Daily

daily@lists.cert.at

1 participants
3139 discussions

Tageszusammenfassung - Montag 29-05-2017
by Daily end-of-shift report 29 May '17

29 May '17

======================= = End-of-Shift report = ======================= Timeframe: Freitag 26-05-2017 18:00 − Montag 29-05-2017 18:00 Handler: Stephan Richter Co-Handler: n/a *** Microsoft Quietly Patches Another Critical Malware Protection Engine Flaw *** --------------------------------------------- Microsoft quietly patched a critical vulnerability found by Googles Project Zero team in the Malware Protection Engine. --------------------------------------------- http://threatpost.com/microsoft-quietly-patches-another-critical-malware-pr… *** Crysis ransomware master keys posted to Pastebin *** --------------------------------------------- Why would someone release the keys to victims? Who knows, but as the poster who uploaded them says, Enjoy! --------------------------------------------- https://nakedsecurity.sophos.com/2017/05/26/crysis-ransomware-master-keys-p… *** File2pcap - A new tool for your toolkit!, (Fri, May 26th) *** --------------------------------------------- One of our readers, Gebhard, submitted a pointer to a tool today, released byTalos, that I wasnt familiar with. However, when I realized it could generate packets, I had to try it out. Its called File2pcap. The concept of the tool is that instead of having to download a file and capture the traffic in order to write detection content, the tool would simulate the download and generate the traffic that you would see. You get a nice pcap in the end. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=22456&rss *** CyberChef a Must Have Tool in your Tool bag!, (Sun, May 28th) *** --------------------------------------------- This multipurpose and feature rich tool has been available for a while now and is updated regularly. What I find the most interesting is the number of features that are available this tool. CyberChef is fully portable and can be downloaded locally as an simple HTML self-contained page that can run in any browsers or if you prefer, you can download the package from Github and compile it yourself[2] but why bother. Since the code is updated regularly, I find the first option more practical. It [...] --------------------------------------------- https://isc.sans.edu/diary.html?storyid=22458&rss *** Analysis of Competing Hypotheses (ACH part 1), (Sun, May 28th) *** --------------------------------------------- In threat intelligence, by definition, an analyst will most of the times have to perform assessments in an environment of incomplete information, and/or with information that is being produced with the purpose of misleading the analyst. One of the well-known methodologies is the Analysis of Competing Hypotheses (ACH) [1], developed by Richards J. Heuer, Jr., a former CIA veteran. ACH is an analytic process that identifies a set of alternative hypotheses, and assesses whether data available are [...] --------------------------------------------- https://isc.sans.edu/diary.html?storyid=22460&rss *** Guidance on Disabling System Services on Windows Server 2016 with Desktop Experience *** --------------------------------------------- [Primary authors: Dan Simon and Nir Ben Zvi] The Windows operating system includes many system services that provide important functionality. Different services have different default startup policies: some are started by default (automatic), some when needed (manual) and some are disabled by default and must be explicitly enabled before they can run. These defaults were... --------------------------------------------- https://blogs.technet.microsoft.com/secguide/2017/05/29/guidance-on-disabli… *** Network Time Protocol updated to spook-harden user comms *** --------------------------------------------- Network time lords decide we dont need IP address swaps The Internet Engineering Task Force has taken another small step in protecting everybodys privacy - this time, in making the Network Time Protocol a bit less spaffy. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2017/05/29/network_tim… *** CFP Time *** --------------------------------------------- We decided to create a website for a clearer view of what conferences are happening all around the world. The project is still in beta and after seeing how the community takes it, we might take it one step further. --------------------------------------------- https://cfptime.org/cfps/about *** Dirty COW and why lying is bad even if you are the Linux kernel *** --------------------------------------------- [...] There have been plenty of articles and blog posts about the exploit, but none of them give a satisfactory explanation on exactly how Dirty COW works under the hood from the kernel's perspective. The following analysis is based on this attack POC, although the idea applies to all other similar attacks. --------------------------------------------- https://chao-tic.github.io/blog/2017/05/24/dirty-cow *** DFN-CERT-2017-0928: Microsoft Malware Protection Engine: Mehrere Schwachstellen ermöglichen u.a. die komplette Systemübernahme *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0928/ *** DFN-CERT-2017-0913: WebKitGTK+: Mehrere Schwachstellen ermöglichen die Ausführung beliebigen Programmcodes und einen Cross-Site-Scripting-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0913/ https://webkitgtk.org/security/WSA-2017-0004.html *** DFN-CERT-2017-0925: FortiOS: Mehrere Schwachstellen ermöglichen u.a. das Erlangen von Administratorrechten *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0925/ *** Security Advisory - Multiple Vulnerabilities in MTK Platform *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170527-… *** Bugtraq: Wordpress Plugin Social-Stream - Exposure of Twitter API Secret Key and Token *** --------------------------------------------- http://www.securityfocus.com/archive/1/540636 *** Bugtraq: [security bulletin] HPESBHF03730 rev.1 - HPE Aruba ClearPass Policy Manager, Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/540635 *** Bugtraq: [security bulletin] HPESBHF03754 rev.1 - HPE ML10 Gen 9 Server using Intel Xeon E3-1200 v5 Processor, Remote Access Restriction Bypass *** --------------------------------------------- http://www.securityfocus.com/archive/1/540634 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM PowerVC is affected by vulnerability in OpenStack Nova (CVE-2017-7214) *** http://www-01.ibm.com/support/docview.wss?uid=nas8N1022011 --------------------------------------------- *** IBM Security Bulletin: A security vulnerability has been identified in Red Hat Enterprise Linux (RHEL) Server shipped with PurePower Integrated Manager (PPIM) (CVE-2017-6462 CVE-2017-6463 CVE-2017-6464) *** http://www-01.ibm.com/support/docview.wss?uid=isg3T1025209 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDKs affect IBM Virtualization Engine TS7700 - January 2017 *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1010245 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in libxml2 and zlib affect IBM Virtual Fabric 10Gb Switch Module *** http://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=migr-50… --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in NTP affect IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru, QLogic 8Gb Intelligent Pass-thru Module & SAN Switch Module for BladeCenter and QLogic Virtual Fabric Extension Module for IBM *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=MIGR-5… --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru, QLogic 8Gb Intelligent Pass-thru Module & SAN Switch Module for BladeCenter and QLogic Virtual Fabric Extension Module for IBM *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=MIGR-5… ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 26-05-2017
by Daily end-of-shift report 26 May '17

26 May '17

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 24-05-2017 18:00 − Freitag 26-05-2017 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Reflections on reflection (attacks) *** --------------------------------------------- Recently Akamai published an article about CLDAP reflection attacks. This got us thinking. We saw attacks from Conectionless LDAP servers back in November 2016 but totally ignored them because our systems were automatically dropping the attack .. --------------------------------------------- https://blog.cloudflare.com/reflections-on-reflections/ *** Cloak & Dagger *** --------------------------------------------- Cloak & Dagger is a new class of potential attacks affecting Android devices. These attacks allow a malicious app to completely control the UI feedback loop and take over the device — without giving the user a chance to notice the malicious activity. These attacks .. --------------------------------------------- http://cloak-and-dagger.org/ *** Trump’s Dumps: ‘Making Dumps Great Again’ *** --------------------------------------------- Its not uncommon for crooks who peddle stolen credit cards to seize on iconic American figures of wealth and power in the digital advertisements for these shops that run continuously on various .. --------------------------------------------- https://krebsonsecurity.com/2017/05/trumps-dumps-making-dumps-great-again/ *** Österreichs Unternehmen sind bei IT-Sicherheit Nachzügler *** --------------------------------------------- Investitionen in die Sicherheit als Chance verstehen --------------------------------------------- http://derstandard.at/2000058280565 *** 83% of Security Pros Waste Time Fixing Co-Workers Non-Security Problems *** --------------------------------------------- Security personnel in many organizations waste time every week helping co-workers with general IT problems, rather than doing their own work, which in the long run, .. --------------------------------------------- https://www.bleepingcomputer.com/news/technology/83-percent-of-security-pro… *** Schwere Sicherheitslücke in Samba gefunden *** --------------------------------------------- Exploits bereits im Netz – Updates sollten rasch eingespielt werden --------------------------------------------- http://derstandard.at/2000058287863 *** DSA-3863 imagemagick - security update *** --------------------------------------------- This update fixes several vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising .. --------------------------------------------- https://www.debian.org/security/2017/dsa-3863 *** DSA-3862 puppet - security update *** --------------------------------------------- It was discovered that unrestricted YAML deserialisation of data sent from agents to the server in the Puppet configuration management .. --------------------------------------------- https://www.debian.org/security/2017/dsa-3862 *** Manipulierte Webseiten legen Windows lahm *** --------------------------------------------- Problem mit Dateinamen verlangsamt System bis zum Stillstand – Windows 7, 8 und Vista betroffen --------------------------------------------- http://derstandard.at/2000058292526 *** Tanze (aktualisierten) Samba mit mir *** --------------------------------------------- Die Erinnerung an CVE-2017-0144, und die Auswirkungen von WannaCry, ist bei uns allen noch frisch im Gedächtnis verankert, und damit keine Langeweile aufkommt, hat Samba nun ein Advisory bezüglich einer kritischen Schwachstelle veröffentlicht: All versions of Samba .. --------------------------------------------- http://www.cert.at/services/blog/20170526134531-2020.html *** FileZilla FTP Client Adds Support for Master Password That Encrypts Your Logins *** --------------------------------------------- Following years of criticism and user requests, the FileZilla FTP client is finally adding support for a master password .. --------------------------------------------- https://www.bleepingcomputer.com/news/software/filezilla-ftp-client-adds-su…

1 0

Tageszusammenfassung - Mittwoch 24-05-2017
by Daily end-of-shift report 24 May '17

24 May '17

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 23-05-2017 18:00 − Mittwoch 24-05-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** FIRST releases version 1.1 of the CSIRT Services Framework *** --------------------------------------------- The leading association of incident response and security teams released a new version of its CSIRT Services Framework. This is a formal list of services a Computer Security Incident Response Team (CSIRT) may consider implementing to address the needs of their constituency. --------------------------------------------- https://www.first.org/newsroom/releases/20170524 *** B. Braun Medical SpaceCom Open Redirect Vulnerability *** --------------------------------------------- This advisory was originally posted to the NCCIC Portal on March 23, 2017, and is being released to the ICS-CERT web site. This advisory contains mitigation details for an open redirect vulnerability in B. Braun Medical's SpaceCom module, which is integrated into the SpaceStation docking station. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSMA-17-082-02 *** Trend Micro ServerProtect for Linux Multiple Bugs Let Remote Users Execute Arbitrary Code and Conduct Cross-Site Scripting and Cross-Site Request Forgery Attacks and Let Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1038548 *** OpenVPN Access Server Input Validation Flaw Lets Remote Users Conduct Session Fixation Attacks to Hijack a Target Users Session *** --------------------------------------------- A remote user can create a specially crafted URL containing the '%0A' character that, when loaded by the target user prior to authentication, will inject headers and set the session cookie to a specified value. After the target user authenticates to the target OpenVPN Access Server, the remote user can hijack the target user's session. --------------------------------------------- http://www.securitytracker.com/id/1038547 *** DFN-CERT-2017-0901/">Puppet, Puppet Enterprise: Eine Schwachstelle ermöglicht die Ausführung beliebigen Programmcodes *** --------------------------------------------- Betroffene Software Puppet < 4.10.1 Puppet Enterprise < 2016.4.5 Puppet Enterprise < 2017.2.1 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0901/ *** [Announce] Samba 4.6.4, 4.5.10 and 4.4.14 Available for Download *** --------------------------------------------- CVE-2017-7494: All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it. --------------------------------------------- https://lists.samba.org/archive/samba-announce/2017/000406.html *** Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones *** --------------------------------------------- There is Factory Reset Protection (FRP) bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can perform some operations to update the Google account. As a result, the FRP function is bypassed. (Vulnerability ID: HWPSIRT-2017-02036). This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2017-2710. --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170524-… *** Jaff ransomware gets a makeover *** --------------------------------------------- With all the recent news about WannaCry ransomware, people might forget Jaff is an ongoing threat. Worse yet, some people might not know about it at all since its debut about 2 weeks ago. Jaff has already gotten a makeover, so an infected host looks noticeably different now. --------------------------------------------- https://isc.sans.edu/diary/Jaff+ransomware+gets+a+makeover/22446 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: multiple vulnerabilities in IBM SDK Java Technology Edition affect IBM Security Guardium Data Redaction. . *** http://www-01.ibm.com/support/docview.wss?uid=swg22003466 --------------------------------------------- *** IBM Security Bulletin: IBM Maximo Asset Management generates error messages that could reveal sensitive information that could be used in further attacks against the system (CVE-2017-1292) *** http://www-01.ibm.com/support/docview.wss?uid=swg22003414 --------------------------------------------- *** IBM Security Bulletin: IBM Maximo Asset Management is vulnerable to HTTP response splitting attacks (CVE-2017-1291) *** http://www.ibm.com/support/docview.wss?uid=swg22003413 --------------------------------------------- *** IBM Security Bulletin: Fix Available for IBM iNotes Cross-Site Scripting Vulnerability (CVE-2017-1325) *** http://www-01.ibm.com/support/docview.wss?uid=swg22003497 --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in the IBM SDK Java Technology Edition affect IBM Notes *** http://www-01.ibm.com/support/docview.wss?uid=swg22000602 --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in the IBM SDK Java Technology Edition affect IBM Domino *** http://www-01.ibm.com/support/docview.wss?uid=swg22000516 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 23-05-2017
by Daily end-of-shift report 23 May '17

23 May '17

======================= = End-of-Shift report = ======================= Timeframe: Montag 22-05-2017 18:00 − Dienstag 23-05-2017 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** EU security think tank ENISA looks for IoT security, cant find any *** --------------------------------------------- Proposes baseline security spec, plus stickers to prove thing-makers have complied European network and infosec agency ENISA has taken a look at Internet of Things security, and doesnt much like what it sees. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2017/05/23/enisa_propo… *** Biometrie: Iris-Scanner des Galaxy S8 kann einfach manipuliert werden *** --------------------------------------------- Schon wieder zeigt sich: Biometrische Merkmale sind praktisch zum Entsperren von Geräten - sicher sind sie hingegen nicht. Ein Hacker hat gezeigt, dass sich der Irisscanner des Galaxy S8 von Samsung mit einem einfachen Foto und einer Kontaktlinse austricksen lässt. --------------------------------------------- https://www.golem.de/news/biometrie-iris-scanner-des-galaxy-s8-kann-einfach… *** Preloading in Internet Explorer 11 sends complete browsing history to Microsoft *** --------------------------------------------- Your entire browsing history will periodically be sent to Microsoft. The data sent includes all addresses you visit and when you visited them (derived from that is also how long you spent on each page), and the address of the page that referred you to each page. --------------------------------------------- https://ctrl.blog/entry/ie11-flip-out-privacy *** Windows 10 UAC Bypass Uses "Apps & Features" Utility *** --------------------------------------------- Malware authors have a new UAC bypass technique at their disposal that they can use to install malicious apps on devices running Windows 10. --------------------------------------------- https://www.bleepingcomputer.com/news/security/windows-10-uac-bypass-uses-a… *** Hackers can use subtitles to take over millions of devices running VLC, Kodi, Popcorn Time and Stremio *** --------------------------------------------- Check Point researchers revealed a new attack vector threatening millions of users of popular media players, including VLC, Kodi (XBMC), Popcorn Time and Stremio. By crafting malicious subtitle files for films and TV programmes, which are then downloaded by viewers, attackers can potentially take complete control of any device running the vulnerable platforms. --------------------------------------------- https://www.helpnetsecurity.com/2017/05/23/subtitle-hack/ *** [2017-05-23] Arbitrary File Upload & Stored XSS in InvoicePlane *** --------------------------------------------- Multiple high risk vulnerabilities, such as arbitrary file upload and stored cross site-scripting, within the InvoicePlane software allow an attacker to compromise the affected server. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2017… *** BIG-IP Azure cloud vulnerability CVE-2017-6131 *** --------------------------------------------- BIG-IP Azure cloud vulnerability CVE-2017-6131. Security Advisory. Security Advisory Description. In some circumstances ... --------------------------------------------- https://support.f5.com/csp/article/K61757346 *** Cisco Integrated Management Controller Remote Code Execution Vulnerability *** --------------------------------------------- A vulnerability in the web-based GUI of Cisco Integrated Management Controller (CIMC) could allow an unauthenticated, remote attacker to perform unauthorized remote command execution on the affected device.The vulnerability exists because the affected software does not sufficiently sanitize specific values that are received as part of a user-supplied HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. Successful exploitation... --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… *** Cisco Integrated Management Controller Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in the web-based GUI of Cisco Integrated Management Controller (CIMC) could allow an authenticated, remote attacker to elevate the privileges of user accounts on the affected device.The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted HTTP requests to the affected device. Successful exploitation could allow an authenticated attacker to elevate the privileges of user accounts configured on the device. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in NTP affect IBM Flex System Chassis Management Module (CMM) *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=MIGR-5… --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in xorg-x11-libX11 affect IBM Flex System Chassis Management Module (CMM) *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=MIGR-5… --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in cURL affect IBM Flex System Chassis Management Module (CMM) *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=MIGR-5… --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect MegaRAID Storage Manager *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=migr-5… --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in tcpdump affect IBM Flex System Chassis Management Module (CMM) *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=MIGR-5… --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Web Experience Factory *** http://www.ibm.com/support/docview.wss?uid=swg22003695 --------------------------------------------- *** IBM Security Bulletin: Directory Traversal vulnerabilities impact IBM Network Advisor. *** http://www.ibm.com/support/docview.wss?uid=ssg1S1009700 --------------------------------------------- *** IBM Security Bulletin: Rational DOORS Web Access is affected by Apache Tomcat vulnerability (CVE-2016-6816) *** http://www.ibm.com/support/docview.wss?uid=swg22003660 --------------------------------------------- *** IBM Security Bulletin: Open Source cURL Libcurl, used by BigFix Platform, has security vulnerabilities (CVE-2016-8617 CVE-2016-8624 CVE-2016-8621) *** http://www-01.ibm.com/support/docview.wss?uid=swg22001818 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Security Access Manager (CVE-2016-5597, CVE-2016-5554) *** http://www-01.ibm.com/support/docview.wss?uid=swg22002446 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Tivoli Access Manager for e-business and IBM Security Access Manager for Web (CVE-2016-5597, CVE-2016-5554) *** http://www-01.ibm.com/support/docview.wss?uid=swg22002445 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 22-05-2017
by Daily end-of-shift report 22 May '17

22 May '17

======================= = End-of-Shift report = ======================= Timeframe: Freitag 19-05-2017 18:00 − Montag 22-05-2017 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Terror Exploit Kit Evolves Into Larger Threat *** --------------------------------------------- The Terror exploit kit has matured into a greater threat and carefully crafts attacks based on a users browser environment. --------------------------------------------- http://threatpost.com/terror-exploit-kit-evolves-into-larger-threat/125816/ *** DSA-3859 dropbear - security update *** --------------------------------------------- https://www.debian.org/security/2017/dsa-3859 *** DSA-3858 openjdk-7 - security update *** --------------------------------------------- Several vulnerabilities have been discovered in OpenJDK, animplementation of the Oracle Java platform, resulting in privilege escalation, denial of service, newline injection in SMTP or use of insecure cryptography. --------------------------------------------- https://www.debian.org/security/2017/dsa-3858 *** WannaCry: Fast nur Windows-7-PCs infiziert *** --------------------------------------------- Mehr als 98 Prozent aller mit WannaCry infizierten PCs laufen nach Zahlen von Kaspersky Lab unter Windows 7. --------------------------------------------- https://heise.de/-3719145 *** Nordkorea unterhält offenbar Spezialeinheit für Cyberangriffe auf Banken *** --------------------------------------------- Soll angeblich hauptsächlich Devisen beschaffen --------------------------------------------- http://derstandard.at/2000058034871 *** Netgear fixes router by adding phone-home features that record your IP and MAC address *** --------------------------------------------- Yeah, that'll be secure for sure Netgear NightHawk R7000 users who ran last weeks firmware upgrade need to check their settings, because the company added a remote data collection feature to the units. --------------------------------------------- www.theregister.co.uk/2017/05/21/netgear_updates_router_with_phone_home_fea… *** "Athena": Mächtiges CIA-Tool knackt alle Windows-Versionen seit XP *** --------------------------------------------- Wikileaks publiziert Dokumente - Umfassende Überwachungsmöglichkeiten, Malware kann auch Daten löschen --------------------------------------------- http://derstandard.at/2000058071298 *** IT threat evolution Q1 2017. Statistics *** --------------------------------------------- According to KSN data, Kaspersky Lab solutions detected and repelled 479,528,279 malicious attacks from online resources located in 190 countries all over the world. File antivirus detected a total of 174,989,956 unique malicious and potentially unwanted objects. --------------------------------------------- http://securelist.com/analysis/quarterly-malware-reports/78475/it-threat-ev… *** Operation "Porto": 159 Dealer im Darknet ausgeforscht *** --------------------------------------------- Ermittlungsverfahren gegen 697 Personen - 35 kg Suchtgift sowie 4.500 Tabletten sichergestellt --------------------------------------------- http://derstandard.at/2000058084813 *** Achtung, Abzocke: Microsoft warnt erneut vor betrügerischen Anrufen *** --------------------------------------------- Mit angeblichen Support-Anrufen von Unternehmen wie Microsoft oder Dell versuchen Betrüger, PC-Besitzer abzuzocken. Trotz einiger Erfolge der Ermittler bleibt das Problem virulent. --------------------------------------------- https://heise.de/-3720168 *** The Problem with OCSP Stapling and Must Staple and why Certificate Revocation is still broken *** --------------------------------------------- Today the OCSP servers from Let's Encrypt were offline for a while. This has caused far more trouble than it should have, because in theory we have all the technologies available to handle such an incident. However due to failures in how they are implemented they don't really work. --------------------------------------------- https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-Stapling-and-Must… *** Was die Datenschutzverordnung bringt: Sammelklagen, Beauftragte *** --------------------------------------------- Nutzer können ab Mai 2018 ihre Rechte leichter durchsetzen, sagt IT-Anwalt Lukas Feiler --------------------------------------------- http://derstandard.at/2000058102109 *** Yahoo schmeisst ImageMagick nach Sicherheitslücke aus eigenem Webmail-Code *** --------------------------------------------- Durch die Schwachstelle konnten Angreifer Speicherinhalte der Yahoo-Server auslesen und so die E-Mail-Anhänge anderer Nutzer ausspionieren. Yahoo schloss die Lücke innerhalb eines selbstverordneten 90-Tage-Ultimatums. --------------------------------------------- https://heise.de/-3720803

1 0

Tageszusammenfassung - Freitag 19-05-2017
by Daily end-of-shift report 19 May '17

19 May '17

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 18-05-2017 18:00 − Freitag 19-05-2017 18:00 Handler: Stephan Richter Co-Handler: n/a *** How did the WannaCry Ransomworm spread? *** --------------------------------------------- Security researchers have had a busy week since the WannaCry ransomware outbreak that wreaked havoc on computers worldwide. How did it all happen? --------------------------------------------- https://blog.malwarebytes.com/cybercrime/2017/05/how-did-wannacry-ransomwor… *** Who's responsible for fixing SS7 security issues? *** --------------------------------------------- The WannaCry ransomware onslaught has overshadowed some of the other notable happenings this month, including the spectacular Google-themed phishing/spamming attack, and the news that attackers have managed to exploit vulnerabilities in the SS7 protocol suite to bypass German banks' two-factor authentication and drain their customers' bank accounts. According to the reports, the attackers were able to pull this scheme off by gaining access to the network of a foreign mobile network [...] --------------------------------------------- https://www.helpnetsecurity.com/2017/05/19/ss7-security-issues/ *** Number of HTTPS phishing sites triples *** --------------------------------------------- When, in January 2017, Mozilla and Google made Firefox and Chrome flag HTTP login pages as insecure, the intent was to make phishing pages easier to recognize, as well as push more website owners towards deploying HTTPS. But while the latter aim was achieved, and the number of phishing sites making use of HTTPS has increased noticeably, the move also had one unintended consequence: the number of phishing sites with HTTPS has increased, too. --------------------------------------------- https://www.helpnetsecurity.com/2017/05/19/number-https-phishing-sites-trip… *** Hintergrund: Chrome blockt ab sofort Zertifikate mit Common Name *** --------------------------------------------- Wenn der seit Jahren etablierte, hauseigene Dienst plötzlich den HTTPS-Zugang verwehrt, liegt das vermutlich an einer Neuerung der aktuellen Chrome-Version: Google erzwingt den Einsatz der RFC-konformen "Subject Alt Names" und viele Admins müssen deshalb jetzt Hand anlegen. --------------------------------------------- https://heise.de/-3717594 *** Bypassing Application Whitelisting with BGInfo *** --------------------------------------------- TL;DR: BGinfo.exe older than version 4.22 can be used to bypass application whitelisting using vbscript inside a bgi file. This can run directly from a webdav server. --------------------------------------------- https://msitpros.com/?p=3831 *** "Four Keys to Effective ICS Incident Response" *** --------------------------------------------- While incident response in Information Technology (IT) and Operational Technology (OT) or Industrial Control Systems (ICS) may appear to be very similar, incident response in an ICS environment has different considerations and priorities. Many organizations leverage their existing IT incident response capabilities in an OT environment which may not be ideal for successful incident response [...] --------------------------------------------- http://ics.sans.org/blog/2017/05/19/four-keys-to-effective-ics-incident-res… *** ETERNALBLUE vs Internet Security Suites and nextgen protections *** --------------------------------------------- Due to the recent #wannacry ransomware events, we initiated a quick test in our lab. Most vendors claim to protect against the WannaDecrypt ransomware, and some even claims they protect against ETERNALBLUE exploit (MS17-010). Unfortunately, our tests shows otherwise. Warning: We only tested the exploit and the backdoor, but not the payload (Wannacry)! --------------------------------------------- https://www.mrg-effitas.com/eternalblue-vs-internet-security-suites-and-nex… *** Forensik-Tool soll gelöschte Notizen aus iCloud auslesen können *** --------------------------------------------- Der Softwareanbieter Elcomsoft hat seine App "Phone Breaker" um eine Funktion erweitert, die den Umstand ausnutzt, dass Apple offenbar auch vom Nutzer eigentlich vernichtete Notizen länger aufbewahrt. --------------------------------------------- https://heise.de/-3718361 *** MS17-010 (Ransomware WannaCry) Impact to Cisco Products *** --------------------------------------------- The Cisco PSIRT Team is continuing to investigate the impact of this vulnerability on Cisco products that have not reached end of software maintenance support and that do not support automated or manual updates of the Microsoft patch for these vulnerabilities. Investigation is expected to be completed by Friday, May 19th. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco… *** HPESBGN03748 rev.1 - HPE Cloud Optimizer, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified in HPE Cloud Optimizer. The vulnerability could be remotely exploited resulting in disclosure of information. --------------------------------------------- https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbgn037… *** Bugtraq: Nextcloud/Owncloud - Reflected Cross Site Scripting in error pages *** --------------------------------------------- http://www.securityfocus.com/archive/1/540569 *** DSA-3855 jbig2dec - security update *** --------------------------------------------- Multiple security issues have been found in the JBIG2 decoder library,which may lead to denial of service, disclosure of sensitive informationfrom process memory or the execution of arbitrary code if a malformedimage file (usually embedded in a PDF document) is opened. --------------------------------------------- https://www.debian.org/security/2017/dsa-3855 *** Indicators Associated With WannaCry Ransomware (Update C) *** --------------------------------------------- This updated alert is a follow-up to the updated alert titled ICS-ALERT-17-135-01B Indicators Associated With WannaCry Ransomware that was published May 17, 2017, on the NCCIC/ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-17-135-01C *** McAfee Network Data Loss Prevention Multiple Bugs Let Remote Users Conduct Session Hijacking and Cross-Site Scripting Attacks and Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1038523 *** VMSA-2017-0009 *** --------------------------------------------- VMware Workstation update addresses multiple security issues --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2017-0009.html *** DFN-CERT-2017-0885: Red Hat JBoss Enterprise Application Platform, RESTEasy: Eine Schwachstelle ermöglicht das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0885/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Samba vulnerability issue on IBM Storwize V7000 Unified (CVE-2016-2125, CVE-2016-2126) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1010052 --------------------------------------------- *** IBM Security Bulletin: IBM Cisco Switches and Directors vulnerable to Sweet32 Birthday attacks (CVE-2016-2183 CVE-2016-6329). *** http://www.ibm.com/support/docview.wss?uid=ssg1S1010239 --------------------------------------------- *** IBM Security Bulletin: IBM Content Navigator Cross Site Scripting Vulnerability *** http://www-01.ibm.com/support/docview.wss?uid=swg22002356 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in Network Security Services (NSS) component affect SAN Volume Controller, Storwize family and FlashSystem V9000 products. *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1010118 --------------------------------------------- *** IBM Security Bulletin: Open redirect vulnerability in IBM Business Process Manager (CVE-2017-1159) *** http://www-01.ibm.com/support/docview.wss?uid=swg22000253 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in OpenSSL affect IBM SONAS (CVE-2017-3731) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1010136 ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 18-05-2017
by Daily end-of-shift report 18 May '17

18 May '17

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 17-05-2017 18:00 − Donnerstag 18-05-2017 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** Bootstrap - Critical - Information Disclosure - SA-CONTRIB-2017-048 *** --------------------------------------------- This theme enables you to bridge the gap between the Bootstrap Framework and Drupal. The theme does not sufficiently exclude the submitted password value when an incorrect value .. --------------------------------------------- https://www.drupal.org/node/2879177 *** 4022345 - Identifying and correcting failure of Windows Update client to receive updates - Version: 1.3 *** --------------------------------------------- Microsoft is releasing this security advisory to provide information related to an uncommon deployment scenario in which the Windows Update Client may not properly scan for, or download, updates. This scenario may affect customers who installed .. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/4022345 *** iPrint Appliance 2.0 Patch 5 *** --------------------------------------------- iPrint Appliance 2.0 Patch 5 includes bug fixes, security fixes and a consolidation of previously released patches and hot patches for the iPrint Appliance 2.0. --------------------------------------------- https://download.novell.com/Download?buildid=nKiTte1j9yM~ *** iPrint Appliance 2.1 Patch 3 *** --------------------------------------------- iPrint Appliance 2.1 Patch 3 is a cumulative patch including fixes from all the previous 2.1 patches and hot fixes. --------------------------------------------- https://download.novell.com/Download?buildid=4QmSWkUlwrA~ *** Indicators Associated With WannaCry Ransomware (Update B) *** --------------------------------------------- This updated alert is a follow-up to the updated alert titled ICS-ALERT-17-135-01A Indicators Associated With WannaCry Ransomware that was published May 16, 2017, on the NCCIC/ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-17-135-01B *** My Little CVE Bot *** --------------------------------------------- The massive spread of the WannaCry ransomware last Friday was another good proof that many organisations still fail to patch their systems. Everybody admits that patching is a boring task. They are many constraints that make this process very difficult to implement .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=22432 *** Handbrake-Trojaner: Quellcode des Mac-Entwicklerstudios Panic entwendet *** --------------------------------------------- Die auf Mac-Nutzer abzielene Malware “Proton” hat ein erstes prominentes Opfer gefordert: Unbekannte klauten den Quelltext zu mehreren Apps des Entwicklerstudios Panic. Kundendaten sind nicht betroffen, betont das Unternehmen. --------------------------------------------- https://heise.de/-3716479 *** Why the most successful Retefe spam campaign never paid off *** --------------------------------------------- Switzerland is one of the main targets of the Retefe banking trojan since its first appearance in November 2013. At .. --------------------------------------------- https://securityblog.switch.ch/2017/05/18/why-the-most-successful-retefe-sp… *** SSB-412479 (Last Update 2017-05-17): Customer Information on WannaCry Malware for Siemens Healthineers Imaging and Diagnostics Products *** --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_bulletin_ssb-412479… *** [2017-05-18] Multiple critical vulnerabilities in Western Digital TV Media Player *** --------------------------------------------- Multiple critical vulnerabilities, such as unauthenticated arbitrary file upload or local file inclusion, within the WDTV Media Player devices allow an attacker to take over the device over the network. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2017… *** Security Alert: BlueDoom Worm Caught Spreading through EternalBlue, Integrates Batch of Leaked NSA Exploits *** --------------------------------------------- Unfortunately for users who haven’t patched their systems yet after the WannaCry ransomware campaign, there has been an increase in attempts to abuse the EternalBlue exploit in the past few .. --------------------------------------------- https://heimdalsecurity.com/blog/bluedoom-worm-eternablue-nsa-exploits/ *** ATM Black Box attacks: 27 arrested all over Europe *** --------------------------------------------- The efforts of a number of EU Member States and Norway, supported by Europol’s European Cybercrime Centre (EC3) and the Joint Cybercrime Action Taskforce (J-CAT), culminated in the arrest of 27 individuals linked with so-called ATM Black Box attacks across .. --------------------------------------------- https://www.helpnetsecurity.com/2017/05/18/black-box-attacks/ *** 22 Cisco Security Advisories 2017-05-17 *** --------------------------------------------- 1 Critical, 3 High, 18 Medium --------------------------------------------- https://tools.cisco.com/security/center/publicationListing.x

1 0

Tageszusammenfassung - Mittwoch 17-05-2017
by Daily end-of-shift report 17 May '17

17 May '17

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 16-05-2017 18:00 − Mittwoch 17-05-2017 18:00 Handler: Stephan Richter Co-Handler: n/a *** Jetzt patchen: Gerfährliche Sicherheitslücke in Joomla *** --------------------------------------------- Das Joomla-Team schließt mit Version 3.7.1 eine SQL-Injection-Lücke, die fatale Folgen haben kann. Joomla-Admins sollten zügig reagieren. --------------------------------------------- https://heise.de/-3716175 *** WordPress-Update 4.7.5 schließt sechs Sicherheitslücken *** --------------------------------------------- Zwar werden keine der Lücken als kritisch eingestuft, Admins sollten sich aber trotzdem um die XSS- und CSRF-Lücken kümmern. --------------------------------------------- https://heise.de/-3716055 *** Extending Microsoft Edge Bounty Program *** --------------------------------------------- Over the past 10 months, we've paid out more than $200,000 USD in bounties to researchers reporting vulnerabilities through the Microsoft Edge Bounty Program. Partnering with the research community has helped improve Microsoft Edge security, and to continue this collaboration, today we're extending the end date of the Edge on Windows Insider Preview (WIP) bounty... --------------------------------------------- https://blogs.technet.microsoft.com/msrc/2017/05/16/extending-microsoft-edg… *** BSI veröffentlicht Mindeststandard für Mobile Device Management *** --------------------------------------------- Der Mindeststandard definiert in 40 technischen und organisatorischen Regeln die Anforderungen an MDM-Systeme des Bundes sowie deren Betrieb. Er definiert, welche Richtlinien ein System umsetzen können muss, lässt aber Spielraum bei deren Ausgestaltung. --------------------------------------------- https://heise.de/-3715500 *** Basic Best Practices for Securing LDAP and Active Directory with Red Hat *** --------------------------------------------- In the enterprise, its very popular to manage Windows client PCs through Red Hat servers. This sort of configuration is especially common in healthcare and the financial services industries. Red Hat Enterprise Linux (RHEL) has good software for working with Windows Active Directory. Red Hat Enterprise Linux can also manage clients with multiple platforms, such as Windows, OS X, Android, and other Linux distributions with OpenLDAP, an opensource implementation of the Lightweight Directory Access [...] --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/basic-best-practices-f… *** Gefälschtes easybank-Schreiben: Konto gesperrt *** --------------------------------------------- Kriminelle versenden eine gefälschte easybank-Nachricht. Darin heißt es, dass Unbekannte auf das Konto zugegriffen haben. Deshalb sollen Kund/innen eine Website aufrufen, persönliche Bankdaten bekannt geben und ihr Konto bestätigen. Wer die verlangten Informationen Preis gibt, übermittelt sie an Verbrecher/innen. --------------------------------------------- https://www.watchlist-internet.at/phishing/gefaelschtes-easybank-schreiben-… *** Why Phishing Attacks Succeed *** --------------------------------------------- The first time I received a "secure" email message from my bank, I was a bit suspicious of what I was actually seeing. It looked too much like a phishing attempt for my comfort. The message in my inbox was from my banker's email address, not from Chase 1 directly. It also included an attached HTML page and instructions to "open the attached page in an browser for instructions on how to proceed." --------------------------------------------- https://ttmm.io/tech/why-phishing-attacks-succeed/ *** How Big Fuzzing helps find holes in open source projects *** --------------------------------------------- Googles beta project, OSS-Fuzz, has found 264 vulnerabilities in 47 open-source projects - so is it an idea whose time has come? --------------------------------------------- https://nakedsecurity.sophos.com/2017/05/17/how-big-fuzzing-helps-find-hole… *** Security Advisory - DoS Vulnerability in Some Huawei Products *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170517-… *** SSB-412479 (Last Update 2017-05-16): Customer Information on WannaCry Malware for Siemens Healthineers Imaging and Diagnostics Products *** --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_bulletin_ssb-421479… *** Indicators Associated With WannaCry Ransomware (Update A) *** --------------------------------------------- This updated alert is a follow-up to the original alert titled ICS-ALERT-17-135-01 Indicators Associated With WannaCry Ransomware that was published May 15, 2017, on the NCCIC/ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-17-135-01A *** FortiOS stored XSS vulnerability in the policy global-label parameter *** --------------------------------------------- FortiOS is subject to a Cross-Site Scripting vulnerability, due to an improperly sanitized parameter in a hidden CLI configuration setting named global-label . This can however only be exploited by an administrator with write privileges. --------------------------------------------- http://fortiguard.com/psirt/FG-IR-17-057 *** NTP vulnerability CVE-2017-6463 *** --------------------------------------------- NTP vulnerability CVE-2017-6463. Security Advisory. Security Advisory Description. NTP before 4.2.8p10 and 4.3.x before ... --------------------------------------------- https://support.f5.com/csp/article/K02951273 *** Linux kernel vulnerability CVE-2017-8106 *** --------------------------------------------- Linux kernel vulnerability CVE-2017-8106. Security Advisory. Security Advisory Description. The handle_invept function ... --------------------------------------------- https://support.f5.com/csp/article/K34886212 *** Schneider Electric VAMPSET *** --------------------------------------------- This advisory contains mitigation details for a memory corruption vulnerability in Schneider Electric's VAMPSET. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-136-04 *** Detcon SiteWatch Gateway *** --------------------------------------------- This advisory contains mitigation details for authentication bypass and plaintext storage of a password vulnerabilities in Detcon's SiteWatch Gateway. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-136-01 *** Hanwha Techwin SRN-4000 *** --------------------------------------------- This advisory contains mitigation details for an unauthenticated access vulnerability in Hanwha Techwin's SRN-4000. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-136-03 *** Schneider Electric SoMachine HVAC *** --------------------------------------------- This advisory contains mitigation details for buffer overflow and DLL hijack vulnerabilities in Schneider Electric's SoMachine HVAC. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-136-02 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security Network Protection *** http://www-01.ibm.com/support/docview.wss?uid=swg21999513 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in IBM Java SDK affects IBM Algo One Algo Risk Application and Core (CVE-2016-5546, CVE-2016-5548, CVE-2016-5549, CVE-2016-5547, CVE-2016-2183) *** http://www.ibm.com/support/docview.wss?uid=swg22000818 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Installation Manager and IBM Packaging Utility *** http://www-01.ibm.com/support/docview.wss?uid=swg22003157 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Monitoring *** http://www.ibm.com/support/docview.wss?uid=swg22002865 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Integration Designer and WebSphere Integration Developer *** http://www-01.ibm.com/support/docview.wss?uid=swg22002555 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Tomcat affects IBM Algo One Core (CVE-2016-8745) *** http://www.ibm.com/support/docview.wss?uid=swg22001932 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in OpenSSH affects IBM Security Network Protection (CVE-2015-8325) *** http://www-01.ibm.com/support/docview.wss?uid=swg21999248 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime IBM affect IBM Decision Optimization Center and IBM ILOG ODM Enterprise *** http://www-01.ibm.com/support/docview.wss?uid=swg22003304 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM ILOG CPLEX Optimization Studio *** http://www-01.ibm.com/support/docview.wss?uid=swg22003305 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in GNU C library (glibc) affect IBM Security Network Protection *** http://www-01.ibm.com/support/docview.wss?uid=swg22001907 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Security Network Protection (CVE-2016-8610, and CVE-2017-3731) *** http://www-01.ibm.com/support/docview.wss?uid=swg21999162 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in NTP affect IBM Security Network Protection *** http://www-01.ibm.com/support/docview.wss?uid=swg21999246 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 16-05-2017
by Daily end-of-shift report 16 May '17

16 May '17

======================= = End-of-Shift report = ======================= Timeframe: Montag 15-05-2017 18:00 − Dienstag 16-05-2017 18:00 Handler: Petr Sikuta Co-Handler: Stephan Richter *** WannaCry? Do your own data analysis., (Tue, May 16th) *** --------------------------------------------- In God we trust. All others must bring data ~Bob Rudis With endless amounts of data, technical detail, and insights on WannaCrypt/WannaCry, and even more FUD, speculation, and even downright trolling, herein is a proposal for you to do your own data-driven security analysis. My favorite book to help you scratch that itch? Data Driven Security: Analysis, Visualization and Dashboards, by Jay Jacobs Bob Rudis. A few quick samples, using WannaCry data and R, the open source programming language and [...] --------------------------------------------- https://isc.sans.edu/diary.html?storyid=22424&rss *** Digital signature service DocuSign hacked and email addresses stolen *** --------------------------------------------- Digital signature service DocuSign said Monday that an unnamed third-party had got access to email addresses of its users after hacking into its systems.The hackers gained temporary access to a peripheral sub-system for communicating service-related announcements to users through email, the company said. It confirmed after what it described as a complete forensic analysis that only email addresses were accessed, and not other details such as names, physical addresses, passwords, social security [...] --------------------------------------------- http://www.cio.com/article/3196854/security/digital-signature-service-docus… *** Apple-Updates schließen unangenehme Sicherheitslücken in iCloud, iTunes und iOS *** --------------------------------------------- Patchday bei Apple: Das BSI warnt vor mehreren Sicherheitslücken in iTunes und iCloud auf Windows, sowie dem Mobilbetriebssystem iOS, die es Angreifern ermöglichen, Code auszuführen. Anwender sollten sicherstellen, dass die Updates installiert wurden --------------------------------------------- https://heise.de/-3715077 *** Chrome Browser Hack Opens Door to Credential Theft *** --------------------------------------------- Researchers at DefenseCode claim a vulnerability in Google's Chrome browser allows hackers to steal credentials and launch SMB relay attacks. --------------------------------------------- http://threatpost.com/chrome-browser-hack-opens-door-to-credential-theft/12… *** Cisco Snort++ Protocol Decoder Denial of Service Vulnerabilities *** --------------------------------------------- Two vulnerabilities in the protocol decoders of Snort++ (Snort 3) could allow an unauthenticated, remote attacker to create a Denial of Service (DoS) condition.The vulnerabilities are due to lack of validation in the protocol decoders. An attacker could exploit these vulnerabilities by crafting a malicious packet and sending it through the targeted device. A successful exploit could allow the attacker to cause a DoS condition if the Snort process restarts and traffic inspection is bypassed or [...] --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… *** Indicators Associated With WannaCry Ransomware *** --------------------------------------------- This alert is a follow-up to US-CERT alert TA17-132A Indicators Associated With WannaCry Ransomware, which was originally posted to the US-CERT web site on May 12, 2017. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-17-135-01 *** Novell Messenger 3.0.3 P3 *** --------------------------------------------- Abstract: Novell Messenger 3.0.3 P3 has been released. This release only includes fixes for the Linux platform. Please view the Change Log for modifications made to the program. There have also been changes to update security issues with the product. Please see the Security Fix section for details. NOTE: This version is not designed to work with eDir 9. If you require eDir 9 support, contact Micro Focus Technical Support. Document ID: 5296730Security Alert: YesDistribution Type: --------------------------------------------- https://download.novell.com/Download?buildid=U3MFbmzMet0~ *** IDM 4.6 RACF Driver 4.0.3.1 *** --------------------------------------------- Abstract: IDM 4.6 Bi-Directional RACF Driver Version 4.0.3.1. This patch is for the Identity Manager 4.6 RACF Driver. Field patch for IDMLOAD.XMT, SAMPLIB.XMT, RACFEXEC.XMTDocument ID: 5297291Security Alert: YesDistribution Type: Field Test FileEntitlement Required: YesFiles:idm46racf-patch1.tar.gz (2.66 MB)Products:Identity Manager 4.5Identity Manager 4.6Superceded Patches:IDM 4.0.2 RACF Driver Version 4.0.0.11 Patch 3 --------------------------------------------- https://download.novell.com/Download?buildid=LSTFMkrcRo0~ *** Apple Security Updates *** --------------------------------------------- *** macOS Sierra 10.12.5, Security Update 2017-002 El Capitan, and Security Update 2017-002 Yosemite *** https://support.apple.com/kb/HT207797 --------------------------------------------- *** iOS 10.3.2 *** https://support.apple.com/kb/HT207798 --------------------------------------------- *** watchOS 3.2.2 *** https://support.apple.com/kb/HT207800 --------------------------------------------- *** tvOS 10.2.1 *** https://support.apple.com/kb/HT207801 --------------------------------------------- *** iCloud for Windows 6.2.1 *** https://support.apple.com/kb/HT207803 --------------------------------------------- *** Safari 10.1.1 *** https://support.apple.com/kb/HT207804 --------------------------------------------- *** iTunes 12.6.1 for Windows *** https://support.apple.com/kb/HT207805 --------------------------------------------- *** IBM Security Bulletin *** --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM SPSS Statistics (CVE-2016-5548, CVE-2016-5549, CVE-2016-5547, CVE-2016-2183) *** http://www.ibm.com/support/docview.wss?uid=swg22002966 --------------------------------------------- *** IBM Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU Jan 2017 Includes Oracle Jan 2017 CPU affect Content Collector for SAP Applications *** https://www-01.ibm.com/support/docview.wss?uid=swg22001462 --------------------------------------------- *** IBM Security Bulletin: Multiple Mozilla Firefox vulnerability issues in IBM SONAS *** http://www.ibm.com/support/docview.wss?uid=ssg1S1010199 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in the zlib component affect IBM SPSS Statistics (CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843) *** http://www.ibm.com/support/docview.wss?uid=swg22003212 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Flex System Manager (FSM) *** http://www-01.ibm.com/support/docview.wss?uid=isg3T1025160 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in Informix Dynamic Server and Informix Open Admin Tool *** http://www.ibm.com/support/docview.wss?uid=swg22002897 --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in Expat affects HTTP Server shipped with Cloud Orchestrator and Cloud Orchestrator Enterprise (CVE-2016-4472, CVE-2016-0718) *** http://www.ibm.com/support/docview.wss?uid=swg2C1000234 --------------------------------------------- *** IBM Security Bulletin: Apache Commons FileUpload Vulnerabilities IBM WebSphere MQ (CVE-2016-3092) *** http://www.ibm.com/support/docview.wss?uid=swg22001563 --------------------------------------------- *** IBM Security Bulletin: Vulnerability CVE-2017-2619 in Samba affects IBM i *** http://www.ibm.com/support/docview.wss?uid=nas8N1022009 --------------------------------------------- *** IBM Security Bulletin: IBM Tivoli Federated Identity Manager is affected by a missing secure attribute in the encrypted session (SSL) cookie (CVE-2017-1319) *** http://www-01.ibm.com/support/docview.wss?uid=swg22002871 --------------------------------------------- *** IBM Security Bulletin: IBM Tivoli Federated Identity Manager is affected by a cross-site scripting vulnerability (CVE-2017-1320) *** http://www.ibm.com/support/docview.wss?uid=swg22002877 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in GnuTLS and OpenSSL affect IBM Flex System Manager (FSM) (CVE-2016-8610) *** http://www-01.ibm.com/support/docview.wss?uid=isg3T1024887 --------------------------------------------- *** IBM Security Bulletin: A Vulnerability in IBM Java SDK affects IBM Streams (CVE-2016-5546, CVE-2017-3253, CVE-2016-5548, CVE-2016-5549, CVE-2016-5547, CVE-2016-5552, CVE-2016-2183) *** http://www-01.ibm.com/support/docview.wss?uid=swg22002804 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 15-05-2017
by Daily end-of-shift report 15 May '17

15 May '17

======================= = End-of-Shift report = ======================= Timeframe: Freitag 12-05-2017 18:00 − Montag 15-05-2017 18:00 Handler: Stephan Richter Co-Handler: n/a *** Ransomware: Experten warnen vor Zahlung der Wanna-Crypt-Erpressersumme *** --------------------------------------------- Experten raten davon ab, im Falle einer Infektion mit Wanna Crypt die geforderten Bitcoins zu zahlen, denn offenbar sind die Angreifer vom Erfolg ihrer Operation überrascht. Ein kostenloses Werkzeug zum Wiederherstellen der Daten ist bislang auch nicht verfügbar. --------------------------------------------- https://www.golem.de/news/ransomware-experten-warnen-vor-zahlung-der-wanna-… *** WannaCry & Co.: So schützen Sie sich *** --------------------------------------------- Nach WannaCry ist vor dem nächsten Erpressungstrojaner. Was Gefährdete jetzt tun sollten, wie Sie sich vor Nachahmern schützen können und welche Optionen bleiben, wenn der Verschlüsselungstrojaner schon zugeschlagen hat. --------------------------------------------- https://heise.de/-3714596 *** Customer Guidance for WannaCrypt attacks *** --------------------------------------------- Microsoft solution available to protect additional products Today many of our customers around the world and the critical systems they depend on were victims of malicious "WannaCrypt" software. Seeing businesses and individuals affected by cyberattacks, such as the ones reported today, was painful. Microsoft worked throughout the day to ensure we understood the attack and... --------------------------------------------- https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-w… *** Security Alert: Uiwix Ransomware Is Here and It Can Be Worse Than Wannacry *** --------------------------------------------- WannaCry distribution may have dropped, but the ransomware pandemic is not over. As we feared in yesterday's alert, another ransomware variant, known as Uiwix, has begun to spread by exploiting the same vulnerability in Windows SMBv1 and SMBv2 as WannaCry used. Cyber criminals are quick to incorporate vulnerabilities, especially when they have huge potential of infection, [...] --------------------------------------------- https://heimdalsecurity.com/blog/security-alert-uiwix-ransomware/ *** Microsoft posts PowerShell script that spawns pseudo security bulletins *** --------------------------------------------- A Microsoft manager this week offered IT administrators a way to replicate -- in a fashion -- the security bulletins the company discarded last month."If you want a report summarizing todays #MSRC security bulletins, heres a script that uses the MSRC Portal API," John Lambert, general manager of the Microsoft Threat Intelligence Center, said in a Tuesday message on Twitter.Lamberts tweet linked to code depository GitHub, where he posted a PowerShell script that polled data using a new [...] --------------------------------------------- http://www.cio.com/article/3196254/windows/microsoft-posts-powershell-scrip… *** WannaCry/WannaCrypt Ransomware Summary, (Mon, May 15th) *** --------------------------------------------- The ransomware was first noticed on Fridayand spread very quickly through many large organizations worldwide [verge]. Unlike prior ransomware, this sample used the SMBv1 ETERNALBLUE exploit to spread. ETERNALBLUE became public about a month ago in April when it was published as part of the Shadowbroker archive of NSA hacking tools [shadow]. A month prior to the release of the hacking tool, Microsoft had patched the vulnerability as part of the March Patch Tuesday release. The patch was released [...] --------------------------------------------- https://isc.sans.edu/diary.html?storyid=22420&rss *** Ein paar Gedanken zu WannaCry *** --------------------------------------------- Wir haben heute unsere offizielle Warnung bezüglich der WannaCry Ransomware veröffentlicht. Ich will in diesem Blogbeitrag ein bisschen Kontext liefern, und etwas strategischer denken. --------------------------------------------- http://www.cert.at/services/blog/20170514232126-2007.html *** DSA-3852 squirrelmail - security update *** --------------------------------------------- Dawid Golunski and Filippo Cavallarin discovered that squirrelmail, awebmail application, incorrectly handled a user-supplied value. Thiswould allow a logged-in user to run arbitrary commands on the server. --------------------------------------------- https://www.debian.org/security/2017/dsa-3852 *** EMC Isilon OneFS NFS Export Upgrade *** --------------------------------------------- Topic: EMC Isilon OneFS NFS Export Upgrade Risk: Medium Text:ESA-2017-027: EMC Isilon OneFS NFS Export Upgrade Vulnerability EMC Identifier: ESA-2017-027 CVE Identifier: CVE-2017-49... --------------------------------------------- https://cxsecurity.com/issue/WLB-2017050087 *** Security Advisory - WannaCry ransomware Vulnerabilities in Microsoft Windows Systems *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170513-… *** Security Notice - Statement on "WannaCry ransomware" attacks *** --------------------------------------------- http://www.huawei.com/en/psirt/security-notices/2017/huawei-sn-20170513-01-… *** DRD Agent - Critical - Multiple vulnerabilities - SA-CONTRIB-2017-047 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2017-047Project: DRD agent (third-party module)Version: 6.x, 7.x, 8.xDate: 2017-May-10Security risk: 19/25 ( Critical) AC:Complex/A:None/CI:All/II:All/E:Theoretical/TD:AllVulnerability: Cross Site Request Forgery, Open RedirectDescriptionThe Drupal Remote Dashboard (DRD) module enables you to manage and monitor any remote Drupal site and, this module, the DRD Agent is the remote module which responds to requests from authorised DRD sites.The module doesnt [...] --------------------------------------------- https://www.drupal.org/node/2877392 *** DSA-3854 bind9 - security update *** --------------------------------------------- Several vulnerabilities were discovered in BIND, a DNS serverimplementation. The Common Vulnerabilities and Exposures projectidentifies the following problems: --------------------------------------------- https://www.debian.org/security/2017/dsa-3854 *** FortiPortal Multiple Vulnerabilities *** --------------------------------------------- Multiple vulnerabilities impacting FortiPortal were disclosed to Fortinet with details as follows:CVE-2017-7337: Improper Access Control allows a user to potentially view firewall policies and objects from a VDOM s/he is not authorized to, enumerate other customer ADOMs and view other customers dataCVE-2017-7338: Application returns password hashes, and passwords for associated FortiAnalyzer devices via the UICVE-2017-7339: Persistent XSS via the Name and Description fields in the pop-up to add [...] --------------------------------------------- http://fortiguard.com/psirt/FG-IR-17-114 *** DFN-CERT-2017-0842: Moodle: Mehrere Schwachstellen ermöglichen u.a. einen Cross-Site-Request-Forgery-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0842/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Samba vulnerability issue on IBM SONAS (CVE-2016-2125, CVE-2016-2126 ) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1010051 --------------------------------------------- *** IBM Security Bulletin: Multiple Mozilla Firefox vulnerability issues in IBM Storwize V7000 Unified. *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009957 --------------------------------------------- *** IBM Security Bulletin: Tomcat apache vulnerability affects IBM Storwize V7000 Unified *** http://www.ibm.com/support/docview.wss?uid=ssg1S1009993 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Storwize V7000 Unified (CVE-2016-5597) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1009995 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects IBM SONAS (CVE-2016-5597 ) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1009963 --------------------------------------------- *** IBM Security Bulletin: Open Source Apache Struts Vulnerabilities affect IBM Enterprise Records *** https://www-01.ibm.com/support/docview.wss?uid=swg22000471 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in Struts v2 affect IBM Enterprise Records *** https://www-01.ibm.com/support/docview.wss?uid=swg22000469 --------------------------------------------- *** IBM Security Bulletin: IBM Tivoli Federated Identity Manager is affected by an XML External Entity vulnerability (CVE-2016-2908) *** http://www.ibm.com/support/docview.wss?uid=swg22001175 ---------------------------------------------

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily