Daily

daily@lists.cert.at

1 participants
3085 discussions

Tageszusammenfassung - Mittwoch 25-11-2015
by Daily end-of-shift report 25 Nov '15

25 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 24-11-2015 18:00 − Mittwoch 25-11-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Unified CallManager and Unified Presence Server ICMP Echo Request Handling Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-… *** A $10 Tool Can Guess (And Steal) Your Next Credit Card Number *** --------------------------------------------- A pattern in AmEx card numbers allows Samy Kamkars DIY gadget to predict and use new numbers for fraud as fast as the company can generate them. --------------------------------------------- http://www.wired.com/2015/11/samy-kamkar-10-dollar-tool-can-guess-and-steal… *** High-Security, Open-Source Router is a Hit on Indiegogo (Video) *** --------------------------------------------- The device is called the Turris Omnia, and its Indiegogo page says its a "hi-performance & open-source router." Their fundraising goal is $100,000. So far, 1,191 backers have pledged $248,446 (as of the moment this was typed), with 49 days left .. --------------------------------------------- http://linux.slashdot.org/story/15/11/24/1940251/high-security-open-source-… *** Hilton Acknowledges Credit Card Breach *** --------------------------------------------- Two months after KrebsOnSecurity first reported that multiple banks suspected a credit card breach at Hilton Hotel properties across the country, Hilton has acknowledged an intrusion involving malicious software found on some point-of-sale systems. --------------------------------------------- http://krebsonsecurity.com/?p=33068 *** Xen VPMU Feature May Let Local Users Deny Service, Obtain Information, and Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1034230 *** Unwanted Software and Harmful Programs *** --------------------------------------------- We frequently clean blacklisted websites and submit reconsideration requests to have them de-listed. We have encountered many kinds of blacklist warnings including search engines, anti-virus programs, firewalls and and e-mail spam. Recently I came .. --------------------------------------------- https://blog.sucuri.net/2015/11/unwanted-software-and-harmful-programs.html *** Google kann nicht ohne weiteres geschützte Geräte entsperren *** --------------------------------------------- Ein Sicherheitsbericht des Bezirksstaatsanwalts von Manhattan berichtet von einer Hintertür, durch die Google auf richterlichen Beschluss in den USA auf bestimmte passwortgeschützte Android-Smartphones zugreifen können soll. Dem widerspricht jetzt ein Mitarbeiter des Android-Sicherheitsteams. --------------------------------------------- http://www.golem.de/news/android-sicherheit-google-kann-nicht-ohne-weiteres… *** House of Keys: Industry-Wide HTTPS Certificate and SSH Key Reuse Endangers Millions of Devices Worldwide *** --------------------------------------------- In the course of an internal research project we have analyzed the firmware images of more than 4000 embedded devices of over 70 vendors. The devices we have looked at include Internet gateways, routers, modems, IP cameras, VoIP phones, etc. We have specifically analyzed .. --------------------------------------------- http://blog.sec-consult.com/2015/11/house-of-keys-industry-wide-https.html *** DSDTestProvider: Weiteres gefährliches Dell-Zertifikat entdeckt *** --------------------------------------------- Auf Dell-Computern ist ein weiteres CA-Zertifikat mitsamt privatem Schlüssel entdeckt worden. Damit kann jeder gültige Zertifikate ausstellen und die Verschlüsselung von Webseiten ad absurdum führen. Der Patch zum Löschen von eDellRoot ist verfügbar. --------------------------------------------- http://heise.de/-3020134 *** Internet Explorer: Microsoft stellt Support für fast alle Versionen ein *** --------------------------------------------- Ab Mitte Jänner wird nur mehr der IE11 mit Sicherheitsupdates versorgt – Fast ein Viertel der Web-Nutzer betroffen. --------------------------------------------- http://derstandard.at/2000026383964 *** Amazon.com setzt Passwörter von Kunden zurück *** --------------------------------------------- Einige Amazon-Kunden in den USA und Großbritannien müssen sich ein neues Passwort ausdenken. Amazon hat die Passwörter zurückgesetzt - eine reine Vorsichtsmaßnahme, wie es heißt. Doch das Statement von Amazon ist teilweise widersprüchlich und lässt viele Fragen offen. --------------------------------------------- http://www.golem.de/news/security-amazon-com-setzt-passwoerter-von-kunden-z… *** When Your CEO Won't Take Security Awareness Training *** --------------------------------------------- CEOs are often the busiest people in any organization. As security professionals, we should respect that: but what can we do when our CEO won't take security awareness training? This is not uncommon but it can be a hard nut for security .. --------------------------------------------- http://resources.infosecinstitute.com/when-your-ceo-wont-take-security-awar… *** Does prevalence matter? A different approach to traditional antimalware test scoring *** --------------------------------------------- Most well-known antimalware tests today focus on broad-spectrum malware. In other words, tests include malware that is somewhat indiscriminate (isnt necessarily targeted), at least somewhat prevalent and sometimes very prevalent. Typically,.. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/11/25/does-prevalence-matter-a… *** Moxa OnCell Central Manager Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for hardcoded credentials and authentication bypass vulnerabilities in the Moxa OnCell Central Manager Software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-328-01 *** Tor-Betreiber starten Crowdfunding *** --------------------------------------------- Private Gelder sollen Abhängigkeit von US-Behörden reduzieren und Weiterentwicklung ermöglichen --------------------------------------------- http://derstandard.at/2000026409932 *** A Problem Shared *** --------------------------------------------- Information sharing has been a much discussed, but traditionally a hit-and-miss affair within the world of information security - after all, one's information can hardly be said to be secure if you're bandying it about to anyone who expresses .. --------------------------------------------- https://blog.team-cymru.org/2015/11/a-problem-shared/ *** Protecting Windows Networks - Dealing with credential theft *** --------------------------------------------- Credential theft is a huge problem, if you care to look at Verizon Data Breach reports over the years, you will see that use of stolen credentials was lingering at the top intrusion method for quite some time. They also prevalent in APT attacks. And why .. --------------------------------------------- https://dfirblog.wordpress.com/2015/11/24/protecting-windows-networks-deali… *** Ransomware Playbook - Guide for Handling Ransomware Infections *** --------------------------------------------- The following post demonstrates the writing process of a ransomware playbook for effective incident response and handling ransomware infections. --------------------------------------------- https://www.demisto.com/playbooks/playbook-for-handling-ransomware-infectio… *** Breach at IT Automation Firm LANDESK *** --------------------------------------------- LANDESK, a company that sells software to help organizations securely and remotely manage their fleets of desktop computers, servers and mobile devices, alerted employees last week that a data breach may have exposed their personal information. But LANDESK .. --------------------------------------------- http://krebsonsecurity.com/2015/11/breach-at-it-automation-firm-landesk

1 0

Tageszusammenfassung - Dienstag 24-11-2015
by Daily end-of-shift report 24 Nov '15

24 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 23-11-2015 18:00 − Dienstag 24-11-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Stealthy GlassRAT Spies on Commercial Targets *** --------------------------------------------- RSA has uncovered GlassRAT, a spy tool targeting commercial targets thats signed with a stolen certificate from a large developer in China. --------------------------------------------- http://threatpost.com/stealthy-glassrat-spies-on-commercial-targets/115453/ *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-… --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple vulnerabilities in Apache Commons affecting IBM products *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21971377 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21971376 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21971415 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21971412 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21971246 *** IBM Security Bulletin: Tivoli Storage Manager for Virtual Environments: Data Protection for VMware and Tivoli Storage FlashCopy Manager for VMware affected by operating system command vulnerability (CVE-2015-7426) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21971484 *** IBM Security Bulletin: IBM i Access for Windows affected by vulnerability CVE-2015-7416 *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=nas8N1020995 *** IBM Security Bulletin: IBM Smart Analytics System 5600 is affected by a vulnerability in IBM GPFS (CVE-2015-1788) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21969177 *** IBM Security Bulletin:Multiple vulnerabilities in IBM Java SDK affect Sytem Storage DS8000 *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ssg1S1005448 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect AppScan Standard (CVE-2015-2613, CVE-2015-2601, CVE-2015-4749, CVE-2015-2625, CVE-2015-1931) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21970847 *** Security Advisory - Overflow Vulnerabilities in SNMPv3 *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Worlds most complex cash register malware plunders millions in US *** --------------------------------------------- ModPos kernel monster threatens haul during festive shopping blitz The worlds most complex sales till malware has been discovered ... after it ripped millions of bank cards from US retailers .. --------------------------------------------- www.theregister.co.uk/2015/11/24/modpos_point_of_sale_malware/ *** Break a dozen secret keys, get a million more for free *** --------------------------------------------- For many years NIST has officially claimed that AES-128 has "comparable strength" to 256-bit ECC, namely 128 "bits of security". Ten years ago, in a talk "Is 2255−19 big enough?", I disputed this claim. The underlying attack algorithms had already been known for years, and its not hard to see their impact on key-size selection; but somehow NIST hadnt gotten .. --------------------------------------------- http://blog.cr.yp.to/20151120-batchattacks.html *** Steam Weak File Permissions Privilege Escalation *** --------------------------------------------- A low privileged user could modify the steam.exe binary and obtain code execution with elevated privileges upon an administrator login or execution of steam.exe --------------------------------------------- http://www.securityfocus.com/archive/1/536961 *** Security Advisory - Memory Overflow Vulnerability in the Huawei Smartphone *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Root-CA-Zertifikat: Dell will eDellRoot über Update entfernen *** --------------------------------------------- Dell versichert, dass Besitzer eines Dell-Computers das vom Hersteller standardmäßig installierte gefährliche CA-Zertifikat über ein Update deinstallieren oder per Hand dauerhaft entfernen können. --------------------------------------------- http://heise.de/-3015616 *** 3 Attacks on Cisco TACACS+: Bypassing the Ciscos auth *** --------------------------------------------- I would like to tell the results of my little security research of TACACS+ protocol. --------------------------------------------- http://agrrrdog.blogspot.ca/2015/11/3-attacks-on-cisco-tacacs-bypassing.html *** Hackers do the Haka - Part 1 *** --------------------------------------------- Haka is an open source network security oriented language that allows writing security rules and protocol dissectors. In this first part of a two-part series, we will focus on writing security rules. --------------------------------------------- http://thisissecurity.net/2015/11/23/hackers-do-the-haka-part-1/ *** Heap Overflow in PCRE *** --------------------------------------------- There are two variants of PCRE, the classic one and PCRE2. PCRE2 is not affected. ... If you use PCRE with potentially untrusted regular expressions you should update immediately. There is no immediate risk if you use regular expressions from a trusted source with an untrusted input. --------------------------------------------- https://blog.fuzzing-project.org/29-Heap-Overflow-in-PCRE.html *** Ermittlern gelingt Schlag gegen weltweit agierende Phisher-Bande *** --------------------------------------------- Das LKA Sachsen hat fünf Tatverdächtige verhaftet, die bandenmäßig mit Betrugsanrufen PIN-Codes für Online-Zahlungsgutscheine abgephisht haben sollen. --------------------------------------------- http://heise.de/-3016944 *** WP Page Widget <= 2.7 - Authenticated Reflected Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8317 *** Social Share Button <= 2.1 - Authenticated Persistent Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8326 *** Google kann Android-Geräte aus der Ferne entsperren *** --------------------------------------------- Google kann offensichtlich die Bildschirmsperren der meisten Android-Geräte auf Behördenanordnung zurücksetzen. Das geht aus dem Bericht eines New Yorker Bezirksstaatsanwalt hervor. Der einzige Schutz dagegen ist die Vollverschlüsselung. --------------------------------------------- http://heise.de/-3015984 *** WP Live Chat Support <= 4.3.5 - Unauthenticated Blind SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8343 *** WR ContactForm <= 1.1.9 - Authenticated SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8341

1 0

Tageszusammenfassung - Montag 23-11-2015
by Daily end-of-shift report 23 Nov '15

23 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 20-11-2015 18:00 − Montag 23-11-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Cisco TelePresence Video Communication Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Command and Control Server Detection: Methods & Best Practices *** --------------------------------------------- Botnet C&C servers issue commands in many ways Recently I discussed botnets and the way they represent an ongoing and evolving threat to corporate IT security. This time I'll be discussing .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/command-and-control-se… *** Cisco Networking Services Sensitive Information Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Deepsec: ZigBee macht Smart Home zum offenen Haus *** --------------------------------------------- ZigBee-Funknetze weisen nach neuen Erkenntnissen von Sicherheitsforschern eklatante Sicherheitsmängel auf. Die Technik wird beispielsweise bei der Steuerung von Türschlössern eingesetzt. --------------------------------------------- http://heise.de/-3010287 *** Blackberry Offers Lawful Device Interception Capabilities *** --------------------------------------------- An anonymous reader writes: Apple and Google have been vocal in their opposition to any kind of government regulation of cell phone encryption. BlackBerry, however, is taking a different stance, saying it specifically supports "lawful interception capabilities" .. --------------------------------------------- http://yro.slashdot.org/story/15/11/22/0048205/blackberry-offers-lawful-dev… *** JW Player 6 Plugin for Wordpress <= 2.1.14 - Authenticated Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8260 *** DSA-3401 openjdk-7 - security update *** --------------------------------------------- It was discovered that rebinding a receiver of a direct method handlemay allow a protected method to be accessed. --------------------------------------------- https://www.debian.org/security/2015/dsa-3401 *** Bugtraq: Proftpd v1.3.5a ZERODAY - Heap Overflows due to zero length mallocs. Advanced Information Security Corporation *** --------------------------------------------- Proftpd v1.3.5a ZERODAY - Heap Overflows due to zero length mallocs. Advanced Information Security Corporation --------------------------------------------- http://www.securityfocus.com/archive/1/536951 *** Data breach at firm that manages Cisco, Microsoft certifications *** --------------------------------------------- Pearson VUE says credentials manager product affected Cisco, IBM, Oracle and Microsofts certification management provider, Pearson VUE, has copped to a data breach following a malware .. --------------------------------------------- www.theregister.co.uk/2015/11/23/pearson_vue_data_breach_pcm/ *** Ist hier jemand Dell-Kunde? Die shippen anscheinend ... *** --------------------------------------------- Ist hier jemand Dell-Kunde? Die shippen anscheinend eine Backdoor-CA mit ihrem Windows.Aber, mal unter uns, wer sich irgendeinen PC kauft und nicht als erstes das Windows wegschmeisst und frisch neu installiert, dem ist eh nicht zu helfen.Daher war das ja .. --------------------------------------------- http://blog.fefe.de/?ts=a8adce6b *** WP Database Backup <= 3.3 - Authenticated Persistent Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8275 *** Pornography - A Favorite Costume For Android Malware *** --------------------------------------------- 30% of Internet traffic is in some way related to pornography and this is the primary reason why malware authors are using porn apps to infect large numbers of users. During recent data mining, we noticed an increasing volume of mobile malware using pornography (disguised as porn apps) to lure victims into different scams .. --------------------------------------------- http://research.zscaler.com/2015/11/pornography-favorite-costume-for.html

1 0

Tageszusammenfassung - Freitag 20-11-2015
by Daily end-of-shift report 20 Nov '15

20 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 19-11-2015 18:00 − Freitag 20-11-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** Trojanized adware family abuses accessibility service to install whatever apps it wants *** --------------------------------------------- Shedun does not exploit a vulnerability in the service, instead it takes advantage of the service's legitimate features. By gaining the permission to use the accessibility service, Shedun is able to read the text that appears on screen, determine if an application installation prompt is shown, scroll through the permission list, and finally, press the install button without any physical interaction from the user. --------------------------------------------- https://blog.lookout.com/blog/2015/11/19/shedun-trojanized-adware/ *** Tibbo AggreGate Platform Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Tibbo AggreGate SCADA/HMI package. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-323-01 *** When Hunting BeEF, Yara rules. *** --------------------------------------------- BeEF, The Browser Exploitation Framework, is a penetration-testing tool focusing on web browsers. You can think of it as the Metasploit for web browsers security testing. In fact, it offers several modules that may allow the attacker to, for example, steal web login credentials, switch on microphone and camera, etc. --------------------------------------------- https://isc.sans.edu/diary/When+Hunting+BeEF%2C+Yara+rules./20395 *** HTTP Evasions Explained - Part 8 - Borderline Robustness *** --------------------------------------------- This is part eight in a series which explains the evasions done by HTTP Evader. This part looks into the excessive and inconsistent robustness attempts done by the browser vendors and how this can be used to evade firewalls. --------------------------------------------- http://noxxi.de/research/http-evader-explained-8-borderline-robustness.html *** Nmap 7 Released! *** --------------------------------------------- I encounter many folks at security conferences who havent heard about all the modern Nmap capabilities and still just use it as a simple port scanner. Folks who dont use (or at least know about) NSE, Ncat, Nping, Zenmap, Ndiff, version detection and IPv6 scanning are really missing out! --------------------------------------------- http://seclists.org/nmap-announce/2015/6 *** contrast-rO0 *** --------------------------------------------- A lightweight Java agent for preventing attacks against object deserialization like those discussed by @breenmachine and the original researchers @frohoff and @gebl, affecting WebLogic, JBoss, Jenkins and more. --------------------------------------------- https://github.com/Contrast-Security-OSS/contrast-rO0 *** Metasploit module: Chkrootkit Local Privilege Escalation *** --------------------------------------------- Chkrootkit before 0.50 will run any executable file named /tmp/update as root, allowing a trivial privsec. CVE: CVE-2014-0476 --------------------------------------------- https://cxsecurity.com/issue/WLB-2015110179 *** ArcSight Management Center and ArcSight Logger vulnerable to cross-site scripting *** --------------------------------------------- ArcSight Management Center and ArcSight Logger contain a cross-site scripting vulnerability. --------------------------------------------- http://jvn.jp/en/jp/JVN51046809/ *** IBM Security Bulletin: IBM i Access for Windows affected by vulnerabilities CVE-2015-2023 and CVE-2015-7422 *** --------------------------------------------- IBM i Access for Windows is affected by vulnerabilities CVE-2015-2023 and CVE-2015-7422. These vulnerabilities affect the Windows system running the IBM i Access for Windows product. --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=nas8N1020996 *** IBM Security Bulletin: Multiple vulnerabilities in current releases of IBM WebSphere Real Time *** --------------------------------------------- Java SE issues disclosed in the Oracle October 2015 Critical Patch Update, plus CVE-2015-5006 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21970978

1 0

Tageszusammenfassung - Donnerstag 19-11-2015
by Daily end-of-shift report 19 Nov '15

19 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 18-11-2015 18:00 − Donnerstag 19-11-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** GovCERT.ch zu den DDoS-Erpressungen *** --------------------------------------------- Die Kollegen aus der Schweiz haben ausführlich zu den aktuellen Erpressungsversuchen (DD4BC/Armada Collective) gebloggt und auch eine Zusammenfassung über Mitigations-Massnahmen geschrieben. --------------------------------------------- http://www.cert.at/services/blog/20151119115219-1633.html *** BSI veröffentlicht Bericht zur Lage der IT-Sicherheit in Deutschland 2015 *** --------------------------------------------- Der Bericht zur Lage der IT-Sicherheit in Deutschland beschreibt und analysiert die aktuelle IT-Sicherheitslage, die Ursachen von Cyber-Angriffen sowie die verwendeten Angriffsmittel und -methoden. Daraus abgeleitet thematisiert der Lagebericht Lösungsansätze zur Verbesserung der IT-Sicherheit in Deutschland. Der Lagebericht verdeutlicht, dass die Anzahl der Schwachstellen und Verwundbarkeiten in IT-Systemen weiterhin auf einem hohen Niveau liegt und ... --------------------------------------------- https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2015/Lage_der_IT… *** ARRIS Cable Modem has a Backdoor in the Backdoor *** --------------------------------------------- While researching on the subject, I found a previously undisclosed backdoor on ARRIS cable modems, affecting many of their devices including TG862A, TG862G, DG860A. As of this writing, Shodan searches indicate that the backdoor affects over 600.000 externally accessible hosts and the vendor did not state whether its going to fix it yet. --------------------------------------------- https://w00tsec.blogspot.co.at/2015/11/arris-cable-modem-has-backdoor-in.ht… *** BSI veröffentlicht Sicherheitsstudie zu TrueCrypt *** --------------------------------------------- Im Auftrag des Bundesamtes für Sicherheit in der Informationstechnik (BSI) untersuchte das Fraunhofer-Institut für Sichere Informationstechnologie SIT die Verschlüsselungssoftware TrueCrypt auf Sicherheitslücken. ... Die Sicherheitsexperten kommen zu dem Ergebnis, dass TrueCrypt weiterhin für die Verschlüsselung von Daten auf Datenträgern geeignet ist. --------------------------------------------- https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2015/Sicherheits… *** ZDI-15-570: SQLite fts3_tokenizer Untrusted Pointer Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SQLite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/U5RlY6kAls0/ *** Encrypt - Moderately Critical - Weak Encryption - SA-CONTRIB-2015-166 *** --------------------------------------------- This module enables you to encrypt data within Drupal using a user-configurable encryption method and key provider. The module did not sufficiently validate good configurations and api usage resulting in multiple potential weaknesses ... --------------------------------------------- https://www.drupal.org/node/2618362 *** Actors using exploit kits - How they change tactics, (Thu, Nov 19th) *** --------------------------------------------- Introduction Exploit kits (EKs) are used by criminals to infect unsuspecting users while they are browsing the web. EKs are hosted on servers specifically dedicated to the EK. How are the users computers directed to an EK? It happens through compromised websites. Threat actors compromise legitimate websites, and pages from these compromised servers have injected script that connects the users computer to an EK server. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20391&rss *** NVIDIA Driver Windows Control Panel Unquoted Search Path Lets Local Users Gain Elevated Privileges *** --------------------------------------------- The NVIDIA Control Panel executable Smart Maximize Helper (nvSmartMaxApp.exe) uses an unquoted path when launching process threads. A local user can place a specially crafted program in certain locations in the search path to cause arbitrary code to be executee with elevated privileges during Windows startup. --------------------------------------------- http://www.securitytracker.com/id/1034175 *** NVIDIA 3D Driver for Windows Named Pipe Access Control Flaw Lets Remote Authenticated Users Gain Elevated Privileges *** --------------------------------------------- The 3D Driver's 'Vision service' (nvSCPAPISvr.exe) creates a named pipe without proper access controls. A local user or a remote authenticated user can create a specially crafted run key entry to execute arbitrary command line statements with the privileges of the target user. In a Windows Domain environment, a remote authenticated user with access to a domain-joined system can exploit this flaw within the joined domain. --------------------------------------------- http://www.securitytracker.com/id/1034173 *** Microsoft Security Intelligence Report: Strontium *** --------------------------------------------- The Microsoft Security Intelligence Report (SIR) provides a regular snapshot of the current threat landscape, using data from more than 600 million computers worldwide. The latest report (SIRv19) was released this week and includes a detailed analysis of the actor group STRONTIUM - a group that uses zero-day exploits to collect the sensitive information of high-value targets in government and political organizations. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/11/18/microsoft-security-intel… *** NVIDIA NVAPI and Kernel Mode Driver Bugs Let Local Users Deny Service, Obtain Potentially Sensitive Information, and Gain Elevated Privielges *** --------------------------------------------- The NVAPI support layer of NVIDIA GPU graphics drivers does not properly validate user-supplied input. In addition, an integer overflow may occur in the kernel mode driver. A local user can exploit these vulnerabilities to potentially sensitive information, deny service, or execute arbitrary code on the target system with elevated privileges. --------------------------------------------- http://www.securitytracker.com/id/1034176 *** Open-Xchange Guard 2.0 Cross Site Scripting *** --------------------------------------------- Topic: Open-Xchange Guard 2.0 Cross Site Scripting Risk: Low Text:Product: Open-Xchange Guard Vendor: Open-Xchange GmbH Internal reference: 41466 (Bug ID) Vulnerability type: Cross-Site-Sc... --------------------------------------------- https://cxsecurity.com/issue/WLB-2015110166 *** Edgy online shoppers face Dyre Christmas as malware mutates *** --------------------------------------------- Bank-plundering code now hunts Windows 10 and its Edge browser VXers have cooked up Windows 10 and Edge support for the nasty Dyre or Dyreza banking trojan. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/11/19/edgy_online… *** Windows Sandbox Attack Surface Analysis *** --------------------------------------------- TL;DR; I've released my tools I use internally to test out sandboxed code and determine the likely attack surface exposed to an attacker if a sandboxed process is compromised. You can get the source code from https://github.com/google/sandbox-attacksurface-analysis-tools. This blog post will describe a few common use cases so that you can use them to do your own sandbox analysis. --------------------------------------------- http://googleprojectzero.blogspot.co.at/2015/11/windows-sandbox-attack-surf… *** Bugtraq: CVE-2015-8131: Kibana CSRF vulnerability *** --------------------------------------------- Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a CSRF attack. We have been assigned CVE 2015-8131 for this issue. CVSS Score: 4.0 Remediation: We recommend that all Kibana users upgrade to either 4.1.3, 4.2.1, or a later version. --------------------------------------------- http://www.securityfocus.com/archive/1/536935 *** Russian financial cybercrime: how it works *** --------------------------------------------- The Russian-language cybercrime market is known all over the world. Kaspersky Lab experts have been monitoring the Russian hacker underground since its emergence. In this review we analyze how financial cybercrime works. --------------------------------------------- http://securelist.com/analysis/publications/72782/russian-financial-cybercr… *** VMSA-2015-0008 *** --------------------------------------------- vCenter Server, vCloud Director, Horizon View information disclosure issue VMware products that use Flex BlazeDS may be affected by a flaw in the processing of XML External Entity (XXE) requests. A specially crafted XML request sent to the server could lead to unintended information be disclosed. ... The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2015-3269 to this issue. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0008.html *** Cisco Unified Interaction Manager Cross-Site Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web chat interface of Cisco Unified Interaction Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the chat on the affected system. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-… *** IBM Security Bulletin: Vulnerability in Apache Commons affects IBM WebSphere Application Server (CVE-2015-7450) *** --------------------------------------------- An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by WebSphere Application Server and WebSphere Application Server Hypervisor Edition. This vulnerability does not affect the IBM HTTP Server or versions of WebSphere Application Server prior to Version 7.0. --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21970575

1 0

Tageszusammenfassung - Mittwoch 18-11-2015
by Daily end-of-shift report 18 Nov '15

18 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 17-11-2015 18:00 − Mittwoch 18-11-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Adobe releases out-of-band security patches - amazingly not for Flash *** --------------------------------------------- ColdFusion, LiveCycle and Premiere get fixed ... Adobe says that it hasnt seen any evidence that these flaws are being exploited in the wild, but that users should patch anyway, just to be on the safe side - certainly before hackers reverse-engineer the updates and start abusing the bugs... --------------------------------------------- http://www.theregister.co.uk/2015/11/17/adobe_releases_outofband_security_p… *** Introducing Chuckle and the importance of SMB signing *** --------------------------------------------- Digital signing is a feature of SMB designed to allow a recipient to confirm the authenticity of SMB packets and to prevent tampering during transit - this feature was first made available back in Windows NT 4.0 Service Pack 3. By default, only domain controllers require packets to be signed and this default behavior is usually seen in most corporate networks. --------------------------------------------- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2015/novem… *** Team Cymru: Free tools for incident response *** --------------------------------------------- We at Team Cymru would like to be helpful to incident response vendors in implementing the USG's growing security strategy. To that end, we have identified a few of our free community resources (and one commercial service) that would be most useful to IR. --------------------------------------------- https://blog.team-cymru.org/2015/11/free-tools-for-incident-response-and-a-… *** How two seconds become two days *** --------------------------------------------- At 3:37PM PST, we had a power blip in one of our datacenters. In those two seconds, over 1,000 systems blinked offline. As a non-profit, we don't have all of those niceties such as hot-hot datacenters or those new fangled UPSes. Instead, we do it the old fashioned way, which means we are susceptible to... --------------------------------------------- http://blog.shadowserver.org/2015/11/17/how-two-seconds-become-two-days/ *** A flaw in D-Link Switches opens corporate networks to hack *** --------------------------------------------- A flaw in certain D-Link switches can be exploited by remote attackers to access configuration data and hack corporate networks. The independent security researcher Varang Amin and the chief architect at Elastica's Cloud Threat Labs Aditya Sood have discovered a vulnerability in the D-Link Switches belonging to the DGS-1210 Series Gigabit Smart Switches. The security experts revealed... --------------------------------------------- http://securityaffairs.co/wordpress/42054/hacking/d-link-switches-flaw.html *** Blast from the Past: Blackhole Exploit Kit Resurfaces in Live Attacks *** --------------------------------------------- The year is 2015 and a threat actor is using the defunct Blackhole exploit kit in active drive-by download campaigns via compromised websites.Categories: ExploitsTags: drive-by downloadsexploitexploit kitwebsite(Read more...) --------------------------------------------- https://blog.malwarebytes.org/exploits-2/2015/11/blast-from-the-past-blackh… *** Google VirusTotal - now with autoanalysis of OS X malware *** --------------------------------------------- Google just announced that its virus classification and auto-analysis service, VirusTotal, is now officially interested in OS X malware. --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/buCfkbvoJqQ/ *** Nishang: A Post-Exploitation Framework *** --------------------------------------------- Introduction I was recently doing an external penetration test for one of our clients, where I got shell access to Windows Server 2012(Internal WebServer sitting behind an IPS) with Administrative Privileges. It also appears to have an Antivirus installed on the system as everything I was uploading on to the machine was being deleted on... --------------------------------------------- http://resources.infosecinstitute.com/nishang-a-post-exploitation-framework/ *** 10 dumb security mistakes sys admins make *** --------------------------------------------- Security isn't merely a technical problem -- its a people problem. There's only so much technology you can throw at a network before dumb human mistakes trip you up.But guess what? Those mistakes are often committed by the very people who should know better: system administrators and other IT staff.[ Also on InfoWorld: 10 security mistakes that will get you fired. | Deep Dive: How to rethink security for the new world of IT. | Discover how to secure your systems with InfoWorlds... --------------------------------------------- http://www.cio.com/article/3006147/security/10-dumb-security-mistakes-sys-a… *** SANS Pentest Sumit: Evil DNS tricks by Ron Bowes - slide deck *** --------------------------------------------- Things Im gonna talk about: * How to use DNS in pentesting * How to use DNSs indirect nature * DNS tunnelling (dnscat2) --------------------------------------------- https://docs.google.com/presentation/d/1Jxh6PPO9JbUqXwOCTQFyA00uQoFMDBh-1Pe… *** Cyber Security Assessment Netherlands 2015: cross-border cyber security approach necessary *** --------------------------------------------- The CSAN has five Core Findings: * Cryptoware and other ransomware constitute the preferred business model for cyber criminals * Geopolitical tensions manifest themselves increasingly often in (impending) digital security breaches * Phishing is often used in targeted attacks and can barely be recognised by users * Availability becomes more important as alternatives to IT systems are disappearing * Vulnerabilities in software are still the Achilles heel of digital security --------------------------------------------- https://www.ncsc.nl/english/current-topics/Cyber+Security+Assessment+Nether… *** Inside the Conficker-Infected Police Body Cameras *** --------------------------------------------- A Florida integrator who discovered the Conficker worm lurking in body cameras meant for police use takes Threatpost inside the story, including a frustrating disclosure with a disbelieving manufacturer. --------------------------------------------- http://threatpost.com/inside-the-conficker-infected-police-body-cameras/115… *** EMC VPLEX GeoSynchrony Default Log Level Lets Local Users View Passwords *** --------------------------------------------- http://www.securitytracker.com/id/1034169 *** F5 security advisory: NTP vulnerability CVE-2015-5300 *** --------------------------------------------- A man-in-the-middle attacker able to intercept network time protocol (NTP) traffic between a connecting client and an NTP server could use this flaw to force that client to make multiple steps larger than the panic threshold, effectively changing the time to an arbitrary value at any time. --------------------------------------------- https://support.f5.com/kb/en-us/solutions/public/k/10/sol10600056.html?ref=… *** Atlassian Hipchat XSS to RCE *** --------------------------------------------- Topic: Atlassian Hipchat XSS to RCE Risk: Medium Text:Two issues exist in Atlassian’s HipChat desktop client that allow an attacker to retrieve files or execute remote code when a... --------------------------------------------- https://cxsecurity.com/issue/WLB-2015110164 *** [HTB23272]: RCE and SQL injection via CSRF in Horde Groupware *** --------------------------------------------- Product: Horde Groupware v5.2.10 Vulnerability Type: Cross-Site Request Forgery [CWE-352]Risk level: High Creater: http://www.horde.orgAdvisory Publication: September 30, 2015 [without technical details]Public Disclosure: November 18, 2015 CVE Reference: CVE-2015-7984 CVSSv2 Base Score: 8.3 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H] Vulnerability Details: High-Tech Bridge Security Research Lab discovered three Cross-Site Request Forgery (CSRF) vulnerabilities in a popular collaboration... --------------------------------------------- https://www.htbridge.com/advisory/HTB23272 *** Security Advisory - Information Leak Vulnerability in Huawei DSM Product *** --------------------------------------------- There is a information leak vulnerability in DSM (Document Security Management) Product. The DSM does not clear the clipboard after data in a secure file opened using the DSM is copied and the secure file is closed. Data in the clipboard can be copied in common documents that do not use the DSM, leading to information leaks. (Vulnerability ID: HWPSIRT-2015-09009) Huawei has released software updates to fix these vulnerabilities. --------------------------------------------- http://www1.huawei.com/en/security/psirt/security-bulletins/security-adviso… *** Symantec Endpoint Protection Elevation of Privilege Issues SYM15-011 *** --------------------------------------------- 11/16/2015 - Assigned a new CVE ID, CVE-2015-8113 and Bugtraq ID 77585, to the SEP Client Binary Planting Partial Fix to differentiate between the original fix released in 12.1-RU6-MP1 and the updated issue and fix released in 12.1-RU6-MP3 --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Cisco Security Advisories *** --------------------------------------------- *** Cisco Firepower 9000 USB Kernel Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Firepower 9000 Command Injection at Management I/O Command-Line Interface Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Firepower 9000 Persistent Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Firepower 9000 Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Firepower 9000 Series Switch Clickjacking Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Firepower 9000 Arbitrary File Read Access Script Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Commons affects IBM WebSphere Application Server (CVE-2015-4852) *** http://www.ibm.com/support/docview.wss?uid=swg21970575 --------------------------------------------- *** IBM Security Bulletin: IBM Sterling B2B Integrator has Cross Site Scripting vulnerabilities in Queue Watcher (CVE-2015-7431) *** http://www.ibm.com/support/docview.wss?uid=swg21970676 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Version 1.5.0 and 1.7.0 affect IBM Flex System Manager (FSM) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022835 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK 7 affect IBM Systems Director Storage Control (CVE-2015-2613 CVE-2015-2601 CVE-2015-2625 CVE-2015-1931 ) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022936 --------------------------------------------- *** IBM Security Bulletin: IBM Tivoli Monitoring (CVE-2015-1829, CVE-2015-3183, CVE-2015-1283, CVE-2015-4947, CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21970056 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Version 1.5.0 and 1.7.0 affect IBM Flex System Manager (FSM) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022820 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 17-11-2015
by Daily end-of-shift report 17 Nov '15

17 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 16-11-2015 18:00 − Dienstag 17-11-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Cyber crooks actively hijacking servers with unpatched vBulletin installations *** --------------------------------------------- Administrators of vBulletin installations would do well to install the latest vBulletin Connect updates as soon as possible, as cyber crooks are actively searching for servers running vulnerable versi... --------------------------------------------- http://www.net-security.org/secworld.php?id=19113 *** Windows driver signing bypass by Derusbi *** --------------------------------------------- Derusbi is an infamous piece of malware. The oldest identified version was compiled in 2008. It was used on well-known hacks such as the Mitsubishi Heavy Industries hack discovered in October 2011 or the Anthem hack discovered in 2015. --------------------------------------------- http://www.sekoia.fr/blog/windows-driver-signing-bypass-by-derusbi/ *** Developers Are (still) From Mars, Infosec People (still) From Venus *** --------------------------------------------- In March 2011, Brian Honan contributed to an issue of the INSECURE magazine with an article called "Management are from Mars, information security professional are from Venus". This title comes from the John Gray's worldwide bestseller where he presents the relations between men and women. Still today, we can reuse this subject for many purposes. Last week, I... --------------------------------------------- https://blog.rootshell.be/2015/11/17/developers-mars-infosec-people-venus/ *** Why Algebraic Eraser may be the riskiest cryptosystem you've never heard of *** --------------------------------------------- Researchers say there's a fatal flaw in proposed "Internet of things" standard. --------------------------------------------- http://arstechnica.com/security/2015/11/why-algebraic-eraser-may-be-the-mos… *** Cyber Security Assessment Netherlands 2015: cross-border cyber security approach necessary *** --------------------------------------------- Cybercrime and digital espionage remain the largest threat to digital security in the Netherlands. Geopolitical developments like international conflicts and political sensitivities have a major impact on the scope of this threat. These are key findings from the Cyber Security Assessment Netherlands (CSAN), presented to the House of Representatives by State Secretary Dijkhoff in October, and now available in English. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/cyber-security-assessment-n… *** Gas- und Öl-Industrie: Leichte Ziele für Hacker *** --------------------------------------------- Sicherheitsforscher warnen davor, dass Cyber-Kriminelle mit vergleichsweise einfachen Methoden einen Großteil der weltweiten Öl-Produktion kontrollieren könnten. --------------------------------------------- http://heise.de/-2922912 *** Bugtraq: Open-Xchange Security Advisory 2015-11-17 *** --------------------------------------------- PGP public keys allow to specify arbitrary "User ID" information that gets encoded to the public key and is presented to OX Guard users at "Guard PGP Settings". Public keys containing such content are still valid. Therefor they can be distributed and in case the uid field contains javascript code, they can be used to inject code. --------------------------------------------- http://www.securityfocus.com/archive/1/536923 *** Cisco Firepower 9000 Unauthenticated File Access Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** D-Link DIR-645 UPNP Buffer Overflow *** --------------------------------------------- Topic: D-Link DIR-645 UPNP Buffer Overflow Risk: High Text:## Advisory Information Title: Dlink DIR-645 UPNP Buffer Overflow Vendors contacted: William Brown <william.brown(a)dlink.com... --------------------------------------------- https://cxsecurity.com/issue/WLB-2015110133 *** D-Link DIR-815 Buffer Overflow / Command Injection *** --------------------------------------------- Topic: D-Link DIR-815 Buffer Overflow / Command Injection Risk: High Text:## Advisory Information Title: DIR-815 Buffer overflows and Command injection in authentication and HNAP functionalities Ve... --------------------------------------------- https://cxsecurity.com/issue/WLB-2015110135 *** Huawei Security Notice - Statement on Seclists.org Revealing Security Vulnerability in Huawei P8 Smart Phone *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices…

1 0

Tageszusammenfassung - Montag 16-11-2015
by Daily end-of-shift report 16 Nov '15

16 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 13-11-2015 18:00 − Montag 16-11-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** BitLocker encryption can be defeated with trivial Windows authentication bypass *** --------------------------------------------- Companies relying on Microsoft BitLocker to encrypt the drives of their employees computers should install the latest Windows patches immediately. A researcher disclosed a trivial Windows authentication bypass, fixed earlier this week, that puts data on BitLocker-encrypted drives at risk.Ian Haken, a researcher with software security testing firm Synopsys, demonstrated the attack Friday at the Black Hat Europe security conference in Amsterdam. The issue affects Windows computers that are part... --------------------------------------------- http://www.cio.com/article/3005178/bitlocker-encryption-can-be-defeated-wit… *** The November 2015 issue of our SWITCH Security Report is available! *** --------------------------------------------- Dear Reader! A new issue of our monthly SWITCH Security Report has just been released. The topics covered in this report are: No safe harbour in the Land of the Free - EU Court of Justice restricts data transfer to... --------------------------------------------- http://securityblog.switch.ch/2015/11/13/the-november-2015-issue-of-our-swi… *** Websicherheit: Datenleck durch dynamische Skripte *** --------------------------------------------- Moderne Webseiten erstellen häufig dynamischen Javascript-Code. Wenn darin private Daten enthalten sind, können fremde Webseiten diese auslesen. Bei einer Untersuchung von Sicherheitsforschern war ein Drittel der untersuchten Webseiten von diesem Problem betroffen. --------------------------------------------- http://www.golem.de/news/websicherheit-datenleck-durch-dynamische-skripte-1… *** Op-ed: (How) did they break Diffie-Hellman? *** --------------------------------------------- Relax - its not true that researchers have broken the Diffie-Hellman key exchange protocol. --------------------------------------------- http://arstechnica.com/security/2015/11/op-ed-how-did-they-break-diffie-hel… *** More POS malware, just in time for Christmas *** --------------------------------------------- VXers stuff evidence-purging malware in retailer stockings. Threat researchers are warning of two pieces of point of sales malware that have gone largely undetected during years of retail wrecking and now appear likely to earn VXers a haul over the coming festive break. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/11/16/more_pos_ma… *** Black Hat Europe 2015 slides *** --------------------------------------------- briefings - november 12-13 --------------------------------------------- https://www.blackhat.com/eu-15/briefings.html *** Choosing the Right Cryptography Library for your PHP Project: A Guide *** --------------------------------------------- ... conventional wisdom states that you almost certainly should not try to design your own cryptography. Instead, you should use an existing cryptography library. Okay, great. So which PHP cryptography library should I use? That depends on your exact requirements. Lets look at some good choices. (We wont cover any terrible choices.) --------------------------------------------- https://paragonie.com/blog/2015/11/choosing-right-cryptography-library-for-… *** Apple OS X authentication issue when recovering from sleep mode *** --------------------------------------------- When Apple Remote Desktop is used in full screen mode and the remote connection is alive upon entering sleep mode, the text entered in the dialog box upon recovering from sleep mode is sent to the remotely connected host instead of the local host. This may result in command execution at the remote host. --------------------------------------------- http://jvn.jp/en/jp/JVN56210048/index.html *** Programmbibliothek libpng verlangt nach Sicherheitsupdates *** --------------------------------------------- Eine Schwachstelle in libpng kann als Einfallstor für Angreifer dienen, um Anwendungen zum Absturz zu bringen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Programmbibliothek-libpng-verlangt-n… *** Container: CoreOS gibt CVE-Service als Open Source frei *** --------------------------------------------- Der Linux-Distributor CoreOS hat sein Container-Security-Werkzeug Clair als Open-Source-Software freigegeben. Das Tool ist in der Lage, jede einzelne Containerschicht nach Schwachstellen zu durchforsten und im Falle eines Fundes eine Meldung über die Art der Bedrohung zu übermitteln. Hierfür greift Clair auf die CVE-Datenbank (Common Vulnerabilities and Exposures) und ähnliche Ressourcen von Red Hat, Ubuntu, und Debian zurück. Clair hilft allerdings nicht, die... --------------------------------------------- http://www.heise.de/newsticker/meldung/Container-CoreOS-gibt-CVE-Service-al… *** LiME - Linux Memory Extractor *** --------------------------------------------- Features Full Android memory acquisition Acquisition over network interface Minimal process footprint --------------------------------------------- http://www.kitploit.com/2015/11/lime-linux-memory-extractor.html *** DD4BC / Armada Collective: Erpressung mittels DDoS *** --------------------------------------------- DD4BC / Armada Collective: Erpressung mittels DDoS16. November 2015Das ist mal wieder nichts wirklich Neues. Distributed Denial of Service Angriffe gibt es schon lange, das mag mit Turf-Fights in der Rotlicht-Szene angefangen haben, der Angriff auf Estland 2007 hat das Thema groß in die Presse gebracht, und spätestens seit den Angriffen der "Anonymous"-Bewegung sollte das Problem allgemein bekannt sein. Dazu gibt es auch einen Abschnitt in unserem letzten... --------------------------------------------- http://www.cert.at/services/blog/20151116114639-1627.html *** BlackBerry Enterprise Server Input Validation Flaw in Management Console Lets Remote Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1034154 *** D-link wireless router DIR-816L Cross-Site Request Forgery (CSRF) vulnerability *** --------------------------------------------- Cross-Site Request Forgery (CSRF) vulnerability in the DIR-816L wireless router enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated. --------------------------------------------- http://www.securityfocus.com/archive/1/536886 *** Debian: strongswan security update *** --------------------------------------------- Tobias Brunner found an authentication bypass vulnerability in strongSwan, an IKE/IPsec suite. Due to insufficient validation of its local state the server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin can be tricked into successfully concluding the authentication without providing valid credentials. --------------------------------------------- https://lists.debian.org/debian-security-announce/2015/msg00303.html *** Cisco Security Advisories *** --------------------------------------------- *** Cisco Videoscape Distribution Suite Service Manager Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco IOS Software Virtual PPP Interfaces Security Bypass Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco FireSIGHT Management Center Certificate Validation Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Prime Collaboration Assurance Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- *** Apache Commons Vulnerability for handling Java object deserialization *** http://www.ibm.com/support/docview.wss?uid=swg21970575 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in GSKit affects IBM DataPower Gateways (CVE-2015-1788) *** http://www.ibm.com/support/docview.wss?uid=swg21969271 --------------------------------------------- *** IBM Security Bulletin: Certain cookies missing Secure attribute in IBM DataPower Gateways (CVE-2015-7427) *** http://www.ibm.com/support/docview.wss?uid=swg21969342 --------------------------------------------- *** Security Bulletin: Vulnerabilities in OpenSSL affect IBM System Networking RackSwitch (CVE-2015-1788, CVE-2015-1789, CVE-2015-1792) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098801 --------------------------------------------- *** IBM Security Bulletin: IBM Cúram Social Program Management contains an Apache Batik Vulnerability (CVE-2015-0250) *** http://www.ibm.com/support/docview.wss?uid=swg21970112 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in current releases of the IBM SDK, Java Technology Edition *** http://www.ibm.com/support/docview.wss?uid=swg21969225 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in qemu-kvm affects IBM SmartCloud Provisioning for IBM Software Virtual Appliance *** http://www.ibm.com/support/docview.wss?uid=swg21968929 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in FUSE affects PowerKVM (CVE-2015-3202) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022878 --------------------------------------------- *** IBM Security Bulletin: Lotus Protector for Mail Security affected by Opensource PHP Vulnerabilities (CVE-2015-6836 CVE-2015-6837 CVE-2015-6838) *** http://www.ibm.com/support/docview.wss?uid=swg21968353 --------------------------------------------- *** IBM Security Bulletin: GPFS security vulnerabilities in IBM SONAS (CVE-2015-4974 and CVE-2015-4981) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005425 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Mozilla gdk-pixbuf2 affects PowerKVM (CVE-2015-4491) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022833 --------------------------------------------- *** Vulnerability in bind affects AIX (CVE-2015-5722) *** http://www.ibm.com/support/ ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 13-11-2015
by Daily end-of-shift report 13 Nov '15

13 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 12-11-2015 18:00 − Freitag 13-11-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Using Facebook to log in - safe or not? *** --------------------------------------------- Open up your favorite web site and you can see what this is about right away. There are in many cases two options, an ordinary log-in and "Log in with Facebook". Have you been using the Facebook option? It is quite convenient, isn't it? I was talking to a journalist about privacy a while ago... --------------------------------------------- http://safeandsavvy.f-secure.com/2015/11/12/using-facebook-to-log-in-safe-o… *** MIG Mozilla InvestiGator *** --------------------------------------------- Search through your infrastructure in real-time from the command line --------------------------------------------- https://jve.linuxwall.info/ressources/taf/LISA15/ *** ZipInputStream Armageddon *** --------------------------------------------- Again, again, again .. and again these bugs are turning up because of the general lack of validation occurring on the ZIP contents. In most cases this is probably due to the fact that developers are making assumptions that these ZIP files are not being tampered with, and therefore dont really consider the ramifications. --------------------------------------------- http://rotlogix.com/2015/11/12/zipinputstream-armageddon/ *** botfrei.de: Werbeblocker-Sanktionen "der falsche Weg" *** --------------------------------------------- Das "Anti-Botnet Beratungszentrums" botfrei.de und der Betreiber, der eco Verband der Internetwirtschaft, halten Online-Werbung für wichtig. Sanktionen gegen Werbeblocker würden aber wichtige Nutzerinteressen unberücksichtigt lassen. --------------------------------------------- http://heise.de/-2920022 *** One BadBarcode Spoils Whole Bunch *** --------------------------------------------- At PacSec 2015, researchers demonstrated attacks using poisoned barcodes scanned by numerous keyboard wedge barcode scanners to open a shell on a machine and virtually type control commands. --------------------------------------------- http://threatpost.com/one-badbarcode-spoils-whole-bunch/115362/ *** Google Reconnaissance, Sprinter-style, (Fri, Nov 13th) *** --------------------------------------------- When doing security assessments or penetration tests, theres a significant amount of findings that you can get from search engines. For instance, if a client has sensitive information or any number of common vulnerabilities, you can often find those with a Google or Bing search, without sending a single packet to the clients infrastructure. This concept is called google dorking, and was pioneered by Johnny Long back in the day (he has since moved on to other projects see... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20375&rss *** Researchers Discover Two New Strains of POS Malware *** --------------------------------------------- Two new and different strains of point of sale malware have come to light, including one that's gone largely undetected for the past five years. --------------------------------------------- http://threatpost.com/researchers-discover-two-new-strains-of-pos-malware/1… *** Spring Social Core Vulnerability Disclosure *** --------------------------------------------- Today we would like to announce the discovery of a vulnerability in the Spring Social Core library. Spring Social provides Java bindings to popular service provider APIs like GitHub, Facebook, Twitter, etc., and is widely used by developers. All current versions (1.0.0.RELEASE to 1.1.2.RELEASE) of the library are affected by this vulnerability. --------------------------------------------- https://blog.srcclr.com/spring-social-core-vulnerability-disclosure/ *** Unitronics VisiLogic OPLC IDE Vulnerabilities *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on November 3, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for vulnerabilities in Unitronics VisiLogic OPLC IDE. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-274-02 *** Security Advisory - App Validity Check Bypass Vulnerability in Huawei P7 Smartphone *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Notice - Statement on Black Hat Europe 2015 Revealing Security Vulnerability in Huawei P7 Smart Phone *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** DFN-CERT-2015-1761: Jenkins: Mehrere Schwachstellen ermöglichen u.a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1761/ *** Cisco AnyConnect Secure Mobility Client Arbitrary File Move Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software Tunnel Interfaces Security Bypass Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Aironet 1800 Series Access Point SSHv2 Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-…

1 0

Tageszusammenfassung - Donnerstag 12-11-2015
by Daily end-of-shift report 12 Nov '15

12 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 11-11-2015 18:00 − Donnerstag 12-11-2015 18:01 Handler: Robert Waldner Co-Handler: Stephan Richter *** Distributed Vulnerability Search - Told via Access Logs *** --------------------------------------------- Sometimes just a few lines of access logs can tell a whole story: Many ongoing attacks against WordPress and Joomla sites use a collection of known vulnerabilities in many different plugins, themes and components. This helps hackers maximize the number of sites they can compromise. Google Dorks Do you ever think about how hackers find... --------------------------------------------- https://blog.sucuri.net/2015/11/distributed-vulnerability-search-told-via-a… *** Latest Android phones hijacked with tidy one-stop-Chrome-pop *** --------------------------------------------- Chinese researcher burns exploit for ski trip. PacSec: Googles Chrome for Android has been popped in a single exploit that could lead to the compromise of any handset. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/11/12/mobile_pwn2… *** Samsung S6 calls open to man-in-the-middle base station snooping *** --------------------------------------------- Their cheap man-in-the-middle attack requires an OpenBTS base station to be established and located near target handsets. Handsets will automatically connect to the bogus station. The malicious base station then pushes firmware to the phones baseband processor (the chip that handles voice calls, and which isnt directly accessible to end users). ... The Register would speculate that since the Qualcomm silicon in question isnt unique to Samsung kit, other researchers are probably setting to work... --------------------------------------------- http://www.theregister.co.uk/2015/11/12/mobile_pwn2own1/ *** Geschäftsgeheimnisse: Sicherheitsforscher warnt vor TTIP *** --------------------------------------------- Das Freihandelsabkommmen TTIP hat eine weitere Gegnergruppe: IT-Sicherheitsforscher. Das jedenfalls sagt René Pfeiffer, Organisator der Deepsec in Wien. Er fürchtet, dass Informationen über Sicherheitsrisiken damit noch stärker unterbunden werden. --------------------------------------------- http://www.golem.de/news/geschaeftsgeheimnisse-sicherheitsforscher-warnt-vo… *** Outlook-Probleme: Microsoft fixt Sicherheits-Update für Windows *** --------------------------------------------- Microsoft hat ein fehlerhaftes Update zurückgezogen und durch eine gefixte Version ersetzt. Nach der Installation soll Outlook nicht mehr abstürzen. Doch es gibt noch weitere Probleme. --------------------------------------------- http://heise.de/-2919456 *** Pentesting SAP Applications : An Introduction *** --------------------------------------------- Introduction to SAP SAP (Systems-Applications-Products) is a software suite that offers standard business solutions; it is used by thousands of customers across the globe to manage their business. In other words, SAP systems provide the capability to manage financial, asset, and cost accounting, production operations and materials, personnel and many more tasks. Before we jump... --------------------------------------------- http://resources.infosecinstitute.com/pen-stesting-sap-applications-part-1/ *** EMV Protocol Fuzzer *** --------------------------------------------- The world-wide introduction of the Europay, MasterCard and Visa standard (EMV), to facilitate communication between smartcards and EMV-enabled devices, such as point-of-sale (POS) terminals and automatic teller machines (ATMs), has altered the security landscape of the daily markets. Surprisingly limited public research exists addressing security aspects of hardware and software specific implementations. This is something we wanted to put right and therefore started a new research programme to... --------------------------------------------- https://labs.mwrinfosecurity.com/blog/2015/11/11/emv-protocol-fuzzer/ *** Got a time machine? Good, you can brute-force 2FA *** --------------------------------------------- Security researcher Gabor Szathmari says the problem is that if your 2FA tokens depend on the network time protocol (NTP), its too easy for a sysadmin to put together an attackable implementation. As he explains in two posts.., if an attacker can trick NTP, they can mount a brute-force attack against the security tokens produced by Google Authenticator (the example in the POC) and a bunch of other Time-based One-time Password Algorithm-based (TOTP) 2FA mechanisms. --------------------------------------------- http://www.theregister.co.uk/2015/11/12/got_a_time_machine_good_you_can_bru… *** Spam and phishing in Q3 2015 *** --------------------------------------------- The dating theme is typical for spam emails, but in the third quarter of 2015 we couldn't help but notice the sheer variety appearing in these types of mailings. We came across some rather interesting attempts to deceive recipients and to bypass filters, as well as new types of spam mailings that were bordering on fraud. --------------------------------------------- https://securelist.com/analysis/quarterly-spam-reports/72724/spam-and-phish… *** Oracle WebLogic Server: CVE-2015-4852 patched, (Thu, Nov 12th) *** --------------------------------------------- Lost in the hoopla around Microsoft and Adobe patch Tuesday was a critical patch released by Oracle which addressed CVE-2015-4852. CVE-2105-4852is a critical vulnerability in Apache Commons which affects Oracle WebLogic Server. This vulnerability permits remote exploitation without authentication and should be patchedas soon as practical. More information can be found at the Oracle Blog. -- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ -... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20369&rss *** Cisco Cloud Web Security DNS Hijack, (Thu, Nov 12th) *** --------------------------------------------- We have received a report that a domain critical in delivering the Cisco Cloud Web Security product had for a while earlier today been hijacked. The report indicates thatthe DNS entrys forscansafe.net were hijacked and pointed to 208.91.197.132, a site which both VirusTotal and Web of Trust indicate has a reputation for delivering malware.">Guidance that has been provided to customers is that the issue has been resolved but that the TTL on the DNS entries are 48 hours so it will take a... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20371&rss *** Volatility 2.5 released *** --------------------------------------------- This is the first release since the publication of The Art of Memory Forensics! It adds support for Windows 10 (initial), Linux kernels 4.2.3, and Mac OS X El Capitan. Additionally, the unified output rendering gives users the flexibility of asking for results in various formats (html, sqlite, json, xlsx, dot, text, etc.) while simplifying things for plugin developers. In short, less code... --------------------------------------------- http://www.volatilityfoundation.org/?_escaped_fragment_=25/c1f29 *** Die Apache Software Foundation zu dem Java Commons Collection/Java (De)Serialization Problem *** --------------------------------------------- Die Apache Software Foundation zu dem Java Commons Collection/Java (De)Serialization Problem12. November 2015Die Apache Software Foundation hat dazu einen ausführlichen Blog-Post verfasst. Die Money Quote daraus: "Even when the classes implementing a certain functionality cannot be blamed for this vulnerability, and fixing the known cases will also not make the usage of serialization in an untrusted context safe, there is still demand to fix at least the known cases, even when this... --------------------------------------------- http://www.cert.at/services/blog/20151112140918-1625.html *** R-Scripts VRS 7R Multiple Stored XSS And CSRF Vulnerabilities *** --------------------------------------------- The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Stored cross-site scripting vulnerabilitity was also discovered. The issue is triggered when input passed via multiple POST parameters is not properly sanitized before being returned to the user. This can be exploited to execute... --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5274.php *** Cisco FireSight Management Center Web Framework Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Google Picasa CAMF Section Integer Overflow Vulnerability *** --------------------------------------------- 2) Severity Rating: Highly critical Impact: System Access Where: From remote ... 4) Solution Update to version 3.9.140 Build 259. --------------------------------------------- http://www.securityfocus.com/archive/1/536878 *** Citrix XenServer Security Update for CVE-2015-5307 and CVE-2015-8104 *** --------------------------------------------- A security vulnerability has been identified in Citrix XenServer that may allow a malicious administrator of an HVM guest VM to crash the host. This vulnerability affects all currently supported versions of Citrix XenServer up to and including Citrix XenServer 6.5 Service Pack 1. --------------------------------------------- http://support.citrix.com/article/CTX202583 *** Security Notice - Statement on Security Researchers Revealing a Security Vulnerability in Huawei HG630a&HG630a-50 on Packet Storm Website *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices…

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily