Daily

daily@lists.cert.at

1 participants
3154 discussions

Tageszusammenfassung - 08.06.2018
by Daily end-of-shift report 08 Jun '18

08 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 07-06-2018 18:00 − Freitag 08-06-2018 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Gitea: Account von Github-Alternative kurzzeitig übernommen ∗∗∗ --------------------------------------------- Das Projekt Gitea erstellt eine leichtgewichtige Open-Source-Alternative zu Github. Ein Bot-Account des Projekts auf Github ist nun offenbar kurzzeitig übernommen worden, um Cryptominer zu verbreiten. Quellcode und Infrastruktur sollen nicht betroffen sein. --------------------------------------------- https://www.golem.de/news/gitea-account-von-github-alternative-kurzzeitig-u… ∗∗∗ Adobe: Flash-Exploit wird über Office-Dokumente verteilt ∗∗∗ --------------------------------------------- Flash-Exploits werden mittlerweile immer häufiger über Office-Dokumente verteilt, weil Browser die Inhalte kaum noch anzeigen. In einem aktuellen Fall werden Nutzer im arabischen Raum angegriffen. --------------------------------------------- https://www.golem.de/news/adobe-flash-exploit-wird-ueber-office-dokumente-v… ∗∗∗ Combo aus drei Sicherheitslücken bricht IP-Kameras von Foscam ∗∗∗ --------------------------------------------- Es gibt wichtige Sicherheitsupdates für verschiedene IP-Kameras von Foscam. --------------------------------------------- http://heise.de/-4074308 ===================== = Vulnerabilities = ===================== ∗∗∗ Rockwell Automation RSLinx Classic and FactoryTalk Linx Gateway ∗∗∗ --------------------------------------------- This advisory contains mitigation recommendations for an unquoted search path or element vulnerability in the Rockwell Automation RSLinix Classic software platform. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-158-01 ∗∗∗ Update: "Zero-Day" Sicherheitslücke in Adobe Flash Player - aktiv ausgenützt - Patches verfügbar ∗∗∗ --------------------------------------------- Update: "Zero-Day" Sicherheitslücke in Adobe Flash Player - aktiv ausgenützt - Patches verfügbar 7. Juni 2018 Update: 8. Juni 2018 Beschreibung Adobe hat bekanntgegeben, dass es aktuell eine kritische Sicherheitslücke in Adobe Flash Player gibt, die auch bereits aktiv ausgenützt wird. CVE-Nummer: CVE-2018-5002 Update: 8. Juni 2018 CVE-Nummern: CVE-2018-4945, CVE-2018-5000, CVE-2018-5001, CVE-2018-5002 Adobe hat ein entsprechendes Update [...] --------------------------------------------- http://www.cert.at/warnings/all/20180607.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (radare2), Debian (jruby), Fedora (elfutils and wireless-tools), openSUSE (glibc, mariadb, and xdg-utils), Oracle (kernel), Red Hat (chromium-browser and java-1.7.1-ibm), SUSE (ceph, icu, kernel-firmware, memcached, and xen), and Ubuntu (unbound). --------------------------------------------- https://lwn.net/Articles/756950/ ∗∗∗ Security vulnerabilities fixed in Firefox 60.0.2, ESR 60.0.2, and ESR 52.8.1 ∗∗∗ --------------------------------------------- critical - CVE-2018-6126: Heap buffer overflow rasterizing paths in SVG with Skia --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2018-14/ ∗∗∗ Synology-SA-17:79 SRM ∗∗∗ --------------------------------------------- This vulnerability allows remote authenticated users to execute arbitrary code via a susceptible version of Synology Router Manager --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_17_79 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.06.2018
by Daily end-of-shift report 07 Jun '18

07 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 06-06-2018 18:00 − Donnerstag 07-06-2018 18:00 Handler: Olaf Schwarz Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Prowli Malware Targeting Servers, Routers, and IoT Devices ∗∗∗ --------------------------------------------- After the discovery of massive VPNFilter malware botnet, security researchers have now uncovered another giant botnet that has already compromised more than 40,000 servers, modems and internet-connected devices belonging to a wide number of organizations across the world. Dubbed Operation Prowli, the campaign has been spreading malware and injecting malicious code ... --------------------------------------------- https://thehackernews.com/2018/06/prowli-malware-botnet.html ∗∗∗ Crappy IoT on the high seas: Holes punched in hull of maritime security ∗∗∗ --------------------------------------------- Researchers: We can nudge ships off course Infosec Europe Years-old security issues mostly stamped out in enterprise technology remain in maritime environments, leaving ships vulnerable to hacking, tracking, and worse. --------------------------------------------- https://www.theregister.co.uk/2018/06/06/infosec_europe_maritime_security/ ∗∗∗ Cyber Europe 2018 – Get prepared for the next cyber crisis ∗∗∗ --------------------------------------------- EU Cybersecurity Agency ENISA organised an international cybersecurity exercise --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/cyber-europe-2018-get-prepared-… ∗∗∗ Retefe check ∗∗∗ --------------------------------------------- Check if your computer is infected with the Retefe banking trojan. --------------------------------------------- http://retefe-check.ch/ ∗∗∗ A Totally Tubular Treatise on TRITON and TriStation ∗∗∗ --------------------------------------------- Introduction In December 2017, FireEyes Mandiant discussed an incident response involving the TRITON framework. The TRITON attack and many of the publicly discussed ICS intrusions involved routine techniques where the threat actors used only what is necessary to succeed in their mission. For both INDUSTROYER and TRITON, the attackers moved from the IT network to the OT (operational technology) network through systems that were accessible to both environments. --------------------------------------------- http://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatis… ∗∗∗ Sicherheitsupdates: Kritische Lücken in Cisco IOS und Prime ∗∗∗ --------------------------------------------- In verschiedenen Netzwerkgeräten und -Software von Cisco klaffen teils kritische Lücken. Betroffene Admins sollten die verfügbaren Patches zügig installieren. --------------------------------------------- http://heise.de/-4072861 ===================== = Vulnerabilities = ===================== ∗∗∗ "Zero-Day" Sicherheitslücke in Adobe Flash Player - aktiv ausgenützt - Patches verfügbar ∗∗∗ --------------------------------------------- "Zero-Day" Sicherheitslücke in Adobe Flash Player - aktiv ausgenützt - Patches verfügbar 7. Juni 2018 Beschreibung Adobe hat bekanntgegeben, dass es aktuell eine kritische Sicherheitslücke in Adobe Flash Player gibt, die auch bereits aktiv ausgenützt wird. CVE-Nummer: CVE-2018-5002 Adobe hat ein entsprechendes Update veröffentlicht, die Details befinden sich unter https://helpx.adobe.com/security/products/flash-player/apsb18-19.html. --------------------------------------------- http://www.cert.at/warnings/all/20180607.html ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (memcached), Fedora (java-1.8.0-openjdk-aarch32, sqlite, and xen), Mageia (corosync, gimp, qtpass, and SDL_image), openSUSE (zziplib), Slackware (mozilla), SUSE (git and libvorbis), and Ubuntu (liblouis). --------------------------------------------- https://lwn.net/Articles/756853/ ∗∗∗ IBM Security Bulletin: Multiple vulnerabilites in IBM Java Runtime affect IBM Spectrum Protect Snapshot (formerly Tivoli Storage FlashCopy Manager) for VMware (CVE-2018-2579, CVE-2018-2602, CVE-2018-2603, CVE-2018-2633, CVE-2018-2783) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22016041 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect (formerly Tivoli Storage Manager) for Virtual Environments: Data Protection for Hyper-V ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22016028 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities have been fixed in IBM Security Identity Manager ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22013617 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect (formerly Tivoli Storage Manager) for Virtual Environments: Data Protection for Hyper-V ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015304 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.06.2018
by Daily end-of-shift report 06 Jun '18

06 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 05-06-2018 18:00 − Mittwoch 06-06-2018 18:00 Handler: Olaf Schwarz Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Sofacy Group’s Parallel Attacks ∗∗∗ --------------------------------------------- Unit 42’s continued look at the Sofacy Group’s activity reveals the persistent targeting of government, diplomatic and other strategic organizations across North America and Europe.The post Sofacy Group’s Parallel Attacks appeared first on Palo Alto Networks Blog. --------------------------------------------- https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-pa… ∗∗∗ Converting PCAP Web Traffic to Apache Log ∗∗∗ --------------------------------------------- PCAP data can be really useful when you must investigate an incident but when the amount of PCAP files to analyse is counted in gigabytes, it may quickly become tricky to handle. Often, the first protocol to be analysed is HTTP because it remains a classic infection or communication vector used by malware. What if you could analyze HTTP connections like an Apache access log? This kind of log can be easily indexed/processed by many tools. --------------------------------------------- https://isc.sans.edu/diary/rss/23739 ∗∗∗ Researchers warn widespread Google Group misconfigurations are exposing sensitive data ∗∗∗ --------------------------------------------- A survey of 2.5 million domains looked for configurations publicly exposed, found 9,637 exposed organizations, then used a random sample of 171 public organizations to determine nearly 3,000 domains were leaking sensitive data. --------------------------------------------- https://www.scmagazine.com/researchers-find-widespread-google-group-misconf… ∗∗∗ VPNFilter Update - VPNFilter exploits endpoints, targets new devices ∗∗∗ --------------------------------------------- Cisco Talos, while working with our various intelligence partners, has discovered additional details regarding "VPNFilter." In the days since we first published our findings on the campaign, we have seen that VPNFilter is targeting more makes/models of devices than initially thought, and has additional capabilities, including the ability to deliver exploits to endpoints. --------------------------------------------- https://blog.talosintelligence.com/2018/06/vpnfilter-update.html ∗∗∗ Schwachstelle Zip Slip: Beim Entpacken ist Schadcode inklusive ∗∗∗ --------------------------------------------- Viele Coding-Bibliotheken sind beim Entpacken von Archiven angreifbar. Ist eine Attacke erfolgreich, könnte Schadcode auf Computer gelangen. --------------------------------------------- http://heise.de/-4070792 ∗∗∗ Warnung vor anenberg.store ∗∗∗ --------------------------------------------- Auf anenberg.store finden Konsument/innen Grafikkarten und Krypto-Miner. Wir raten von einem Einkauf bei dem Anbieter ab, denn er zeigt Auffälligkeiten. Internet-Nutzer/innen warnen vor einer Bestellung, die Preise sind teilweise sehr niedrig und die Bezahlung der Ware ist nur im Voraus möglich. --------------------------------------------- https://www.watchlist-internet.at/news/warnung-vor-anenbergstore/ ∗∗∗ Markenfälscher-Alarm auf backpacks.at! ∗∗∗ --------------------------------------------- Auf backpacks.at finden KonsumentInnen Schuhe und Taschen von Marken wie Michael Kors, Tamaris, Buffalo oder Ralph Lauren. Die Preise sind extrem niedrig und sollen zu einem schnellen Kauf verlocken. Die .at-Domain lässt zwar ein österreichisches Unternehmen vermuten, doch eigentlich wird der Shop aus Asien betrieben, gelieferte Ware entspricht nicht der Bestellten und ein Widerruf ist aussichtslos. --------------------------------------------- https://www.watchlist-internet.at/news/markenfaelscher-alarm-auf-backpacksa… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (git), Fedora (php-symfony, php-symfony4, and thunderbird-enigmail), Mageia (glpi and libreoffice), openSUSE (dpdk-thunderxdpdk, git, and ocaml), SUSE (glibc, libvorbis, and zziplib), and Ubuntu (elfutils, git, and procps). --------------------------------------------- https://lwn.net/Articles/756761/ ∗∗∗ Philips IntelliVue Patient and Avalon Fetal Monitors ∗∗∗ --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSMA-18-156-01 ∗∗∗ ABB IP Gateway ∗∗∗ --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-156-01 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MQ Internet Pass Thru ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22016280 ∗∗∗ IBM Security Bulletin: A vulnerability in IBM Java Runtime affects IBM Tivoli Storage Manager FastBack (CVE-2018-2602) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22016679 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilites in IBM Java Runtime affect IBM Spectrum Protect (Tivoli Storage Manager) Windows and Macintosh Client (CVE-2018-2603, CVE-2018-2633) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22016042 ∗∗∗ IBM Security Bulletin: Apache Commons FileUpload vulnerability affects IBM Spectrum Protect Plus (CVE-2016-1000031) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22016826 ∗∗∗ IBM Security Bulletin: IBM MQ Appliance is affected by an OpenSSL vulnerability ( CVE-2017-3736) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22016116 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.06.2018
by Daily end-of-shift report 05 Jun '18

05 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Montag 04-06-2018 18:00 − Dienstag 05-06-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Over 115,000 Drupal Sites Still Vulnerable to Drupalgeddon2 Exploit ∗∗∗ --------------------------------------------- Hundreds of thousands of websites running on the Drupal CMS—including those of major educational institutions and government organizations around the world—have been found vulnerable to a highly critical flaw for which security .. --------------------------------------------- https://thehackernews.com/2018/06/drupalgeddon2-exploit.html ∗∗∗ IoT Botnets Found Using Default Credentials for C&C Server Databases ∗∗∗ --------------------------------------------- Not following cybersecurity best practices could not only cost online users but also cost cybercriminals. Yes, sometimes hackers dont take best security measures to keep their infrastructure safe. A variant of IoT botnet, called Owari, that relies on default or weak credentials to hack insecure IoT devices was found itself using default credentials in its MySQL server integrated with command --------------------------------------------- https://thehackernews.com/2018/06/iot-botnet-password.html ∗∗∗ In eigener Sache: CERT.at sucht Verstärkung ∗∗∗ --------------------------------------------- Für unsere täglichen Routineaufgaben suchen wir derzeit 1 Berufsein- oder -umsteiger/in mit ausgeprägtem Interesse an IT-Security, welche/r uns bei den täglich anfallenden Standard-Aufgaben unterstützt. Details finden sich auf unserer Jobs-Seite. https://cert.at/about/jobs/jobs.html --------------------------------------------- https://www.cert.at/services/blog/20180605165955-2249.html ∗∗∗ Sicherheitsupdates: Mehrere AV-Anwendungen von F-Secure sind löchrig ∗∗∗ --------------------------------------------- In verschiedenen Endpoint-Protection-Produkten von F-Secure für Windows klaffen kritische Sicherheitslücken. --------------------------------------------- http://heise.de/-4068340 ∗∗∗ Vulnerability Spotlight: TALOS-2018-0535 - Ocularis Recorder VMS_VA Denial of Service Vulnerability ∗∗∗ --------------------------------------------- Vulnerabilities discovered by Carlos Pacho from TalosOverviewTalos is disclosing a denial-of-service vulnerability in the Ocularis Recorder. Ocularis is a video management software (VMS) platform used in a variety of .. --------------------------------------------- https://blog.talosintelligence.com/2018/06/vulnerability-spotlight-talos-20… ∗∗∗ Hacking, tracking, stealing and sinking ships ∗∗∗ --------------------------------------------- At Infosecurity Europe this year, we demonstrated multiple methods to interrupt the shipping industry, several of which haven’t been demonstrated in public before, to our knowledge. Some of these issues were simply through .. --------------------------------------------- https://www.pentestpartners.com/security-blog/hacking-tracking-stealing-and… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms ARP Request Handling Denial of Service Vulnerability ∗∗∗ --------------------------------------------- A vulnerability exists in Cisco Access Point (AP) platforms when processing Address Resolution Protocol (ARP) packets that could allow an unauthenticated, adjacent attacker to inject crafted entries into the ARP .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… ∗∗∗ FortiSwitch rest_admin account exposed under specific conditions ∗∗∗ --------------------------------------------- During an upgrade to version 3.4.1, a FortiSwitch device may let an attackerlog in the rest_admin account without a password, if all the conditions beloware met: * The FortiSwitch device .. --------------------------------------------- http://fortiguard.com/advisory/FG-IR-16-011 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.06.2018
by Daily end-of-shift report 04 Jun '18

04 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 01-06-2018 18:00 − Montag 04-06-2018 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Mobile Devs Making the Same Security Mistakes Web Devs Made in the Early 2000s ∗∗∗ --------------------------------------------- Mobile app developers are going through the same growing pains that the webdev scene has gone through in the 90s and 2000s when improper input validation led to many security incidents. --------------------------------------------- https://www.bleepingcomputer.com/news/security/mobile-devs-making-the-same-… ∗∗∗ SMiShing with Punycode ∗∗∗ --------------------------------------------- Cybercriminals keep coming up with new ways to steal and profit from personal user data. Because mobile devices are so prevalent, and so capable, they are becoming the targets of a variety of cyberattacks that were previously limited to computers. One such attack technique is SMS phishing—SMiShing—in which attacks are delivered via text messages. --------------------------------------------- https://www.zscaler.com/blogs/research/smishing-punycode ∗∗∗ Scammers Targeting Booking.com Users with Phishing Messages ∗∗∗ --------------------------------------------- Scammers recently targeted Booking.com customers with phishing messages designed to steal their sensitive financial information. According to The Sun, criminals sent out WhatsApp messages and text messages to customers claiming that a security breach had occurred and that recipients needed to change their passwords. The attack correspondence came with a link that, when clicked, gave [...] --------------------------------------------- https://www.tripwire.com/state-of-security/security-data-protection/cyber-s… ∗∗∗ Warnung vor SEPA-Lastschriftbetrug bei Unternehmen ∗∗∗ --------------------------------------------- Unternehmen, die ihre Bankdaten öffentlich haben, werden Opfer eines Betrugs, bei dem Kriminelle ihre Bankverbindung für Verbrechen nutzen. Die Täter/innen greifen auf das SEPA-Lastschriftverfahren zurück und täuschen einen Einzugsermächtigung oder einen Abbuchungsauftrag vor. In anderen Fällen nennen sie bei betrügerischen Einkäufen die Bankdaten des Unternehmens. Es droht ein hoher Geldverlust. --------------------------------------------- https://www.watchlist-internet.at/news/warnung-vor-sepa-lastschriftbetrug-b… ∗∗∗ Zahlen - Visa-Kreditkarten aufgrund Hardware-Fehlers unbenutzbar ∗∗∗ --------------------------------------------- Der Betrieb laufe nun wieder wie normal – es gebe keinen Hinweis auf einen kriminellen Angriff --------------------------------------------- https://derstandard.at/2000080869035/Visa-Kreditkarten-aufgrund-Hardware-Fe… ===================== = Vulnerabilities = ===================== ∗∗∗ Apple Security Updates, (Sun, Jun 3rd) ∗∗∗ --------------------------------------------- Summary (MacOS, iOS, tvOS, watchOS) --------------------------------------------- https://isc.sans.edu/diary/rss/23727 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (procps, xmlrpc, and xmlrpc3), Debian (batik, prosody, redmine, wireshark, and zookeeper), Fedora (jasper, kernel, poppler, and xmlrpc), Mageia (git and wireshark), Red Hat (rh-java-common-xmlrpc), Slackware (git), SUSE (bzr, dpdk-thunderxdpdk, and ocaml), and Ubuntu (exempi). --------------------------------------------- https://lwn.net/Articles/756489/ ∗∗∗ Jenkins-Plugins: Mehrere Schwachstellen ermöglichen u.a. das Ausführen beliebigen Programmcodes ∗∗∗ --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-1064/ ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security AppScan Enterprise ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22016709 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.06.2018
by Daily end-of-shift report 01 Jun '18

01 Jun '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 30-05-2018 18:00 − Freitag 01-06-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ May 2018 mobile malware review from Doctor Web ∗∗∗ --------------------------------------------- May 31, 2018 In May 2018 Doctor Web specialists found several Google Play applications containing the Trojan Android.Click.248.origin. It loaded fraudulent websites on which users subscribed to expensive mobile services. Also .. --------------------------------------------- https://news.drweb.com/show/?i=12618&lng=en&c=9 ∗∗∗ Shell Logins as a Magento Reinfection Vector ∗∗∗ --------------------------------------------- Recently, we have come across a number of websites that were facing reinfection of a credit card information stealer malware within the following files: app/Mage.php; lib/Varien/Autoload.php; index.php; app/code/core/Mage/Core/functions.php; These are .. --------------------------------------------- https://blog.sucuri.net/2018/05/shell-logins-as-a-magento-reinfection-vecto… ∗∗∗ Rig Exploit Kit Now Using CVE-2018-8174 to Deliver Monero Miner ∗∗∗ --------------------------------------------- An exploit kit such as Rig usually starts off with a threat actor compromising a website to inject a malicious script/code that eventually redirects would-be victims to the exploit kit’s landing page. Sometime around .. --------------------------------------------- https://blog.trendmicro.com/trendlabs-security-intelligence/rig-exploit-kit… ∗∗∗ Expired domain led to SpamCannibals blacklist eating the whole world ∗∗∗ --------------------------------------------- The domain of the little-used SpamCannibal DNS blacklist had expired, resulting in it .. --------------------------------------------- https://www.virusbulletin.com:443/blog/2018/05/expired-domain-led-spamcanni… ∗∗∗ Sicherheitslücke gefährdete zehn Jahre lang Millionen Steam-Client-Nutzer ∗∗∗ --------------------------------------------- Der Steam-Client war verwundbar und Angreifer hätten mit vergleichsweise wenig Aufwand Schadcode auf Computer schmuggeln können. --------------------------------------------- http://heise.de/-4061777 ∗∗∗ Browser - WebAuthn: Bei Chrome kann man sich vielerorts nun ohne Passwort anmelden ∗∗∗ --------------------------------------------- Fingerabdruckscanner oder spezielle USB-Sticks können stattdessen verwendet werden --------------------------------------------- https://derstandard.at/2000080745632/WebAuthn-Bei-Chrome-kann-man-sich-viel… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco TelePresence TX9000 Series Cross-Frame Scripting Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the web UI of Cisco TelePresence TX9000 Series Software could allow an unauthenticated, remote attacker to conduct a cross-frame scripting (XFS) attack against a user of the web UI of the .. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Synology-SA-18:30 SSL VPN Client ∗∗∗ --------------------------------------------- A vulnerability allows remote attackers to conduct man-in-the-middle attacks via a susceptible version of SSL VPN Client. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_18_30 ∗∗∗ HPESBUX03818 rev.1 - HP-UX Secure Shell, Multiple Remote Vulnerabilities ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.05.2018
by Daily end-of-shift report 30 May '18

30 May '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 29-05-2018 18:00 − Mittwoch 30-05-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Ultraschallangriffe bringen Festplatten zum Absturz ∗∗∗ --------------------------------------------- Sicherheitsforscher haben mit Schall- und Ultraschallattacken Videoüberwachungssyteme, aber auch PCs und Laptops außer Gefecht gesetzt. --------------------------------------------- https://futurezone.at/science/ultraschallangriffe-bringen-festplatten-zum-a… ∗∗∗ Yahoo-Hack: Kanadier zu fünf Jahren Gefängnis verurteilt ∗∗∗ --------------------------------------------- Für den russischen Geheimdienst beschaffte ein Hacker den Zugang zu 80 Webmail-Konten durch Eindringen in das Yahoo-System. Jetzt muss er ins Gefängnis. --------------------------------------------- http://heise.de/-4060708 ∗∗∗ Roboter Pepper kämpft mit massiven Sicherheitsproblemen ∗∗∗ --------------------------------------------- Die "feindliche" Übernahme von einem Roboter ist ein Horrorszenario. Beim Service-Roboter Pepper ist das möglich, wie Wissenschaftler herausgefunden haben. --------------------------------------------- http://heise.de/-4060743 ∗∗∗ Will the Real Joker’s Stash Come Forward? ∗∗∗ --------------------------------------------- For as long as scam artists have been around so too have opportunistic thieves who specialize in ripping off other scam artists. This is the story about a group of Pakistani Web site designers who apparently have made an impressive living impersonating some of the most popular and well known "carding" markets, or online stores that sell stolen credit cards. --------------------------------------------- https://krebsonsecurity.com/2018/05/will-the-real-jokers-stash-come-forward/ ∗∗∗ 0patching Foxit Reader Buffer... Oops... Integer Overflow (CVE-2017-17557) ∗∗∗ --------------------------------------------- In April, Steven Seeley of Source Incite published a report of a vulnerability in Foxit Reader and PhantomPDF versions up to 9.0.1 that could allow for remote code execution on a target system. Public release of this report was coordinated with an official vendor fix included in the Aprils Foxit Reader and PhantomPDF 9.1. release.According to our analysis the PoC attached to the report triggers a heap-based buffer overflow in a Bitmap image data copy operation .. --------------------------------------------- http://blog.0patch.com/2018/05/0patching-foxit-reader-buffer-oops.html ∗∗∗ Cookie consent script used to distribute malware ∗∗∗ --------------------------------------------- Since the new website cookie usage regulations in the EU have come into place, many websites have added a warning on their website about how they use cookies on it and as well, ask for your consent. ]]> --------------------------------------------- http://labs.sucuri.net/?note=2018-05-29 ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-4212 git - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4212 ∗∗∗ DSA-4213 qemu - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4213 ∗∗∗ Potential XSS in "CSRF validation failure" page due to lack of referer sanitization ∗∗∗ --------------------------------------------- https://fortiguard.com/psirt/FG-IR-18-059 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.05.2018
by Daily end-of-shift report 29 May '18

29 May '18

===================== = End-of-Day report = ===================== Timeframe: Montag 28-05-2018 18:00 − Dienstag 29-05-2018 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Cobalt Hacking Group Still Active Despite Leaders Arrest ∗∗∗ --------------------------------------------- Despite their leaders arrest in Spain two months ago, the Cobalt hacker group thats specialized in stealing money from banks and financial institutions has remained active, even launching a new campaign. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cobalt-hacking-group-still-a… ∗∗∗ 2018 Fraud World Cup ∗∗∗ --------------------------------------------- There are only two weeks to go before the start of the massive soccer event - FIFA World Cup. This championship has already attracted the attention of millions worldwide, including a fair few cybercriminals. Long before kick-off, email accounts began bulging with soccer-related spam, and scammers started exploiting the topic in mailings and creating World Cup-themed phishing pages. --------------------------------------------- https://securelist.com/2018-fraud-world-cup/85878/ ∗∗∗ Qihoo 360 discovers high-risk security issues in EOS, says 80% digital wallets have problems ∗∗∗ --------------------------------------------- Blockchain platform EOS is facing a series of high-risk security vulnerabilities, according to Chinese cybersecurity company Qihoo 360 which published a report on May 29. The company's Vulcan team discovered that attacks can be remotely executed on the EOS node, TechNode's Chinese sister site reports. --------------------------------------------- https://technode.com/2018/05/29/qihoo-360-security-issues-eos/ ∗∗∗ New LTS Release ∗∗∗ --------------------------------------------- Back around the end of 2014 we posted our release strategy. This was the first time we defined support timelines for our releases, and added the concept of an LTS (long-term support) release. At our OMC meeting earlier this month, we picked our next LTS release. This post walks through that announcement, and tries to explain all the implications of it. --------------------------------------------- https://www.openssl.org/blog/blog/2018/05/18/new-lts/ ∗∗∗ Kritische Lücken in IBMs Sicherheits-Lösung QRadar ∗∗∗ --------------------------------------------- Ausgerechnet in der Sicherheitslösung QRadar, die Angriffe aufdecken und verhindern soll, klafften kritische Lücken, die externen Angreifern vollen Zugriff gewährten. --------------------------------------------- http://heise.de/-4060177 ∗∗∗ Keine 359,88 Euro an MEDIA ADVICE LIMITED bezahlen! ∗∗∗ --------------------------------------------- Die betrügerische Media Advice Limited betreibt verschiedene Streaming-Plattformen, wie tutoflix.de, soloflix.de oder megaflix.de. InteressentInnen sollen sich auf den Websites registrieren, um Zugriff auf das Film-Angebot zu bekommen. Wer den Anweisungen folgt, wird böse überrascht, denn die Registrierung führt zu einer Premium-Mitgliedschaft, die Kosten von 359,88 Euro pro Jahr verursacht. Der Betrag sollte auf keinen Fall bezahlt werden, denn ein gültiger Vertrag kam --------------------------------------------- https://www.watchlist-internet.at/news/keine-35988-euro-an-media-advice-lim… ===================== = Vulnerabilities = ===================== ∗∗∗ GNU Barcode 0.99 Memory Leak ∗∗∗ --------------------------------------------- GNU Barcode suffers from a memory leak vulnerability, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error in the cmdline.c, which can be exploited to cause a memory leak via a specially crafted file. The vulnerability is confirmed in version 0.99. Other versions may also be affected. --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5471.php ∗∗∗ GNU Barcode 0.99 Buffer Overflow ∗∗∗ --------------------------------------------- The vulnerability is caused due to a boundary error in the processing of an input file, which can be exploited to cause a buffer overflow when a user processes e.g. a specially crafted file. Successful exploitation could allow execution of arbitrary code on the affected machine. --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5470.php ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (wireshark), Fedora (kernel), openSUSE (enigmail), Red Hat (kernel), SUSE (cairo, java-1_7_0-ibm, libvirt, perl-DBD-mysql, and xen), and Ubuntu (batik and isc-dhcp). --------------------------------------------- https://lwn.net/Articles/755884/ ∗∗∗ WordPress plugin "Site Reviews" vulnerable to cross-site scripting ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN60978548/ ∗∗∗ WordPress plugin "Email Subscribers & Newsletters" vulnerable to cross-site scripting ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN16471686/ ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Content Collector for SAP Applications ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=swg22014445 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Integration Bus and WebSphere Message Broker ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22016387 ∗∗∗ Unprotected WiFi access & Unencrypted data transfer in Vgate iCar2 OBD2 Dongle ∗∗∗ --------------------------------------------- https://www.sec-consult.com/en/blog/advisories/unprotected-wifi-access-unen… ∗∗∗ Spring Framework vulnerability CVE-2018-1258 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K18193959 ∗∗∗ HPESBHF03852 rev.1 - HPE Intelligent Management Center (iMC) Wireless Service Manager (WSM) Software, Remote Code Execution ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.05.2018
by Daily end-of-shift report 28 May '18

28 May '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 25-05-2018 18:00 − Montag 28-05-2018 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Capture and Analysis of User Agents, (Sun, May 27th) ∗∗∗ --------------------------------------------- ISC collects web logs which also includes User-Agents. If you are running a honeypot or a web server, it is fairly easy to quickly use some Regex to parse the logs and get a count of what is most commonly seen. This is some of the activity I have observed over the past week, some well know user-agent associated with valid browser versions and some custom that are telltale to hacking tools: [...] --------------------------------------------- https://isc.sans.edu/diary/rss/23705 ∗∗∗ NCSC-NL/taranis3 ∗∗∗ --------------------------------------------- NCSC-NL has published their internal workflow management tool "Taranis" on GitHub. This makes it easier for the community to contribute to future developments. --------------------------------------------- https://github.com/NCSC-NL/taranis3/ ∗∗∗ VPNFilter-Botnetz: US-Behörden raten dringend zu Router- und NAS-Neustart ∗∗∗ --------------------------------------------- Weil wichtige Teile der Infrastruktur des Botnetzes VPNFilter gekapert wurden, kann ein Neustart die Infektion entschärfen. Deswegen raten FBI und US-Justizministerium zum Neustart von SOHO-Routern und NAS-Geräten. --------------------------------------------- https://www.heise.de/-4059341 ∗∗∗ Efail: Empfohlener Workaround für Apple Mail und PGP schützt offenbar nicht ∗∗∗ --------------------------------------------- Apples E-Mail-Client mit GPG Suite kann verschlüsselte Mails einem Bericht zufolge weiterhin preisgeben, auch wenn der Nutzer das Laden entfernter Inhalte deaktiviert hat. Die Anzeige von HTML-Mails lässt sich in Apple Mail nicht komplett abschalten. --------------------------------------------- http://heise.de/-4059867 ∗∗∗ Attackers Fake Computational Power to Steal CryptoCurrencies from Mining Pools ∗∗∗ --------------------------------------------- Recently, we detected a new type of attack which targets some equihash mining pools. After analysis, we found out the attacked equihash mining pools are [...] --------------------------------------------- https://blog.360totalsecurity.com/en/attackers-fake-computational-power-ste… ∗∗∗ Warnung vor mmg-tennis.de ∗∗∗ --------------------------------------------- Im Webstore mmg-tennis.de finden Konsument/innen günstige Markenware. Bei dieser handelt es sich um Produktfälschungen. Kund/innen, die bei mmg-tennis.de einkaufen, müssen deshalb mit zahlreichen Nachteilen und überhöhten Geldabbuchungen rechnen. Wir raten daher dringend von einem Einkauf bei mmg-tennis.de ab. --------------------------------------------- https://www.watchlist-internet.at/news/warnung-vor-mmg-tennisde/ ===================== = Vulnerabilities = ===================== ∗∗∗ 2018-1014: Moodle: Mehrere Schwachstellen ermöglichen u.a. die Ausführung beliebigen Programmcodes ∗∗∗ --------------------------------------------- Eine Schwachstelle in Moodle ermöglicht einem entfernten, einfach authentifizierten Angreifer mit der Berechtigung, Berechnungsfragen zu erstellen, die Ausführung beliebigen Programmcodes ( https://moodle.org/mod/forum/discuss.php?d=371199#p1496353 ). Mehrere weitere Schwachstellen [...] --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-1014/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (batik, cups, gitlab, ming, and xdg-utils), Fedora (dpdk, firefox, glibc, nodejs-deep-extend, strongswan, thunderbird, thunderbird-enigmail, wavpack, xdg-utils, and xen), Gentoo (ntp, rkhunter, and zsh), openSUSE (Chromium, GraphicsMagick, jasper, opencv, pdns, and wireshark), SUSE (jasper, java-1_7_1-ibm, krb5, libmodplug, and openstack-nova), and Ubuntu (thunderbird). --------------------------------------------- https://lwn.net/Articles/755796/ ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Netcool Impact ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22016544 ∗∗∗ IBM Security Bulletin: Security Bulletin: IBM Cloud Orchestrator and Cloud Orchestrator Enterprise update of IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg2C1000370 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.05.2018
by Daily end-of-shift report 25 May '18

25 May '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 24-05-2018 18:00 − Freitag 25-05-2018 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Z-Shave Attack Could Impact Over 100 Million IoT Devices ∗∗∗ --------------------------------------------- The Z-Wave wireless communications protocol used for some IoT/smart devices is vulnerable to a downgrade attack that can allow a malicious party to intercept and tamper with traffic between smart devices. --------------------------------------------- https://www.bleepingcomputer.com/news/security/z-shave-attack-could-impact-… ∗∗∗ Electron: Was es mit dem Patch des Patches auf sich hat... ∗∗∗ --------------------------------------------- Die Entwickler von Electron haben in der vorigen Woche einen Patch für den Januar-Patch ihres Cross-Plattform-Frameworks zur Erstellung von Desktop-Apps veröffentlicht. Ein Sicherheitsforscher von Doyensec erläuterte nun, warum das notwendig war. --------------------------------------------- https://www.heise.de/-4058755 ∗∗∗ Gefälschter Überweisungsauftrag für Vereins-Kassier/innen ∗∗∗ --------------------------------------------- Vereins-Kassier/innen erhalten eine angebliche Benachrichtigung ihrer Obfrau oder ihres Obmanns, in der es heißt, dass der Verein dringend Geld ins Ausland überweisen müsse. Kommen sie der Aufforderung nach, verliert der Verein Geld, denn das Schreiben stammt von Kriminellen. --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschter-ueberweisungsauftrag-fu… ===================== = Vulnerabilities = ===================== ∗∗∗ VU#338343: strongSwan VPN charon server vulnerable to buffer underflow ∗∗∗ --------------------------------------------- [...] strongSwan VPNs charon server prior to version 5.6.3 does not check packet length and may allow buffer underflow, resulting in denial of service. --------------------------------------------- http://www.kb.cert.org/vuls/id/338343 ∗∗∗ BeaconMedaes TotalAlert Scroll Medical Air Systems ∗∗∗ --------------------------------------------- This medical device advisory includes mitigations for improper access controls, insufficiently protected credentials, and unprotected storage of credentials vulnerabilities in the BeaconMedaes TotalAlert Scroll Medical Air Systems web application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSMA-18-144-01 ∗∗∗ Schneider Electric Floating License Manager ∗∗∗ --------------------------------------------- This advisory includes mitigations for heap-based buffer overflow, improper restriction of operations within the bounds of a memory buffer, and open redirect vulnerabilities in the Schneider Electric Floating License Manager. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-144-01 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (bind, libofx, and thunderbird), Debian (thunderbird, xdg-utils, and xen), Fedora (procps-ng), Mageia (gnupg2, mbedtls, pdns, and pdns-recursor), openSUSE (bash, GraphicsMagick, icu, and kernel), Oracle (thunderbird), Red Hat (java-1.7.1-ibm, java-1.8.0-ibm, and thunderbird), Scientific Linux (thunderbird), and Ubuntu (curl). --------------------------------------------- https://lwn.net/Articles/755667/ ∗∗∗ IBM Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by an Application Error vulnerability ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22016515 ∗∗∗ IBM Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by an Incorrect Permission Assignment for Critical Resource vulnerability ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22016132 ∗∗∗ IBM Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a Query Parameter in SSL Request vulnerability ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22016131 ∗∗∗ IBM Security Bulletin: IBM Spectrum Control (formerly IBM Tivoli Storage Productivity Center) is affected by a vulnerability in Apache CXF (CVE-2017-12624) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22014053 ∗∗∗ IBM Security Bulletin: Open Source Apache CXF Vulnerabilities affects IBM Spectrum LSF Explorer ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=isg3T1027368 ∗∗∗ IBM Security Bulletin: API Connect Developer Portal is affected by a PHP vulnerability (CVE-2017-7272) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22016607 ∗∗∗ IBM Security Bulletin: IBM Spectrum Control (formerly IBM Tivoli Storage Productivity is affected by an OpenSSL vulnerabilitiy (CVE-2018-0739) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015614 ∗∗∗ IBM Security Bulletin: IBM FileNet Image Services is affected by GSKit and GSKit-Crypto vulnerabilities ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=swg22014741 ∗∗∗ IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center) CVE-2017-1788 ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22014729 ∗∗∗ IBM Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a Cross-Site Scripting vulnerability ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22016512 ∗∗∗ IBM Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a Session Identifier Not Updated vulnerability ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22016513 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily