=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 21-01-2025 18:00 − Mittwoch 22-01-2025 18:00
Handler: Michael Schlagenhaufer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Großflächige Brute-Force-Angriffe auf M365 – vorsichtshalber Log-ins checken ∗∗∗
---------------------------------------------
In den vergangenen Wochen gab es großflächige Angriffe auf Zugangsdaten zur Microsoft-Cloud. IT-Admins sollten prü…
[View More]fen, ob diese eventuell erfolgreich waren.
---------------------------------------------
https://heise.de/-10252167
∗∗∗ Patch procrastination leaves 50,000 Fortinet firewalls vulnerable to zero-day ∗∗∗
---------------------------------------------
Data from the Shadowserver Foundation shows 48,457 Fortinet boxes are still publicly exposed and haven't had the patch for CVE-2024-55591 applied, despite stark warnings issued over the past seven days.
---------------------------------------------
https://go.theregister.com/feed/www.theregister.com/2025/01/21/fortinet_fir…
∗∗∗ Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet ∗∗∗
---------------------------------------------
Threat actors are exploiting an unspecified zero-day vulnerability in Cambium Networks cnPilot routers to deploy a variant of the AISURU botnet called AIRASHI to carry out distributed denial-of-service (DDoS) attacks. According to QiAnXin XLab, the attacks have leveraged the security flaw since June 2024.
---------------------------------------------
https://thehackernews.com/2025/01/hackers-exploit-zero-day-in-cnpilot.html
∗∗∗ Fake Homebrew Google ads target Mac users with malware ∗∗∗
---------------------------------------------
Hackers are once again abusing Google ads to spread malware, using a fake Homebrew website to infect Macs and Linux devices with an infostealer that steals credentials, browser data, and cryptocurrency wallets.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/fake-homebrew-google-ads-tar…
∗∗∗ IPany VPN breached in supply-chain attack to push custom malware ∗∗∗
---------------------------------------------
South Korean VPN provider IPany was breached in a supply chain attack by the "PlushDaemon" China-aligned hacking group, who compromised the companys VPN installer to deploy the custom SlowStepper malware.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/ipany-vpn-breached-in-supply…
∗∗∗ Unique 0-click deanonymization attack targeting Signal, Discord and hundreds of platforms ∗∗∗
---------------------------------------------
3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. [..] A few months ago, I had a lightbulb moment: if Cloudflare stores cached data so close to users, could this be exploited for deanonymization attacks on sites we don't control? [..] Cloudflare's final statement about this says they do not consider the deanonymization attack to be a vulnerability in their own systems and it is up to their consumers to disable caching for resources they wish to protect.
---------------------------------------------
https://gist.github.com/hackermondev/45a3cdfa52246f1d1201c1e8cdef6117
∗∗∗ Turning Data into Decisions: How CVE Management Is Changing ∗∗∗
---------------------------------------------
Every day, hundreds of new Common Vulnerabilities and Exposures (CVEs) are published, many of which target critical systems that keep businesses and governments operational. For cybersecurity professionals, simply knowing that a vulnerability exists is not enough. What’s needed is context—a deeper understanding of the CVE data, its potential impact, and how to prioritize its remediation. Enter Vulnrichment, an initiative launched by the Cybersecurity and Infrastructure Security Agency (CISA) on May 10, 2024.
---------------------------------------------
https://thecyberexpress.com/cve-data-vulnrichment-program/
∗∗∗ Geolocation and Starlink, (Tue, Jan 21st) ∗∗∗
---------------------------------------------
The IP address of a satellite user identifies the ground station location, not the user's location. Starlink, on the other hand, uses satellites in low earth orbit. The network can forward traffic among satellites, but typically, the satellite will attempt to pass the traffic to the closest base station in view. Due to the low orbit, each satellite only "sees" a relatively small area, and the ground station is usually within a couple hundred miles of the user.
---------------------------------------------
https://isc.sans.edu/diary/rss/31612
∗∗∗ Mirai Botnet Launches Record 5.6 Tbps DDoS Attack with 13,000+ IoT Device ∗∗∗
---------------------------------------------
Web infrastructure and security company Cloudflare on Tuesday said it detected and blocked a 5.6 Terabit per second (Tbps) distributed denial-of-service (DDoS) attack, the largest ever attack to be reported to date. The UDP protocol-based attack took place on October 29, 2024, targeting one of its customers, an unnamed internet service provider (ISP) from Eastern Asia.
---------------------------------------------
https://thehackernews.com/2025/01/mirai-botnet-launches-record-56-tbps.html
∗∗∗ Understanding Microsofts CVSS v3.1 Ratings and Severity Scores ∗∗∗
---------------------------------------------
Recently, I looked at Microsoft’s assigned CVSS v3.1 scores for Patch Tuesday vulnerabilities alongside the Microsoft assigned severity ratings. I wanted to revisit these numbers and see just how closely CVSS aligns with Microsoft’s opinion of severity.
---------------------------------------------
https://www.tripwire.com/state-of-security/understanding-microsofts-cvss-v3…
∗∗∗ Vorsicht, wenn Online-Shops per WhatsApp zur Zahlung auffordern ∗∗∗
---------------------------------------------
Der Fake-Shop bikeunivers.de bietet Markenfahrräder zu günstigen Preisen an. Bezahlt werden kann nur per Banküberweisung. Wer nicht bezahlt, erhält eine Zahlungsaufforderung per E-Mail und WhatsApp. Ignorieren Sie diese, denn Sie erhalten trotz Zahlung keine Ware!
---------------------------------------------
https://www.watchlist-internet.at/news/fake-shop-whatsapp/
∗∗∗ Vorsicht vor gefälschten Telegram-SMS ∗∗∗
---------------------------------------------
Derzeit kursieren gefälschte SMS, angeblich von Telegram. Die Nachricht besagt, dass Ihr Konto eingeschränkt sei und Sie es freischalten müssen. Klicken Sie auf keinen Fall auf den Link! Kriminelle stehlen Ihre Daten und versuchen sich auf einem fremden Gerät mit Ihrer Telefonnummer einzuloggen!
---------------------------------------------
https://www.watchlist-internet.at/news/vorsicht-vor-gefaelschten-telegram-s…
∗∗∗ Redline, Vidar and Raccoon Malware Stole 1 Billion Passwords in 2024 ∗∗∗
---------------------------------------------
Specops 2025 Breached Password Report reveals over 1 billion passwords stolen by malware in the past year, exposing weak practices, malware trends, and security gaps.
---------------------------------------------
https://hackread.com/redline-vidar-raccoon-malware-stole-1-billion-password…
=====================
= Vulnerabilities =
=====================
∗∗∗ Oracle Critical Patch Update Advisory - January 2025 ∗∗∗
---------------------------------------------
This Critical Patch Update contains 318 new security patches across the product families listed below.
---------------------------------------------
https://www.oracle.com/security-alerts/cpujan2025.html
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (snapcast), Fedora (python-jinja2), Mageia (rsync), SUSE (cdi-apiserver-container, cdi-cloner-container, cdi- controller-container, cdi-importer-container, cdi-operator-container, cdi- uploadproxy-container, cdi-uploadserver-container, cont, gh, kernel, kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t, nvidia-open-driver-G06-signed, and pam_u2f), and Ubuntu (linux-oem-6.11 and vim).
---------------------------------------------
https://lwn.net/Articles/1005798/
∗∗∗ Technical Advisory: Cross-Site Scripting in Umbraco Rich Text Display ∗∗∗
---------------------------------------------
Due to a lack of input sanitization on the server side, Umbraco CMS 14.3.1 or below is vulnerable to stored cross-site scripting (XSS) attacks through the rendering logic for rich text contents. [..] Umbraco has accepted this behavior as the majority of its customer base is unaffected. [..] Identify a C/C++ HTML sanitization framework best suited for the organization if using RTE is mandatory. Seek alternative components in Umbraco for content rendering otherwise.
---------------------------------------------
https://www.nccgroup.com/us/research-blog/technical-advisory-cross-site-scr…
∗∗∗ PHP: PMASA-2025-3 ∗∗∗
---------------------------------------------
https://www.phpmyadmin.net/security/PMASA-2025-3/
∗∗∗ PHP: PMASA-2025-2 ∗∗∗
---------------------------------------------
https://www.phpmyadmin.net/security/PMASA-2025-2/
∗∗∗ PHP: PMASA-2025-1 ∗∗∗
---------------------------------------------
https://www.phpmyadmin.net/security/PMASA-2025-1/
∗∗∗ ABB: 2025-01-21: Cyber Security Advisory - Drive Composer Path Traversal Vulnerability ∗∗∗
---------------------------------------------
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A5466&Lan…
∗∗∗ Cisco BroadWorks SIP Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso…
∗∗∗ Cisco Meeting Management REST API Privilege Escalation Vulnerability ∗∗∗
---------------------------------------------
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso…
∗∗∗ Cisco ClamAV OLE2 File Format Decryption Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
[View Less]
=====================
= End-of-Day report =
=====================
Timeframe: Montag 20-01-2025 18:00 − Dienstag 21-01-2025 18:00
Handler: Michael Schlagenhaufer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing” ∗∗∗
---------------------------------------------
Sophos MDR identifies a new threat cluster riffing on the playbook of Storm-1811, and amped-up …
[View More]activity from the original connected to Black Basta ransomware.
---------------------------------------------
https://news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-c…
∗∗∗ 7-Zip: Lücke erlaubt Umgehung von Mark-of-the-Web ∗∗∗
---------------------------------------------
In 7-Zip ermöglicht eine Sicherheitslücke, den Mark-of-the-Web-Schutzmechanismus auszuhebeln und so Code auszuführen. [..] Die Sicherheitslücke schließt 7-Zip Version 24.09 oder neuer, die auf der Download-Seite von 7-Zip bereits seit Ende November vergangenen Jahres zum Herunterladen bereitsteht. [..] 7-Zip-Nutzer müssen selbst aktiv werden, um sich zu schützen und das verfügbare Update installieren.
---------------------------------------------
https://heise.de/-10250351
∗∗∗ 13,000 MikroTik Routers Hijacked by Botnet for Malspam and Cyberattacks ∗∗∗
---------------------------------------------
A global network of about 13,000 hijacked Mikrotik routers has been employed as a botnet to propagate malware via spam campaigns, the latest addition to a list of botnets powered by MikroTik devices. The activity "take[s] advantage of misconfigured DNS records to pass email protection techniques," Infoblox security researcher David Brunsdon said in a technical report published last week.
---------------------------------------------
https://thehackernews.com/2025/01/13000-mikrotik-routers-hijacked-by.html
∗∗∗ Exchange 2016 und 2019 erreichen Support-Ende – in 9 Monaten ∗∗∗
---------------------------------------------
Microsoft erinnert an das dräuende Support-Ende der Exchange-Server 2016 und 2019.
---------------------------------------------
https://www.heise.de/-10249853
∗∗∗ Medusa Ransomware: What You Need To Know ∗∗∗
---------------------------------------------
What is the Medusa ransomware? Medusa is a ransomware-as-a-service (RaaS) platform that first came to prominence in 2023. The ransomware impacts organisations running Windows, predominantly exploiting vulnerable and unpatched systems and hijacking accounts through initial access brokers.
---------------------------------------------
https://www.tripwire.com/state-of-security/medusa-ransomware-what-you-need-…
∗∗∗ How to secure body-worn cameras and protect footage from cyber threats ∗∗∗
---------------------------------------------
Body-worn cameras are used by police [..] Cameras are taken into the field but footage could be presented as evidence [..] Cryptographic approaches are needed to ensure the confidentiality and integrity of captured video and audio.
---------------------------------------------
https://www.pentestpartners.com/security-blog/how-to-secure-body-worn-camer…
∗∗∗ Offene Rechnung für „Gelbe Seiten Online“-Eintrag nicht bezahlen ∗∗∗
---------------------------------------------
In den letzten Tagen haben zahlreiche Unternehmen eine E-Mail von gsol-dach.com erhalten. Darin werden sie aufgefordert, eine Rechnung für einen angeblichen Premium-Firmenbucheintrag zu bezahlen. Achtung: Diese Rechnungen sind Betrug!
---------------------------------------------
https://www.watchlist-internet.at/news/rechnung-fuer-gelbe-seiten-online-ei…
∗∗∗ Hackers impersonate Ukraine’s CERT to trick people into allowing computer access ∗∗∗
---------------------------------------------
CERT-UA is warning Ukrainians not to accept requests for help via AnyDesk software unless they are sure the source is legitimate.
---------------------------------------------
https://therecord.media/fake-ukraine-cert-anydesk-requests-hackers
∗∗∗ Reverse Engineering Bambu Connect ∗∗∗
---------------------------------------------
The purpose of this guide is to demonstrate the trivial process of extracting the "private keys" used for communicating with Bambu devices to examine, and challenge, the technical basis for Bambu Lab's security justification of Bambu Connect.
---------------------------------------------
https://wiki.rossmanngroup.com/wiki/Reverse_Engineering_Bambu_Connect
∗∗∗ Vulnerability Archeology: Stealing Passwords with IBM i Access Client Solutions ∗∗∗
---------------------------------------------
Two weeks ago IBM published a support article about a compatibility issue affecting IBM i Access Client Solutions (ACS) when running on Windows 11 24H2. [..] Debugging the entry point in cwbnetnt.dll also confirms that password information is no longer passed to the Network Provider!. This change was documented by Microsoft here in March 2024, we believe IBM should’ve referenced this document in their memo. This is an important change from Microsoft - let’s hope not many applications rely on this backdoor and their insecure artifacts get cleaned up properly!
---------------------------------------------
https://blog.silentsignal.eu/2025/01/21/ibm-acs-password-dump/
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by AlmaLinux (grafana), Debian (libebml, poco, redis, sympa, tiff, and ucf), Fedora (rsync), Mageia (dcmtk, git, proftpd, and raptor2), Red Hat (grafana, iperf3, kernel, microcode_ctl, and redis), SUSE (chromium, dhcp, git, libqt5-qtwebkit, and pam_u2f), and Ubuntu (python3.10, python3.8 and python3.12).
---------------------------------------------
https://lwn.net/Articles/1005708/
∗∗∗ Webbrowser: Lücke in Brave ermöglicht gefälschte Anzeige der Download-Quelle ∗∗∗
---------------------------------------------
Im Webbrowser Brave können Angreifer eine Sicherheitslücke missbrauchen, die zur falschen Anzeige einer Download-Quelle führt. [..] Die Sicherheitslücke schließt Brave mit der Version 1.74.48, die in der Mitte vergangener Woche veröffentlicht wurde.
---------------------------------------------
https://heise.de/-10250205
∗∗∗ Traffic Alert and Collision Avoidance System (TCAS) II ∗∗∗
---------------------------------------------
https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-01
∗∗∗ ZF Roll Stability Support Plus (RSSPlus) ∗∗∗
---------------------------------------------
https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-03
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
[View Less]
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 17-01-2025 18:00 − Montag 20-01-2025 18:00
Handler: Michael Schlagenhaufer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Malicious PyPi package steals Discord auth tokens from devs ∗∗∗
---------------------------------------------
A malicious package named pycord-self on the Python package index (PyPI) targets Discord developers to steal authentication tokens …
[View More]and plant a backdoor for remote control over the system. [..] The package mimics the highly popular 'discord.py-self,' which has nearly 28 million downloads, and even offers the functionality of the legitimate project.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/malicious-pypi-package-steal…
∗∗∗ Forscher deckt auf: ChatGPT lässt sich für DDoS-Angriffe missbrauchen ∗∗∗
---------------------------------------------
Eine ChatGPT-API scheint bereitwillig eine lange Liste von Links zur gleichen Webseite anzunehmen - und diese anschließend ungebremst abzufragen. [..] Ausführen lässt sich der DDoS-Angriff laut Flesch durch eine HTTP-Anfrage an eine ChatGPT-API, konkret durch einen POST-Request an die URL "https://chatgpt.com/backend-api/attributions". Die API erwarte eine Liste von Hyperlinks, schreibt der Forscher. Jedoch werde nicht geprüft, ob ein Hyperlink zur gleichen Ressource mehrfach genannt wird.
---------------------------------------------
https://www.golem.de/news/forscher-deckt-auf-chatgpt-laesst-sich-fuer-ddos-…
∗∗∗ Partial ZIP File Downloads, (Mon, Jan 20th) ∗∗∗
---------------------------------------------
Say you want a file that is inside a huge online ZIP file (several gigabytes large). Downloading the complete ZIP file would take too long.
---------------------------------------------
https://isc.sans.edu/diary/rss/31608
∗∗∗ Private Keys in the Fortigate Leak ∗∗∗
---------------------------------------------
A few days ago, a download link for a leak of configuration files for Fortigate/Fortinet devices was posted on an Internet forum. [..] It was first reported by heise, a post by Kevin Beaumont contains further info. What has not been widely recognized is that this leak also contains TLS and SSH private keys.
---------------------------------------------
https://blog.hboeck.de:443/archives/908-Private-Keys-in-the-Fortigate-Leak.…
∗∗∗ Looking at the Attack Surfaces of the Pioneer DMH-WT7600NEX IVI ∗∗∗
---------------------------------------------
For the upcoming Pwn2Own Automotive contest, a total of four in-vehicle infotainment (IVI) head units have been selected as targets. [..] This blog post aims to detail some of the attack surfaces of the DMH-WT7600NEX unit as well as provide information on how to extract the software running on this unit for further vulnerability research.
---------------------------------------------
https://www.thezdi.com/blog/2025/1/16/looking-at-the-attack-surfaces-of-the…
∗∗∗ Die meisten Cyberkriminellen hacken nicht, sondern loggen sich ein ∗∗∗
---------------------------------------------
Bei 57 Prozent der erfolgreichen Cyberangriffe ist kein großer Hack über Sicherheitslücken erforderlich. Die Cyberkriminellen nutzten einfach ein kompromittiertes Nutzerkonto, um Zugang auf die Systeme zu erhalten, so die Analyse von Varonis zu solchen Vorfällen
---------------------------------------------
https://www.borncity.com/blog/2025/01/19/die-meisten-cyberkriminellen-hacke…
∗∗∗ Hackers Claim Breach of Hewlett Packard Enterprise, Lists Data for Sale ∗∗∗
---------------------------------------------
Hacker IntelBroker claims to have breached Hewlett Packard Enterprise (HPE), exposing sensitive data like source code, certificates, and PII, now available for sale online.
---------------------------------------------
https://hackread.com/hackers-claim-hewlett-packard-data-breach-sale/
∗∗∗ Secure Coding: Apache Maven gegen Cache-Poisoning-Attacken rüsten ∗∗∗
---------------------------------------------
Dependency-Management-Systeme wie Maven sind immer wieder Ziel von Cache-Poisoning-Angriffen, gegen die nur konsequent umgesetzte Sicherheitspraktiken helfen.
---------------------------------------------
https://heise.de/-10244779
∗∗∗ Hilton, Hyatt, Marriott: 437.000 Datensätze aus Verwaltungsplattform bei HIBP ∗∗∗
---------------------------------------------
Kriminelle haben Daten bei der Verwaltungsplattform Otelier geklaut. Rund 437.000 Datensätze etwa von Hilton, Hyatt oder Marriott sind nun bei HIBP.
---------------------------------------------
https://heise.de/-10248339
∗∗∗ Investigating an "evil" RJ45 dongle ∗∗∗
---------------------------------------------
Earlier this week, a young entrepreneur caused stir on social media by suggesting that an Ethernet-to-USB they purchased from China was preloaded with malware that “evaded virtual machines”, “captured keystrokes”, and “used Russian-language elements”. [..] To get to that point, we didn’t need a hardware lab; a bit of patience and Google-fu was enough.
---------------------------------------------
https://lcamtuf.substack.com/p/investigating-an-evil-rj45-dongle
=====================
= Vulnerabilities =
=====================
∗∗∗ VU#199397: Insecure Implementation of Tunneling Protocols (GRE/IPIP/4in6/6in4) ∗∗∗
---------------------------------------------
Researchers at the DistriNet-KU Leuven research group have discovered millions of vulnerable Internet systems that accept unauthenticated IPIP, GRE, 4in6, or 6in4 traffic. This can be considered a generalization of the vulnerability in VU#636397 : IP-in-IP protocol routes arbitrary traffic by default (CVE-2020-10136). The exposed systems can be abused as one-way proxies, enable an adversary to spoof the source address of packets (CWE-290 Authentication Bypass by Spoofing), or permit access to an organization's private network.
---------------------------------------------
https://kb.cert.org/vuls/id/199397
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by AlmaLinux (.NET 8.0, .NET 9.0, ipa, and NetworkManager), Debian (389-ds-base, busybox, libreoffice, rsync, ruby2.7, tomcat10, and tryton-server), Fedora (chromium and stb), Mageia (openafs and vim), Oracle (.NET 8.0 and .NET 9.0), SUSE (amazon-ssm-agent, chromedriver, git, golang-github-prometheus-prometheus, govulncheck-vulndb, grafana, hplip, pam_u2f, perl-Compress-Raw-Zlib, perl-IO-Compress, redis, redis7, rsync, and velociraptor), and Ubuntu (libpodofo and linux-xilinx-zynqmp).
---------------------------------------------
https://lwn.net/Articles/1005638/
∗∗∗ Nvidia: Datenabfluss durch Sicherheitsleck in Grafiktreiber möglich ∗∗∗
---------------------------------------------
Nvidia hat Sicherheitslücken in seinen Grafikkartentreibern entdeckt. Angreifer können dadurch Informationen abgreifen. Updates stehen bereit.
---------------------------------------------
https://heise.de/-10248258
∗∗∗ Sicherheitspatch: Unbefugte Zugriffe auf bestimmte Switches von Moxa möglich ∗∗∗
---------------------------------------------
Angreifer können bei Moxa-Switches der EDS-508A-Serie die Authentifizierung umgehen. Die Sicherheitslücke gilt als kritisch. Um Angriffe vorzubeugen, sollten Netzwerkadmins die Firmware ihrer Ethernet-Switches der Serie EDS-508A von Moxa auf den aktuellen Stand bringen.
---------------------------------------------
https://heise.de/-10249285
∗∗∗ Yubico Warns of 2FA Security Flaw in pam-u2f for Linux and macOS Users ∗∗∗
---------------------------------------------
https://thecyberexpress.com/yubico-2fa-bypass-vulnerability-advisory/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
[View Less]
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 16-01-2025 18:00 − Freitag 17-01-2025 18:00
Handler: Alexander Riepl
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ D-Trust: Cyberangriff trifft Trustcenter der Bundesdruckerei ∗∗∗
---------------------------------------------
Aus einem Antragsportal der D-Trust GmbH sind potenziell personenbezogene Daten abgeflossen. Wer hinter dem Angriff steckt, ist noch …
[View More]unklar.
---------------------------------------------
https://www.golem.de/news/d-trust-cyberangriff-trifft-trustcenter-der-bunde…
∗∗∗ Mercedes-Benz Head Unit security research report ∗∗∗
---------------------------------------------
Kaspersky experts analyzed the Mercedes-Benz head unit, its IPC protocols and firmware, and found new vulnerabilities via physical access.
---------------------------------------------
https://securelist.com/mercedes-benz-head-unit-security-research/115218/
∗∗∗ New Star Blizzard spear-phishing campaign targets WhatsApp accounts ∗∗∗
---------------------------------------------
In mid-November 2024, Microsoft Threat Intelligence observed the Russian threat actor we track as Star Blizzard sending their typical targets spear-phishing messages, this time offering the supposed opportunity to join a WhatsApp group. This is the first time we have identified a shift in Star Blizzard’s longstanding tactics, techniques, ..
---------------------------------------------
https://www.microsoft.com/en-us/security/blog/2025/01/16/new-star-blizzard-…
∗∗∗ Gootloader inside out ∗∗∗
---------------------------------------------
Open-source intelligence reveals the server-side code of this pernicious SEO-driven malware - without needing a lawyer afterward
---------------------------------------------
https://news.sophos.com/en-us/2025/01/16/gootloader-inside-out/
∗∗∗ U.S. Sanctions North Korean IT Worker Network Supporting WMD Programs ∗∗∗
---------------------------------------------
The U.S. Treasury Departments Office of Foreign Assets Control (OFAC) sanctioned two individuals and four entities for their alleged involvement in illicit revenue generation schemes for the Democratic Peoples Republic of Korea (DPRK) by dispatching ..
---------------------------------------------
https://thehackernews.com/2025/01/us-sanctions-north-korean-it-worker.html
∗∗∗ Hackers Likely Stole FBI Call Logs From AT&T That Could Compromise Informants ∗∗∗
---------------------------------------------
A breach of AT&T that exposed “nearly all” of the company’s customers may have included records related to confidential FBI sources, potentially explaining the bureau’s new embrace of end-to-end encryption.
---------------------------------------------
https://www.wired.com/story/hackers-likely-stole-fbi-call-logs-from-att-tha…
∗∗∗ Biden ordnet für US-Behörden Verschlüsselung von E-Mail, DNS und BGP an ∗∗∗
---------------------------------------------
Ende-zu-Ende-Verschlüsselung, bessere Software und Abwehr, Post-Quanten, Aufsicht über Lieferanten, Passkeys, Erforschung von KI – Biden verordnet gute Medizin.
---------------------------------------------
https://www.heise.de/news/Biden-ordnet-Verschluesselung-von-E-Mail-DNS-und-…
∗∗∗ Daten von rund 250.000 MSI-Kunden bei Have I Been Pwned ∗∗∗
---------------------------------------------
Bei einem Cybervorfall bei MSI sind 2024 offenbar zahlreiche Kundendatensätze kopiert worden. Rund 250.000 Stück hat HIBP nun aufgenommen.
---------------------------------------------
https://www.heise.de/news/Daten-von-rund-250-000-MSI-Kunden-bei-Have-I-Been…
∗∗∗ Vertrauensdiensteanbieter D-Trust informiert über Datenschutzvorfall ∗∗∗
---------------------------------------------
Bei D-Trust kam es zu einem Datenschutzvorfall. Betroffen ist das Antragsportal für Signatur- und Siegelkarten. Die Ermittlungen laufen.
---------------------------------------------
https://www.heise.de/news/Vertrauensdiensteanbieter-D-Trust-informiert-uebe…
∗∗∗ Chinese Innovations Spawn Wave of Toll Phishing Via SMS ∗∗∗
---------------------------------------------
Residents across the United States are being inundated with text messages purporting to come from toll road operators like E-ZPass, warning that recipients face fines if a delinquent toll fee remains unpaid. Researchers say the surge in SMS spam coincides with new features added to a popular commercial phishing kit sold in China that makes it simple to ..
---------------------------------------------
https://krebsonsecurity.com/2025/01/chinese-innovations-spawn-wave-of-toll-…
∗∗∗ OSV-SCALIBR: A library for Software Composition Analysis ∗∗∗
---------------------------------------------
In December 2022, we announced OSV-Scanner, a tool to enable developers to easily scan for vulnerabilities in their open source dependencies. Together with the open source community, we’ve continued to build this tool, adding remediation features, as well ..
---------------------------------------------
http://security.googleblog.com/2025/01/osv-scalibr-library-for-software.html
∗∗∗ PayPal ruft an? Vorsicht Betrug! ∗∗∗
---------------------------------------------
Aktuell erhält die Watchlist Internet zahlreiche Meldungen zu Anrufen durch angebliche PayPal-Mitarbeiter:innen. Heben Sie ab, berichtet man Ihnen von angeblichen Abbuchungen von Ihrem PayPal-Konto und fordert Ihre Mithilfe zum Blockieren der Abbuchungen. Tatsächlich greift man dabei aber auf Ihre Systeme zu und stiehlt Ihnen Ihr Geld. Ein Schaden entsteht erst durch das Telefonat!
---------------------------------------------
https://www.watchlist-internet.at/news/paypal-ruft-an/
∗∗∗ Let’s talk about AI and end-to-end encryption ∗∗∗
---------------------------------------------
Recently, I came across a fantastic new paper by a group of NYU and Cornell researchers entitled “How to think about end-to-end encryption and AI.” I’m extremely grateful to see this paper, because while I don’t agree with every one of it’s ..
---------------------------------------------
https://blog.cryptographyengineering.com/2025/01/17/lets-talk-about-ai-and-…
∗∗∗ Threat Brief: CVE-2025-0282 and CVE-2025-0283 ∗∗∗
---------------------------------------------
CVE-2025-0282 and CVE-2025-0283 affect multiple Ivanti products. This threat brief covers attack scope, including details from an incident response case.
---------------------------------------------
https://unit42.paloaltonetworks.com/threat-brief-ivanti-cve-2025-0282-cve-2…
∗∗∗ New WDAC Exploit Technique: Leveraging Policies to Disable EDRs and Evade Detection ∗∗∗
---------------------------------------------
The file “SiPolicy.p7b” contains policies that Windows OS and Windows Defender (AV) will listen to and your antivirus will apply the policies that this ..
---------------------------------------------
https://www.truesec.com/hub/blog/new-wdac-exploit-technique-leveraging-poli…
∗∗∗ IoT Botnet Linked to Large-scale DDoS Attacks Since the End of 2024 ∗∗∗
---------------------------------------------
Since the end of 2024, we have been continuously monitoring large-scale DDoS attacks orchestrated by an IoT botnet exploiting vulnerable IoT devices such as wireless routers and IP cameras.
---------------------------------------------
https://www.trendmicro.com/en_us/research/25/a/iot-botnet-linked-to-ddos-at…
∗∗∗ Announcing Six Day and IP Address Certificate Options in 2025 ∗∗∗
---------------------------------------------
This year we will continue to pursue our commitment to improving the security of the Web PKI by introducing the option to get certificates with six-day lifetimes (“short-lived certificates”). We will also add support for IP addresses in addition to domain names ..
---------------------------------------------
https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/
∗∗∗ A Response to Recent Claims About Sessions Security Architecture ∗∗∗
---------------------------------------------
We were recently made aware of a blog published by a security researcher which makes a number of claims about Session and supposed flaws in Session’s design and implementation. We, as well as other Session contributors, have now had time to read through the blog and investigate the claims and wanted to give a detailed response on each point raised by the author.
---------------------------------------------
https://getsession.org/blog/a-response-to-recent-claims-about-sessions-secu…
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (rsync and tomcat9), Fedora (chromium, mingw-python-jinja2, redict, and valkey), Gentoo (GIMP and pip), Oracle (.NET, fence-agents, ipa, kernel, python-virtualenv, raptor2, and rsync), Red Hat (.NET 8.0 and .NET 9.0), SUSE (apache2-mod_jk, git, git-lfs, kernel, python-Django, thunderbird, and xen), and Ubuntu (audacity, bcel, dotnet8, dotnet9, gimp-dds, harfbuzz, libxml2, poppler, rsync, and tqdm).
---------------------------------------------
https://lwn.net/Articles/1005433/
∗∗∗ Aviatrix Controllers OS Command Injection Vulnerability ∗∗∗
---------------------------------------------
https://fortiguard.fortinet.com/threat-signal-report/5982
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
[View Less]
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 15-01-2025 18:00 − Donnerstag 16-01-2025 18:00
Handler: Alexander Riepl
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ MFA Failures - The Worst is Yet to Come ∗∗∗
---------------------------------------------
This article delves into the rising tide of MFA failures, the alarming role of generative AI in amplifying these attacks, the growing user discontent …
[View More]weakening our defenses, and the glaring vulnerabilities being frequently exploited. The storm is building, and the worst is yet to come.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/mfa-failures-the-worst-is-ye…
∗∗∗ An honest mistake - and a cautionary tale ∗∗∗
---------------------------------------------
We all make mistakes. That is only natural. However, there are cases in which these mistakes can have unexpected consequences. A Twitter user recently found this out the hard way. The ingredients: a cheap USB-C adapter with a network connection, an internet connection and a sandbox.
---------------------------------------------
https://www.gdatasoftware.com/blog/2025/01/38129-usb-network-adapter-malware
∗∗∗ Windows 10 und 11: Microsoft verwirrt Nutzer mit Bitlocker-Bug ∗∗∗
---------------------------------------------
Auf einigen Windows-Geräten mit aktivierter Bitlocker-Verschlüsselung erscheint eine unerwartete Meldung. Microsoft untersucht das Problem.
---------------------------------------------
https://www.golem.de/news/windows-10-und-11-microsoft-verwirrt-nutzer-mit-b…
∗∗∗ Tiktok, Xiaomi, Aliexpress: Beschwerden wegen Datentransfers nach China eingereicht ∗∗∗
---------------------------------------------
China ist als autoritärer Überwachungsstaat nach Einschätzung von Datenschützern kein zulässiger Standort für europäische Nutzerdaten.
---------------------------------------------
https://www.golem.de/news/tiktok-xiaomi-aliexpress-beschwerden-wegen-datent…
∗∗∗ Bidens Cyber Ambassador Urges Trump Not to Cede Ground to Russia and China in Global Tech Fight ∗∗∗
---------------------------------------------
Nathaniel Fick, the ambassador for cyberspace and digital policy, has led US tech diplomacy amid a rising tide of pressure from authoritarian regimes. Will the Trump administration undo that work?
---------------------------------------------
https://www.wired.com/story/nathaniel-fick-us-cyber-ambassador-exit-intervi…
∗∗∗ IT-Sicherheit: EU-Kommission will Gesundheitsbranche unterstützen ∗∗∗
---------------------------------------------
Verstärkte Prävention und rasche Reaktion auf Attacken stehen im Zentrum eines EU-Plans für IT-Sicherheit von Krankenhäusern und Gesundheitsdienstleistern.
---------------------------------------------
https://www.heise.de/news/IT-Attacken-So-will-die-EU-Kommission-den-Gesundh…
∗∗∗ Es kann Schadcode auf HPE Aruba Networking AOS Controllers und Gateways gelangen ∗∗∗
---------------------------------------------
Netzwerktechnik von HPE Aruba ist verwundbar. Aktuelle Updates schließen insgesamt zwei Sicherheitslücken.
---------------------------------------------
https://www.heise.de/news/Es-kann-Schadcode-auf-HPE-Aruba-Networking-AOS-Co…
∗∗∗ Achtung vor go.hopeforlifefund.com: Spendenaufruf für Nikolas ist Fake! ∗∗∗
---------------------------------------------
Kinder, die an Krebs erkranken, stehen vor großen Herausforderungen und ihre Familien sind oft mit enormen finanziellen Belastungen konfrontiert. Spendenaktionen können hier ein Lichtblick sein. Doch leider gibt es auch Kriminelle, die das Mitgefühl der Menschen schamlos ausnutzen – wie im Fall der betrügerischen Spendenplattform go.hopeforlifefund.com, die angeblich für den krebskranken Jungen Nikolas Spenden sammelt.
---------------------------------------------
https://www.watchlist-internet.at/news/spendenaufruf-fuer-krebskranken-niko…
∗∗∗ FTC cracks down on GoDaddy for cybersecurity failings ∗∗∗
---------------------------------------------
GoDaddy’s failure to use industry standard measures led to what the Federal Trade Commission called “several major security breaches” between 2019 and 2022.
---------------------------------------------
https://therecord.media/ftc-godaddy-cyber-failings-fine
∗∗∗ Detecting Teams Chat Phishing Attacks (Black Basta) ∗∗∗
---------------------------------------------
For quite a while now, there has been a new ongoing threat campaign where the adversaries first bomb a user’s mailbox with spam emails and then pose as Help Desk or IT Support on Microsoft Teams to trick their potential victims into providing ..
---------------------------------------------
https://blog.nviso.eu/2025/01/16/detecting-teams-chat-phishing-attacks-blac…
∗∗∗ 2022 zero day was used to raid Fortigate firewall configs. Somebody just released them. ∗∗∗
---------------------------------------------
Back in 2022, Fortinet warned that somebody had a zero day vulnerability and was using it to exploit Fortigate firewalls https://www.fortinet.com/blog/psirt-blogs/update-regarding-cve-2022-40684 ..
---------------------------------------------
https://doublepulsar.com/2022-zero-day-was-used-to-raid-fortigate-firewall-…
∗∗∗ Black Basta-Style Cyberattack Hits Inboxes with 1,165 Emails in 90 Minutes ∗∗∗
---------------------------------------------
A recent cyberattack, mimicking the tactics of the notorious Black Basta ransomware group, targeted one of SlashNext’s clients.…
---------------------------------------------
https://hackread.com/black-basta-cyberattack-hits-inboxes-with-1165-emails/
∗∗∗ Proxying PyRIT for fun and profit ∗∗∗
---------------------------------------------
If you are in the AI security field, you are probably facing the problem of testing Large Language Models (LLMs) at scale and questioning the optimal balance between automatic testing and manual testing ..
---------------------------------------------
https://www.nccgroup.com/us/research-blog/proxying-pyrit-for-fun-and-profit/
∗∗∗ Dont Use Session (Signal Fork) ∗∗∗
---------------------------------------------
The main reason I said to avoid Session, all those months ago, was simply due to their decision to remove forward secrecy (which is an important security property of cryptographic protocols they inherited for free when they forked libsignal).
---------------------------------------------
https://soatok.blog/2025/01/14/dont-use-session-signal-fork/
∗∗∗ UK Officials Consider Banning Ransomware Payments from Public Entities ∗∗∗
---------------------------------------------
The UK government is poised to take a decisive step in the fight against ransomware by banning public sector entities from paying ransoms. This collection of proposals, part of a broader effort to protect critical national infrastructure, aims to disrupt the business model of cybercriminals and shield essential services like the NHS, schools, and local ..
---------------------------------------------
https://socket.dev/blog/uk-officials-consider-banning-ransomware-payments-f…
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by AlmaLinux (fence-agents, raptor2, and rsync), Debian (chromium), Fedora (rsync and seamonkey), Mageia (openjpeg2), Red Hat (tuned), Slackware (git), SUSE (dcmtk, dnsmasq, govulncheck-vulndb, libQtWebKit4, libraptor-devel, opera, python311-Pillow, python311-translate-toolkit, rsync, and SDL2_sound-devel), and Ubuntu (linux-raspi-5.4, neomutt, and python2.7).
---------------------------------------------
https://lwn.net/Articles/1005292/
∗∗∗ CVE-2024-9042 ∗∗∗
---------------------------------------------
Command Injection affecting Windows nodes via nodes/*/logs/query API
---------------------------------------------
https://github.com/kubernetes/kubernetes/issues/129654
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
[View Less]
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 14-01-2025 18:00 − Mittwoch 15-01-2025 18:00
Handler: Alexander Riepl
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ WP3.XYZ malware attacks add rogue admins to 5,000+ WordPress sites ∗∗∗
---------------------------------------------
A new malware campaign has compromised more than 5,000 WordPress sites to create admin accounts, install a malicious plugin, and …
[View More]steal data.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/wp3xyz-malware-attacks-add-r…
∗∗∗ Undercover Operations: Scraping the Cybercrime Underground ∗∗∗
---------------------------------------------
A blog about web scraping methods, use cases, challenges, and how to overcome them.
---------------------------------------------
https://www.sans.org/blog/undercover-operations-scraping-the-cybercrime-und…
∗∗∗ Cyber-Bedrohungen für die öffentliche Ladeinfrastruktur: Risiken und Schutzmaßnahmen durch Penetrationstests ∗∗∗
---------------------------------------------
Angriffe auf die öffentliche Ladeinfrastruktur für Elektrofahrzeuge nehmen zu und gefährden den Ruf und die Sicherheit der ..
---------------------------------------------
https://sec-consult.com/de/blog/detail/cyber-bedrohungen-fuer-die-oeffentli…
∗∗∗ Phishing False Alarm ∗∗∗
---------------------------------------------
A very security-conscious company was hit with a (presumed) massive state-actor phishing attack with gift cards, and everyone rallied to combat it—until it turned out it was company management sending the gift cards.
---------------------------------------------
https://www.schneier.com/blog/archives/2025/01/phishing-false-alarm.html
∗∗∗ Miscreants mass exploited Fortinet firewalls, highly probable zero-day used ∗∗∗
---------------------------------------------
Ransomware not off the table, Arctic Wolf threat hunter tells El Reg Updated Miscreants running a "mass exploitation campaign" against Fortinet firewalls, which peaked in December, may be using an unpatched zero-day vulnerability to compromise the equipment, according to security researchers who say theyve observed the ..
---------------------------------------------
https://www.theregister.com/2025/01/14/miscreants_mass_exploited_fortinet_f…
∗∗∗ Patchday Fortinet: Hintertür ermöglicht unbefugte Zugriffe auf FortiSwitch ∗∗∗
---------------------------------------------
Der Anbieter von IT-Securitylösungen Fortinet hat zahlreiche Sicherheitsupdates für seine Produkte veröffentlicht. Das sollten Netzwerkadmins im Blick haben.
---------------------------------------------
https://www.heise.de/news/Patchday-Fortinet-Hintertuer-ermoeglicht-unbefugt…
∗∗∗ Cybergang Cl0p: Angeblich Daten durch Cleo-Sicherheitslücke abgezogen ∗∗∗
---------------------------------------------
Die kriminelle Bande Cl0p hat angeblich bei vielen Unternehmen Daten durch eine Sicherheitslücke in der Transfersoftware Cleo gestohlen.
---------------------------------------------
https://www.heise.de/news/Cybergang-Cl0p-Angeblich-Daten-durch-Cleo-Sicherh…
∗∗∗ Security flaws found in tiny phones promoted to children ∗∗∗
---------------------------------------------
TL;DR Three mini smartphones promoted to children were analysed These types of phones are heavily promoted on TikTok All had outdated operating systems All could be rooted without wiping the ..
---------------------------------------------
https://www.pentestpartners.com/security-blog/security-flaws-found-in-tiny-…
∗∗∗ Security flaws found in tiny phones promoted to children ∗∗∗
---------------------------------------------
TL;DR Three mini smartphones promoted to children were analysed Those devices are heavily promoted on TikTok All had outdated operating systems All could be rooted without wiping the phone, allowing ..
---------------------------------------------
https://www.pentestpartners.com/security-blog/security-flaws-found-in-tiny-…
∗∗∗ Adobe Releases Security Updates for Multiple Products ∗∗∗
---------------------------------------------
Adobe released security updates to address vulnerabilities in multiple Adobe software products including Adobe Photoshop, Animate, and Illustrator for iPad. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following ..
---------------------------------------------
https://www.cisa.gov/news-events/alerts/2025/01/14/adobe-releases-security-…
∗∗∗ TAG Bulletin: Q3 2024 ∗∗∗
---------------------------------------------
This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q3 2024.
---------------------------------------------
https://blog.google/threat-analysis-group/tag-bulletin-q3-2024/
∗∗∗ Patchday: Windows 10/11 Updates (14. Januar 2025) ∗∗∗
---------------------------------------------
Am 14. Januar 2024 (zweiter Dienstag im Monat, Patchday bei Microsoft) hat Microsoft auch kumulative Updates für die noch unterstützten Versionen der Client-Betriebssysteme Windows 10 und Windows 11 veröffentlicht. Hier einige ..
---------------------------------------------
https://www.borncity.com/blog/2025/01/15/patchday-windows-10-11-updates-14-…
∗∗∗ Passkeys: the promise of a simpler and safer alternative to passwords ∗∗∗
---------------------------------------------
The merits of choosing passkeys over passwords to help keep your online accounts more secure, and explaining how the technology promises to do this
---------------------------------------------
https://www.ncsc.gov.uk/blog-post/passkeys-promise-simpler-alternative-pass…
∗∗∗ Your Single-Page Applications Are Vulnerable: Heres How to Fix Them ∗∗∗
---------------------------------------------
Due to their client-side nature, single-page applications (SPAs) will typically have multiple access control vulnerabilitiesBy implementing a robust access control policy on supporting APIs, the risks associated with client-side rendering can be largely mitigatedUsing server-side ..
---------------------------------------------
https://cloud.google.com/blog/topics/threat-intelligence/single-page-applic…
∗∗∗ Tracking cloud-fluent threat actors - Part two: Behavioral cloud IOCs ∗∗∗
---------------------------------------------
Discover how behavioral cloud IOCs can expose malicious activity as we break down real-world examples to reveal actionable detection techniques.
---------------------------------------------
https://www.wiz.io/blog/detecting-behavioral-cloud-indicators-of-compromise…
∗∗∗ The Risks of Misguided Research in Supply Chain Security ∗∗∗
---------------------------------------------
On January 8, 2025, it came to light that Snyk, a well-known security tool—frequently used to protect against supply chain attacks—was implicated in a troubling event. Several malicious packages targeting the popular AI coding platform Cursor were deployed to the public npm registry. These packages, named “cursor-retrieval,” “cursor-always-local,” ..
---------------------------------------------
https://socket.dev/blog/the-risks-of-misguided-research-in-supply-chain-sec…
∗∗∗ Penetration Testing for ISO/IEC 27001: A Detailed Guide to Compliance ∗∗∗
---------------------------------------------
In an era where data breaches and cyber threats dominate headlines, safeguarding sensitive information has become a critical priority for organizations worldwide. ISO/IEC 27001, the internationally recognized standard for Information Security Management Systems (ISMS), offers a robust framework to protect valuable information assets. By ..
---------------------------------------------
https://fortbridge.co.uk/regulations/penetration-testing-for-iso-iec-27001-…
=====================
= Vulnerabilities =
=====================
∗∗∗ Six vulnerabilities discovered in rsync ∗∗∗
---------------------------------------------
Nick Tait announced on the oss-security mailing list that rsync, the widely used file transfer program, had a number of serious vulnerabilities.Users can mitigate all six vulnerabilities by upgrading to version 3.4.0, which was released on January 14. While all users should upgrade, servers that use rsyncd are especially impacted:In the most severe CVE, an attacker ..
---------------------------------------------
https://lwn.net/Articles/1005129/
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Arch Linux (rsync), Debian (rsync), Fedora (perl-Net-OAuth and redis), Red Hat (ipa, raptor2, rsync, and tuned), Slackware (rsync), SUSE (apache2-mod_jk, git, kernel, rclone, rsync, and webkit2gtk3), and Ubuntu (git, linux-azure-5.4, pdns, pdns-recursor, python-django, rlottie, and rsync).
---------------------------------------------
https://lwn.net/Articles/1005163/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
[View Less]
=====================
= End-of-Day report =
=====================
Timeframe: Montag 13-01-2025 18:00 − Dienstag 14-01-2025 18:00
Handler: Alexander Riepl
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Abgehörte Kryptohandys: BGH erlaubt Verwertung - Berliner Landgericht lehnt ab ∗∗∗
---------------------------------------------
Die Justiz ringt seit Jahren um die Verwertung von Daten abgehörter Kryptohandys. Nun gab es in wenigen Wochen gegensä…
[View More]tzliche Urteile.
---------------------------------------------
https://www.golem.de/news/abgehoerte-kryptohandys-bgh-erlaubt-verwertung-be…
∗∗∗ Analyzing CVE-2024-44243, a macOS System Integrity Protection bypass through kernel extensions ∗∗∗
---------------------------------------------
Microsoft discovered a macOS vulnerability allowing attackers to bypass System Integrity Protection (SIP) by loading third party kernel extensions, which could lead to serious consequences, such as allowing attackers to install rootkits, create persistent malware, bypass Transparency, Consent, and Control (TCC), and expand the attack surface to perform other ..
---------------------------------------------
https://www.microsoft.com/en-us/security/blog/2025/01/13/analyzing-cve-2024…
∗∗∗ The Database Slayer: Deep Dive and Simulation of the Xbash Malware ∗∗∗
---------------------------------------------
In the world of malware, common ransomware schemes aim to take the data within databases (considered the "gold" in the vault of any organization) and hold them hostage, promising data recovery upon ransom payment.
---------------------------------------------
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-databas…
∗∗∗ Snyk appears to deploy malicious packages targeting Cursor for unknown reason ∗∗∗
---------------------------------------------
Packages removed, vendor said to have apologized to AI code editor as onlookers say it could have been a test Developer security company Snyk is at the center of allegations concerning the possible targeting or testing of Cursor, an AI code editor company, using "malicious" packages uploaded to NPM.
---------------------------------------------
https://www.theregister.com/2025/01/14/snyk_npm_deployment_removed/
∗∗∗ SAP-Patchday: Updates schließen 14 teils kritische Schwachstellen ∗∗∗
---------------------------------------------
Im Januar bedenkt SAP Produkte mit 14 Sicherheitsmitteilungen und zugehörigen Updates. Zwei davon gelten als kritisch.
---------------------------------------------
https://www.heise.de/news/SAP-Patchday-Hersteller-stopft-teils-kritische-SI…
∗∗∗ Telefónica: Infostealer-Kampagne legt interne Jira-Issues offen ∗∗∗
---------------------------------------------
Der Telekommunikationsanbieter Telefónica wurde Opfer eines Cyberangriffs. Kriminelle erbeuteten offenbar Zugriff auf große Mengen interner Daten.
---------------------------------------------
https://www.heise.de/news/Telefonica-Infostealer-Kampagne-legt-interne-Jira…
∗∗∗ Achtung Fake: vailllant.at und vaillantproservice.at ∗∗∗
---------------------------------------------
Kriminelle missbrauchen das für Heiztechnik bekannte Unternehmen Vaillant für eine Betrugsmasche. Auf gefälschten Webseiten geben sich die Kriminellen als 24-Stunden-Notdienst für Österreich bzw. Wien/Niederösterreich aus. Ruft man den betrügerischen Notdienst an, kommen unseriöser Handwerker:innen, die den Schaden nicht fachgerecht beheben, sondern eine horrende Summe in Rechnung stellen!
---------------------------------------------
https://www.watchlist-internet.at/news/achtung-fake-vailllantat-und-vaillan…
∗∗∗ One Step Ahead in Cyber Hide-and-Seek: Automating Malicious Infrastructure Discovery With Graph Neural Networks ∗∗∗
---------------------------------------------
Graph neural networks aid in analyzing domains linked to known attack indicators, effectively uncovering new malicious domains and cybercrime campaigns.
---------------------------------------------
https://unit42.paloaltonetworks.com/graph-neural-networks/
∗∗∗ Ransomware: Threat Level Remains High in Third Quarter ∗∗∗
---------------------------------------------
Recently established RansomHub group overtakes LockBit to become most prolific ransomware operation.
---------------------------------------------
https://www.security.com/threat-intelligence/ransomware-threat-level-remain…
∗∗∗ CISA Releases the JCDC AI Cybersecurity Collaboration Playbook and Fact Sheet ∗∗∗
---------------------------------------------
Today, CISA released the JCDC AI Cybersecurity Collaboration Playbook and Fact Sheet to foster operational collaboration among government, industry, and international partners and strengthen artificial intelligence (AI) cybersecurity. The playbook provides voluntary information-sharing processes that, if adopted, can help protect organizations from emerging ..
---------------------------------------------
https://www.cisa.gov/news-events/alerts/2025/01/14/cisa-releases-jcdc-ai-cy…
∗∗∗ Major location data broker reports hack to Norwegian authorities ∗∗∗
---------------------------------------------
The location data broker Gravy Analytics confirmed to Norwegian authorities that it was breached by a hacker — potentially exposing a trove of sensitive information.
---------------------------------------------
https://therecord.media/location-data-broker-gravy-breach
∗∗∗ NPM command confusion ∗∗∗
---------------------------------------------
Intro Managing dependencies in JavaScript projects can quickly become a complex undertaking. Tasks include keeping track of versions, ensuring compatibility, and handling updates . npm provides a robust solution to these problems, through a centralized system for managing project dependencies. Primarily accessed through its command-line interface (CLI), npm ..
---------------------------------------------
https://checkmarx.com/blog/npm-command-confusion/
∗∗∗ Malicious Kong Ingress Controller Image Found on DockerHub ∗∗∗
---------------------------------------------
A critical security breach in the software supply chain has been detected. An attacker accessed Kong’s DockerHub account
---------------------------------------------
https://hackread.com/malicious-kong-ingress-controller-image-dockerhub/
∗∗∗ Hackers Using Fake YouTube Links to Steal Login Credentials ∗∗∗
---------------------------------------------
Cybercriminals exploit fake YouTube links to redirect users to phishing pages, stealing login credentials via URI ..
---------------------------------------------
https://hackread.com/hackers-fake-youtube-links-steal-login-credentials/
∗∗∗ Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar ∗∗∗
---------------------------------------------
In Hindi, chokidar (चौकीदार) means “gatekeeper” or “watchman”—a perfect descriptor for chokidar one of Node.js most trusted file-watching libraries with around 56 million weekly downloads. Meanwhile, chalk serves as a cornerstone for terminal string styling in JavaScript, drawing over 265 million downloads weekly. Unfortunately, our Socket threat ..
---------------------------------------------
https://socket.dev/blog/kill-switch-hidden-in-npm-packages-typo-squatting-c…
=====================
= Vulnerabilities =
=====================
∗∗∗ Zyxel security advisory for improper privilege management vulnerability in APs and security router devices ∗∗∗
---------------------------------------------
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-…
∗∗∗ January Security Update ∗∗∗
---------------------------------------------
https://www.ivanti.com/blog/january-security-update
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
[View Less]
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 10-01-2025 18:00 − Montag 13-01-2025 18:00
Handler: Alexander Riepl
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Ongoing attacks on Ivanti VPNs install a ton of sneaky, well-written malware ∗∗∗
---------------------------------------------
In-the-wild attacks tamper with built-in security tool providing infection warnings.
--------------------------------------…
[View More]-------
https://arstechnica.com/security/2025/01/ivanti-vpn-users-are-getting-hacke…
∗∗∗ Phishing texts trick Apple iMessage users into disabling protection ∗∗∗
---------------------------------------------
Cybercriminals are exploiting a trick to turn off Apple iMessages built-in phishing protection for a text and trick users into re-enabling disabled phishing links.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/phishing-texts-trick-apple-i…
∗∗∗ Ransomware abuses Amazon AWS feature to encrypt S3 buckets ∗∗∗
---------------------------------------------
A new ransomware campaign encrypts Amazon S3 buckets using AWSs Server-Side Encryption with Customer Provided Keys (SSE-C) known only to the threat actor, demanding ransoms to receive the decryption key.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/ransomware-abuses-amazon-aws…
∗∗∗ Anwendung blockiert: MacOS stuft Docker Desktop als Malware ein ∗∗∗
---------------------------------------------
Einige Dateien von Docker Desktop für MacOS wurden falsch signiert, so dass Nutzer eine Malware-Warnung erhalten. Eine echte Gefahr besteht nicht.
---------------------------------------------
https://www.golem.de/news/anwendung-blockiert-docker-desktop-unter-macos-al…
∗∗∗ New LLM Jailbreak Uses Models Evaluation Skills Against Them ∗∗∗
---------------------------------------------
SC Media reports on a new jailbreak method for large language models (LLMs) that "takes advantage of models ability to identify and score harmful content in order to trick the models into generating content related to malware, illegal activity, harassment and more. "The Bad Likert Judge multi-step jailbreak technique was developed and tested by ..
---------------------------------------------
https://it.slashdot.org/story/25/01/12/2010218/new-llm-jailbreak-uses-model…
∗∗∗ Nominet probes network intrusion linked to Ivanti zero-day exploit ∗∗∗
---------------------------------------------
Unauthorized activity detected, but no backdoors found UK domain registry Nominet is investigating a potential intrusion into its network related to the latest Ivanti zero-day exploits.
---------------------------------------------
https://www.theregister.com/2025/01/13/nominet_ivanti_zero_day/
∗∗∗ Paypal-Phishing: Angebliche monatliche Finanzberichte ködern Opfer ∗∗∗
---------------------------------------------
Derzeit schaffen es Phishing-Mails an Spam-Filtern vorbeizukommen, die einen monatlichen Finanzbericht für Paypal versprechen.
---------------------------------------------
https://www.heise.de/news/Paypal-Phishing-Angebliche-monatliche-Finanzberic…
∗∗∗ Log Source Management App für IBM QRadar SIEM ist auf vielen Wegen angreifbar ∗∗∗
---------------------------------------------
Weil mehrere Komponenten verwundbar sind, können Angreifer Systeme mit Log Source Management App für IBM QRadar SIEM attackieren.
---------------------------------------------
https://www.heise.de/news/Log-Source-Management-App-fuer-IBM-QRadar-SIEM-is…
∗∗∗ Tackling AI threats. Advanced DFIR methods and tools for deepfake detection ∗∗∗
---------------------------------------------
TL; DR AI-generated documents, videos and more pose significant challenges for DFIR DFIR teams can harness innovative detection strategies and tooling Digital fingerprinting and watermarking, AI-powered and behavioural analyses ..
---------------------------------------------
https://www.pentestpartners.com/security-blog/tackling-ai-threats-advanced-…
∗∗∗ Rufnummernmissbrauch dank Verordnung drastisch zurückgegangen ∗∗∗
---------------------------------------------
Die "Anti-Spoofing-Verordnung" der RTR greift seit September, seitdem gibt es nur noch wenige Vorfälle von Betrug mittels gekaperter Rufnummern
---------------------------------------------
https://www.derstandard.at/story/3000000252624/rufnummernmissbrauch-dank-ve…
∗∗∗ Muddling Meerkat Linked to Domain Spoofing in Global Spam Scams ∗∗∗
---------------------------------------------
Infoblox cybersecurity researchers investigating the mysterious activities of Muddling Meerkat unexpectedly uncovered widespread use of domain spoofing in malicious spam campaigns.
---------------------------------------------
https://hackread.com/muddling-meerkat-domain-spoofing-spam-scams/
∗∗∗ Fake CrowdStrike Recruiters Distribute Malware Via Phishing Emails ∗∗∗
---------------------------------------------
SUMMARY Cybercriminals are deploying a tricky new phishing campaign impersonating the cybersecurity firm CrowdStrike‘s ..
---------------------------------------------
https://hackread.com/fake-crowdstrike-recruiters-malware-phishing-emails/
∗∗∗ 3 Russians Indicted for Operating Blender.io and Sinbad.io Crypto Mixers ∗∗∗
---------------------------------------------
SUMMARY Three Russian nationals have been indicted for their alleged roles in running cryptocurrency mixing services Blender.io and…
---------------------------------------------
https://hackread.com/3-russian-operating-blender-io-sinbad-io-crypto-mixers/
∗∗∗ Exploitation Walkthrough and Techniques - Ivanti Connect Secure RCE (CVE-2025-0282) ∗∗∗
---------------------------------------------
As we saw in our previous blogpost, we fully analyzed Ivanti’s most recent unauthenticated Remote Code Execution vulnerability in their Connect Secure (VPN) appliance. Specifically, we analyzed CVE-2025-0282.Today, we’re ..
---------------------------------------------
https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-c…
∗∗∗ Deep Dive Into a Linux Rootkit Malware ∗∗∗
---------------------------------------------
This is a follow-up analysis to a previous blog about a zero day exploit where the FortiGuard Incident Response (FGIR) team examined how remote attackers exploited multiple vulnerabilities in an appliance to gain control of a customer’s system.
---------------------------------------------
https://feeds.fortinet.com/~/910912481/0/fortinet/blogs~Deep-Dive-Into-a-Li…
∗∗∗ Wiz Research Identifies Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603) ∗∗∗
---------------------------------------------
The Wiz Incident Response team is currently responding to multiple incidents involving CVE-2024-50603, an Aviatrix Controller unauthenticated RCE vulnerability, that can lead to privileges escalation in the AWS control plane. Organizations should patch urgently.
---------------------------------------------
https://www.wiz.io/blog/wiz-research-identifies-exploitation-in-the-wild-of…
∗∗∗ Analysis of Counter-Ransomware Activities in 2024 ∗∗∗
---------------------------------------------
The scourge of ransomware continues primarily because ofthree main reasons: Ransomware-as-a-Service (RaaS), cryptocurrency, and safe havens.RaaS platforms enable aspiring cybercriminals to join a gang and begin launching attacks with a support system that help extract ransom payments from their victims.Cryptocurrency enables cybercriminals to receive funds ..
---------------------------------------------
https://blog.bushidotoken.net/2025/01/analysis-of-counter-ransomware.html
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by AlmaLinux (dpdk, firefox, iperf3, thunderbird, and webkit2gtk3), Debian (firefox-esr, gnuchess, node-mocha, openafs, python-django, and thunderbird), Fedora (libxmp, python-jinja2, suricata, thunderbird, and xen), Mageia (avahi, libjxl, opencontainers-runc, radare2, rizin, and tinyproxy), Oracle (cups, dpdk, firefox, iperf3, ..
---------------------------------------------
https://lwn.net/Articles/1004962/
∗∗∗ MISP 2.4.203 and 2.5.5 released including new features, improvements and many security improvements. ∗∗∗
---------------------------------------------
We are thrilled to announce the release of MISP v2.4.203 and MISP v2.5.5, bringing a range of new features, improvements, and fixes to enhance the platforms performance, usability, and security. These updates reflect our ongoing commitment to providing a robust and reliable open-source ..
---------------------------------------------
https://github.com/MISP/MISP/releases/tag/v2.4.203
∗∗∗ Security Vulnerabilities fixed in Firefox for iOS 134 ∗∗∗
---------------------------------------------
https://www.mozilla.org/en-US/security/advisories/mfsa2025-06/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
[View Less]
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 09-01-2025 18:00 − Freitag 10-01-2025 18:00
Handler: Alexander Riepl
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Ongoing attacks on Ivanti VPNs install a ton of sneaky, well-written malware ∗∗∗
---------------------------------------------
In-the-wild attacks tamper with built-in security tool to suppress infection warnings.
---------------------------------…
[View More]------------
https://arstechnica.com/security/2025/01/ivanti-vpn-users-are-getting-hacke…
∗∗∗ Stealthy Credit Card Skimmer Targets WordPress Checkout Pages via Database Injection ∗∗∗
---------------------------------------------
Recently, we released an article where a credit card skimmer was targeting checkout pages on a Magento site. Now we’ve come across sophisticated credit card skimmer malware while investigating a compromised WordPress ..
---------------------------------------------
https://blog.sucuri.net/2025/01/stealthy-credit-card-skimmer-targets-wordpr…
∗∗∗ Sicherheitsupdates: Angreifer können Netzwerkgeräte mit Junos OS crashen lassen ∗∗∗
---------------------------------------------
Netzwerkgeräte wie Switches von Juniper sind verwundbar. Ansatzpunkte sind mehrere Schwachstellen im Betriebssystem Junos OS.
---------------------------------------------
https://www.heise.de/news/Sicherheitsupdates-Angreifer-koennen-Netzwerkgera…
∗∗∗ Meet FunkSec: A New, Surprising Ransomware Group, Powered by AI ∗∗∗
---------------------------------------------
Executive Summary: The FunkSec ransomware group emerged in late 2024 and published over 85 victims in December, surpassing every other ransomware group that month FunkSec operators appear to use AI-assisted malware development, which can enable even inexperienced actors to quickly produce and refine advanced tools The group’s activities straddle the line ..
---------------------------------------------
https://blog.checkpoint.com/research/meet-funksec-a-new-surprising-ransomwa…
∗∗∗ Do we still have to keep doing it like this? ∗∗∗
---------------------------------------------
Hazel gets inspired by watching Wendy Nather’s recent keynote, and explores ways to challenge security assumptions.
---------------------------------------------
https://blog.talosintelligence.com/do-we-still-have-to-keep-doing-it-like-t…
∗∗∗ How Cracks and Installers Bring Malware to Your Device ∗∗∗
---------------------------------------------
Our research shows how attackers use platforms like YouTube to spread fake installers via trusted hosting services, employing encryption to evade detection and steal sensitive browser data.
---------------------------------------------
https://www.trendmicro.com/en_us/research/25/a/how-cracks-and-installers-br…
∗∗∗ Banshee Stealer Hits macOS Users via Fake GitHub Repositories ∗∗∗
---------------------------------------------
Cybersecurity researchers at Check Point detected a new version of Banshee Stealer in late September 2024, distributed ..
---------------------------------------------
https://hackread.com/banshee-stealer-hits-macos-fake-github-repositories/
∗∗∗ Do Secure-By-Design Pledges Come With Stickers? - Ivanti Connect Secure RCE (CVE-2025-0282) ∗∗∗
---------------------------------------------
Did you have a good break? Have you had a chance to breathe? Wake up. It’s 2025, and the chaos continues. Haha, see what we did? We wrote the exact same thing in 2024 because 2024 was exactly ..
---------------------------------------------
https://labs.watchtowr.com/do-secure-by-design-pledges-come-with-stickers-i…
∗∗∗ How to secure your GitHub Actions workflows with CodeQL ∗∗∗
---------------------------------------------
In the last few months, we secured 75+ GitHub Actions workflows in open source projects, disclosing 90+ different vulnerabilities. Out of this research we produced new support for workflows in CodeQL, empowering ..
---------------------------------------------
https://github.blog/security/application-security/how-to-secure-your-github…
=====================
= Vulnerabilities =
=====================
∗∗∗ ZDI-25-010: Redis Stack Lua Use-After-Free Remote Code Execution Vulnerability ∗∗∗
---------------------------------------------
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Redis Stack. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2024-46981.
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-25-010/
∗∗∗ ZDI-25-009: Redis Stack RedisBloom Integer Overflow Remote Code Execution Vulnerability ∗∗∗
---------------------------------------------
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Redis Stack. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-55656.
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-25-009/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
[View Less]
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 08-01-2025 18:00 − Donnerstag 09-01-2025 18:00
Handler: Alexander Riepl
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Here’s how hucksters are manipulating Google to promote shady Chrome extensions ∗∗∗
---------------------------------------------
How do you stash 18,000 keywords into a description? Turns out its easy.
------------------------------------------…
[View More]---
https://arstechnica.com/security/2025/01/googles-chrome-web-store-has-a-ser…
∗∗∗ Unpatched critical flaws impact Fancy Product Designer WordPress plugin ∗∗∗
---------------------------------------------
Premium WordPress plugin Fancy Product Designer from Radykal is vulnerable to two critical severity flaws that remain unfixed in the current latest version.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/unpatched-critical-flaws-imp…
∗∗∗ Beyond Meh-trics: Examining How CTI Programs Demonstrate Value Using Metrics ∗∗∗
---------------------------------------------
A blog about developing cyber threat intelligence (CTI) metrics.
---------------------------------------------
https://www.sans.org/blog/beyond-meh-trics-examining-how-cti-programs-demon…
∗∗∗ The State of Magecart: A Persistent Threat to E-Commerce Security ∗∗∗
---------------------------------------------
Trustwave SpiderLabs first blogged about Magecart back in 2019; fast forward five years and it is still here going strong.
---------------------------------------------
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-state-o…
∗∗∗ Mitel 0-day, 5-year-old Oracle RCE bug under active exploit ∗∗∗
---------------------------------------------
3 CVEs added to CISAs catalog Cybercriminals are actively exploiting two vulnerabilities in Mitel MiCollab, including a zero-day flaw – and a critical remote code execution vulnerability in Oracle WebLogic Server that has been abused for at least five years.
---------------------------------------------
https://www.theregister.com/2025/01/08/mitel_0_day_oracle_rce_under_exploit/
∗∗∗ Japanese police claim China ran five-year cyberattack campaign targeting local orgs ∗∗∗
---------------------------------------------
‘MirrorFace’ group found ways to run malware in the Windows sandbox, which is worrying Japan’s National Police Agency and Center of Incident Readiness and Strategy for Cybersecurity have confirmed third party reports of attacks on local orgs by publishing details of a years-long series of attacks attributed to a China-backed source.
---------------------------------------------
https://www.theregister.com/2025/01/09/japan_mirrorface_china_attack/
∗∗∗ Angestellte klickten dreimal so oft auf Phishing-Links ‒ häufig in Suchmaschinen ∗∗∗
---------------------------------------------
Mitarbeiter klicken trotz Schulungen auf Phishing-Links. Laut einer Studie sind sie bei E-Mails sich der Angriffe eher bewusst, bei der Suche im Netz weniger.
---------------------------------------------
https://www.heise.de/news/E-Mails-sind-out-Phishing-verstaerkt-ueber-Suchma…
∗∗∗ New Research: Enhancing Botnet Detection with AI using LLMs and Similarity Search ∗∗∗
---------------------------------------------
As botnets continue to evolve, so do the techniques required to detect them.
---------------------------------------------
https://www.rapid7.com/blog/post/2025/01/08/new-research-enhancing-botnet-d…
∗∗∗ Banshee: The Stealer That “Stole Code” From MacOS XProtect ∗∗∗
---------------------------------------------
As of 2024, approximately 100.4 million people worldwide use macOS, accounting for 15.1% of the global PC market. Of the millions of macOS users, many falsely assume that their systems are inherently secure from malware. This perception stems from macOS’s Unix-based architecture and historically lower market share, ..
---------------------------------------------
https://research.checkpoint.com/2025/banshee-macos-stealer-that-stole-code-…
∗∗∗ Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation ∗∗∗
---------------------------------------------
On Wednesday, Jan. 8, 2025, Ivanti disclosed two vulnerabilities, CVE-2025-0282 and CVE-2025-0283, impacting Ivanti Connect Secure (“ICS”) VPN appliances. Mandiant has identified zero-day exploitation of CVE-2025-0282 in the wild beginning mid-December 2024. CVE-2025-0282 is an unauthenticated stack-based buffer overflow. Successful exploitation could result in unauthenticated remote code execution, leading to potential downstream compromise of a victim network.
---------------------------------------------
https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-sec…
∗∗∗ Angeblich Datenleck bei Datensammler Gravy Analytics ∗∗∗
---------------------------------------------
Im Darknet behaupten Kriminelle, Daten vom Positionsdatensammler Gravy Analytics erbeutet zu haben. Sorge um die Privatsphäre macht sich breit.
---------------------------------------------
https://heise.de/-10233802
=====================
= Vulnerabilities =
=====================
∗∗∗ ZDI-25-008: Trend Micro Deep Security Agent Incorrect Permissions Local Privilege Escalation Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-25-008/
∗∗∗ ZDI-25-007: Trend Micro Apex One widget getWidgetPoolManager Local File Inclusion Remote Code Execution Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-25-007/
∗∗∗ ZDI-25-006: Trend Micro Apex One LogServer Link Following Local Privilege Escalation Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-25-006/
∗∗∗ ZDI-25-005: Trend Micro Apex One LogServer Link Following Local Privilege Escalation Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-25-005/
∗∗∗ ZDI-25-004: Trend Micro Apex One Origin Validation Error Local Privilege Escalation Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-25-004/
∗∗∗ ZDI-25-003: Trend Micro Apex One Security Agent Link Following Local Privilege Escalation Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-25-003/
∗∗∗ ZDI-25-002: Trend Micro Apex One LogServer Link Following Local Privilege Escalation Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-25-002/
∗∗∗ ZDI-25-001: Trend Micro Apex One Damage Cleanup Engine Link Following Local Privilege Escalation Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-25-001/
∗∗∗ 2025-01 Security Bulletin: Junos Space: Multiple vulnerabilities resolved in 24.1R2 release ∗∗∗
---------------------------------------------
https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
[View Less]