Daily

daily@lists.cert.at

1 participants
3087 discussions

Tageszusammenfassung - 19.11.2019
by Daily end-of-shift report 19 Nov '19

19 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Montag 18-11-2019 18:00 − Dienstag 19-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Linux, Windows Users Targeted With New ACBackdoor Malware ∗∗∗ --------------------------------------------- Researchers have discovered a new multi-platform backdoor that infects Windows and Linux systems allowing the attackers to run malicious code and binaries on the compromised machines. --------------------------------------------- https://www.bleepingcomputer.com/news/security/linux-windows-users-targeted… ∗∗∗ Buran Ransomware Infects PCs via Microsoft Excel Web Queries ∗∗∗ --------------------------------------------- A new spam campaign has been spotted distributing the Buran Ransomware through IQY file attachments. When opened, these Microsoft Excel Web Query attachments will execute a remote command that installs the ransomware onto a victims computer. --------------------------------------------- https://www.bleepingcomputer.com/news/security/buran-ransomware-infects-pcs… ∗∗∗ Coin Stealer Found in Monero Linux Binaries From Official Site ∗∗∗ --------------------------------------------- The Monero Project is currently investigating a potential compromise of the official website after a coin stealer was found in the Linux 64-bit command line (CLI) Monero binaries downloaded from the download page. --------------------------------------------- https://www.bleepingcomputer.com/news/security/coin-stealer-found-in-monero… ∗∗∗ Elasticsearch: Datenleak bei Conrad ∗∗∗ --------------------------------------------- Der Elektronikhändler Conrad meldet, dass ein Angreifer Zugang zu Kundendaten und Kontonummern gehabt habe. Grund dafür war eine ungesicherte Elasticsearch-Datenbank. --------------------------------------------- https://www.golem.de/news/elasticsearch-datenleak-bei-conrad-1911-145091-rs… ∗∗∗ Windows Debugging & Exploiting Part 2 - WinDBG 101 ∗∗∗ --------------------------------------------- Hello again! After our previous post about the environment setup, now it is time to cover the main tool of this project, the WinDBG. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/windows-deb… ∗∗∗ When Bank Communication is Indistinguishable from Phishing Attacks ∗∗∗ --------------------------------------------- You know how banks really, really want to avoid their customers falling victim to phishing scams? And how they put a heap of effort into education to warn folks about the hallmarks of phishing scams? And how banks are the shining beacons of light when it comes to demonstrating security [...] --------------------------------------------- https://www.troyhunt.com/when-bank-communication-is-indistinguishable-from-… ∗∗∗ Vulnerability in ABB Plant Historian Disclosed 5 Years After Discovery ∗∗∗ --------------------------------------------- It took Swiss-based industrial technology solutions provider ABB five years to inform customers of a critical vulnerability affecting one of its products, and the researcher who found it says this increased the chances of threat actors discovering and exploiting the security flaw. --------------------------------------------- https://www.securityweek.com/vulnerability-abb-plant-historian-disclosed-5-… ∗∗∗ Vorsicht bei angeblichen Gewinnspielen von Magenta, A1, Drei oder Liwest ∗∗∗ --------------------------------------------- Aktuell verbreiten Kriminelle über unterschiedliche Kanäle Fake-Gewinnspiele. Sie werden entweder per E-Mail, SMS oder mittels Pop-Up im Browser benachrichtigt, dass Sie angeblich ein Smartphone gewonnen haben. Um den Gewinn zu erhalten, muss nur eine kurze Umfrage beantwortet und ein kleiner Geldbetrag für den Versand bezahlt werden. Vorsicht: Es handelt sich um eine Abo-Falle. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-bei-angeblichen-gewinnspiel… ===================== = Vulnerabilities = ===================== ∗∗∗ Schwere Sicherheitslücke in WhatsApp entdeckt ∗∗∗ --------------------------------------------- In WhatsApp wurde eine Schwachstelle gefunden, die es Angreifern ermöglicht, Dateien zu stehlen und Nachrichten auszulesen. --------------------------------------------- https://futurezone.at/apps/schwere-sicherheitsluecke-in-whatsapp-entdeckt/4… ∗∗∗ Lernplattform Moodle: Entwickler schließen kritische Schwachstellen ∗∗∗ --------------------------------------------- Moodle-Admins aufgepasst: Neue Versionen schließen mehrere, teils als "Serious" bewertete Lücken. --------------------------------------------- https://heise.de/-4591094 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (python-psutil, slurm-llnl, symfony, and thunderbird), Fedora (gd and ghostscript), and SUSE (ceph, haproxy, java-11-openjdk, and ncurses). --------------------------------------------- https://lwn.net/Articles/805149/ ∗∗∗ Lexmark Services Monitor 2.27.4.0.39 Directory Traversal ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2019110124 ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Performance Management products ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerabilities in Curl affect PowerSC (CVE-2019-5435, CVE-2019-5436) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-curl-a… ∗∗∗ HPESBHF03963 rev.1 - Certain HPE ProLiant Servers with Intel CSME, AMT, SPS, TXE, ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03968 rev.1 - HPE Gen10 ProLiant, Apollo, and Synergy Servers using Intel CPU Transactional Synchronization Extensions (TSX) Asynchronous Abort (TAA), Local Disclosure of Information ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03969 rev.1 - HPE ProLiant Gen10 Servers using certain Intel Xeon Scalable Processors, Voltage Modulation, Local Denial of Service ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBHF03971 rev.1 - HPE Servers using certain Intel Processors, SMM and TXT, Local Escalation of Privilege ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ HPESBST03964 rev.1 - HPE Nimble Storage, Multiple Remote Vulnerabilities ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ Google Chrome: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0998 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.11.2019
by Daily end-of-shift report 18 Nov '19

18 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 15-11-2019 18:00 − Montag 18-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New NextCry Ransomware Encrypts Data on NextCloud Linux Servers ∗∗∗ --------------------------------------------- On October 24, Nextcloud released an urgent alert about a remote code execution vulnerability that impacts the default Nextcloud NGINX configuration. Tracked as CVE-2019-11043, the flaw is in the PHP-FPM (FastCGI Process Manager) component, included by some hosting providers like Nextcloud in their default setup. A public exploit exists and has been leveraged to compromised servers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-nextcry-ransomware-encry… ∗∗∗ Powershell ConstrainedLanguage Mode ∗∗∗ --------------------------------------------- Gastbeitrag vom milCERT - Philipp Thaller und Stefan Bachmair - Bei der Analyse von aktueller Malware stellte sich heraus dass viele der aktuellen Exemplare (inkl. Emotet ) auf die PowerShell angewiesen sind um ihr schadhaftes Potential entfalten zu können. Schränkt man die PowerShell entsprechend ein, ist eine Ausführung des eigentlichen Schadcodes oft gar nicht möglich. --------------------------------------------- https://cert.at/de/blog/2019/11/201911-powershell-constrainedlanguage ∗∗∗ Willhaben warnt vor betrügerischer Phishing-SMS ∗∗∗ --------------------------------------------- Wer von der Verkaufsplattform Willhaben eine SMS mit Zahlungsinformationen bekommt, soll den Link keinesfalls anklicken. --------------------------------------------- https://futurezone.at/apps/willhaben-warnt-vor-betruegerischer-phishing-sms… ∗∗∗ pax: Exploit padding oracles for fun and profit ∗∗∗ --------------------------------------------- Pax (PAdding oracle eXploiter) is a tool for exploiting padding oracles in order to: - Obtain plaintext for a given piece of CBC encrypted data. - Obtain encrypted bytes for a given piece of plaintext, using the unknown encryption algorithm used by the oracle. --------------------------------------------- https://github.com/liamg/pax ∗∗∗ RdpThief: Extracting Clear-text Credentials from Remote Desktop Clients ∗∗∗ --------------------------------------------- In this blogpost I will describe the process I followed to write a tool that will extract clear-text credentials from the Microsoft RDP client using API hooking. Using this approach, if you are already operating under the privileges of the compromised user (e.g. as a result of a phish) and the user has an RDP session open, you are able to extract the clear-text credentials without privilege escalation. --------------------------------------------- https://www.mdsec.co.uk/2019/11/rdpthief-extracting-clear-text-credentials-… ∗∗∗ Medica 2019: BSI-Leitfaden zur Cyber-Sicherheit von Medizinprodukten ∗∗∗ --------------------------------------------- Im Kontext der sicheren Digitalisierung im Gesundheitswesen hat das Bundesamt für Sicherheit in der Informationstechnik (BSI) im Rahmen der Messe "Medica" in Düsseldorf einen neuen Leitfaden "Sicherheit von Medizinprodukten – Leitfaden zur Nutzung des MDS2 aus 2019" (Manufacturer Disclosure Statement for Medical Device Security) veröffentlicht. --------------------------------------------- https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2019/Leitfaden_M… ∗∗∗ Google patches ‘awesome’ XSS vulnerability in Gmail dynamic email feature ∗∗∗ --------------------------------------------- The bug bounty hunter who disclosed the issue says the bug is a prime example of DOM Clobbering. --------------------------------------------- https://www.zdnet.com/article/google-patches-awesome-xss-vulnerability-in-g… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (angular.js, libapache2-mod-auth-openidc, mosquitto, postgresql-common, and thunderbird), Fedora (chromium, djvulibre, freetds, ghostscript, java-1.8.0-openjdk-aarch32, samba, thunderbird-enigmail, wpa_supplicant, and xen), openSUSE (go1.12, ImageMagick, and ucode-intel), Oracle (ghostscript and kernel), Red Hat (libcomps and sudo), Slackware (kernel), SUSE (microcode_ctl, slurm, and ucode-intel), and Ubuntu (mysql-5.7, mysql-8.0 and python-ecdsa). --------------------------------------------- https://lwn.net/Articles/805083/ ∗∗∗ Security Bulletin: Denial of Service vulnerability in WebSphere Application Server Liberty affects IBM Spectrum Protect Operations Center (CVE-2019-4096) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-denial-of-service-vulnera… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.11.2019
by Daily end-of-shift report 15 Nov '19

15 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 14-11-2019 18:00 − Freitag 15-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ How the Linux kernel balances the risks of public bug disclosure ∗∗∗ --------------------------------------------- A serious Wi-Fi flaw shows how Linux handles security in plain sight. --------------------------------------------- https://nakedsecurity.sophos.com/2019/11/15/how-the-linux-kernel-balances-t… ∗∗∗ A Tale of Rootkits and Other Backdoors ∗∗∗ --------------------------------------------- In this post, we will focus on software backdoors commonly seen in Linux environments, we will attempt to outline some representative examples, and we will discuss common techniques backdoor authors use to hide their malicious payloads. --------------------------------------------- https://capsule8.com/blog/dont-get-kicked-out-a-tale-of-rootkits-and-other-… ===================== = Vulnerabilities = ===================== ∗∗∗ Security Advisory 2019-15: Security Update for OTRS Framework ∗∗∗ --------------------------------------------- OTRS can be put into an endless loop by providing filenames with overly long extensions. This applies to the PostMaster (sending in email) and also upload (attaching files to mails, for example). --------------------------------------------- https://community.otrs.com/security-advisory-2019-15-security-update-for-ot… ∗∗∗ Security Advisory 2019-14: Security Update for OTRS Framework ∗∗∗ --------------------------------------------- An attacker who is logged into OTRS as an agent is able to list tickets assigned to other agents, which are in the queue where attacker doesn’t have permissions. --------------------------------------------- https://community.otrs.com/security-advisory-2019-14-security-update-for-ot… ∗∗∗ A heap overflow vulnerability has been found in wolfssl ∗∗∗ --------------------------------------------- Wolfssl is an TLS library mostly used in embedded Linux devices. It is also used in the popular tool curl. ... The vulnerability has been given the CVE of CVE-2019–18840. --------------------------------------------- https://medium.com/@social_62682/heap-overflow-in-wolfssl-cve-2019-18840-18… ∗∗∗ Lücke in älteren WhatsApp-Versionen erlaubte Codeausführung aus der Ferne ∗∗∗ --------------------------------------------- Facebook weist auf eine Lücke in dem Messenger WhatsApp hin. Viele Geräte sollten dank automatischer Updates bereits seit einiger Zeit geschützt sein. --------------------------------------------- https://heise.de/-4587119 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (kernel), Debian (ghostscript, mesa, and postgresql-common), Fedora (chromium, php-robrichards-xmlseclibs, php-robrichards-xmlseclibs3, samba, scap-security-guide, and wpa_supplicant), Mageia (cpio, fribidi, libapreq2, python-numpy, webkit2, and zeromq), openSUSE (ImageMagick, kernel, libtomcrypt, qemu, ucode-intel, and xen), Oracle (kernel), Red Hat (ghostscript, kernel, and kernel-rt), Scientific Linux (ghostscript and kernel), SUSE (bash, enigmail, ghostscript, kernel, libjpeg-turbo, openconnect, squid), Ubuntu (ghostscript, imagemagick, postgresql-common). --------------------------------------------- https://lwn.net/Articles/804904/ ∗∗∗ Philips IntelliBridge EC40/80 ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsma-19-318-01 ∗∗∗ Omron CX-Supervisor ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-318-04 ∗∗∗ ABB Power Generation Information Manager (PGIM) and Plant Connect ∗∗∗ --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-318-05 ∗∗∗ Security Bulletin: CSV Injection (CVE-2019-4490) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-csv-injection-cve-2019-44… ∗∗∗ Security Bulletin: Multiple vulnerabilities in jackson-databind affect IBM Platform Symphony and IBM Spectrum Symphony ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Security vulnerabilities affect IBM Cloud Object Storage SDK Java (November 2019 Bulletin) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Performance Management products ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM OS Images for RedHat Enterprise System is vulnerable to Intel Microarchitectural Data Sampling (MDS) Vulnerabilites (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-os-images-for-redhat-… ∗∗∗ Security Bulletin: OpenSSL vulnerabilites impacting IBM Aspera Connect 3.7.4 and earlier (CVE-2017-3732, CVE-2016-7055) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-vulnerabilites-im… ∗∗∗ Security Bulletin: Apache Commons Collections library in WebSphere Application Server Knowledge Center is vulnerable (CVE-2015-7450) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-commons-collection… ∗∗∗ iControl REST logs a plaintext password when the syntax of a cURL request is incorrect ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K61105950 ∗∗∗ BIG-IP / BIG-IQ / Enterprise Manager / F5 iWorkflow Configuration utility vulnerability CVE-2019-6663 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K76052144 ∗∗∗ TMM vulnerability CVE-2019-6660 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K23860356 ∗∗∗ TLS 1.3 vulnerability CVE-2019-6659 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K34450231 ∗∗∗ BIG-IP restjavad vulnerability CVE-2019-6662 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K01049383 ∗∗∗ TMOS vulnerability CVE-2019-6664 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K03126093 ∗∗∗ BIG-IP APM apd vulnerability CVE-2019-6661 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K61705126 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.11.2019
by Daily end-of-shift report 14 Nov '19

14 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 13-11-2019 18:00 − Donnerstag 14-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Researchers Find Bug in Qualcomm Code for Trusted App ∗∗∗ --------------------------------------------- Researchers stressing the code related to Qualcomms implementation of the secure execution area on mobile devices found a new vulnerability that could allow access to critical data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/researchers-find-bug-in-qual… ∗∗∗ NCSC-NZ Cyber threat report for 2018/19 released ∗∗∗ --------------------------------------------- The National Cyber Security Centre, (NCSC) has released its Cyber Threat Report for the 2018/19 reporting year. --------------------------------------------- https://www.ncsc.govt.nz/newsroom/cyber-threat-report-for-201819-released/ ∗∗∗ Windows & Linux get options to disable Intel TSX to prevent Zombieload v2 attacks ∗∗∗ --------------------------------------------- Disclosure of new Zombieload v2 vulnerability prompts OS makers to react with ways to disable Intels TSX technology. --------------------------------------------- https://www.zdnet.com/article/windows-linux-get-options-to-disable-intel-ts… ===================== = Vulnerabilities = ===================== ∗∗∗ Symantec Fixes Privilege Escalation Flaw in Endpoint Protection ∗∗∗ --------------------------------------------- Symantec fixed a local privilege escalation security flaw affecting all Symantec Endpoint Protection software versions prior to 14.2 RU2, and allowing attackers to escalate privileges on compromised devices and execute malicious code using SYSTEM privileges. --------------------------------------------- https://www.bleepingcomputer.com/news/security/symantec-fixes-privilege-esc… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (kernel, linux-lts, and linux-zen), CentOS (kernel, sudo, and thunderbird), Debian (linux-4.9), Fedora (samba), openSUSE (apache2-mod_auth_openidc, kernel, qemu, rsyslog, and ucode-intel), Oracle (kernel), Red Hat (kernel and kernel-rt), Scientific Linux (kernel), SUSE (kernel and microcode_ctl), and Ubuntu (kernel, libjpeg-turbo, linux, linux-hwe, linux-oem, linux, linux-hwe, linux-oem-osp1, and qemu). --------------------------------------------- https://lwn.net/Articles/804775/ ∗∗∗ Movable Type vulnerable to open redirect ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN65280626/ ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an OpenSSL vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an Oracle MySQL vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an OpenSSL vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Netcool Impact ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ bzip2 vulnerability CVE-2019-12900 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K68713584 ∗∗∗ lodash library vulnerability CVE-2019-10744 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K47105354 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.11.2019
by Daily end-of-shift report 13 Nov '19

13 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 12-11-2019 18:00 − Mittwoch 13-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Network Traffic Analysis for IR: Address Resolution Protocol (ARP) with Wireshark ∗∗∗ --------------------------------------------- Introduction to the Address Resolution Protocol The Address Resolution Protocol (ARP) was first defined in RFC 826. As the name suggests, it is designed to resolve IP addresses into a form usable by other systems within a subnet. Network addressing works at a couple of different layers of the OSI model. --------------------------------------------- https://resources.infosecinstitute.com/address-resolution-protocol-arp-with… ∗∗∗ Schlüssel aus TPM-Chips lassen sich extrahieren ∗∗∗ --------------------------------------------- Mit einem Timing-Angriff lassen sich Signaturschlüssel auf Basis elliptischer Kurven aus TPM-Chips extrahieren. ... TPM-Chips sind in allen modernen PCs vorhanden und teilweise umstritten, da sie auch dazu genutzt werden können, Schutzmechanismen gegen den Willen des Nutzers umzusetzen. Trotz ihrer Verbreitung werden die Chips eher selten für kritische Applikationen genutzt, die Auswirkungen der Lücke dürften sich in Grenzen halten. --------------------------------------------- https://www.golem.de/news/tpm-fail-schluessel-aus-tpm-chips-lassen-sich-ext… ∗∗∗ GSM Traffic and Encryption: A5/1 Stream Cipher ∗∗∗ --------------------------------------------- This write-up documents some of my follow-up research with regard to analyzing the GSM traffic packets I captured using Software Defined Radio. My attempt was to better understand the GSM mobile network protocols and procedures, with an emphasis on the authentication and ciphering algorithms being deployed. --------------------------------------------- https://www.blackhillsinfosec.com/gsm-traffic-and-encryption-a5-1-stream-ci… ∗∗∗ Angriffe über USB und Bluetooth: Android-Smartphones verwundbar ∗∗∗ --------------------------------------------- Sicherheitsforscher haben Schwachstellen in mehreren älteren Android-Smartphones entdeckt, die sie über USB- und Bluetooth-Verbindungen ausnutzen konnten. --------------------------------------------- https://heise.de/-4584690 ∗∗∗ Seriöses Job-Angebot oder Auftrag zur Geldwäsche? ∗∗∗ --------------------------------------------- Auf diversen Job-Börsen und Kleinanzeigenportalen stoßen Arbeitssuchende momentan auf Angebote zur freien Mitarbeit der „TideBit Deutschland LTD“. Die Firma existiert in dieser Form nicht. Kriminelle missbrauchen den Namen eines Kryptowährungsunternehmens, um BewerberInnen zur Geldwäsche zu bringen. Wer die Aufgaben erfüllt, macht sich womöglich selbst strafbar. --------------------------------------------- https://www.watchlist-internet.at/news/serioeses-job-angebot-oder-auftrag-z… ===================== = Vulnerabilities = ===================== ∗∗∗ November 2019 security updates are available! ∗∗∗ --------------------------------------------- We have released the November security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found in the Security Update Guide. As a reminder, Windows 7 and Windows Server 2008 R2 will be out of extended support and no longer receiving updates as of January 14, 2020. --------------------------------------------- https://msrc-blog.microsoft.com:443/2019/11/12/november-2019-security-updat… ∗∗∗ Intel fixt Sicherheitslücken und enthüllt nebenbei eine neue ZombieLoad-Variante ∗∗∗ --------------------------------------------- Zum Patch Tuesday hat Intel 77 teils kritische Lücken gefixt, unter denen sich auch ein bislang geheim gehaltener Seitenkanalangriff befand. --------------------------------------------- https://heise.de/-4584543 ∗∗∗ VMSA-2019-0020 ∗∗∗ --------------------------------------------- VMware ESXi, Workstation, and Fusion patches provide Hypervisor-Specific Mitigations for Speculative-Execution Vulnerabilities (CVE-2018-12207, CVE-2019-11135) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0020.html ∗∗∗ VMSA-2019-0021 ∗∗∗ --------------------------------------------- VMware Workstation and Fusion updates address multiple security vulnerabilities (CVE-2019-5540, CVE-2019-5541, CVE-2019-5542) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0021.html ∗∗∗ VMSA-2019-0008.2 ∗∗∗ --------------------------------------------- VMware product updates enable Hypervisor-Specific Mitigations, Hypervisor-Assisted Guest Mitigations, and Operating System-Specific Mitigations for Microarchitectural Data Sampling (MDS) Vulnerabilities (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, and CVE-2019-11091) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0008.html ∗∗∗ Xen Security Advisory CVE-2019-11135 / XSA-305 ∗∗∗ --------------------------------------------- A new way to sample data from microarchitectural structures has been identified. A TSX Asynchronous Abort is a state which occurs between a transaction definitely aborting (usually for reasons outside of the pipeline's control e.g. receiving an interrupt), and architectural state being rolled back to start of the transaction. During this period, speculative execution may be able to infer the value of data in the microarchitectural structures. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-305.html ∗∗∗ Xen Security Advisory CVE-2018-12207 / XSA-304 ∗∗∗ --------------------------------------------- An erratum exists across some CPUs whereby an instruction fetch may cause a machine check error if the pagetables have been updated in a specific manner without invalidating the TLB. ... This corner case can be triggered by guest kernels. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-304.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (dpdk, intel-microcode, kernel, libssh2, qemu, and webkit2gtk), Fedora (apache-commons-beanutils, bluez, iwd, kernel, kernel-headers, kernel-tools, libell, and microcode_ctl), openSUSE (gdb), Oracle (kernel), Red Hat (kernel and kernel-rt), SUSE (dhcp, evolution, kernel, libcaca, python, python-xdg, qemu, sysstat, ucode-intel, and xen), and Ubuntu (dpdk, intel-microcode, kernel, linux, linux-aws, ..., webkit2gtk) --------------------------------------------- https://lwn.net/Articles/804641/ ∗∗∗ Citrix Hypervisor Security Update ∗∗∗ --------------------------------------------- CTX263684 - A security issue has been identified in certain CPU hardware that may allow unprivileged code running on a CPU core to infer the value of memory data belonging to other processes, virtual machines or the hypervisor that are, or have recently been, running on the same CPU core. --------------------------------------------- https://support.citrix.com/article/CTX263684 ∗∗∗ Citrix ADC and Citrix Gateway Security Update (CVE-2019-0140) ∗∗∗ --------------------------------------------- CTX263807 - A vulnerability has been identified affecting Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC, and Citrix Gateway, formerly known as NetScaler Gateway, platforms which could result in privilege escalation via layer 2 network access on all network interfaces. --------------------------------------------- https://support.citrix.com/article/CTX263807 ∗∗∗ Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Identity Services Engine Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Advisory - Two Vulnerabilities in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191113-… ∗∗∗ Security Advisory - Improper File Management Vulnerability in Huawei Share ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191113-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by kernel vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM NeXtScale Fan Power Controller (FPC) is affected by vulnerability in OpenSSL (CVE-2019-1559) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-nextscale-fan-power-c… ∗∗∗ libpcap vulnerability CVE-2019-15163 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K92862401?utm_source=f5support&utm_mediu… ∗∗∗ Hotfix XS80E008 - For Citrix Hypervisor 8.0 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263663 ∗∗∗ Hotfix XS76E012 - For XenServer 7.6 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263662 ∗∗∗ Hotfix XS71ECU2024 - For XenServer 7.1 Cumulative Update 2 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263661 ∗∗∗ Hotfix XS70E075 - For XenServer 7.0 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX263660 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.11.2019
by Daily end-of-shift report 12 Nov '19

12 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Montag 11-11-2019 18:00 − Dienstag 12-11-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Threat Alert: TCP Amplification Attacks ∗∗∗ --------------------------------------------- TCP reflection attacks, such as SYN-ACK reflection attacks, have been less popular among attackers until recently. The lack of popularity was mainly due to the wrong assumption that TCP reflection attacks cannot generate enough amplification compared to UDP-based reflections. In general, TCP attacks are low bandwidth and less likely to saturate an internet link. --------------------------------------------- https://blog.radware.com/security/2019/11/threat-alert-tcp-reflection-attac… ∗∗∗ Tech Support Scammers Exploiting Unpatched Firefox Bug ∗∗∗ --------------------------------------------- Mozilla is working on addressing a Firefox bug that has been exploited by tech support scammers to lock the browser when users visit specially crafted websites. --------------------------------------------- https://www.securityweek.com/tech-support-scammers-exploiting-unpatched-fir… ∗∗∗ Netflix: Vorsicht vor betrügerischen Phishing-Mails ∗∗∗ --------------------------------------------- Aktuell häufen sich Meldungen über betrügerische E-Mails, die angeblich von Netflix stammen. Es sei ein Problem mit der Zahlungsabwicklung aufgetreten, sodass Netflix die Nutzungsgebühr nicht abbuchen kann und daher den Account vorübergehend gesperrt hat. Kriminelle fordern Netflix-NutzerInnen auf, die Kontoinformationen zu aktualisieren. Es handelt sich jedoch um Phishing! --------------------------------------------- https://www.watchlist-internet.at/news/netflix-vorsicht-vor-betruegerischen… ∗∗∗ This unusual new ransomware is going after servers ∗∗∗ --------------------------------------------- The previously undetected server-encrypting malware has been detailed in research by cyber security analysts at Intezer and IBM X-Force, who've named it PureLocker because it's written in written in the PureBasic programming language. ... It's currently uncertain how exactly PureLocker is delivered to victims, but researchers note that more_eggs campaigns begin with phishing emails, so the ransomware attacks could begin in the same way, with the final payload likely to be the final part of a multi-staged attack. --------------------------------------------- https://www.zdnet.com/article/this-unusual-new-ransomware-is-going-after-se… ===================== = Vulnerabilities = ===================== ∗∗∗ McAfee Patches Privilege Escalation Flaw in Antivirus Software ∗∗∗ --------------------------------------------- McAfee patched a security vulnerability discovered in all editions of its Antivirus software for Windows and enabling potential attackers to escalate privileges and execute code using SYSTEM privileges. --------------------------------------------- https://www.bleepingcomputer.com/news/security/mcafee-patches-privilege-esc… ∗∗∗ Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating system of an affected device. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Adobe Security Bulletins ∗∗∗ --------------------------------------------- Adobe has published security bulletins for Adobe Animate CC (APSB19-34), Adobe Illustrator CC (APSB19-36), Adobe Media Encoder (APSB19-52) and Adobe Bridge CC (APSB19-53). --------------------------------------------- https://blogs.adobe.com/psirt/?p=1801 ∗∗∗ Sicherheitsupdate: Magento-Onlineshops von Schadcode-Attacken gefährdet ∗∗∗ --------------------------------------------- Wer einen Onlineshop mit Magento-Software betreibt, sollte aus Sicherheitsgründen zügig die aktuelle Version installieren. --------------------------------------------- https://heise.de/-4584383 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (community-mysql, crun, java-latest-openjdk, and mupdf), openSUSE (libssh2_org), and SUSE (go1.12, libseccomp, and tar). --------------------------------------------- https://lwn.net/Articles/804412/ ∗∗∗ Synology-SA-19:38 Synology Assistant ∗∗∗ --------------------------------------------- A vulnerability allows remote attackers to conduct denial-of-service attacks via a susceptible version of Synology Assistant. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_38 ∗∗∗ SAP Security Patch Day – November 2019 ∗∗∗ --------------------------------------------- On 12th of November 2019, SAP Security Patch Day saw the release of 12 Security Notes. There are 3 updates to previously released Patch Day Security Notes. --------------------------------------------- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528880390 ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache ActiveMQ vulnerability (CVE-2018-11775) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: Incorrect permissions on restored files and directories on Windows using IBM Spectrum Protect Plus (CVE-2019-4652) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-incorrect-permissions-on-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in Java affect IBM Spectrum Protect Plus ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact Configuration and Deployment Management Clickjacking ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by a jQuery vulnerability (CVE-2015-9251) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by a jQuery vulnerability (CVE-2019-11358) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ SSA-686531 (Last Update: 2019-11-12): Hardware based manufacturing access on S7-1200 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-686531.pdf ∗∗∗ SSA-616472 (Last Update: 2019-11-12): ZombieLoad and Microarchitectural Data Sampling Vulnerabilities in Industrial Products ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-616472.pdf ∗∗∗ SSA-898181 (Last Update: 2019-11-12): Desigo PX Web Remote Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-898181.pdf ∗∗∗ SSA-434032 (Last Update: 2019-11-12): Vulnerability in Mentor Nucleus Networking Module ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-434032.pdf ∗∗∗ Multiple tcpdump vulnerabilities ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K44551633 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.11.2019
by Daily end-of-shift report 11 Nov '19

11 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 08-11-2019 18:00 − Montag 11-11-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ DDoS attacks in Q3 2019 ∗∗∗ --------------------------------------------- Statistically, Q3 2019 differs little from Q2. In terms of geographical distribution of attacks and targets, we saw a continuation of the now familiar trend of unexpected guests appearing, only to drop out the next quarter. --------------------------------------------- https://securelist.com/ddos-report-q3-2019/94958/ ∗∗∗ Vulnerable Versions of Adminer as a Universal Infection Vector ∗∗∗ --------------------------------------------- This past week, we’ve been monitoring a new wave of website infections mostly impacting WordPress and Magento websites. We found that hackers have been injecting scripts from scripts.trasnaltemyrecords[.]com into multiple files and database tables. This is still the same ongoing campaign that we’ve been following for the past few years, where site visitors are redirected to various kinds of scam landing pages—including tech support scams, fake lottery wins, and malicious [...] --------------------------------------------- https://blog.sucuri.net/2019/11/vulnerable-versions-of-adminer-as-a-univers… ∗∗∗ Ring Video Doorbell Pro: Mitteilsame IoT-Türklingel verriet WLAN-Zugangsdaten ∗∗∗ --------------------------------------------- Eine Klingel, die Besucher sicht- und hörbar macht, hätte Angreifern unbemerkt vollen WLAN-Zugriff verschaffen können. Automatische Updates wurden verteilt. --------------------------------------------- https://heise.de/-4583764 ∗∗∗ Sofortübersetzer von Muama Enence hält nicht, was er verspricht ∗∗∗ --------------------------------------------- Ein Gerät, das 32 Sprachen unmittelbar übersetzt und Verständigungsprobleme im Urlaub oder bei Geschäftstätigkeiten beseitigt, klingt erstmal hervorragend! Dies verspricht die UAB Ekomlita mit dem MUAMA Enence Instant Translator. Doch Vorsicht: Hier werden mitunter wichtige Informationen zum Produkt verheimlicht, es kommt zu groben Problemen beim Rücktritt und wir hegen Bedenken zum Datenschutz! --------------------------------------------- https://www.watchlist-internet.at/news/sofortuebersetzer-von-muama-enence-h… ∗∗∗ Apples Siri unterwandert E-Mail-Verschlüsselung ∗∗∗ --------------------------------------------- Nachrichten werden unter macOS im Klartext lokal gespeichert – Fehlerbereinigung laut Apple in Arbeit --------------------------------------------- https://www.derstandard.at/story/2000110928043/apples-siri-unterwandert-e-m… ===================== = Vulnerabilities = ===================== ∗∗∗ Jira Service Desk Security Advisory 2019-11-06 ∗∗∗ --------------------------------------------- CVE-2019-15003 - Authorization bypass allows information disclosure CVE-2019-15004 - URL path traversal allows information disclosure --------------------------------------------- https://confluence.atlassian.com/jira/jira-service-desk-security-advisory-2… ∗∗∗ UniFi Video Server Privilege Escalation From user to SYSTEM via unauthenticated command execution ∗∗∗ --------------------------------------------- The vulnerability, or feature depending how you look at it, is the ability to execute commands using the evostream API interface that is exposed on localhost:7440. --------------------------------------------- https://hackerone.com/reports/544928 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ampache, chromium, djvulibre, firefox-esr, gdal, and ruby-haml), Fedora (chromium, file, gd, hostapd, nspr, and rssh), openSUSE (bcm20702a1-firmware, firefox, gdal, libtomcrypt, php7, python-ecdsa, python3, samba, and thunderbird), SUSE (apache2-mod_auth_openidc, libssh2_org, and rsyslog), and Ubuntu (bash). --------------------------------------------- https://lwn.net/Articles/804325/ ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to multiple Kernel vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: IBM RackSwitch firmware products are affected by TCP denial of service vulnarabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-rackswitch-firmware-p… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache Camel vulnerability (CVE-2019-0188) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: Node.js lodash vulnerability affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center) ( CVE-2019-10744) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-node-js-lodash-vulnerabil… ∗∗∗ Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by vulnerability in SQLite (CVE-2018-20346) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-flex-system-chassis-m… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to Jetty Vulnerabilities (CVE-2017-7656, CVE-2017-7657, CVE-2017-7658, CVE-2018-12536) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: IBM Tivoli Netcool Impact is affected by an Apache Camel vulnerability (CVE-2019-0194) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-tivoli-netcool-impact… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to cross site scripting (XSS) (CVE-2019-4470) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: Multiple vulnerabilities in Python affect IBM i ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to Intel Microarchitectural Data Sampling (MDS) Vulnerabilites ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.11.2019
by Daily end-of-shift report 08 Nov '19

08 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 07-11-2019 18:00 − Freitag 08-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Microsoft Warns of More Harmful Windows BlueKeep Attacks, Patch Now ∗∗∗ --------------------------------------------- The Microsoft Defender ATP Research Team says that the BlueKeep attacks detected on November 2 are connected with a coin mining campaign from September that used the same command-and-control (C2) infrastructure. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-warns-of-more-harm… ∗∗∗ QNAP Warns Users to Secure Devices Against QSnatch Malware ∗∗∗ --------------------------------------------- Network-attached storage (NAS) maker QNAP urges customers to secure their NAS devices against an ongoing malicious campaign that infects them with QSnatch malware capable of stealing user credentials. --------------------------------------------- https://www.bleepingcomputer.com/news/security/qnap-warns-users-to-secure-d… ∗∗∗ Amazon Kindle, Embedded Devices Open to Code-Execution ∗∗∗ --------------------------------------------- Flaws in Das U-Boot affect third-party hardware that uses the universal bootloader as an underlying component. --------------------------------------------- https://threatpost.com/amazon-kindle-embedded-devices-code-execution/150003/ ∗∗∗ Pwn2Own Tokyo Roundup: Amazon Echo, Routers and Smart TVs Fall to Hackers ∗∗∗ --------------------------------------------- The latest edition of the bi-annual hacking contest saw creative exploits in new device categories. --------------------------------------------- https://threatpost.com/pwn2own-tokyo-2019-amazon-echo-hackers/150033/ ∗∗∗ Microsoft Apps Diverted from Their Main Use, (Fri, Nov 8th) ∗∗∗ --------------------------------------------- This week, the CERT.eu[1] organized its yearly conference in Brussels. Across many interesting presentations, one of them covered what they called the "catnmouse" game that Blue and Red teams are playing continuously. When the Blue team has detected an attack technique, they write a rule or implement a new control to detect or block it. Then, the Red team has to find an alternative attack path, [...] --------------------------------------------- https://isc.sans.edu/diary/rss/25502 ∗∗∗ Skimmers for Both Magento and WordPress ∗∗∗ --------------------------------------------- We often write about malware that steal payment information from sites built with Magento and other types of e-commerce CMS. When discussing credit card skimmers like Magecart, it’s sometimes overlooked that WordPress also has a decent share in the ecommerce segment. There are numerous popular plugins that can easily turn a WordPress site into a full-featured online store. In fact, Woocommerce alone has over 5 million installations. --------------------------------------------- https://blog.sucuri.net/2019/11/skimmers-for-both-magento-and-wordpress.html ∗∗∗ Wireshark Tutorial: Examining Trickbot Infections ∗∗∗ --------------------------------------------- A tutorial offering tips on how to identify Trickbot, an information stealer and banking malware that has been infecting victims since 2016. --------------------------------------------- https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-trickbot-i… ===================== = Vulnerabilities = ===================== ∗∗∗ Medtronic Valleylab FT10 and LS10 ∗∗∗ --------------------------------------------- This medical advisory contains mitigations for improper authentication and protection mechanism failure vulnerabilities in Medtronic’s Valleylab FT10 and LS10 energy and electrosurgery products. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsma-19-311-01 ∗∗∗ Medtronic Valleylab FT10 and FX8 ∗∗∗ --------------------------------------------- This medical advisory contains mitigations for use of hard-coded credentials, reversible one-way hash, and improper input validation vulnerabilities in Medtronic’s Valleylab FT10 and FX8 products. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsma-19-311-02 ∗∗∗ Mitsubishi Electric MELSEC-Q Series and MELSEC-L Series CPU Modules ∗∗∗ --------------------------------------------- This advisory contains mitigations for an uncontrolled resource consumption vulnerability in select Mitsubishi Electrics CPU modules. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-311-01 ∗∗∗ Fuji Electric V-Server ∗∗∗ --------------------------------------------- This advisory contains mitigations for a heap-based buffer overflow vulnerability in Fuji Electrics V-Server data collection and management service. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-311-02 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (linux-hardened), Debian (fribidi), Gentoo (oniguruma, openssh/openssh, openssl, and pump), Mageia (chromium-browser-stable, expat, firefox, freetds, proftpd, python, thunderbird, and unbound), Oracle (sudo), Scientific Linux (thunderbird), Slackware (kernel), SUSE (rubygem-haml), and Ubuntu (fribidi and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/804202/ ∗∗∗ IBM Security Bulletin: Security vulnerabilities affect multiple IBM Rational products based on IBM Jazz technology ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-security-vulnerabilit… ∗∗∗ tcpdump vulnerability CVE-2018-14879 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K51512510 ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2019-0006 ∗∗∗ --------------------------------------------- https://webkitgtk.org/security/WSA-2019-0006.html ∗∗∗ Squid: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0966 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.11.2019
by Daily end-of-shift report 07 Nov '19

07 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 06-11-2019 18:00 − Donnerstag 07-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Specially Crafted ZIP Files Used to Bypass Secure Email Gateways ∗∗∗ --------------------------------------------- Attackers are always looking for new tricks to distribute malware without them being detected by antivirus scanners and secure email gateways. This was illustrated in a new phishing campaign that utilized a specially crafted ZIP file that was designed to bypass secure email gateways to distribute the NanoCore RAT. --------------------------------------------- https://www.bleepingcomputer.com/news/security/specially-crafted-zip-files-… ∗∗∗ How to Secure Critical Infrastructure When Patching Isn’t Possible ∗∗∗ --------------------------------------------- Mission-critical systems cant just be switched off to apply security updates -- so patching can take weeks if not years. --------------------------------------------- https://threatpost.com/secure-critical-infrastructure-when-patching-isnt-po… ∗∗∗ Vulnerability hunting with Semmle QL: DOM XSS ∗∗∗ --------------------------------------------- In two previous blog posts ( part 1 and part 2), we talked about using Semmle QL in C and C++ codebases to find vulnerabilities such as integer overflow, path traversal, and those leading to memory corruption. In this post, we will explore applying Semmle QL to web security by hunting for one of the [...] --------------------------------------------- https://msrc-blog.microsoft.com:443/2019/11/06/vulnerability-hunting-with-s… ∗∗∗ Getting the best value out of security assessments, (Thu, Nov 7th) ∗∗∗ --------------------------------------------- Since my day job is all about hacking, I get a lot of questions (and there appears to be a lot of confusion) about what a vulnerability scan, penetration test or red team assessment is. --------------------------------------------- https://isc.sans.edu/diary/rss/25498 ∗∗∗ Magento 1 End of Life ∗∗∗ --------------------------------------------- It’s no secret that a CMS without support will develop vulnerabilities. Eventually, these lead to a compromised website — which cripples any ecommerce business. When you consider the popularity of the Magento ecommerce platform, it’s easy to see how their announcement of the Magento 1 end of life could leave a significant portion of ecommerce retailers scrambling for new solutions. --------------------------------------------- https://blog.sucuri.net/2019/11/magento-1-end-of-life.html ∗∗∗ VB2019 paper: DNS on fire ∗∗∗ --------------------------------------------- In a paper presented at VB2019, Cisco Talos researchers Warren Mercer and Paul Rascagneres looked at two recent attacks against DNS infrastructure: DNSpionage and Sea Turtle. Today we publish their paper and the recording of their presentation. --------------------------------------------- https://www.virusbulletin.com:443/blog/2019/11/vb2019-paper-dns-fire/ ∗∗∗ C2 With It All: From Ransomware To Carding ∗∗∗ --------------------------------------------- Cisco Talos recently discovered a new server hosting a large stockpile of malicious files. Our analysis of these files shows that these attackers were able to obtain a deep level of access to victims infrastructure — all of which allowed us to identify several targets of these attacks, including one American manufacturing company. Talos notified these targets of the attack. --------------------------------------------- https://blog.talosintelligence.com/2019/11/c2-with-it-all.html ∗∗∗ 5 Tipps zur Steigerung der Cybersecurity Awareness von Angestellten ∗∗∗ --------------------------------------------- Wie können Firmen ein Arbeitsumfeld schaffen, das es Angestellten ermöglicht, die nötigen Fähigkeiten zu erwerben, um Cybergefahren richtig einzuschätzen? --------------------------------------------- https://www.welivesecurity.com/deutsch/2019/11/07/5-tipps-steigerung-cybers… ∗∗∗ Falsche Gewinnspiele für Kinogutscheine kosten 80 Euro pro Monat ∗∗∗ --------------------------------------------- Mit Facebook-Anzeigen und nachgebauten Facebook-Seiten von Kinos in ganz Österreich werben Kriminelle für ein Gewinnspiel. Angeblich können Kinogutscheine gewonnen werden. Doch Vorsicht: Hier gibt es nichts zu gewinnen! Statt eines Kinobesuchs gibt es nur Ärger. Die Kreditkartendaten landen in den Händen von Kriminellen, die dann 80 bis 90 Euro pro Monat abbuchen. --------------------------------------------- https://www.watchlist-internet.at/news/falsche-gewinnspiele-fuer-kinogutsch… ===================== = Vulnerabilities = ===================== ∗∗∗ Gamers Hit with Nvidia GPU Driver, GeForce Flaws ∗∗∗ --------------------------------------------- Vulnerabilities in several PC gaming products offered by Nvidia can lead to escalation of privilege, denial of service and other malicious attacks. --------------------------------------------- https://threatpost.com/gamers-hit-with-nvidia-gpu-driver-geforce-flaws/1499… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (squid), Fedora (chromium, libssh2, and wpa_supplicant), openSUSE (chromium), Red Hat (ansible, chromium-browser, openstack-octavia, patch, qemu-kvm-rhev, sudo, and thunderbird), Scientific Linux (sudo), SUSE (bluez, gdb, php72, and thunderbird), and Ubuntu (cpio and rygel). --------------------------------------------- https://lwn.net/Articles/804091/ ∗∗∗ Cisco: All these routers have the same embedded crypto keys, so update firmware ∗∗∗ --------------------------------------------- Cisco removes static encryption keys that were shared across its small-business routers. --------------------------------------------- https://www.zdnet.com/article/cisco-all-these-routers-have-the-same-embedde… ∗∗∗ Open Social - Critical - Insecure Session Management - SA-CONTRIB-2019-075 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-075 ∗∗∗ PEPPERL+FUCHS Linux Kernel Vulnerability on ecom Mobile Devices ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2019-021 ∗∗∗ Red Hat OpenShift Container Platform: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0965 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.11.2019
by Daily end-of-shift report 06 Nov '19

06 Nov '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 05-11-2019 18:00 − Mittwoch 06-11-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Emotet, Trickbot, Ryuk – ein explosiver Malware-Cocktail ∗∗∗ --------------------------------------------- Der aktuell "zerstörerischste" Schädling Emotet besteht aus einer Kaskade mehrerer Schadprogramme, die zusammen vielstellige Millionenschäden verursachen. --------------------------------------------- https://heise.de/-4573848 ∗∗∗ Überteuerte Visums- und Einreisegenehmigungsangebote im Internet ∗∗∗ --------------------------------------------- Ihr nächstes Urlaubsziel verlangt ein Visum? Dann nehmen Sie sich vor unseriösen Websites in Acht, die ein Vielfaches der tatsächlich anfallenden Gebühr für die Einreisegenehmigungen verlangen. Besondere Vorsicht ist beispielsweise bei Reisen nach Australien, Ägypten, Vietnam, Indien sowie Kanada oder in die USA und die Türkei geboten – theoretisch ist die Masche aber bei allen Destinationen mit Visumspflicht möglich. --------------------------------------------- https://www.watchlist-internet.at/news/ueberteuerte-visums-und-einreisegene… ∗∗∗ German Dridex spam campaign is unfashionably large ∗∗∗ --------------------------------------------- VB has analysed a malicious spam campaign targeting German-speaking users with obfuscated Excel malware that would likely download Dridex but that mostly stood out through its size. --------------------------------------------- https://www.virusbulletin.com:443/blog/2019/11/german-malspam-campaign-unfa… ∗∗∗ Scammers Are Exploiting a Firefox Bug to Freeze Your Browser ∗∗∗ --------------------------------------------- Fraudulent tech-support sites are causing the browser to lock up and display a disturbing message. Force quitting is the only way out. --------------------------------------------- https://www.wired.com/story/scammers-are-exploiting-a-firefox-bug-to-freeze… ∗∗∗ Siemens PLC Feature Can Be Exploited for Evil - and for Good ∗∗∗ --------------------------------------------- A hidden feature in some newer models of the vendors programmable logic controllers leaves the devices open to attack. Siemens says it plans to fix it. --------------------------------------------- https://www.darkreading.com/vulnerabilities---threats/siemens-plc-feature-c… ∗∗∗ Kamerka OSINT tool shows your countrys internet-connected critical infrastructure ∗∗∗ --------------------------------------------- Kamerka lets you see what a hacker sees. It plots maps with SCADA equipment, webcams, and printers that have been left exposed on the internet inside any given country. --------------------------------------------- https://www.zdnet.com/article/kamerka-osint-tool-shows-your-countrys-intern… ===================== = Vulnerabilities = ===================== ∗∗∗ Omron CX-Supervisor ∗∗∗ --------------------------------------------- This advisory contains mitigations for a use of obsolete function vulnerability in Omrons CX-Supervisor SCADA and HMI package. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-309-01 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (cpio, openafs, proftpd-dfsg, simplesamlphp, and wordpress), Fedora (thunderbird), openSUSE (binutils, docker-runc, kernel, nfs-utils, php7, python3, and samba), Red Hat (389-ds:1.4, ansible, bind, container-tools:1.0, container-tools:rhel8, curl, dbus, dhcp, dovecot, edk2, elfutils, evolution, freeradius:3.0, gdb, gettext, glib2, glibc, GNOME, gnutls, go-toolset:rhel8, http-parser, httpd:2.4, kernel, kernel-rt, libarchive, libjpeg-turbo, libqb, [...] --------------------------------------------- https://lwn.net/Articles/804018/ ∗∗∗ Smartwares HOME easy v1.0.9 Database Backup Information Disclosure Exploit ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5541.php ∗∗∗ Smartwares HOME easy v1.0.9 Client-Side Authentication Bypass ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5540.php ∗∗∗ Cisco Security Advisories ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/publicationListing.x ∗∗∗ Security Advisory - Insufficient Authentication Vulnerability in Several Band Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191106-… ∗∗∗ libpcap vulnerability CVE-2018-16301 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K86252029 ∗∗∗ Red Hat Enterprise Linux: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0959 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily