Daily

daily@lists.cert.at

1 participants
3150 discussions

Tageszusammenfassung - 07.12.2020
by Daily end-of-shift report 07 Dec '20

07 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 04-12-2020 18:00 − Montag 07-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Finanzmarktaufsicht und Bundeskriminalamt warnen vor Geldwäsche-Jobs ∗∗∗ --------------------------------------------- Warnung: Professionelle Geldwäscher versuchen Jobsuchende als Finanzagent anzuwerben und zur Geldwäscherei zu missbrauchen. --------------------------------------------- https://www.watchlist-internet.at/news/finanzmarktaufsicht-und-bundeskrimin… ∗∗∗ Sicherheitslücke: Remote Code Execution in Microsoft Teams ∗∗∗ --------------------------------------------- Im Desktop-Client von Microsoft Teams fand sich eine extrem kritische Sicherheitslücke, aber Microsoft hat das Problem heruntergespielt. --------------------------------------------- https://www.golem.de/news/sicherheitsluecke-remote-code-execution-in-micros… ∗∗∗ What is Ransomware - 15 Easy Steps To Protect Your System [Updated 2020] ∗∗∗ --------------------------------------------- May 12th 2017 saw the biggest ever cyber attack in Internet history (yes, bigger than the Dyn DDoS). A ransomware named WannaCry stormed through the web, with the damage epicenter being in Europe. WannaCry leveraged a vulnerability in Windows OS, first discovered by the NSA, and then publicly revealed to the world by the Shadow [...] --------------------------------------------- https://heimdalsecurity.com/blog/what-is-ransomware-protection/ ∗∗∗ Obfuscation Techniques in MARIJUANA Shell "Bypass" ∗∗∗ --------------------------------------------- Attackers are always trying to come up with new ways to evade detection from the wide range of security controls available for web applications. This also extends to malware like PHP shells, which are typically left on compromised websites as a backdoor to maintain unauthorized access. MARIJUANA is the name of a PHP shell that we have been tracking since last year. --------------------------------------------- https://blog.sucuri.net/2020/12/obfuscation-techniques-in-marijuana-shell-b… ∗∗∗ Payment Card Skimmer Group Using Raccoon Info-Stealer to Siphon Off Data ∗∗∗ --------------------------------------------- A cybercrime group known for targeting e-commerce websites unleashed a "multi-stage malicious campaign" earlier this year designed with an intent to distribute information stealers and JavaScript-based payment skimmers. In a new report published today and shared with The Hacker News, Singapore-based cybersecurity firm Group-IB attributed the operation to the same group thats been linked to a [...] --------------------------------------------- https://thehackernews.com/2020/12/payment-card-skimmer-group-using.html ∗∗∗ Exploitation of Windows RDP Vulnerability CVE-2019-0708 (BlueKeep): Get RCE with System Privilege Using Refresh Rect PDU and RDPDR Client Name Request PDU ∗∗∗ --------------------------------------------- To better protect Windows users, we discuss how attackers might exploit CVE-2019-0708 (BlueKeep) on Windows RDP endpoints. --------------------------------------------- https://unit42.paloaltonetworks.com/cve-2019-0708-bluekeep/ ∗∗∗ Shodan Verified Vulns 2020-12 ∗∗∗ --------------------------------------------- Auch im Dezember wollen wir einen Blick auf Schwachstellen werfen, die Shodan in Österreich sieht. Die folgende Grafik basiert auf den Daten vom 2020-12-01: [...] --------------------------------------------- https://cert.at/de/aktuelles/2020/12/shodan-verified-vulns-2020-12 ===================== = Vulnerabilities = ===================== ∗∗∗ QNAP patches QTS vulnerabilities allowing NAS device takeover ∗∗∗ --------------------------------------------- Network-attached storage (NAS) maker QNAP today released security updates to address vulnerabilities that could enable attackers to take control of unpatched NAS devices following successful exploitation. --------------------------------------------- https://www.bleepingcomputer.com/news/security/qnap-patches-qts-vulnerabili… ∗∗∗ Cisco Security Manager Java Deserialization Vulnerabilities ∗∗∗ --------------------------------------------- Multiple vulnerabilities in the Java deserialization function that is used by Cisco'Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (ceph, gitea, matrix-synapse, musl, mutt, neomutt, opensc, and webkit2gtk), Debian (debian-security-support, openldap, salt, xen, and xorg-server), Fedora (fossil, pdfresurrect, tcpdump, thunderbird, and xorg-x11-server), Gentoo (chromium, firefox, mariadb, pam, postgresql, seamonkey, thunderbird, and xorg-server), Mageia (mutt, pdfresurrect, privoxy, and thunderbird), openSUSE (chromium, java-1_8_0-openjdk, kernel, minidlna, neomutt, opera, [...] --------------------------------------------- https://lwn.net/Articles/839198/ ∗∗∗ HPE HP-UX: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1199 ∗∗∗ Security Bulletin: Vulnerability in PyYAML affects IBM Spectrum Protect Plus Container and Microsoft File Systems Agents (CVE-2020-1747) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-pyyaml-a… ∗∗∗ Security Bulletin: Denial of Service Vulnerability in Chart.js affects IBM Spectrum Protect Plus (CVE-2020-7746) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-denial-of-service-vulnera… ∗∗∗ Security Bulletin: Upgrade to IBP v2.5.1 to address recent concerns/issues with Golang versions other than 1.14.7 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-upgrade-to-ibp-v2-5-1-to-… ∗∗∗ Security Bulletin: Vulnerability in Urllib3 affects IBM Spectrum Protect Container and Microsoft File Systems Agents (CVE-2020-26137) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-urllib3-… ∗∗∗ Public Service Announcement ∗∗∗ --------------------------------------------- Due to Dec 8 being a public holiday in Austria the next End-of-Day report will be published on Dec 9. --------------------------------------------- https://en.wikipedia.org/wiki/Feast_of_the_Immaculate_Conception -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.12.2020
by Daily end-of-shift report 04 Dec '20

04 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 03-12-2020 18:00 − Freitag 04-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Achtung! Amazon-Phishing Mails boomen derzeit! ∗∗∗ --------------------------------------------- Der Black Friday ist vorbei, Weihnachten steht vor der Tür und Österreich befindet sich nach wie vor im Lockdown. All das sind Gründe, wieso der Online-Handel derzeit boomt – genauso boomen jedoch betrügerische Nachrichten, die im Namen von Amazon verschickt werden. Aktuell kursieren E-Mails, bei denen BetrügerInnen Ihnen eine doppelte Abbuchung vorgaukeln, um an Ihre Daten zu kommen. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-amazon-phishing-mails-boomen… ∗∗∗ Malware für den Diebstahl von Finanzdaten versteckt sich hinter Social-Media-Buttons ∗∗∗ --------------------------------------------- Die Buttons erlauben angeblich das Teilen von Inhalten per Facebook, Twitter und Instagram. Stattdessen aktivieren sie Schadcode, der es auf persönliche Informationen und Kreditkartendaten abgesehen hat. Die zugehörige Malware ist bereits seit Ende September im Umlauf. --------------------------------------------- https://www.zdnet.de/88390301/malware-fuer-den-diebstahl-von-finanzdaten-ve… ∗∗∗ Cybercrime: Trickbot lernt neuen Trick ∗∗∗ --------------------------------------------- Emotet-Infektionen werden zukünftig noch gefährlicher. Denn die nachgeladene Malware könnte sich im BIOS festsetzen. --------------------------------------------- https://heise.de/-4980197 ∗∗∗ Forscher warnen vor teils noch ungefixter Schwachstelle in diversen Android-Apps ∗∗∗ --------------------------------------------- Die ehemals verwundbare, durch Google bereits im März reparierte Play Core-Library wurde durch manche App-Entwickler (noch) nicht aktiv aktualisiert. --------------------------------------------- https://heise.de/-4979478 ∗∗∗ The chronicles of Emotet ∗∗∗ --------------------------------------------- More than six years have passed since the banking Trojan Emotet was first detected. During this time it has repeatedly mutated, changed direction, acquired partners, picked up modules, and generally been the cause of high-profile incidents and multimillion-dollar losses. --------------------------------------------- https://securelist.com/the-chronicles-of-emotet/99660/ ∗∗∗ Leaking Browser URL/Protocol Handlers ∗∗∗ --------------------------------------------- An important step in any targeted attack is reconnaissance. The more information an attacker can obtain on the victim the greater the chances for a successful exploitation and infiltration. Recently, we uncovered two information disclosure vulnerabilities affecting three of the major web browsers which can be leveraged to leak out a vast range of installed applications, including the presence of security products, allowing a threat actor to gain critical insights on the target. --------------------------------------------- https://www.fortinet.com/blog/threat-research/leaking-browser-url-protocol-… ===================== = Vulnerabilities = ===================== ∗∗∗ VMware Releases Security Updates to Address CVE-2020-4006 ∗∗∗ --------------------------------------------- VMware has released security updates to address a vulnerability—CVE-2020-4006—in VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. An attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review VMware Security Advisory VMSA-2020-0027.2 and apply the necessary updates. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2020/12/03/vmware-releases-s… ∗∗∗ Webserver-Sicherheitslücke: Heikle Konfigurations- und Statusdaten publiziert ∗∗∗ --------------------------------------------- Fehlkonfigurierte Webserver von Bundesbehörden und IT-Firmen präsentierten Besucher-IPs, Benutzernamen, Meeting-Kennungen und mehr offen im Internet. --------------------------------------------- https://heise.de/-4971830 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (thunderbird), Fedora (c-ares, pdfresurrect, webkit2gtk3, and xen), openSUSE (python3), SUSE (gdm, python-pip, rpmlint, and xen), and Ubuntu (snapcraft). --------------------------------------------- https://lwn.net/Articles/838960/ ∗∗∗ WECON LeviStudioU (Update C) ∗∗∗ --------------------------------------------- This updated advisory is a follow-up to the advisory update titled ICSA-20-238-03 WECON LeviStudioU (Update B) that was published October 29, 2020, to the ICS webpage on us-cert.cisa.gov. This advisory contains mitigations for a Stack-based Buffer Overflow vulnerability in the WECON Technology LeviStudioU software. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-238-03 ∗∗∗ Apache Tomcat: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1195 ∗∗∗ Security Advisory - Privilege Escalation Vulnerability in Huawei Smartphone ∗∗∗ --------------------------------------------- https://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201202… ∗∗∗ Security Advisory - Resource Management Error Vulnerability in Huawei CloudEngine 1800V Product ∗∗∗ --------------------------------------------- https://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201202… ∗∗∗ Intel CPU vulnerability CVE-2020-0591 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K82356391 ∗∗∗ Intel CPU vulnerability CVE-2020-0592 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K04160444 ∗∗∗ QEMU vulnerability CVE-2020-27617 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K41142448 ∗∗∗ Jetty vulnerability CVE-2019-10247 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K41412302 ∗∗∗ Security Bulletin: jQuery Vulnerabilities Affect IBM Emptoris Program Management (CVE-2020-11023, CVE-2020-11022) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jquery-vulnerabilities-af… ∗∗∗ Security Bulletin: Trusteer Mobile SDK is vulnerable to CVE-2019-17362 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-trusteer-mobile-sdk-is-vu… ∗∗∗ Security Bulletin: jQuery Vulnerabilities Affect IBM Emptoris Sourcing (CVE-2020-11023, CVE-2020-11022) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jquery-vulnerabilities-af… ∗∗∗ Security Bulletin: jQuery Vulnerabilities Affect IBM Emptoris Contract Management (CVE-2020-11023, CVE-2020-11022) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jquery-vulnerabilities-af… ∗∗∗ Security Bulletin: jQuery Vulnerabilities Affect IBM Emptoris Spend Analysis (CVE-2020-11023, CVE-2020-11022) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jquery-vulnerabilities-af… ∗∗∗ Security Bulletin: IBM API Connect is vulnerable to arbitrary code execution and security bypass in Drupal (CVE-2020-13664, CVE-2020-13665) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-is-vulner… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Watson Explorer and Watson Explorer Content Analytics Studio (CVE-2020-14579, CVE-2020-14578, CVE-2020-14577, CVE-2020-14621) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: jQuery Vulnerabilities Affect IBM Emptoris Strategic Supply Management Platform (CVE-2020-11023, CVE-2020-11022) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-jquery-vulnerabilities-af… ∗∗∗ Security Bulletin: Multiple security vulnerabilities with IBM Content Navigator component in IBM Business Automation Workflow – CVE-2020-4687, CVE-2020-4760, CVE-2020-4704 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Upgrade javaenv:2.2 to address Gradle oauth authentication concerns. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-upgrade-javaenv2-2-to-add… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.12.2020
by Daily end-of-shift report 03 Dec '20

03 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 02-12-2020 18:00 − Donnerstag 03-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ APT-Gruppen: Turla und Co. tarnen Angriffe durch scheinbar harmlose Aktivitäten ∗∗∗ --------------------------------------------- Eine Spionage-Malware der wohl staatlich finanzierten Turla-Gang setzt auf Dropbox zum Datenklau. In einem anderen Fall verschleierte Coin-Mining Schlimmeres. --------------------------------------------- https://heise.de/-4978541 ∗∗∗ Studie: Schwachstellen in Open-Source-Software bleiben in der Regel vier Jahre unentdeckt ∗∗∗ --------------------------------------------- Patches stehen in der Regel innerhalb von vier Wochen zur Verfügung. Zudem sind nur 17 Prozent der registrierten Sicherheitslücken als "schädlich" einzustufen. GitHub sieht Open-Source-Software als "kritische Infrastruktur" an. --------------------------------------------- https://www.zdnet.de/88390280/studie-schwachstellen-in-open-source-software… ∗∗∗ What did DeathStalker hide between two ferns? ∗∗∗ --------------------------------------------- While tracking DeathStalker’s Powersing-based activities in May 2020, we detected a previously unknown implant that leveraged DNS over HTTPS as a C2 channel, as well as parts of its delivery chain. We named this new malware "PowerPepper". --------------------------------------------- https://securelist.com/what-did-deathstalker-hide-between-two-ferns/99616/ ∗∗∗ Xerox DocuShare Bugs Allow Data Leaks ∗∗∗ --------------------------------------------- CISA warns the leading enterprise document management platform is open to attack and urges companies to apply fixes. --------------------------------------------- https://threatpost.com/xerox-docushare-bugs/161791/ ∗∗∗ Another LILIN DVR 0-day being used to spread Mirai ∗∗∗ --------------------------------------------- In March, we reported[1] that multiple botnets, including Chalubo, Fbot, Moobot were using a same 0 day vulnerability to attack LILIN DVR devices, the vendor soon fixed the vulnerability. On August 26, 2020, our Anglerfish honeypot detected that another new LILINDVR/ [...] --------------------------------------------- https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mi… ∗∗∗ Adventures in Anti-Gravity (Part II) ∗∗∗ --------------------------------------------- Here we continue to deconstruct a Mac variant of GravityRAT (the cross-platform spyware, known to target the Indian armed forces), focusing on its Electron component. --------------------------------------------- https://objective-see.com/blog/blog_0x5C.html ∗∗∗ TrickBot Malware Gets UEFI/BIOS Bootkit Feature to Remain Undetected ∗∗∗ --------------------------------------------- TrickBot, one of the most notorious and adaptable malware botnets in the world, is expanding its toolset to set its sights on firmware vulnerabilities to potentially deploy bootkits and take complete control of an infected system. The new functionality, dubbed "TrickBoot" by Advanced Intelligence (AdvIntel) and Eclypsium, makes use of readily available tools to check devices for well-known [...] --------------------------------------------- https://thehackernews.com/2020/12/trickbot-malware-gets-uefibios-bootkit.ht… ∗∗∗ Spamhaus Intelligence API: Free threat intelligence data for security developers ∗∗∗ --------------------------------------------- Spamhaus Technology releases its Intelligence API. This is the first time Spamhaus has released its extensive threat intelligence via API, providing enriched data relating to IP addresses exhibiting compromised behaviour. Available free of charge, developers can readily access enhanced data that catalogues IP addresses compromised by malware, worms, Trojan infections, devices controlled by botnets, and third party exploits, such as open proxies. The API features live and historical data, [...] --------------------------------------------- https://www.helpnetsecurity.com/2020/12/03/spamhaus-intelligence-api/ ∗∗∗ Open Source Tool Helps Secure Siemens PCS 7 Control Systems ∗∗∗ --------------------------------------------- Industrial cybersecurity company OTORIO has released an open source tool designed to help organizations harden Siemens’ SIMATIC PCS 7 distributed control systems (DCS). --------------------------------------------- https://www.securityweek.com/open-source-tool-helps-secure-siemens-pcs-7-co… ===================== = Vulnerabilities = ===================== ∗∗∗ Google Play Apps Remain Vulnerable to High-Severity Flaw ∗∗∗ --------------------------------------------- Patches for a flaw (CVE-2020-8913) in the Google Play Core Library have not been implemented by several popular Google Play apps, including Cisco Teams and Edge. --------------------------------------------- https://threatpost.com/google-play-apps-remain-vulnerable-to-high-severity-… ∗∗∗ iCloud for Windows 11.5 ∗∗∗ --------------------------------------------- Foundation: A local user may be able to read arbitrary files ImageIO: Processing a maliciously crafted image may lead to arbitrary code execution ImageIO: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution libxml2: Processing maliciously crafted web content may lead to code execution libxml2: A remote attacker may be able to cause unexpected application termination or arbitrary code execution libxml2: Processing a maliciously crafted file may lead to arbitrary code execution SQLite: A remote attacker may be able to cause a denial of service SQLite: A remote attacker may be able to cause arbitrary code execution SQLite: A remote attacker may be able to leak memory SQLite: A maliciously crafted SQL query may lead to data corruption WebKit: Processing maliciously crafted web content may lead to arbitrary code execution --------------------------------------------- https://support.apple.com/kb/HT211935 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Mageia (cimg, pngcheck, poppler, tor, and xdg-utils), openSUSE (mariadb), Red Hat (go-toolset-1.14-golang), and Ubuntu (linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-gke-4.15, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon). --------------------------------------------- https://lwn.net/Articles/838870/ ∗∗∗ Mozilla Foundation Security Advisory 2020-53 ∗∗∗ --------------------------------------------- In security advisory 2020-53, the Mozilla Foundation describes a stack overflow vulnerability (CVE-2020-26970) patched in Thunderbird 78.5.1. The issue was caused by writing an SMTP server status integer value on the stack designed to only hold one byte. This could potentially corrupt the stack which might be exploitable. --------------------------------------------- https://exchange.xforce.ibmcloud.com/collection/0f933021879b159a96ec2380843… ∗∗∗ Red Hat Enterprise Linux: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1190 ∗∗∗ Security Bulletin: Vulnerability in PyYAML affects IBM Spectrum Protect Plus Container and Microsoft File Systems Agents (CVE-2020-1747) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-pyyaml-a… ∗∗∗ Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a 3rd party cryptographc vulnerability (CVE-2020-4254) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-big… ∗∗∗ Security Bulletin: A security bypass vulnerability in Apache Solr (lucene) affects IBM InfoSphere Information Server ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-bypass-vulnera… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java affect IBM Netezza Analytics ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple security vulnerabilities with Administration Console for Content Platform Engine component in IBM Business Automation Workflow and IBM Business Process Manager (BPM) – CVE-2020-4447, CVE-2020-4759 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.12.2020
by Daily end-of-shift report 02 Dec '20

02 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 01-12-2020 18:00 − Mittwoch 02-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Project Zero: Exploit zeigt Komplettübernahme von iPhones per WLAN ∗∗∗ --------------------------------------------- Ohne Bugfix hätten iPhones vollständig per WLAN ausgelesen werden können - über eine triviale Lücke. Apple hat den Fehler bereits behoben. --------------------------------------------- https://www.golem.de/news/project-zero-exploit-zeigt-komplettuebernahme-von… ∗∗∗ "Free" Symchanger Malware Tricks Users Into Installing Backdoor ∗∗∗ --------------------------------------------- In a previous post, I discussed how attackers can trick website owners into installing malware onto a website - granting the attacker the same unauthorized access as if they had exploited a vulnerability or compromised login details for the website. But did you know attackers use the same tactic against other bad actors? They do this by offering free malware, even going to great lengths to include a guide on how to use it. --------------------------------------------- https://blog.sucuri.net/2020/12/free-symchanger-malware-tricks-users-into-i… ∗∗∗ Remote Code Execution: Lücken in NAS-Betriebssystem QTS von Qnap geschlossen ∗∗∗ --------------------------------------------- Die Qnap-Entwickler haben eine abgesicherte Version von QTS für NAS-Geräte aus dem eigenen Haus veröffentlicht. --------------------------------------------- https://heise.de/-4977592 ∗∗∗ Paketmanager npm: Remote Access Trojan tarnt sich als JSON-Tool ∗∗∗ --------------------------------------------- Die zwei Pakete jdb.js und db-json.js versuchen njRAT zu installieren und die Windows-Firewall passend zu öffnen. --------------------------------------------- https://heise.de/-4977572 ∗∗∗ Zahlreiche betrügerische Jobangebote von rareAI und enixAI online! ∗∗∗ --------------------------------------------- „Quereinsteiger im KI-Training“ oder „Datenerfasser/KI-Trainer“ – so oder so ähnlich klingen betrügerische Jobangebote, die derzeit auf zahlreichen Plattformen inseriert werden. Dahinter stecken die angeblichen Start-Ups rareAI oder enixAI. Doch weder die Unternehmen existieren erhalten Interessierte eine bezahlte Arbeit. Stattdessen wird der Bewerbungsprozess genutzt, um im Namen der Opfer ein Konto zu eröffnen, nebenbei klauen die Kriminellen noch [...] --------------------------------------------- https://www.watchlist-internet.at/news/zahlreiche-betruegerische-jobangebot… ===================== = Vulnerabilities = ===================== ∗∗∗ ICS Advisory (ICSA-20-336-01) Schneider Electric EcoStruxure Operator Terminal Expert runtime (Vijeo XD) ∗∗∗ --------------------------------------------- Successful exploitation of this vulnerability may allow unauthorized command execution by a local user of the Windows engineering workstation, which could result in loss of availability, confidentiality, and integrity of the workstation where EcoStruxure Operator Terminal Expert runtime is installed. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-336-01 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (brotli, jupyter-notebook, and postgresql-9.6), Fedora (perl-Convert-ASN1 and php-pear), openSUSE (go1.15, libqt5-qtbase, mutt, python-setuptools, and xorg-x11-server), Oracle (firefox, kernel, libvirt, and thunderbird), Red Hat (rh-postgresql10-postgresql and rh-postgresql12-postgresql), SUSE (java-1_8_0-openjdk, python, python-cryptography, python-setuptools, python3, and xorg-x11-server), and Ubuntu (linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-oracle, linux-raspi, linux, linux-aws, linux-azure, linux-kvm, linux-lts-trusty, linux-raspi2, linux-snapdragon, python-werkzeug, and xorg-server, xorg-server-hwe-16.04, xorg-server-hwe-18.04). --------------------------------------------- https://lwn.net/Articles/838786/ ∗∗∗ Security Advisory - Privilege Escalation Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- https://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201202… ∗∗∗ HCL Domino: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des Dienstes ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1182 ∗∗∗ FreeBSD: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1185 ∗∗∗ McAfee Total Protection: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1184 ∗∗∗ Security Bulletin: Multiple Vulnerabilities in IBM Java SDK affect IBM Virtualization Engine TS7700 – July 2020 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in firmware supporting products shipped with IBM Clouf Pak System ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: CVE-2020-26217 XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-26217-xstream-be… ∗∗∗ Security Bulletin: Multiple security vulnerabilities with Administration Console for Content Platform Engine component in IBM Business Automation Workflow and IBM Business Process Manager (BPM) – CVE-2020-4447, CVE-2020-4459 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.12.2020
by Daily end-of-shift report 01 Dec '20

01 Dec '20

===================== = End-of-Day report = ===================== Timeframe: Montag 30-11-2020 18:00 − Dienstag 01-12-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Banking-Malware Gootkit ist zurück und hat es auf PCs in Deutschland abgesehen ∗∗∗ --------------------------------------------- Das CERT-Bund und verschiedene Sicherheitsforscher warnen vor Trojaner-Attacken. Infektionen sind aber nicht ohne Weiteres möglich. --------------------------------------------- https://heise.de/-4976043 ∗∗∗ FBI warns of BEC scammers using email auto-forwarding in attacks ∗∗∗ --------------------------------------------- The FBI is warning U.S. companies about scammers actively abusing auto-forwarding rules on web-based email clients to increase the likelihood of successful Business Email Compromise (BEC) attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fbi-warns-of-bec-scammers-us… ∗∗∗ Critical Oracle WebLogic flaw actively exploited by DarkIRC malware ∗∗∗ --------------------------------------------- A botnet known as DarkIRC is actively targeting thousands of exposed Oracle WebLogic servers in attacks designed to exploit the CVE-2020-14882 remote code execution (RCE) vulnerability fixed by Oracle two months ago. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-oracle-weblogic-fla… ∗∗∗ IceRat evades antivirus by running PHP on Java VM ∗∗∗ --------------------------------------------- IceRat keeps low detections rates for weeks by using an unusual language implementation: JPHP. But there are more reasons than the choice of the compiler. This article explores IceRat and explains a way to analyze JPHP malware. --------------------------------------------- https://www.gdatasoftware.com/blog/icerat-evades-antivirus-by-using-jphp ∗∗∗ How prevalent is DNS spoofing? Could a repeat of the Dyn/Mirai DDoS attack have the same results? ∗∗∗ --------------------------------------------- Two separate groups of academics have recently released research papers based on research into the Domain Name System (DNS). One has found that the overwhelming majority of popular site operators haven’t learned from the 2016 Dyn/Mirai incident/attack and set up a backup DNS server, and the other has shown that the rate of DNS spoofing, though still very small, has more than doubled in less than seven years. --------------------------------------------- https://www.helpnetsecurity.com/2020/12/01/dns-spoofing/ ∗∗∗ Xanthe - Docker aware miner ∗∗∗ --------------------------------------------- Ransomware attacks and big-game hunting making the headlines, but adversaries use plenty of other methods to monetize their efforts in less intrusive ways. Cisco Talos recently discovered a cryptocurrency-mining botnet attack were calling "Xanthe," which attempted to compromise one of Ciscos security honeypots for tracking Docker-related threats. --------------------------------------------- https://blog.talosintelligence.com/2020/12/xanthe-docker-aware-miner.html ∗∗∗ Docker malware is now common, so devs need to take Docker security seriously ∗∗∗ --------------------------------------------- Three years after the first malware attacks targeting Docker, developers are still misconfiguring and exposing their Docker servers online. --------------------------------------------- https://www.zdnet.com/article/docker-malware-is-now-common-so-devs-need-to-… ===================== = Vulnerabilities = ===================== ∗∗∗ GO SMS Pro Vulnerable to File Theft: Part 2 ∗∗∗ --------------------------------------------- Last week we released an advisory about an SMS app called GO SMS Pro. Media files sent via text in the app are stored insecurely on a publicly accessible server. With some very minor scripting, it is trivial to throw a wide net around that content. While its not directly possible to link the media to specific users, those media files with faces, names, or other identifying characteristics do that for you. [...] It seems like GOMO is attempting to fix the issue, but a complete fix is still not available in the app. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/go-sms-pro-… ∗∗∗ Multiple (RCE) Vulnerabilities in Micro Focus Operations Bridge Manager ∗∗∗ --------------------------------------------- After analysing OBM, I found a mountain of critical security vulnerabilities that when combined result in a complete compromise of the application: - Use of Hard-coded Credentials - Insecure Java Deserialization (an incredible total of 41 of them) - Use of Outdated and Insecure Java Libraries - Incorrect Default Folder Permissions (resulting in Privilege Escalation to SYSTEM) All of these vulnerabilities affect the latest version, 2020.05, and possibly earlier versions. Both Windows and Linux installations are affected, except for the privilege escalation, which only affects Windows. --------------------------------------------- https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focu… ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2020-0009 ∗∗∗ --------------------------------------------- Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. [...] Impact: Processing maliciously crafted web content may lead toarbitrary code execution. --------------------------------------------- https://webkitgtk.org/security/WSA-2020-0009.html ∗∗∗ QNAP QTS: Mehrere Schwachstellen ermöglichen Codeausführung ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1181 ∗∗∗ Foxit Phantom PDF Suite: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1180 ∗∗∗ HCL Domino: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1177 ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to a buffer overflow (CVE-2020-4701) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: Information disclosure vulnerability may affect IBM Business Automation Workflow – CVE-2020-4900 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-information-disclosure-vu… ∗∗∗ Security Bulletin: Node.js upgrade for IBM Cloud Pak for Data Streams Flows ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-node-js-upgrade-for-ibm-c… ∗∗∗ Security Bulletin: Node.js module upgrade for IBM Cloud Pak for Data Streams Flows ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-node-js-module-upgrade-fo… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities in IBM WebSphere Application Server affects IBM Voice Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: A security vulnerability in Node.js affects IBM Voice Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Node.js upgrade for IBM Cloud Pak for Data Streams Flows ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-node-js-upgrade-for-ibm-c… ∗∗∗ Security Bulletin: Multiple security vulnerabilities in IBM Java SDK affects IBM Voice Gateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: IBM® Db2® could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. (CVE-2020-4739) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-could-allow-a-loc… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.11.2020
by Daily end-of-shift report 30 Nov '20

30 Nov '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 27-11-2020 18:00 − Montag 30-11-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Bug oder Feature: Privilege Escalation in Windows Autopilot ∗∗∗ --------------------------------------------- SEC Consult hat im Deploymentprozess von Windows Autopilot eine Schwachstelle identifziert, die eine Erweiterung lokaler Berechtigungen ermöglicht. --------------------------------------------- https://www.sec-consult.com/./blog/2020/11/bug-oder-feature-privilege-escal… ∗∗∗ Credit card skimmer fills fake PayPal forms with stolen order info ∗∗∗ --------------------------------------------- A newly discovered credit card skimmer uses an innovative technique to inject highly convincing PayPal iframes and hijack the checkout process on compromised online stores. --------------------------------------------- https://www.bleepingcomputer.com/news/security/credit-card-skimmer-fills-fa… ∗∗∗ Cyberthreats to financial organizations in 2021 ∗∗∗ --------------------------------------------- Let us review the forecasts we made at the end of 2019 and see how accurate we were. Then we will go through the key events of 2020 relating to financial attacks. Finally, we need to make a forecast of financial attacks in 2021. --------------------------------------------- https://securelist.com/cyberthreats-to-financial-organizations-in-2021/9959… ∗∗∗ Threat Hunting with JARM, (Fri, Nov 27th) ∗∗∗ --------------------------------------------- Recently I have been testing a new tool created by the people at Salesforce. The tool is called JARM and what it does is query TLS instances (HTTPS servers and services) to create a fingerprint of their TLS configuration. Much like analyzing the nuances of network traffic can be used to fingerprint the operating system and version of a server, JARM fingerprints TLS instances to create a fingerprint which can be used to compare one TLS service to another. --------------------------------------------- https://isc.sans.edu/diary/rss/26832 ∗∗∗ German users targeted with Gootkit banker or REvil ransomware ∗∗∗ --------------------------------------------- After a noted absence, the Gootkit banking Trojan returns en masse to hit Germany. In an interesting twist, some of the victims may receive ransomware instead. --------------------------------------------- https://blog.malwarebytes.com/threat-analysis/2020/11/german-users-targeted… ∗∗∗ SD-WAN Product Vulnerabilities Allow Hackers to Steer Traffic, Shut Down Networks ∗∗∗ --------------------------------------------- Researchers at cybersecurity consulting firm Realmode Labs have identified vulnerabilities in SD-WAN products from Silver Peak, Cisco, Citrix and VMware, including potentially serious flaws that can be exploited to steer traffic or completely shut down an organization’s network. --------------------------------------------- https://www.securityweek.com/sd-wan-product-vulnerabilities-allow-hackers-s… ∗∗∗ Tens of Dormant North American Networks Suspiciously Resurrected at Once ∗∗∗ --------------------------------------------- More than fifty networks in the North American region suddenly burst to life after being dormant for a long period of time, Spamhaus reveals. The Geneva-based international nonprofit organization is focused on tracking spam, phishing, malware, and botnets, and provides threat intelligence that can help filter spam and related threats. --------------------------------------------- https://www.securityweek.com/tens-dormant-north-american-networks-suspiciou… ∗∗∗ Hackers are targeting MacOS users with this updated malware ∗∗∗ --------------------------------------------- Researchers link new malware attacks designed to install a backdoor onto compromised systems to Vietnamese-backed hacking operation OceanLotus. --------------------------------------------- https://www.zdnet.com/article/hackers-are-targeting-macos-users-with-this-u… ∗∗∗ Whac-A-Mole: Six Years of DNS Spoofing. (arXiv:2011.12978v1 [cs.CR]) ∗∗∗ --------------------------------------------- DNS is important in nearly all interactions on the Internet. All large DNS operators use IP anycast, announcing servers in BGP from multiple physical locations to reduce client latency and provide capacity. However, DNS is easy to spoof: third parties intercept and respond to queries for benign or malicious purposes. Spoofing is of particular risk for services using anycast, since service is already announced from multiple origins. --------------------------------------------- http://arxiv.org/abs/2011.12978 ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdate: Lücke in Trend Micro ServerProtect gefährdet Linux-Systeme ∗∗∗ --------------------------------------------- Es gibt eine abgesicherte Version von Trend Micro ServerProtect for Linux. --------------------------------------------- https://heise.de/-4974321 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (c-ares, libass, raptor, rclone, and swtpm), Debian (libproxy, qemu, tcpflow, and x11vnc), Fedora (asterisk, c-ares, microcode_ctl, moodle, pam, tcpdump, and webkit2gtk3), Mageia (jruby and webkit2), openSUSE (buildah, c-ares, ceph, fontforge, java-1_8_0-openjdk, kernel, LibVNCServer, mariadb, thunderbird, ucode-intel, and wireshark), Red Hat (firefox, rh-mariadb103-mariadb and rh-mariadb103-galera, and thunderbird), SUSE (binutils, libssh2_org, [...] --------------------------------------------- https://lwn.net/Articles/838579/ ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects TXSeries for Multiplatforms ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: IBM QRadar Network Security is affected by Network Time Protocol (NTP) vulnerabilities (CVE-2020-11868, CVE-2020-13817) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-network-securi… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects TXSeries for Multiplatforms ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: Vulnerability in IBM Java SDK affect IBM Content Classification ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Content Classification ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Content Classification is affected by a Eclipse Jetty (Publicly disclosed vulnerability) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-content-classificatio… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects IBM CICS TX on Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: Eclipse Jetty (Publicly disclosed vulnerability) affects Content Classifaction ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-eclipse-jetty-publicly-di… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affect IBM CICS TX on Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.11.2020
by Daily end-of-shift report 27 Nov '20

27 Nov '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 26-11-2020 18:00 − Freitag 27-11-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Achtung Identitätsdiebstahl: Kriminelle versenden betrügerische E-Mails im Namen der Post! ∗∗∗ --------------------------------------------- Zahlreiche LeserInnen melden uns derzeit eine betrügerische E-Mail, die im Namen der Österreichischen Post verschickt wird. In diesem E-Mail werden Sie dazu aufgefordert, eine Ausweiskopie zu senden, damit eine Lieferung verarbeitet werden kann. Ignorieren Sie diese E-Mail. Es handelt sich um Betrug! --------------------------------------------- https://www.watchlist-internet.at/news/achtung-identitaetsdiebstahl-krimine… ∗∗∗ Sicherheitsupdates: Archive mit Schadcode könnten Drupal-Websites gefährden ∗∗∗ --------------------------------------------- Die Drupal-Enwickler haben zwei gefährliche Sicherheitslücken im Content Management System Drupal geschlossen. --------------------------------------------- https://heise.de/-4972845 ∗∗∗ Mit dem Bloodhound auf Active-Directory-Jagd ∗∗∗ --------------------------------------------- Auf seiner SO-CON zeigte SpecterOps viele Aktualisierungen für Security-Werkzeuge, darunter BloodHound 4.0 für Active-Directory-Angriffe. --------------------------------------------- https://heise.de/-4973049 ∗∗∗ Hackers Love Expired Domains ∗∗∗ --------------------------------------------- Sometimes, website owners no longer want to own a domain name and they allow it to expire without attempting to renew it. This happens all the time and is totally normal, but it’s important to remember that attackers regularly monitor domain expirations and may target certain domains that meet specific criteria. Vendor domains can be an easy backdoor A vendor (supplier) domain is defined as a website that is used to host and load third party Javascript resources [...] --------------------------------------------- https://blog.sucuri.net/2020/11/hackers-love-expired-domains.html ∗∗∗ Digitally Signed Bandook Malware Once Again Targets Multiple Sectors ∗∗∗ --------------------------------------------- A cyberespionage group with suspected ties to the Kazakh and Lebanese governments has unleashed a new wave of attacks against a multitude of industries with a retooled version of a 13-year-old backdoor Trojan. Check Point Research called out hackers affiliated with a group named Dark Caracal in a new report published yesterday for their efforts to deploy "dozens of digitally signed variants" of [...] --------------------------------------------- https://thehackernews.com/2020/11/digitally-signed-bandook-malware-once.html ===================== = Vulnerabilities = ===================== ∗∗∗ Citrix Virtual Apps and Desktops Security Update ∗∗∗ --------------------------------------------- 2020-11-25: Improved clarification on when a version is impacted and added that 1912 LTSR CU2 is now available --------------------------------------------- https://support.citrix.com/article/CTX285059 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (go, libxml2, postgresql, and wireshark-cli), Debian (drupal7 and lxml), Fedora (drupal7, java-1.8.0-openjdk-aarch32, libxml2, pacemaker, slurm, and swtpm), openSUSE (c-ares, ceph, chromium, dash, firefox, go1.14, java-1_8_0-openjdk, kernel, krb5, perl-DBI, podman, postgresql10, postgresql12, rclone, slurm, ucode-intel, wireshark, wpa_supplicant, and xen), SUSE (ceph, firefox, kernel, LibVNCServer, and python), and Ubuntu (freerdp, poppler, and [...] --------------------------------------------- https://lwn.net/Articles/838469/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.11.2020
by Daily end-of-shift report 26 Nov '20

26 Nov '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 25-11-2020 18:00 − Donnerstag 26-11-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Risk Based Authentication: Die Krücke für Passwörter und wie sie ausgenutzt wird ∗∗∗ --------------------------------------------- Mit der Risikoabschätzung RBA wollen Online-Dienste den Passwortmissbrauch bekämpfen. Doch Cybercrime macht daraus ein Geschäft: mit digitalen Doppelgängern. --------------------------------------------- https://heise.de/-4970547 ∗∗∗ Was ist SIM‑Swapping und wie können Sie sich schützen ∗∗∗ --------------------------------------------- Bei diesem Angriff geht es um ihre Telefonnummer und zwar darum sie Ihnen wegzunehmen. --------------------------------------------- https://www.welivesecurity.com/deutsch/2020/11/26/was-ist-sim-swapping-und-… ∗∗∗ Vorsicht! Der Download dieser Apps entpuppt sich als teure Abo-Falle! ∗∗∗ --------------------------------------------- Es gibt viele hilfreiche Apps für das Handy, die das Leben erleichtern können. Allerdings gibt es auch Apps, die das Leben erschweren. So tauchen immer wieder Apps im Google Play- oder im App-Store auf, bei denen ungewollte und teure Abos abgeschlossen werden. Die Kosten werden dabei entweder gar nicht erwähnt oder kaum sichtbar im Kleingedruckten versteckt. Wir zeigen Ihnen, wie Sie sich vor dieser Betrugsmasche schützen können. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-der-download-dieser-apps-en… ∗∗∗ 71 Opfer seit September: Forscher warnen vor Ransomware Egregor ∗∗∗ --------------------------------------------- Die Hintermänner sind bisher in 19 Ländern aktiv. Die Mehrheit der Opfer befindet sich jedoch in den USA. Dank ausgeklügelter Codeverschleierung können Sicherheitsforscher den Infektionsweg von Egregor bisher nicht vollständig klären. --------------------------------------------- https://www.zdnet.de/88390072/71-opfer-seit-september-forscher-warnen-vor-r… ∗∗∗ Analysis of Kinsing Malwares Use of Rootkit ∗∗∗ --------------------------------------------- The Kinsing malware has been evolving with capabilities added to increase the difficulty of detection. Trend Micro reports on the use of a rootkit in recent samples to carry out these objectives. --------------------------------------------- https://exchange.xforce.ibmcloud.com/collection/6d8ebd5da62cf61982fce04b20b… ===================== = Vulnerabilities = ===================== ∗∗∗ Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013 ∗∗∗ --------------------------------------------- The Drupal project uses the PEAR Archive_Tar library. The PEAR Archive_Tar library has released a security update that impacts Drupal. --------------------------------------------- https://www.drupal.org/sa-core-2020-013 ∗∗∗ Synology: Kritische Lücken aus Disk Station Manager und Safe Access beseitigt ∗∗∗ --------------------------------------------- Über Sicherheitslücken könnten Angreifer aus der Ferne Programmcode auf verwundbaren Geräten ausführen. Abgesicherte Versionen stehen teilweise noch aus. --------------------------------------------- https://heise.de/-4971807 ∗∗∗ Forscher entdeckt zufällig Zero-Day-Lücke in Windows 7 und Server 2008 ∗∗∗ --------------------------------------------- Sie erlaubt eine nicht autorisierte Ausweitung von Benutzerrechten. Neuere Windows-Versionen sind nicht betroffen. Der Forscher stößt bei der Arbeit an einem Update für sein Sicherheitstool PrivescCheck auf den Fehler. --------------------------------------------- https://www.zdnet.de/88390077/forscher-entdeckt-zufaellig-zero-day-luecke-i… ∗∗∗ BlackBerry Powered by Android Security Bulletin - November 2020 ∗∗∗ --------------------------------------------- https://support.blackberry.com/kb/articleDetail?language=en_US&articleNumbe… ∗∗∗ BigBlueButton E-mail Validation Bypass ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2020110211 ∗∗∗ BigBlueButton Meeting Access Code Brute Force Vulnerability ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2020110210 ∗∗∗ Security Bulletin: IBM Cloud Pak for Security (CP4S) could reveal sensitive information to authenticated user (CVE-2020-4626) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-securit… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM Cognos Command Center ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Cloud Pak for Security (CP4S) uses weaker than expected cryptographic algorithms (CVE-2020-4624) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-securit… ∗∗∗ Security Bulletin: IBM Network Performance Insight is affected by Apache Commons Codec vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-network-performance-i… ∗∗∗ Security Bulletin: IBM Cloud Pak for Security (CP4S) vulnerable to session handling issue (CVE-2020-4696) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-securit… ∗∗∗ Security Bulletin: CP4S 1.3.0.1 fails to use HTTPOnly flag (CVE-2020-4625) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cp4s-1-3-0-1-fails-to-use… ∗∗∗ Security Bulletin: IBM Cloud Pak for Security (CP4S) is potentially vulnerable to CVS injection (CVE-2020-4627) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-securit… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.11.2020
by Daily end-of-shift report 25 Nov '20

25 Nov '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 24-11-2020 18:00 − Mittwoch 25-11-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Light-Based Attacks Expand in the Digital Home ∗∗∗ --------------------------------------------- The team that hacked Amazon Echo and other smart speakers using a laser pointer continue to investigate why MEMS microphones respond to sound. --------------------------------------------- https://threatpost.com/light-based-attacks-digital-home/161583/ ∗∗∗ [SANS ISC] Live Patching Windows API Calls Using PowerShell ∗∗∗ --------------------------------------------- I published the following diary on isc.sans.edu: “Live Patching Windows API Calls Using PowerShell“: It’s amazing how attackers can be imaginative when it comes to protecting themselves and preventing security controls to do their job. Here is an example of a malicious PowerShell script that patches live a DLL function [...] --------------------------------------------- https://blog.rootshell.be/2020/11/25/sans-isc-live-patching-windows-api-cal… ∗∗∗ IBM: Aktuelle Security-Updates sichern diverse Produkte gegen Angriffe ab ∗∗∗ --------------------------------------------- Schwachstellen von "Low" bis "High" wurden aus Netezza Host Management, aus Resilient, Spectrum Protect (Plus), TNPM Wireline und weiteren Produkten beseitigt. --------------------------------------------- https://heise.de/-4970430 ∗∗∗ Stantinko Proxy Trojan Masquerades as Apache Servers ∗∗∗ --------------------------------------------- A threat group tracked as Stantinko was observed using a new version of a Linux proxy Trojan that poses as Apache servers to remain undetected. --------------------------------------------- https://www.securityweek.com/stantinko-proxy-trojan-masquerades-apache-serv… ∗∗∗ This critical software flaw is now being used to break into networks - so update fast ∗∗∗ --------------------------------------------- A vulnerability in MobileIron mobile device management software is being used by state-backed hackers and organised crime, warns security agency. --------------------------------------------- https://www.zdnet.com/article/this-software-flaw-is-being-used-to-break-int… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitslücken in McAfee Endpoint Security machen Windows angreifbar ∗∗∗ --------------------------------------------- Es gibt wichtige Updates für McAfee Endpoint Security. Unter bestimmten Voraussetzungen könnten Angreifer Schadcode ausführen. --------------------------------------------- https://heise.de/-4970655 ∗∗∗ 2-Factor Authentication Bypass Flaw Reported in cPanel and WHM Software ∗∗∗ --------------------------------------------- cPanel, a provider of popular administrative tools to manage web hosting, has patched a security vulnerability that could have allowed remote attackers with access to valid credentials to bypass two-factor authentication (2FA) protection on an account. The issue, tracked as "SEC-575" and discovered by researchers from Digital Defense, has been remedied by the company in versions 11.92.0.2, [...] --------------------------------------------- https://thehackernews.com/2020/11/2-factor-authentication-bypass-flaw.html ∗∗∗ Cisco DNA Spaces Connector Command Injection Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the web-based management interface of Cisco DNA Spaces Connector could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary [...] --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Edge Fog Fabric Resource Exposure Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the REST API of Cisco Edge Fog Fabric could allow an authenticated, remote attacker to access files outside of their authorization sphere on an affected device. The vulnerability is due to incorrect authorization enforcement on an affected system. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ VMSA-2020-0023.3 VMware ESXi, Workstation, Fusion and NSX-T updates address multiple security vulnerabilities (CVE-2020-3981, CVE-2020-3982, CVE-2020-3992, CVE-2020-3993, CVE-2020-3994, CVE-2020-3995) ∗∗∗ --------------------------------------------- Updated security advisory to add VMware Cloud Foundation 3.x and 4.x versions in the response matrix of section 3(a). --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2020-0023.html ∗∗∗ VMSA-2020-0026.1 VMware ESXi, Workstation and Fusion updates address use-after-free and privilege escalation vulnerabilities (CVE-2020-4004, CVE-2020-4005) ∗∗∗ --------------------------------------------- Updated security advisory to add VMware Cloud Foundation 3.x and 4.x versions in the response matrix of sections 3(a) and 3(b). --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2020-0026.html ∗∗∗ ICS Advisory (ICSA-20-329-02) Fuji Electric V-Server Lite ∗∗∗ --------------------------------------------- Successful exploitation of this vulnerability could allow for remote code execution on the device. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-329-02 ∗∗∗ ICS Advisory (ICSA-20-329-01) Rockwell Automation FactoryTalk Linx ∗∗∗ --------------------------------------------- Successful exploitation of these vulnerabilities could allow a denial-of-service condition, remote code execution, or leak information that could be used to bypass address space layout randomization (ASLR). --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-20-329-01 ∗∗∗ MISP: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1170 ∗∗∗ Red Hat Virtualization: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1169 ∗∗∗ NETGEAR GS108Ev3 vulnerable to cross-site request forgery ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN27806339/ ∗∗∗ Security Advisory - Command Injection Vulnerability in ManageOne Product ∗∗∗ --------------------------------------------- https://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201125… ∗∗∗ Security Advisory - Out-of-bounds Read Vulnerability in Some Huawei Smartphones ∗∗∗ --------------------------------------------- https://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201125… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.11.2020
by Daily end-of-shift report 24 Nov '20

24 Nov '20

===================== = End-of-Day report = ===================== Timeframe: Montag 23-11-2020 18:00 − Dienstag 24-11-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Warten auf Patches: Kritische VMware-Lücke gefährdet Linux- und Windows-Systeme ∗∗∗ --------------------------------------------- Software von VMware ist über eine Zero-Day-Lücke attackierbar. Bislang gibt es nur Workarounds zur Absicherung. --------------------------------------------- https://heise.de/-4969353 ∗∗∗ Betrügerische Trading-Plattformen: Kriminelle werben mit Kommentaren bei YouTube-Videos ∗∗∗ --------------------------------------------- In den Kommentaren zahlreicher beliebter YouTube-Videos – darunter Last Christmas von Wham! – finden sich Tipps, wie man mit Bitcoin-Handel im Internet reich werden kann. Verpackt in einer hochemotionalen Geschichte berichtet ein Nutzer, wie ihm eine Lyra Holt Dean beim Handel unterstützte. Im Kommentar gibt er auch ihre E-Mail-Adresse an. Schreiben Sie keinesfalls an diese Adresse, es handelt sich um Betrug! --------------------------------------------- https://www.watchlist-internet.at/news/betruegerische-trading-plattformen-k… ∗∗∗ Lookalike domains and how to outfox them ∗∗∗ --------------------------------------------- Our approach is more complex than simply registering lookalike domains to the company and enables real-time blocking of attacks that use such domains as soon as they appear. --------------------------------------------- https://securelist.com/lookalike-domains-and-how-to-outfox-them/99539/ ∗∗∗ Blackrota, a heavily obfuscated backdoor written in Go ∗∗∗ --------------------------------------------- Recently, a malicious backdoor program written in the Go language that exploits an unauthorized access vulnerability in the Docker Remote API was caught by the our Anglerfish honeypot. We named it Blackrota, giventhat its C2 domain name is [...] --------------------------------------------- https://blog.netlab.360.com/blackrota-an-obfuscated-backdoor-written-in-go-… ∗∗∗ Hidden SEO Spam Link Injections on WordPress Sites ∗∗∗ --------------------------------------------- Often when a website is injected with SEO spam, the owner is completely unaware of the issue until they begin to receive warnings from search engines or blacklists. This is by design - attackers intentionally try to prevent detection by arranging injected links so they are not visible to average human traffic. One of the techniques attackers use is to “push” the injected SEO spam links off the visible portion of the website. --------------------------------------------- https://blog.sucuri.net/2020/11/hidden-seo-spam-link-injections-on-wordpres… ∗∗∗ MedusaLocker Ransomware Analysis ∗∗∗ --------------------------------------------- The Cybereason Nocturnus Team has published an analysis of the MedusaLocker ransomware. MedusaLocker targets Windows systems and first appeared in 2019. Since then, it has reportedly been involved in many attacks targeting a number of industry sectors, but especially the healthcare sector. --------------------------------------------- https://exchange.xforce.ibmcloud.com/collection/9b5a2bd4954b29920abc8f39f0a… ===================== = Vulnerabilities = ===================== ∗∗∗ Citrix Hypervisor Security Update ∗∗∗ --------------------------------------------- A security issue has been identified that may allow privileged code running in a guest VM to compromise the host. This issue is limited to only those guest VMs where the host administrator has explicitly assigned a PCI passthrough device to the guest VM. --------------------------------------------- https://support.citrix.com/article/CTX286511 ∗∗∗ Xen Security Advisory XSA-355 - stack corruption from XSA-346 change ∗∗∗ --------------------------------------------- A malicious or buggy HVM or PVH guest can cause Xen to crash, resulting in a Denial of Service (DoS) to the entire host. Privilege escalation as well as information leaks cannot be excluded. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-355.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (chromium, microcode_ctl, and seamonkey), Mageia (f2fs-tools, italc, python-cryptography, python-pillow, tcpreplay, and vino), Oracle (thunderbird), Red Hat (bind, kernel, microcode_ctl, net-snmp, and Red Hat Virtualization), Scientific Linux (net-snmp and thunderbird), SUSE (kernel and mariadb), and Ubuntu (atftp, libextractor, pdfresurrect, and pulseaudio). --------------------------------------------- https://lwn.net/Articles/838255/ ∗∗∗ Synology-SA-20:25 Safe Access ∗∗∗ --------------------------------------------- Multiple vulnerabilities allow remote attackers to execute arbitrary code via a susceptible version of Safe Access. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_20_25 ∗∗∗ Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht SQL-Injection ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1161 ∗∗∗ OTRS: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1159 ∗∗∗ Security Bulletin: IBM TNPM Wireline is vulnerable to Apache Commons Codec. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tnpm-wireline-is-vuln… ∗∗∗ Security Bulletin: IBM Resilient SOAR is Using Components with Known Vulnerabilities – IBM SDK, Java Technology Edition v8.0.6.11 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-resilient-soar-is-usi… ∗∗∗ Security Bulletin: IBM API Connect is vulnerable to arbitrary code execution and security bypass in Drupal (CVE-2020-13664, CVE-2020-13665) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-is-vulner… ∗∗∗ [20201107] - Core - Write ACL violation in multiple core views ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/834-20201107-core-write-ac… ∗∗∗ [20201106] - Core - CSRF in com_privacy emailexport feature ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/833-20201106-core-csrf-in-… ∗∗∗ [20201105] - Core - User Enumeration in backend login ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/832-20201105-core-user-enu… ∗∗∗ [20201104] - Core - SQL injection in com_users list view ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/831-20201104-core-sql-inje… ∗∗∗ [20201103] - Core - Path traversal in mod_random_image ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/830-20201103-core-path-tra… ∗∗∗ [20201102] - Core - Disclosure of secrets in Global Configuration page ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/829-20201102-core-disclosu… ∗∗∗ [20201101] - Core - com_finder ignores access levels on autosuggest ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/828-20201101-core-com-find… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily