Daily

daily@lists.cert.at

1 participants
3119 discussions

Tageszusammenfassung - 23.10.2019
by Daily end-of-shift report 23 Oct '19

23 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 22-10-2019 18:00 − Mittwoch 23-10-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ VB2019 papers: Emotet and Ryuk ∗∗∗ --------------------------------------------- Today we publish VB2019 papers by Luca Nagy (Sophos) on Emotet and Gabriela Nicolao and Luciano Martins (Deloitte) on Ryuk, as well as the corresponding videos of their presentations. --------------------------------------------- https://www.virusbulletin.com:443/blog/2019/10/vb2019-papers-emotet-and-ryu… ∗∗∗ CPDoS: Cache Poisoned Denial of Service ∗∗∗ --------------------------------------------- Cache-Poisoned Denial-of-Service (CPDoS) is a new class of web cache poisoning attacks aimed at disabling web resources and websites. --------------------------------------------- https://cpdos.org/ ∗∗∗ Tech, Security Firms Launch Operational Technology Cyber Security Alliance ∗∗∗ --------------------------------------------- Several major tech and cybersecurity companies have joined forces for a new initiative called the Operational Technology Cyber Security Alliance (OTCSA), which aims to help industrial and critical infrastructure organizations address challenges related to OT security by providing guidance and resources. --------------------------------------------- https://www.securityweek.com/tech-security-firms-launch-operational-technol… ∗∗∗ Investment-Firmen fordern Zugriff auf Ihr System? Nehmen Sie Abstand! ∗∗∗ --------------------------------------------- Nehmen Sie sich vor Investments bei unseriösen Firmen wie aurumpro.co beziehungsweise Muller Enterprise LTD in Acht. Angebliche BeraterInnen kontaktieren Sie telefonisch und verleiten Sie zu immer höheren Investments. Um "effektiver" handeln zu können, verlangt man die Installation von Fernwartungssoftware wie AnyDesk oder TeamViewer. Tun Sie dies nicht und nehmen Sie Abstand – man hat es auf Ihr Vermögen abgesehen! --------------------------------------------- https://www.watchlist-internet.at/news/investment-firmen-fordern-zugriff-au… ===================== = Vulnerabilities = ===================== ∗∗∗ Schneider Electric ProClima ∗∗∗ --------------------------------------------- This advisory contains mitigations for code injection, improper restriction of operations within the bounds of a memory buffer, and uncontrolled search path element vulnerabilities in Schneider Electrics ProClima building and automation control products. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-295-01 ∗∗∗ Firefox, Chrome Bugs Allow Arbitrary Code-Execution ∗∗∗ --------------------------------------------- Multiple critical memory safety bugs in Firefox 69 and Firefox ESR 68.1 in particular affect medium and large government entities and enterprises. --------------------------------------------- https://threatpost.com/critical-firefox-bugs-arbitrary-code-execution/14945… ∗∗∗ OpenAFS Security Advisory 2019-001 ∗∗∗ --------------------------------------------- Topic: information leakage from uninitialized RPC output variables on error Issued: 22 October, 2019 Affected: OpenAFS versions 1.0 through 1.6.23, and 1.8.0 through 1.8.4 --------------------------------------------- http://openafs.org/pages/security/OPENAFS-SA-2019-001.txt ∗∗∗ OpenAFS Security Advisory 2019-002 ∗∗∗ --------------------------------------------- Topic: information leakage from uninitialized scalars Issued: 22 October, 2019 Affected: OpenAFS versions 1.0 through 1.6.23, and 1.8.0 through 1.8.4 --------------------------------------------- http://openafs.org/pages/security/OPENAFS-SA-2019-002.txt ∗∗∗ OpenAFS Security Advisory 2019-003 ∗∗∗ --------------------------------------------- Topic: database server crash from unserialized data access Issued: 22 October, 2019 Affected: OpenAFS versions 1.0 through 1.6.23, and 1.8.0 through 1.8.4 --------------------------------------------- http://openafs.org/pages/security/OPENAFS-SA-2019-003.txt ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (go, go-pie, pacman, and xpdf), CentOS (java-1.7.0-openjdk, java-1.8.0-openjdk, java-11-openjdk, and patch), openSUSE (gcc7), Red Hat (firefox, kernel, and qemu-kvm-rhev), Slackware (mozilla), SUSE (kernel, libcaca, openconnect, python, sysstat, and zziplib), and Ubuntu (libxslt, linux-azure, and linux-lts-xenial, linux-aws). --------------------------------------------- https://lwn.net/Articles/802941/ ∗∗∗ Avast, Avira Products Vulnerable to DLL Hijacking ∗∗∗ --------------------------------------------- Vulnerabilities in Avast Antivirus, AVG Antivirus, and Avira Antivirus could allow an attacker to load a malicious DLL file in an effort to bypass defenses and escalate privileges, SafeBreach Labs security researchers discovered. read more --------------------------------------------- https://www.securityweek.com/avast-avira-products-vulnerable-dll-hijacking ∗∗∗ Security Advisory - Out-Of-Bound Read Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191023-… ∗∗∗ Security Advisory - Insufficient Authentication Vulnerability in Several Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191023-… ∗∗∗ Security Advisory - Memory Leak Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20191023-… ∗∗∗ IBM Security Bulletin: IBM Security Proventia Network Active Bypass is affected by openssl vulnerabilities (CVE-2019-1547, CVE-2019-1563) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-security-proventi… ∗∗∗ IBM Security Bulletin: Vulnerability in Apache Commons Beanutils affect Tivoli Netcool/OMNIbus WebGUI (CVE-2019-10086) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerability-in-apac… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM® Db2®. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2019-4486) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-maximo-asset-mana… ∗∗∗ IBM Security Bulletin: A security vulnerability affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise Edition (CVE-2019-4398) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-a-security-vulnerabil… ∗∗∗ IBM Security Bulletin: IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise Edition is affected by ASoC vulnerability (CVE-2019-4459) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-cloud-orchestrato… ∗∗∗ IBM Security Bulletin: A security vulnerability affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise Edition (CVE-2019-4397) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-a-security-vulnerabil… ∗∗∗ IBM Security Bulletin: IBM Security Proventia Network Active Bypass is affected by glibc vulnerabilities (CVE-2018-20796, CVE-2019-9169) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-security-proventi… ∗∗∗ IBM Security Bulletin: IBM Security Proventia Network Active Bypass is affected by openssl vulnerabilities (CVE-2019-1559) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-security-proventi… ∗∗∗ BIND vulnerability CVE-2018-5743 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K74009656 ∗∗∗ BIG-IP vulnerability CVE-2018-15333 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K53620021 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.10.2019
by Daily end-of-shift report 22 Oct '19

22 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Montag 21-10-2019 18:00 − Dienstag 22-10-2019 18:00 Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Three Service Account Secrets Straight from Hackers and Security Pros ∗∗∗ --------------------------------------------- A survey of nearly 300 Black Hat conference attendees this year showed strong agreement that service accounts are an attractive target. --------------------------------------------- https://threatpost.com/service-account-secrets/148996/ ∗∗∗ MISP Summit 0x05 Wrap-Up ∗∗∗ --------------------------------------------- I’m in Luxembourg for a full week of infosec events. It started today with the MISP summit. It was already the fifth edition and, based on the number of attendees, the tool is getting more and more popularity. --------------------------------------------- https://blog.rootshell.be/2019/10/21/misp-summit-0x05-wrap-up/ ∗∗∗ emotet_network_protocol ∗∗∗ --------------------------------------------- This repository has been created with the idea of helping the community of cybersecurity researchers and malware researchers. It explains in detail how the network communication protocol used by Emotet to communicate with the C&Cs works. Knowing all these details, it should be relatively easy to emulate the communication, and obtain the new modules and distributed malware directly from the c&c. --------------------------------------------- https://d00rt.github.io/emotet_network_protocol/ ∗∗∗ Avast, NordVPN Breaches Tied to Phantom User Accounts ∗∗∗ --------------------------------------------- Antivirus and security giant Avast and virtual private networking (VPN) software provider NordVPN each today disclosed months-long network intrusions that -- while otherwise unrelated -- shared a common cause: Forgotten or unknown user accounts that granted remote access to internal systems with little more than a password. --------------------------------------------- https://krebsonsecurity.com/2019/10/avast-nordvpn-breaches-tied-to-phantom-… ∗∗∗ The forgotten domain: Exploring a link between Magecart Group 5 and the Carbanak APT ∗∗∗ --------------------------------------------- Bread crumbs left behind open up a possible connection between Magecart Group 5 and Carbanak. --------------------------------------------- https://blog.malwarebytes.com/threat-analysis/2019/10/the-forgotten-domain-… ∗∗∗ Malspam Campaign Targeted German Organizations with Buran Ransomware ∗∗∗ --------------------------------------------- Researchers spotted a malspam campaign that targeted German organizations with samples of the Buran crypto-ransomware family. In early October, Bromium observed a malspam campaign whose emails impersonated online fax service eFax. The emails contained hyperlinks to a PHP page that served up malicious Word documents. --------------------------------------------- https://www.tripwire.com/state-of-security/security-data-protection/malspam… ∗∗∗ genosyla.net und versandhaus-voss.de liefern keine Ware ∗∗∗ --------------------------------------------- Bei genosyla.net und versandhaus-voss.de finden Sie günstige Elektrogeräte. Viele Produkte sind im Schnitt 100 Euro billiger als bei anderen Shops. Der Haken: die Ware wird trotz Bezahlung nie geliefert. Es handelt sich um betrügerische Webshops. Sie verlieren Ihr Geld! --------------------------------------------- https://www.watchlist-internet.at/news/genosylanet-und-versandhaus-vossde-l… ∗∗∗ Browser-based attacks, our customers, and us ∗∗∗ --------------------------------------------- While some browser-based attacks such as web skimming steal customer data and thus victimize both the organization and the users, other attacks leverage an organizations website to attack the customers or to attack another organization entirely. --------------------------------------------- https://www.zdnet.com/article/browser-based-attacks-our-customers-and-us/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (jss and kernel), Debian (libpcap, openjdk-8, and tcpdump), Fedora (java-11-openjdk), openSUSE (libreoffice), Oracle (java-1.7.0-openjdk), Red Hat (java-1.7.0-openjdk, python, and wget), Scientific Linux (java-1.7.0-openjdk), SUSE (ceph, ceph-iscsi, ses-manual_en, dhcp, openconnect, and procps), and Ubuntu (exiv2, linux, linux-aws, linux-azure, linux-gcp, linux-kvm, linux-raspi2, linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon, linux-hwe, [...] --------------------------------------------- https://lwn.net/Articles/802863/ ∗∗∗ ZDI-19-908: Foxit Studio Photo JPEG Batch Processing Out-Of-Bounds Read Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-19-908/ ∗∗∗ IBM Security Bulletin: Security Bulletin: IBM Event Streams is affected by jackson-databind vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-security-bulletin-ibm… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.10.2019
by Daily end-of-shift report 21 Oct '19

21 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 18-10-2019 18:00 − Montag 21-10-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Avast Network Breached As Hackers Target CCleaner Again ∗∗∗ --------------------------------------------- Avast said it believes that threat actors are again looking to target CCleaner in a supply chain attack. --------------------------------------------- https://threatpost.com/avast-network-breached-as-hackers-target-ccleaner-ag… ∗∗∗ Attention: Your blog may be used to spread the Emotet Trojan! ∗∗∗ --------------------------------------------- Emotet was originally a banking Trojan that targeted bank customers in Europe and stole relevant bank credentials. In 2017, Emotet changed its business model from [...] --------------------------------------------- https://blog.360totalsecurity.com/en/attention-your-blog-may-be-used-to-spr… ∗∗∗ Winnti Group’s skip‑2.0: A Microsoft SQL Server backdoor ∗∗∗ --------------------------------------------- Notorious cyberespionage group debases MSSQL --------------------------------------------- https://www.welivesecurity.com/2019/10/21/winnti-group-skip2-0-microsoft-sq… ===================== = Vulnerabilities = ===================== ∗∗∗ Linux: Kritische Zeroday-Lücke im WLAN-Treiber ∗∗∗ --------------------------------------------- Mit speziell präparierten WLAN-Paketen könnten Angreifer Linux-Systeme kapern, die Realtek-Chips einsetzen. --------------------------------------------- https://heise.de/-4562505 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (aspell, graphite-web, imagemagick, mediawiki, milkytracker, nfs-utils, and openjdk-11), Fedora (kernel, kernel-headers, kernel-tools, mediawiki, and radare2), openSUSE (dhcp, libpcap, lighttpd, and tcpdump), Scientific Linux (java-1.8.0-openjdk), Slackware (python), SUSE (bluez, kernel, and python-xdg), and Ubuntu (aspell). --------------------------------------------- https://lwn.net/Articles/802776/ ∗∗∗ AVM FRITZ!OS: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- https://www.bsi-fuer-buerger.de/SharedDocs/Warnmeldungen/DE/TW/2019/10/warn… ∗∗∗ Trend Micro Anti-Threat Toolkit (ATTK) < = v1.62.0.1218 Remote Code Execution 0day ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2019100137 ∗∗∗ IBM Security Bulletin: Version 8.15.0 of Node.js included in IBM Cloud Event Management 2.3.0 has several security vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-version-8-15-0-of-nod… ∗∗∗ IBM Security Bulletin: IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise Edition is affected by HTTP Server vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-cloud-orchestrato… ∗∗∗ IBM Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise (CVE-2018-1996) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-a-security-vulnerabil… ∗∗∗ Linux kernel vulnerability CVE-2019-16089 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K03814795?utm_source=f5support&utm_mediu… ∗∗∗ Linux kernel vulnerability CVE-2019-15666 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K53420251?utm_source=f5support&utm_mediu… ∗∗∗ Authentication Bypass Vulnerability in the Management Interface of Citrix Application Delivery Controller and Citrix Gateway ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX261055 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.10.2019
by Daily end-of-shift report 18 Oct '19

18 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 17-10-2019 18:00 − Freitag 18-10-2019 18:00 Handler: n/a Co-Handler: n/a ===================== = News = ===================== ∗∗∗ STOP Ransomware Decryptor Released for 148 Variants ∗∗∗ --------------------------------------------- The release of Emsisofts STOP Ransomware decryption service is a huge achievement and will be a life saver for both the victims and the helpers on BleepingComputer. It should be noted, though, that while this decryptor can help with the majority of STOP variants, anyone who was infected after August 2019 cannot be helped. --------------------------------------------- https://www.bleepingcomputer.com/news/security/stop-ransomware-decryptor-re… ∗∗∗ REvil Ransomware Affiliates Partner with Corporate Intruders ∗∗∗ --------------------------------------------- Experienced network intruders and ransomware groups have struck an alliance helping each other monetize their skills by spreading malware to company networks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/revil-ransomware-affiliates-… ∗∗∗ Ordinypt: Resurgence ∗∗∗ --------------------------------------------- Recently, the Ordinypt malware has seen a resurgence in the wild, disguised as fake job applications sent via email to human resource departments in German companies. The malware uses social engineering to infect the user’s files and trick them into paying cryptocurrency to restore the infected files. --------------------------------------------- https://www.gdatasoftware.com/blog/2019/10/35358-resurgence ∗∗∗ Quick Malicious VBS Analysis, (Fri, Oct 18th) ∗∗∗ --------------------------------------------- Lets have a look at a VBS sample found yesterday. It started as usual with a phishing email that contained a link to a malicious ZIP archive. This technique is more and more common to deliver the first stage via a URL because it reduces the risk to have the first file blocked by classic security controls. --------------------------------------------- https://isc.sans.edu/diary/rss/25430 ∗∗∗ Fake UpdraftPlus Plugins ∗∗∗ --------------------------------------------- We often find various fake WordPress plugins installed by hackers during website cleanups. Recently, we’ve noticed a new wave of infections that install fake plugins with backdoor functionality. --------------------------------------------- https://blog.sucuri.net/2019/10/fake-updraftplus-plugins.html ∗∗∗ Samsung to patch S10 fingerprint sensor bug next week ∗∗∗ --------------------------------------------- Samsung promises software patch next week; recommends not using custom screen covers in the meantime. --------------------------------------------- https://www.zdnet.com/article/samsung-to-patch-s10-fingerprint-sensor-bug-n… ===================== = Vulnerabilities = ===================== ∗∗∗ AVEVA Vijeo Citect and Citect SCADA ∗∗∗ --------------------------------------------- This advisory contains mitigations for a stack-based buffer overflow vulnerability in the AVEVA Vijeo Citect and Citect SCADA. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-290-01 ∗∗∗ Horner Automation Cscape ∗∗∗ --------------------------------------------- This advisory contains mitigations for improper input validation and out-of-bounds write vulnerabilities in Horner Automations Cscape control system application programming software. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-290-02 ∗∗∗ VMSA-2019-0017 ∗∗∗ --------------------------------------------- VMware SD-WAN by VeloCloud update addresses information disclosure vulnerability (CVE-2019-5533) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0017.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (poppler, sudo, and wordpress), Oracle (java-1.8.0-openjdk), Red Hat (java-1.8.0-openjdk), Scientific Linux (java-1.8.0-openjdk, java-11-openjdk, and kernel), and SUSE (kernel and postgresql10). --------------------------------------------- https://lwn.net/Articles/802622/ ∗∗∗ Synology-SA-19:34 WordPress ∗∗∗ --------------------------------------------- These vulnerabilities allow remote attackers to inject arbitrary web script or HTML, obtain sensitive information, or access intranet resources via a susceptible version of WordPress. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_19_34 ∗∗∗ InfoZIP vulnerability CVE-2019-13232 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K80311892 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.10.2019
by Daily end-of-shift report 17 Oct '19

17 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 16-10-2019 18:00 − Donnerstag 17-10-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ 10 Steps for Ransomware Protection ∗∗∗ --------------------------------------------- Here are things you can do right now to shore up your defenses and help your recovery when you get hit. --------------------------------------------- https://threatpost.com/10-steps-ransomware-protection/149259/ ∗∗∗ Betrüger übernehmen alte E-Mail-Adressen ∗∗∗ --------------------------------------------- Das Bundeskriminalamt (BKA) warnt vor missbräuchlicher Verwendung alter E-Mail-Adressen. Betrüger würden sich länger nicht genutzte E-Mail-Adressen aneignen, um damit Zugang zu persönlichen Nutzerkonten zu erlangen, so das BKA. Gaming Accounts und Nutzerkonten in Sozialen Medien seien besonders betroffen. --------------------------------------------- https://help.orf.at/stories/2993027/ ∗∗∗ l+f: Leise rieselt der Crypto-Miner ∗∗∗ --------------------------------------------- Forscher entdecken Crypto-Miner und Backdoors, die sich in WAV-Dateien verstecken. --------------------------------------------- https://heise.de/-4558856 ∗∗∗ Cisco fixes serious flaws in enterprise-grade Catalyst and Aironet access points ∗∗∗ --------------------------------------------- Cisco has released another batch of security updates, the most critical of which fixes a vulnerability that could allow unauthenticated, remote attackers to gain access to vulnerable Cisco Aironet wireless access points. Cisco Aironet APs are enterprise-grade access points used for branch offices, campuses, organizations of all sizes, enterprise and carrier-operator Wi-Fi deployments, and so on. --------------------------------------------- https://www.helpnetsecurity.com/2019/10/17/cisco-aironet-vulnerabilities/ ∗∗∗ KRACK‑Sicherheitslücke in Alexa Smart Home Geräten ∗∗∗ --------------------------------------------- Das ESET Smart Home Research Team entdeckte KRACK-Sicherheitslücken in einigen Amazon Echo- und Kindle-Geräten. --------------------------------------------- https://www.welivesecurity.com/deutsch/2019/10/17/krack-sicherheitsluecke-a… ∗∗∗ Werbung für betrügerische Elektriker auf Google ∗∗∗ --------------------------------------------- Wenn zu Hause der Strom ausfällt, verschafft oft nur eine Fachkraft Abhilfe. Die Suche über Google am Smartphone liegt dabei natürlich nahe. Doch Vorsicht: Die Gefahr, über die Anzeigen auf unseriöse Angebote zu stoßen, ist hoch! Opfer landen beispielsweise auf elektriker-mg.at, elektriker-dienst.at oder elektriker.24std.expert, wo die großen Versprechen in schlechter Arbeit zu horrenden Preisen münden. --------------------------------------------- https://www.watchlist-internet.at/news/werbung-fuer-betruegerische-elektrik… ===================== = Vulnerabilities = ===================== ∗∗∗ Dangerous Kubernetes Bugs Allow Authentication Bypass, DoS ∗∗∗ --------------------------------------------- The flaws in the container technology, CVE-2019-16276 and CVE-2019-11253, are simple to exploit. --------------------------------------------- https://threatpost.com/kubernetes-bugs-authentication-bypass-dos/149265/ ∗∗∗ Security updates available in Foxit Reader 9.7, Foxit PhantomPDF 9.7 and Foxit PhantomPDF Mac 3.4 ∗∗∗ --------------------------------------------- Foxit has released Foxit Reader 9.7 and Foxit PhantomPDF 9.7, which addresses potential security and stability issues. Foxit has released Foxit PhantomPDF Mac 3.4, which addresses potential security and stability issues. --------------------------------------------- https://www.foxitsoftware.com/support/security-bulletins.php ∗∗∗ VMSA-2019-0017 ∗∗∗ --------------------------------------------- VMware ESXi, Workstation, Fusion, VMRC and Horizon Client updates address use-after-free and denial of service vulnerabilities. (CVE-2019-5527, CVE-2019-5535) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0017.html ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (sudo), Debian (libsdl1.2 and libsdl2), Mageia (e2fsprogs, kernel, libpcap and tcpdump, nmap, and sudo), openSUSE (GraphicsMagick and sudo), Oracle (java-1.8.0-openjdk, java-11-openjdk, jss, and kernel), Red Hat (java-1.8.0-openjdk and java-11-openjdk), Scientific Linux (jss), SUSE (gcc7 and libreoffice), and Ubuntu (leading to a double-free, libsdl1.2, and tiff). --------------------------------------------- https://lwn.net/Articles/802537/ ∗∗∗ D-LINK Router: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.bsi-fuer-buerger.de/SharedDocs/Warnmeldungen/DE/TW/2019/10/warn… ∗∗∗ CyberArk Password Vault 10.6 Authentication Bypass ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2019100114 ∗∗∗ Booking and Availability Management Tools for Drupal - Moderately critical - Access Bypass - SA-CONTRIB-2019-074 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-074 ∗∗∗ Cisco Security Advisories ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/publicationListing.x ∗∗∗ Vim/Neovim vulnerability CVE-2019-12735 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K93144355?utm_source=f5support&utm_mediu… ∗∗∗ Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0924 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.10.2019
by Daily end-of-shift report 16 Oct '19

16 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 15-10-2019 18:00 − Mittwoch 16-10-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Docker Containers Riddled with Graboid Crypto-Worm ∗∗∗ --------------------------------------------- A worm with a randomized propagation method is spreading via the popular container technology. --------------------------------------------- https://threatpost.com/docker-containers-graboid-crypto-worm/149235/ ∗∗∗ Security Monitoring: At Network or Host Level?, (Wed, Oct 16th) ∗∗∗ --------------------------------------------- Today, to reach a decent security maturity, the keyword remains "visibility". There is nothing more frustrating than being blind about what's happening on a network or starting an investigation without any data (logs, events) to process. The question is: how to efficiently keep an eye on what's happening on your network? There are three key locations to collect data: [...] --------------------------------------------- https://isc.sans.edu/diary/rss/25420 ∗∗∗ Messing with Azorult Part 1: Malware Breakdown ∗∗∗ --------------------------------------------- In this blog series, we dive into an information stealing Trojan called Azorult that we analysed during a recent Digital Forensics and Incident Response (DFIR) investigation. During our analysis, we also take a look at the bot’s control panel and its vulnerability. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/messing-wit… ∗∗∗ Patchday bei Adobe: 64 Lücken im Reader ∗∗∗ --------------------------------------------- Außerdem gibt es auch Updates für den Experience Manager, Experience Manager Forms und den Adobe Download Manager. --------------------------------------------- https://heise.de/-4557403 ∗∗∗ Schadsoftware in vermeintlichen Banking-Apps aus unbekannter Quelle! ∗∗∗ --------------------------------------------- Immer wieder versenden Kriminelle massenhaft E-Mails im Design diverser Banken. Sie beziehen sich darin gehäuft auf die sogenannte PSD2-Richtlinie, die zu diversen Änderungen beim Online-Banking geführt hat und verlangen die Bestätigung persönlicher Daten oder die Installation einer App aus unbekannter Quelle. Nur so ließe sich die Sperre Ihres Kontos verhindern. Es dürfen keine Daten bekanntgegeben und die Apps nicht installiert werden. Es handelt sich um [...] --------------------------------------------- https://www.watchlist-internet.at/news/schadsoftware-in-vermeintlichen-bank… ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Patch Update: Oracle veröffentlicht 219 Sicherheitspatches ∗∗∗ --------------------------------------------- Es gibt abgesicherte Versionen von unter anderem Fusion Middleware und NoSQL Database, in denen Oracle kritische Sicherheitslücken geschlossen hat. --------------------------------------------- https://heise.de/-4557788 ∗∗∗ VMSA-2019-0016 ∗∗∗ --------------------------------------------- VMware Cloud Foundation and VMware Harbor Container Registry for PCF address broken access control vulnerability (CVE-2019-16919) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0016.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (apache2 and unbound), Fedora (opendmarc, runc, and sudo), openSUSE (epiphany, GraphicsMagick, and libopenmpt), Oracle (kernel and sudo), Red Hat (java-1.8.0-openjdk, jss, kernel, kernel-rt, and kpatch-patch), SUSE (crowbar-core, crowbar-openstack, grafana, novnc, openstack-keystone, openstack-neutron, openstack-neutron-lbaas, openstack-nova, openstack-tempest, python-pysaml2, python-urllib3, rubygem-chef, rubygem-easy_diff, sleshammer, libpcap, sudo, [...] --------------------------------------------- https://lwn.net/Articles/802451/ ∗∗∗ Linux kernel vulnerability CVE-2019-13233 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K13331647?utm_source=f5support&utm_mediu… ∗∗∗ HPESBHF03960 rev.1 - HPE Lights Out 100 (LO100) Remote Management for ProLiant G1 - G6 servers, Remote Denial of Service ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ Red Hat JBoss Enterprise Application Platform: Schwachstelle gefährdet Verfügbarkeit und Integrität ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0905 ∗∗∗ Red Hat Enterprise Linux: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0913 ∗∗∗ Publish SBA-ADV-20190913-04: WordPress Plugin - All in One SEO Pack -… ∗∗∗ --------------------------------------------- https://github.com/sbaresearch/advisories/commit/478f4828ddc618f6bdb9530640… ∗∗∗ Publish SBA-ADV-20190913-03: WordPress Plugin - Events Manager - Stor… ∗∗∗ --------------------------------------------- https://github.com/sbaresearch/advisories/commit/eb0047b9fb067ec171007b14df… ∗∗∗ Publish SBA-ADV-20190913-02: WordPress Plugin - Broken Link Checker -… ∗∗∗ --------------------------------------------- https://github.com/sbaresearch/advisories/commit/3e79665a02f0cd2e7666e7738e… ∗∗∗ Publish SBA-ADV-20190913-01: WordPress Plugin - EU Cookie Law (GDPR) … ∗∗∗ --------------------------------------------- https://github.com/sbaresearch/advisories/commit/51b3d30fc0d9e69a760203b32d… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.10.2019
by Daily end-of-shift report 15 Oct '19

15 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Montag 14-10-2019 18:00 − Dienstag 15-10-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Cyberangriffe: Attribution ist wie ein Indizienprozess ∗∗∗ --------------------------------------------- Russland hat den Bundestag gehackt! China wollte die Bayer AG ausspionieren! Bei großen Hackerangriffen ist oft der Fingerzeig auf den mutmaßlichen Täter nicht weit. Knallharte Beweise dafür gibt es selten, Hinweise sind aber kaum zu vermeiden. --------------------------------------------- https://www.golem.de/news/cyberangriffe-attribution-ist-wie-ein-indizienpro… ∗∗∗ Update now! Windows users targeted by iTunes Software Updater zero-day ∗∗∗ --------------------------------------------- The flaw is a rare ‘unquoted path class’ described as "so thoroughly documented that you would expect programmers to be well aware..." But thats not the case. --------------------------------------------- https://nakedsecurity.sophos.com/2019/10/15/update-now-windows-users-target… ∗∗∗ Top 10 Website Hardening Tips ∗∗∗ --------------------------------------------- Website hardening means adding layers of protection to reduce the risk of website attacks, a process known as “defense in depth.” Here are our top 10 virtual hardening principles: [...] --------------------------------------------- https://blog.sucuri.net/2019/10/top-10-website-hardening-tips.html ∗∗∗ Threat Actor Profile: TA407, the Silent Librarian ∗∗∗ --------------------------------------------- [...] Since our blog post, colleagues at Secureworks have provided further details on one actor we highlighted, tracked by Proofpoint as TA407, also known as Silent Librarian, Cobalt Dickens, and Mabna Institute. In this blog, we provide additional insight into the actor and their evolving TTPs in ongoing, academia-focused campaigns. --------------------------------------------- https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta40… ∗∗∗ Europol: Ransomware remains top threat in IOCTA report ∗∗∗ --------------------------------------------- The European Union Agency for Law Enforcement Cooperation, or Europol, just released its annual Internet Organized Crime Threat Assessment (IOCTA) report. We highlight their key findings and remind readers how to better protect themselves. --------------------------------------------- https://blog.malwarebytes.com/awareness/2019/10/europol-ransomware-remains-… ∗∗∗ Researchers Find New Backdoor Used by Winnti Hackers ∗∗∗ --------------------------------------------- ESET security researchers were able to identify a new backdoor associated with the threat actor known as the Winnti Group. --------------------------------------------- https://www.securityweek.com/researchers-find-new-backdoor-used-winnti-hack… ∗∗∗ SMS von „InfoSMS“ führt in Abo-Falle ∗∗∗ --------------------------------------------- Aktuell sind vermehrt betrügerische SMS vom Absender „InfoSMS“ im Umlauf. In der SMS heißt es, dass der Besitzer der Handynummer gesucht wird. Für nähere Informationen werden Sie aufgefordert, einem Link zu folgen. Sie landen dann auf einer gefälschten Media Markt Seite, wo ein angeblicher Gewinn auf Sie wartet. Sie werden Ihren Gewinn jedoch nie erhalten, es handelt sich um eine Abo-Falle. --------------------------------------------- https://www.watchlist-internet.at/news/sms-von-infosms-fuehrt-in-abo-falle/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security Bulletins Posted ∗∗∗ --------------------------------------------- Adobe has published security bulletins for Adobe Experience Manager (APSB19-48), Adobe Acrobat and Reader (APSB19-49), Adobe Experience Manager Forms (APSB19-50) and Adobe Download Manager (APSB19-51). Adobe recommends users update their product installations to the latest versions using the instructions referenced in the bulletin. This posting is provided “AS IS” with no warranties and confers no rights. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1795 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (sudo and xtrlock), openSUSE (sudo), Red Hat (Single Sign-On), Slackware (sudo), SUSE (binutils, dhcp, ffmpeg, kernel, kubernetes-salt, sudo, and tcpdump), and Ubuntu (sudo). --------------------------------------------- https://lwn.net/Articles/802328/ ∗∗∗ PHOENIX CONTACT Security Advisory for Automation Worx Software Suite ∗∗∗ --------------------------------------------- Phoenix Contact Automationworx Suite: *.bcp-file Memory Corruption Remote Code Execution Vulnerability and *.mwt-file Out-OfBounds Read Remote Code Execution Vulnerability --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2019-016 ∗∗∗ sudo: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0902 ∗∗∗ WordPress: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0903 ∗∗∗ IBM Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM Cloud Private ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by an Oracle MySQL vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-security-guardium… ∗∗∗ IBM Security Bulletin: IBM MQ Appliance is affected by kernel vulnerabilities (CVE-2019-11479, CVE-2019-11478 and CVE-2019-11477) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-mq-appliance-is-a… ∗∗∗ IBM Security Bulletin: IBM Security Guardium Big Data Intelligence is affected by a Using Components with Known Vulnerabilities vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-security-guardium… ∗∗∗ IBM Security Bulletin: Vulnerability CVE-2019-4031 affects IBM Workload Scheduler ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerability-cve-201… ∗∗∗ TYPO3-EXT-SA-2019-018: Remote Code Execution in extension "freeCap CAPTCHA" (sr_freecap) ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-ext-sa-2019-018/ ∗∗∗ TYPO3-EXT-SA-2019-017: Multiple vulnerabilities in extension "SLUB: Event Registration" (slub_events) ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-ext-sa-2019-017/ ∗∗∗ TYPO3-EXT-SA-2019-016: Information Disclosure in extension "Direct Mail" (direct_mail) ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-ext-sa-2019-016/ ∗∗∗ TYPO3-EXT-SA-2019-015: SQL Injection in extension "URL redirect" (url_redirect) ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-ext-sa-2019-015/ ∗∗∗ Linux kernel vulnerability CVE-2019-16714 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K48351130?utm_source=f5support&utm_mediu… ∗∗∗ OpenLDAP vulnerability CVE-2019-13565 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K98008862?utm_source=f5support&utm_mediu… ∗∗∗ HPESBHF03933 rev.6 - HPE Products using certain Intel Processors, Microarchitectural Data Sampling (MDS) Side Channel Vulnerabilities, Local Disclosure of Information ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.10.2019
by Daily end-of-shift report 14 Oct '19

14 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 11-10-2019 18:00 − Montag 14-10-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ The Week in Ransomware - October 11th 2019 - Decryptors Released! ∗∗∗ --------------------------------------------- We had some interesting news this week, such as the HildaCrypt ransomware releasing their keys, RobbinHood Ransomware bragging about their past exploits, a Muhstik Ransomware victim hacking back and stealing the decryption keys, and a Nemty decryptor being released. --------------------------------------------- https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-octob… ∗∗∗ Sodinokibi Ransomware: Following the Affiliate Money Trail ∗∗∗ --------------------------------------------- After a Sodinokibi ransomware affiliate posted partial transaction IDs for ransomware payments, researchers were able to use that information to follow the money trail for affiliates and in some cases, how they spend their illicit earnings. --------------------------------------------- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-follow… ∗∗∗ Simjacker: SIM-Karten in 29 Ländern anfällig für SMS-Angriff ∗∗∗ --------------------------------------------- Mit einer präparierten SMS können Daten aus dem Mobiltelefon ausgelesen werden. Die Sicherheitsfirma Adaptive Mobile hat den Simjacker genannten Angriff entdeckt und die betroffenen Staaten veröffentlicht. Demnach nutzte in drei Ländern eine Überwachungsfirma die Lücke aktiv aus. --------------------------------------------- https://www.golem.de/news/simjacker-sim-karten-in-29-laendern-anfaellig-fue… ∗∗∗ Pass the AppleJeus ∗∗∗ --------------------------------------------- A new macOS backdoor written by the infamous Lazarus APT group needs analyzing. Here, we examine its infection vector, method of persistence, capabilities, and more! --------------------------------------------- https://objective-see.com/blog/blog_0x49.html ∗∗∗ Another successful edition of the European Cyber Security Challenge concluded in Romania ∗∗∗ --------------------------------------------- The sixth edition of the European Cyber Security Challenge (ECSC), organised from 9 to 11 October in Bucharest at the Palace of the Parliament, the heaviest building and the second-largest building in the world, has concluded. Team Romania - followed by Italy and Austria - has proven successful in completing the most advanced and complex cybersecurity challenges and is thereby the proud winner of ECSC2019. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/another-successful-edition-of-t… ∗∗∗ Most SSL certificate misissuance caused by software bugs and rule misinterpretations ∗∗∗ --------------------------------------------- Academic study analyzed 379 incidents of incorrectly-issued SSL certificates from a total of 1,300+ known cases. --------------------------------------------- https://www.zdnet.com/article/most-ssl-certificate-misissuance-caused-by-so… ===================== = Vulnerabilities = ===================== ∗∗∗ Upcoming Security Updates for Adobe Acrobat and Reader (APSB19-49) ∗∗∗ --------------------------------------------- A prenotification security advisory (APSB19-49) has been posted regarding upcoming Adobe Acrobat and Reader updates scheduled for Tuesday, October 15, 2019. We will continue to provide updates on the upcoming release via the Security Bulletins and Advisories page as well as the Adobe PSIRT Blog. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1793 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (chromium, sdl, and unbound), Debian (clamav, libdatetime-timezone-perl, openssl, tcpdump, and tzdata), Fedora (cutter-re, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-parent, libapreq2, ming, opendmarc, radare2, and thunderbird), openSUSE (chromium), Oracle (kernel), and SUSE (axis, jakarta-commons-fileupload, kernel, sles12sp3-docker-image, sles12sp4-image, system-user-root, and webkit2gtk3). --------------------------------------------- https://lwn.net/Articles/802268/ ∗∗∗ Critical Flaw in Sophos Cyberoam Appliances Allows Remote Code Execution ∗∗∗ --------------------------------------------- A critical vulnerability patched recently by Sophos in its Cyberoam firewall appliances allows a remote, unauthenticated attacker to execute arbitrary commands with root privileges. --------------------------------------------- https://www.securityweek.com/critical-flaw-sophos-cyberoam-appliances-allow… ∗∗∗ Swift 5.1.1 for Ubuntu ∗∗∗ --------------------------------------------- https://support.apple.com/kb/HT210647 ∗∗∗ Reflected XSS vulnerability in OpenProject (CVE-2019-17092) ∗∗∗ --------------------------------------------- https://sec-consult.com/en/blog/advisories/reflected-xss-vulnerability-in-o… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.10.2019
by Daily end-of-shift report 11 Oct '19

11 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 10-10-2019 18:00 − Freitag 11-10-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Remote-Angriffe und Denial-of-Service: Schwachstellen in Juniper-Netzwerktechnik ∗∗∗ --------------------------------------------- Juniper-Geräte der Serien SRX, NFX, QFX, PTX, ACX, MX, und EX sowie das Betriebssystem JUNOS weisen Schwachstellen auf die umgehend gepatcht werden sollten. --------------------------------------------- https://heise.de/-4553168 ∗∗∗ Researchers released a free decryptor for the Nemty Ransomware ∗∗∗ --------------------------------------------- Good news for the victims of the Nemty Ransomware, security researchers have released a free decryptor that could be used to recover files. --------------------------------------------- https://securityaffairs.co/wordpress/92386/malware/nemty-ransomware-decrypt… ∗∗∗ Examining the Ryuk Ransomware ∗∗∗ --------------------------------------------- Ryuk ransomware had a disturbingly successful debut, being used to hit at least three organizations in its first two months of activity for more than $640,000 in ransom. Several attacks followed, where the attackers demanded even greater amounts of ransom. The attackers were able to demand and receive high ransoms because of a unique trait in the Ryuk code: the ability to identify and encrypt network drives and resources, as well as delete shadow copies on the endpoint. --------------------------------------------- https://www.zscaler.com/blogs/research/examining-ryuk-ransomware ∗∗∗ Staying Hidden on the Endpoint: Evading Detection with Shellcode ∗∗∗ --------------------------------------------- True red team assessments require a secondary objective of avoiding detection. Part of the glory of a successful red team assessment is not getting detected by anything or anyone on the system. As modern Endpoint Detection and Response (EDR) products have matured over the years, the red teams must follow suit. This blog post will provide some insights into how the FireEye Mandiant Red Team crafts payloads to bypass modern EDR products and get full command and control (C2) on their [...] --------------------------------------------- http://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-e… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (lucene-solr and ruby-openid), Fedora (krb5 and SDL2), openSUSE (kernel and libopenmpt), and Ubuntu (python2.7, python3.4). --------------------------------------------- https://lwn.net/Articles/802086/ ∗∗∗ IBM Security Bulletin: IBM FileNet Content Manager and Case Foundation security vulnerability in Process Orchestration Web Service logging ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-filenet-content-m… ∗∗∗ IBM Security Bulletin: IBM FileNet Content Manager and Case Foundation are affected by Publicly disclosed vulnerability in Java July 2019 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-filenet-content-m… ∗∗∗ Linux kernel vulnerability CVE-2017-18551 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K48073202?utm_source=f5support&utm_mediu… ∗∗∗ Apache Tomcat vulnerability CVE-2019-0221 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K13184144?utm_source=f5support&utm_mediu… ∗∗∗ ImageMagick vulnerability CVE-2019-13136 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K03512441?utm_source=f5support&utm_mediu… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.10.2019
by Daily end-of-shift report 10 Oct '19

10 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 09-10-2019 18:00 − Donnerstag 10-10-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ HP Touchpoint Analytics LPE Vulnerability Affects Most HP PCs ∗∗∗ --------------------------------------------- HP patched a vulnerability discovered in the HP Touchpoint Analytics software installed by default on most of its Windows laptops and desktops, a flaw allowing attackers to escalate privileges and execute arbitrary code using SYSTEM privileges. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hp-touchpoint-analytics-lpe-… ∗∗∗ Gamers Warned of High-Severity Intel, Nvidia Flaws ∗∗∗ --------------------------------------------- The Intel NUC and Nvidia Shield both are vulnerable to high-severity flaws, Intel and Nvidia warned in dual advisories. --------------------------------------------- https://threatpost.com/gamers-high-severity-intel-nvidia-flaws/149034/ ∗∗∗ Apple iTunes Bug Actively Exploited in BitPaymer/iEncrypt Campaign ∗∗∗ --------------------------------------------- Attackers exploit an “unquoted path” flaw in the Bonjour updater in iTunes for Windows to deliver ransomware attacks. --------------------------------------------- https://threatpost.com/apple-itunes-bug-bitpaymer-iencrypt/149075/ ∗∗∗ Mahalo FIN7: Responding to the Criminal Operators’ New Tools and Techniques ∗∗∗ --------------------------------------------- During several recent incident response engagements, FireEye Mandiant investigators uncovered new tools in FIN7’s malware arsenal and kept pace as the global criminal operators attempted new evasion techniques. In this blog, we reveal two of FIN7’s new tools that we have called BOOSTWRITE and RDFSNIFFER. --------------------------------------------- http://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-… ∗∗∗ Security Descriptor Auditing Methodology: Investigating Event Log Security ∗∗∗ --------------------------------------------- Upon gaining access to a system, what level of access is granted to an attacker who has yet to elevate their privileges? --------------------------------------------- https://posts.specterops.io/security-descriptor-auditing-methodology-invest… ===================== = Vulnerabilities = ===================== ∗∗∗ Juniper Networks Releases Security Updates ∗∗∗ --------------------------------------------- Juniper Networks has released security updates to address multiple vulnerabilities in various Juniper products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/10/10/juniper-networks-r… ∗∗∗ Sicherheitsupdates: Intel sichert NUC-PCs und Serverwartungstool ab ∗∗∗ --------------------------------------------- Angreifer könnten sich auf NUCs und auf Intel-Servern höhere Rechte aneignen. Eine Lücke bleibt jedoch ungepatcht. --------------------------------------------- https://heise.de/-4550829 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (clamav, libtomcrypt, and rsyslog), Fedora (suricata), SUSE (libopenmpt and python-requests), and Ubuntu (libsoup2.4 and octavia). --------------------------------------------- https://lwn.net/Articles/801974/ ∗∗∗ ZDI-19-866: NETGEAR AC1200 mini_httpd Poison Null Byte Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-19-866/ ∗∗∗ Maxlength - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-073 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-073 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ OpenSSL vulnerability CVE-2019-1563 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K97324400?utm_source=f5support&utm_mediu… ∗∗∗ OpenSSL vulnerability CVE-2019-1547 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K73422160?utm_source=f5support&utm_mediu… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily