluster zum Cracken von Passwörtern ansteuert und Aufgaben verwaltet und verteilt. --------------------------------------------- http://heise.de/-2774582 *** Scada-Sicherheit: Siemens-PLC wird zum Einbruchswerkzeug *** --------------------------------------------- Über die oftmals frei aus dem Internet zugänglichen Programmable Logic Controller (PLC) zum Steuern von Scada-Systemen können Angreifer Scanner zum Spionieren in Industrie-Systeme schmuggeln. Die dafür nötige Software steht frei zum Download. --------------------------------------------- http://heise.de/-2774812 *** Citrix XenServer Security Update for CVE-2015-5154 *** --------------------------------------------- A security vulnerability has been identified in Citrix XenServer that may allow a malicious administrator of an HVM guest VM to compromise the host ... --------------------------------------------- http://support.citrix.com/article/CTX201593 *** USN-2706-1: OpenJDK 6 vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2706-16th August, 2015openjdk-6 vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTSSummarySeveral security issues were fixed in OpenJDK 6.Software description openjdk-6 - Open Source Java implementation DetailsSeveral vulnerabilities were discovered in the OpenJDK JRE related toinformation disclosure, data integrity, and availability. An attackercould exploit these to cause a denial of service or expose sensitivedata... --------------------------------------------- http://www.ubuntu.com/usn/usn-2706-1/ *** Security Advisory: Java SE vulnerabilities CVE-2015-2590 and CVE-2015-4732 *** --------------------------------------------- (SOL17079) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/000/sol17079.htm… *** DSA-3329 linux - security update *** --------------------------------------------- Several vulnerabilities have been discovered in the Linux kernelthat may lead to a privilege escalation, denial of service orinformation leak. --------------------------------------------- https://www.debian.org/security/2015/dsa-3329 *** Apache Subversion Bugs Let Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1033215 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: A Security Vulnerability, exists in the Android platform used by the Cordova tools in Rational Application Developer for WebSphere Software (CVE-2015-1835) *** http://www.ibm.com/support/docview.wss?uid=swg21962128 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect IBM Security Identity Governance *** http://www.ibm.com/support/docview.wss?rs=0&uid=swg21963438 *** IBM Security Bulletin: A vulnerability in Diffie-Hellman ciphers affects the IBM FlashSystem V840 (CVE 2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005344 *** IBM Security Bulletin: A vulnerability in Diffie-Hellman ciphers affects the IBM FlashSystem 840 (CVE 2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005339 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21960191 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Tivoli Monitoring (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962739 *** IBM Security Bulletin: A vulnerability in Open Source Struts affects the IBM FlashSystem 840 (CVE 2015-1831) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005329 *** IBM Security Bulletin: Multiple vulnerabilities in Java affect the IBM FlashSystem V840 (CVEs 2015-0204, 2015-0488, and 2015-1916) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005328 *** IBM Security Bulletin: A vulnerability in Open Source Struts affect the IBM FlashSystem V840 (CVE 2015-1831) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005331 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-0488, CVE-2015-0478, CVE-2015-1916) *** http://www.ibm.com/support/docview.wss?uid=swg21883959 *** IBM Security Bulletin: Multiple vulnerabilities in the unzip utility affect IBM Security Access Manager for Mobile. *** http://www.ibm.com/support/docview.wss?uid=swg21963158 *** IBM Security Bulletin: Multiple vulnerability in Product IBM Tivoli Common Reporting(CVE-2015-0488, CVE-2015-0478, CVE-2015-2808, CVE-2015-1916, CVE-2014-0227, CVE-2015-0209 , CVE-2015-0286 , CVE-2015-0289) *** http://www.ibm.com/support/docview.wss?uid=swg21963024 *** IBM Security Bulletin: A vulnerability in Open Source OpenSSL affects the IBM FlashSystem 840 (CVE 2015-0286) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005341 *** IBM Security Bulletin: Vulnerability in Open Source Apache Tomcat affect the IBM FlashSystem V840, (CVE-2014-0227) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005204

1 0

Tageszusammenfassung - Donnerstag 6-08-2015
by Daily end-of-shift report 06 Aug '15

06 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 05-08-2015 18:00 − Donnerstag 06-08-2015 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Jetzt Android-Geräte auf Stagefright-Lücken testen! *** --------------------------------------------- Mit einer kostenlosen App kann man überprüfen, ob die eigenen Android-Geräte über die Stagefright-Lücken angreifbar sind. --------------------------------------------- http://heise.de/-2773801 *** Stagefright-Sicherheitslücke: Elf Wege, ein Android-System zu übernehmen *** --------------------------------------------- Auf der Black-Hat-Konferenz hat Joshua Drake die Hintergründe zu den Stagefright-Sicherheitslücken erläutert. Über mindestens elf verschiedene Wege lässt sich ein Android-System seinem Vortrag zufolge angreifen. Fortschritte gibt es bei den Android-Updates. (Android, Firefox) --------------------------------------------- http://www.golem.de/news/stagefright-sicherheitsluecke-elf-wege-ein-android… *** APT Group Gets Selective About Data it Steals *** --------------------------------------------- Dell SecureWorks researchers today at Black Hat released a new report on Emissary Panda, or TG-3390, a China-sponsored APT gang that has refined the types of data it covets. --------------------------------------------- http://threatpost.com/apt-group-gets-selective-about-data-it-steals/114103 *** Inside the $100M 'Business Club' Crime Gang *** --------------------------------------------- New research into a notorious Eastern European organized cybercrime gang accused of stealing than $100 million from banks and businesses worldwide provides an unprecedented, behind-the-scenes look at an exclusive "business club" that dabbled in cyber espionage and worked closely with phantom Chinese firms on Russias far eastern border. --------------------------------------------- http://www.krebsonsecurity.com/2015/08/inside-the-100m-business-club-crime-… *** Corporate networks can be compromised via Windows Updates *** --------------------------------------------- Yesterday at Black Hat USA 2015, researchers from UK-based Context Information Security demonstrated how Windows Update can be abused for internal attacks on corporate networks by exploiting insecurely configured enterprise implementations of Windows Server Update Services (WSUS). --------------------------------------------- http://www.net-security.org/secworld.php?id=18725 *** Exploit-Kit Rig: Verbrechen lohnt sich wieder *** --------------------------------------------- Vor einigen Monaten wurde der Quellcode des Exploit-Kits RIG 2.0 veröffentlicht; damit war der Shooting-Star der Crimeware-Szene erstmal aus dem Rennen. Jetzt sind die Entwickler mit einer Version 3.0 zurück - und verdienen besser denn je. --------------------------------------------- http://heise.de/-2772951 *** How Scammers Abuse Our Brains *** --------------------------------------------- Your brain is awesome. We're not just flattering you, it's true. It's also true of the guy sat next to you, the woman across the street, even your kid cousin who still thinks that flicking boogers is the height of hilarity. Each one of us is blessed with a brain that has unparalleled amounts of storage, and ferocious processing power. That said, our minds are still finite. The amount of information we can attend to at a given moment is limited. --------------------------------------------- https://blog.team-cymru.org/2015/08/how-scammers-abuse-our-brains/ *** Bugtraq: Vulnerable MSVC++ runtime distributed with LibreOffice 5.0.0 for Windows *** --------------------------------------------- the just released latest version 5.0.0.5 of LibreOffice.org for Windows distributes (once again) a completely outdated and vulnerable MSVC++ runtime. --------------------------------------------- http://www.securityfocus.com/archive/1/536144 *** Nicholas Weaver on iPhone Security *** --------------------------------------------- Excellent essay: Yes, an iPhone configured with a proper password has enough protection that, turned off, Id be willing to hand mine over to the DGSE, NSA, or Chinese. But many (perhaps most) users dont configure their phones right. Beyond just waiting for the suspect to unlock his phone, most people either use a weak 4-digit passcode ... --------------------------------------------- https://www.schneier.com/blog/archives/2015/08/nicholas_weaver_1.html *** Sigcheck and virustotal-search, (Thu, Aug 6th) *** --------------------------------------------- In my last diary entry I mentioned offline use of Sysinternal tools with my tool virustotal-search. So you want to use sigcheck but you cant connect the machine to the Internet. Then you can use sigchecks option -h to calculate cryptographic hashes of the files it checks, and option -c to produce a CSV output (-ct for CSV with a tab separator). If you want, you can limit sigcheck" /> To extract a unique list of MD5 hashes, you can use this pipe of awk, tail, sed and sort ... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20009&rss *** How Social Engineering Security Awareness Stops 3 Common Scams *** --------------------------------------------- Social engineering, in the context of information security, refers to the use of psychological manipulation to trick people into divulging sensitive information (information gathering) or performing actions (fraud/unauthorized system access). It is a non-technical confidence scam that resembles a very elaborate plan that consists of several stages (See the Typical Phases part). --------------------------------------------- http://resources.infosecinstitute.com/how-social-engineering-security-aware… *** Sick of Flash security holes? HTML5 has its own *** --------------------------------------------- HTML5 has been billed as the natural, standards-based successor to proprietary plug-ins such as Adobes Flash Player for providing rich multimedia services on the Web. But when it comes to security, one of Flashs major weaknesses, HTML5 is no panacea.In fact, HTML5 has security issues of its own. Julien Bellanger, CEO of application security monitoring firm Prevoty, says HTML5 makes security more complex, not simpler. HTML5 security has been a question mark for years, and it has not improved --------------------------------------------- http://www.csoonline.com/article/2960695/application-security/sick-of-flash… *** 'Funtenna' software hack turns a laser printer into a covert radio *** --------------------------------------------- Researcher demonstrates how attacker could exfiltrate data over airwaves. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/RCktE3iPj7M/ *** Black Hat: Sicherheitsforscher klonen verschlüsselte SIM-Karten *** --------------------------------------------- Die Verschlüsselung via AES 256 gilt auch langfristig als sicher. Im Zuge eines Angriffes über Bande wurden nun derartig verschlüsselte SIM-Karten in wenigen Minuten geknackt. --------------------------------------------- http://heise.de/-2773751 *** Bugtraq: [security bulletin] HPSBUX03388 SSRT102180 rev.1 - HP-UX running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP-UX running OpenSSL with SSL/TLS enabled. This is the TLS vulnerability using US export-grade 512-bit keys in Diffie-Hellman key exchange known as Logjam which could be exploited remotely resulting in disclosure of information. --------------------------------------------- http://www.securityfocus.com/archive/1/536142 *** FreeBSD patch(1) Lets Remote Users Execute Arbitrary Commands on the Target System *** --------------------------------------------- A vulnerability was reported in FreeBSD patch(1). A remote user can cause arbitrary commands to be executed on the target system. The patch(1) utility does not properly sanitize the input patch stream. A remote user can create a specially crafted patch file that, when processed by the target user via patch(1), will run ed(1) commands (in addition to running valid version control system commands) with the privileges of the target user. --------------------------------------------- http://www.securitytracker.com/id/1033188 *** FreeBSD routed(8) RIP Query Processing Flaw Lets Remote Users Cause the Target Service to Crash *** --------------------------------------------- A remote user on a network that is not directly connected to the target system's network can send a specially crafted routing information protocol (RIP) query to trigger a flaw in the target routed(8) daemon and cause the daemon to crash. As a result, the target system's routing table will no longer be updated. Systems with the routed(8) daemon enabled are affected. --------------------------------------------- http://www.securitytracker.com/id/1033185 *** Security Notice - Statement on the UAP2015 Vulnerability Mentioned at the BlackHat USA Conference *** --------------------------------------------- The investigation is still ongoing. Huawei PSIRT will keep updating the SN and will give the related views as soon as possible. Please stay tuned. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices…

1 0

Tageszusammenfassung - Mittwoch 5-08-2015
by Daily end-of-shift report 05 Aug '15

05 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 04-08-2015 18:00 − Mittwoch 05-08-2015 18:00 Handler: n/a Co-Handler: n/a *** Nuclear EK traffic patterns in August 2015, (Wed, Aug 5th) *** --------------------------------------------- Introduction About two weeks ago, Nuclear exploit kit (EK)changed its URL patterns. Now it looks a bit likeAngler EK. Kafeine originally announced the change on 2015-07-21 [1], and we collected examples the next day. Heres how Nuclear EK looked on" /> Here" /> Now that were into August 2015,URL patterns for Nuclear EK have altered again. These changes are similar to weve seen withAngler EK since June 2015 [3]. Theyre not the same URL patternsas Angler, but the changes are... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20001&rss *** Wait, what? TrueCrypt decrypted by FBI to nail doc-stealing sysadmin *** --------------------------------------------- Do the Feds know something we dont about crypto-tool? Or did bloke squeal his password? Discontinued on-the-fly disk encryption utility TrueCrypt was unable to keep out the FBI in the case of a US government techie who stole copies of classified military documents. How the Feds broke into the IT bods encrypted TrueCrypt partition isnt clear. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/04/truecrypt_d… *** WordPress-Update schließt sechs Sicherheitslücken *** --------------------------------------------- Die Version 4.2.4 des Content-Management-Systems behebt unter anderem eine SQL-Injection-Lücke, durch die Angreifer die Installation übernehmen können. --------------------------------------------- http://heise.de/-2771541 *** Man-In-The-Cloud Owns Your DropBox, Google Drive -- Sans Malware *** --------------------------------------------- Using no malware or stolen passwords, new attack can compromise your cloud synch services and make your good files malicious. --------------------------------------------- http://www.darkreading.com/cloud/man-in-the-cloud-owns-your-dropbox-google-… *** Email Security Awareness: How To Get Quick Results *** --------------------------------------------- Phishing and Spear phishing attacks on the rise Phishing and spear phishing attacks are the most effective attack vectors. Despite the high level of awareness of the cyber threats, bad actors still consider email their privileged attack vector. According to the security experts at Trend Micro firm, spear phishing is the attack method used in... --------------------------------------------- http://resources.infosecinstitute.com/email-security-awareness-how-to-get-q… *** Finding Vulnerabilities in Core WordPress: A Bug Hunter's Trilogy, Part I *** --------------------------------------------- In this series of blog posts, Check Point vulnerability researcher Netanel Rubin tells a story in three acts - describing his long path of discovered flaws and vulnerabilities in core WordPress, leading him from a read-only "Subscriber" user, through creating, editing and deleting posts, and all the way to performing SQL injection and persistent XSS attacks on 20% of the popular web... --------------------------------------------- http://blog.checkpoint.com/2015/08/04/wordpress-vulnerabilities-1/ *** Android-Schwachstelle: Telekom schaltet wegen Stagefright-Exploits direktes MMS ab *** --------------------------------------------- MMS-Nutzer müssen wegen einer Android-Schwachstelle auf die direkte Zustellung verzichten. Die Telekom will so ihre Kunden schützen. --------------------------------------------- http://www.golem.de/news/android-schwachstelle-telekom-schaltet-wegen-stage… *** MVEL as an attack vector *** --------------------------------------------- Java-based expression languages provide significant flexibility when using middleware products such as Business Rules Management System (BRMS). This flexibility comes at a price as there are significant security concerns in their use. In this article MVEL is used in JBoss... --------------------------------------------- https://securityblog.redhat.com/2015/08/05/mvel-as-an-attack-vector/ *** Root-Exploit: Apple bereitet offenbar Patch mit MacOS 10.10.5 vor *** --------------------------------------------- Der Mac-Hersteller setzt einem Bericht zufolge zunächst auf verschiedene Maßnahmen, um die Ausnutzung einer Rechteausweitungslücke zur Malware-Installation zu erschweren. Das ausstehende Update auf OS X 10.10.5 soll die Schwachstelle dann beseitigen. --------------------------------------------- http://heise.de/-2772715 *** Bugtraq: [SECURITY] [DSA 3328-2] wordpress regression update *** --------------------------------------------- http://www.securityfocus.com/archive/1/536135 *** Apple OS X DYLD_PRINT_TO_FILE Environment Variable Validation Flaw Lets Local Users Obtain Root Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1033177 *** [2015-08-05] Websense Content Gateway stack buffer overflow in handle_debug_network *** --------------------------------------------- A stack-based buffer overflow was identified in the Websense Content Manager administrative interface, which allows execution of arbitrary code. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Security Advisory - CF Card Information Leak Vulnerability on Multiple Huawei Products *** --------------------------------------------- The CF cards on some Huawei switches contain some sensitive information in plaintext. Once an attacker gets such a CF card, it may result in the leak of sensitive information (HWPSIRT-2015-07048). --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security_Advisory-Two Security Vulnerabilities in the ME906 Wireless Module *** --------------------------------------------- The upgrade package of the ME906 wireless module contains the hash values of the root account and password. An attacker can obtain the password of the root account through reverse cracking, connect to the serial port of the wireless module, and enter the root account and password to log in to the operating system of the module. (HWPSIRT-2015-02009) | This module implements upgrade check using CRC16, which is insecure. Much study is done for reversely cracking this algorithm. (HWPSIRT-2015-06032) --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor…

1 0

Tageszusammenfassung - Dienstag 4-08-2015
by Daily end-of-shift report 04 Aug '15

04 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 03-08-2015 18:00 − Dienstag 04-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Thunderstrike 2: Mac-Firmware-Wurm soll sich über Thunderbolt-Adapter verbreiten *** --------------------------------------------- Weitere EFI-Schwachstellen ermöglichen nach Angabe von Sicherheitsforschern die Modifikation der Firmware mobiler Macs. Ein Angreifer könne dadurch einen Schädling einschleusen, der sich über Thunderbolt-Adapter und Peripherie fortpflanzt. --------------------------------------------- http://heise.de/-2767994 *** DYLD_PRINT_TO_FILE exploit found in the wild *** --------------------------------------------- Last month, Stefan Esser blogged about a zero-day vulnerability in OS X, without having informed Apple about the problem first. Unfortunately, today has brought the discovery of the first known exploit. (Read more...) --------------------------------------------- https://blog.malwarebytes.org/mac/2015/08/dyld_print_to_file-exploit-found-… *** Hackers use cartons with sticks, may be foiled by watermelons *** --------------------------------------------- Translation from Russian hack-slang: Credit card, PayPal and secure server Gaining an invite to the best of the nearly 60 websites powering the cybercrime underground is only half the fight for researchers; they also need to know that credit cards are called cartons, PayPal a stick, and bulletproof servers watermelons. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/04/russian_cyb… *** Android-Schwachstelle: Stagefright-Exploits wohl bald aktiv *** --------------------------------------------- Erste Nachweise, dass die wohl gravierende Sicherheitslücke in Android ausnutzbar ist, sind bereits im Umlauf. Patches gibt es bereits für Android und Cynanogenmod. Bis die Hersteller sie bereitstellen, könnte Stagefright aber millionenfach missbraucht worden sein. --------------------------------------------- http://www.golem.de/news/android-schwachstelle-stagefright-exploits-wohl-ba… *** Android MediaServer Bug Traps Phones in Endless Reboots *** --------------------------------------------- We have discovered a new vulnerability that allows attackers to perform denial of service (DoS) attacks on Android's mediaserver program. This causes a device's system to reboot and drain all its battery life. In more a severe case, where a related malicious app is set to auto-start, the device can be trapped in an endless reboot... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/w1VZWbnfA4c/ *** Your Password is Too Damn Short *** --------------------------------------------- Im a little tired of writing about passwords. But like taxes, email, and pinkeye, theyre not going away any time soon. Heres what I know to be true, and backed up by plenty of empirical data: --------------------------------------------- http://blog.codinghorror.com/your-password-is-too-damn-short/ *** Yahoo! ads! caught! spreading! CryptoWall! ransomware! AGAIN! *** --------------------------------------------- Unpatched Flash holes exploited to inject file-scrambling nasty Yahoo!s ad network is still being used to spread ransomware to Windows PCs a year after the last big outbreak. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/04/yahoo_malwa… *** Open source tool for deploying SSL public key pinning in iOS, OS X apps *** --------------------------------------------- At Black Hat USA 2015, Data Theorem and Yahoo! will be unveiling TrustKi, a new, open source security toolkit that helps developers easily include complex mobile security functionality, known as SSL p... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/jxmlYG4OZVA/secworld.php *** Cybersecurity Policy and Threat Assessment for the Energy Sector *** --------------------------------------------- INTRODUCTION: A wake-up call An HP Enterprise Security's 2014 Global Report on the Cost of Cyber Crime by the Ponemon Institute reveals some astounding aspects of the cyber-attacks on the energy utilities. First, these assets suffered the highest average annual losses from cybercrimes ($13, 2 million), closely followed by the losses caused by computer attacks... --------------------------------------------- http://resources.infosecinstitute.com/cybersecurity-policy-and-threat-asses… *** Symantec Endpoint Protection: Gefährlicher Sicherheitslücken-Cocktail *** --------------------------------------------- Über verschiedene Schwachstellen in Symantecs End Point Protection 12.1 können sich Angreifer in Netzwerke schleichen, beliebigen Code und Befehle ausführen und anschließend ganze Systemverbunde kapern. --------------------------------------------- http://heise.de/-2768461 *** MatrixSSL Tiny: A TLS software implementation for IoT devices *** --------------------------------------------- INSIDE Secure announced the availability of MatrixSSL Tiny, the world's smallest Transport Layer Security (TLS) software implementation, to allow companies to affordably secure IoT devices with string... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/mnlQoZJr0zU/secworld.php *** Bugtraq: Mozilla extensions: a security nightmare *** --------------------------------------------- http://www.securityfocus.com/archive/1/536133 *** WordPress 4.2.4 Security and Maintenance Release *** --------------------------------------------- August 4, 2015 | WordPress 4.2.4 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. This release addresses six issues, including three cross-site scripting vulnerabilities and a potential SQL injection that could be used to compromise... --------------------------------------------- https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance… *** Security Advisory: Apache vulnerability CVE-2012-0053 *** --------------------------------------------- (SOL15273) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/200/sol15273.htm… *** DSA-3327 squid3 - security update *** --------------------------------------------- Alex Rousskov of The Measurement Factory discovered that Squid3, a fullyfeatured web proxy cache, does not correctly handle CONNECT method peerresponses when configured with cache_peer and operating on explicitproxy traffic. This could allow remote clients to gain unrestrictedaccess through a gateway proxy to its backend proxy. --------------------------------------------- https://www.debian.org/security/2015/dsa-3327 *** SSA-504631 (Last Update 2015-08-04): Incorrect Certificate Validation in COMPAS Mobile App *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM SDK, Java Technology Edition affected IBM Workflow for Bluemix July 2015 *** http://www.ibm.com/support/docview.wss?uid=swg21963428 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational ClearCase (CVE-2015-1788, CVE-2015-1789, CVE-2015-1791) *** http://www.ibm.com/support/docview.wss?uid=swg21960633 *** IBM Security Bulletin: IBM Security Identity Manager Virtual Appliance is affected by multiple vulnerabilities *** http://www.ibm.com/support/docview.wss?uid=swg21962726 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Rational ClearQuest(CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962816 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Rational ClearCase (CVE-2015-0488, CVE-2015-0478, CVE-2015-1916) *** http://www.ibm.com/support/docview.wss?uid=swg21902824 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect IBM MobileFirst Platform Foundation and IBM Worklight *** http://www.ibm.com/support/docview.wss?uid=swg21961179

1 0

Tageszusammenfassung - Montag 3-08-2015
by Daily end-of-shift report 03 Aug '15

03 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 31-07-2015 18:00 − Montag 03-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** One font vulnerability to rule them all #1: Introducing the BLEND vulnerability *** --------------------------------------------- Posted by Mateusz Jurczyk of Google Project ZeroLast month, I presented parts of my PostScript font security research at the REcon security conference in Montreal, in a talk titled "One font vulnerability to rule them all: A story of cross-software ownage, shared codebases and advanced exploitation". This talk discussed the exploitation process of a vulnerability found in the implementation of a BLEND Charstring instruction, discovered in a user-mode Adobe Reader's CoolType... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/07/one-font-vulnerability-to-rul… *** Schwachstellen: Fernzugriff öffnet Autotüren *** --------------------------------------------- Einem Hacker ist es gelungen, sich in die Software Onstar Remotelink des US-Autoherstellers General Motors einzuklinken. Damit lässt sich das Fahrzeug entriegeln und sogar starten. Wegfahren konnte er mit dem gehackten Fahrzeug aber nicht. --------------------------------------------- http://www.golem.de/news/schwachstellen-fernzugriff-oeffnet-autotueren-1508… *** Angriff auf Dell-Firmware nach Tiefschlaf *** --------------------------------------------- Nach dem Aufwachen aus dem Standby vergisst die Firmware einiger Dell-Rechner, sich selbst vor Schreibzugriffen zu schützen. So könnten Angreifer Schadcode in die Firmware schleusen. --------------------------------------------- http://heise.de/-2766940 *** Sicherheitslücken im Android-Multimedia-System eskalieren *** --------------------------------------------- Die Schwachstellen im Multimedia-System sind gefährlicher als zuerst vermutet: Mit manipulierten MP4-Videos könnten Angreifer Kontrolle übers Smartphone erlangen. --------------------------------------------- http://heise.de/-2766925 *** Your Security Policy Is So Lame, (Sun, Aug 2nd) *** --------------------------------------------- Every person should avoid lame security policies because of the lack of clarity they leave behind. Often times we find ourselves forced into creating security policies due to compliance requirements. Is there a way to lean into this requirement and get value beyond the checkbox? I certainly think so and would like to share some ideas on how you can do this as well. ">I personally avoided being the policy guy">">The following are several tips and tricks you can use to --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19991&rss *** Microsoft Windows 10 spies on you by default *** --------------------------------------------- While Microsoft is offering for free it new Windows 10 OS, security experts argue that the cost for user privacy is much higher. Microsoft Windows 10 is the new operating system of the IT giant, the newborn already reached more than 14 million downloads in just two days. The experts who have already analyzed Windows 10... --------------------------------------------- http://securityaffairs.co/wordpress/39042/digital-id/windows-10-privacy.html *** BIND9 - Denial of Service Exploit in the Wild *** --------------------------------------------- BIND is one of the most popular DNS servers in the world. It comes bundled with almost every cPanel, VPS and dedicated server installation and is used by most DNS providers. A week ago, the Internet Systems Consortium (ISC) team released a patch for a serious denial of service vulnerability (CVE-2015-5477) that allows a remote... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/RmxRTNcW95o/bind9-denial-of-s… *** Chrome extensions crocked with simple attack *** --------------------------------------------- Security-enhancer HTTPS Everywhere switched off with this one weird trick Detectify researcher Mathias Karlsson says attackers can remove Google Chrome extensions, including the popular HTTPS Everywhere extension, if users do nothing else but visit a web page. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/03/detectify_d… *** Hijacking Satellite Communications with a $1,000 Device *** --------------------------------------------- A security researcher demonstrated how to hack a satellite tracking technology with a $1,000 device made of off the shelf components. Colby Moore, a security expert from security firm Synack, will present in a talk at the next Black Hat Conference how to hack satellite tracking technology by using a $1,000 device made of off... --------------------------------------------- http://securityaffairs.co/wordpress/39051/digital-id/hijacking-satellite-co… *** Researchers Create First Firmware Worm That Attacks Macs *** --------------------------------------------- The common wisdom is that Apple computers are more secure than PCs. It turns out this isnt true. --------------------------------------------- http://www.wired.com/2015/08/researchers-create-first-firmware-worm-attacks… *** Anonymisierung: Weiterer Angriff auf das Tor-Netzwerk beschrieben *** --------------------------------------------- Forscher haben eine weitere Möglichkeit entdeckt, Benutzerzugriffe auf Tors Hidden Services zu entlarven. Ihr Angriff benötige aber eine gehörige Portion Glück, schreiben sie. Auch die Tor-Betreiber wiegeln ab. --------------------------------------------- http://www.golem.de/news/anonymisierung-weiterer-angriff-auf-das-tor-netzwe… *** Your SSH Server On Port 8080 Is No Longer "Hidden" Or "Safe", (Mon, Aug 3rd) *** --------------------------------------------- I am seeing some scanning for SSH servers on port 8080 in web server logs for web servers that listen on this port. So far, I dont see any scans like this for web servers listening on port 80. In web server logs, the scan is reflected as an Invalid Method (error 501) as the web server only sees the banner provided by the SSHclient, and of course can not respond. For example: 222.186.21.180 - - [03/Aug/2015:08:31:55 +0000] SSH-2.0-libssh2_1.4.3 501 303 - - This IP address in this example is for... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19995&rss *** Designing the Perfect Security Awareness Newsletter *** --------------------------------------------- Even in smaller organizations, a regular security awareness newsletter can support effective, participative security. While your organization's editorial rules could be a creative break on a really great newsletter, the following tips can help you build up an effective one that will be welcomed by associates and be an asset to the organization's security. Do... --------------------------------------------- http://resources.infosecinstitute.com/designing-the-perfect-security-awaren… *** Windows 10 Upgrade Spam Carries CTB-Locker Ransomware *** --------------------------------------------- Spam messages spoofing Microsoft and promising a free Windows 10 upgrade instead drop the CTB-Locker crypto-ransomware on compromised machines. --------------------------------------------- http://threatpost.com/windows-10-upgrade-spam-carries-ctb-locker-ransomware… *** Google Android Buffer Overflows in DHCP Let Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1033124 *** D-Link DCS-2103 1.20 CSRF / Cross Site Scripting *** --------------------------------------------- Topic: D-Link DCS-2103 1.20 CSRF / Cross Site Scripting Risk: Medium Text:Hello list! There are Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in D-Link DCS-2103 (IP camera). ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080016 *** VU#360431: Chiyu Technology fingerprint access control contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#360431 Chiyu Technology fingerprint access control contains multiple vulnerabilities Original Release date: 31 Jul 2015 | Last revised: 31 Jul 2015 Overview Multiple models of Chiyu Technology fingerprint access control devices contain a cross-site scripting (XSS) vulnerability and an authentication bypass vulnerability. Description CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) - CVE-2015-2870According to the reporter, tags are... --------------------------------------------- http://www.kb.cert.org/vuls/id/360431 *** Juniper Pulse Secure TCP Hardware Acceleration Flaw Lets Remote Users Access Data on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033166 *** FortiSandbox WebUI Multiple XSS vulnerabilities *** --------------------------------------------- Topic: FortiSandbox WebUI Multiple XSS vulnerabilities Risk: Low Text:[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/a... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080004 *** DSA-3322 ruby-rack - security update *** --------------------------------------------- Tomek Rabczak from the NCC Group discovered a flaw in thenormalize_params() method in Rack, a modular Ruby webserver interface.A remote attacker can use this flaw via specially crafted requests tocause a `SystemStackError` and potentially cause a denial of servicecondition for the service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3322 *** DSA-3326 ghostscript - security update *** --------------------------------------------- William Robinet and Stefan Cornelius discovered an integer overflow inGhostscript, the GPL PostScript/PDF interpreter, which may result indenial of service or potentially execution of arbitrary code if aspecially crafted file is opened. --------------------------------------------- https://www.debian.org/security/2015/dsa-3326 *** DSA-3325 apache2 - security update *** --------------------------------------------- Several vulnerabilities have been found in the Apache HTTPD server. --------------------------------------------- https://www.debian.org/security/2015/dsa-3325 *** DSA-3323 icu - security update *** --------------------------------------------- Several vulnerabilities were discovered in the International Componentsfor Unicode (ICU) library. --------------------------------------------- https://www.debian.org/security/2015/dsa-3323 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Application Dependency Discovery Manager (TADDM) - IBM Java SDK updates July 2015 *** http://www.ibm.com/support/docview.wss?uid=swg21963354 *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Security Network Intrusion Prevention System *** http://www.ibm.com/support/docview.wss?uid=swg21962039 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Security Access Manager for Web *** http://www.ibm.com/support/docview.wss?uid=swg21963096 *** IBM Security Bulletin: A vulnerability in Diffie-Hellman ciphers affects IBM Security Network Intrusion Prevention System (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962045 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cloud Manager with OpenStack (CVE-2015-0486 CVE-2015-0491 CVE-2015-0459 CVE-2015-0469 CVE-2015-0458 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-2808 *** http://www.ibm.com/support/docview.wss?uid=isg3T1022548 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SmartCloud Entry (CVE-2015-0486 CVE-2015-0491 CVE-2015-0459 CVE-2015-0469 CVE-2015-0458 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-2808 *** http://www.ibm.com/support/docview.wss?uid=isg3T1022550 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Security Access Manager for Web and IBM Tivoli Access Manager for e-business *** http://www.ibm.com/support/docview.wss?uid=swg21963126 *** IBM Security Bulletin: Multiple vulnerabilities in the unzip utility affect IBM Security Access Manager for Web *** http://www.ibm.com/support/docview.wss?uid=swg21963094 *** IBM Security Bulletin: Vulnerabilities in unzip affect IBM Security Network Intrusion Prevention System (CVE-2014-8139, CVE-2014-8140, CVE-2014-8141, and CVE-2014-9636 ) *** http://www.ibm.com/support/docview.wss?uid=swg21962038

1 0

Tageszusammenfassung - Freitag 31-07-2015
by Daily end-of-shift report 31 Jul '15

31 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 30-07-2015 18:00 − Freitag 31-07-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Derelict TrueCrypt Russia portal is command hub for Ukraine spying op *** --------------------------------------------- Backdoored code slung at officials, journos etc Malware used to attack Ukrainian government, military, and major news agencies in the country, was distributed from the Russian portal of encryption utility TrueCrypt, new research has revealed. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/30/truecrypt_r… *** Username Enumeration against OpenSSH-SELinux with CVE-2015-3238 *** --------------------------------------------- I recently disclosed a low-risk vulnerability in Linux-PAM < 1.2.1 , which allows attackers to conduct username enumeration and denial of service attacks. Below I will provide more technical details about this vulnerability. The Past Time-based username enumeration is an... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Username-Enumeration-ag… *** Flash Threats: Not Just In The Browser *** --------------------------------------------- July has been a fairly poor month for Adobe Flash Player security, to say the least. Three separate zero-day vulnerabilities (all courtesy of the Hacking Team dump) have left many people concerned about Flash security, with many (including this blog) calling for it to go away. Some sort of reaction from Adobe to improve Flash... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/6YRcRVFMKYg/ *** Bundestags-Hack: Reparatur des Bundestagsnetzes soll vier Tage dauern *** --------------------------------------------- Das Netzwerk des Bundetages soll zwischen dem 13. und 17. August 2015 neu aufgesetzt werden. In dieser Zeit wird es komplett abgeschaltet. Auch E-Mails können dann nicht mehr empfangen oder versendet werden. --------------------------------------------- http://www.golem.de/news/bundestags-hack-reparatur-des-bundestagsnetzes-sol… *** Compromised site serves Nuclear exploit kit together with fake BSOD *** --------------------------------------------- Support scammers not lying about a malware infection for a change.During our work on the development of the VBWeb tests, which will be started soon, we came across an interesting case of an infected website that served not only the Nuclear exploit kit, but also a fake blue screen of death (BSOD) that attempted to trick the user into falling for a support scam.When a (legitimate) website includes (legitimate) advertisements, these ads themselves are rarely included in the HTML code. Rather, the... --------------------------------------------- http://www.virusbtn.com/blog/2015/07_31.xml?rss *** MMS Not the Only Attack Vector for "Stagefright" *** --------------------------------------------- Earlier this week Zimperium zLabs revealed an Android vulnerability which could be used to install malware on a device via a simple multimedia message. This vulnerability, now known as Stagefright, has gained a lot of attention for the potential attacks it can cause. Stagefright makes it possible, for example, for an attacker to install a spyware app... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/fiKsjboNusw/ *** Real World Ramifications of Cyber Attacks *** --------------------------------------------- Warning: the following blog contains gratuitous use of sarcasm and hyperbole from the start. Reader discretion is advised. And so, ladies and gentlemen, it has finally happened. The Internet-of-Things has risen up, Skynet style, and we are doomed. This much prophesied event finally came to pass with reports of hackers disabling cars from miles away, and altering rifle trajectories. At last, it seems, the crossover has been made from the digital world to the physical one; the end is nigh. Then... --------------------------------------------- https://blog.team-cymru.org/2015/07/real-world-ramifications-of-cyber-attac… *** Symantec Endpoint Protection Multiple Issues *** --------------------------------------------- Revisions None Severity CVSS2 Base Score ... --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Cisco Security Advisories *** --------------------------------------------- *** Cisco ASR 1000 Series Aggregation Services Routers Fragmented Packet Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Prime Central Hosted Collaboration Solution Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40214 *** Cisco IM and Presence Service Reflected Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40217 *** Cisco AnyConnect Secure Mobilty Client Directory Traversal Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40175 *** Cisco Unified Communications Manager Prime Collaboration Deployment Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40223 *** Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Password Storage Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a password storage vulnerability in the Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-211-01 *** ZDI-15-372: IBM Tivoli Storage Manager FastBack Server Opcode 4755 Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/lONzWRepYUI/ *** ZDI-15-373: IBM Tivoli Storage Manager FastBack Server Opcode 1365 Files Restore Agents Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Np2gm5rVOXQ/ *** ZDI-15-374: IBM Tivoli Storage Manager FastBack Server Opcode 1365 Volumes Restore Agents Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/zJI4EVNVvMM/ *** ZDI-15-375: IBM Tivoli Storage Manager FastBack Server Opcode 4115 Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/x0uVs7pbpJo/ *** ZDI-15-376: IBM Tivoli Storage Manager FastBack Server Opcode 8192 Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/L9RNtcsUYnU/ *** More IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us

1 0

Tageszusammenfassung - Donnerstag 30-07-2015
by Daily end-of-shift report 30 Jul '15

30 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 29-07-2015 18:00 − Donnerstag 30-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Der Stagefright Bug *** --------------------------------------------- Bald ist die Blackhat Konferenz in Vegas und der Schwachstellen-Zirkus rundherum ist im vollen Gange. Aktuell sind eine Reihe von Verwundbarkeiten in der Stagefright Library von Android groß im Gespräch. Was steckt da .. --------------------------------------------- http://www.cert.at/services/blog/20150730175038-1560.html *** Anatomy of a Scamware Network - MultiPlug *** --------------------------------------------- While examining our cloud sandbox data recently, we uncovered a large MultiPlug network that caught our attention due to its use pattern of code signing certificates and the breadth of its hosting infrastructure. Overview of the Scamware .. --------------------------------------------- http://research.zscaler.com/2015/07/anatomy-of-scamware-network-multiplug.h… *** Tsar Team Microsoft Office Zero Day CVE-2015-2424 *** --------------------------------------------- After the publication of Flash and IE zero days following the Hacking Team leak, researchers have discovered the use of another zero-day vulnerability by the Tsar Team sometimes .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Tsar-Team-Microsoft-Off… *** Telefonanlage gehackt – 14.000 Euro Schaden für Firma in Oberwart *** --------------------------------------------- Der Fall einer Firma, deren Telefonanlage von Unbekannten gehackt worden ist, beschäftigt Kriminalisten in Oberwart: Dem Unternehmer flatterten Rechnungen über insgesamt 14.000 Euro ins Haus. Wie der Schaden entstehen konnte, sei noch Gegenstand von Ermittlungen, teilte die Landespolizeidirektion Burgenland mit. --------------------------------------------- http://derstandard.at/2000019966507 *** Android: Video-Attacke kann Geräte unbenutzbar machen *** --------------------------------------------- Die Sicherheit von Googles mobilem Betriebssystem Android kommt einmal mehr unter Beschuss: Nur wenige Tage nachdem Zimperium vor mehreren Lücken im Media Framework Stagefright gewarnt hat, meldet sich nun auch Trend Micro zu Wort. In einem Blog-Eintrag warnt der Sicherheitsdienstleister vor zwei weiteren Fehlern in Stagefright, durch die ein Android-Gerät vorübergehend keinen Laut mehr von sich gibt. Auch reagiert ein solcherart angegriffenes Geräte kaum bis gar nicht mehr. --------------------------------------------- http://derstandard.at/2000019966485 *** Windows 10 speichert Festplattenverschlüsselungs-Keys in der Cloud *** --------------------------------------------- Mit Windows 10 steht seit kurzem die neueste Betriebssystemgeneration von Microsoft zur Verfügung. Die ersten Tests kommen zu überwiegende positiven Urteilen, und doch steht der Softwarehersteller nun einmal mehr in der Kritik – und zwar von Sicherheitsexperten. --------------------------------------------- http://derstandard.at/2000019972950 *** Throwback Thursday: Riotous Assembly *** --------------------------------------------- This Throwback Thursday, we turn the clock back to January 1994, shortly after Cyber Riot had emerged as the first virus capable of infecting the Windows kernel.Today, malware that affects the Windows kernel is ubiquitous - the .. --------------------------------------------- http://www.virusbtn.com/blog/2015/07_30.xml *** Beginners Guide to "Use after free Exploits #IE 6 0-day #Exploit Development" *** --------------------------------------------- Last week a friend asked few queries regarding use after free vulnerabilities, . Its been a while I wrote a tutorial so taught of cooking a beginners guide this week end. I wanted a live target for the tutorial so my plans were to .. --------------------------------------------- http://garage4hackers.com/content.php?r=143-Beginners-Guide-to-Use-after-fr… *** Admin-Oberfläche Froxlor verrät Datenbank-Passwörter *** --------------------------------------------- Das Server-Management-Panel Froxlor ist verwundbar und Angreifer können unter Umständen das Datenbank-Passwort aus der Ferne auslesen. Eine gefixte Version ist aber noch nicht für alle Linux-Distributionen verfügbar. --------------------------------------------- http://heise.de/-2765508 *** OpenBSD patch Lets Remote Users Execute Arbitrary Commands on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033126 *** CVE-2015-0097 Exploited in the Wild *** --------------------------------------------- In March 2015, Microsoft patched a remote code execution (RCE) vulnerability (CVE-2015-0097) in Microsoft Office. In July 2015, Eduardo Prado released a Proof of Concept (PoC) exploit for this vulnerability here. It did not take long for attackers to repackage this PoC and use it in attacks .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-0097_exploi.h… *** l+f: Smarter Safe lässt sich clever ausrauben *** --------------------------------------------- Präparierten USB-Stick anstecken, 60 Sekunden warten und schon öffnen sich die Tresor-Türen: Mehr als 10.000 in den USA installierte vermeintlich smarte Tresore sollen sich so knacken lassen. Die Spuren lassen sich dabei restlos verwischen. --------------------------------------------- http://heise.de/-2765663 *** Why is Passive Mixed Content so serious? *** --------------------------------------------- One of the most important tools in web security is Transport Layer Security (TLS). It not only protects sensitive information during transit, but also verifies that .. --------------------------------------------- https://blog.whitehatsec.com/why-is-passive-mixed-content-so-serious/

1 0

Tageszusammenfassung - Mittwoch 29-07-2015
by Daily end-of-shift report 29 Jul '15

29 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-07-2015 18:00 − Mittwoch 29-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New RC4 Attack *** --------------------------------------------- New research: "All Your Biases Belong To Us: Breaking RC4 in WPA-TKIP and TLS," by Mathy Vanhoef and Frank Piessens: Abstract: We present new biases in RC4, break the Wi-Fi Protected Access Temporal Key Integrity Protocol (WPA-TKIP), and design a practical .. --------------------------------------------- https://www.schneier.com/blog/archives/2015/07/new_rc4_attack_1.html *** Cisco UCS Central Software File Access Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40151 *** Cisco AnyConnect Secure Mobility Client Local Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40176 *** SweetCAPTCHA Returns Hijacking Another Plugin *** --------------------------------------------- Yesterday we observed a strange short return of the SweetCaptcha plugin to WordPress.org repository. In June we reported that SweetCaptcha injected third-party ad code to their scripts which lead to malvertising problems on the .. --------------------------------------------- https://blog.sucuri.net/2015/07/sweetcaptcha-returns-hijacking-another-plug… *** CVE-2015-5477: An error in handling TKEY queries can cause named to exit with a REQUIRE assertion failure *** --------------------------------------------- An error in the handling of TKEY queries can be exploited by an attacker for use as a denial-of-service vector, as a constructed packet can use the defect to trigger a REQUIRE assertion failure, causing BIND to exit. --------------------------------------------- https://kb.isc.org/article/AA-01272 *** Trend Micro Discovers Vulnerability That Renders Android Devices Silent *** --------------------------------------------- We have discovered a vulnerability in Android that can render a phone apparently dead - silent, unable to make calls, with a lifeless screen. This vulnerability is present from Android 4.3 (Jelly Bean) up to the current version, Android .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-disc… *** Hackers Can Disable a Sniper Rifle - Or Change Its Target *** --------------------------------------------- If a hacker attacks your TrackingPoint smart gun over its Wi-Fi connection, you may find the weapon is aiming at a different target than you think. --------------------------------------------- http://www.wired.com/2015/07/hackers-can-disable-sniper-rifleor-change-targ… *** Eigene Keys zum Verschlüsseln der Google Cloud Platform *** --------------------------------------------- Nutzer der Google Cloud Platform können ihre Umgebung nun mit eigenen Keys verschlüsseln. So sollen weder Betreiber noch Externe Zugriff auf die Daten erhalten. --------------------------------------------- http://heise.de/-2764751 *** Phishing: Betrüger zocken Nutzer mit "WhatsApp Gold" ab *** --------------------------------------------- Fake-Angebot lockt mit "besserer Audioqualität" und größeren Gruppen – bringt aber nur Werbung --------------------------------------------- http://derstandard.at/2000019919056 *** A third of workers admit theyd leak sensitive biz data for peanuts *** --------------------------------------------- And three per cent of employees would consider offers as low as 100 pound. A third of employees would sell information on company patents, financial records and customer credit card details .. --------------------------------------------- www.theregister.co.uk/2015/07/29/third_workers_would_leak_data_cash/ *** Die Git-Stolperfalle: Viele Webseiten geben sensible Daten preis *** --------------------------------------------- Wenn Web-Admins beim Hochladen von Projekten nicht aufpassen, stellen sie unter Umständen ohne es mitzubekommen Passwort-Datenbanken und weitere schützenswerte Daten zum Abruf für jedermann bereit. --------------------------------------------- http://heise.de/-2764756 *** Remote code execution via serialized data *** --------------------------------------------- Most programming languages contain powerful features, that used correctly are incredibly powerful, but used incorrectly can be incredibly dangerous. Serialization (and deserialization) is one such feature available in most modern programming .. --------------------------------------------- https://securityblog.redhat.com/2015/07/29/remote-code-execution-via-serial… *** Analyzing VUPEN's CVE-2012-1856 *** --------------------------------------------- Quite some time ago (more than a year before the HackingTeam leaks) I came across a number of interesting exploit samples that make use of CVE-2012-1856. With the recent HackingTeam leaks a .. --------------------------------------------- http://blog.ropchain.com/2015/07/27/analyzing-vupens-cve-2012-1856/ *** Sicherheitsupdate von Chrysler gefährlicher als Hack *** --------------------------------------------- Zum Schließen einer Sicherheitslücke, die eine Fernsteuerung des Autos ermöglichen könnte, bot Chrysler den Download von ".exe"- und ".zip"-Dateien für die Autoelektronik an. --------------------------------------------- http://fm4.orf.at/stories/1761148/ *** Windows 10 Shares Your Wi-Fi With Contacts *** --------------------------------------------- Starting today, Microsoft is offering most Windows 7 and Windows 8 users a free upgrade to the software giants latest operating system -- Windows 10. But theres a very important security caveat that users should know about before transitioning to the .. --------------------------------------------- http://krebsonsecurity.com/2015/07/windows-10-shares-your-wi-fi-with-contac…

1 0

Tageszusammenfassung - Dienstag 28-07-2015
by Daily end-of-shift report 28 Jul '15

28 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-07-2015 18:00 − Dienstag 28-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Firepower 9000 Series Unauthenticated Web Page Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40136 *** Cisco Email Security Appliance AsyncOS Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40172 *** Angler Exploit Kit Used to Find and Infect PoS Systems *** --------------------------------------------- An attack aiming to infect PoS systems was found using the Angler Exploit Kit to push a PoS reconnaissance Trojan,This Trojan, detected as TROJ_RECOLOAD.A, checks for multiple conditions in the infected system like if it is a PoS machine or part of a PoS .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/angler-exploit-k… *** PHP File Manager hat gravierende Sicherheitslücken *** --------------------------------------------- Seit Jahren ungepatchte Schwachstellen im PHP File Manager gefährden zahlreiche Server, darunter auch von großen Unternehmen. Der Hersteller reagiert nicht auf Anfragen --------------------------------------------- http://www.golem.de/news/security-php-file-manager-hat-gravierende-sicherhe… *** 2. Konferenz zur Cyber Security Challenge: Das Programm steht *** --------------------------------------------- Die Gefahren und andererseits die Möglichkeiten zum Schutz und der Prävention vor Cyberangriffen sind das zentrale Thema der 2. Konferenz zur Cyber Security Challenge Germany Mitte September in Berlin. --------------------------------------------- http://heise.de/-2761878 *** [2015-07-28] McAfee Application Control multiple vulnerabilities *** --------------------------------------------- McAfee Application Control contains multiple vulnerabilities which can be used by an attacker to bypass the provided application whitelisting protection and attack availability of the system. Moreover, the identified vulnerabilities negatively affect the security of the underlying operating system. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** IMI 2015 - IT meets Industry 29.-30. September 2015 *** --------------------------------------------- Interconnecting IT and Automation offers great opportunities for the operation of industrial production sites. However, this may carry along some complex risks. With the title “IT meets Industry” IMI 2015 brings together the ICS- and IT-Community. The goal: make the most of opportunities – and minimise risks. --------------------------------------------- https://it-meets-industry.de/ *** Honeynet-Projekt analysiert Gefahren für Industrie 4.0 *** --------------------------------------------- Acht Monate lang beobachteten Experten des TÜV SÜD, welche Angriffe von wo aus auf ihr simuliertes Wasserwerk erfolgten. Ihre Erkenntnisse sollten arglose Unternehmen spätestens jetzt wachrütteln. --------------------------------------------- http://heise.de/-2763978 *** Aaron Zauner presented preliminary results on TLS usage in email *** --------------------------------------------- Aaron Zauner presented our preliminary results on the usage of TLS in the email ecosystem at the IETF meeting last week. As part of our project TLSiP we are actively scanning the Internet (/0) for TLS configurations as well as its problems with it. As .. --------------------------------------------- https://www.sba-research.org/2015/07/28/aaron-zauner-presented-preliminary-… *** The Russian Underground - Revamped *** --------------------------------------------- When big breaches happen and hundreds of millions of credit card numbers and SSNs get stolen, they resurface in other places. The underground now offers a vast landscape of shops, where criminals can buy credit cards and other things at irresistible prices. Million dollar breaches News and media coverage .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-russian-unde… *** Cisco 2015 Midyear Security Report [PDF] *** --------------------------------------------- http://www.cisco.com/web/offers/pdfs/cisco-msr-2015.pdf *** Security: Apples App Store als Einfallstor für Schadcode *** --------------------------------------------- Über eine Schwachstelle in der Verarbeitung von Belegen für Einkäufe in Apples App Store lässt sich Code auf fremden Rechnern einschleusen. --------------------------------------------- http://www.golem.de/news/security-apples-app-store-als-einfallstor-fuer-sch…

1 0

Tageszusammenfassung - Montag 27-07-2015
by Daily end-of-shift report 27 Jul '15

27 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-07-2015 18:00 − Montag 27-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple Cisco Products LDAP Server SSL Certificate Validation Vulnerability *** --------------------------------------------- A vulnerability in SSL certificate validation of multiple Cisco products could allow an unauthenticated, remote attacker to stage a man-in-the-middle attack. The vulnerability is due to lack of SSL certificate validation for secure LDAP. An attacker could exploit this vulnerability to stage a man-in-the-middle attack when .. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40137 *** IT-Sicherheit bei smarten Autos "viel zu lange ignoriert" *** --------------------------------------------- Nach dem Hack eines Jeeps gibt es Einigung darüber, dass noch viel Nachholbedarf besteht --------------------------------------------- http://derstandard.at/2000019712190 *** DSA-3317 lxc - security update *** --------------------------------------------- Several vulnerabilities have been discovered in LXC, the LinuxContainers userspace tools. Roman Fiedler discovered a directory traversal flaw in LXC when creating lock files. A local attacker could exploit this flaw to create an arbitrary .. --------------------------------------------- https://www.debian.org/security/2015/dsa-3317 *** Hacking Team: "Wir sind das Opfer" *** --------------------------------------------- Der Hersteller von aggressiver Überwachungs-Software sieht sich als einziges Opfer in der Affäre um die Veröffentlichung von Daten, die die Zusammenarbeit des Unternehmens mit autoritären Staaten belegen sollen. --------------------------------------------- http://heise.de/-2763077 *** WP Statistics <= 9.4 - SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8116 *** WP Slimstat <= 4.1.5.2 - Referer Header Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8117 *** Password Hashing Competition: Hashfunktion Argon2 gewinnt Wettbewerb *** --------------------------------------------- In einem Wettbewerb ist nach neuen Hashfunktionen gesucht worden, die sich für das Hashen von Passwörtern eignen. Jetzt steht der Gewinner fest: Argon2, entwickelt von einem Team an der Universität Luxemburg. --------------------------------------------- http://www.golem.de/news/password-hashing-competition-hashfunktion-argon2-g… *** Security: Zahlreiche Steam-Konten gehackt *** --------------------------------------------- Die Steam-Konten mehrerer Twitch-Streamer wurden offenbar von Unbekannten übernommen. Sie nutzen einen Fehler in der Anmeldefunktion aus. Valve hat bereits ein Update bereitgestellt. --------------------------------------------- http://www.golem.de/news/security-zahlreiche-steam-konten-gehackt-1507-1154… *** Advertising hijacking made by Invisible rogue mobile apps are wasting petabytes of data a day *** --------------------------------------------- Mobile Malware is growing and crooks are targeting the advertising industry to redirect users to ad pages in a sort of Advertising hijacking. Mobile Malware is growing and crooks are targeting the advertising industry with malicious .. --------------------------------------------- http://securityaffairs.co/wordpress/38885/cyber-crime/mobile-advertising-hi… *** Citrix XenServer Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator of a guest VM to crash the host ... --------------------------------------------- http://support.citrix.com/article/CTX201145 *** ManageEngine Exchange Reporter Plus Auth Bypass / Arbitrary SQL Statement Execution *** --------------------------------------------- The ManageEngine Exchange Reporter product installs a JBoss server which listens on default port 8181 (tcp/http) for incoming requests. It offers an admin panel on that port. Without authorization/authentication it is possible to .. --------------------------------------------- https://blogs.securiteam.com/index.php/archives/2533 *** Experts Found a Unicorn in the Heart of Android *** --------------------------------------------- Gaining remote code execution privileges merely by having access to the mobile number? Enter Stagefright. The targets for this kind of attack can be anyone from Prime ministers, govt. officials, company executives, security officers to IT managers. --------------------------------------------- http://blog.zimperium.com/experts-found-a-unicorn-in-the-heart-of-android/

1 0

Tageszusammenfassung - Freitag 24-07-2015
by Daily end-of-shift report 24 Jul '15

24 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-07-2015 18:00 − Freitag 24-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Four Zero Days Disclosed in Internet Explorer Mobile *** --------------------------------------------- [...] The four vulnerabilities originally were reported to Microsoft as affecting IE on the desktop, and later on it was discovered that they also affected IE Mobile on Windows Phones. Microsoft has patched all of the vulnerabilities in the desktop version of the browser, but the bugs remain open on IE Mobile. ZDI’s original advisories on these flaws said that they were zero days on Internet Explorer, as well. The company updated the advisories late Thursday to reflect the fact that the bugs only affect IE Mobile. --------------------------------------------- http://threatpost.com/four-zero-days-disclosed-in-internet-explorer/113911 *** Fixing hundreds of websites in one day *** --------------------------------------------- Remedying Angler infections in Switzerland In recent weeks the Angler exploit kit has become the dominating tool for DriveBy attacks. Cleaning Angler compromised web servers is a challenge which has been well mastered in Switzerland, thanks to the close collaboration... --------------------------------------------- http://securityblog.switch.ch/2015/07/24/fixing-hundreds-of-websites-in-one… *** The OpenSSH Bug That Wasnt *** --------------------------------------------- Much has been written about a purported OpenSSH vulnerability. On closer inspection, the reports actually got most of their facts wrong. Read on for the full story.It all started with a blog post dated July 16, 2015, titled OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass), where the TL;DR is that its possible to get an almost infinite number of tries at authentication -- good for bruteforce password guessing, for example -- if you only tickle the... --------------------------------------------- http://bsdly.blogspot.com/2015/07/the-openssh-bug-that-wasnt.html *** Malicious Google Analytics Referral Spam *** --------------------------------------------- Robots (bots) have outnumbered people on the Internet for almost two years, and they browse much faster than your average visitor. Aside from spamming your comment systems and crawling for vulnerable websites to attack, bots can also cause a lot of confusion in your website traffic reporting systems. If you use analytics software on yourRead More The post Malicious Google Analytics Referral Spam appeared first on Sucuri Blog. --------------------------------------------- https://blog.sucuri.net/2015/07/malicious-google-analytics-referral-spam.ht… *** libuser vulnerabilities *** --------------------------------------------- It was discovered that the libuser library contains two vulnerabilities which, in combination, allow unprivileged local users to gain root privileges. libuser is a library that provides read and write access to files like /etc/passwd, which constitute the system user... --------------------------------------------- https://securityblog.redhat.com/2015/07/23/libuser-vulnerabilities/ *** Emerging Web Infrastructure Threats *** --------------------------------------------- A secure cloud relies on some weak Internet infrastructure with some new BGP vulnerabilities that will be disclosed at Black Hat USA. --------------------------------------------- http://www.darkreading.com/cloud/emerging-web-infrastructure-threats/d/d-id… *** Boffins sting spooks with HORNET onion router *** --------------------------------------------- Spies eyss will water with effort as they try to slice into 93 Gb/s Tor cousin Five academics have developed a Tor alternative network that can handle up to 93 Gb/s of traffic while maintaining privacy. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/24/hornet_high… *** SANS ICS Amsterdam 2015 - 22-28 September, 2015 *** --------------------------------------------- SANS ICS Amsterdam 2015 remains open for registration. This dedicated event for those tasked with securing Industrial Control Systems will be led by SANS ICS/SCADA Instructors and subject-matter experts from across the globe. --------------------------------------------- https://www.sans.org/event/ics-amsterdam-2015 *** IT-Sicherheitsgesetz tritt in Kraft *** --------------------------------------------- Das "Gesetz zur Erhöhung der Sicherheit informationstechnischer Systeme" bringt zunächst verschärfte Anforderungen für Serveradmins und Meldepflichten für Provider sowie Kernkraftwerksbetreiber mit sich. --------------------------------------------- http://www.heise.de/newsticker/meldung/IT-Sicherheitsgesetz-tritt-in-Kraft-… *** How to manage PCI DSS 3.1 Requirement 6.6 for your web applications *** --------------------------------------------- One of the PCI DSS 3.1 requirements is Requirement 6.6 dedicated to web application security. In this blog post we will try to understand how to comply with the requirement in cost-efficient manner. --------------------------------------------- https://www.htbridge.com/blog/how-to-manage-pci-dss-3-1-requirement-6-6-for… *** SweetCaptcha Returns Hijacking Another Plugin *** --------------------------------------------- Yesterday we observed a strange short return of the SweetCaptcha plugin to WordPress.org repository. In June we reported that SweetCaptcha injected third-party ad code to their scripts which lead to malvertising problems on the sites that used this CAPTCHA service. After that incident, the SweetCaptcha WordPress plugin had been removed from the official plugin repository.Read More The post SweetCaptcha Returns Hijacking Another Plugin appeared first on Sucuri Blog. --------------------------------------------- https://blog.sucuri.net/2015/07/sweetcaptcha-returns-hijacking-another-plug… *** DSA-3314 typo3-src - end of life *** --------------------------------------------- Upstream security support for Typo3 4.5.x ended three months ago and thesame now applies to the Debian packages as well. --------------------------------------------- https://www.debian.org/security/2015/dsa-3314 *** userhelper/libuser Multiple vulns *** --------------------------------------------- Topic: userhelper/libuser Multiple vulns Risk: Medium Text:Qualys Security Advisory CVE-2015-3245 userhelper chfn() newline filtering CVE-2015-3246 libuser passwd file handling ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070115 *** Siemens RuggedCom ROS and ROX-based Devices TLS POODLE Vulnerability (UPDATE A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-202-03 Siemens RuggedCom ROS and ROX-based Devices TLS POODLE Vulnerability that was published July 22, 2015 on the ICS-CERT web site. This advisory provides mitigation details for a Transport Layer Security Padding Oracle On Downgraded Legacy Encryption vulnerability in the web interface of the Siemens RuggedCom ROS and ROX-based devices. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-202-03A

1 0

Tageszusammenfassung - Donnerstag 23-07-2015
by Daily end-of-shift report 23 Jul '15

23 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-07-2015 18:00 − Donnerstag 23-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Flash zero-day monster Angler dominates exploit kit crime market *** --------------------------------------------- If only you could buy shares SophosLabs researcher Fraser Howard says the Angler exploit kit is dominating the highly-competitive underground malware market, growing from exploding a quarter to 83 percent of market share within nine months . --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/23/sophos_angl… *** Hintergrund: Das Geschäft mit den Zero Days *** --------------------------------------------- Der Verkauf von bisher unbekannten Sicherheitslücken, sogenannten Zero Days, scheidet die Geister. Manche halten dieses Geschäft für unmoralisch, andere sagen, es sollte illegal sein. Vor allem ist es aber wohl sehr lukrativ. --------------------------------------------- http://heise.de/-2757303 *** Security: Schwachstelle erlaubt lokale Rechteausweitung in OS X 10.10 *** --------------------------------------------- Ein Fehler in Apples OS X 10.10.4 erlaubt es, sich administrative Privilegien zu verschaffen. Die Schwachstelle kann nur lokal ausgenutzt werden und wurde in der Beta von OS X 10.11 bereits behoben. --------------------------------------------- http://www.golem.de/news/security-schwachstelle-erlaubt-lokale-rechteauswei… *** 3 important questions raised by Wired's car hack *** --------------------------------------------- Wired.com broke a shocking but hardly surprising story on July 21st. The reporter was driving his Jeep on the highway when strange things started to happen. First the fan and radio went on and later the whole car came to a stop. On the highway! Andy Greenburg was not in control of the car anymore. --------------------------------------------- http://safeandsavvy.f-secure.com/2015/07/23/3-important-questions-raised-by… *** Löchrige VMs: Den PGP-Schlüssel des Nachbarn klauen *** --------------------------------------------- Teilt man sich auf einem virtuellen Server die gleiche Hardware mit anderen VMs, kann man diese ausspionieren. Dabei lassen sich auf überraschend vielen Wegen Side-Channel-Angriffe durchführen. --------------------------------------------- http://heise.de/-2760695 *** Hacking Team: a zero-day market case study *** --------------------------------------------- This article documents Hacking Teams third-party acquisition of zero-day (0day) vulnerabilities and exploits. The recent compromise of Hacking Teams email archive offers one of the first public case studies of the market for 0days. Because of its secretive nature, this market has been the source of endless debates on the ethics of its participants. The archive also offers insight into the capabilities and limits of offensive-intrusion software developers. Hacking Team was seriously exploit... --------------------------------------------- http://tsyrklevich.net/2015/07/22/hacking-team-0day-market/ *** Securing Cookies using HTTP Headers *** --------------------------------------------- In the previous articles in this series on defending against web attacks using HTTP headers, we have seen the usage of X-Frame-Options and X-XSS-Protection headers. In this article, we will see some HTTP headers to secure cookies. Introduction: Cookies are one of the most sensitive items during a user's session. An authentication cookie is as... --------------------------------------------- http://resources.infosecinstitute.com/defending-against-web-attacks-using-h… *** Another Day, Another Patch *** --------------------------------------------- FreeBSD users were treated this week to an interesting new denial of service attack vector. All supported versions of the OS are affected by the bug, which has now been patched. Junos OS, which is based on FreeBSD, is also affected. If you're a FreeBSD admin and you haven't patched, feel free to disappear now and do so. Don't worry, we'll be here when you're done - Right, now that's out of the way, we can peruse the vulnerability at our leisure. The bug... --------------------------------------------- https://blog.team-cymru.org/2015/07/another-day-another-patch/ *** SBA Afterworks Summer Special: Hacking Team Hacked? => Lessons Learned! *** --------------------------------------------- August 06, 2015 - 5:00 pm - 6:00 pm SBA Research Favoritenstraße 16 1040 Wien --------------------------------------------- https://www.sba-research.org/events/security-afterworks-hacking-team-hacked… *** Sicherheitsupdate für WordPress *** --------------------------------------------- WordPress 4.2.3 stopft unter anderem ein Sicherheitsloch, durch die Nutzer mit bestimmten Rechten die gesamte Site kompromittieren können. --------------------------------------------- http://heise.de/-2761788 *** Microsofts Advanced Threat Analytics soll Firmennetze schützen *** --------------------------------------------- Microsoft will Firmennetze mit Advanced Threat Analytics gegen Angriffe und Eindringlinge wappnen. Die Software setzt am Active Directory an, soll lernfähig sein und präsentiert Verdächtiges in einer Zeitleiste. --------------------------------------------- http://heise.de/-2761360 *** Cisco IOS Software TFTP Server Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Unified MeetingPlace Unauthorized Password Change Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Application Policy Infrastructure Controller Access Control Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS XR LPTS Network Stack Remote Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40068 *** Security Advisory: PCRE library vulnerability CVE-2015-2325 *** --------------------------------------------- (SOL16983) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16983.htm… *** Security Advisory: Multiple PHP vulnerabilities CVE-2015-4025 and CVE-2015-4026 *** --------------------------------------------- (SOL16993) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16993.htm… *** DSA-3312 cacti - security update *** --------------------------------------------- Multiple SQL injection vulnerabilities were discovered in cacti, a webinterface for graphing of monitoring systems. --------------------------------------------- https://www.debian.org/security/2015/dsa-3312 *** DSA-3313 linux - security update *** --------------------------------------------- Several vulnerabilities have been discovered in the Linux kernel thatmay lead to a privilege escalation or denial of service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3313 *** EMC Avamar Lets Remote Users Traverse the Directory to View Files on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033026 *** USN-2676-1: NBD vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2676-122nd July, 2015nbd vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummarySeveral security issues were fixed in NBD.Software description nbd - Network Block Device protocol DetailsIt was discovered that NBD incorrectly handled IP address matching. Aremote attacker could use this issue with an IP address that has a partialmatch and bypass access restrictions. This... --------------------------------------------- http://www.ubuntu.com/usn/usn-2676-1/ *** Time Tracker - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-135 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-135Project: Time Tracker (third-party module)Version: 7.xDate: 2015-July-22Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Multiple vulnerabilitiesDescriptionThis module enables you to track time on entities and comments.The module doesnt sufficiently filter notes added to time entries, leading to an XSS/JavaScript injection vulnerability. This vulnerability is mitigated by... --------------------------------------------- https://www.drupal.org/node/2537866 *** OSF for Drupal - Critical - Multiple vulnerabilities - SA-CONTRIB-2015-134 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-134Project: OSF for Drupal (third-party module)Version: 7.xDate: 2015-July-22Security risk: 15/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site Scripting, Access bypass, Cross Site Request ForgeryDescriptionThe Open Semantic Framework (OSF) for Drupal is a middleware layer that allows structured data (RDF) and associated vocabularies (ontologies) to "drive" tailored tools and data displays within... --------------------------------------------- https://www.drupal.org/node/2537860 *** FTC Uconnect Vulnerability *** --------------------------------------------- NCCIC/ICS-CERT is aware of a public report and video of researchers demonstrating remote exploits on a magazine reporter's automobile. The report and video focus on unauthorized remote access to the Fiat Chrysler Automobile (FCA) Connect automotive infotainment system. ICS-CERT is issuing this alert to provide notice of this report and video, and that a patch is available from the FCA. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-203-01 *** WordPress 4.2.3 Security and Maintenance Release *** --------------------------------------------- July 23, 2015 --------------------------------------------- https://wordpress.org/news/2015/07/wordpress-4-2-3/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in current releases of IBM WebSphere Real Time *** http://www.ibm.com/support/docview.wss?uid=swg21962496 *** IBM Security Bulletin: Current Release of IBM SDK for Node.js in IBM Bluemix is affected by CVE-2015-5380 *** http://www.ibm.com/support/docview.wss?uid=swg21962754 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Tealeaf Customer Experience (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21959030 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2015-4000, CVE-2015-0478, CVE-2015-1916). *** http://www.ibm.com/support/docview.wss?uid=swg21962216 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK (CVE-2015-0478, CVE-2015-0488, and CVE-2015-1916) and with Diffie-Hellman ciphers (CVE-2015-4000) may affect IBM Integration Designer (IID) and WebSphere Integration Developer (WID) *** http://www.ibm.com/support/docview.wss?uid=swg21961812 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron (CVE-2015-0478, CVE-2015-0488) *** http://www.ibm.com/support/docview.wss?uid=swg21961728 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affects IBM Workload Deployer (CVE-2015-0209, CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0292, and CVE-2015-0293) *** http://www.ibm.com/support/docview.wss?uid=swg21962334 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Image Construction and Composition Tool (CVE-2015-0410 and CVE-2014-6593) *** http://www.ibm.com/support/docview.wss?uid=swg21962370

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily