- Daily - CERT.at

Tageszusammenfassung - Freitag 15-02-2013
by Daily end-of-shift report 15 Feb '13

15 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 14-02-2013 18:00 − Freitag 15-02-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** CFP: 8th International Workshop on Critical Information Infrastructures Security *** --------------------------------------------- "(CRITIS 2013) Amsterdam, The Netherlands September 16-18, 2013Deadline for submission of papers: May 10, 2013Notification to authors: June 30, 2013Camera-ready papers: August 16, 2013The eighth CRITIS Conference on Critical Information Infrastructures Security is set to continue a tradition of presenting innovative research and exploring new challenges for the protection of critical information-based infrastructures. This conference focus is on the challenges regarding resilience of smart --------------------------------------------- http://www.critis2013.nl/ *** Cisco Unified IP Phone Local Kernel System Call Input Validation Vulnerability *** --------------------------------------------- Please give us your feedback on Cisco Security Intelligence Operations. Thanks! Cisco Unified IP Phones 7900 Series versions 9.3(1)SR1 and prior contain an arbitrary code execution vulnerability that could allow a local attacker to execute code or modify arbitrary memory with elevated privileges.This vulnerability is due to a failure to properly validate input passed to kernel system calls from applications running in userspace. An attacker could exploit this issue by gaining local access to --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Security Advisory&vs_cat=Security Intelligence&vs_type=RSS&vs_p=Cisco Unified IP Phone Local Kernel System Call Input Validation Vulnerability& *** Adobe adds anti-spearphishing feature for Word embedded Flash *** --------------------------------------------- "Scheduled update fixes 17 critical flaws in Flash, two in Shockwave and adds Click to Play auto-launch check for embedded Flash in Office documents. Hot of the heels of Adobes Flash zero-day fixes last Friday, the company has released a new update which integrates a security feature that could have helped prevent recent spearphishing attacks using embedded Flash in older versions of Microsoft Office documents. The Flash Player updates fix 17 critical vulnerabilities affecting it on --------------------------------------------- http://www.cso.com.au/article/453621/adobe_adds_anti-spearphishing_feature_… *** Edimax EW-7206APg & EW-7209APg Redirection / XSS / Header Injection *** --------------------------------------------- Topic: Edimax EW-7206APg & EW-7209APg Redirection / XSS / Header Injection Risk: Low Text:Device Name: EW-7206APg / EW-7209APg Vendor: Edimax Vulnerable Firmware Releases: Device: EW-7206APg Hardw... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/hKlz2mqtt70/WLB-20… *** TP-Link TL-WA701N / TL-WA701ND Directory Traversal & XSS *** --------------------------------------------- Topic: TP-Link TL-WA701N / TL-WA701ND Directory Traversal & XSS Risk: Medium Text:Device Name: TL-WA701N / TL-WA701ND Vendor: TP-Link Vulnerable Firmware Releases: Firmware Version: 3.12.6 Bui... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/KnenNycHmss/WLB-20… *** Raidsonic IB-NAS5220 / IB-NAS4220-B XSS / Authentication Bypass *** --------------------------------------------- Topic: Raidsonic IB-NAS5220 / IB-NAS4220-B XSS / Authentication Bypass Risk: High Text:Device Name: IB-NAS5220 / IB-NAS4220-B Vendor: Raidsonic Vulnerable Firmware Releases: Product Name IB-NAS5220... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/wLNEwqEuBik/WLB-20… *** Websense Security Labs Releases 2013 Threat Report *** --------------------------------------------- "Websense Security Labs has released its 2013 Threat Report. The study details the most prevalent mobile, social, email and web-based threats from last year. As far as the web is concerned, experts say it has become significantly more malicious in 2012...." --------------------------------------------- http://news.softpedia.com/news/Websense-Security-Labs-Releases-2013-Threat-… *** Wachsender Markt für Zero-Day-Exploits *** --------------------------------------------- Mit ihrer offensiven Cyberwar-Strategie fördert die US-Regierung einen globalen Markt für IT-Sicherheitslücken, beklagen Experten. Das könnte das Web noch unsicherer machen, als es heute schon ist. --------------------------------------------- http://www.heise.de/newsticker/meldung/Wachsender-Markt-fuer-Zero-Day-Explo… *** Apple kündigt Fix für Passcode-Problem in iOS 6.1 und 6.1.1 an *** --------------------------------------------- Das Unternehmen zeigt sich über den Fehler informiert, mit dem sich auf Kontakte, Fotoalbum sowie Telefonfunktion zugreifen lässt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/28978a85/l/0L0Sheise0Bde0Csec… *** Mobile network infections increase by 67% *** --------------------------------------------- "Kindsight released a new report that reveals security threats to home and mobile networks, including a small decline in home network infections and an increase in mobile network infections. Highlights include:The rate of home network infections decreased from 13 to 11 percent in Q4; 6 percent exhibited high-level threats, such as bots, rootkits and banking Trojans. The ZeroAccess botnet continued to be the most common malware threat, infecting 0...." --------------------------------------------- http://www.net-security.org/malware_news.php?id=2415

1 0

Tageszusammenfassung - Donnerstag 14-02-2013
by Daily end-of-shift report 14 Feb '13

14 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-02-2013 18:00 − Donnerstag 14-02-2013 18:00 Handler: Robert Waldner Co-Handler: Matthias Fraidl *** Drupal Manager Change For Organic Groups 7.x Cross Site Scripting *** --------------------------------------------- Topic: Drupal Manager Change For Organic Groups 7.x Cross Site Scripting Risk: Low Text:View online: http://drupal.org/node/1916312 * Advisory ID: DRUPAL-SA-CONTRIB-2013-015 * Project: Manager Change for Org... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/_gQ6taUHG30/WLB-20… *** OpenPLI OS Command Execution / Cross Site Scripting *** --------------------------------------------- Topic: OpenPLI OS Command Execution / Cross Site Scripting Risk: High Text:Device Name: OpenPLI - Dream Multimedia Box with OpenPLI software Vendor of device: Dream Multimedia Vendor of Software: Open... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Xw2JT_kHdgI/WLB-20… *** Drupal Banckle Chat 7.x Access Bypass *** --------------------------------------------- Topic: Drupal Banckle Chat 7.x Access Bypass Risk: High Text:View online: http://drupal.org/node/1916370 * Advisory ID: DRUPAL-SA-CONTRIB-2013-016 * Project: Banckle Chat [1] (thir... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/rLZXZc-YDas/WLB-20… *** Foxit Reader Plugin URL Processing Buffer Overflow *** --------------------------------------------- Topic: Foxit Reader Plugin URL Processing Buffer Overflow Risk: High Text:## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/_YZtyNAPpCI/WLB-20… *** Lua for Windows (LfW) V5.1.4-46 => os.getenv ntdll.dll Crash *** --------------------------------------------- Topic: Lua for Windows (LfW) V5.1.4-46 => os.getenv ntdll.dll Crash Risk: Medium Text:Lua for Windows (LfW) V5.1.4-46 => os.getenv ntdll.dll Crash found by: devilteam.pl contact: info(a)devilteam.pl ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/-0kYjNur224/WLB-20… *** DirectAdmin On-Line Demo SQL Injection *** --------------------------------------------- Topic: DirectAdmin On-Line Demo SQL Injection Risk: Medium Text:++++++++++++++++++++++++++++++++++++++ # Exploit Title :DirectAdmin On-Line Demo SQLInjection # *Vendor*:http://www.directadm... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/OL1UqRx5FGI/WLB-20… *** Datenschutzbedenken bei Google Play Store *** --------------------------------------------- Bei jedem Kauf in Googles App-Store werden automatisch Name, E-Mail-Adresse und Standortinformationen zum App-Entwickler übertragen, ohne, dass der Käufer dem explizit zustimmt. --------------------------------------------- http://futurezone.at/digitallife/14096-datenschutzbedenken-bei-google-play-… *** [webapps] - Sonicwall OEM Scrutinizer v9.5.2 - Multiple Vulnerabilities *** --------------------------------------------- Sonicwall OEM Scrutinizer v9.5.2 - Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/24500 *** [papers] - A Short Guide on ARM Exploitation *** --------------------------------------------- A Short Guide on ARM Exploitation --------------------------------------------- http://www.exploit-db.com/download_pdf/24493 *** Unscrambling an Android Telephone With FROST *** --------------------------------------------- Noryungi writes "Researchers at the University of Erlangen demonstrate how to recover an Android phone confidential content, with the help of a freezer and FROST, a specially-crafted Android ROM. Quite an interesting set of pictures, starting with wrapping your Android phone in a freezer bag." Read more of this story at Slashdot. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/RFQuYaJ5DZU/story01.htm *** iPhone-Lücke erlaubt Zugriff ohne Passcode *** --------------------------------------------- Durch eine Schwachstelle kann man bei gesperrten iOS-Geräten auf Kontakte und Fotos zugreifen, ohne den Passcode einzugeben. Auch Telefonate sind dadurch möglich. Wir konnten das Problem mit einem iPhone 4 und einem iPhone 5 nachvollziehen, auf denen jeweils die aktuelle iOS-Version 6.1 installiert ist --------------------------------------------- http://www.heise.de/newsticker/meldung/iPhone-Luecke-erlaubt-Zugriff-ohne-P…

1 0

Tageszusammenfassung - Mittwoch 13-02-2013
by Daily end-of-shift report 13 Feb '13

13 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-02-2013 18:00 − Mittwoch 13-02-2013 18:00 Handler: Robert Waldner Co-Handler: Matthias Fraidl *** Data protection practices in EU and Asia *** --------------------------------------------- "Research undertaken by Field Fisher Waterhouse into the existing legal framework mandating encryption of personal data in the EU and Asia. The study details legal requirements in the EU and Asia and reveals a trajectory of data protection regulation towards encryption as a compliance imperative. The litany of highly visible data breach incidents in 2012, further compounded by the steep penalties being delivered by data protection watchdogs, means that the pressure to protect the integrity --------------------------------------------- http://www.net-security.org/secworld.php?id=14395 *** Neues Sicherheits-Update für Ruby on Rails *** --------------------------------------------- Mit den Rails-Versionen 3.2.12 und 3.1.11 und 2.3.17 werden kritische Sicherheitslücken geschlossen. Zusätzlich sollen Nutzer das Gem für JSON auf die neuste Version aktualisieren. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/287dc9e1/l/0L0Sheise0Bde0Csec… *** Summary for February 2013 - Version: 1.1 *** --------------------------------------------- This bulletin summary lists security bulletins released for February 2013. With the release of the security bulletins for February 2013, this bulletin summary replaces the bulletin advance notification originally issued February 7, 2013. --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-feb *** RADIUS Authentication Bypass *** --------------------------------------------- Please give us your feedback on Cisco Security Intelligence Operations. Thanks! Remote Authentication Dial In User Service (RADIUS) authentication on adevice that is running certain versions of Cisco Internetworking OperatingSystem (IOS) and configured with a fallback method to none canbe bypassed.Systems that are configured for other authentication methods or thatare not configured with a fallback method tonone are not affected.Only the systems that are running certain versions of Cisco IOS --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Security Advisory&vs_cat=Security Intelligence&vs_type=RSS&vs_p=RADIUS Authentication Bypass&vs_k=1 *** How Lockheed Martins Kill Chain Stopped SecurID Attack *** --------------------------------------------- "A few months after RSA had rocked the security world with news that it had been breached and its SecurID database exposed in a sophisticated attack, defense contractor Lockheed Martin discovered an intruder in its network using legitimate credentials."We almost missed it," says Steve Adegbite, director of cybersecurity for Lockheed Martin, of the intrusion sometime around May or early June 2011. "We thought at first it was a new person in the department ... but then it --------------------------------------------- http://www.darkreading.com/authentication/167901072/security/attacks-breach… *** SonicWALL Scrutinizer 9.5.2 SQL Injection *** --------------------------------------------- Topic: SonicWALL Scrutinizer 9.5.2 SQL Injection Risk: Medium Text:Title: Sonicwall Scrutinizer v9.5.2 - SQL Injection Vulnerability Date: == 2013-02-13 References: == htt... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/2p4Vvj_j1ng/WLB-20… *** Vuln: EMC NetWorker nsrindexd RPC Service Buffer Overflow Vulnerability *** --------------------------------------------- EMC NetWorker nsrindexd RPC Service Buffer Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57182 *** Zero-Day-Lücke im Adobe Reader *** --------------------------------------------- Sicherheitsforscher haben ein speziell präpariertes PDF-Dokument entdeckt, das offenbar eine bislang unbekannte Schwachstelle im Reader ausnutzt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/288471e5/l/0L0Sheise0Bde0Csec… *** OpenEMR 4.1.1 (ofc_upload_image.php) Arbitrary File Upload Vulnerability *** --------------------------------------------- Topic: OpenEMR 4.1.1 (ofc_upload_image.php) Arbitrary File Upload Vulnerability Risk: High Text: --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Q1XBAdgibv4/WLB-20…

1 0

Tageszusammenfassung - Dienstag 12-02-2013
by Daily end-of-shift report 12 Feb '13

12 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 11-02-2013 18:00 − Dienstag 12-02-2013 18:00 Handler: Robert Waldner Co-Handler: Matthias Fraidl *** Microsoft Report Examines Socio-Economic Relationships to Malware Infections *** --------------------------------------------- "Tired of all those malware and vulnerability reports that count how many of each have been reported to security companies? Well, Microsoft has taken a different tack in its latest Security Intelligence Report (SIR) by globally comparing regions relative security against socio-economic factors including the maturity of a national or regional cybersecurity policy. The results arent so surprising; areas such as Europe with well-defined, long-standing and enforceable policies rate much better --------------------------------------------- http://threatpost.com/en_us/blogs/microsoft-report-examines-socio-economic-… *** Bugtraq: Atmel "secure" crypto co-processor series microprocessors (AT91SAM7XC) leaking keys, plus bonus DESFire hack *** --------------------------------------------- Atmel "secure" crypto co-processor series microprocessors (AT91SAM7XC) leaking keys, plus bonus DESFire hack --------------------------------------------- http://www.securityfocus.com/archive/1/525643 *** Feds Offer $20M For Critical Open Source Energy Network Cybersecurity Tools *** --------------------------------------------- coondoggie writes "The US Department of Energy today said it would spend $20 million on the development of advanced cybersecurity tools to help protect the nations vulnerable energy supply. The DOE technologies developed under this program should be interoperable, scalable, cost-effective advanced tools that do not impede critical energy delivery functions, that are innovative and can easily be commercialized or made available through open source for no cost." Read more of this --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/9TMHc5f0eM4/story01.htm *** Dorkbot worm lurks on Skype and MSN Messenger again *** --------------------------------------------- "The Dorkbot/Rodpicom worm, which spreads via messaging applications and leads to additional malware infections, is currently doing rounds on Skype and MSN Messenger, warns Fortinet. The vicious circle starts with potential victims receiving a direct message from a contact, asking "LOL is this your new profile pic? http://goo...." --------------------------------------------- http://www.net-security.org/malware_news.php?id=2408 *** Brother HL5370 Command Execution & Password Guessing *** --------------------------------------------- Topic: Brother HL5370 Command Execution & Password Guessing Risk: High Text:Tested on Brother HL5370 latest firmware so far, confirmed working against many others by Brother documentation >From Brothe... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/x_kg5EVaYGc/WLB-20… *** Huawei Mobile Partner Poor Permissions *** --------------------------------------------- Topic: Huawei Mobile Partner Poor Permissions Risk: High Text:1. DESCRIPTION Huawei Mobile Partner application contains a flaw that may allow an attacker to gain access to unauthorized ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/LXaaPcg1qMI/WLB-20… *** Windows Manage Persistent Payload Installer *** --------------------------------------------- Topic: Windows Manage Persistent Payload Installer Risk: Low Text:## # ## This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Ple... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/vb4FCkPCJRg/WLB-20… *** Wordpress newscast Theme SQL Injection *** --------------------------------------------- Topic: Wordpress newscast Theme SQL Injection Risk: Medium Text: # # Exploit Title: wordpress newscast Theme SQL Injection # Google Dork: inurl:/wp-content/themes/newscast & inurl:"s... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Stvaf5d_Ze4/WLB-20… *** Wordpress image news slider v3 Plugin SQL Injection *** --------------------------------------------- Topic: Wordpress image news slider v3 Plugin SQL Injection Risk: Medium Text: # # Exploit Title: wordpress image news slider v3 Plugin SQL Injection # Google Dork: inurl:/wp-content/plugins/wp-... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/KzGKRl1pfrw/WLB-20… *** cURL auf Abwegen *** --------------------------------------------- Ein Server kann cURL über Umwege dazu bringen, beim Abruf einer Webseite beliebigen Code auf dem System auszuführen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/287bfbd2/l/0L0Sheise0Bde0Csec… *** Microsoft will am Februar-Patchday 57 Lücken schließen *** --------------------------------------------- Der nächste Patchday bringt zwölf Bulletins, von denen fünf kritische Lücken schließen. Abgesichert werden unter anderem sämtliche Windows-Versionen, der Internet Explorer und Exchange. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/287bfbd1/l/0L0Sheise0Bde0Csec…

1 0

Tageszusammenfassung - Montag 11-02-2013
by Daily end-of-shift report 11 Feb '13

11 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 08-02-2013 18:00 − Montag 11-02-2013 18:00 Handler: Robert Waldner Co-Handler: Matthias Fraidl *** ct Trojaner-Test: Die alten fangen sie alle *** --------------------------------------------- Der Trojaner-Test der aktuellen ct attestiert den Viren-Wächtern eine hervorragende Leistung: Sie blockierten alle Trojaner, wenn diese über eine Woche alt waren. Wer seine Mail allerdings sofort öffnet, muss aufpassen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2863edd1/l/0L0Sheise0Bde0Cmel… *** Security Firm Bit9 Hacked, Used to Spread Malware *** --------------------------------------------- "Bit9, a company that provides software and network security services to the U.S. government and at least 30 Fortune 100 firms, has suffered an electronic compromise that cuts to the core of its business: helping clients distinguish known safe files from computer viruses and other malicious software. Waltham, Massachusetts-based Bit9 is a leading provider of application whitelisting services, a security technology that turns the traditional approach to fighting malware on its head. --------------------------------------------- http://krebsonsecurity.com/2013/02/security-firm-bit9-hacked-used-to-spread… *** Bots, Zeus, Web Exploits: the Most Potent Threats of 2012 *** --------------------------------------------- "Every year it seems that security-related news advances further from its roots in national security circles, IT departments, and the antivirus industry into the mainstream consciousness. From July to the end of year was no exception. However, despite a handful of flashy security stories, F-Secure claims that the second half of 2012 was really about things that rarely (if ever) come up in local and national news: botnets, ZeroAccess in particular, Java and other Web exploits, and the --------------------------------------------- http://threatpost.com/en_us/blogs/bots-zeus-web-exploits-most-potent-threat… *** New Whitehole exploit toolkit emerges on the underground market *** --------------------------------------------- "A new exploit kit called Whitehole has emerged on the underground market, providing cybercriminals with one more tool to infect computers with malware over the Web, security researchers from antivirus vendor Trend Micro reported Wednesday. Exploit kits are malicious Web-based applications designed to install malware on computers by exploiting vulnerabilities in outdated browser plug-ins like Java, Adobe Reader or Flash Player. Attacks that use such toolkits are called drive-by downloads --------------------------------------------- http://www.csoonline.com/article/728509/new-whitehole-exploit-toolkit-emerg… *** Wordpress plugin myftp-ftp-like-plugin-for-wordpress 2 SQL Injection *** --------------------------------------------- Topic: Wordpress plugin myftp-ftp-like-plugin-for-wordpress 2 SQL Injection Risk: Medium Text:# Exploit Title: wordpress myftp-ftp-like-plugin-for-wordpress plugin v2 Plugin SQL Injection # Google Dork: inurl:/wp-content... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/hLRBxtv9_j0/WLB-20… *** [dos] - Schneider Electric Accutech Manager Heap Overflow PoC *** --------------------------------------------- Schneider Electric Accutech Manager Heap Overflow PoC --------------------------------------------- http://www.exploit-db.com/exploits/24474 *** Wordpress post2pdf-converter v2 Plugin SQL Injection *** --------------------------------------------- Topic: Wordpress post2pdf-converter v2 Plugin SQL Injection Risk: Medium Text:# Exploit Title: wordpress post2pdf-converter v2 Plugin SQL Injection # Google Dork: inurl:wp-content/plugins/post2pdf-convert... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/ymNXfLXFu7A/WLB-20… *** Wordpress smart-map v2 Plugin SQL Injection *** --------------------------------------------- Topic: Wordpress smart-map v2 Plugin SQL Injection Risk: Medium Text:# Exploit Title: wordpress smart-map v2 Plugin SQL Injection # Google Dork: inurl:wp-content/plugins/smart-map inurl:show-smar... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/3bHfg6PXmFU/WLB-20… *** "Intel Packet of Death" ist kein Intel-Problem *** --------------------------------------------- Die vermeintlichen Todespakete, mit denen man bestimmte Intel-Netzwerkinterfaces abschießen können soll, betreffen offenbar nur einen einzigen Board-Hersteller. Laut Intel hat dieser beim Programmieren des EEPROMs gepatzt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/287185f4/l/0L0Sheise0Bde0Cmel… *** Vuln: GNU glibc Dynamic Linker $ORIGIN Local Privilege Escalation Vulnerability *** --------------------------------------------- GNU glibc Dynamic Linker $ORIGIN Local Privilege Escalation Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/44154 *** [papers] - Manipulating Memory for Fun & Profit *** --------------------------------------------- Manipulating Memory for Fun & Profit --------------------------------------------- http://www.exploit-db.com/download_pdf/24482 *** [webapps] - Linksys WRT160N - Multiple Vulnerabilities *** --------------------------------------------- Linksys WRT160N - Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/24478 *** Linksys WAG200G Multiple Vulns *** --------------------------------------------- Topic: Linksys WAG200G Multiple Vulns Risk: Medium Text:Device Name: Linksys WAG200G Vendor: Linksys/Cisco Device Description: The WAG200G is a Linksys Wireless-G A... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/QVSmcx_37s8/WLB-20… *** Apache CXF WSS4JInInterceptor always allows HTTP Get requests *** --------------------------------------------- Topic: Apache CXF WSS4JInInterceptor always allows HTTP Get requests Risk: High Text:CVE-2012-5633: WSS4JInInterceptor always allows HTTP Get requests from browser Severity: Critical Vendor: The Apache Soft... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/mpI-hZhtnw0/WLB-20… *** Nach dem Java-Update ist vor dem Java-Update *** --------------------------------------------- Oracle hat mit seinem Notfall-Update am 1. Februar schnell reagiert. Eigentlich war ein Update für den 19. Februar geplant. Dieser Termin wird nun auch eingehalten: Mit einem Update für den Notfall-Patch. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2872904c/l/0L0Sheise0Bde0Cmel… *** Java Zero-Day Offered On Russian Dark Market For $100k *** --------------------------------------------- "Java zero-day software flaws arent just worth tens of thousands, they can fetch hundreds of thousands, according to RSA security experts. When asked how much vulnerabilities were selling for, one cyber intelligence agent, tasked specifically with infiltrating Russian dark markets on the Web, told TechWeekEurope he had seen a Java vulnerability on sale for $100,000. The latest Java vulnerability, that went for $100,000, he said...." --------------------------------------------- http://www.techweekeurope.co.uk/news/java-zero-day-russian-forum-sale-10000… *** OpenSSL 1.0.1e Released with Corrected fix for CVE-2013-1069, more here: http://www.openssl.org/, (Mon, Feb 11th) *** --------------------------------------------- -- John Bambenek bambenek \at\ gmail /dot/ com Bambenek Consulting (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15133&rss

1 0

Tageszusammenfassung - Freitag 8-02-2013
by Daily end-of-shift report 08 Feb '13

08 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 07-02-2013 18:00 − Freitag 08-02-2013 18:00 Handler: Stephan Richter Co-Handler: L. Aaron Kaplan *** Viele Router-Lücken, wenig Patches *** --------------------------------------------- Michael Messner hat nachgelegt: In seinem Blog veröffentlichte er weitere Schwachstellen in Routern von Linksys, Netgear und erneut D-Link. Die Hersteller sind seit Monaten informiert, trotzdem sind die meisten Lücken noch sperrangelweit offen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2856de6a/l/0L0Sheise0Bde0Cmel… *** Advance Notification Service for the February 2013 Security Bulletin Release *** --------------------------------------------- We're kicking off the February 2013 Security Bulletin Release with Advance Notification of 12 bulletins for release Tuesday, February 12. This release brings five Critical and seven Important-class bulletins, which address 57 unique vulnerabilities. The Critical-rated bulletins address issues in Microsoft Windows, Internet Explorer and Exchange Software. The Important-rated bulletins address issues in Microsoft Windows, Office, .NET Framework, and Microsoft Server Software. Per our... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2013/02/07/advance-notification-ser… *** Vuln: PostgreSQL enum_recv() Function Denial of Service Vulnerability *** --------------------------------------------- PostgreSQL enum_recv() Function Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57844 *** Vuln: Adobe Flash Player CVE-2013-0633 Buffer Overflow Vulnerability *** --------------------------------------------- Adobe Flash Player CVE-2013-0633 Buffer Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57788 *** Vuln: Adobe Flash Player CVE-2013-0634 Remote Memory Corruption Vulnerability *** --------------------------------------------- Adobe Flash Player CVE-2013-0634 Remote Memory Corruption Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57787 *** Vuln: cURL/libcURL Curl_sasl_create_digest_md5_message() Stack Buffer Overflow Vulnerability *** --------------------------------------------- cURL/libcURL Curl_sasl_create_digest_md5_message() Stack Buffer Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57842 *** Is it Spam or Is it Malware?, (Fri, Feb 8th) *** --------------------------------------------- Does anyone have a friend that regularly still sends you crap via email that usually includes a link or some pics. We are all IT security professionals here and know the preachers drill on this topic. Really, we do not like wasting our time on the junk that is sent to us. Delete, Delete, Delete. BUT, we are also human. We are the weakest link! So, today that one friend sends something over to us. This friend has a great knack for sending water cooler stuff that can warrant a look --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15121&rss *** Vuln: Multiple TLS And DTLS Implementations CVE-2013-0169 Information Disclosure Vulnerability *** --------------------------------------------- Multiple TLS And DTLS Implementations CVE-2013-0169 Information Disclosure Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57778 *** VMWare Advisories (ESX, Workstation, Fusion...) http://www.vmware.com/security/advisories/VMSA-2013-0002.html, (Fri, Feb 8th) *** --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15124&rss

1 0

Tageszusammenfassung - Donnerstag 7-02-2013
by Daily end-of-shift report 07 Feb '13

07 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 06-02-2013 18:00 − Donnerstag 07-02-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Bugtraq: Cisco Security Advisory: Cisco ATA 187 Analog Telephone Adaptor Remote Access Vulnerability *** --------------------------------------------- Cisco Security Advisory: Cisco ATA 187 Analog Telephone Adaptor Remote Access Vulnerability --------------------------------------------- http://www.securityfocus.com/archive/1/525591 *** WordPress CommentLuv 2.92.3 Cross Site Scripting *** --------------------------------------------- Topic: WordPress CommentLuv 2.92.3 Cross Site Scripting Risk: Low Text:Advisory ID: HTB23138 Product: CommentLuv WordPress plugin Vendor: Andy Bailey Vulnerable Version(s): 2.92.3 and probably pr... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/hGxikOAUsIU/WLB-20… *** WordPress Wysija Newsletters 2.2 SQL Injection *** --------------------------------------------- Topic: WordPress Wysija Newsletters 2.2 SQL Injection Risk: Medium Text:Advisory ID: HTB23140 Product: Wysija Newsletters WordPress plugin Vendor: Wysija Vulnerable Version(s): 2.2 and probably pr... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/XJ6UhJjgxu4/WLB-20… *** [webapps] - Netgear DGN1000B - Multiple Vulnerabilities *** --------------------------------------------- Netgear DGN1000B - Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/24464 *** [dos] - Cool PDF Reader 3.0.2.256 Buffer Overflow *** --------------------------------------------- Cool PDF Reader 3.0.2.256 Buffer Overflow --------------------------------------------- http://www.exploit-db.com/exploits/24463 *** Vuln: Google Chrome 24.0.1312.57 HTTP Authentication Security Bypass Weakness *** --------------------------------------------- Google Chrome 24.0.1312.57 HTTP Authentication Security Bypass Weakness --------------------------------------------- http://www.securityfocus.com/bid/57790 *** Intel Network Card (82574L) Packet of Death, (Wed, Feb 6th) *** --------------------------------------------- An interesting blog post by Kristian Kielhofer describes how a specific SPI packet can kill an Intel Gigabit ethernet card [1]. If a card is exposed to this traffic, the system has to be physically power cycled. A reboot will not recover the system. The network card crashed whenever the value 0x32 or 0x33 was found at offset 0x47f. Kristian first noticed this happening for specific SIP packets, but in the end, it turned out that any packet with 0x32 at 0x47f caused the crash. Intel traced the --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15109&rss *** Microsoft, Symantec Hijack 'Bamital' Botnet *** --------------------------------------------- Microsoft and Symantec said Wednesday that have teamed up to seize control over the "Bamital" botnet, a multi-million dollar crime machine that used malicious software to hijack search results. The two companies are now using that control to alert hundreds of thousands of users whose PCs remain infected with the malware.Related Posts:Microsoft Issues Fix for Zero-Day IE FlawAdobe, Microsoft Ship Critical Security UpdatesPolish Takedown Targets 'Virut' BotnetMicrosoft --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/ZnTidLd2mjU/

1 0

Tageszusammenfassung - Mittwoch 6-02-2013
by Daily end-of-shift report 06 Feb '13

06 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 05-02-2013 18:00 − Mittwoch 06-02-2013 18:00 Handler: Robert Waldner Co-Handler: Matthias Fraidl *** Sicherheitsalarm für D-Link-Router *** --------------------------------------------- In den Modellen DIR-300 und DIR-600 klafft eine kritische Sicherheitslücke, durch die Angreifer beliebige Befehle mit Root-Rechten ausführen können -- bei vielen Systemen sogar aus dem Internet. Und der Hersteller will das Problem nicht beseitigen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/284304da/l/0L0Sheise0Bde0Cmel… *** Wordpress wp-forum plugin SQL Injection *** --------------------------------------------- Topic: Wordpress wp-forum plugin SQL Injection Risk: Medium Text: ## # Exploit Title : Wordpress wp-forum plugin SQL Injection # # Exploit Author : Ashiyane Digital Security Team # # s... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Il59FzJa50U/WLB-20… *** Maximal 9999 Bugs: CVE-Projekt stellt Zählweise um *** --------------------------------------------- Da in den nächsten Jahren mehr als rund 10.000 offiziell gezählte Bugs beim Common-Vulnerabilities-and-Exposures-Projekt zu erwarten sind, soll die mögliche Zahl auf 999.999 pro Jahr erhöht werden. Drei neue Zählweisen sind im Gespräch. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2848af79/l/0L0Sheise0Bde0Cmel… *** Scheinfirma signiert Malware *** --------------------------------------------- Trojaner sind schon an sich ein Ärgernis - ausgestattet mit gültigen Zertifikaten, können sie sich einfacher bei ihren Opfern einschleichen. Nun soll ein Fall aufgetreten sein, bei der über die Anmeldung einer Scheinfirma Zertifikate erworben wurden. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/284aaf95/l/0L0Sheise0Bde0Cmel… *** Bugtraq: SQL Injection Vulnerability in Wysija Newsletters WordPress Plugin *** --------------------------------------------- SQL Injection Vulnerability in Wysija Newsletters WordPress Plugin --------------------------------------------- http://www.securityfocus.com/archive/1/525585 *** Cisco ATA 187 Analog Telephone Adaptor Remote Access Vulnerability *** --------------------------------------------- Please give us your feedback on Cisco Security Intelligence Operations. Thanks! Cisco ATA 187 Analog Telephone Adaptor firmware versions 9.2.1.0 and 9.2.3.1 contain a vulnerability that could allow an unauthenticated, remote attacker to access the operating system of the affected device.Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available.This advisory is available at the following link: --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Security Advisory&vs_cat=Security Intelligence&vs_type=RSS&vs_p=Cisco ATA 187 Analog Telephone Adaptor Remote Access Vulnerability&vs_k=1 *** Bugtraq: Cross-Site Scripting (XSS) Vulnerability in CommentLuv WordPress Plugin *** --------------------------------------------- Cross-Site Scripting (XSS) Vulnerability in CommentLuv WordPress Plugin --------------------------------------------- http://www.securityfocus.com/archive/1/525587 *** Kaspersky-Update legt XP-Rechner lahm *** --------------------------------------------- In der Nacht von Montag auf Dienstag lieferte Kaspersky ein fehlerhaftes Signatur-Update aus, das zahlreiche XP-Rechner weitgehend lahmlegte. Der Fehler stellte den Web-Schutz offenbar so scharf, dass die Kaspersky-Produkte fast alle Versuche zum Aufbau interner und externer Netzverbindungen schweigend blockierten. Zudem produzierte der Virenscanner maximale Systemlast, sobald Anwender ein Browser-Fenster öffneten. --------------------------------------------- http://www.heise.de/meldung/Kaspersky-Update-legt-XP-Rechner-lahm-1799114.h…

1 0

Tageszusammenfassung - Dienstag 5-02-2013
by Daily end-of-shift report 05 Feb '13

05 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 04-02-2013 18:00 − Dienstag 05-02-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Unlucky for you: UK crypto-duo crack HTTPS in Lucky 13 attack *** --------------------------------------------- OpenSSL patch to protect against TLS decryption boffinry Two scientists say they have identified a new weakness in TLS, the encryption system used to safeguard online shopping, banking and privacy. The design flaw, revealed today, could be exploited to snoop on passwords and other sensitive information sent by users to HTTPS websites.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/02/04/unlucky_13_… *** Bugtraq: ESA-2013-002: RSA Archer® GRC Multiple Vulnerabilities *** --------------------------------------------- ESA-2013-002: RSA Archer® GRC Multiple Vulnerabilities --------------------------------------------- http://www.securityfocus.com/archive/1/525541 *** Nagios XI 2012R1.5b XSS & Command Execution & SQL Injection & CSRF *** --------------------------------------------- Topic: Nagios XI 2012R1.5b XSS & Command Execution & SQL Injection & CSRF Risk: Medium Text:Reflected XSS: Alert Cloud Component: Example URL: http://nagiosxiserver/nagiosxi/includes/components/alertcloud/index.php?w... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/4q2noPJRt1M/WLB-20… *** [webapps] - Cisco Unity Express Multiple Vulnerabilities *** --------------------------------------------- Cisco Unity Express Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/24449 *** Vuln: Oracle E-Business Suite CVE-2013-0390 Remote Security Vulnerability *** --------------------------------------------- Oracle E-Business Suite CVE-2013-0390 Remote Security Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57419 *** Bugtraq: APPLE-SA-2013-02-04-1 OS X Server v2.2.1 *** --------------------------------------------- APPLE-SA-2013-02-04-1 OS X Server v2.2.1 --------------------------------------------- http://www.securityfocus.com/archive/1/525572 *** Crooks, think your Trojan looks legit? This one has a DIGITAL CERTIFICATE *** --------------------------------------------- CA defends issuing digital seal to Brazilian swindlers Security researchers have discovered a banking Trojan that comes with its own built-in digital certificate.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/02/05/digitally_s…

1 0

Tageszusammenfassung - Montag 4-02-2013
by Daily end-of-shift report 04 Feb '13

04 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 01-02-2013 18:00 − Montag 04-02-2013 18:00 Handler: Stephan Richter Co-Handler: L. Aaron Kaplan *** VMware vSphere security updates for the authentication service and third party libraries (see http://www.vmware.com/security/advisories/VMSA-2013-0001.html), (Fri, Feb 1st) *** --------------------------------------------- Jim Clausing, GIAC GSE #26 jclausing --at-- isc [dot] sans (dot) edu (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15058&rss *** Twitter hacked, at least 250,000 users affected: what you can do to protect yourself *** --------------------------------------------- "Ouch. Hyperpopular microblog-type-thing Twitter is the latest web property to admit that intruders seem to have been wandering around its network for some time. Earlier this week, both the New York Times and the Wall Street Journal came out with similar revelations...." --------------------------------------------- http://nakedsecurity.sophos.com/2013/02/02/twitter-hacked-at-least-250000-u… *** EU: Meldepflicht für Banken bei Cyberattacken *** --------------------------------------------- Die EU-Kommission will wichtige Infrastruktur-Netze in der Union besser gegen Cyberattacken schützen. Mehrere Branchen sollen zur Meldung von Angriffen verpflichtet werden. Betroffen sind unter anderem Banken, Energieversorger, die Verkehrsbranche und Internetanbieter. Insgesamt sollen die Auflagen für 44.000 Unternehmen gelten. --------------------------------------------- http://futurezone.at/netzpolitik/13850-eu-meldepflicht-fuer-banken-bei-cybe… *** EU-Sicherheitsagentur ENISA erhält mehr Befugnisse *** --------------------------------------------- Vertreter des EU-Rats und des Parlaments haben sich auf ein neues Mandat für die Europäische Agentur für Netz- und Informationssicherheit (ENISA) geeinigt. Die auf Kreta angesiedelte Behörde soll künftig unter anderem Computer-Notfallteams (CERTs, Computer Emergency Response Teams) bereithalten, wie aus einer Mitteilung (PDF-Datei) des Ministerrats hervorgeht. Zudem können Mitgliedsstaaten demnächst gezielt Hilfe im Fall von Sicherheitsverletzungen oder beim Verdacht auf kompromittierte Systeme anfordern. --------------------------------------------- http://www.heise.de/meldung/EU-Sicherheitsagentur-ENISA-erhaelt-mehr-Befugn… http://www.consilium.europa.eu/uedocs/cms_data/docs/pressdata/en/trans/1351… *** Typing These 8 Characters Will Crash Almost Any App On Your Mountain Lion Mac *** --------------------------------------------- An anonymous reader writes "All software has bugs, but this one is a particularly odd one. If you type "File:///" (no quotes) into almost any app on your Mac, it will crash. The discovery was made recently and a bug report was posted to Open Radar. First off, it's worth noting that the bug only appears to be present in OS X Mountain Lion and is not reproducible in Lion or Snow Leopard. That's not exactly good news given that this is the latest release of Apple's... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/T12UqX_DPZo/story01.htm *** Critical Java Update Fixes 50 Security Holes *** --------------------------------------------- Oracle Corp. has issued an update for its Java SE software that plugs at least 50 security holes in the software, including one the company said was actively being exploited in the wild.Related Posts:Correction to Java Update StoryJava Security Update Scrubs 14 FlawsOracle Ships Critical Security Update for JavaJava Patch Plugs 17 Security HolesJava 6 Update 24 Plugs 21 Security Holes... --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/B737Gp7Fig8/ *** Doctor Web: 2012 Virus Activity Overview *** --------------------------------------------- January 14, 2013 The company Doctor Web is pleased to present its 2012 virus activity overview. Above all, the past year was marked by the largest-ever epidemic of the Trojan Backdoor.Flashback.39 for Mac OS. This event shook the world community and greatly undermined consumer faith in the "invulnerability" of the Apple operating system. In addition, the number of Trojan-encoder modifications and infections increased significantly over the past twelve months. One of the largest... --------------------------------------------- http://news.drweb.com/show/?i=3215&lng=en&c=9

1 0

Tageszusammenfassung - Freitag 1-02-2013
by Daily end-of-shift report 01 Feb '13

01 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 31-01-2013 18:00 − Freitag 01-02-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Yahoo! Hack Demonstrates the Risks Posed by Third-Party Code in Cloud Computing *** --------------------------------------------- "Security firm Imperva has published its January Hacker Intelligence Initiative Report. The study, entitled Lessons Learned from the Yahoo! Hack, underscores the dangers of third-party code in cloud computing...." --------------------------------------------- http://news.softpedia.com/news/Yahoo-Hack-Demonstrates-the-Risks-Posed-by-T… *** Apple blockiert Java-Plugin erneut *** --------------------------------------------- Die jüngste Java-Version steht nun auf der Plugin-Blockierliste von OS X. Apple verweist auf eine neuere Version von Oracle, die derzeit noch nicht erhältlich ist. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2819d5fb/l/0L0Sheise0Bde0Cmel… *** BSI warnt vor virenverseuchten ELSTER-Steuerbescheiden *** --------------------------------------------- Cyber-Kriminelle haben eine neue Masche entdeckt, um Malware unter das Volk zu bringen.Sie behaupten, der schädliche Anhang sei vom Finanzamt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2819d5f9/l/0L0Sheise0Bde0Cmel… *** Largest cyber security exercise "Cyber Europe 2012" report published in 23 languages *** --------------------------------------------- "ENISA has published the new report of the largest ever pan-Europe cyber security exercise, Cyber Europe 2012, which is available in 23 languages. Almost 600 individual players participated, including actors from the private sector (financial, telecom and Internet), for the first time. The conclusion: for fast and effective response to cyber incidents, knowledge of procedures and information flows is crucial...." --------------------------------------------- https://www.enisa.europa.eu/media/press-releases/largest-cyber-security-exe… *** Wordpress simple-shout-box Plugin SQL Injection *** --------------------------------------------- Topic: Wordpress simple-shout-box Plugin SQL Injection Risk: Medium Text:# Exploit Title: wordpress-simple-shout-box Plugin SQL Injection # Google Dork: inurl:wp-content/plugins/wordpress-simple-shou... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/zqhX_F2Yo-Y/WLB-20… *** Wordpress portfolio-slideshow-pro v3 Plugin SQL Injection *** --------------------------------------------- Topic: Wordpress portfolio-slideshow-pro v3 Plugin SQL Injection Risk: Medium Text:# Exploit Title: Wordpress portfolio-slideshow-pro v3 Plugin SQL Injection # Google Dork: inurl:wp-content/plugins/portfolio-... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/d9I9Cwtp2QI/WLB-20… *** Vuln: Squid cachemgr.cgi Incomplete Fix Remote Denial of Service Vulnerability *** --------------------------------------------- Squid cachemgr.cgi Incomplete Fix Remote Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57646 *** FreeBSD 9.1 ftpd Remote Denial of Service *** --------------------------------------------- Topic: FreeBSD 9.1 ftpd Remote Denial of Service Risk: Medium Text:FreeBSD 9.1 ftpd Remote Denial of Service Maksymilian Arciemowicz http://cxsecurity.org/ http://cxsec.org/ Public Date: 0... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/gHoxPhhFEEc/WLB-20… *** Wordpress wp-table-reloaded plugin cross-site scripting in SWF *** --------------------------------------------- Topic: Wordpress wp-table-reloaded plugin cross-site scripting in SWF Risk: Low Text:# Exploit Title: Wordpress wp-table-reloaded plugin cross-site scripting in SWF # Release Date: 24/01/13 # Author: hip [Insig... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Y1QTuWd0xI0/WLB-20… *** FreeBSD/GNU ftpd remote denial of service exploit *** --------------------------------------------- Topic: FreeBSD/GNU ftpd remote denial of service exploit Risk: Medium Text: --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/eYD2LcbgKzE/WLB-20… *** Facebook spam leads to Exploit Kit *** --------------------------------------------- To no wonders, the Blackhole Exploit Kit is still trying to infect users. One of the techniques commonly used is to send the victim an email from for example Facebook, Linkedin, Twitter, ... . Asking to click on a link. We'll take a small peek at those tactics. We received the following email: Hi , You [...] --------------------------------------------- http://pandalabs.pandasecurity.com/facebook-spam-leads-to-exploit-kit/ *** Heisec-Netzwerkcheck spürt offene UPnP-Dienste auf *** --------------------------------------------- Millionen Netzwerkgeräte wie Router antworten auf UPnP-Anfragen aus dem Internet und sind damit potenziell angreifbar. Mit dem Netzwerkcheck von heise Security überprüfen Sie, ob Ihr Equipment auch dazugehört. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2821dff3/l/0L0Sheise0Bde0Cmel… *** Filthy! old! blog! bug! blamed! for! Yahoo! webmail! hijacks! *** --------------------------------------------- Unpatched WordPress flaw clears way for inbox takeovers Yahoo! webmail accounts are being hijacked by hackers exploiting an eight-month-old bug in the web giants blog, security biz Bitdefender warns. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/02/01/yahoo_webma…

1 0

Tageszusammenfassung - Donnerstag 31-01-2013
by Daily end-of-shift report 31 Jan '13

31 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 30-01-2013 18:00 − Donnerstag 31-01-2013 18:00 Handler: Robert Waldner Co-Handler: Matthias Fraidl *** Vuln: Microsoft Internet Explorer Address Bar CVE-2013-1451 URI Spoofing Vulnerability *** --------------------------------------------- Microsoft Internet Explorer Address Bar CVE-2013-1451 URI Spoofing Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57641 *** Drupal 6.x email2image Access bypass *** --------------------------------------------- Topic: Drupal 6.x email2image Access bypass Risk: High Text:View online: http://drupal.org/node/1903264 * Advisory ID: DRUPAL-SA-CONTRIB-2013-011 * Project: email2image [1] (third... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/wQ-ZcM2RY0k/WLB-20… *** Drupal 7.x Boxes Cross Site Scripting *** --------------------------------------------- Topic: Drupal 7.x Boxes Cross Site Scripting Risk: Low Text:View online: http://drupal.org/node/1903300 * Advisory ID: DRUPAL-SA-CONTRIB-2013-013 * Project: Boxes [1] (third-party... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/v1GnLRQwdfQ/WLB-20… *** Wordpress RLSWordPressSearch plugin SQL Injection *** --------------------------------------------- Topic: Wordpress RLSWordPressSearch plugin SQL Injection Risk: Medium Text: ## # Exploit Title : Wordpress RLSWordPressSearch plugin SQL Injection # # Exploit Author : Ashiyane Digital Security Te... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/uIaAqifvqpM/WLB-20… *** Vuln: Wireshark PER Dissector Denial of Service Vulnerability *** --------------------------------------------- Wireshark PER Dissector Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57622 *** Vuln: Wireshark MS-MMC Dissector Denial of Service Vulnerability *** --------------------------------------------- Wireshark MS-MMC Dissector Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57620 *** Vuln: Wireshark NTLMSSP Dissector Buffer Overflow Vulnerability *** --------------------------------------------- Wireshark NTLMSSP Dissector Buffer Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57618 *** Vuln: Wireshark DTLS Dissector Denial of Service Vulnerability *** --------------------------------------------- Wireshark DTLS Dissector Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57621 *** Schadcode in Rubys Software-Archiv *** --------------------------------------------- Gems stellen Ruby-Programmierern fertig konfektionierte Software-Pakete bereit und werden unter anderem in dem zentralen Web-Repository rubygems.org verwaltet. Vor kurzem wurde dort ein bösartiges Gem eingeschleust, das vier Konfigurationsdateien des Systems auf einen öffentlich zugänglichen Server kopiert. Betroffen ist unter anderem das Messwerkzeug Librato. Der Schadcode könne durch einen kürzlich behobenen Fehler im YAML-Parser eingeschleust werden, für den des mehrere Exploits gibt, schreiben die Betreiber des Gem-Repositorys New Relic. --------------------------------------------- http://www.heise.de/meldung/Schadcode-in-Rubys-Software-Archiv-1794663.html…

1 0

Tageszusammenfassung - Mittwoch 30-01-2013
by Daily end-of-shift report 30 Jan '13

30 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 29-01-2013 18:00 − Mittwoch 30-01-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Warnung - Erpresser-Virus fordert wieder 100 Euro von Nutzern *** --------------------------------------------- Schädling gibt vor, dass Rechner zur Verbreitung illegaler Inhalte genutzt wurde --------------------------------------------- http://text.derstandard.at/1358305035077/Erpresser-Virus-fordert-wieder-100… *** Millionen Geräte über UPnP angreifbar *** --------------------------------------------- Die Sicherheitsfirma Rapid7 hat bei einem IP-Scan unzählige netzwerkfähige Geräte gefunden, die über UPnP antworten und durch kritische Lücken angreifbar sein sollen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/28067031/l/0L0Sheise0Bde0Cmel… *** Internet-facing printers remain a huge risk *** --------------------------------------------- "Despite repeated warnings about office and home devices being accessible from the Internet when there is no good reason for them to be, every now and then someone gets the idea of using Google Search to sniff out just how many of them are there. The latest in this line is Adam Howard, a UK-based software engineer who searched for publicly accessible HP printers by using a sequence that matches with an often-used pattern for printing documents on an office or home network:He found --------------------------------------------- http://www.net-security.org/secworld.php?id=14322 *** Hintergrund: Passwort-Schutz für jeden *** --------------------------------------------- Wer den wohl gemeinten Tipps folgt und für jeden Dienst ein eigenes Passwort verwendet, braucht entweder ein fotografisches Gedächtnis oder die richtigen Tricks, um das scheinbare Chaos in den Griff zu bekommen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/280ca451/l/0L0Sheise0Bde0Csec… *** Opera-Update schließt Sicherheitslücken *** --------------------------------------------- Version 12.13 des Desktop-Browsers beseitigt einige SIcherheitsrisiken. Benutzer berichten jedoch von Abstürzen beim Update. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/280df642/l/0L0Sheise0Bde0Cmel… *** Aktuelle VLC-Version mit kritischer Lücke *** --------------------------------------------- Durch einen Fehler im ASF-Muxer kann Schadcode auf den Rechner gelangen. Nicht nur durch das öffnen verseuchter Mediendateien, sondern auch beim Surfen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/280eb6db/l/0L0Sheise0Bde0Cmel…

1 0

Tageszusammenfassung - Dienstag 29-01-2013
by Daily end-of-shift report 29 Jan '13

29 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 28-01-2013 18:00 − Dienstag 29-01-2013 18:00 Handler: Robert Waldner Co-Handler: n/a *** After silence on Java flaws, Oracle now says it cares *** --------------------------------------------- "Oracle wants to you to know it is on the job when it comes to Java security. Two weeks after the U.S. government told users to disable Java in their browsers (and Apple did so automatically for Mac users) because of serious security flaws, the company is now reaching out to developers and users about this embarrassing problem. In recent blog posts and during a conference with JUG (Java User Group) leaders on Friday, Oracle has tried to convey the message that it cares about Java --------------------------------------------- http://www.infoworld.com/t/java-programming/after-silence-java-flaws-oracle… *** iOS 6.1 Released, (Mon, Jan 28th) *** --------------------------------------------- Apple today released iOS 6.1 as well as an update for Apple TV (5.2). No details about the security content have been posted yet, but we expect it to show up in a day or so at the usual location [1]. There appears to be however one interesting security related change: As in other upgrades, after upgrading to iOS 6.1, you will be asked to activate your device again by logging into your Apple iCloud account. This time around however, you will be asked to setup password recovery questions unless --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15022&rss *** Browser-hijacking malware talks to attackers using SPF email validation protocol *** --------------------------------------------- "A new Trojan program that displays rogue advertisements during browsing sessions uses a DNS-based email validation protocol called the Sender Policy Framework (SPF) in order to receive instructions from attackers without being detected, according to security researchers from Symantec. The new malware is called Trojan. Spachanel and its purpose is to inject malicious JavaScript code into every Web page opened on infected computers, Symantec researcher Takashi Katsuki said Friday in a blog --------------------------------------------- http://www.computerworld.com.au/article/452057/browser-hijacking_malware_ta… *** Vuln: ZoneMinder Remote Multiple Arbitrary Command Execution Vulnerabilities *** --------------------------------------------- ZoneMinder Remote Multiple Arbitrary Command Execution Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/57544 *** Fortinet FortiMail IBE Appliance Application Filter Bypass *** --------------------------------------------- Topic: Fortinet FortiMail IBE Appliance Application Filter Bypass Risk: Medium Text:Title: Fortinet FortiMail 400 IBE - Multiple Web Vulnerabilities Date: == 2013-01-23 References: == http... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/UZi8QdV4Kiw/WLB-20… *** Weitere kritische Lücke in Ruby on Rails geschlossen *** --------------------------------------------- Das Ruby-Entwicklerteam hat eine sehr kritische Lücke in dem Web-Framework Ruby on Rails (RoR) geschlossen, durch die ein Angreifer Code in den Server einschleusen kann. Wer einen Server mit RoR betreibt, sollte umgehend handeln, da bereits passende Exploits kursieren. Betroffen sind die RoR-Versionen 2.3 und 3.0; Abhilfe schafft ein Update auf 3.0.20 und 2.3.16. Außerdem gibt es Patches. --------------------------------------------- http://www.heise.de/meldung/Weitere-kritische-Luecke-in-Ruby-on-Rails-gesch… *** Bugtraq: [SE-2012-01] An issue with new Java SE 7 security features *** --------------------------------------------- [SE-2012-01] An issue with new Java SE 7 security features --------------------------------------------- http://www.securityfocus.com/archive/1/525469 *** [dos] - Apple Quick Time Player (Windows) Version 7.7.3 Out of Bound Read *** --------------------------------------------- Apple Quick Time Player (Windows) Version 7.7.3 Out of Bound Read --------------------------------------------- http://www.exploit-db.com/exploits/24437

1 0

Tageszusammenfassung - Montag 28-01-2013
by Daily end-of-shift report 28 Jan '13

28 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 25-01-2013 18:00 − Montag 28-01-2013 18:00 Handler: Robert Waldner Co-Handler: n/a *** Trojanized SSH Daemon In the Wild, Sending Passwords To Iceland *** --------------------------------------------- An anonymous reader writes "It is no secret that SSH binaries can be backdoored. It is nonetheless interesting to see analysis of real cases where a trojanized version of the daemon are found in the wild. In this case, the binary not only lets the attacker log onto the server if he has a hardcoded password, the attacker is also granted access if he/she has the right SSH key. The backdoor also logs all username and passwords to exfiltrate them to a server hosted in Iceland." Read --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/FyP3h7-iIkU/story01.htm *** GitHubs new search reveals passwords and private keys *** --------------------------------------------- "GitHub, the popular online source code repository, has unveiled on Wednesday a new search infrastructure that should help coders find specific code within the millions of the individual repositories GitHub hosts. But, as helpful as this tool promises to be, it can still be misused. And unfortunately, it didnt take long to prove that, as only hours later a number of individuals realized that quite a few careless coders inadvertently published their private encryption keys or their --------------------------------------------- http://www.net-security.org/secworld.php?id=14305 *** WordPress SolveMedia 1.1.0 Cross Site Request Forgery *** --------------------------------------------- Topic: WordPress SolveMedia 1.1.0 Cross Site Request Forgery Risk: Low Text:# Exploit Title: WordPress SolveMedia 1.1.0 CSRF Vulnerability # Release Date: 24/01/13 # Author: Junaid Hussain - [ illSecur... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/ofsYN2kHetM/WLB-20… *** Common Sense Guide to Mitigating Insider Threats - Best Practice 11 (of 19) *** --------------------------------------------- "Hello, this is Todd Lewellen, Cybersecurity Threat and Incident Analyst for the CERT Program, with the eleventh of 19 blog posts that describe the best practices fully documented in the fourth edition of the Common Sense Guide to Mitigating Insider Threats. The CERT Program announced the public release of the fourth edition of the Common Sense Guide to Mitigating Insider Threats on December 12, 2012. The guide describes 19 practices that organizations should implement across the --------------------------------------------- http://www.cert.org/blogs/insider_threat/2013/01/common_sense_guide_to_miti… *** 34th IEEE Symposium on Security & Privacy *** --------------------------------------------- "The 2013 Symposium will mark the 34th annual meeting of this flagship conference. Since 1980, the IEEE Symposium on Security and Privacy has been the premier forum for presenting developments in computer security and electronic privacy, and for bringing together researchers and practitioners in the field. The Symposium will be held on May 19-22 2013 in San Francisco, California...." --------------------------------------------- http://www.ieee-security.org/TC/SP2013/ *** HP JetDirect Vulnerabilities Discussed, (Sun, Jan 27th) *** --------------------------------------------- On a slow day in the cyber security world here at ISC I wanted to open a discussion of the recent review of vulnerabilities in the HP JetDirect software by researcher Sebastin Guerrero (English translation is available here). I have performed audits in highly monitored environments, where change control and secure baselines were the law of the land, and still find known and documented vulnerabilities in the printer environment. Even in highly developed enterprise security groups the printer --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15016&rss *** Vuln: JBoss Enterprise Application Platform Cross Site Request Forgery Vulnerability *** --------------------------------------------- JBoss Enterprise Application Platform Cross Site Request Forgery Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/54915 *** Vuln: JBoss twiddle.sh Local Information Disclosure Vulnerability *** --------------------------------------------- JBoss twiddle.sh Local Information Disclosure Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/54631 *** Vuln: JBoss Enterprise BRMS Platform JGroups Diagnostics Service Information Disclosure Vulnerability *** --------------------------------------------- JBoss Enterprise BRMS Platform JGroups Diagnostics Service Information Disclosure Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/54183 *** [TYPO3-announce] Security issues in several third party TYPO3 extensions *** --------------------------------------------- Several vulnerabilities have been found in the following third party TYPO3 extensions: Attac Calendar (attacalendar) Attac Petition (attacpetition) Subscription (eu_subscribe) Exinit job offer (exinit_joboffer) Frontend File Browser (fefilebrowser) Javascript and Css Optimizer (js_css_optimizer) >From a csv-file to a html-table (kk_csv2table) SEO Pack for tt_news (lonewsseo) MySQL to JSON (mn_mysql2json) --------------------------------------------- http://typo3.org/support/teamssecuritysecurity-bulletins/security-bulletins… *** Awareness is not enough, says EU Commissioner Kroes days before introducing EU Cybersecurity Strategy *** --------------------------------------------- "The WEF affirmed that in the next 10 years there is a 10% likelihood of a major Critical Information Infrastructure breakdown with possible economic damages of over $250 billion. Incidents and attacks are on the rise. The big message was that cybersecurity is a matter that cannot be left to the technical people...." --------------------------------------------- http://www.diplonews.com/feeds/free/27_January_2013_62.php *** PC-Welt.de als Virenschleuder missbraucht *** --------------------------------------------- Mindestens am Freitag und Samstag vergangener Woche haben Unbekannte Malware über die Website des Magazins PC-Welt verbreitet. Nach Angaben der Betreiber ist die Site inzwischen wieder sauber. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/27fb5a7e/l/0L0Sheise0Bde0Cmel…

1 0

Tageszusammenfassung - Freitag 25-01-2013
by Daily end-of-shift report 25 Jan '13

25 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 24-01-2013 18:00 − Freitag 25-01-2013 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** Web server hackers install rogue Apache modules and SSH backdoors, researchers say *** --------------------------------------------- "A group of hackers that are infecting Web servers with rogue Apache modules are also backdooring their Secure Shell (SSH) services in order to steal login credentials from administrators and users. The hackers are replacing all of the SSH binary files on the compromised servers with backdoored versions that are designed to send the hostname, username and password for incoming and outgoing SSH connections to attacker-controlled servers, security researchers from Web security firm Sucuri --------------------------------------------- http://www.computerworld.com.au/article/451689/web_server_hackers_install_r… *** Playing chess with APTs *** --------------------------------------------- During a briefing from the top security analyst at one of the Washington-area cyber centers, I got the idea that resisting targeted attacks from sophisticated adversaries (so-called advanced persistent threats, or APTs) is a bit like playing chess at the grand master level. --------------------------------------------- http://blogs.gartner.com/dan-blum/2012/12/28/playing-chess-with-apts-2/ *** Silly gits upload private crypto keys to public GitHub projects *** --------------------------------------------- Amazing what you can find searching for BEGIN RSA PRIVATE KEY Scores of programmers uploaded their private cryptographic keys to public source-code repositories on GitHub, exposing their login credentials to world+dog. The discovery was made just before the website hit the kill switch on its search engine or, more likely, the service collapsed under the weight of curious users trawling for the sensitive data. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/01/25/github_ssh_… *** Are Cyber Criminals Using Plus-Sized Malware To Fool AV? *** --------------------------------------------- "Obesity is an epidemic in the United States. And it looks as if it may soon be a problem in malware circles, as well. After years watching malware authors pack their poison into smaller and smaller packages, one forum frequented by those seeking help with virus infections says that theyre seeing just the opposite: simple malware wrapped within obscenely large executables in one case, over 200 megabytes...." --------------------------------------------- http://securityledger.com/are-cyber-criminals-using-plus-sized-malware-to-f… *** Identifying People from their Writing Style *** --------------------------------------------- "Its called stylometry, and its based on the analysis of things like word choice, sentence structure, syntax and punctuation. In one experiment, researchers were able to identify 80% of users with a 5,000-word writing sample. More Information: -http://www...." --------------------------------------------- http://www.schneier.com/blog/archives/2013/01/identifying_peo_3.html *** Vulnerability Scans via Search Engines (Request for Logs) *** --------------------------------------------- We had a reader this week submit the following web log to us: GET /geography/slide.php?image_name=Free+gay+black+moviesslide_file= script%E2%84%91_id=0+union+select+0x3f736372aca074200372 HTTP/1.1 The request, as you can probably tell, is an attempt to detect SQL Injection and likely XSS vulnerabilities. As such, it isnt really all that special. What makes this more interesting is the fact that it came from Microsoft +http://www.bing.com/bingbot.html) Client IP Address: 157.55.52.58 This --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15010&rss *** Inside the Gozi Bulletproof Hosting Facility *** --------------------------------------------- Nate Anderson at Ars Technica has a good story about how investigators tracked down "Virus," the nickname allegedly used by a Romanian man accused by the U.S. Justice Department of running the Web hosting operations for a group that created and marketed the Gozi banking Trojan. Turns out, Ive been sitting on some fascinating details about this hosting provider for many months without fully realizing what I had.Related Posts:Three Charged in Connection with Gozi --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/u48Al_9RZnE/ *** China Accused Of Java, IE Zero Day Attacks *** --------------------------------------------- "Recently disclosed vulnerabilities in Java and Internet Explorer have been used in targeted attacks that appear to be aimed at critics of the Chinese government. Tuesday, Jindrich Kubec, director of threat intelligence for Prague-based antivirus software developer Avast, reported that multiple websites had been compromised by attackers and used to infect visitors via JavaScript drive-by attacks. If successful, the attacks infected PCs with a remote access Trojan (RAT), thus giving --------------------------------------------- http://www.informationweek.com/security/attacks/china-accused-of-java-ie-ze…

1 0

Tageszusammenfassung - Donnerstag 24-01-2013
by Daily end-of-shift report 24 Jan '13

24 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 23-01-2013 18:00 − Donnerstag 24-01-2013 18:00 Handler: Matthias Fraidl Co-Handler: Christian Wojner *** Cisco Prime LAN Management Solution Command Execution Vulnerability *** --------------------------------------------- Please give us your feedback on Cisco Security Intelligence Operations. Thanks! Cisco Prime LAN Management Solution (LMS) Virtual Appliancecontains a vulnerability that could allow an unauthenticated, remoteattacker to execute arbitrary commands with the privileges of the root user. Thevulnerability is due to improper validation of authentication andauthorization commands sent to certain TCP ports. An attackercould exploit this vulnerability by connecting to the affected systemand sending --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Security Advisory&vs_cat=Security Intelligence&vs_type=RSS&vs_p=Cisco Prime LAN Management Solution Command Execution Vulnerability&vs_k=1 *** Phisher missbrauchen URL-Weiterleitung der Arbeitsagentur *** --------------------------------------------- PayPal-Phishing ist ein alter Hut. Neu ist, dass die Phishing-Links auf Arbeitsagentur.de zeigen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/27d32215/l/0L0Sheise0Bde0Cmel… *** Megas erster Krypto-Fauxpas *** --------------------------------------------- Ein eigentlich cleveres Konzept zum Nachladen von Code entpuppt sich als potentielle Hintertür, weil dabei ungeeignete Krypto-Funktionen zum Einsatz kommen. So könnten Dritte Teile des Mega-Codes manipulieren. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/27d24431/l/0L0Sheise0Bde0Cmel… *** DNS attacks increase by 170% *** --------------------------------------------- "Radware identified a number of new attack methods representative of todays increasingly sophisticated and severe DDoS threat. Their latest report highlights server-based botnets and encrypted layer attacks as just two of the new attack tools challenging organizations during DDoS attacks. While security organizations have focused their efforts and attention on the pre and post-phases of defense, attackers now launch prolonged attacks that last days or weeks...." --------------------------------------------- http://www.net-security.org/secworld.php?id=14285 *** Most exploit kits originated in Russia, say researchers *** --------------------------------------------- "58 percent of the vulnerabilities targeted by the most popular exploit kits in Q4 were more than two years old and 70 percent of exploit kits reviewed were released or developed in Russia, reveals Solutionary SERTs Q4 2012 Quarterly Research Report. In reviewing 26 commonly used exploit kits, SERT identified exploit code dating as far back as 2004, serving as evidence that old vulnerabilities continue to prove fruitful for cyber criminals. The fact that 58 percent of the vulnerabilities --------------------------------------------- http://www.net-security.org/secworld.php?id=14286 *** Most US banks were DDoSed last year - survey *** --------------------------------------------- One in 10 banking IT bods say budget constraints an issue Nearly two-thirds of retail banks experienced at least one distributed denial of service (DDoS) attack in the past year, according to a new survey. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/01/24/ddos_survey… *** Malware - USA sind Botnet-Standort Nummer Eins *** --------------------------------------------- Mehr Zombie-Rechner-Netzwerke als in China und Russland zusammen. --------------------------------------------- http://derstandard.at/1358304537265/USA-sind-Botnet-Standort-Nummer-Eins *** Spammer entdecken WhatsApp *** --------------------------------------------- Spammer missbrauchen den beliebten Messaging-Dienst WhatsApp derzeit offenbar verstärkt als Transportmittel für ihre dubiosen Werbebotschaften. --------------------------------------------- http://www.heise.de/meldung/Spammer-entdecken-WhatsApp-1790526.html/from/at… *** New Trojan fakes search results *** --------------------------------------------- January 15, 2013 Russian anti-virus company Doctor Web is warning users about a malicious program dubbed BackDoor.Finder which fakes search result pages and redirects browsers to bogus websites. When launched in an infected system, BackDoor.Finder creates a copy of itself in the current users % APPDATA% folder and makes corresponding changes in the branch of the Windows registry responsible for application startup. After that this malware injects its code into all running processes. If it --------------------------------------------- http://news.drweb.com/show/?i=3218&lng=en&c=9 *** Backdoors Found in Barracuda Networks Gear *** --------------------------------------------- A broad variety of the latest firewall, spam filter and VPN appliances sold by Campbell, Calif. based Barracuda Networks Inc. contain undocumented backdoor accounts, the company disclosed today. Worse still, while the backdoor accounts are apparently set up so that they would only be accessible from Internet addresses assigned to Barracuda, they are in fact accessible to potentially hundreds of other companies and network owners.Related Posts:Amnesty International Site Serving Java ExploitNew --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/OyYLL3kGjlo/ *** Update-Probleme mit Microsofts Gratis-Virenscanner *** --------------------------------------------- Auf einigen Systemen aktualisieren die Microsoft Security Essentials seit einigen Tagen ihre Signatur nicht mehr selbstständig. Abhilfe schafft das manuelle Einspielen eines Signaturpakets. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/27dc0058/l/0L0Sheise0Bde0Cmel…

1 0

Tageszusammenfassung - Mittwoch 23-01-2013
by Daily end-of-shift report 23 Jan '13

23 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 22-01-2013 18:00 − Mittwoch 23-01-2013 18:00 Handler: Matthias Fraidl Co-Handler: Christian Wojner *** Have a Wi-Fi-Enabled Phone? Stores Are Tracking You *** --------------------------------------------- jfruh writes "Call it Google Analytics for physical storefronts: if youve got a phone with wi-fi, stores can detect your MAC address and track your comings and goings, determining which aisles you go to and whether youre a repeat customer. The creator of one of the most popular tracking software packages says that the addresses are hashed and not personally identifiable, but it might make you think twice about leaving your phone on when you head to the mall." Read more of this --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/RGkVUafw2-M/story01.htm *** Skype becomes a malware minefield *** --------------------------------------------- "Skype users should be careful when using the service these days. First CSIS researchers unearthed a campaign misusing Skype to replicate and spread the Shylock banking Trojan with a plugin called msg. gsm that, when it was first spotted five days ago, was detected by none of the AV solutions used by VirusTotal...." --------------------------------------------- http://www.net-security.org/malware_news.php?id=2383 *** Red October spy ring also used "Rhino" Java exploit *** --------------------------------------------- "A cyber espionage campaign that was recently unearthed by researchersused a now-patched vulnerability in Java software as another tool to exploit victims machines. Security firm Seculert published a blog post Tuesday saying that the "Red October" spy campaign, in addition to leveraging weaknesses in Microsoft Office, also spread malware by taking advantage of a Java flaw in the Rhino Script Engine, CVE-2011- 3544, fixed in October 2011. After investigating the --------------------------------------------- http://cyberwarzone.com/red-october-spy-ring-also-used-rhino-java-exploit *** Paypal.com Blind SQL Injection *** --------------------------------------------- Topic: Paypal.com Blind SQL Injection Risk: Medium Text:Title: Paypal Bug Bounty #18 - Blind SQL Injection Vulnerability Date: == 2013-01-22 References: == http... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/7mPYfOLfMHQ/WLB-20… *** DDoS Attacks as Constitutional Problem: Germanys Experience *** --------------------------------------------- "A distributed denial of service (DDoS) attack targets a computer systems resources by flooding it with requests beyond its capacity in hopes of negatively impacting its functionality. Does society consider DDoS attacks a legitimate form of protest? When an anonymously posted petition appeared on the White Houses We the People page and advocated the legalization of DDoS attacks most commentators didnt look to kindly at the idea...." --------------------------------------------- http://blog.cyveillance.com/general-cyberintel/right-to-bear-low-orbit-ion-… *** SCADA Password-Cracking Tool For Siemens S7 PLCs Released *** --------------------------------------------- FROM: Matthias Fraidl <fraidl(a)cert.at> http://www.darkreading.com/vulnerability-management/167901026/security/vuln… --------------------------------------------- /taranis/mod_assess/show_mail.pl?id=2361 *** Beware of fake Java updates *** --------------------------------------------- "Following recent security vulnerabilities in Java, malware developers are taking a new approach to exploit the Java platform by issuing false updates that pose as legitimate updates for the runtime. The latest version of the Java runtime that fixes recent vulnerabilities is update 11, and Kaspersky labs is reporting that a new malware is out that poses as "Java Update 11." The malware is packaged in a Java archive file called "javaupdate11. jar" that contains two --------------------------------------------- http://reviews.cnet.com/8301-13727_7-57565035-263/beware-of-fake-java-updat… *** Twitter flaw gave private message access to third-party apps, researcher says *** --------------------------------------------- "Users who signed into third-party Web or mobile applications using their Twitter accounts might have given those applications access to their Twitter private "direct" messages without knowing it, according to Cesar Cerrudo, the chief technology officer of security consultancy firm IOActive. The issue is the result of a flaw in Twitters API (application programming interface) that led to users not being properly informed about what permissions an application will have on their --------------------------------------------- http://www.computerworld.com/s/article/9236024/Twitter_flaw_gave_private_me… *** Multiple Vulnerabilities in Cisco Wireless LAN Controllers *** --------------------------------------------- Please give us your feedback on Cisco Security Intelligence Operations. Thanks! The Cisco Wireless LAN Controller (Cisco WLC) product family is affected by the following four vulnerabilities: Cisco Wireless LAN Controllers Wireless Intrusion Prevention System (wIPS) Denial of Service Vulnerability Cisco Wireless LAN Controllers Session Initiation Protocol Denial of Service Vulnerability Cisco Wireless LAN Controllers HTTP Profiling Remote Code Execution Vulnerability Cisco Wireless LAN --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Security Advisory&vs_cat=Security Intelligence&vs_type=RSS&vs_p=Multiple Vulnerabilities in Cisco Wireless LAN Controllers&vs_k=1 *** Three Men Charged in Connection with Gozi Trojan *** --------------------------------------------- Federal investigators are expected to announce today criminal charges against three men alleged to be responsible for creating and distributing the Gozi Trojan, an extremely sophisticated strain of malicious software that was sold to cyber crooks and was tailor-made to attack specific financial institutions targeted by each buyer. According to charging documents filed in the U.S. [...]Related Posts:New Findings Lend Credence to Project BlitzkriegU.S. Charges 37 Alleged Money Mules19 Arrested in --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/2TTqn06NSJo/ *** Summary for January 2013 - Version: 3.0 *** --------------------------------------------- With the release of the security bulletins for January 2013, this bulletin summary replaces the bulletin advance notification originally issued January 3, 2013 and the out-of-band advance notification issued January 13, 2013. --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-jan *** Vuln: Oracle MySQL Server CVE-2013-0384 Remote Security Vulnerability *** --------------------------------------------- Oracle MySQL Server CVE-2013-0384 Remote Security Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57416

1 0

Tageszusammenfassung - Dienstag 22-01-2013
by Daily end-of-shift report 22 Jan '13

22 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 21-01-2013 23:28 − Dienstag 22-01-2013 23:28 Handler: L. Aaron Kaplan Co-Handler: Christian Wojner *** Vuln: libTIFF TIFF Image CVE-2012-2088 Buffer Overflow Vulnerability *** --------------------------------------------- libTIFF TIFF Image CVE-2012-2088 Buffer Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/54270 *** First Google wants to know all about you, now it wants a RING on your finger *** --------------------------------------------- For those whove always wanted to give the web giant the finger Top Google bods are mulling over using cryptographic finger-ring gadgets and other ways for users to securely log into websites and other services. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/01/21/google_pass… *** Linksys WRT54GL CSRF Attacke *** --------------------------------------------- Linksys WRT54GL CSRF Attacke21. Jänner 2013Wir bitten um Beachtung folgender CSRF Attacke gegen den allseits beliebten und weit verbreiteten Linksys WRT54GL:http://www.securityfocus.com/archive/1/525368/30/0/threadedWir haben in Oesterreich derzeit laut Shodan mindestens 1065 betroffene Linksysen, die direkt via Internet ansprechbar sind (also mit Admin Interface auf einer public IP). Der WRT54GL ist ein Dauerrenner bei WLAN Routern und durchaus weit verbreitet. (quelle: --------------------------------------------- http://www.cert.at/services/blog/20130121222847-705.html *** The LulzSec Press Twitter Account Hacked And Exposed By Indonesian Hacker Hmei7 *** --------------------------------------------- "Indonesian hacker going by the name of Hmei7 published a document on pastebin,exposing @TheLulzSecPress, by stating they they have been stealing others hack. The document has been well organised,giving an introduction section followed by Hacking Incidents analysis,where comparison was made between original hacks of some genuine hackers and the stolen hacks by thelulzsecpress. A total of 5 issues were compared which hmei7 has been naming as FAIL NO...." --------------------------------------------- http://riduan-anonymous.blogspot.in/2013/01/the-lulzsec-press-twitter-accou… *** [SECURITY] [DSA 2611-1] movabletype-opensource security update *** Debian Security Advisory DSA-2611-1 security(a)debian.org http://www.debian.org/security/ Yves-Alexis Perez January 22, 2013 http://www.debian.org/security/faq *** Operation Red October Attackers Wielded Spear Phishing *** --------------------------------------------- "The Red October malware network is one of the most advanced online espionage operations thats ever been discovered. Thats the conclusion of Moscow-based security firm Kaspersky Lab, which first discovered Operation Red October--"Rocra" for short--in October 2012."The primary focus of this campaign targets countries in Eastern Europe, former USSR republics, and countries in Central Asia, although victims can be found everywhere, including Western Europe and North --------------------------------------------- http://www.informationweek.com/security/attacks/operation-red-october-attac… *** DHS: Industrial control systems subject to 200 attacks in 2012 *** --------------------------------------------- "A DHS report released last week revealed that industrial control systems, which are used to monitor and control critical infrastructure facilities, were hit with 198 documented cyberattacks in 2012, and that many of these attacks were serious. Forty percent of those attacks were on energy firms, according to the Industrial Control Systems (ICS) and Cyber Emergency Response Team (CERT), which reviewed every incident. Water utilities came in second, with 15 percent of the attacks focused on --------------------------------------------- http://www.homelandsecuritynewswire.com/dr20130114-dhs-industrial-control-s… *** Google bezahlt für Daten-Traffic an Orange *** --------------------------------------------- Der französische Mobilfunkbetreiber Orange hat mit Google einen Vertrag darüber geschlossen, wonach Google für den Transport der Daten des Video-Portals YouTube zahlt. Das französische Regierung will mit Google zudem über eine "Internet-Steuer" für die Sammlung persönlicher Daten verhandeln. --------------------------------------------- http://futurezone.at/b2b/13616-google-bezahlt-fuer-daten-traffic-an-orange.… *** Vuln: Cisco VPN Client for Windows CVE-2012-5429 Local Denial of Service Vulnerability *** --------------------------------------------- Cisco VPN Client for Windows CVE-2012-5429 Local Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57483 *** Spent Fuel Pool *** --------------------------------------------- Spent Fuel Pool What if I took a swim in a typical spent nuclear fuel pool? Would I need to dive to actually experience a fatal amount of radiation? How long could I stay safely at the surface? Assuming you're a reasonably good swimmer, you could probably survive treading water anywhere from 10 to 40 hours. At that point, you would black out from fatigue and drown. This is also true for a pool without nuclear fuel in the bottom.Spent fuel from nuclear --------------------------------------------- http://what-if.xkcd.com/29/ *** iOS 6 jailbreak nearly there, say iPhone hackers *** --------------------------------------------- "Two iPhone hackers hinted theyre making progress towards developing a new jailbreak for the latest version of Apples mobile operating system. One of the hackers, who goes by "@pod2g" on Twitter, said yesterday that they found two "new vulnerabilities in a day," but whats missing is an "initial code execution" for a public jailbreak. Pod2g is working with David Wang, known as "@planetbeing" on Twitter, to develop a way to remotely exploit iOS 6, --------------------------------------------- http://news.techworld.com/security/3421528/ios-6-jailbreak-nearly-there-say… *** Security researchers cripple Virut botnet *** --------------------------------------------- "Many of the domain names used by a cybercriminal gang to control computers infected with the Virut malware were disabled last week in a coordinated takedown effort, Spamhaus, an organization dedicated to fighting spam, announced Saturday. The Virut malware spreads by inserting malicious code into clean executable files and by copying itself to fixed, attached and shared network drives. Some variants also infects HTML, ASP and PHP files with rogue code that distributes the threat...." --------------------------------------------- http://www.computerworld.com/s/article/9235991/Security_researchers_cripple… *** SOL14138: XML External Entity Injection (XXE) from authenticated source CVE-2012-2997 *** --------------------------------------------- http://support.f5.com/kb/en-us/solutions/public/14000/100/sol14138.html --------------------------------------------- *** Netzpolitik - Deutschland plant Firmen-Meldepflicht für Cyber-Angriffe *** --------------------------------------------- Neuer Gesetzentwurf sieht Prüfung der Sicherheitsstandards vor --------------------------------------------- http://derstandard.at/1358304341673/Deutschland-plant-Firmen-Meldepflicht-f… *** Bugtraq: [SECURITY] [DSA 2611-1] movabletype-opensource security update *** --------------------------------------------- [SECURITY] [DSA 2611-1] movabletype-opensource security update --------------------------------------------- http://www.securityfocus.com/archive/1/525380 *** Red October closes as Kaspersky publishes more details *** --------------------------------------------- "Almost as soon as Kaspersky began publishing details about the Red October cyberespionage network, the command and control systems behind the apparently five-year-old digital spying ring began closing down. According to a posting on Kasperskys threatpost, the researchers who exposed the network on Monday say that "not only [are] the registrars killing the domains and the hosting providers killing the command-and-control servers but perhaps the attackers shutting down the whole --------------------------------------------- http://www.h-online.com/security/news/item/Red-October-closes-as-Kaspersky-… *** Vuln: Oracle MySQL Server CVE-2013-0384 Remote Security Vulnerability *** --------------------------------------------- Oracle MySQL Server CVE-2013-0384 Remote Security Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57416

1 0

Tageszusammenfassung - Montag 21-01-2013
by Daily end-of-shift report 21 Jan '13

21 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Samstag 19-01-2013 18:18 − Montag 21-01-2013 18:18 Handler: L. Aaron Kaplan Co-Handler: Christian Wojner *** Android Botnet Infects 1 Million Plus Phones *** --------------------------------------------- Trailrunner7 writes "Up to a million Android users in China could be part of a large mobile botnet, according to research unveiled by Kingsoft Security, a Hong Kong-based security company, this week. The botnet has spread across phones running the Android operating system via Android.Troj.mdk, a Trojan that researchers said exists in upwards of 7,000 applications available from non-Google app marketplaces, including the popular Temple Run and Fishing Joy games." Update: 01/19 12:54 --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/QL1JqKgnwOU/story01.htm *** In Syria, the Cyberwar Intensifies *** --------------------------------------------- "The front pages have been dominated for more than a year by photos of young Syrian rebel fighters, armed and proud, battling an increasingly isolated Syrian military. But amid the shooting, the atrocities and the bombings, there is a parallel war a sophisticated cyber insurgency battling a shadowy team working on behalf of the Assad regime. The Syrians online conflict may be the most active cyberwar in recent memory, with extraordinary efforts by both sides to sabotage, disrupt and --------------------------------------------- http://www.defensenews.com/article/20130118/C4ISR01/301180018/In-Syria-Cybe… *** Malware shuts down US power company *** --------------------------------------------- "A computer virus attacked a turbine control system at a US power company last fall when a technician unknowingly inserted an infected USB computer drive into the network, keeping a plant off line for three weeks, according to a report posted on a US government website. The Department of Homeland Security report did not identify the plant but said criminal software, which is used to conduct financial crimes such as identity theft, was behind the incident...." --------------------------------------------- http://articles.timesofindia.indiatimes.com/2013-01-17/security/36393196_1_… *** Vuln: Oracle MySQL Server Heap Overflow Vulnerability *** --------------------------------------------- Oracle MySQL Server Heap Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56768 *** Beware: malware masquerading as Java patch *** --------------------------------------------- "Opportunist hackers are capitalising on fears over Java vulnerabilities by spreading malware posing as patches for the under fire computer platform. Oracle has endured a torrid week over Javas security, having already issued Update 11 to fix critical flaw CVE-2013-0422 a threat deemed serious enough for the US Department of Homeland Security to recommend that users completely disable Java from their computers...." --------------------------------------------- http://www.itproportal.com/2013/01/18/beware-malware-masquerading-java-patc… *** Hackers Leak 1.7 GB of Data from Azerbaijans Special State Protection Service *** --------------------------------------------- "The information leaked by the hacktivists doesnt belong only to the Special State Protection Service, but also to other organizations linked to it, including ING Geneva, Sumato Energy, BNP Paribas, Taurus Petroleum and even security solutions provider Prolexic. The hackers say the files contain passport scans, reports, confidential shareholder documents, account statements, letters of credit, and details of oil drilling technologies. At the beginning of January, the hackers leaked --------------------------------------------- http://news.softpedia.com/news/Hackers-Leak-1-7-GB-of-Data-from-Azerbaijan-… *** Google zahlt Durchleitungsentgelte an Orange *** --------------------------------------------- http://www.heise.de/meldung/Google-zahlt-Durchleitungsentgelte-an-Orange-17… *** Google will Passwörter durch Ring ersetzen *** --------------------------------------------- Google testet derzeit Möglichkeiten die klassische Passworteingabe durch Hardware abzulösen. So könnte man sich zukünftig per USB-Stick in sein Google-Konto anmelden. Auch eine NFC-Lösung mittels Ring am Finger wäre für Google denkbar. --------------------------------------------- http://futurezone.at/future/13609-google-will-passwoerter-durch-ring-ersetz… *** Netzpolitik - Webadresse von Kärntner Jugendreferat führte zu Pornoseite *** --------------------------------------------- Hackerangriff vermutet - Problem mittlerweile behoben --------------------------------------------- http://derstandard.at/1358304202191/Webadresse-von-Kaerntner-Jugendreferat-… *** Shylock banking malware spreads via Skype *** --------------------------------------------- "The banking Trojan known as Shylock has been updated with new functionality, including the ability to spread over Skype. The program was discovered in 2011 that steals online banking credentials and other financial information from infected computers. Shylock, named after a character from Shakespeares "The Merchant of Venice"...." --------------------------------------------- http://thehackernews.com/2013/01/shylock-banking-malware-spreads-via.html?u… *** Arguing Against Voluntary Standards - CEOs See Provisions over Infosec Standards as Distraction *** --------------------------------------------- "The idea of the U.S. federal government and industry jointly developing IT security best practices will do little to help critical infrastructure operators defend against cyber-risk, says Business Roundtable Vice President Liz Gasster. "It makes an underlying assumption that the point of best practices will, in fact, be effective in addressing cybersecurity risk," Gasster says in an interview with Information Security Media Group. "And that while best practices are a useful --------------------------------------------- http://www.healthcareinfosecurity.com/interviews/arguing-against-voluntary-…

1 0

Tageszusammenfassung - Freitag 18-01-2013
by Daily end-of-shift report 18 Jan '13

18 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 17-01-2013 18:00 − Freitag 18-01-2013 18:00 Handler: Stephan Richter Co-Handler: Otmar Lendl *** Linksys vuln: Cisco responds *** --------------------------------------------- Working on fix for WRT54GL router Cisco has identified the Linksys router affected by the vulnerability published by DefenseCode on January 14... --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/01/17/cisco_respo… *** Anti-Spam SMTP Proxy Server 2.2.1 => Cross Site Scripting *** --------------------------------------------- Topic: Anti-Spam SMTP Proxy Server 2.2.1 => Cross Site Scripting Risk: Low Text:: + Vendor info Anti-Spam SMTP Proxy Server 2.2.1 => Cross Site Scripting (CWE-79) http://sourceforge.net/projects/assp/ ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/l6FeQIUUAbY/WLB-20… *** Vuln: Multiple SonicWALL Products CVE-2013-1359 Authentication Bypass Vulnerability *** --------------------------------------------- Multiple SonicWALL Products CVE-2013-1359 Authentication Bypass Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57445 *** Outbank 2 mit Passwort-Leck *** --------------------------------------------- Die Mac-Version der neuen Banking-Software legt das Programmkennwort in einer Standard-Logdatei ab – unverschlüsselt. Ein Update steht noch aus. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/27a7a138/l/0L0Sheise0Bde0Cmel… *** Why the Java threat rang every alarm *** --------------------------------------------- "If the IT industry had a color-coded threat-level advisory system, the alerts would have spiked to red this week -- and in a way they did when the Department of Homeland Security, no less, urged users to disable or uninstall Java because of a serious security vulnerability. Judging by the ensuing avalanche of ink (mea culpa for adding to the pileup), you might think this attack took the industry by surprise. Far from it -- as Twitter engineer and security expert Charlie Miller told... --------------------------------------------- http://www.infoworld.com/t/security/why-the-java-threat-rang-every-alarm-21… *** Bugtraq: CVE-2012-6452 Axway Secure Messenger Username Disclosure *** --------------------------------------------- CVE-2012-6452 Axway Secure Messenger Username Disclosure --------------------------------------------- http://www.securityfocus.com/archive/1/525346

1 0

Tageszusammenfassung - Donnerstag 17-01-2013
by Daily end-of-shift report 17 Jan '13

17 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 16-01-2013 18:00 − Donnerstag 17-01-2013 18:00 Handler: Stephan Richter Co-Handler: Christian Wojner *** Vuln: HP PKI ActiveX Control Denial of Service Vulnerability *** --------------------------------------------- HP PKI ActiveX Control Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/51341 *** Drupal Core 6.x / 7.x Cross Site Scripting & Access Bypass *** --------------------------------------------- Topic: Drupal Core 6.x / 7.x Cross Site Scripting & Access Bypass Risk: High Text:View online: http://drupal.org/SA-CORE-2013-001 * Advisory ID: DRUPAL-SA-CORE-2013-001 * Project: Drupal core [1] * ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Vol8aq1w-iY/WLB-20… *** Yet ANOTHER Java zero-day claimed - but this time youre laughing, right? *** --------------------------------------------- "Irrepressible cybercrime investigator and reporter Brian Krebs has written about yet another Java zero-day exploit. This one, it seems, targets an exploitable vulnerability even in Oracles most recent release, Version 7 Update 11, also known as 7u11. Details of the exploit are sketchy, because the underworld is playing this one very close to its chest...." --------------------------------------------- http://nakedsecurity.sophos.com/2013/01/17/yet-another-java-zero-day-claime… *** Heads-Up - Security Researchers Expose X-ray Machine Bug *** --------------------------------------------- "A pair of researchers best known for poking holes in industrial control systems (ICS) products found that medical devices suffer similar security woes after they were able to easily hack into a Philips x-ray machine. Terry McCorkle and Billy Rios, both of Cylance, here today demonstrated how a rudimentary fuzzer they wrote basically gave them privileged user status on the XPER x-ray machine. The machine has inherently weak remote authentication...." --------------------------------------------- http://www.darkreading.com/vulnerability-management/167901026/security/atta… *** Novell schließt gefährliche Lücke in eDirectory-Server *** --------------------------------------------- Novell hat einen Patch für seinen eDirectory-Server bereitgestellt, der einen möglichen Pufferüberlauf beseitigt. Angreifern hätte die Lücke das Erlangen von Administrator-Rechten auf dem Zielrechner ermöglicht... --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/279f3d9d/l/0L0Sheise0Bde0Cmel…

1 0

Tageszusammenfassung - Mittwoch 16-01-2013
by Daily end-of-shift report 16 Jan '13

16 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 15-01-2013 18:00 − Mittwoch 16-01-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** When Disabling IE6 (or Java, or whatever) is not an Option..., (Tue, Jan 15th) *** --------------------------------------------- Were getting a whole lot of bad advice regarding the latest crop of vulnerabilities. Folks are saying things like disable Java, or Migrate away from IE6/7/8, or even Migrate to IE10 or Firefox. While these will certainly mitigate the current vulnerability, its often not a practical way to go. If you pick the right week, almost anything could be your target disable that component - everyone has a zero day at one time or another. Specific to this weeks issues, there are lots of business... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14947&rss *** January 2013 Out-of-Band Security Bulletin Webcast, Q&A, and Slide Deck *** --------------------------------------------- Today we’re publishing the January 2013 Out-of-Band Security Bulletin Webcast Questions & Answers page. During the webcast, we fielded 17 questions focusing on Security Update MS13-088, and SecurityAdvisory 2794220 which was deprecated by this update release. All questions and answers are included in the transcript. We invite our customers to join us for the next scheduled webcast on Wednesday, February 13th at 11 a.m. PST (UTC-8), when we will go into detail about the February... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2013/01/15/january-2013-out-of-band… *** Bugtraq: Trimble® Infrastructure GNSS Series Receivers Cross Site Scripting (XSS) vulnerability *** --------------------------------------------- Trimble® Infrastructure GNSS Series Receivers Cross Site Scripting (XSS) vulnerability --------------------------------------------- http://www.securityfocus.com/archive/1/525317 *** Oracles Januar-Patches schließen 86 Lücken *** --------------------------------------------- Mit dem jetzt veröffentlichten regulären Critical Patch Update behebt Oracle unter anderem 24 Sicherheitslücken in seinen Datenbankprodukten, davon 18 in MySQL. Einige davon ließen sich übers Netz ohne Anmeldung ausnutzen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/27929ccc/l/0L0Sheise0Bde0Cmel… *** Security hotfix released for ColdFusion (APSB13-03) *** --------------------------------------------- Today, a Security Bulletin (APSB13-03) has been posted in regards to a security hotfix for Adobe ColdFusion 10, 9.0.2, 9.0.1 and 9.0 for Windows, Macintosh and UNIX. Adobe recommends users update their product installation using the instructions provided in the security bulletin. This posting is provided “AS IS” with no warranties and confers no rights. --------------------------------------------- http://blogs.adobe.com/psirt/2013/01/security-hotfix-released-for-coldfusio… *** Cisco ASA 1000V Cloud Firewall H.323 Inspection Denial of Service Vulnerability *** --------------------------------------------- Please give us your feedback on Cisco Security Intelligence Operations. Thanks! A vulnerability in Cisco Adaptive Security Appliance (ASA) Software for the Cisco ASA 1000V Cloud Firewall may cause the Cisco ASA 1000V to reload after processing a malformed H.323 message. Cisco ASA 1000V Cloud Firewall is affected when H.323 inspection is enabled.Cisco has released free software updates that address this vulnerability.This advisory is posted at the following... --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Security Advisory&vs_cat=Security Intelligence&vs_type=RSS&vs_p=Cisco ASA 1000V Cloud Firewall H.323 Inspection Denial of Service Vulnerability

1 0

Tageszusammenfassung - Dienstag 15-01-2013
by Daily end-of-shift report 15 Jan '13

15 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 14-01-2013 18:00 − Dienstag 15-01-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Bugtraq: Updated - CA20121018-01: Security Notice for CA ARCserve Backup *** --------------------------------------------- Updated - CA20121018-01: Security Notice for CA ARCserve Backup --------------------------------------------- http://www.securityfocus.com/archive/1/525303 *** Cyber Security Bulletin (SB13-014) - Vulnerability Summary for the Week of January 7, 2013 *** --------------------------------------------- "The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cyber Security Division (NCSD) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability --------------------------------------------- http://www.us-cert.gov/cas/bulletins/SB13-014.html *** DefenseCode turns up Linksys zero-day *** --------------------------------------------- World awaits patch With more than 70 million home networking devices in service, a zero-day for Linksys has a very wide reach. According to DefenseCode, an information security consultancy that’s just what turned up in a recent product evaluation for a client.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/01/14/cisco_links… *** Novell NCP Pre-Auth Remote Stack-Based Buffer Overflow *** --------------------------------------------- Topic: Novell NCP Pre-Auth Remote Stack-Based Buffer Overflow Risk: High Text: Title: Novell NCP Pre-Auth Remote Stack-Based Buffer Overflow. Author: David Klein (davi... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013010133

1 0

Tageszusammenfassung - Montag 14-01-2013
by Daily end-of-shift report 14 Jan '13

14 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 11-01-2013 18:00 − Montag 14-01-2013 18:00 Handler: Stephan Richter Co-Handler: Otmar Lendl *** Microsoft Lync Server 2010 Remote Code Execution/XSS User Agent Header *** --------------------------------------------- Topic: Microsoft Lync Server 2010 Remote Code Execution/XSS User Agent Header Risk: High Text:Summary = Microsoft Lync 2010 fails to properly sanitize user-supplied input, which can lead to remote code execution. ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013010107 *** Java SE 5/6/7 critical security issue *** --------------------------------------------- Topic: Java SE 5/6/7 critical security issue Risk: High Text:Weve recently discovered yet another security vulnerability affecting all latest versions of Oracle Java SE software. The im... --------------------------------------------- http://cxsecurity.com/issue/WLB-2012090223 *** Sysinternals Updates, (Sun, Jan 13th) *** --------------------------------------------- A handlers shift usually doesnt go by without Roseman writing in telling us that Microsoft have released another Sysinternals update and today is one of those days. A couple of days has passed since Microsoft announced: Autoruns v11.4: Autoruns v11.4 adds additional startup locations, fixes several bugs related to image path parsing, adds better support for browsing folders on WinPE, and fixes a Wow64 redirection bug. Procdump v5.12: This Procdump update fixes a bug introduced in v5.11... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14926&rss *** ICS-CERT berichtet von Viren-Infektionen bei US-Stromversorgern *** --------------------------------------------- Über USB-Sticks werden die industriellen Steuerungssysteme eines US-Stromversorgers und eines Elektrizitätswerks mit Schadsoftware infiziert. Das ICS-CERT begrenzt den Schaden. Das "Project Shine" kann auf Schwachstellen aufmerksam machen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/277bb6fc/l/0L0Sheise0Bde0Cmel… *** Microsoft to release emergency Internet Explorer patch on Monday *** --------------------------------------------- "Microsoft will release a patch on Monday for older versions of its Internet Explorer browser, deviating from its normal repair schedule due to the seriousness of the problem. The vulnerability, which is present in IE 6, 7 and 8, is a memory corruption issue. It can be exploited by an attacker via a drive-by download, a term for loading a website with attack code that delivers malware to a victims computer if the person merely visits the website...." --------------------------------------------- http://www.computerworld.com.au/article/446389/microsoft_release_emergency_… *** Vuln: Qt QSslSocket::sslErrors() Certificate Validation Security Weakness *** --------------------------------------------- Qt QSslSocket::sslErrors() Certificate Validation Security Weakness --------------------------------------------- http://www.securityfocus.com/bid/57162 *** Heads-Up - Oracle Critical Patch Update Pre-Release Announcement - January 2013 *** --------------------------------------------- "DescriptionThis Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Critical Patch Update for January 2013, which will be released on Tuesday, January 15, 2013. While this Pre-Release Announcement is as accurate as possible at the time of publication, the information it contains may change before publication of the Critical Patch Update Advisory. A Critical Patch Update is a collection of patches for multiple security vulnerabilities...." --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html *** Emergency patch for Java fails to fix cybercrime holes, warn experts *** --------------------------------------------- ORACLE released an emergency update to its Java software for surfing the Web last night, but security experts said the update fails to protect PCs from attack by hackers intent on committing cyber crimes. --------------------------------------------- http://www.independent.ie/business/technology/emergency-patch-for-java-fail…

1 0

Tageszusammenfassung - Freitag 11-01-2013
by Daily end-of-shift report 11 Jan '13

11 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 10-01-2013 18:00 − Freitag 11-01-2013 18:00 Handler: Stephan Richter Co-Handler: Christian Wojner *** European Cybercrime Centre opens for business *** --------------------------------------------- "The European Cybercrime Centre (EC3) will officially start operating on 11 January with a mission to protect European citizens and businesses from cybercrime. "Cybercriminals are smart and quick in using new technologies for criminal purposes; the EC3 will help us become even smarter and quicker to help prevent and fight their crimes" said European Commissioner for Home Affairs Cecilia Malmstrm at the launch of the EC3 project ahead of the official opening of the centre at... --------------------------------------------- http://www.h-online.com/security/news/item/European-Cybercrime-Centre-opens… *** Bugtraq: DefenseCode Security Advisory (UPCOMING): Cisco Linksys Remote Preauth 0day Root Exploit *** --------------------------------------------- DefenseCode Security Advisory (UPCOMING): Cisco Linksys Remote Preauth 0day Root Exploit --------------------------------------------- http://www.securityfocus.com/archive/1/525269 *** Bugtraq: Detailed examples of two vulnerabilities in whitelisting software: SE46 (Cryptzone) and Application Control (McAfee) *** --------------------------------------------- Detailed examples of two vulnerabilities in whitelisting software: SE46 (Cryptzone) and Application Control (McAfee) --------------------------------------------- http://www.securityfocus.com/archive/1/525268 *** What Else runs Telnets? Or, Pentesters Love Video Conferencing Units Too!, (Thu, Jan 10th) *** --------------------------------------------- As a side note to todays iSeries / Mainframe story, and a follow-up to one I wrote last year (https://isc.sans.edu/diary/12103), another thing Im seeing is more and more on telnets (tcp port 992 - https://isc.sans.edu/port.html?port=992) is voice gateway and videoconferencing unit problems. Specifically, when scanning for port tcp/992, you will likely run across more videoconferencing systems than mainframes. Theyll often show up with less fingerprinting than the SNA platforms we discussed,... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14902&rss *** HPSBMU02838 SSRT100789 rev.1 - HP Serviceguard on Linux, Remote Denial of Service (DoS) *** --------------------------------------------- https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03621178 *** TYPO3-EXT-SA-2013-001: Several vulnerabilities in third party extensions *** --------------------------------------------- Several vulnerabilities have been found in the following third-party TYPO3 extensions: news, onetimeaccount, phpunit, div2007, t3mootools, t3jquery, oneclicklogin --------------------------------------------- https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-… *** .NET-Update beeinträchtigt Windows Server 2012 *** --------------------------------------------- Ein seit Dienstag ausgeliefertes Update für die .NET-Laufzeitumgebung 4.5 führt unter Windows Server 2012 zu Problemen mit dem Failover Cluster Manager. Microsoft hat das Problem bereits bestätigt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/276e67d9/l/0L0Sheise0Bde0Cmel…

1 0

Tageszusammenfassung - Donnerstag 10-01-2013
by Daily end-of-shift report 10 Jan '13

10 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 09-01-2013 18:00 − Donnerstag 10-01-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Vuln: GE Proficy HMI/SCADA CIMPLICITY Denial of Service Vulnerability *** --------------------------------------------- GE Proficy HMI/SCADA CIMPLICITY Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57188 *** Police Arrest Alleged ZeuS Botmaster “bx1″ *** --------------------------------------------- A man arrested in Thailand this week on charges of stealing millions from online bank accounts fits the profile of a miscreant nicknamed "bx1," a hacker fingered by Microsoft as a major operator of botnets powered by the ZeuS banking trojan. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/D_NUNHSTfy8/ *** Zero-Day Java Exploit Debuts in Crimeware *** --------------------------------------------- The hackers who maintain Blackhole and Nuclear Pack – competing crimeware products that are made to be stitched into hacked sites and use browser flaws to foist malware — say they’ve added a brand new exploit that attacks a previously unknown and currently unpatched security hole in Java. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/x8J2sRZ5128/ *** Vuln: Microsoft .NET Framework CVE-2013-0004 Remote Privilege Escalation Vulnerability *** --------------------------------------------- Microsoft .NET Framework CVE-2013-0004 Remote Privilege Escalation Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57113 *** Web Application Vulnerability Statistics of 2012 *** --------------------------------------------- "With years of experience and valuable insights from our cloud based application security testing, we thought of conducting a study to discover the prevailing website vulnerability trends. The study is based on our original research on more than 5000 tests covering 300+ customers distributed globally. How was the study conducted?..." --------------------------------------------- http://www.ivizsecurity.com/blog/penetration-testing/web-application-vulner… *** Exploit für Ruby on Rails im Umlauf *** --------------------------------------------- Die Sicherheitslücke in Ruby-On-Rails erweist sich als akut gefährlich; erste Exploits sind im Umlauf und Berichte über gekaperte Web-Server laufen ein. Administratoren sollten dringend handeln. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2763d32a/l/0L0Sheise0Bde0Cmel…

1 0

Tageszusammenfassung - Mittwoch 9-01-2013
by Daily end-of-shift report 09 Jan '13

09 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 08-01-2013 18:00 − Mittwoch 09-01-2013 18:00 Handler: Stephan Richter Co-Handler: Otmar Lendl *** Serious Password Reset Hole In Accellion Secure FTP *** --------------------------------------------- chicksdaddy writes "A security researcher who was looking for vulnerabilities in Facebooks platform instead stumbled on a much larger hole that could affect scores of firms who rely on a secure file transfer platform from Accellion. Writing on his blog on Monday, Israeli researcher Nir Goldshlager said he discovered the password reset vulnerability while analyzing a Accellion deployment that is used, internally, by Facebook employees. Goldshlager used public knowledge of the Accellion... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/BpSzZxCpN3k/story01.htm *** Microsoft Updates for Multiple Vulnerabilities *** --------------------------------------------- The Microsoft Security Bulletin Summary for January 2013 describes multiple vulnerabilities in Microsoft software. Microsoft has released updates to address the vulnerabilities. --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-jan *** Adobe Security Bulletins Posted *** --------------------------------------------- Today, we released the following Security Bulletins: APSB13-01 Security updates available for Adobe Flash Player APSB13-02 Security updates available for Adobe Reader and Acrobat Customers of the affected products should consult the relevant Security Bulletin(s) for details. This posting is provided "AS IS" with no warranties and confers no rights. --------------------------------------------- http://blogs.adobe.com/psirt/2013/01/adobe-security-bulletins-posted-4.html *** Experts Identify, Analyze Botnet Used to Launch DDOS Attacks Against US Banks *** --------------------------------------------- "Researchers have been constantly analyzing the distributed denial-of-service (DDOS) attacks launched by Izz ad-Din al-Qassam Cyber Fighters against United States financial institutions but, up until now, little was known about the resources used by the hacktivists. Incapsula, a cloud-based security and acceleration service provider, has uncovered some interesting details about the cyberattacks and the botnet that powers them after noticing that the website of a new customer was... --------------------------------------------- http://news.softpedia.com/news/Experts-Identify-Analyze-Botnet-Used-to-Laun… *** Mobile Browser Security: Problem Exists Between Device and Chair *** --------------------------------------------- "Last month, a Georgia Tech study found that mobile browsers frequently left even expert users insufficient information to judge if a site was potentially dangerous, because of user interface limitations. The item that is most problematic is how SSL information is displayed. Compared to desktops, mobile browsers have far more limited ways to show if a site is using SSL...." --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/mobile-browser-s… *** Kritische Lücken in Firefox, Thunderbird und SeaMonkey geschlossen *** --------------------------------------------- Mit den jüngsten Updates haben die Entwickler zahlreiche Schwachstellen in den Mozilla-Programmen beseitigt. Man sollte daher sicherstellen, dass man jeweils die aktuelle Version nutzt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2758df0f/l/0L0Sheise0Bde0Cmel… *** First confirmed hard victim of Ruby on Rails Zero-Day Dutch DigiD Government Service. All services *** --------------------------------------------- "After having alerted on a new SQL Injection Vulnerability in Ruby on rails on 3 january, Bricade alerted on a second, even more serious, Zero Day on 8 January. The Dutch Government DigiD Service reported today 9th of January on their website that the DigiD service was not available today. See https://www...." --------------------------------------------- http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-1… *** Aktuelle Foxit-Reader-Version führt Schadcode aus *** --------------------------------------------- In Browser-Plug-in des PDF-Anzeigeprogramms klafft eine hochkritische Sicherheitslücke, weshalb man es umgehend abschalten sollte. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/275a0b01/l/0L0Sheise0Bde0Cmel… *** Cisco Security Advisory: Cisco Prime LAN Management Solution Command Execution Vulnerability *** --------------------------------------------- Advisory ID: cisco-sa-20130109-lms --------------------------------------------- Cisco Prime LAN Management Solution (LMS) Virtual Appliance contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with the privileges of the root user. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-…

1 0

Tageszusammenfassung - Dienstag 8-01-2013
by Daily end-of-shift report 08 Jan '13

08 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 07-01-2013 18:00 − Dienstag 08-01-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Bugtraq: Chrome for Android - Cookie theft from Chrome by malicious Android app *** --------------------------------------------- Chrome for Android - Cookie theft from Chrome by malicious Android app --------------------------------------------- http://www.securityfocus.com/archive/1/525222 *** Bugtraq: Chrome for Android - Android APIs exposed to JavaScript *** --------------------------------------------- Chrome for Android - Android APIs exposed to JavaScript --------------------------------------------- http://www.securityfocus.com/archive/1/525220 *** Foxit Reader <= 5.4.4.1128 npFoxitReaderPlugin.dll Stack Buffer Overflow *** --------------------------------------------- Topic: Foxit Reader --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/mNx5SSGJYF4/WLB-20… *** Drupal 6.x->7.18 getimagesize() <= Multiple Vulnerabilities *** --------------------------------------------- Topic: Drupal 6.x->7.18 getimagesize() --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/2AwbWS10dFQ/WLB-20… *** Bugtraq: Facebook for Android - Information Diclosure Vulnerability *** --------------------------------------------- Facebook for Android - Information Diclosure Vulnerability --------------------------------------------- http://www.securityfocus.com/archive/1/525223 *** Symantec plays down PGP hole *** --------------------------------------------- "Symantec has quenched fears about a vulnerability in its PGP technology. According to a Pastebin statement, the pgpwded. sys kernel driver distributed with Symantec PGP Desktop contains an arbitrary memory overwrite vulnerability in the handling of IOCTL 0x80022058...." --------------------------------------------- http://news.hitb.org/content/symantec-plays-down-pgp-hole *** ‘Value of a Hacked PC’ Graphic Goes Global *** --------------------------------------------- The Value of a Hacked PC graphic, which I published on this blog a few months ago to explain bad guy uses for your PC, is getting a makeover. I’m honored to say that the SANS Institute, a security training group, has taken the idea and run with it as an educational tool, and is in [...] --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/ehmnqBEd8q0/ *** Abgeschottetes Android für Unternehmen *** --------------------------------------------- Eine speziell angepasste Version des Mobilbetriebssystems überwacht, was der User mit seinem Gerät tun kann – basierend auf der jeweiligen Nutzungssituation. --------------------------------------------- http://www.heise.de/meldung/Abgeschottetes-Android-fuer-Unternehmen-1767696… *** Vuln: OpenIPMI ipmievd Daemon PID Files Insecure File Permissions Vulnerability *** --------------------------------------------- OpenIPMI ipmievd Daemon PID Files Insecure File Permissions Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/51036 *** Vuln: PostgreSQL Multiple Privilege Escalation and Denial of Service Vulnerabilities *** --------------------------------------------- PostgreSQL Multiple Privilege Escalation and Denial of Service Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/27163 *** ENISA Names Drive-By Exploits as Biggest Emerging Threat of 2012 *** --------------------------------------------- "The European Network and Information Security Agency (ENISA) has released its Cyber Threat Landscape analysis of 2012. The study, based on over 120 threat reports, highlights the top threats and their trends. According to the report, drive-by exploits malicious code injects used to exploit web browser vulnerabilities are the number one threat...." --------------------------------------------- http://news.softpedia.com/news/ENISA-Names-Drive-By-Exploits-as-Biggest-Eme… *** [webapps] - Advantech WebAccess HMI/SCADA Software Persistence XSS Vulnerability *** --------------------------------------------- Advantech WebAccess HMI/SCADA Software Persistence XSS Vulnerability --------------------------------------------- http://www.exploit-db.com/exploits/23968 *** Wichtiges Sicherheitsupdate für MoinMoin-Wiki *** --------------------------------------------- Das Update auf Version 1.9.6 behebt unter anderem eine kritische Schwachstelle, die bereit aktiv von Cyber-Kriminellen ausgenutzt wird. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/274e0d0f/l/0L0Sheise0Bde0Cmel… *** Payment Card Fraud in the European Union *** --------------------------------------------- "The criminal market of payment card fraud (PCF) within the European Union (EU) is dominated by well structured and globally active organised crime groups (OCGs). Criminal networks have managed to affect non-cash payments in the EU to the extent that protection measures are very expensive and need to be implemented on a global level. Consequently, the use of payment cards can be inconvenient and no longer fully secure for EU cardholders...." --------------------------------------------- https://www.europol.europa.eu/sites/default/files/publications/1public_full… *** Angriffe auf ungepatchte ColdFusion-Lücken *** --------------------------------------------- Adobe warnt davor, dass Cyber-Kriminelle durch bislang nicht geschlossene Sicherheitslöcher in ColdFusion-Server einsteigen. Ein passender Patch ist frühestens in einer Woche fertig. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/274f87d4/l/0L0Sheise0Bde0Cmel… *** Bugtraq: ESA-2013-001: EMC NetWorker Buffer Overflow vulnerability *** --------------------------------------------- ESA-2013-001: EMC NetWorker Buffer Overflow vulnerability --------------------------------------------- http://www.securityfocus.com/archive/1/525229 *** [webapps] - WordPress Plugin Google Document Embedder Arbitrary File Disclosure *** --------------------------------------------- WordPress Plugin Google Document Embedder Arbitrary File Disclosure --------------------------------------------- http://www.exploit-db.com/exploits/23970 *** Kritische Schwachstellen in Asterisk *** --------------------------------------------- Digium hat einige kritische Schwachstellen in der quelloffenen Telefonanlagen-Software Asterisk geschlossen, durch die ein Angreifer Code in den Server einschleusen kann. Bei den Lücken handelt es sich um Pufferüberläufe auf dem Stack, die über die Protokolle HTTP, SIP und XMPP ausgenutzt werden können. Nur bei XMPP ist hierzu eine aktive Sitzung nötig. --------------------------------------------- http://www.heise.de/meldung/Kritische-Schwachstellen-in-Asterisk-1779526.ht…

1 0

Tageszusammenfassung - Montag 7-01-2013
by Daily end-of-shift report 07 Jan '13

07 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 04-01-2013 18:00 − Montag 07-01-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Patch for IE Zero Day Wont Be Among Microsoft Security Updates Next Week *** --------------------------------------------- "Microsoft plans to release a pair of critical bulletins on Tuesday for its first round of 2013 monthly security updates, but still has no announcement regarding a patch for the zero day vulnerability and exploit in Internet Explorer reported over the Christmas holiday. Users are urged to apply a Fix It released Dec. 31 for the vulnerability in IE 6, 7 and 8 that was at the heart of an attack on the Council on Foreign Relations website as well as that of energy manufacturer Capstone... --------------------------------------------- http://threatpost.com/en_us/blogs/patch-ie-zero-day-wont-be-among-microsoft… *** Dutch Government Aims to Shape Ethical Hackers Disclosure Practices *** --------------------------------------------- "The Dutch governments cyber security center has published guidelines that it hopes will encourage ethical hackers to disclose security vulnerabilities in a responsible way."Persons who report an IT vulnerability have an important social responsibility," the Dutch ministry of Security and Justice said on Thursday, announcing guidelines for ethical hacking that were published by the countrys National Cyber Security Center (NCSC). White-hat hackers and security researchers play an... --------------------------------------------- http://www.cio.com/article/725400/Dutch_Government_Aims_to_Shape_Ethical_Ha… *** FreePBX 2.7.0.3 & Elastix 2.3.0 SQL injection *** --------------------------------------------- Topic: FreePBX 2.7.0.3 & Elastix 2.3.0 SQL injection Risk: Medium Text:# Exploit Title: SQL injection in FreePBX 2.7.0.3 / Elastix 2.3.0 # Google Dork: N/A # Date: 05/01/2013 # Exploit Author: S... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/DfqeYKHkuXM/WLB-20… *** pfSense 2.0.1 XSS & CSRF & Command Execution *** --------------------------------------------- Topic: pfSense 2.0.1 XSS & CSRF & Command Execution Risk: High Text: # # Exploit Title: pfSense 2.0.1 XSS & CSRF Remote root Access # Date: 04/01/2013 # Author: Yann CAM ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/1o3q8BIwTZs/WLB-20… *** MyBB Profile Wii Friend Code 1.0 Cross Site Scripting and SQL Injection *** --------------------------------------------- Topic: MyBB Profile Wii Friend Code 1.0 Cross Site Scripting and SQL Injection Risk: Medium Text:# Exploit Title: MyBB Profile Wii Friend Code SQLi/Persistent XSS # Dork: intitle:"Profile of" intext:"Wii Friend Code" inurl:... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/lZtyzTcL-Tc/WLB-20… *** BSI release Draft Cyber Security standard - PAS 555\ *** --------------------------------------------- "This PAS specifies a framework for the governance and management of cyber security risk. The requirements of this PAS define the overall outcomes of effective cyber security, and include technical, physical, cultural and behavioural measures alongside effective leadership and governance. While there are many standards and guidelines available that can help tackle cyber security risk, they tend to define good practice as to how elements of effective cyber security might be... --------------------------------------------- http://drafts.bsigroup.com/Home/Details/49890 *** Adobe ColdFusion Security Advisory, (Sat, Jan 5th) *** --------------------------------------------- Adobe released a security advisory which identifies three vulnerabilities (CVE-2013-0625, CVE-2013-0629, CVE-2013-0631) affecting ColdFusion for Windows, Macintosh and Unix. They have received reports that these vulnerabilities are actively being exploited. Adobe is currently planning to release a fix for January 15, 2013. Additional information and mitigations options available here. [1] http://www.adobe.com/support/security/advisories/apsa13-01.html ----------- Guy Bruneau IPSS Inc. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14827&rss *** Neuer Exploit für Lücke im Internet Explorer *** --------------------------------------------- Einer Sicherheitsfirma gelang es nach eigenen Angaben, Microsofts provisorischen Patch für die kritische IE-Lücke auszutricksen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2738e1e8/l/0L0Sheise0Bde0Cmel… *** Malware targets Java HTTP servers *** --------------------------------------------- "A malware that strikes at Java HTTP servers and allows attackers to gain control on underlying systems has been spotted by security researchers of anti-virus vendor Trend Micro Inc. Using a password cracking tool, cybercriminals are able to login and gain manager/administrative rights allowing the deployment of Web application archive (WAR) file packages with the backdoor to the server, according to a post last Thursday on the Trend Labs. & Once done, the backdoor can now browse, --------------------------------------------- http://www.itworldcanada.com/news/malware-targets-java-http-servers/146535 *** Symantec links latest Microsoft zero-day with skilled hacker gang *** --------------------------------------------- "Symantec is crediting a hacker group with an impressive track record as responsible for finding the latest as yet unpatched vulnerability in older versions of Microsofts Internet Explorer browser. A gang Symantec calls the Elderwood group appears to have found the latest zero-day vulnerability in IE, which can allow a malicious website to automatically infect a persons computer.[ Security expert Roger A. Grimes offers a guided tour of the latest threats and explains what you can do to... --------------------------------------------- http://www.infoworld.com/d/security/symantec-links-latest-microsoft-zero-da… *** Crimeware Author Funds Exploit Buying Spree *** --------------------------------------------- "The author of Blackhole, an exploit kit that booby-traps hacked Web sites to serve malware, has done so well for himself renting his creation to miscreants that the software has emerged as perhaps the most notorious and ubiquitous crimeware product in the Underweb. Recently, however, the author has begun buying up custom exploits to bundle into a far more closely-held and expensive exploit pack, one that appears to be fueling a wave of increasingly destructive online extortion schemes. An... --------------------------------------------- http://krebsonsecurity.com/2013/01/crimeware-author-funds-exploit-buying-sp… *** Wordpress NextGEN Gallery plugin Cross-Site Scripting Vulnerability *** --------------------------------------------- Topic: Wordpress NextGEN Gallery plugin Cross-Site Scripting Vulnerability Risk: Low Text: ## # # Exploit Title : Wordpress NextGEN Gallery plugin Cross-Site Scripting Vulnerability # # Author : IrI... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/ESFCnSJbmkU/WLB-20… *** Wordpress wilderness SQL injection *** --------------------------------------------- Topic: Wordpress wilderness SQL injection Risk: Medium Text:# Exploit Title: Wordpress wilderness SQL injection # Google Dork: inurl:/wp-content/themes/wilderness/gallery.php # Date: 20... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/6WtYRSMSzoI/WLB-20… *** Vuln: CUPS CVE-2012-5519 Local Privilege Escalation Vulnerability *** --------------------------------------------- CUPS CVE-2012-5519 Local Privilege Escalation Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56494 *** Sicherheit - Ubisofts Spieleplattform Uplay gehackt *** --------------------------------------------- Spielehersteller arbeitet bereits an Lösung und ruft zu besseren Passwörtern auf --------------------------------------------- http://derstandard.at/1356426935498/Ubisofts-Spieleplattform-Uplay-gehackt *** Google, Yahoo, Microsoft und Amazon anfällig für Clickjacking *** --------------------------------------------- Ein Sicherheitsforscher demonstriert an populären Webseiten wie Amazon, Google, Yahoo und Microsoft Live, dass viele Webseiten immer noch schlecht gegen Clickjacking geschützt sind. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/274546ad/l/0L0Sheise0Bde0Cmel…

1 0

Tageszusammenfassung - Freitag 4-01-2013
by Daily end-of-shift report 04 Jan '13

04 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 03-01-2013 18:00 − Freitag 04-01-2013 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** Apache Malware Installs Zeus *** --------------------------------------------- "The worlds most widely used web server, Apache, is a conduit to inject malicious content into web pages served by an infected Linux server, without the knowledge of the website owner. Those are the results of an analysis of a malicious Apache module, detected by ESET. They called the malware Linux/Chapro.A. Although the malware can serve practically any type of content, in this specific case it installs a variant of Win32/Zbot, malware designed to steal information from online banking --------------------------------------------- http://www.isssource.com/apache-malware-installs-zeus/ *** Bugtraq: Aastra IP Telephone encrypted .tuz configuration file leakage *** --------------------------------------------- Aastra IP Telephone encrypted .tuz configuration file leakage --------------------------------------------- http://www.securityfocus.com/archive/1/525190 *** Browser vendors rush to block fake google.com site cert *** --------------------------------------------- Turkish authoritys goof could compromise data Google and other browser vendors have taken steps to block an unauthorized digital certificate for the " *.google.com" domain that fraudsters could have used to impersonate the search giants online services. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/01/04/turkish_fak… *** Holey code, Batman! Microsoft to patch 12 vulns on Tuesday *** --------------------------------------------- Christmas zero-day flaw not included Microsoft has issued its pre Patch Tuesday report, saying it will issue seven patches fixing 12 code flaws next week but it wont provide a permanent fix for the exploit discovered during the recent holidays that is already being used in the wild. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/01/04/microsoft_p… *** Canadian Government Acknowledges Security Breach *** --------------------------------------------- "An employee of Human Resources and Skills Development Canada (HRSDC) recently misplaced an unencrypted USB drive containing sensitive data on approximately 5,000 Canadian citizens."The lost data, which was reported to the HRSDC on Nov. 17, included names, Social Insurance Numbers (similar to Social Security numbers) and other information criminals could use to defraud victims," writes TechNewsDailys Ben Weitzenkorn."The department, which handles a variety of files including --------------------------------------------- http://www.esecurityplanet.com/network-security/canadian-government-acknowl… *** Nicht zimperlich - DDoS-Attacken, gestohlene Daten: Harte Bandagen bei Lieferservices *** --------------------------------------------- Strafbefehle gegen sieben Führungskräfte von Lieferheld wegen entwendeter Datenbank eines Konkurrenten --------------------------------------------- http://derstandard.at/1356426716898/DDoS-Attacken-gestohlene-Daten-Harte-Ba… *** Over 18,000 PayPal Phishing Websites Identified in December 2012 *** --------------------------------------------- "Phishing websites, ones created by cybercriminals to harvest sensitive information from unsuspecting users, have become highly problematic lately. Because theyre so effective, crooks have launched a considerable number of sites that replicate popular companies. For instance, according to a study performed by Trend Micro for December 2012, a total of 18,947 phishing websites have been found to replicate PayPal...." --------------------------------------------- http://news.softpedia.com/news/Over-18-000-PayPal-Phishing-Websites-Identif… *** Major global Facebook Botnet taken down *** --------------------------------------------- "A fraud ring worth around 525 million has been taken out of action by the joint efforts of Facebooks own security team and local police forces in the UK, Peru, the US and a number of other countries. The gang managed to steal the massive sum from Facebook users by secretly planting spyware on victims computers that would steal credit and bank card details. Along with financial details, personal information with worth on the black market was also lifted...." --------------------------------------------- http://www.journalism.co.uk/press-releases/major-global-facebook-botnet-tak…

1 0

Tageszusammenfassung - Donnerstag 3-01-2013
by Daily end-of-shift report 03 Jan '13

03 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 02-01-2013 18:00 − Donnerstag 03-01-2013 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** BSI warnt vor Sicherheitslücke im VLC Media Player *** --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnik rät Nutzern der populären quelloffenen Videoabspielsoftware, auf die aktuelle Version 2.0.5 umzusteigen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/27218c1d/l/0L0Sheise0Bde0Cmel… *** Energy Manufacturer Also Victimized by IE Zero Day in Watering Hole Attack *** --------------------------------------------- "This weeks watering hole attack exploiting a zero-day vulnerability in Internet Explorer was not limited to the influential Council on Foreign Relations site. A Metasploit contributor said an energy manufacturers website has been serving malware related to the attack since September. Researcher Eric Romang said that Capstone Turbine Corp., which builds power generation equipment for utilities, has been infected with malware exploiting CVE 2012-4969 for four months and the latest IE --------------------------------------------- http://threatpost.com/en_us/blogs/energy-manufacturer-also-victimized-ie-ze… *** 6 Big cyber security predictions for 2013 *** --------------------------------------------- "If there is any weakness in security, you can guarantee the criminals will try to exploit it. And if a cyber criminal discovers a weakness in one community, it wont be long before that isolated crime turns into a trend. The commercialization of malware is rapidly becoming a well-organized and highly lucrative business...." --------------------------------------------- http://venturebeat.com/2013/01/02/6-big-cyber-security-predictions-for-2013/ *** Malware SNEAK dons cunning disguise, opens creaky back door to servers *** --------------------------------------------- Java-based exploit targets web-hosting servers A malicious backdoor designed to infect web servers poses a severe threat, Trend Micro warns. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/01/03/web_server_… *** A New Way of Detecting Cybersecurity Attacks *** --------------------------------------------- "Rajeev Bhargava is an acknowledged pioneer in the networking and software industry, and CEO of Toronto-based Decision Zone Inc. His career spans more than 30 years within the engineering and IT industry, and he has been closely associated with many of its major developments. Rajeev has advised many of North Americas largest organizations within the telecom, financial, high tech, military, retail, aerospace and government industries. He is the inventor of an anomaly detection solution used --------------------------------------------- http://www.digitalcommunities.com/articles/A-New-Way-of-Detecting-Cyber-Sec… *** Lücke in Ruby on Rails erlaubt SQL-Injections *** --------------------------------------------- Alle aktuellen Versionen des Fameworks Ruby on Rails sind von einer Sicherheitslücke betroffen, die das Einschleusen von beliebigem SQL-Code ermöglicht. Nutzer sollten ihre Software möglichst schnell aktualisieren. --------------------------------------------- http://www.heise.de/meldung/Luecke-in-Ruby-on-Rails-erlaubt-SQL-Injections-… *** Virenverseuchte Dia-Scanner bei Tchibo verkauft *** --------------------------------------------- Der Kaffeeröster Tchibo hat in der Vorweihnachtszeit des vergangenen Jahres einen virenverseuchten Dia-Scanner verkauft. Das Gerät wurde ab dem 11. Dezember 2012 für 60 Euro über die Filialen und den Tchibo-Onlineshop angeboten. --------------------------------------------- http://www.heise.de/meldung/Virenverseuchte-Dia-Scanner-bei-Tchibo-verkauft… *** Invasion of the Botnets *** --------------------------------------------- "Millions and millions of PCs have been silently infiltrated with bot malware, creating massive bot armies, poised to steal and inflict maximum damage when triggered by their Bot Commander. There are several botnets each comprising millions of compromised PCs, such as Zeus, Conficker, Mariposa, ZeroAccess and BredoLab, waiting for the next command from their Bot Commander, so that they can spring into action and obediently carry out their strike orders like a well-disciplined and --------------------------------------------- http://dwaterson.com/2013/01/02/invasion-of-the-botnets/ *** Cloud security to be most disruptive technology of 2013 *** --------------------------------------------- "The Security for Business Innovation Council, comprised of IT security professionals from 19 companies worldwide, called cloud computing the main disruptive force for 2013. In its report, "Information Security Shake-Up," the group said it was evident many organizations are preparing to move more business processes to the cloud. This year, it will even be "mission-critical apps and regulated data" consigned to the cloud...." --------------------------------------------- http://www.networkworld.com/news/2013/010313-cloud-security-265437.html *** Facebook-Lücke erlaubte unbemerkte Webcam-Aufnahmen *** --------------------------------------------- Rund vier Monate nachdem zwei Sicherheitsforscher eine Schwachstelle in Facebooks Video-Upload-Funktion meldeten, soll de Lücke geschlossen worden sein. Die Entdecker sind überrascht über die Höhe der von Facebook gezahlten Belohnung. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2729d37e/l/0L0Sheise0Bde0Cmel…

1 0

Tageszusammenfassung - Mittwoch 2-01-2013
by Daily end-of-shift report 02 Jan '13

02 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 28-12-2012 18:00 − Mittwoch 02-01-2013 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** Microsoft Warns of New Gaming Malware *** --------------------------------------------- "According to a recent report by Marianne Mallen of the Microsoft Malware Protection Center (MMPC), Microsoft researchers recently came across three new Trojans that specifically target Korean gamers."According to the ... MMPC, whoever is responsible for these pieces of malware is attempting to pilfer user login credentials, credit card information that is used to pay for in-game money and assorted upgrades, Korean ID numbers (a sort of Korean-variety Social Security number often --------------------------------------------- http://www.esecurityplanet.com/malware/microsoft-warns-of-new-gaming-malwar… *** Microsoft - Windows XP wird zum Sicherheitsrisiko *** --------------------------------------------- Die Zeitschrift ct warnt: "Ab 2014 kann man einen XP-Rechner nur noch in völliger Isolation betreiben" --------------------------------------------- http://text.derstandard.at/1356426331198/Windows-XP-wird-zum-Sicherheitsris… *** 29C3 - erfolgreicher Angriff auf verschlüsselnde Festplatten *** --------------------------------------------- Auch bei automatisch verschlüsselnden Festplatten (Self-Encrypting Drives, SED) können Angreifer die Daten mit wenigen Handgriffen auslesen: Der Informatiker Tilo Müller demonstrierte am Freitag auf dem 29. Hacker-Kongress des Chaos Computer Clubs (29C3) in Hamburg, wie sich die Hardware-Verschlüsselung von Desktop-Computern oder Laptops angreifen lässt. --------------------------------------------- http://www.heise.de/meldung/29C3-erfolgreicher-Angriff-auf-verschluesselnde… *** Windows 8 Will Be Harder to Hack - Security Expert *** --------------------------------------------- "Windows 8 has already been attacked by hackers who wanted to activate the operating system at no cost, but theres no doubt its one of the most secure Windows iterations released so far. And Microsoft uses this argument to promote Windows 8 with every single occasion, while security companies across the globe confirm that its harder to attack the new OS. McAfee said in its 2013 predictions report that Windows 8 may become hackers next big target, but Rapid7 CISO and Metasploit founder HD... --------------------------------------------- http://news.softpedia.com/news/Windows-8-Will-Be-Harder-to-Hack-Security-Ex… *** Bugtraq: GnuPG 1.4.12 and lower - memory access errors and keyring database corruption *** --------------------------------------------- GnuPG 1.4.12 and lower - memory access errors and keyring database corruption --------------------------------------------- http://www.securityfocus.com/archive/1/525167 *** Worst email scams of 2012 *** --------------------------------------------- "The scammers have continued to flood us with dodgy emails this year. Here are some of the worst ones weve spotted. Identity fraud and theft continues to be a big issue in the UK...." --------------------------------------------- http://www.lovemoney.com/news/scams-and-rip-offs/scams/18904/worst-email-sc… *** Provisorischer Fix für kritische Lücke im Internet Explorer *** --------------------------------------------- Im Internet Explorer bis einschließlich Version 8 klafft eine kritische Sicherheitslücke. Microsoft hat nun ein Fix-It-Tool herausgegeben, mit dem sich Nutzer der betroffenen IE-Versionen schützen können, bis ein Patch fertig ist. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/27194e91/l/0L0Sheise0Bde0Cmel… *** Piraterie - Gecrackte Apps: Neue Dienste kapern iOS auch ohne Jailbreak *** --------------------------------------------- Nachfolger von Installous könnten wesentlich mehr User erreichen --------------------------------------------- http://derstandard.at/1356426557392/Gecrackte-Apps-Neue-Dienste-kapern-iOS-…

1 0

Tageszusammenfassung - Freitag 28-12-2012
by Daily end-of-shift report 28 Dec '12

28 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 27-12-2012 18:00 − Freitag 28-12-2012 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** ICS-CERT Closes-out Two Alerts *** --------------------------------------------- "Today the folks at DHS ICS-CERT published two advisories for different systems that were based upon uncoordinated disclosures reported earlier by ICS-CERT. Actually ICS-CERT only notes that one is based upon an earlier alert, but records show that both were. The affected systems are from RuggecCom and Carlo Gavazzi Automation...." --------------------------------------------- http://chemical-facility-security-news.blogspot.nl/2012/12/ics-cert-closes-… *** RealPlayer RealMedia File Handling Buffer Overflow *** --------------------------------------------- Topic: RealPlayer RealMedia File Handling Buffer Overflow Risk: High Text:## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/bi_N1sR5TgU/WLB-20… *** Joomla bch and Content Shell Upload *** --------------------------------------------- Topic: Joomla bch and Content Shell Upload Risk: High Text: [ Joomla com_content Shell Upload Vulnerability] [x] Author : Agd_Scorp [x] Home : www.turkguvenligi.info ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/vUggqlfFDmw/WLB-20… *** Vuln: Real Networks RealPlayer Multiple Security Vulnerabilities *** --------------------------------------------- Real Networks RealPlayer Multiple Security Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/56956 Next End-of-Shift report on 2013-01-02

1 0

Tageszusammenfassung - Donnerstag 27-12-2012
by Daily end-of-shift report 27 Dec '12

27 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Freitag 21-12-2012 18:00 − Donnerstag 27-12-2012 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Vuln: Honeywell HMIWeb Browser ActiveX Control Remote Buffer Overflow Vulnerability *** --------------------------------------------- Honeywell HMIWeb Browser ActiveX Control Remote Buffer Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/55465 *** Java 7 update offers more security options *** --------------------------------------------- "A recent Java 7 update (Update 10) has added more security options that will appeal to security conscious users and businesses. A new option under the Java control panel, for example, allows users to disable Java applications from running inside their browsers by clearing the "enable Java content in the browser" checkbox. The plethora of security attacks that exploit flaws in the Java platform means that disallowing Java from browsers has long been recommended by security... --------------------------------------------- http://www.fiercecio.com/techwatch/story/java-7-update-offers-more-security… *** India Developing Its Own Secure Operating System *** --------------------------------------------- "According to The Times of India, 150 engineers from all across the country have already been working on the project for over one year and a half, but it will take another three before the operating systems can be rolled out. The director general of the DRDO has explained that India needs its own operating system to strengthen cyber security. He has emphasized that the current operating systems used in India, regardless whether theyre Windows or Linux-based, contain numerous security... --------------------------------------------- http://news.softpedia.com/news/India-Developing-Its-Own-Secure-Operating-Sy… *** Vuln: WordPress Multiple CMSMasters Themes upload.php Arbitrary File Upload Vulnerability *** --------------------------------------------- WordPress Multiple CMSMasters Themes upload.php Arbitrary File Upload Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56988 *** Hook Analyser Malware Tool 2.2 *** --------------------------------------------- "Hook Analyser is a hook tool which can be potentially helpful in reversing applications and analysing malware. It can hook to an API in a process and search for a pattern in memory or dump the buffer. Changes: The UI and modules of the project have been re-written...." --------------------------------------------- http://packetstormsecurity.org/files/119087 *** PHP-CGI Argument Injection Remote Code Execution *** --------------------------------------------- Topic: PHP-CGI Argument Injection Remote Code Execution Risk: High Text:#!/usr/bin/python import requests import sys print """ CVE-2012-1823 PHP-CGI Arguement Injection Remote Code Execution T... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/HMIGwX9uCpo/WLB-20… *** [remote] - IBM Lotus Notes Client URL Handler Command Injection *** --------------------------------------------- IBM Lotus Notes Client URL Handler Command Injection --------------------------------------------- http://www.exploit-db.com/exploits/23650 *** [remote] - Microsoft SQL Server Database Link Crawling Command Execution *** --------------------------------------------- Microsoft SQL Server Database Link Crawling Command Execution --------------------------------------------- http://www.exploit-db.com/exploits/23649 *** NVidia Display Driver Service (nvvsvc.exe) Exploit *** --------------------------------------------- Topic: NVidia Display Driver Service (nvvsvc.exe) Exploit Risk: High Text:/* NVidia Display Driver Service (Nsvr) Exploit - Christmas 2012 - Bypass DEP + ASLR + /GS + CoE = (@... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/RWnidJO9giU/WLB-20…

1 0

Tageszusammenfassung - Freitag 21-12-2012
by Daily end-of-shift report 21 Dec '12

21 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 20-12-2012 18:00 − Freitag 21-12-2012 18:00 Handler: Stephan Richter Co-Handler: L. Aaron Kaplan *** WordPress 3.4.2 Sessions Not Terminated Upon Explicit User Logout *** --------------------------------------------- Topic: WordPress 3.4.2 Sessions Not Terminated Upon Explicit User Logout Risk: Low Text:*Summary = WordPress 3.4.2 fails to invalidate a user's sessions upon logout. WordPress was originally notified of... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/m7FLRoPAp58/WLB-20… *** HPSBUX02835 SSRT100763 rev.1 - HP-UX Running BIND, Remote Domain Name Revalidation *** --------------------------------------------- https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03577598 *** Vuln: Squid cachemgr.cgi Remote Denial of Service Vulnerability *** --------------------------------------------- Squid cachemgr.cgi Remote Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56957 *** QNAP-NAS anfällig für cross-site-scripting (XSS) *** --------------------------------------------- Twitter-User @rootdial ist aufgefallen, dass in manchen Web-Anwendungen des QNAP-NAS nicht richtig geprüft wird, was übergeben wird. So ist z.B. die Photostation und die TVStation anfällig für XSS. --------------------------------------------- http://sdcybercom.wordpress.com/ *** CA20121220-01: Security Notice for CA IdentityMinder *** --------------------------------------------- CA Technologies Support is alerting customers to two potential risks in CA IdentityMinder (formerly known as CA Identity Manager). Two vulnerabilities exist that can allow a remote attacker to execute arbitrary commands, manipulate data, or gain elevated access. CA Technologies has issued patches to address the vulnerability. --------------------------------------------- https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID={FBA53B… *** VMWare posts some updates, (Fri, Dec 21st) *** --------------------------------------------- Just in the case the world doesnt come to a grinding halt today (end of Mayan calendar and all that).... .... VMWare has posted some updates that you might want to pay attention to over at:http://www.vmware.com/security/advisories/VMSA-2012-0018.html There are as many as 13 different CVEs covered in this update, so make sure, if you are affected, to patch! -- Joel Esler | http://blog.joelesler.net | http://twitter.com/joelesler (c) SANS Internet Storm Center. http://isc.sans.edu Creative --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14740&rss Next End-of-Shift report on 2012-12-27

1 0

Tageszusammenfassung - Donnerstag 20-12-2012
by Daily end-of-shift report 20 Dec '12

20 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 19-12-2012 18:00 − Donnerstag 20-12-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Sweet Orange Exploit Kit Offers Customers Higher Infection Rates *** --------------------------------------------- "The newly emerging Sweet Orange Exploit Kit boasts a 10 to 25 percent infection rate and is promising to drive 150,000 unique visitors per day to the websites of its customers, according to Jeff Doty and Chris Larsen of Blue Coat Security. If the claims of Sweet Oranges authors reflect reality, it means that users of the kit can expect to add anywhere between 15,000 and 37,500 machines to their botnet per day. Sweet Orange has 45 dedicated IP addresses and 267 unique domains, which Doty... --------------------------------------------- http://threatpost.com/en_us/blogs/sweet-orange-exploit-kit-offers-customers… *** MyBB MyYoutube Cross Site Scripting *** --------------------------------------------- Topic: MyBB MyYoutube Cross Site Scripting Risk: Low Text:# Exploit Title: MyYoutube MyBB Stored XSS # Date: 17.12.2012 # Exploit Author: limb0 # Vendor Homepage: http://www.mybb-es.... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/C8aZDfreDmo/WLB-20… *** MyBB Xbox Live ID Cross Site Scripting *** --------------------------------------------- Topic: MyBB Xbox Live ID Cross Site Scripting Risk: Low Text:# Exploit Title: Xbox Live ID MyBB Plugin Stored XSS # Date: 13/12/2012 # Exploit Author: limb0 # Vendor Homepage: http://ww... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/qUghUFk2MwE/WLB-20… *** Vuln: Cerberus FTP Server Web Admin Multiple HTML-Injection Vulnerabilities *** --------------------------------------------- Cerberus FTP Server Web Admin Multiple HTML-Injection Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/56906 *** Bugtraq: EMC Avamar: World writable cache files *** --------------------------------------------- EMC Avamar: World writable cache files --------------------------------------------- http://www.securityfocus.com/archive/1/525095 *** Apache plug-in doles out Zeus attack *** --------------------------------------------- Points victims to Sweet Orange exploit server, slurps banking credentials Anti-virus outfit Eset has discovered a malicious Apache module in the wild that serves up malware designed to steal banking credentials. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/12/20/apache_dang… *** SurgeFTP Remote Command Execution *** --------------------------------------------- Topic: SurgeFTP Remote Command Execution Risk: High Text:require msf/core class Metasploit3 --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/iwcAssIZcxo/WLB-20… *** Drupal Core 6.x & 7.x Access Bypass & Code Execution *** --------------------------------------------- Topic: Drupal Core 6.x & 7.x Access Bypass & Code Execution Risk: High Text:View online: http://drupal.org/SA-CORE-2012-004 * Advisory ID: DRUPAL-SA-CORE-2012-004 * Project: Drupal core [1] * ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/bLFpBaVeTdc/WLB-20… *** ENISA on Smart Grids: a Risk-Based Approach Is Key to Secure Implementation *** --------------------------------------------- "The European Network and Information Security Agency (ENISA) has released a new report to help smart grid providers properly secure their infrastructures against cyberattacks. The European Union hopes to achieve a 20% increase in renewable energy, a 20% reduction in CO2 emissions, and a 20% increase in energy efficiency by 2020. Smart grids can help a lot in achieving these goals, but they must be rolled out in a secure way...." --------------------------------------------- http://news.softpedia.com/news/ENISA-on-Smart-Grids-a-Risk-Based-Approach-I… *** Vuln: Zend Framework Zend_Feed Component Information Disclosure Vulnerabilities *** --------------------------------------------- Zend Framework Zend_Feed Component Information Disclosure Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/56982 *** PGP, TrueCrypt-encrypted files CRACKED by £300 tool *** --------------------------------------------- Plod at the door? Better yank out that power cable ElcomSoft has built a utility that forages for encryption keys in snapshots of a PCs memory to decrypt PGP and TrueCrypt-protected data. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/12/20/elcomsoft_t… *** Sicherheitslücke in AMDs Catalyst-Control-Center *** --------------------------------------------- Eigentlich soll das Catalyst-Control-Center von AMD helfen die Treiber für Grafikkarten so aktuell wie möglich zu halten - über ein Ausnutzen der Update-Benachrichtigung kann vermutlich ein manipulierter Treiber untergejubelt werden. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/26cbb061/l/0L0Sheise0Bde0Cmel…

1 0

Tageszusammenfassung - Mittwoch 19-12-2012
by Daily end-of-shift report 19 Dec '12

19 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 18-12-2012 18:00 − Mittwoch 19-12-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** The Only 2013 Cybersecurity Predictions List You Need to Read *** --------------------------------------------- "Please, allow me to save you some time reading all of those Top 10 Cybersecurity Threats of 2013 lists from journalists, bloggers, analysts, vendors and other crackpots. Nearly all of them will include the 10 following threats, in varying orders:The Cloud Lots of vulnerabilities out there. BYOD/Mobile malware Its a problem dealing with all these devices...." --------------------------------------------- http://blogs.cio.com/security/17647/only-2013-cybersecurity-predictions-lis… *** 1-15 December 2012 Cyber Attacks Timeline *** --------------------------------------------- "Christmas is coming quickly, we have just passed the first half of December, and hence its time for the first update of the Cyber Attacks Timeline for December. The Team GhostShell has decided to close the year with a clamorous Cyber Attack, and hence,as part of the project ProjectWhiteFox, has leaked 1. 6 million of accounts from several organizations all over the world...." --------------------------------------------- http://hackmageddon.com/2012/12/17/1-15-december-2012-cyber-attack-timeline/ *** Enterpriser16 LB 7.1 Cross Site Scripting *** --------------------------------------------- Topic: Enterpriser16 LB 7.1 Cross Site Scripting Risk: Low Text:Title: Enterpriser16 LB v7.1 - Multiple Web Vulnerabilities Date: == 2012-12-12 References: == http://ww... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Pv935OaGGFY/WLB-20… *** [webapps] - SonicWall SonicOS 5.8.1.8 WAF XSS Vulnerability *** --------------------------------------------- SonicWall SonicOS 5.8.1.8 WAF XSS Vulnerability --------------------------------------------- http://www.exploit-db.com/exploits/23498

1 0

Tageszusammenfassung - Dienstag 18-12-2012
by Daily end-of-shift report 18 Dec '12

18 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Montag 17-12-2012 18:00 − Dienstag 18-12-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Vuln: Symantec Endpoint Protection Manager CVE-2012-4348 Remote Code Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/56846 *** Vuln: Symantec Network Access Control CVE-2012-4349 Local Privilege Escalation Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/56847 *** Vuln: TWiki Multiple Security Vulnerabilities *** --------------------------------------------- TWiki Multiple Security Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/56950 *** Reminder: Java 6 end-of-live February 2013 , (Mon, Dec 17th) *** --------------------------------------------- Reader Josh reports that while downloading the latest version of Java 6 (version 37) from Oracles website he received a reminder from Oracle that Java 6 will reach end of life in February 2013. After February 2013 security updates will only be available to customer who purchase extended support contracts. If you havent already done so, now is a good time to mark your calendars for this upgrade. More details are available here: http://www.oracle.com/technetwork/java/javase/eol-135779.html --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14719&rss *** Bugtraq: IPv6 Neighbor Discovery security (new documents) *** --------------------------------------------- IPv6 Neighbor Discovery security (new documents) --------------------------------------------- http://www.securityfocus.com/archive/1/525063 *** Cyber Security Bulletin (SB12-352) - Vulnerability Summary for the Week of December 10, 2012 *** --------------------------------------------- "The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cyber Security Division (NCSD) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability... --------------------------------------------- http://www.us-cert.gov/cas/bulletins/SB12-352.html *** Carberp-in-the-Mobile found on Google Play *** --------------------------------------------- "Everybody knows (or should know) that downloading apps from third party online markets is dangerous, but even official markets such as Google Play cant be considered completely safe, as time and time again malware peddlers succeed at fooling its defenses and upload malware for download, masquerading as games and other popular apps. Kaspersky Lab researchers have recently discovered a slew of apps carrying the Carberp-in-the-Mobile (CitMo) component that allows criminals to steal mobile... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2362 *** Lookout Predicts 18 Million Android Malware Infections by End of 2013 *** --------------------------------------------- "Lookout Mobile Security recently published its mobile threat predictions for 2013, anticipating that 18 million Android users will encounter mobile malware between the beginning of 2012 and the end of 2013."The likelihood that new Lookout users will encounter malware or spyware is heavily dependent on their geography and behavior, varying from 0. 20 percent in Japan to 0. 40 percent in the US and as high as 34...." --------------------------------------------- http://www.esecurityplanet.com/mobile-security/lookout-predicts-18-million-… *** Trojan Upclicker malware infecting PCs via mouse input *** --------------------------------------------- "Windows PC owners be warned theres a new strain of malware out there that befuddles users into helping it accomplish its dirty deeds via mouse clicks. Dubbed "Trojan Upclicker" by the FireEye Malware Intelligence Lab researchers who identified it, this elusive bit of malicious code is purpose-built to evade identification by the automated analysis systems used by many anti-virus vendors. FireEye researchers Abhishek Singh and Yasir Khalid noted that Trojan Upclicker is a variant... --------------------------------------------- http://www.itproportal.com/2012/12/17/trojan-upclicker-malware-infecting-pc… *** EU to propose mandatory reporting of cyber incidents *** --------------------------------------------- "The European Union may force companies operating critical infrastructure in areas such as banking, energy and stock exchanges to report major online attacks and reveal security breaches, according to draft report by the European Commission. The European Commission is due to present a proposal on cybersecurity in February once it has received feedback from the European Parliament and EU countries. The proposal was initially announced in May for the third quarter this year but has been... --------------------------------------------- http://www.euractiv.com/infosociety/eu-propose-mandatory-reporting-c-news-5…

1 0

Tageszusammenfassung - Montag 17-12-2012
by Daily end-of-shift report 17 Dec '12

17 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Freitag 14-12-2012 18:00 − Montag 17-12-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Vuln: MyBB DyMy User Agent Plugin SQL Injection Vulnerability *** --------------------------------------------- MyBB DyMy User Agent Plugin SQL Injection Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56931 *** Bugtraq: Wordpress Pingback Port Scanner *** --------------------------------------------- Wordpress Pingback Port Scanner --------------------------------------------- http://www.securityfocus.com/archive/1/525045 *** Bugtraq: DDIVRT-2012-48 VMware View Connection Server Directory Traversal (CVE-2012-5978) *** --------------------------------------------- DDIVRT-2012-48 VMware View Connection Server Directory Traversal (CVE-2012-5978) --------------------------------------------- http://www.securityfocus.com/archive/1/525044 *** ENISA - Introduction to Return on Security Investment *** --------------------------------------------- "As for any organization, CERTs need to measure their cost-effectiveness, to justify their budget usage and provide supportive arguments for their next budget claim. But organizations often have difficulties to accurately measure the effectiveness and the cost of their information security activities. The reason for that is that security is not usually an investment that provides profit but loss prevention...." --------------------------------------------- http://www.enisa.europa.eu/activities/cert/other-work/introduction-to-retur… *** Foswiki Remote code execution and other vulnerabilities in MAKETEXT *** --------------------------------------------- Topic: Foswiki Remote code execution and other vulnerabilities in MAKETEXT Risk: High Text: + Security Alert: Code injection vulnerability in MAKETEXT macro, Denial of Service vulnerability in MAKETEXT macro. This ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/8WkKh9Nz_ZM/WLB-20… *** Eurograbber: A Smart Trojan Attack - Hackers Methods Reveal Banking Know-How *** --------------------------------------------- "The Eurograbber banking Trojan is an all-in-one hit, researchers say. It successfully compromises desktops and mobile devices, and has gotten around commonly used two-factor authentication practices in Europe. How can banking institutions defend themselves and their customers against this super-Trojan attack?..." --------------------------------------------- http://www.bankinfosecurity.com/eurograbber-smart-trojan-attack-a-5359?rf=2…

1 0

Tageszusammenfassung - Freitag 14-12-2012
by Daily end-of-shift report 14 Dec '12

14 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 13-12-2012 18:00 − Freitag 14-12-2012 18:00 Handler: Christian Wojner Co-Handler: n/a *** Internet Explorer rats out the mouse - Update *** --------------------------------------------- "Company Spider. io warns that Internet Explorer allows a users mouse position to be determined even if the mouse cursor is located outside of the browser window or the browser window isnt being displayed at all either because it is minimised or the user has switched to view another tab or window. This is potentially dangerous because it enables web pages to intercept sensitive data that is being entered via virtual keyboards and virtual keypads, say the researchers...." --------------------------------------------- http://www.h-online.com/security/news/item/Internet-Explorer-rats-out-the-m… *** Bugtraq: Addressbook v8.1.24.1 Group Name XSS *** --------------------------------------------- Addressbook v8.1.24.1 Group Name XSS --------------------------------------------- http://www.securityfocus.com/archive/1/525027 *** New Trojan attempts SMS fraud on OS X users *** --------------------------------------------- "The Russian security firm Dr. Web has uncovered another malware attempt on OS X systems that tries to exploit users with SMS fraud. The new malware is a Trojan horse, dubbed "Trojan. SMSSend...." --------------------------------------------- http://news.cnet.com/8301-1009_3-57558780-83/new-trojan-attempts-sms-fraud-… *** Apple updates OS X malware definitions for new fake-installer/SMS trojan *** --------------------------------------------- "MacRumors noted today that Apple is utilizing the automatic daily checks for malware definitions it implemented last year to block an OS X trojan horse discovered earlier this week. The trojan was originally detailed in a blog post on Dr. Web. Known as TrojanSMSSend...." --------------------------------------------- http://9to5mac.com/2012/12/13/apple-updates-os-x-malware-definitions-for-ne… *** Backdoor Found at NDIS Level *** --------------------------------------------- "It is one thing to have a piece of malware that can focus on targeted attacks, but it is quite another to have it also be nearly invisible. That is just what a variant of the Exforel backdoor malware, VirTool:WinNT/Exforel. A, is able to do, said researchers at Microsofts Malware Protection Center...." --------------------------------------------- http://www.isssource.com/backdoor-found-at-ndis-level/ *** New Attacks from Gameover Gang *** --------------------------------------------- "Millions of emails, which pose as coming from major U.S. banks, are spamming out, according to Dell SecureWorks Counter Threat Unit. The fake but convincing-looking emails appeal to a more security-minded banking customer: You have received a new encrypted message or a secure message from [XYZ] Bank, one of the email campaigns said, noting the bank has set up a secure email exchange for its customers as a way to allay privacy and security concerns. The message includes an infected --------------------------------------------- http://www.isssource.com/new-attacks-from-gameover-gang/ *** Yet another eavesdrop vulnerability in Cisco phones *** --------------------------------------------- Security groundhog day A university student presenting at the Amphion Forum has demonstrated turning a Cisco VoIP phone into a listening device, even when it's on the hook. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/12/13/cisco_voip_… *** Dexter malware targets point of sale systems worldwide *** --------------------------------------------- "You could be getting more than you bargained for when you swipe your credit card this holiday shopping season, thanks to new malware that can skim credit card info from compromised point-of-sale (POS) systems. First spotted by security firm Seculert, the malware dubbed "Dexter" is believed to have infected hundreds of POS systems in 40 countries worldwide in recent months. Companies targeted include retailers, hotel chains, restaurants, and private parking providers...." --------------------------------------------- http://www.theregister.co.uk/2012/12/14/dexter_malware_targets_pos_systems/ *** Top 7 security predictions for 2013 *** --------------------------------------------- "A seismic shift in who controls the Internet? Another Mac malware outbreak? Your smart TV being highjacked for a DDoS attack?..." --------------------------------------------- http://www.net-security.org/secworld.php?id=14120 *** [DNB] Joomla, WordPress Sites Hit by IFrame Injection Attacks *** --------------------------------------------- '....Users of the popular Joomla content management system are being urged by security experts to upgrade to the latest version after reports of exploits being used to compromise websites built on the platform......' --------------------------------------------- https://threatpost.com/en_us/blogs/joomla-wordpress-sites-hit-iframe-inject…

1 0

Tageszusammenfassung - Donnerstag 13-12-2012
by Daily end-of-shift report 13 Dec '12

13 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 12-12-2012 18:00 − Donnerstag 13-12-2012 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** Researchers uncover Tor-powered Skynet botnet *** --------------------------------------------- "Rapid7 researchers have recently unearthed an unusual piece of malware that turned out to be crucial to the formation of an elusive botnet - dubbed Skynet by the researchers - whose existence has been documented in a very popular Reddit "I Am A" thread. The Trojan in question has DDoS and Bitcoin-mining capabilities, but its main function is to steal banking credentials. The botnet operator spreads the malware via the Usenet discussion forum, which is also a popular platform for... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2357 *** "Dexter" malware steals credit card data from point-of-sale terminals *** --------------------------------------------- "A researcher has uncovered new malware that steals payment card data from point-of-sale terminals used by stores, hotels, and other businesses. Dexter, as the malware is called, has infected hundreds of point-of-sale computers at big-name retailers, hotels, restaurants, and other businesses, according to a report issued by Aviv Raff, chief technology officer of Israel-based security firm Seculert. Businesses infected in the past three months are located in 40 different countries, with 30... --------------------------------------------- http://arstechnica.com/security/2012/12/dexter-malware-steals-credit-card-d… *** New Findings Lend Credence to Project Blitzkrieg *** --------------------------------------------- "Project Blitzkrieg," a brazen Underweb plan for hiring 100 botmasters to fuel a blaze of ebanking heists against 30 U.S. financial institutions in the Spring of 2013, was met with skepticism from some in the security community after news of the scheme came to light in October. Many assumed it was a law enforcement sting, or merely the ramblings of a wannabe criminal mastermind. But new research suggests the crooks who hatched the plan were serious and have painstakingly built up a... --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/RgJgMJ51mKo/ *** Cybersecurity company using hackers own devices against them *** --------------------------------------------- "A California cybersecurity start-up, marketing itself as a private cyber intelligence agency, works to identify foreign attackers who are attempting to steal corporate secrets; it does so by using the attackers own techniques and vulnerabilities against them; the company also collects data on hackers and tricks intruders into stealing false information Shawn Henry, the head of the FBI cyber crimes division, this year left agency after twenty-four years to become the president CrowdStrike,... --------------------------------------------- http://www.homelandsecuritynewswire.com/dr20121213-cybersecurity-company-us… *** Facebook Security, FBI Take Down Butterfly Botnet, Arrest 10 *** --------------------------------------------- "Facebooks security team is being lauded by the FBI for its role the arrest of 10 individuals accused of spreading banking malware on the social networking site and collecting more than $850 million from fraudulent transactions. The arrests were carried out yesterday in the U.S., U.K., the Balkans, South America and New Zealand in connection with spreading the Yahos malware on Facebook from 2010 to this October. Yahos compromised more than 11 million computers, the FBI said...." --------------------------------------------- http://threatpost.com/en_us/blogs/facebook-security-fbi-take-down-butterfly…

1 0

Tageszusammenfassung - Mittwoch 12-12-2012
by Daily end-of-shift report 12 Dec '12

12 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 11-12-2012 18:00 − Mittwoch 12-12-2012 18:00 Handler: Matthias Fraidl Co-Handler: Christian Wojner *** First fake-installer Trojan for Mac OS *** --------------------------------------------- December 11, 2012 Russian anti-virus company Doctor Web informs users about a new Trojan for Mac OS X dubbed Trojan.SMSSend.3666. The malicious scheme used to spread this Trojan is notorious among many Windows users but until now it hasnt been employed to deceive owners of Macs. Trojan.SMSSend is a fake installer which can be downloaded from various sites under the guise of useful software. Trojan.SMSSend programs are found in large numbers on the Internet. These are fake installers available --------------------------------------------- http://news.drweb.com/show/?i=3138&lng=en&c=9 *** Web-Seiten identifizieren Besucher über deren soziale Netze *** --------------------------------------------- Der New Yorker Sumit Suman staunte nicht schlecht. Nach seinem Besuch der Web-Seiten von UberVu bekam er am nächsten Tag eine persönliche E-Mail mit Werbeangeboten der Firma. --------------------------------------------- http://www.heise.de/security/meldung/Web-Seiten-identifizieren-Besucher-ueb… *** Dezember-Patchday bei Microsoft und Adobe *** --------------------------------------------- Microsoft und Adobe haben ihre Dezember-Patchdays abgehalten und dabei zahlreiche kritische Lücke geschlossen. Während Microsoft die meisten Windows-Versionen, den Internet Explorer, Word und einige Server-Produkte abgesichert hat, gab es von Adobe Patches für den Flash Player, AIR und ColdFusion. --------------------------------------------- http://www.heise.de/security/meldung/Dezember-Patchday-bei-Microsoft-und-Ad… *** Microsoft Internet Explorer 610 Mouse Tracking *** --------------------------------------------- Topic: Microsoft Internet Explorer 610 Mouse Tracking Risk: Medium Text:Summary: Unprivileged attackers can track your system-wide mouse movements from any IE page, even when the page is unfocused o... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/GTaeIyspNpM/WLB-20… *** Samsungs smart TVs wide open to exploits *** --------------------------------------------- The downside to being more like a PC Samsungs Smart TV has a vulnerability which allows remote attackers to swipe data, according to security researchers. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/12/12/smart_tv_pw… *** Russian space research org targeted by mystery malware attack *** --------------------------------------------- Korean message forum becomes cyber-espionage hub Security researchers have discovered a targeted attack against Russian hi-tech firm that appears to originate in Korea. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/12/12/russian_cyb… *** North America and Europe Most Threatened by Money-Stealing Android Trojans *** --------------------------------------------- "If youre living in Europe or North America and if youre an Android user, the mobile malware that targets you is most likely designed to steal your money. On the other hand, if you live in Asia, youre more likely to be bombarded with aggressive adware and annoying ads. These are the results of a study performed by security firm Bitdefender with the aid of its mobile security solution, between January 1 and December 1, 2012...." --------------------------------------------- http://news.softpedia.com/news/North-America-and-Europe-Most-Threatened-by-…

1 0

Tageszusammenfassung - Dienstag 11-12-2012
by Daily end-of-shift report 11 Dec '12

11 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Montag 10-12-2012 18:00 − Dienstag 11-12-2012 18:00 Handler: Matthias Fraidl Co-Handler: Christian Wojner *** Beware of Bitcoin miner posing as Trend Micro AV *** --------------------------------------------- "Malware almost always comes in disguise, but some malware peddlers try to do a better job than others. Trend Micro researchers have recently uncovered a piece of malware that tried to pass itself off as "Trend Micro AntiVirus Plus AntiSpyware" (click on the screenshot to enlarge it):Unfortunately for whose who get fooled, the software in question is a Trojan that creates the process svchost. exe and downloads additional malicious components such as a Bitcoin miner application --------------------------------------------- http://www.net-security.org/malware_news.php?id=2349 *** Multipurpose Necurs Trojan infects over 83,000 computers *** --------------------------------------------- "The polivalent Necurs malware family has been wreaking havoc in November by infecting over 83,000 unique computers - and that are only the ones detected by Microsofts solutions! The Necurs Trojan is capable of:Modifying the computers registry in order to make itself start after every reboot. Dropping additional components that prevents a large number of security applications from functioning correctly, including the ones manufactured by Avira, Kaspersky Lab, Symantec and --------------------------------------------- http://www.net-security.org/malware_news.php?id=2350 *** 200,000 new malicious programs detected every day *** --------------------------------------------- "Kaspersky Lab released its annual Kaspersky Security Bulletin, which provides the overall malware and cyber-threat statistics for 2012. The report revealed significant growth of Mac-specific malware and an explosive growth in the number of threats targeting the Android platform. Overall, Kaspersky Lab detected and blocked more than 1...." --------------------------------------------- http://www.net-security.org/malware_news.php?id=2352 *** Necurs Rootkit Infections Way Up *** --------------------------------------------- "Infections from a nasty bit of malware, generally delivered by the Black Hole Exploit Kit, surged in November, hitting more than 83,000 machines. Microsofts Malware Protection Center rates the Necurs rootkit threat as severe. Dubbed a rootkit by Kaspersky Lab, Necurs has many dimensions to it...." --------------------------------------------- http://threatpost.com/en_us/blogs/necurs-rootkit-infections-way-120712? *** Joomla (and WordPress) Bulk Exploit Going on, (Mon, Dec 10th) *** --------------------------------------------- Weve gotten some reports and discussion around many Joomla (and some WordPress) sites exploited and hosting IFRAMES pointing to bad places. Well get to the downloaded in a second, but the interesting thing to note is that it doesnt seem to be a scanner exploiting one vulnerability but some tool thats basically firing a bunch of Joomla and Wordpress exploits at a given server and hoping something hits. Wed like PCAPs or weblogs if youre seeing something similar in your environment. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14677&rss *** Russian ransomware strikes Queensland doctor *** --------------------------------------------- Seven years of patients files encrypted by crooks. A medical practice in the Australian state of Queensland, the Miami Family Medical Centre, has been hit by ransomware said to originate in Russia. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/12/11/queensland_… *** Unzuverlässige Trojaner-Warnungen durch Android 4.2 *** --------------------------------------------- Nur 15 Prozent der in einer Analyse eingesetzten Schadsoftware hat der mit Googles Betriebssystem Jelly Bean (Android 4.2) kommende App Verification Service entdeckt. --------------------------------------------- http://www.heise.de/security/meldung/Unzuverlaessige-Trojaner-Warnungen-dur…

1 0

Tageszusammenfassung - Montag 10-12-2012
by Daily end-of-shift report 10 Dec '12

10 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Freitag 07-12-2012 18:00 − Montag 10-12-2012 18:00 Handler: Matthias Fraidl Co-Handler: Christian Wojner *** Sophos Security Threat Report 2013, today... tomorrow *** --------------------------------------------- "Sophos was one of the first security firms that has published a report, Sophos Security Threat Report 2013, on current status of security landscape making predictions for incoming year. The document propose an interesting overview on most common and dangerous cyber threats attempting to determine the level of penetration by different countries. The factors that have primary contributed to the diffusion of new cyber threats are the increasing in use of social networks platforms and --------------------------------------------- http://www.infosecisland.com/blogview/22771-Sophos-Security-Threat-Report-2… *** Onlinebanking lieber per Althandy *** --------------------------------------------- Derzeit droht Nutzern von Internet-Banking-Diensten Gefahr durch den Trojaner Eurograbber, der Geld von mehr als 30 000 Bankkonten erbeutet haben soll. Er greift Online-Banking-Teilnehmer, die PC und Smartphone kombiniert einsetzen, gezielt an und fängt durch geschickte Fragen sowohl Kontodaten als auch Transaktionsnummern seiner Opfer ab. Internetnutzer können sich jedoch mit ein paar Tricks schützen. --------------------------------------------- http://www.heise.de/security/meldung/Onlinebanking-lieber-per-Althandy-1764… *** My Little Pronny: Autorun worms continue to turn *** --------------------------------------------- "Malware activity exploiting Autorun on Windows computers has been generating quite a few calls to ESET support lines lately, reminding us that old infection techniques seldom die and USB flash drives can still be an effective means of getting malicious code onto a computer. USB drives can be used to infect computers that automatically execute files on removable media when that media is inserted. On Windows machines this is known as the Autorun feature (referred to as Autoplay in Windows --------------------------------------------- http://blog.eset.com/2012/12/07/autorun-worm-continues-to-turn *** 16-30 November 2012 Cyber Attacks Timeline *** --------------------------------------------- "November has gone and its time to review this months cyber landscape. From a Cyber Crime perspective, November 2012 will be probably remembered for the breach to Nationwide, one of the largest insurance and financial services providers in the US, a breach that has potentially left up to 1 million users exposed. Unfortunately, in terms of massive breaches, this is not the only remarkable event of the month, just at the end Acer India has suffered a massive cyber attack culminated in the --------------------------------------------- http://hackmageddon.com/category/security/cyber-attacks-timeline/ *** That square QR barcode on the poster? Check its not a sticker *** --------------------------------------------- Crooks slap on duff codes leading to evil sites Cybercrooks are putting up stickers featuring URLs embedded in Quick Response codes (QR codes) as a trick designed to drive traffic to dodgy sites. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/12/10/qr_code_sti… *** Trojans spread from compromised Dalai Lama website *** --------------------------------------------- December 5, 2012 Russian anti-virus company Doctor Web is informing users that several Trojans are being spread from compromised websites. In particular, malware is being downloaded from the official site of the Dalai Lama. Mac OS X systems are in danger as well as Windows PCs. Several days ago Doctor Web was informed that the official site of Tibet's spiritual leader, the Dalai Lama, had been compromised. Doctor Webs analysts discovered that when loading a page from the site in a --------------------------------------------- http://news.drweb.com/show/?i=3124&lng=en&c=9 *** DDoS Attacks: Lessons Learned - 4 Thought Leaders Share Insights About Bank Attacks *** --------------------------------------------- "Distributed-denial-of-service attacks waged against leading U.S. banks between mid-September and mid-October led to improved information sharing about threats. And that exchange proved effective in minimizing disruptions. Inter-bank and industry communication helped financial institutions targeted later in the DDoS campaign suffer less severe outages than those targeted earlier, says Mike Smith, a DDoS specialist at Web security vendor Akamai Technologies...." --------------------------------------------- http://www.bankinfosecurity.com/ddos-attacks-lessons-learned-a-5343?rf=2012… *** The "hidden" backdoor - VirTool:WinNT/Exforel.A *** --------------------------------------------- Recently we discovered an advanced backdoor sample - VirTool:WinNT/Exforel.A. Unlike traditional backdoor samples, this backdoor is implemented at the NDIS (Network Driver Interface Specification) level. https://blogs.technet.com/b/mmpc/archive/2012/12/09/the-quot-hidden-quot-ba… *** Vuln: TP-LINK TL-WR841N Router Multiple HTML Injection Vulnerabilities *** --------------------------------------------- TP-LINK TL-WR841N Router Multiple HTML Injection Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/56602 *** VLC Media Player 2.0.4 Buffer Overflow *** --------------------------------------------- Topic: VLC Media Player 2.0.4 Buffer Overflow Risk: High Text:Title : VLC media player 2.0.4 buffer overflow POC Version : 2.0.4 Twoflower Date : 2012-12-06 Vendor : http:/... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/JsOQvc6gSeY/WLB-20…

1 0

Tageszusammenfassung - Freitag 7-12-2012
by Daily end-of-shift report 07 Dec '12

07 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 06-12-2012 18:00 − Freitag 07-12-2012 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Sieben Microsoft-Patches auf einen Streich am Patchday *** --------------------------------------------- Microsoft kündigte an, anlässlich seines Dezember-Patchdays am kommenden Dienstag sieben Patch-Pakete (Bulletins) herauszugeben, die insgesamt elf Sicherheitslücken schließen. Fünf der Patch-Pakete stuft das Unternehmen als kritisch ein; sie schließen Lücken, die das Einschleusen von Schadcode aus der Ferne erlauben. --------------------------------------------- http://www.heise.de/security/meldung/Sieben-Microsoft-Patches-auf-einen-Str… *** Viele beliebte Windows-Programme unzureichend gesichert *** --------------------------------------------- Der Autor der Software SlopFinder beschreibt, dass viele beliebte Windows-Programme selbst grundlegende Schutzmechanismen nicht verwenden. So soll bei DEP (Data Execution Prevention) der Prozessor über ein Flag (NX-Bit) die Ausführung von eingeschleustem Schadcode im Datenbereich verhindern. --------------------------------------------- http://www.heise.de/security/meldung/Viele-beliebte-Windows-Programme-unzur… *** RSA boss predicts "catastrophic" cyber attack *** --------------------------------------------- "A large-scale attack on critical infrastructure will soon become a reality, according to RSA chief executive Art Coviello. The security boss said that poor government security protections combined with increasingly sophisticated attack techniques has left critical infrastructure at risk for attacks which could cause widespread damage."I abhor the phrase Cyber Pearl Harbor because I think it is a poor metaphor to describe the state I believe we are in," Coviello --------------------------------------------- http://www.v3.co.uk/v3-uk/news/2229201/rsa-boss-art-coviello-predicts-catas… *** Skynet, a Tor-powered botnet straight from Reddit *** --------------------------------------------- FROM: Matthias Fraidl <fraidl(a)cert.at> Following is an overview of this malware labelled by the creator as Skynet: a Tor-powered trojan with DDoS, Bitcoin mining and Banking capabilities, that we observed spreading through the veins of Usenet. https://community.rapid7.com/community/infosec/blog/2012/12/06/skynet-a-tor… --------------------------------------------- /taranis/mod_assess/show_mail.pl?id=1826 *** BlackHole Exploit Kit Has Difficulties in Infecting Chrome Users, Experts Say *** --------------------------------------------- "The notorious BlackHole exploit kit has been around for quite some time now, with new iterations being released periodically. While it can be considered one of the most efficient cybercriminal tools, BlackHole doesnt like it when its victims utilize Googles Chrome web browser. According to experts from Blue Coat, when potential victims are tricked into clicking on links that point to BlackHole-infested websites, theyre presented with a loading or a please wait message, while in the --------------------------------------------- http://news.softpedia.com/news/BlackHole-Exploit-Kit-Has-Difficulties-in-In… *** New Trojan Exploits Mobile Channel - Eurograbber Defeats Two-Factor Authentication *** --------------------------------------------- "Eurograbber is more than just another banking Trojan. Its an exploitation of fundamental online banking authentication practices that could strike any institution, says Check Points Darrell Burkey. This Zeus variant Trojan is blamed for attacks that stole more than 36 million Euros ($47 million U.S. dollars) from an estimated 30,000 consumer and corporate accounts at European banks...." --------------------------------------------- http://www.bankinfosecurity.com/interviews/new-trojan-exploits-mobile-chann… *** WhatsApp schließt Lücke erneut, aber nicht überall *** --------------------------------------------- Das Katz-und-Maus-Spiel um die Sicherheit von WhatsApp geht in die nächste Runde: Nachdem heise Security vor rund einer Woche demonstriert hatte, dass die Android-Version nach wie vor anfällig für Account-Hijacking ist, bietet der Betreiber nun WhatsApp-Version 2.8.8968 über Google Play an, die eine verbesserte Rufnummern-Verifikation verspricht. --------------------------------------------- http://www.heise.de/security/meldung/WhatsApp-schliesst-Luecke-erneut-aber-…

1 0

Tageszusammenfassung - Donnerstag 6-12-2012
by Daily end-of-shift report 06 Dec '12

06 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 05-12-2012 18:00 − Donnerstag 06-12-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Bugtraq: CVE-2012-4534 Apache Tomcat denial of service *** --------------------------------------------- CVE-2012-4534 Apache Tomcat denial of service --------------------------------------------- http://www.securityfocus.com/archive/1/524945 *** Vuln: Adobe InDesign Server RunScript SOAP Message Remote Command Execution Vulnerability *** --------------------------------------------- Adobe InDesign Server RunScript SOAP Message Remote Command Execution Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56574 *** Opera GIF Image Handling Buffer Underflow Vulnerability *** --------------------------------------------- http://secunia.com/advisories/51462/ *** Vuln: Computer Associates XCOM Data Transport Remote Arbitrary Command Execution Vulnerability *** --------------------------------------------- Computer Associates XCOM Data Transport Remote Arbitrary Command Execution Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56824

1 0

Tageszusammenfassung - Mittwoch 5-12-2012
by Daily end-of-shift report 05 Dec '12

05 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 04-12-2012 18:00 − Mittwoch 05-12-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** SHA1-Schwäche begünstigt Passwortknacker *** --------------------------------------------- Jens Steube, einer der Autoren des populären Passwortknackers Hashcat, hat eine "Schwäche im kryptografischen Hash-Verfahren SHA1" (PDF-Datei) ausgemacht, die es ihm erlaubt, das Knacken von Passwörtern um etwa 20 Prozent zu beschleunigen. --------------------------------------------- http://www.heise.de/security/meldung/SHA1-Schwaeche-beguenstigt-Passwortkna… *** ATM Thieves Swap Security Camera for Keyboard *** --------------------------------------------- This blog has featured stories about a vast array of impressive, high-tech devices used to steal money from automated teller machines (ATMs). But every so often thieves think up an innovation that makes all of the current ATM skimmers look like childs play. Case in point: Authorities in Brazil have arrested a man who allegedly stole more than USD $41,000 from an ATM after swapping its security camera with a portable keyboard that let him hack the cash machine. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/kPS5w9ExcfQ/ *** Twitter’s deathless spoofing bug gets the heart-stake again *** --------------------------------------------- Facebook, Venmo also plug SMS vuln Twitter says it has plugged its years-old SMS spoofing vulnerability after yet-another disclosure, this time by security consultant Jonathan Rudenberg. Facebook and social payments outfit Venmo have also blocked the vulnerability.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/12/05/twitter_dum… *** Security Patch released for BIND 9.9.2, (Wed, Dec 5th) *** --------------------------------------------- A security patch was released for BIND 9.9.2. The patch addresses 26 different bugs and/or security issues. Update your bind DNS server to version 9.9.2-P1. Updates can be downloaded here: http://www.isc.org/downloads/all More information is available here: https://kb.isc.org/article/AA-0082 (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14641&rss *** Apache Tomcat CSRF Prevention Filter Bypass *** --------------------------------------------- Topic: Apache Tomcat CSRF Prevention Filter Bypass Risk: Low Text:CVE-2012-4431 Apache Tomcat Bypass of CSRF prevention filter Severity: Important Vendor: The Apache Software Foundation ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/llUlhAAXXjo/WLB-20… *** Apache Tomcat Security Bypass *** --------------------------------------------- Topic: Apache Tomcat Security Bypass Risk: Medium Text:CVE-2012-3546 Apache Tomcat Bypass of security constraints Severity: Important Vendor: The Apache Software Foundation ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/bHs7rEreGXQ/WLB-20… *** HPSBPI02807 SSRT100928 rev.1 - HP LaserJet Pro 400 Multi Function Printers, Remote Unauthorized Access *** --------------------------------------------- https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03464042 *** HPSBPI02828 SSRT100778 rev.1 - HP LaserJet and Color LaserJet, Cross-Site Scripting (XSS) *** --------------------------------------------- https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03556108 *** HPSB3C02831 SSRT100661 rev.1 - HP Intelligent Management Center User Access Manager (UAM), Remote Execution of Arbitrary Code *** --------------------------------------------- https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ *** Sophos Security Threat Report 2013: Norway Is the Safest Country *** --------------------------------------------- "Sophos has just released its Security Threat Report 2013. The study focuses on topics such as Mac malware, targeted attacks, polymorphic attacks, ransomware, Android threats, Java attacks, and the BlackHole exploit kit. An interesting part of the report is the one which details the 10 riskiest and the 10 safest countries in the world...." --------------------------------------------- http://news.softpedia.com/news/Sophos-Security-Threat-Report-2013-Norway-Is… *** New 25-GPU Monster Devours Strong Passwords In Minutes *** --------------------------------------------- chicksdaddy writes "A presentation at the Passwords^12 Conference in Oslo, Norway (slides), has moved the goalposts on password cracking yet again. Speaking on Monday, researcher Jeremi Gosney (a.k.a epixoip) demonstrated a rig that leveraged the Open Computing Language (OpenCL) framework and a technology known as Virtual Open Cluster (VCL) to run the HashCat password cracking program across a cluster of five, 4U servers equipped with 25 AMD Radeon GPUs communicating at 10 Gbps and 20 Gbps... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/cC50oUE-O1A/story01.htm *** The Citadel crimeware kit - under the microscope *** --------------------------------------------- Ever since the source code of the Zeus crimeware kit, also known as Zbot, was leaked onto the internet in May 2011, many new variants have appeared. These have typically added new features and improved on the old code. One particularly prevalent example is Citadel. --------------------------------------------- http://nakedsecurity.sophos.com/2012/12/05/the-citadel-crimeware-kit-under-…

1 0

Tageszusammenfassung - Dienstag 4-12-2012
by Daily end-of-shift report 04 Dec '12

04 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Montag 03-12-2012 18:00 − Dienstag 04-12-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Instagram-App anfällig für Account-Hijacking *** --------------------------------------------- Der Netzwerkverkehr der Instagram-App ist offenbar unzureichend geschützt: Wie der Sicherheitsexperte Carlos Reventlov berichtet, kommuniziert die App der Fotogemeinde unverschlüsselt über HTTP mit dem Instagram-Server. Ein Angreifer kann beim Belauschen des Datenverkehrs laut Reventlov ein Session-Cookie stehlen und damit im Kontext des Belauschten auf den Nutzerbereich von instagram.com zugreifen. --------------------------------------------- http://www.heise.de/security/meldung/Instagram-App-anfaellig-fuer-Account-H… *** Bugtraq: FortiGate FortiDB 2kB 1kC & 400B - Cross Site Vulnerability *** --------------------------------------------- FortiGate FortiDB 2kB 1kC & 400B - Cross Site Vulnerability --------------------------------------------- http://www.securityfocus.com/archive/1/524894 *** Bugtraq: ESA-2012-052 RSA NetWitness Informer Cross-Site Request Forgery and Click-jacking Vulnerabilities *** --------------------------------------------- ESA-2012-052 RSA NetWitness Informer Cross-Site Request Forgery and Click-jacking Vulnerabilities --------------------------------------------- http://www.securityfocus.com/archive/1/524892 *** Vuln: OpenStack Keystone CVE-2012-5571 Security Bypass Vulnerability *** --------------------------------------------- OpenStack Keystone CVE-2012-5571 Security Bypass Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56726 *** Vuln: OpenStack Token Expiration Security Bypass Vulnerability *** --------------------------------------------- OpenStack Token Expiration Security Bypass Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56727 *** Vrublevsky Sues Kaspersky *** --------------------------------------------- The co-founder and owner of ChronoPay, one of Russias largest e-payment providers, is suing Russian security firm Kaspersky Lab, alleging that the latter published defamatory blog posts about him in connection with his ongoing cybercrime trial. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/7qcGBLXbf74/ *** Vuln: Samsung and Dell printers Firmware Backdoor Unauthorized Access Vulnerability *** --------------------------------------------- Samsung and Dell printers Firmware Backdoor Unauthorized Access Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56692 *** Bugtraq: SEC Consult SA-20121203-0 :: F5 FirePass SSL VPN Unauthenticated local file inclusion *** --------------------------------------------- SEC Consult SA-20121203-0 :: F5 FirePass SSL VPN Unauthenticated local file inclusion --------------------------------------------- http://www.securityfocus.com/archive/1/524903 *** Snort-2.9.4 has been released, (Mon, Dec 3rd) *** --------------------------------------------- (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14629&rss *** Vuln: Oracle MySQL acl_get() Buffer Overflow Vulnerability *** --------------------------------------------- Oracle MySQL acl_get() Buffer Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56769 *** Bug Hunter Finds Blended Threat Targeting Yahoo Web Site *** --------------------------------------------- "A Romanian bug hunter has discovered a "blended threat" targeting Yahoos Developer Network Web site that allows unauthorized access to Yahoo users emails and private profile data. At a security conference Sunday, Sergiu Dragos Bogdan demonstrated an abbreviated version of an attack using the YQL console on developer. yahoo...." --------------------------------------------- http://threatpost.com/en_us/blogs/bug-hunter-finds-blended-threat-targeting… *** Rumble in the Tumblr: Troll-worm infected thousands of blogs *** --------------------------------------------- Infamous crew unleashed JavaScript nasty on trendy journals A worm spread like wildfire across Tumblr on Monday, defacing pages on the blogging website with an abusive message penned by a notorious trolling crew.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/12/04/tumblr_java… *** Post aus der Vergangenheit: Security-Fix nach 8 Jahren *** --------------------------------------------- Das Advisory von Januar 2005 war eines von hunderten, ähnlich gearteten dieser Zeit: Eine PHP-Applikation überprüft die Parameter einer Datenbankabfrage nicht und als Resultat kann ein Angreifer mit speziellen URLs beliebige Datenbankbefehle einschleusen. Das besondere an diesem Bug-Report zu PHP Gift Registry: Nach über 7 Jahren hat sich der Autor der Software die Mühe gemacht, dann doch noch zu antworten. --------------------------------------------- http://www.heise.de/security/meldung/Post-aus-der-Vergangenheit-Security-Fi… *** Schnelles Passwort-Knacken bei MySQL *** --------------------------------------------- Der Hacker mit dem Pseudonym KingCope hat erneut eine Sicherheitsproblematik der beliebten MySQL-Datenbank veröffentlicht. Durch eine bereits bekannte Eigenart der Benutzerverwaltung ist es möglich, die Geschwindigkeit einer BruteForce-Attacke signifikant zu erhöhen. Beim sogenannten "Brute Forcing" wird einfach eine Vielzahl möglicher Passwörter durchprobiert, um so das tatsächliche Passwort des angegriffenen Kontos zu erraten. --------------------------------------------- http://www.heise.de/security/meldung/Schnelles-Passwort-Knacken-bei-MySQL-1… *** Centrify Deployment Manager v2.1.0.283 /tmp insecure file handling *** --------------------------------------------- Topic: Centrify Deployment Manager v2.1.0.283 /tmp insecure file handling Risk: Medium Text:Centrify Deployment Manager v2.1.0.283 While at a training session for centrify, I noticed poor handling of files in /tmp. I... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/6ZYCFcfGM0w/WLB-20…

1 0

Tageszusammenfassung - Montag 3-12-2012
by Daily end-of-shift report 03 Dec '12

03 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Freitag 30-11-2012 18:00 − Montag 03-12-2012 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Bugtraq: NGS000263 Technical Advisory: Symantec Messaging Gateway Easy CSRF to add a backdoor-administrator *** --------------------------------------------- NGS000263 Technical Advisory: Symantec Messaging Gateway Easy CSRF to add a backdoor-administrator --------------------------------------------- http://www.securityfocus.com/archive/1/524879 *** Schöne Bescherung - Hacker veröffentlicht Exploits für MySQL und SSH *** --------------------------------------------- Der berüchtigte Hacker mit dem Pseudonym KingCope hat offenbar seine Altbestände ausgemistet und zum ersten Advent eine ganze Reihe von Exploits veröffentlicht, die zum Teil schon aus dem Jahr 2011 stammen. Primäres Ziel ist die mittlerweile von Oracle übernommene Open-Source-Datenbank MySQL; aber auch die SSH-Server der Firma SSH und FreeSSHd/FreeFTPd sind akut gefährdet. --------------------------------------------- http://www.heise.de/security/meldung/Schoene-Bescherung-Hacker-veroeffentli… *** The top 25 computing coding errors that lead to 85% of criminal internet activity *** --------------------------------------------- "The list is being hailed as a major breakthrough that should gradually make theInternet much safer. "When consumers see that most vulnerabilities are caused by amere 25 weaknesses, a new standard for due diligence is likely to emerge," saysKonrad Vesey, a member of the National Security Agencys Information AssuranceDirectorate...." --------------------------------------------- http://www.sans.org/top25-software-errors/#s4 *** OurWebFTP 5.3.5 Cross Site Scripting *** --------------------------------------------- Topic: OurWebFTP 5.3.5 Cross Site Scripting Risk: Low Text:HTTPCS Advisory : HTTPCS112 Product : OurWebFTP Version : 5.3.5 Page : /index.php Variables : mwb_control2=Enter&mw... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Z9CTYZ5_rmc/WLB-20… *** Libsyn Cross Site Scripting *** --------------------------------------------- Topic: Libsyn Cross Site Scripting Risk: Low Text:As you can see from my publications for last five years, I like holes which are placed at hundreds or millions of web sites. S... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/xmo2Up5J5oE/WLB-20… *** FortiWeb 4kC,3kC,1kC & VA Cross Site Vulnerabilities *** --------------------------------------------- Topic: FortiWeb 4kC,3kC,1kC & VA Cross Site Vulnerabilities Risk: Low Text:Title: FortiWeb 4kC,3kC,1kC & VA - Cross Site Vulnerabilities Date: == 2012-12-01 References: == http://... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/WC5HCX-SaKI/WLB-20… *** Critical infrastructure systems should never have moved online, warn security experts *** --------------------------------------------- "UK businesses linked to critical infrastructure areas have opened themselves up to cyber attacks by prematurely moving key systems online, according to prominent security experts. Co-founder of information security site The Jericho Forum, Paul Simmonds, highlighted the fact that the desire to cut costs by moving systems online has left firms vulnerable to cyber attacks."Im worried were rushing headlong into connecting parts of critical infrastructure items to the internet," ... --------------------------------------------- http://www.v3.co.uk/v3-uk/news/2228538/critical-infrastructure-systems-shou… *** Blogger demonstrieren gewieften Passwortklau *** --------------------------------------------- Mitarbeitern der Firma Neophasis haben herausgefunden, dass mit relativ einfachen Mitteln Passwörter und andere Nutzerdaten per JavaScript-Modifikationen aus Web-Browsern abgegriffen werden können. Dass der Diebstahl über eine oft genutzte Tastenkombination funktioniert, macht die Schwachstelle gefährlich. --------------------------------------------- http://www.heise.de/security/meldung/Blogger-demonstrieren-gewieften-Passwo… *** Opera Web Browser 12.11 WriteAV Vulnerability *** --------------------------------------------- Topic: Opera Web Browser 12.11 WriteAV Vulnerability Risk: Medium Text:Title : Opera Web Browser 12.11 WriteAV Vulnerability Version : 12.11 Build 1661 and 12.12 Date : 2012-12-03 Vend... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/bY9KoqQu62A/WLB-20… *** Safety First: That Means Mobile Banking *** --------------------------------------------- "The answer surprises; here is the question: Is it safer to bank using a desktop computer or an app on a mobile phone? The answer is that, all considered, you are vastly safer with that mobile banking app."Fraudsters go after the low-hanging fruit, and that is PC-based banking," said Andreas Baumhof, chief technology officer at ThreatMetrix, in an interview. There is substantially more traffic over online banking channels than there is mobile, and thus the keener interest of ... --------------------------------------------- http://www.themobilityhub.com/author.asp?section_id=2262&doc_id=254931

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily