Daily

daily@lists.cert.at

1 participants
3083 discussions

Tageszusammenfassung - 10.06.2024
by Daily end-of-shift report 10 Jun '24

10 Jun '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 07-06-2024 18:00 − Montag 10-06-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ How We Cover Your Back ∗∗∗ --------------------------------------------- As a national CERT, one of our extremely important tasks is to proactively inform network operators about potential or confirmed security issues that could affect Austrian companies. Initially, I intended to discuss the technical changes in our systems, but I believe its better to start by explaining what we actually do and how we help you sleep well at night — though you should never rely solely on us! --------------------------------------------- https://www.cert.at/en/blog/2024/6/how-we-cover-your-back ∗∗∗ Exploit for critical Veeam auth bypass available, patch now ∗∗∗ --------------------------------------------- A proof-of-concept (PoC) exploit for a Veeam Backup Enterprise Manager authentication bypass flaw tracked as CVE-2024-29849 is now publicly available, making it urgent that admins apply the latest security updates. --------------------------------------------- https://www.bleepingcomputer.com/news/security/exploit-for-critical-veeam-a… ∗∗∗ DDoS attacks target EU political parties as elections begin ∗∗∗ --------------------------------------------- Hacktivists are conducting DDoS attacks on European political parties that represent and promote strategies opposing their interests, according to a report by Cloudflare. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ddos-attacks-target-eu-polit… ∗∗∗ Malicious VSCode extensions with millions of installs discovered ∗∗∗ --------------------------------------------- A group of Israeli researchers explored the security of the Visual Studio Code marketplace and managed to "infect" over 100 organizations by trojanizing a copy of the popular 'Dracula Official theme to include risky code. Further research into the VSCode Marketplace found thousands of extensions with millions of installs. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malicious-vscode-extensions-… ∗∗∗ Bypassing 2FA with phishing and OTP bots ∗∗∗ --------------------------------------------- Explaining how scammers use phishing and OTP bots to gain access to accounts protected with 2FA. --------------------------------------------- https://securelist.com/2fa-phishing/112805/ ∗∗∗ Attacker Probing for New PHP Vulnerablity CVE-2024-4577, (Sun, Jun 9th) ∗∗∗ --------------------------------------------- Our honeypots have detected the first probes for CVE-2024-4577. [..] Watchtwr Labs says PHP is only vulnerable if used in CGI mode in Chinese and Japanese locales. According to Orange Tsai, other locales may be vulnerable as well. --------------------------------------------- https://isc.sans.edu/diary/rss/30994 ∗∗∗ LightSpy Spywares macOS Variant Found with Advanced Surveillance Capabilities ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed that the LightSpy spyware allegedly targeting Apple iOS users is in fact a previously undocumented macOS variant of the implant. [..] The attack chain begins with the exploitation of CVE-2018-4233, a Safari WebKit flaw, via rogue HTML pages to trigger code execution, leading to the delivery of a 64-bit Mach-O binary that masquerades as a PNG image file. --------------------------------------------- https://thehackernews.com/2024/06/lightspy-spywares-macos-variant-found.html ∗∗∗ Technical Analysis of the Latest Variant of ValleyRAT ∗∗∗ --------------------------------------------- ValleyRAT is a remote access trojan (RAT) that was initially documented in early 2023. Its main objective is to infiltrate and compromise systems, providing remote attackers with unauthorized access and control over infected machines. ValleyRAT is commonly distributed through phishing emails or malicious downloads. In the latest version, ValleyRAT introduced new commands, such as capturing screenshots, process filtering, forced shutdown, and clearing Windows event logs. --------------------------------------------- https://www.zscaler.com/blogs/security-research/technical-analysis-latest-v… ===================== = Vulnerabilities = ===================== ∗∗∗ Veeam Recovery Orchestrator Vulnerability (CVE-2024-29855) ∗∗∗ --------------------------------------------- A vulnerability (CVE-2024-29855) in Veeam Recovery Orchestrator (VRO) version 7.0.0.337 allows an attacker to access the VRO web UI with administrative privileges. Note: The attacker must know the exact username and role of an account that has an active VRO UI access token to accomplish the hijack --------------------------------------------- https://www.veeam.com/kb4585 ∗∗∗ Nvidia Patches High-Severity GPU Driver Vulnerabilities ∗∗∗ --------------------------------------------- The GPU driver updates, rolling out as versions R555, R550, R535, and R470, resolve a total of five security defects, three of which are rated ‘high severity’ and two rated ‘medium severity’, Nvidia’s advisory reveals. The most severe of these flaws, tracked as CVE‑2024‑0090, could allow attackers to execute arbitrary code, access or tamper with data, escalate privileges, or cause a denial-of-service (DoS) condition. --------------------------------------------- https://www.securityweek.com/nvidia-patches-high-severity-gpu-driver-vulner… ∗∗∗ Critical PyTorch Vulnerability Can Lead to Sensitive AI Data Theft ∗∗∗ --------------------------------------------- A critical vulnerability in the PyTorch distributed RPC framework could be exploited for remote code execution. Impacting the distributed RPC (Remote Procedure Call) framework of PyTorch and tracked as CVE-2024-5480, the issue exists because the framework does not verify the functions called during RPC operations. --------------------------------------------- https://www.securityweek.com/critical-pytorch-vulnerability-can-lead-to-sen… ∗∗∗ tenable: [R1] Security Center Version 6.4.0 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- A stored cross site scripting vulnerability exists in Tenable Security Center where an authenticated, remote attacker could inject HTML code into a web application scan result page. - CVE-2024-1891 An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required privileges. - CVE-2024-5759 --------------------------------------------- https://www.tenable.com/security/tns-2024-10 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (galera and mariadb10.11), Mageia (0-plugins-base and plasma-workspace), Oracle (ruby:3.1 and ruby:3.3), Red Hat (bind, bind-dyndb-ldap, and dhcp), SUSE (apache2, glib2, libvirt, openssl-1_1, openssl-3, opera, python-Jinja2, python-requests, and squid), and Ubuntu (linux, linux-gcp, linux-gcp-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-xilinx-zynqmp, linux, linux-gcp, linux-gcp-6.5, linux-lowlatency, linux-lowlatency-hwe-6.5, linux-raspi, linux, linux-ibm, linux-lowlatency, linux-raspi, linux-aws, linux-gcp, linux-azure, linux-azure-6.5, linux-starfive, linux-starfive-6.5, and linux-gke, linux-ibm, linux-intel-iotg, linux-oracle). --------------------------------------------- https://lwn.net/Articles/977789/ ∗∗∗ Vulnerability Summary for the Week of June 3, 2024 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/bulletins/sb24-162 ∗∗∗ Canon: CPE2024-003 – uniFLOW Online Device Registration Susceptible To Compromise – 10 June 2024 ∗∗∗ --------------------------------------------- https://www.canon-europe.com/support/product-security-latest-news/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.06.2024
by Daily end-of-shift report 07 Jun '24

07 Jun '24

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 06-06-2024 18:00 − Freitag 07-06-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Sicherheitslücke (CVE-2024-4577) für Remote-Code Ausführung in PHP-CGI / XAMPP entdeckt ∗∗∗ --------------------------------------------- In PHP-CGI wurde eine Sicherheitslücke (CVE-2024-4577) entdeckt, die es Angreifern ermöglicht, aus der Ferne und ohne Authentifizierung beliebigen Code auf betroffenen Servern auszuführen. Die Schwachstelle betrifft PHP-Installationen auf Windows-Systemen und erlaubt es Angreifern, durch spezifische Zeichenfolgen den Schutz einer früheren .. --------------------------------------------- https://www.cert.at/de/aktuelles/2024/6/sicherheitslucke-cve-2024-4577-fur-… ∗∗∗ New Fog ransomware targets US education sector via breached VPNs ∗∗∗ --------------------------------------------- A new ransomware operation named Fog launched in early May 2024, using compromised VPN credentials to breach the networks of educational organizations in the U.S. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-fog-ransomware-targets-u… ∗∗∗ Hackers exploit 2018 ThinkPHP flaws to install ‘Dama’ web shells ∗∗∗ --------------------------------------------- Chinese threat actors are targeting ThinkPHP applications vulnerable to CVE-2018-20062 and CVE-2019-9082 to install a persistent web shell named Dama. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-exploit-2018-thinkph… ∗∗∗ Ukraine says hackers abuse SyncThing tool to steal data ∗∗∗ --------------------------------------------- The Computer Emergency Response Team of Ukraine (CERT-UA) reports about a new campaign dubbed "SickSync," launched by the UAC-0020 (Vermin) hacking group in attacks on the Ukrainian .. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ukraine-says-hackers-abuse-s… ∗∗∗ In Bad Company: JScript RAT and CobaltStrike ∗∗∗ --------------------------------------------- Remote Access Trojans (RATs) that are based in JScript are gaining traction. We have looked at a recent example that emerged in mid-May. It turns out that this RAT has some companions on the way that we are familiar with. --------------------------------------------- https://feeds.feedblitz.com/~/899072462/0/gdatasecurityblog-en~In-Bad-Compa… ∗∗∗ Angriffswelle: Hacker löscht Github-Repos und fordert Lösegeld ∗∗∗ --------------------------------------------- Für die Kontaktaufnahme verweist der Angreifer auf Telegram. Er gibt sich als "Analyst für Cybervorfälle" aus und behauptet, ein Back-up erstellt zu haben. --------------------------------------------- https://www.golem.de/news/angriffswelle-hacker-loescht-github-repos-und-for… ∗∗∗ Commando Cat Cryptojacking Attacks Target Misconfigured Docker Instances ∗∗∗ --------------------------------------------- The threat actor known as Commando Cat has been linked to an ongoing cryptojacking attack campaign that leverages poorly secured Docker instances to deploy cryptocurrency miners for financial gain. --------------------------------------------- https://thehackernews.com/2024/06/commando-cat-cryptojacking-attacks.html ∗∗∗ POC exploit code published for 9.8-rated Apache HugeGraph RCE flaw ∗∗∗ --------------------------------------------- You upgraded when this was fixed in April, right? Right?? If you havent yet upgraded to version 1.3.0 of Apache HugeGraph, nows a good time because at least two proof-of-concept exploits for a CVSS 9.8-rated remote command execution bug .. --------------------------------------------- www.theregister.com/2024/06/07/poc_apache_hugegraph/ ∗∗∗ Ethical hacker releases tool to exploit Microsofts Recall AI, says its not rocket science ∗∗∗ --------------------------------------------- Recall AI hasnt launched yet but its already a target. --------------------------------------------- https://www.zdnet.com/article/ethical-hacker-says-his-windows-11-recall-ai-… ∗∗∗ Ransomware: Hacker greifen überwiegend außerhalb der Arbeitszeiten an ∗∗∗ --------------------------------------------- Der Anteil liegt bei rund 76 Prozent. Auch nehmen die Ransomware-Aktivitäten deutlich zu. --------------------------------------------- https://www.zdnet.de/88416372/ransomware-hacker-greifen-ueberwiegend-ausser… ∗∗∗ CERT-Bund warnt vor Schwachstelle WID-SEC-2024-131 in Microsoft Azure ∗∗∗ --------------------------------------------- Ein Leser hat mich auf eine Warnung vom 7. Juni 2024 des CERT-Bund (BSI) vor einer Schwachstelle in Microsoft Azure hingewiesen. Diese Schwachstelle wird vom BSI mit einem CVSS-Score von 10.0 eingestuft, da sie .. --------------------------------------------- https://www.borncity.com/blog/2024/06/07/cert-bund-warnt-vor-schwachstelle-… ∗∗∗ Howling at the Inbox: Sticky Werewolfs Latest Malicious Aviation Attacks ∗∗∗ --------------------------------------------- Morphisec Labs has been monitoring increased activity associated with Sticky Werewolf, a group suspected to have geopolitical and/or hacktivist ties. While the group’s geographical origin and home base remain unclear, recent attack techniques suggest espionage and data exfiltration intent. --------------------------------------------- https://blog.morphisec.com/sticky-werewolfs-aviation-attacks ∗∗∗ Jetzt patchen! Exploitcode für kritische Lücke in Apache HugeGraph in Umlauf ∗∗∗ --------------------------------------------- Admins sollten aus Sicherheitsgründen das Tool zum Erstellen von Diagrammen HugeGraph von Apache zügig auf den aktuellen Stand bringen. --------------------------------------------- https://heise.de/-9751687 ∗∗∗ Forschungsteam: Herzimplantat-Patienten müssen mehr über Cyberrisiken erfahren ∗∗∗ --------------------------------------------- Mit besseren technologischen Möglichkeiten steige auch das Risiko eines Cyberangriffs auf Herzimplantate, sagt ein Forschungsteam und fordert mehr Aufklärung. --------------------------------------------- https://heise.de/-9752245 ∗∗∗ Ausgeblockt: Antispam-Blockliste SORBS ist abgeschaltet ∗∗∗ --------------------------------------------- Mit der DNS-Blockliste wollte Gründerin Michelle Sullivan seit 2001 das Internet vor Spam bewahren. Die Gründe für die Schließung sind vage, Nachfolger unklar. --------------------------------------------- https://heise.de/-9752366 ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/977442/ ∗∗∗ MISP 2.4.193 released with many bugs fixed, API improvements and security fixes ∗∗∗ --------------------------------------------- https://github.com/MISP/MISP/releases/tag/v2.4.193 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.06.2024
by Daily end-of-shift report 06 Jun '24

06 Jun '24

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 05-06-2024 18:00 − Donnerstag 06-06-2024 18:00 Handler: Alexander Riepl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Qilin ransomware gang linked to attack on London hospitals ∗∗∗ --------------------------------------------- A ransomware attack that hit pathology services provider Synnovis on Monday and impacted several major NHS hospitals in London has now been linked to the Qilin ransomware operation. --------------------------------------------- https://www.bleepingcomputer.com/news/security/qilin-ransomware-gang-linked… ∗∗∗ Linux version of TargetCompany ransomware focuses on VMware ESXi ∗∗∗ --------------------------------------------- Researchers observed a new Linux variant of the TargetCompany ransomware family that targets VMware ESXi environments using a custom shell script to deliver and execute payloads. --------------------------------------------- https://www.bleepingcomputer.com/news/security/linux-version-of-targetcompa… ∗∗∗ Brute Force Attacks Against Watchguard VPN Endpoints, (Wed, Jun 5th) ∗∗∗ --------------------------------------------- If you have a pulse and work in information security (or are a new scraping script without a pulse), you have probably seen reports of attacks against VPN endpoints. Running any VPN without strong authentication has been negligent for years, but in recent times, ransomware gangs, in particular, picked them off pretty quickly. --------------------------------------------- https://isc.sans.edu/diary/rss/30984 ∗∗∗ Malicious Python Script with a "Best Before" Date, (Thu, Jun 6th) ∗∗∗ --------------------------------------------- The script purpose is classic: it will fetch a payload from a remote site, inject it in memory and start a new thread. Such payload are usually related to CobaltStike. --------------------------------------------- https://isc.sans.edu/diary/rss/30988 ∗∗∗ Hackers Target Python Developers with Fake "Crytic-Compilers" Package on PyPI ∗∗∗ --------------------------------------------- Cybersecurity researchers have discovered a malicious Python package uploaded to the Python Package Index (PyPI) repository thats designed to deliver an information stealer called Lumma (aka LummaC2). --------------------------------------------- https://thehackernews.com/2024/06/hackers-target-python-developers-with.html ∗∗∗ Prevent Account Takeover with Better Password Security ∗∗∗ --------------------------------------------- Tom works for a reputable financial institution. He has a long, complex password that would be near-impossible to guess. He’s memorized it by heart, so he started using it for his social media accounts and on his personal devices too. Unbeknownst to Tom, one of these sites has had its password database compromised by hackers and put it up for sale on the dark web. --------------------------------------------- https://thehackernews.com/2024/06/prevent-account-takeover-with-better.html ∗∗∗ 7-year-old Oracle WebLogic bug under active exploitation ∗∗∗ --------------------------------------------- Experts say Big Red will probably re-release patch in an upcoming cycle. --------------------------------------------- https://www.theregister.com/2024/06/06/oracle_weblogic_vulnerability_exploi… ∗∗∗ Exploitation of Recent Check Point VPN Zero-Day Soars ∗∗∗ --------------------------------------------- GreyNoise has observed a rapid increase in the number of exploitation attempts targeting a recent Check Point VPN zero-day. --------------------------------------------- https://www.securityweek.com/exploitation-of-recent-check-point-vpn-zero-da… ∗∗∗ Ransomware: FBI hat Zugriff auf 7000 LockBit-Schlüssel und macht Opfern Hoffnung ∗∗∗ --------------------------------------------- Der Kampf gegen Lockbit ist nach wie vor im Gange. Dank beschlagnahmter Schlüssel sollen nun weitere Opfer wieder auf ihre Daten zugreifen können. --------------------------------------------- https://heise.de/-9749844 ===================== = Vulnerabilities = ===================== ∗∗∗ 2024-06-04: Cyber Security Advisory -KNX Secure Devices FDSK Leak and replay attack ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108464A0803&Lan… ∗∗∗ Cisco Finesse Web-Based Management Interface Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Vulnerabilities Patched in Kiuwan Code Security Products After Long Disclosure Process ∗∗∗ --------------------------------------------- https://www.securityweek.com/vulnerabilities-patched-in-kiuwan-code-securit… ∗∗∗ Emerson Ovation ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02 ∗∗∗ Mitsubishi Electric CC-Link IE TSN Industrial Managed Switch ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-03 ∗∗∗ Emerson PACSystem and Fanuc ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-01 ∗∗∗ Johnson Controls Software House iStar Pro Door Controller ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-04 ∗∗∗ K000139901: PyYAML vulnerability CVE-2017-18342 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000139901 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.06.2024
by Daily end-of-shift report 05 Jun '24

05 Jun '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 04-06-2024 18:00 − Mittwoch 05-06-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ New V3B phishing kit targets customers of 54 European banks ∗∗∗ --------------------------------------------- Cybercriminals are promoting a new phishing kit named V3B on Telegram, which currently targets customers of 54 major financial institutes in Ireland, the Netherlands, Finland, Austria, Germany, France, Belgium, Greece, Luxembourg, and Italy. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-v3b-phishing-kit-targets… ∗∗∗ Cisco Webex: Tausende Videokonferenzen von Ministerien waren abhörbar ∗∗∗ --------------------------------------------- Eine Sicherheitslücke in Cisco Webex ermöglichte Angreifern das Abhören von Onlinemeetings. Jüngste Recherchen zeigen: Die Liste der Betroffenen ist lang. --------------------------------------------- https://www.golem.de/news/cisco-webex-tausende-videokonferenzen-von-ministe… ∗∗∗ Authentifizierung: Microsofts NTLM ist nun offiziell veraltet ∗∗∗ --------------------------------------------- Das Authentifizierungsprotokoll wird allerdings in vielen Apps und Arbeitsgruppen noch immer verwendet. Microsoft empfiehlt Kerberos. --------------------------------------------- https://www.golem.de/news/authentifizierung-microsofts-ntlm-ist-nun-offizie… ∗∗∗ Cross-Execute Your Linux Binaries, Don’t Cross-Compile Them ∗∗∗ --------------------------------------------- Lolbins? Where we’re going, we don’t need lolbins. --------------------------------------------- https://research.nccgroup.com/2024/06/05/cross-execute-your-linux-binaries-… ∗∗∗ Vorsicht vor E-Mail zu ausstehenden Schulden im Namen angeblicher Kunden ∗∗∗ --------------------------------------------- Kriminelle senden E-Mails an Unternehmen und geben sich als deren Kunden aus. Es wird nachgefragt, ob derzeit offene Forderungen bestehen. Ist dies der Fall, sollen die entsprechenden Rechnungen zugesandt werden. Antworten Sie nicht auf diese E-Mails. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-e-mail-zu-ausstehenden-… ∗∗∗ RansomHub: New Ransomware has Origins in Older Knight ∗∗∗ --------------------------------------------- Emergent operation has grown quickly to become one of the most prolific ransomware threats. --------------------------------------------- https://symantec-enterprise-blogs.security.com/threat-intelligence/ransomhu… ∗∗∗ Threat Actors’ Systems Can Also Be Exposed and Used by Other Threat Actors ∗∗∗ --------------------------------------------- Types of cyberattack include not only Advanced Persistent Threat (APT) attacks targeting a few specific companies or organizations but also scan attacks targeting multiple random servers connected to the Internet. This means that the infrastructures of threat actors can become the targets of cyberattack alongside companies, organizations, and personal users. --------------------------------------------- https://asec.ahnlab.com/en/66372/ ∗∗∗ DarkGate switches up its tactics with new payload, email templates ∗∗∗ --------------------------------------------- Cisco Talos is actively tracking a recent increase in activity from malicious email campaigns containing a suspicious Microsoft Excel attachment that, when opened, infected the victims system with the DarkGate malware. --------------------------------------------- https://blog.talosintelligence.com/darkgate-remote-template-injection/ ∗∗∗ Muhstik Malware Targets Message Queuing Services Applications ∗∗∗ --------------------------------------------- Aqua Nautilus discovered a new campaign of Muhstik malware targeting message queuing services applications, specifically the Apache RocketMQ platform. --------------------------------------------- https://blog.aquasec.com/muhstik-malware-targets-message-queuing-services-a… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (deepin-qt5integration, deepin-qt5platform-plugins, dotnet8.0, dwayland, fcitx-qt5, fcitx5-qt, gammaray, kddockwidgets, keepassxc, kf5-akonadi-server, kf5-frameworkintegration, kf5-kwayland, plasma-integration, python-qt5, qadwaitadecorations, qgnomeplatform, qt5, qt5-qt3d, qt5-qtbase, qt5-qtcharts, qt5-qtconnectivity, qt5-qtdatavis3d, qt5-qtdeclarative, qt5-qtdoc, qt5-qtgamepad, qt5-qtgraphicaleffects, qt5-qtimageformats, qt5-qtlocation, [...] --------------------------------------------- https://lwn.net/Articles/977233/ ∗∗∗ TikTok: Zero-Day-Lücke ermöglichte Übernahme von Promi- und Marken-Accounts ∗∗∗ --------------------------------------------- Wegen einer Zero-Day-Lücke ließen sich auf TikTok Accounts über eine Direktnachricht übernehmen. --------------------------------------------- https://heise.de/-9748177 ∗∗∗ Patchday: Attacken auf Geräte mit Android 12, 13 und 14 möglich ∗∗∗ --------------------------------------------- Wichtige Sicherheitsupdates schließen mehrere Schwachstellen in verschiedenen Android-Versionen. --------------------------------------------- https://heise.de/-9748243 ∗∗∗ 40,000 WordPress Sites affected by Vulnerability That Leads to Privilege Escalation in Login/Signup Popup WordPress Plugin ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2024/06/40000-wordpress-sites-affected-by-vu… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.06.2024
by Daily end-of-shift report 04 Jun '24

04 Jun '24

===================== = End-of-Day report = ===================== Timeframe: Montag 03-06-2024 18:00 − Dienstag 04-06-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Vorsicht vor betrügerischen Seiten zu Digitaler Euro und Bundesschatz! ∗∗∗ --------------------------------------------- Der Watchlist Internet werden aktuell massenhaft E-Mails gemeldet, die im Namen von der Österreichischen Nationalbank ein Pilotprogramm zum digitalen Euro ankündigen. Dabei wird mit „einmaligen Renditechancen“ geworben und durch den Hinweis auf die Kooperation von bundesschatz.at und der Europäischen Zentralbank Seriosität und Vertrauenswürdigkeit vorgetäuscht. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-betruegerischen-seiten-… ∗∗∗ Azure Service Tags tagged as security risk, Microsoft disagrees ∗∗∗ --------------------------------------------- Security researchers at Tenable discovered what they describe as a high-severity vulnerability in Azure Service Tags that could allow attackers to access customers private data. [..] Tenable's Liv Matan explained that threat actors can use the vulnerability to craft malicious SSRF-like web requests to impersonate trusted Azure services and bypass firewall rules based on Azure Service Tags, often used to secure Azure services and sensitive data without authentication checks. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/azure-service-tags-tagged-a… ∗∗∗ PoC for Progress Telerik RCE chain released (CVE-2024-4358, CVE-2024-1800) ∗∗∗ --------------------------------------------- Security researchers have published a proof-of-concept (PoC) exploit that chains together two vulnerabilities (CVE-2024-4358, CVE-2024-1800) to achieve unauthenticated remote code execution on Progress Telerik Report Servers. Telerik Report Server is a centralized enterprise platform for report creation, management, storage and delivery/distribution. [..] It was reported by an anonymous researcher and fixed earlier this year by Progress Software. --------------------------------------------- https://www.helpnetsecurity.com/2024/06/04/cve-2024-4358-cve-2024-1800-poc/ ∗∗∗ Details of Atlassian Confluence RCE Vulnerability Disclosed ∗∗∗ --------------------------------------------- Successful exploitation of the bug, however, requires that the attacker has the privileges required for adding new macro languages, and to upload a malicious language file using the ‘Add a new language’ function in the ‘Configure Code Macro’ section. According to Atlassian, which rolled out patches for the vulnerability a couple of weeks ago, the issue was introduced in Confluence version 5.2. --------------------------------------------- https://www.securityweek.com/details-of-atlassian-confluence-rce-vulnerabil… ∗∗∗ Aktuelle Phishingwelle bei Hetzner (Juni 2024) ∗∗∗ --------------------------------------------- Behauptet wird, dass die Domain nicht mehr zugreifbar sei, weil es ein Problem mit einem Zahlungsversuch gegeben habe. Ziel ist es, die Zahlungsinformationen des Opfers abzugreifen. Wer bei Hetzner hostet, könnte möglicherweise darauf hereinfallen. --------------------------------------------- https://www.borncity.com/blog/2024/06/04/aktuelle-phishingwelle-bei-hetzner… ∗∗∗ 122 Gigabyte persönliche Nutzerdaten über Telegram-Messenger geleakt ∗∗∗ --------------------------------------------- Sicherheitsforscher haben ein großes Archiv mit persönlichen Daten aus Telegram-Kanälen zusammengetragen. Darunter sind neben E-Mail-Adressen auch Passwörter. [..] Einem Bericht zufolge wurde das Archiv dem Betreiber des Onlineservices Have I Been Pwned (HIBP) zugespielt. Der Service sammelt aus Cyberattacken geleakte Daten. Dort kann man anonymisiert etwa durch die Eingabe der eigenen E-Mail-Adresse prüfen, ob man in einem Datenleak auftaucht. --------------------------------------------- https://heise.de/-9746825 ===================== = Vulnerabilities = ===================== ∗∗∗ IT-Management-Plattform SolarWinds über mehrere Wege angreifbar ∗∗∗ --------------------------------------------- Wie aus einer Mitteilung zur aktuellen abgesicherten Version 2024.2 hervorgeht, haben die Entwickler in der Managementplattform direkt drei Lücken (CVE-2024-28996 "hoch", CVE-2024-28999 "mittel", CVE-2024-29004 "hoch") geschlossen. Darunter können Angreifer unter anderem für eine persistente XSS-Attacke ansetzen. In diesem Fall können sie beim Aufruf der Webkonsole eigenen Code ausführen. Dafür benötigt ein Angreifer aber bereits im Vorfeld hohe Nutzerrechte und zudem muss ein Opfer mitspielen. --------------------------------------------- https://heise.de/-9747340 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Mageia (chromium-browser-stable, git, libreoffice, microcode, python-requests, webkit2, and wireshark), Oracle (container-tools:ol8, glibc, go-toolset:ol8, idm:DL1 and idm:client, less, python39:3.9 and python39-devel:3.9, ruby:3.0, and virt:ol and virt-devel:rhel), Red Hat (nodejs, nodejs:18, python-idna, and ruby:3.1), and SUSE (389-ds, ffmpeg, ffmpeg-4, gnutls, gstreamer-plugins-base, libhtp, mariadb104, poppler, python-python-jose, squid, and unbound). --------------------------------------------- https://lwn.net/Articles/976977/ ∗∗∗ Zyxel security advisory for multiple vulnerabilities in NAS products ∗∗∗ --------------------------------------------- Due to the critical severity of vulnerabilities CVE-2024-29972, CVE-2024-29973, and CVE-2024-29974, Zyxel has made patches available to customers with extended support as outlined in the table below, despite the products already having reached end-of-vulnerability-support*. --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… ∗∗∗ CODESYS: Vulnerability can cause a DoS on CODESYS OPC UA products ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-026/ ∗∗∗ CODESYS: Vulnerability in multiple products through exposure of resource to wrong sphere ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-027/ ∗∗∗ Uniview NVR301-04S2-P4 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-156-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.06.2024
by Daily end-of-shift report 03 Jun '24

03 Jun '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 31-05-2024 18:00 − Montag 03-06-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Sicherheitsbehörde warnt: Schwachstelle im Linux-Kernel wird aktiv ausgenutzt ∗∗∗ --------------------------------------------- Die US-amerikanische Cybersicherheitsbehörde Cisa hat kürzlich eine Warnung vor der aktiven Ausnutzung einer Schwachstelle im Linux-Kernel herausgegeben. Die Sicherheitslücke ist als CVE-2024-1086 registriert und ermöglicht es Angreifern mit lokalem Zugriff auf ein anfälliges System, ihre Rechte auszuweiten und dadurch einen Root-Zugriff zu erlangen. --------------------------------------------- https://www.golem.de/news/sicherheitsbehoerde-warnt-schwachstelle-im-linux-… ∗∗∗ Researcher Uncovers Flaws in Cox Modems, Potentially Impacting Millions ∗∗∗ --------------------------------------------- Now-patched authorization bypass issues impacting Cox modems that could have been abused as a starting point to gain unauthorized access to the devices and run malicious commands. --------------------------------------------- https://thehackernews.com/2024/06/researcher-uncovers-flaws-in-cox-modems.h… ∗∗∗ PoC Published for Exploited Check Point VPN Vulnerability ∗∗∗ --------------------------------------------- PoC code targeting a recent Check Point VPN zero-day has been released as Censys identifies 14,000 internet-accessible appliances. --------------------------------------------- https://www.securityweek.com/poc-published-for-exploited-check-point-vpn-vu… ∗∗∗ Resilience isnt enough, NATO must be proactive for cyberdefense, warns official ∗∗∗ --------------------------------------------- NATO allies need to allow their militaries to be proactive in cyberspace to ensure the alliance isn't affected by a cyberattack that could disrupt the deployment of forces if a conflict was to occur, Christian-Marc Lifländer, the head of NATO's cyber and hybrid policy section, warned on Friday. --------------------------------------------- https://therecord.media/nato-resilience-cyberdefense-liflander-cycon ∗∗∗ CISA Adds One Known Exploited Vulnerability to Catalog ∗∗∗ --------------------------------------------- CVE-2017-3506 Oracle WebLogic Server OS Command Injection Vulnerability --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/06/03/cisa-adds-one-known-expl… ∗∗∗ Hacks bei Santander und Ticketmaster über Snowflake-Konten ∗∗∗ --------------------------------------------- Die Woche wurden Hacks der Santander Bank und des Anbieters von Tickets, Ticketmaster, bekannt. Bei beiden Hacks wurden Benutzerdaten im großen Umfang erbeutet, die nun in Untergrundforen verkauft werden. Brisant wird die Geschichte, weil diese Hacks wohl über kompromittierte Benutzerkonten beim Cloud-Anbieter Snowflake möglich werden. --------------------------------------------- https://www.borncity.com/blog/2024/06/01/hacks-bei-santander-und-ticketmast… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (python39:3.9 and python39-devel:3.9 and ruby:3.0), Debian (chromium, gst-plugins-base1.0, and kernel), Fedora (chromium, glances, glycin-loaders, gnome-tour, helix, helvum, kitty, libarchive, libipuz, librsvg2, loupe, maturin, ntpd-rs, plasma-workspace, and a huge list of Rust-based packages due to a ""mini-mass-rebuild"" that updated the toolchain to Rust 1.78 and picked up fixes for various pieces), Mageia (gifsicle, netatalk, openssl, python-jinja2, and unbound), Red Hat (kernel and kernel-rt), SUSE (bind, glibc, gstreamer-plugins-base, squid, and tiff), and Ubuntu (glibc). --------------------------------------------- https://lwn.net/Articles/976782/ ∗∗∗ Sicherheitsupdate: Schadcode-Attacken auf Autodesk AutoCAD möglich ∗∗∗ --------------------------------------------- Die CAD-Softwares Advance Steel, Civil 3D und AutoCAD von Autodesk sind verwundbar. Das Sicherheitsrisiko gilt als hoch. [..] In allen Fällen müssen Angreifer Opfern präparierte Dateien (etwa X_B oder CARPTODUCT) unterschieben. --------------------------------------------- https://heise.de/-9745419 ∗∗∗ 2024-06-03: Cyber Security Advisory - ABB WebPro SNMP card PowerValue Cross-Site Scripting (XSS) vulnerability ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=2CMT006108&Language… ∗∗∗ ifm: moneo password reset can be exploited ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-028/ ∗∗∗ Vulnerability Summary for the Week of May 27, 2024 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/bulletins/sb24-155 ∗∗∗ Baxter Welch Allyn Connex Spot Monitor ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-151-02 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 31.05.2024
by Daily end-of-shift report 31 May '24

31 May '24

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 29-05-2024 18:00 − Freitag 31-05-2024 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Operation Endgame: Großer Schlag gegen weltweite Cyberkriminalität ∗∗∗ --------------------------------------------- Die "Operation Endgame" richtete sich hauptsächlich gegen die Gruppierungen hinter den Botnetzen der sechs Schadsoftware-Familien IcedID, SystemBC, Bumblebee, Smokeloader, Pikabot und Trickbot. [..] Zehn internationale Haftbefehle wurden erlassen, vier Personen vorläufig festgenommen. [..] An der Aktion waren demnach unter der Leitung des BKA Strafverfolger aus den Niederlanden, Frankreich, Dänemark, Großbritannien, Österreich sowie den USA beteiligt. --------------------------------------------- https://heise.de/-9741012 ∗∗∗ Cybercriminals pose as "helpful" Stack Overflow users to push malware ∗∗∗ --------------------------------------------- Cybercriminals are abusing Stack Overflow in an interesting approach to spreading malware—answering users questions by promoting a malicious PyPi package that installs Windows information-stealing malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cybercriminals-pose-as-helpf… ∗∗∗ Over 600,000 SOHO routers were destroyed by Chalubo malware in 72 hours ∗∗∗ --------------------------------------------- The Chalubo trojan destroyed over 600,000 SOHO routers from a single ISP, researchers from Lumen Technologies reported. [..] Black Lotus did not name the impacted ISP, however, Bleeping Computer speculates the attack is linked to the Windstream outage that occurred during the same timeframe. --------------------------------------------- https://securityaffairs.com/163939/malware/chalubo-destroyed-600000-soho-ro… ∗∗∗ Researchers Uncover Active Exploitation of WordPress Plugin Vulnerabilities ∗∗∗ --------------------------------------------- Cybersecurity researchers have warned that multiple high-severity security vulnerabilities in WordPress plugins are being actively exploited by threat actors to create rogue administrator accounts for follow-on exploitation. --------------------------------------------- https://thehackernews.com/2024/05/researchers-uncover-active-exploitation.h… ∗∗∗ Microsoft Warns of Surge in Cyber Attacks Targeting Internet-Exposed OT Devices ∗∗∗ --------------------------------------------- Microsoft has emphasized the need for securing internet-exposed operational technology (OT) devices following a spate of cyber attacks targeting such environments since late 2023. "These repeated attacks against OT devices emphasize the crucial need to improve the security posture of OT devices and prevent critical systems from becoming easy targets," the Microsoft Threat Intelligence team said. --------------------------------------------- https://thehackernews.com/2024/05/microsoft-warns-of-surge-in-cyber.html ∗∗∗ CVE-2024-30043: Abusing URL Parsing Confusion to Exploit XXE on SharePoint Server and Cloud ∗∗∗ --------------------------------------------- Yes, the title is right. This blog covers an XML eXternal Entity (XXE) injection vulnerability that I found in SharePoint. The bug was recently patched by Microsoft. In general, XXE vulnerabilities are not very exciting in terms of discovery and related technical aspects. They may sometimes be fun to exploit and exfiltrate data (or do other nasty things) in real environments, but in the vulnerability research world, you typically find them, report them, and forget about them. So why am I writing a blog post about an XXE? --------------------------------------------- https://www.thezdi.com/blog/2024/5/29/cve-2024-30043-abusing-url-parsing-co… ∗∗∗ LilacSquid: The stealthy trilogy of PurpleInk, InkBox and InkLoader ∗∗∗ --------------------------------------------- Cisco Talos is disclosing a new suspected data theft campaign, active since at least 2021, we attribute to an advanced persistent threat actor (APT) we’re calling “LilacSquid.” Multiple TTPs utilized in this campaign bear some overlap with North Korean APT groups. --------------------------------------------- https://blog.talosintelligence.com/lilacsquid/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (.NET 7.0, .NET 8.0, 389-ds:1.4, ansible-core bug fix, enhancement, and, bind and dhcp, container-tools:rhel8, edk2, exempi, fence-agents, freeglut, frr, gdk-pixbuf2, ghostscript, git-lfs, glibc, gmp, go-toolset:rhel8, grafana, grub2, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, harfbuzz, httpd:2.4, Image builder components bug fix, enhancement and, kernel, kernel-rt, krb5, less, LibRaw, libsndfile, libssh, libXpm, linux-firmware, motif, mutt, nghttp2, openssh, pam, pcp, pcs, perl-Convert-ASN1, perl-CPAN, perl:5.32, pki-core:10.6 and pki-deps:10.6, pmix, poppler, python-dns, python-jinja2, python-pillow, python27:2.7, python3, python3.11, python3.11-cryptography, python3.11-urllib3, python39:3.9 and python39-devel:3.9, qt5-qtbase, resource-agents, squashfs-tools, sssd, systemd, tigervnc, traceroute, vorbis-tools, webkit2gtk3, xorg-x11-server, xorg-x11-server-Xwayland, and zziplib), Debian (gst-plugins-base1.0), Fedora (cacti, cacti-spine, roundcubemail, and wireshark), Oracle (.NET 7.0, .NET 8.0, bind and dhcp, gdk-pixbuf2, git-lfs, glibc, grafana, krb5, pcp, python-dns, python3, sssd, tigervnc, xorg-x11-server, and xorg-x11-server-Xwayland), Red Hat (edk2, less, nghttp2, and ruby:3.0), SUSE (gstreamer-plugins-base, Java, kernel, and python-requests), and Ubuntu (ffmpeg, node-browserify-sign, postgresql-14, postgresql-15, postgresql-16, and python-pymysql). --------------------------------------------- https://lwn.net/Articles/976209/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (python-pymysql), Fedora (chromium, mingw-python-requests, and thunderbird), Mageia (perl-Email-MIME and qtnetworkauth5 & qtnetworkauth6), Red Hat (gdisk and python39:3.9 and python39-devel:3.9 modules), SUSE (freerdp, gdk-pixbuf, gifsicle, glib2, java-1_8_0-ibm, kernel, libfastjson, libredwg, nodejs16, python, python3, python36, rpm, warewulf4, and xdg-desktop-portal), and Ubuntu (gst-plugins-base1.0, python-werkzeug, and tpm2-tss). --------------------------------------------- https://lwn.net/Articles/976006/ ∗∗∗ IT-Monitoring: Checkmk schließt Lücke, die Änderung von Dateien ermöglicht ∗∗∗ --------------------------------------------- Eine Sicherheitslücke in der Monitoring-Software Checkmk ermöglicht Angreifern, unbefugt lokale Dateien auf dem Checkmk-Server zu lesen und zu schreiben. --------------------------------------------- https://heise.de/-9741274 ∗∗∗ Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2024-022 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.05.2024
by Daily end-of-shift report 29 May '24

29 May '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 28-05-2024 18:00 − Mittwoch 29-05-2024 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Okta warns of credential stuffing attacks targeting its CORS feature ∗∗∗ --------------------------------------------- Okta warns that a Customer Identity Cloud (CIC) feature is being targeted in credential stuffing attacks, stating that numerous customers have been targeted since April. --------------------------------------------- https://www.bleepingcomputer.com/news/security/okta-warns-of-credential-stu… ∗∗∗ Per Passwortmanager generiert: 20-stelliges Passwort einer Kryptowallet geknackt ∗∗∗ --------------------------------------------- Auf der Wallet befanden sich 43,6 Bitcoins, die heute rund 2,8 Millionen Euro wert sind. Der Besitzer hatte den Zugriff verloren. Zwei Experten konnten ihm helfen. --------------------------------------------- https://www.golem.de/news/per-passwortmanager-generiert-20-stelliges-passwo… ∗∗∗ BreachForums Returns Just Weeks After FBI Seizure - Honeypot or Blunder? ∗∗∗ --------------------------------------------- The online criminal bazaar BreachForums has been resurrected merely two weeks after a U.S.-led coordinated law enforcement action dismantled and seized control of its infrastructure. [..] However, the possibility that it may be a honeypot has not been lost among members of the cybersecurity community. --------------------------------------------- https://thehackernews.com/2024/05/breachforums-returns-just-weeks-after.html ∗∗∗ EU Is Tightening Cybersecurity for Energy Providers ∗∗∗ --------------------------------------------- On March 11th, 2024, the European Commission adopted new cybersecurity rules—the EU network code on cybersecurity for the electricity sector (C/2024/1383)—to “establish a recurrent process of cybersecurity risk assessments in the electricity sector.” If you’re a cybersecurity professional, this news is cause for celebration; if you’re an electricity provider, maybe not so much. --------------------------------------------- https://www.tripwire.com/state-of-security/eu-tightening-cybersecurity-ener… ∗∗∗ Stromspargerät „SmartEnergy“ ist Betrug! ∗∗∗ --------------------------------------------- Aktuell bewerben Kriminelle massenhaft ein Gerät namens „SmartEnergy“. Damit sollen Sie Ihren Stromverbrauch um bis zu 90 Prozent reduzieren können. Wir garantieren Ihnen: Hier sparen Sie nicht 90% Strom, sondern verschwenden zu 100% Geld! --------------------------------------------- https://www.watchlist-internet.at/news/stromspargeraet-smartenergy-betrug/ ===================== = Vulnerabilities = ===================== ∗∗∗ Check Point releases emergency fix for VPN zero-day exploited in attacks ∗∗∗ --------------------------------------------- Check Point has released hotfixes for a VPN zero-day vulnerability exploited in attacks to gain remote access to firewalls and attempt to breach corporate networks. [..] Tracked as CVE-2024-24919, the high-severity information disclosure vulnerability enables attackers to read certain information on internet-exposed Check Point Security Gateways with remote Access VPN or Mobile Access Software Blades enabled. --------------------------------------------- https://www.bleepingcomputer.com/news/security/check-point-releases-emergen… ∗∗∗ Advisory: Active exploitation of Check Point Remote Access VPN vulnerability (CVE-2024-24919) ∗∗∗ --------------------------------------------- mnemonic has several observations of the exploit being used in the wild. [..] We have observed threat actors extracting ntds.dit from compromised customers within 2-3 hours after logging in with a local user. [..] The vulnerability allows a threat actor to enumerate and extract password hashes for all local accounts, including the account used to connect to Active Directory. The full extent of the consequences is still unknown. The following IOCs have been observed in customer environments between April 30, 2024, and today (May 29, 2024) ... --------------------------------------------- https://www.mnemonic.io/resources/blog/advisory-check-point-remote-access-v… ∗∗∗ Vulnerabilities in Eclipse ThreadX Could Lead to Code Execution ∗∗∗ --------------------------------------------- Vulnerabilities in the real-time IoT operating system Eclipse ThreadX before version 6.4 could lead to denial-of-service and code execution.The post Vulnerabilities in Eclipse ThreadX Could Lead to Code Execution appeared first on SecurityWeek. --------------------------------------------- https://www.securityweek.com/vulnerabilities-in-eclipse-threadx-could-lead-… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (glibc and tomcat), Fedora (chromium, fcitx5-qt, python-pyqt6, qadwaitadecorations, qgnomeplatform, qt6, qt6-qt3d, qt6-qt5compat, qt6-qtbase, qt6-qtcharts, qt6-qtcoap, qt6-qtconnectivity, qt6-qtdatavis3d, qt6-qtdeclarative, qt6-qtgraphs, qt6-qtgrpc, qt6-qthttpserver, qt6-qtimageformats, qt6-qtlanguageserver, qt6-qtlocation, qt6-qtlottie, qt6-qtmqtt, qt6-qtmultimedia, qt6-qtnetworkauth, qt6-qtopcua, qt6-qtpositioning, qt6-qtquick3d, qt6-qtquick3dphysics, qt6-qtquicktimeline, qt6-qtremoteobjects, qt6-qtscxml, qt6-qtsensors, qt6-qtserialbus, qt6-qtserialport, qt6-qtshadertools, qt6-qtspeech, qt6-qtsvg, qt6-qttools, qt6-qttranslations, qt6-qtvirtualkeyboard, qt6-qtwayland, qt6-qtwebchannel, qt6-qtwebengine, qt6-qtwebsockets, qt6-qtwebview, and zeal), Red Hat (glibc, kernel, kernel-rt, kpatch-patch, linux-firmware, mod_http2, pcp, pcs, protobuf, python3, rpm-ostree, and rust), SUSE (git, glibc-livepatches, kernel, libxml2, openssl-1_1, SUSE Manager Client Tools, SUSE Manager Client Tools, salt, and xdg-desktop-portal), and Ubuntu (amavisd-new, firefox, flask-security, frr, git, intel-microcode, jinja2, libreoffice, linux-intel-iotg, unbound, and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/975737/ ∗∗∗ WordPress Vulnerability & Patch Roundup May 2024 ∗∗∗ --------------------------------------------- https://blog.sucuri.net/2024/05/wordpress-vulnerability-patch-roundup-may-2… ∗∗∗ ZDI-24-516: Progress Software WhatsUp Gold HttpContentActiveController Server-Side Request Forgery Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-516/ ∗∗∗ Vulnerability Summary for the Week of May 20, 2024 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/bulletins/sb24-149 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.05.2024
by Daily end-of-shift report 28 May '24

28 May '24

===================== = End-of-Day report = ===================== Timeframe: Montag 27-05-2024 18:00 − Dienstag 28-05-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Trusted relationship attacks: trust, but verify ∗∗∗ --------------------------------------------- We analyze the tactics and techniques of attackers targeting organizations through trusted relationships – that is, through contractors and external IT service providers. --------------------------------------------- https://securelist.com/trusted-relationship-attack/112731/ ∗∗∗ Threat landscape for industrial automation systems, Q1 2024 ∗∗∗ --------------------------------------------- The full global and regional reports have been published on the Kaspersky ICS CERT website. --------------------------------------------- https://securelist.com/industrial-threat-landscape-q1-2024/112683/ ∗∗∗ Kriminelle geben sich als Europäische Verbraucherzentren aus ∗∗∗ --------------------------------------------- Sie haben auf einer betrügerischen Investmentplattform Geld verloren? Ihre persönliche Beratung war nicht mehr erreichbar oder Ihr Konto wurde plötzlich gesperrt? Vorsicht, wenn Sie von Institutionen wie den Europäischen Verbraucherzentren kontaktiert werden, die Ihnen versprechen, Ihr Geld zurückzuholen. Es handelt sich erneut um eine Betrugsmasche! --------------------------------------------- https://www.watchlist-internet.at/news/kriminelle-geben-sich-als-europaeisc… ∗∗∗ Ivanti EPM Cloud Services Appliance - Taking advantage of a backdoor to detect a vulnerability ∗∗∗ --------------------------------------------- This blog post details how `CVE-2021-44529` was researched as well as the current method being used to detect it. --------------------------------------------- https://www.bitsight.com/blog/ivanti-epm-cloud-services-appliance-taking-ad… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (less), Mageia (chromium-browser-stable), SUSE (apache2, java-1_8_0-openj9, kernel, libqt5-qtnetworkauth, and openssl-3), and Ubuntu (netatalk and python-cryptography). --------------------------------------------- https://lwn.net/Articles/975529/ ∗∗∗ Kritische Sicherheitslücke gewährt Angreifern Zugriff auf TP-Link-Router C5400X ∗∗∗ --------------------------------------------- Der TP-Link-WLAN-Router C5400X ist verwundbar. Ein Sicherheitspatch schließt eine kritische Schwachstelle. --------------------------------------------- https://heise.de/-9736602 ∗∗∗ WordPress Plugin Exploited to Steal Credit Card Data from E-commerce Sites ∗∗∗ --------------------------------------------- https://thehackernews.com/2024/05/wordpress-plugin-exploited-to-steal.html ∗∗∗ Citrix Workspace app for Mac Security Bulletin for CVE-2024-5027 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX675851/citrix-workspace-app-for-mac-s… ∗∗∗ Campbell Scientific CSI Web Server ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-149-01 ∗∗∗ TI Bluetooth stack can fail to generate a resolvable Random Private Address (RPA) leading to DoS for already bonded peer devices ∗∗∗ --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-466062.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.05.2024
by Daily end-of-shift report 27 May '24

27 May '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 24-05-2024 18:00 − Montag 27-05-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Google-Security-Manager: Phishing-Tests bringen nichts und nerven Mitarbeiter ∗∗∗ --------------------------------------------- Mitarbeiter fühlten sich durch Phishing-Simulationen oftmals hintergangen, erklärt ein Security-Experte. Dadurch werde das Vertrauen in die Sicherheitsteams untergraben. --------------------------------------------- https://www.golem.de/news/google-security-manager-phishing-tests-bringen-ni… ∗∗∗ Speichersicherheit: Fast 20 Prozent aller Rust-Pakete sind potenziell unsicher ∗∗∗ --------------------------------------------- Nach Angaben der Rust Foundation verwendet etwa jedes fünfte Rust-Paket das Unsafe-Keyword. Meistens werden dadurch Code oder Bibliotheken von Drittanbietern aufgerufen. --------------------------------------------- https://www.golem.de/news/speichersicherheit-fast-20-prozent-aller-rust-pak… ∗∗∗ Kommentar: Schluss mit falschen Pentests! ∗∗∗ --------------------------------------------- Wir wollen einen Pentest machen. So begannen für einige Zeit viele meiner Kundengespräche – manchmal mit der Variation "müssen" statt "wollen". Doch warum pentesten wir überhaupt? --------------------------------------------- https://heise.de/-9718811 ∗∗∗ Checkpoint: Important Security Update – Enhance your VPN Security Posture! ∗∗∗ --------------------------------------------- Over the past few months, we have observed increased interest of malicious groups in leveraging remote-access VPN environments as an entry point and attack vector into enterprises. [..] By May 24, 2024 we identified a small number of login attempts using old VPN local-accounts relying on unrecommended password-only authentication method. [..] Password-only authentication is considered an unfavourable method to ensure the highest levels of security, and we recommend not to rely on this when logging-in to network infrastructure. Check Point has released a solution, as a preventative measure to address these unauthorised remote access attempts. --------------------------------------------- https://blog.checkpoint.com/security/enhance-your-vpn-security-posture/ ∗∗∗ Hackers phish finance orgs using trojanized Minesweeper clone ∗∗∗ --------------------------------------------- Hackers are utilizing code from a Python clone of Microsoft's venerable Minesweeper game to hide malicious scripts in attacks on European and US financial organizations. Ukraine's CSIRT-NBU and CERT-UA attribute the attacks to a threat actor tracked as 'UAC-0188,' who is using the legitimate code to hide Python scripts that download and install the SuperOps RMM. Superops RMM is a legitimate remote management software that gives remote actors direct access to the compromised systems. [..] The attack begins with an email sent from the address "support(a)patient-docs-mail.com," impersonating a medical center with the subject "Personal Web Archive of Medical Documents. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-phish-finance-orgs-u… ∗∗∗ Message board scams ∗∗∗ --------------------------------------------- Here’s how scams target buyers and sellers on online message boards, and how the gangs behind them operate. [..] The gang under study also operates in Canada, Austria, France, and Norway. --------------------------------------------- https://securelist.com/message-board-scam/112691/ ∗∗∗ New Tricks in the Phishing Playbook: Cloudflare Workers, HTML Smuggling, GenAI ∗∗∗ --------------------------------------------- Cybersecurity researchers are alerting of phishing campaigns that abuse Cloudflare Workers to serve phishing sites that are used to harvest users credentials associated with Microsoft, Gmail, Yahoo!, and cPanel Webmail. --------------------------------------------- https://thehackernews.com/2024/05/new-tricks-in-phishing-playbook.html ∗∗∗ Technical Analysis of Anatsa Campaigns: An Android Banking Malware Active in the Google Play Store ∗∗∗ --------------------------------------------- At Zscaler ThreatLabz, we regularly monitor the Google Play store for malicious applications. [..] These malware-infected applications have collectively garnered over 5.5 million installs. [..] In this blog, we provide a technical analysis of Anatsa attack campaigns that leveraged themes like PDF readers and QR code readers to distribute malware in the Google Play store. --------------------------------------------- https://www.zscaler.com/blogs/security-research/technical-analysis-anatsa-c… ∗∗∗ Linguistic Lumberjack: Understanding CVE-2024-4323 in Fluent Bit ∗∗∗ --------------------------------------------- This vulnerability was discovered by the Tenable research team who described in their blog, that the flaw is due to improper validation of input names in requests, which can be exploited to cause memory corruption. This can result in denial-of-service attacks or information exposure, with remote code execution being possible under certain conditions. [..] This proof-of-concept script demonstrates how a denial of service is used CVE-2024-4323 is a memory corruption vulnerability in Fluent Bit versions 2.0.7 through 3.0.3. --------------------------------------------- https://blog.aquasec.com/linguistic-lumberjack-understanding-cve-2024-4323-… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (apache2, bluez, chromium, fossil, libreoffice, python-pymysql, redmine, and ruby-rack), Fedora (buildah, crosswords, dotnet7.0, glycin-loaders, gnome-tour, helix, helvum, libipuz, loupe, maturin, mingw-libxml2, ntpd-rs, perl-Email-MIME, and a huge list of Rust-based packages due to a ""mini-mass-rebuild"" that updated the toolchain to Rust 1.78 and picked up fixes for various pieces), Mageia (chromium-browser-stable, mariadb, and roundcubemail), Oracle (kernel, libreoffice, nodejs, and tomcat), and SUSE (cJSON, libfastjson, opera, postgresql15, python3, and qt6-networkauth). --------------------------------------------- https://lwn.net/Articles/975399/ ∗∗∗ Multiple vulnerabilities in HAWKI ∗∗∗ --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities… ∗∗∗ Synology-SA-24:07 Synology Camera ∗∗∗ --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_24_07 ∗∗∗ F5: K000139764: Apache HTTPD vulnerability CVE-2023-38709 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000139764 ∗∗∗ F5: K000139525: Libexpat vulnerability CVE-2022-43680 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000139525 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily