Daily

daily@lists.cert.at

1 participants
3139 discussions

Tageszusammenfassung - Montag 21-09-2015
by Daily end-of-shift report 21 Sep '15

21 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 18-09-2015 18:00 − Montag 21-09-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Unconventional Malvertising Attack Uses New Tricks *** --------------------------------------------- Cyber criminals are creative when using their creative, as seen in this malvertising campaign experimenting with new obfuscation tricks. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/09/unconventional-malvert… *** Cisco Unity Connection Web Interface SQL Injection Vulnerability *** --------------------------------------------- A vulnerability in the web interface of Cisco Unity Connection (UC) could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41074 *** Cisco ASR 9000 Series Aggregation Services Routers Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the DHCP version 6 (DHCPv6) server implementation of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41101 *** DSA-3361 qemu - security update *** --------------------------------------------- Several vulnerabilities were discovered in qemu, a fast processoremulator. --------------------------------------------- https://www.debian.org/security/2015/dsa-3361 *** Insistent router botnet *** --------------------------------------------- Not so long ago, monitoring attackers in our telnet honeypots helped reveal an interesting botnet composed of ASUS brand home routers. A botnet trying to log into our SSH honeypot running on Turris routers most frequently in the last two weeks is a botnet whose IP addresses, according to Shodan, often have one common characteristic: they respond with cookie AIROS_SESSIONID on port 80. This cookie points at AirOS running on Ubiquiti airRouter. --------------------------------------------- http://en.blog.nic.cz/2015/09/18/insistent-router-botnet/ *** Harman-Kardon Uconnect Vulnerability *** --------------------------------------------- This advisory is a follow-up to the ICS-ALERT titled ICS-ALERT-15-203-01 FCA Uconnect Vulnerability that was published July 22, 2015, on the NCCIC/ICS-CERT web site. This advisory provides mitigation details for an unauthorized remote access to Fiat-Chrysler Automobile US (FCA US) LLC Uconnect telematics infotainment system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-260-01 *** Deutsche Cyber-Sicherheitsorganisation DCSO gegründet *** --------------------------------------------- Vier deutsche DAX-Konzerne wollen sich in Deutschland um die Cyber-Sicherheit kümmern. Volkswagen, Allianz, BASF und Bayer gründen einen eigenen Sicherheits-Dienstleister. --------------------------------------------- http://heise.de/-2821882 *** AVG Antivirus Plans to Collect & Sell Your Personal Data to Advertisers *** --------------------------------------------- We at The Hacker News are big fans of Security Software - The first thing we install while setting our Computers and Devices. Thanks to Free Security Software that protects Internet users without paying for their security. But, Remember: Nothing comes for FREE "Free" is just a relative term, as one of the worlds most popular anti-virus companies is now admitting. --------------------------------------------- http://thehackernews.com/2015/09/avg-antivirus.html *** Certificate Transparency: Symantec stellt falsches Google-Zertifikat aus *** --------------------------------------------- Offenbar zu Testzwecken ist von Symantec unberechtigterweise ein gültiges TLS-Zertifikat für Google.com ausgestellt worden. Entdeckt hat Google das über die Logs des Certificate-Transparency-Systems. --------------------------------------------- http://www.golem.de/news/certificate-transparency-symantec-stellt-falsches-… *** Brief survey on methods for attacking Tor hidden service *** --------------------------------------------- cently, MIT published an article for their recent work of identifying the hidden service of Tor by circuit fingerprinting with website fingerprinting to eventually trace down the hidden service users. This paper has been discussed on reddit and many other forums, and the question that whether Tor can be compromised becomes hot again. Here I want to have a brief overview of recent research on the methods and attempts for attacking Tor hidden services over the past years. --------------------------------------------- http://translate.wooyun.io/2015/09/19/Brief-survey-on-methods-for-attacking… *** SYNful Knock *** --------------------------------------------- Introduction On 15 September 2015, FireEye published information about potentially compromised Cisco routers under the name SYNful Knock. As soon as Shadowserver became aware of these potential compromises, Shadowserver and Cisco worked together and cooperated to scan the internet to detect this affected routers to allow a more accurate notification of the affected end-users. --------------------------------------------- http://blog.shadowserver.org/2015/09/21/synful-knock/ *** Inside Target Corp., Days After 2013 Breach *** --------------------------------------------- In December 2013, just days after a data breach exposed 40 million customer debit and credit card accounts, Target Corp. hired security experts at Verizon to probe its networks for weaknesses. The results of that confidential investigation -- until now never publicly revealed -- confirm what pundits have long suspected: Once inside Targets network, there was nothing stop attackers from gaining direct and complete access to every single cash register in every Target store. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/yLzOrODU9Vc/ *** BitPay Hacked, 5 000 Bitcoins Stolen *** --------------------------------------------- Bitcoin payments processor BitPay Inc. is the latest victim in a series of massive hacking scandals that have rocked the cryptocurrency community. The Atlanta-based Bitpay was hacked on three separate occasions in December of 2014. More than 5 000 bitcoins were stolen. Subsequent to this, BitPay sent a claim to its insurer Massachusetts Bay Insurance Company, and the latter declined to pay. The matter is now in court. --------------------------------------------- https://www.cryptocoinsnews.com/bitpay-hacked-5-000-bitcoins-stolen/ *** App Store: Apple bestätigt "XcodeGhost"-Infektionen *** --------------------------------------------- Der Konzern hat laut eigenen Angaben infizierte Apps aus einem Onlineladen entfernt. Ob es alle sind, weiß niemand. --------------------------------------------- http://heise.de/-2822207 *** Risiko Firmware *** --------------------------------------------- Firmware ist nur was für Profis? Von wegen: Heute hängen alltägliche Dinge im Internet und lassen sich darüber fernsteuern. Wenn die Heizungsanlage durchdreht und der DSL-Router für Angreifer offen steht, ist nicht selten veraltete Firmware schuld. --------------------------------------------- http://www.heise.de/newsticker/meldung/Risiko-Firmware-2822449.html?wt_mc=r… *** Typo3 über XSS-Lücke verwundbar *** --------------------------------------------- In Typo3 klafft eine Schwachstelle, über die Angreifer JavaScript in das Content Management System schmuggeln können. --------------------------------------------- http://www.heise.de/newsticker/meldung/Typo3-ueber-XSS-Luecke-verwundbar-28… *** Cisco Wireless LAN Controller RADIUS Packet of Disconnect Vulnerability *** --------------------------------------------- A vulnerability in the RADIUS implementation of the Cisco Wireless LAN Controller (WLC) could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition by disconnecting user sessions. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41102 *** Security Updates Available for Adobe Flash Player (APSB15-23) *** --------------------------------------------- A security bulletin (APSB15-23) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1273

1 0

Tageszusammenfassung - Freitag 18-09-2015
by Daily end-of-shift report 18 Sep '15

18 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 17-09-2015 18:00 − Freitag 18-09-2015 17:55 Handler: Alexander Riepl Co-Handler: n/a *** Important security notice regarding signing key and distribution of Red Hat Ceph Storage on Ubuntu and CentOS *** --------------------------------------------- Last week, Red Hat investigated an intrusion on the sites of both the Ceph community project (ceph.com) and Inktank (download.inktank.com), which were hosted on a computer system outside of Red Hat infrastructure. download.inktank.com provided .. --------------------------------------------- https://securityblog.redhat.com/2015/09/17/important-security-notice-regard… *** Analyzing Proxy Based Spam Networks *** --------------------------------------------- We are no strangers to Blackhat SEO techniques, we've actually spent a great deal of time working and sharing various bits of information related to Blackhat SEO techniques over the years. What we haven't shared, however, is the idea of Proxy-based Spam Networks (PSN). It's not because it wasn't interesting, it's .. --------------------------------------------- https://blog.sucuri.net/2015/09/analyzing-proxy-based-spam-networks.html *** Cisco Prime Network Registrar Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in the default configuration of the Cisco Prime Network Registrar (CPNR) virtual appliance (OVA) which could allow an authenticated, local attacker to gain root privileges. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41041 *** WordPress Malware - Active VisitorTracker Campaign *** --------------------------------------------- We are seeing a large number of WordPress sites compromised with the 'visitorTracker_isMob' malware code. This campaign started 15 days ago, but only in the last few days have we started to see it gain traction; really affecting a large number of .. --------------------------------------------- https://blog.sucuri.net/2015/09/wordpress-malware-active-visitortracker-cam… *** WP Shop <= 3.4.3.18 - Cross-Site Scripting (XSS) & CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8192 *** Researchers seek ransomware samples for their generic solution *** --------------------------------------------- VB2015 presentation to include demonstration of technique against recent samples.The scary hack thats on the rise is how Wireds Kim Zetter described ransomware in an overview article posted yesterday. Indeed, encrypting your files and demanding a ransom to decrypt them has become a very lucrative cybercriminal .. --------------------------------------------- http://www.virusbtn.com/blog/2015/09_18.xml *** Router Security / SYNful Knock *** --------------------------------------------- Wir bekamen Anfragen zum Thema SYNful Knock. Uns war das keine Warnung wert, daher fasst dieser Blogpost unseren Standpunkt zusammen:Management Summary Der SYNful Knock Angriff ist keine neue Kategorie von Bedrohungen. Es gibt .. --------------------------------------------- http://www.cert.at/services/blog/20150918112023-1598.html *** Sicherheitslücke: D-Link vergisst private Code-Signing-Schlüssel im Quellcode *** --------------------------------------------- Dem Hardwarehersteller D-Link ist ein peinlicher Fehler unterlaufen. Im Quellcode der Firmware für eine Überwachungskamera vergaßen die Entwickler private Code-Signing-Schlüssel. Der Hersteller hat bereits reagiert. --------------------------------------------- http://www.golem.de/news/peinlich-d-link-vergisst-private-code-signing-schl… *** Pwnage Per Port - 22/open/tcp//ssh *** --------------------------------------------- Hello and welcome to the first installment of Pwnage Per Port! Today we will be discussing the oh-so-important SSH service which runs (most commonly) on TCP port 22. Not sure what Pwnage Per Port is? Head on over here for a quick rundown on what you can expect! --------------------------------------------- http://l.avala.mp/blog/pwnage-per-port-22opentcpssh/ *** Triaging PowerShell Exploitation with Rekall *** --------------------------------------------- David recently published his article Spotting the Adversary so I figured Id continue the trend and focus on Blue Team tactics in this post. --------------------------------------------- http://www.redblue.team/2015/09/triaging-powershell-exploitation-with.html *** Cisco ASA Software Version Information Disclosure Vulnerability *** --------------------------------------------- A vulnerability in the SSL VPN code of Cisco ASA Software could allow an unauthenticated, remote attacker to obtain information about the Cisco ASA Software version. This information could be used for reconnaissance attacks. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=35946 *** Kritische Sicherheitslücke: Bug in Bugzilla *** --------------------------------------------- Die Bugverwaltung von Firefox gibt schon zum zweiten Mal im September vertrauliche Daten preis - doch diesmal sind auch andere Projekte betroffen. Ein Patch steht bereit. --------------------------------------------- http://www.golem.de/news/kritische-sicherheitsluecke-bug-in-bugzilla-1509-1…

1 0

Tageszusammenfassung - Donnerstag 17-09-2015
by Daily end-of-shift report 17 Sep '15

17 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 16-09-2015 18:00 − Donnerstag 17-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** A Brief Introduction to #totalhash *** --------------------------------------------- #totalhash is Team Cymru's malware analysis database, providing static and dynamic analysis of malware samples free for non-commercial use. Haven't tried #totalhash yet? Here's a brief video with a few highlights on how to upload samples, search our database, and go down the rabbit hole .. --------------------------------------------- https://blog.team-cymru.org/2015/09/a-brief-introduction-to-totalhash/ *** Bugtraq: [security bulletin] HPSBGN03393 rev.2 - HP Operations Manager i, Remote Code Execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/536478 *** Stagefrightened? *** --------------------------------------------- There's been a lot of attention recently around a number of vulnerabilities in Android's libstagefright. There's been a lot of confusion about the remote exploitability of the issues, especially on modern devices. In this blog post we will demonstrate an exploit for one of the libstagefright vulnerabilities .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/09/stagefrightened.html *** ZDI-15-444: Symantec Web Gateway Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-444/ *** ZDI-15-443: Symantec Web Gateway Arbitrary PHP File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is required to exploit this vulnerability, however it can be bypassed via reflected cross-site scripting. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-443/ *** ZDI-15-445: (0Day) Avira Management Console Update Manager Service HTTP Header Use-After-Free Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Avira Management Console. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-445/ *** CMS Updater - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-150 *** --------------------------------------------- The module does not sufficiently protect the settings page allowing any user with the permission "access administration pages" to change settings. --------------------------------------------- https://www.drupal.org/node/2569599 *** Drupal 7 driver for SQL Server and SQL Azure - Moderately Critical - SQL Injection - SA-CONTRIB-2015-148 *** --------------------------------------------- Certain characters aren't properly escaped by the Drupal database API. A malicious user may be able to access restricted information by performing a specially-crafted search. --------------------------------------------- https://www.drupal.org/node/2569577 *** Who's Behind Bluetooth Skimming in Mexico? *** --------------------------------------------- In the previous two stories, I documented the damage wrought by an organized crime gang in Mexico that has been systematically bribing ATM technicians to install Bluetooth skimming components that allow thieves to steal card and PIN data wirelessly. What follows is a look at a mysterious new ATM company in Mexico that sources say may be tied to the skimming activity. --------------------------------------------- http://krebsonsecurity.com/2015/09/whos-behind-bluetooth-skimming-in-mexico/ *** iTunes 12.3: Mehr Sicherheit, weniger Fehler und ein grosser Download *** --------------------------------------------- Zusammen mit iOS 9 hat Apple auch eine neue Version von iTunes freigegeben. Apple beseitigte insbesondere unter Windows Sicherheitslücken, die sogar das Abgreifen von verschlüsselten Zugangsdaten im Netzwerk erlaubten. Zudem erhöht Apple die Sicherheit bei der Verwendung von Apple IDs. --------------------------------------------- http://www.golem.de/news/itunes-12-3-mehr-sicherheit-weniger-fehler-und-ein… *** Behind the scenes at BruCON, a European hacker conference *** --------------------------------------------- Setting up a local conference seems to be a popular way for infosec pros that havent got the time or means to travel to bring the people they want to meet and the knowledge they want to attain .. --------------------------------------------- http://www.net-security.org/secworld.php?id=18863 *** Seven years of malware linked to Russian state-backed cyber espionage *** --------------------------------------------- F-Secure report details "The Dukes" malware family and its Russian connections. For the past seven years, a cyber-espionage group operating out of Russia .. --------------------------------------------- http://arstechnica.com/security/2015/09/seven-years-of-malware-linked-to-ru… *** Throwback Thursday: Virus Writer and Distributors Attributable Viruses *** --------------------------------------------- This Throwback Thursday, we turn the clock back to July 1990, when VB looked at virus origins and some of the rare cases of attributable viruses.This week saw the confession of a former teenage virus writer: the author of the Leprosy .. --------------------------------------------- http://www.virusbtn.com/blog/2015/09_17.xml *** Studie: In den USA droht ein Wahlmaschinen-Debakel *** --------------------------------------------- on den 50 US-Staaten werden 43 im kommenden Jahr besonders fehleranfällige Wahlcomputer einsetzen, die mindestens zehn Jahre alt sind, heißt es in einer Analyse der New York University. Dies berge große Risiken. --------------------------------------------- http://heise.de/-2820268 *** MMD-0042-2015 - Polymorphic in ELF malware: Linux/Xor.DDOS *** --------------------------------------------- The threat of Linux/XOR.DDoS, a China-made ELF backdoor ddoser malware, its still on going. I received a good question from (I assumed from a victim of infection) asked about why the found malware is not the same as what was firstly executed ELF malware binary. This writing is short and covering .. --------------------------------------------- http://blog.malwaremustdie.org/2015/09/mmd-0042-2015-polymorphic-in-elf.html *** HTTP Evasions Explained - Part 2 - Deflate Compression *** --------------------------------------------- This is the second article in a series which will explain the evasions done by HTTP Evader. It covers the failure of several firewalls to support content some compressions supported by all or most browsers, notable the deflate compression. In short, it is possible to bypass the malware inspection of several firewalls by simply sending a response compressed by deflate: --------------------------------------------- http://noxxi.de/research/http-evader-explained-2-deflate.html

1 0

Tageszusammenfassung - Mittwoch 16-09-2015
by Daily end-of-shift report 16 Sep '15

16 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 15-09-2015 18:00 − Mittwoch 16-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** CoreBot Adds New Capabilities, Transitions to Banking Trojan *** --------------------------------------------- As many researchers expected it would, CoreBot, the credential-stealing malware that first surfaced last month, has added a bevy of new capabilities and reinvented itself as a robust banking Trojan. --------------------------------------------- http://threatpost.com/corebot-adds-new-capabilities-transitions-to-banking-… *** Hacking Team looks to hire hacker *** --------------------------------------------- Following the compromising of nearly all its databases and emails, and then the subsequent release of those company details, Hacking Team posted a job listing for a "hacker/developer." --------------------------------------------- http://www.scmagazine.com/hacking-team-looks-to-expand-team-after-breach/ar… *** WordPress Brute Force Attacks - 2015 Threat Landscape *** --------------------------------------------- One of the first server-level compromises I had to deal with in my life was around 15 years ago, and it was caused by an SSH brute force attack. A co-worker set up a test server and chose a very weak root password. A few days later, the box was compromised .. --------------------------------------------- https://blog.sucuri.net/2015/09/wordpress-brute-force-attacks-2015-threat-l… *** Malicious spam with zip attachments containing .js files, (Wed, Sep 16th) *** --------------------------------------------- On 2015-07-29, the ISC publisheda diary covering malicious spam (malspam) with zip archives of javascript (.js) files [1]. Since then, weve received notifications from others who have found this type of malspam. Lets revisit the spam filters, search for this type of email, and see if anything .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20153 *** "Unternehmen wollen Sicherheitslösungen aus Europa" *** --------------------------------------------- SBA Research hat den ersten österreichischen Inkubator für Cybersicherheits-Start-ups ins Leben gerufen. Die futurezone hat die Geschäftsführer des Kompetenzentrums befragt. --------------------------------------------- http://futurezone.at/thema/start-ups/unternehmen-wollen-sicherheitsloesunge… *** In Search of SYNful Routers *** --------------------------------------------- On Tuesday, September 15, 2015, Mandiant and FireEye disclosed SYNful Knock, a router implant discovered on fourteen Cisco routers in India, Mexico, the Philippines, and Ukraine. The implant consists a modified version of the Cisco firmware that provides attackers with unrestricted access to the router including the ability to load additional modules. The attack is .. --------------------------------------------- https://zmap.io/synful/ *** Can an inevitable evil be conquered? *** --------------------------------------------- Scanning an object (a file or web resource) with an Internet security program essentially comes down to making a binary decision: dangerous or safe? An antivirus engine puts forward the hypothesis that an object is malicious and then checks .. --------------------------------------------- http://securelist.com/blog/opinions/72180/can-an-inevitable-evil-be-conquer… *** Enthüllungsplattform Cryptome: PGP-Schlüssel kompromittiert *** --------------------------------------------- Mit Zugang zu den Schlüsseln der Plattform und des Gründers John Young könnten Angreifer verschlüsselte Mails lesen und sich als Betreiber der Webseite ausgeben. --------------------------------------------- http://heise.de/-2817797 *** Cyberkriminalität in Österreich: Fragen und Antworten *** --------------------------------------------- Das Bundeskriminalamt präsentiert gemeinsam mit der futurezone den Cybercrime-Report 2014. Wir laden am Montagabend zur Diskussion über Trends in der Cyberkriminalität. --------------------------------------------- http://futurezone.at/digital-life/cyberkriminalitaet-in-oesterreich-fragen-… *** Android-Passwortsperre lässt sich zum Teil leicht austricksen *** --------------------------------------------- Bei Nexus-Geräten demonstriert, unklar ob andere Geräte betroffen sind – Google liefert bereits Update --------------------------------------------- http://derstandard.at/2000022284907 *** Schneider Electric StruxureWare Building Expert Plaintext Credentials Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cleartext transmission vulnerability in Schneider Electric's StruxureWare Building Expert product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-01 *** 3S CODESYS Gateway Server Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a heap-based buffer overflow vulnerability in 3S-Smart Software Solutions GmbH's CODESYS Gateway Server. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-02 *** GE MDS PulseNET Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two vulnerabilities in GE's MDS PulseNET and MDS PulseNET Enterprise Network Management Software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-03 *** Advantech WebAccess Stack-Based Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a stack-based buffer overflow vulnerability in Advantech's WebAccess application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-04 *** Attacks over DNS *** --------------------------------------------- DNS is a naming system used for all devices connected to the Internet or a network. DNS is easy to remember instead of IP addresses for users. It is a method in which domain names are translated into an IP (Internet Protocol) addresses. The DNS works .. --------------------------------------------- http://resources.infosecinstitute.com/attacks-over-dns/ *** SYNful Knock - A Cisco router implant - Part II *** --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis0.h… *** Trojan.MWZLesson.a Trojan for POS terminals *** --------------------------------------------- For many years POS terminals remain one the most favorite targets for virus makers. Due to the fact that this technology is used by a large number of sales organizations around the world to process payments made using bank cards, cybercriminals just .. --------------------------------------------- http://news.drweb.com/show/?i=9615&lng=en&c=9 *** Einstweilige Verfügung: Fireeye geht juristisch gegen Sicherheitsforscher vor *** --------------------------------------------- Ein Team von Sicherheitsforschern wollte auf einer Konferenz über Sicherheitslücken in Fireeye-Produkten berichten. Fireeye sah durch die Präsentation Geschäftsgeheimnisse bedroht und hat eine einstweilige Verfügung erwirkt. --------------------------------------------- http://www.golem.de/news/einstweilige-verfuegung-fireeye-geht-juristisch-ge… *** TeslaCrypt 2.0: Cyber Crime Malware Behavior, Capabilities and Communications *** --------------------------------------------- As part of our normal course of operations as a cyber threat intelligence provider, we monitor the cyber crime underground and provide analysis to our clients on new and emerging threats. As you can imagine, we naturally run into large quantities of malware on a daily basis. From time to time, we .. --------------------------------------------- http://www.isightpartners.com/2015/09/teslacrypt-2-0-cyber-crime-malware-be… *** Free and Commercial Tools to Implement the SANS Top 20 Security Controls, Part 2 *** --------------------------------------------- This is Part 2 of a How-To is an effort to compile a list of tools (free and commercial) that can help an IT administrator comply with the Security Controls. In Part 1 we looked at Inventory of Authorized and Unauthorized Devices. The controls (ordered 1-20) are in order of importance. In other words, completing .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/free-and-commercial-to…

1 0

Tageszusammenfassung - Dienstag 15-09-2015
by Daily end-of-shift report 15 Sep '15

15 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 14-09-2015 18:00 − Dienstag 15-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Enabling QR codes in Internet Explorer, or a story of a cross-platform memory disclosure *** --------------------------------------------- Posted by Mateusz Jurczyk of Google Project ZeroIn the previous series of posts (parts #1 #2 #3 #4), we discussed the exploitation process of a serious 'blend' vulnerability (CVE-2015-0093 / CVE-2015-3052), which was special .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/09/enabling-qr-codes-in-internet… *** Mapping How Tor's Anonymity Network Spread Around the World *** --------------------------------------------- Germany has overtaken the US in total nodes, with France, the Netherlands, and Russia coming close behind.The post Mapping How Tor's Anonymity Network Spread Around the World appeared first on WIRED. --------------------------------------------- http://www.wired.com/2015/09/mapping-tors-anonymity-network-spread-around-w… *** Large Malvertising Campaign Goes (Almost) Undetected *** --------------------------------------------- A very stealthy malvertising campaign has gone under everybodys noses and exposed a large amount of people to malware. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/09/large-malvertising-cam… *** Tracking Bluetooth Skimmers in Mexico, Part II *** --------------------------------------------- I spent four days last week in Mexico, tracking the damage wrought by an organized crime ring that is bribing ATM technicians to place Bluetooth skimmers inside of cash machines in and around the tourist areas of Cancun. Today's piece chronicles the work of this gang in coastal regions farther south, following a trail of hacked ATMs from Playa Del Camen down to the ancient Mayan ruins in Tulum. --------------------------------------------- http://krebsonsecurity.com/2015/09/tracking-bluetooth-skimmers-in-mexico-pa… *** SYNful Knock - A Cisco router implant - Part I *** --------------------------------------------- Router implants, from any vendor in the enterprise space, have been largely believed to be theoretical in nature and especially in use. However, recent vendor advisories indicate that these have been seen in the wild. Mandiant can confirm the existence of at least 14 such router implants spread across four different countries: Ukraine, Philippines, Mexico, and India. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.ht… *** Hey, Oracle, whats in that VirtualBox security update? *crickets* *** --------------------------------------------- Debian team bit miffed about secretive vuln fixes in hypervisor software Its not just Microsoft keeping schtum on exactly whats inside its software updates. --------------------------------------------- www.theregister.co.uk/2015/09/15/oracle_virtualbox_security_updates/ *** Von Flugzeugen bis Mars-Rovern: Lücke im Echtzeitbetriebssystem VxWorks *** --------------------------------------------- Das Echtzeitbetriebssystem VxWorks ist verwundbar und Angreifer können eigenen Code ausführen. Das System kommt in rund 1,5 Milliarden Geräten zum Einsatz - darunter auch im Mars-Rover Curiosity. --------------------------------------------- http://heise.de/-2812783 *** Another LinkedIn Sockpuppet *** --------------------------------------------- According to LinkedIn, 11 of my connections can introduce me to someone who 'knows' Anna. I'm not so sure about that. According to IMDb, Anna Sentina is really Anna Akana. Maybe LinkedIn should start charging to 'verify' recruiter .. --------------------------------------------- https://labsblog.f-secure.com/2015/09/15/another-linkedin-sockpuppet/ *** Our First Certificate Is Now Live *** --------------------------------------------- Let's Encrypt passed another major milestone by issuing our first certificate. You can see it in action here. --------------------------------------------- https://letsencrypt.org/2015/09/14/our-first-cert.html *** KCI Attacks against TLS *** --------------------------------------------- Protection of Internet communication is crucial in todays hyperconnected world. The industry standard for encrypting private and sensitive communication data over potentially adversarial controlled network cables and radio signals is TLS. ESSE, the security team of RISE GmbH, discovered a .. --------------------------------------------- https://kcitls.org/ *** Hunting Asynchronous Vulnerabilities *** --------------------------------------------- As the video of my 44Con presentation Hunting Asynchronous Vulnerabilities probably wont be available for a while, I thought Id provide a mildly abridged (and less vendor-neutral) writeup of the core technical content. You can download the slides here. --------------------------------------------- http://blog.portswigger.net/2015/09/hunting-asynchronous-vulnerabilities.ht… *** WordPress 4.3.1 Security and Maintenance Release *** --------------------------------------------- https://wordpress.org/news/2015/09/wordpress-4-3-1/ *** VB2015 last-minute papers announced *** --------------------------------------------- Ten talks covering hot research added to the VB2015 programme.There are just over two weeks to go until more than 400 security professionals descend on Prague for VB2015, the 25th Virus Bulletin International Conference.With the addition of ten last-minute papers, the conference programme is now almost complete: two keynotes (by Ross Anderson and Costin Raiu), seven Small Talks and 51 regular presentations mean the three conference days are packed with interesting talks and discussions on a --------------------------------------------- http://www.virusbtn.com/blog/2015/09_15.xml?rss *** Finding Vulnerabilities in Core WordPress: A Bug Hunter�s Trilogy, Part III - Ultimatum *** --------------------------------------------- In this series of blog posts, Check Point vulnerability researcher Netanel Rubin tells a story in three acts - describing his long path of discovered flaws and vulnerabilities in core WordPress, leading him from a read-only 'Subscriber' user, through creating, editing and deleting posts, and all the way to performing SQL injection and persistent XSS attacks on 20% of the popular web. --------------------------------------------- http://blog.checkpoint.com/2015/09/15/finding-vulnerabilities-in-core-wordp…

1 0

Tageszusammenfassung - Montag 14-09-2015
by Daily end-of-shift report 14 Sep '15

14 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 11-09-2015 18:00 − Montag 14-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** FireEye wegen Umgang mit Sicherheitsforschern in der Kritik *** --------------------------------------------- Ein deutscher Forscher, der Lücken in Sicherheits-Gateways der Firma FireEye entdeckt hat, wurde per einstweiliger Verfügung dazu gezwungen, seinen Vortrag zu zensieren. Sein Firmenchef spricht von unprofessionellem Verhalten seitens FireEye. --------------------------------------------- http://heise.de/-2811690 *** Tracking a Bluetooth Skimmer Gang in Mexico *** --------------------------------------------- -Sept. 9, 12:30 p.m. CT, Yucatan Peninsula, Mexico: Halfway down the southbound four-lane highway from Cancun to the ancient ruins in Tulum, traffic inexplicably slowed to a halt. There was some sort of checkpoint ahead by the Mexican Federal Police. I began to wonder whether it was a good idea to have .. --------------------------------------------- http://krebsonsecurity.com/2015/09/tracking-a-bluetooth-skimmer-gang-in-mex… *** Neuer Android-Trojaner erpresst mit Lock-Screen-Sperre *** --------------------------------------------- Versucht über Trick Device-Admin-Rechte einzuholen – Nur jenseits des Play Stores verbreitet --------------------------------------------- http://derstandard.at/2000022182737 *** How Command and Control Servers Remain Resilient *** --------------------------------------------- One of the ways that malware activity on a network is spotted is via the activity of their network activity. However, in many cases this can be difficult to detect: there have been incidents where command-and-control (C&C) servers were able to stay .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/adapting-to-chan… *** "Die Gefahr ist real": Auto-Hacks schrecken Branche auf *** --------------------------------------------- IT-Forscher übernahmen mehrmals Kontrolle über Fahrzeuge --------------------------------------------- http://derstandard.at/2000022195679 *** Österreichische Forscher entdecken TLS-Schwachstelle *** --------------------------------------------- Facebook vergibt Bug Bounty-Award an Rise – "Sicherheits-Desaster" verhindert --------------------------------------------- http://derstandard.at/2000022197161 *** Bundestag-Hack war ein Phishing-Angriff über un.org *** --------------------------------------------- Die Angreifer auf den Bundestag haben wohl Mails mit gefälschter Absendeadresse verschickt, die einen Link auf Malware enthielten. Nicht nur der Bundestag, sondern mehrere internationale Organisationen seien gleichzeitig angegriffen worden. --------------------------------------------- http://heise.de/-2811847 *** The Wordpress Plugins Playground *** --------------------------------------------- This morning, I had a quick look at my web serverlog file and searched for malicious activity. Attacks like brute-force generate a lot of entries and thuscan be easily detected.Other scanners are working below the radar and search for very specific vulnerabilities. In this case, a single request is often .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20147 *** The Shade Encryptor: a Double Threat *** --------------------------------------------- A family of ransomware Trojans emerged in late 2014/early 2015, and quickly established itself among the top three most widespread encryptors. This threat has been assigned the verdict Trojan-Ransom.Win32.Shade according to Kaspersky Labs classification. The original name given to the encryptor by its creator is not known. --------------------------------------------- http://securelist.com/analysis/publications/72087/the-shade-encryptor-a-dou… *** HTTP Evasions Explained - Part 1 - Evading Using HTTP 0.9 *** --------------------------------------------- This is the first article in a series which will explain the evasions done by HTTP evader. It covers the case that most firewalls only block what they detected as explicitly bad and simply pass what they dont understand. The main technique used in this part is the old but still working HTTP 0.9 protocol. --------------------------------------------- http://noxxi.de/research/http-evader-explained-1-http09.html *** Exploiting CSRF against search with Lucene *** --------------------------------------------- Cross domain timing attacks can be used against Lucene to reliably extract information contained within its index. By repeatedly timing HTTP requests using JavaScript Lucene search boxes can be exploited in a similar way to time based blind-sql injection. --------------------------------------------- https://www.idontplaydarts.com/2015/09/cross-domain-timing-attacks-against-… *** Brief analysis of a SQL injection in Cacti 0.8.8b *** --------------------------------------------- Back in September 2013 I wanted to practice some code auditing and picked the latest version of Cacti (v0.8.8b at the time). I spent a few hours looking into the code and also assessing a running instance of Cacti and this exercise resulted in a few vulnerabilities. I was motivated to finally put together this .. --------------------------------------------- http://blog.whatever.io/2015/09/12/brief-analysis-of-a-sql-injection-in-cac… *** Addressing the Delayed Message Attack in Wireless IoT Environments *** --------------------------------------------- While many years have passed while we're waiting for IoT to take over the world, there are some recent signs that it might indeed eventually happen. With this in mind, issues related to IoT security tend to become more and more important. In this article, we won't be talking about current IoT security .. --------------------------------------------- http://ithare.com/addressing-the-delayed-message-attack-in-wireless-iot-env…

1 0

Tageszusammenfassung - Freitag 11-09-2015
by Daily end-of-shift report 11 Sep '15

11 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 10-09-2015 18:00 − Freitag 11-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Bundeslagebild Cybercrime: Crime-as-a-Service wächst weiter *** --------------------------------------------- Das Bundeskriminalamt hat auf seiner Cybercrime-Konferenz C³ das Lagebild Cybercrime veröffentlicht. Demnach steigt die Bedrohung auf allen Gebieten der computerunterstützen Kriminalität. --------------------------------------------- http://heise.de/-2810254 *** VMSA-2015-0003.11 *** --------------------------------------------- Oracle JRE is updated in VMware products to address a critical security issue that existed in earlier releases of Oracle JRE. VMware products running JRE 1.7 Update 75 or newer and JRE 1.6 Update 91 or newer are not vulnerable to CVE-2014-6593, .. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** OpenLDAP Bug in ber_get_next() Lets Remote Users Cause the Target Service to Crash *** --------------------------------------------- A vulnerability was reported in OpenLDAP. A remote user can cause the target service to crash. A remote user can send a specially crafted packet to cause the target slapd service to crash. --------------------------------------------- http://www.securitytracker.com/id/1033534 *** Yokogawa Multiple Products Buffer Overflow Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for stack-based buffer overflow vulnerabilities in multiple Yokogawa products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-253-01 *** Von T-Systems: Der Bundestag bekommt eine neue IT-Infrastruktur *** --------------------------------------------- Als Reaktion auf den Hackerangriff werden im Bundestag nun mehr als 10.000 Webseiten dauerhaft gesperrt. Außerdem soll T-Systems ein neues Netzwerk aufbauen. Bundestags-Mitarbeiter müssen ihre USB-Sticks bald zu Hause lassen. --------------------------------------------- http://www.golem.de/news/von-t-systems-der-bundestag-bekommt-eine-neue-it-i… *** Google veröffentlicht erstes monatliches Sicherheitsupdate *** --------------------------------------------- Nach der Entdeckung der Stagefright-Sicherheitslücke hatte Google angekündigt, einen monatlichen Patchday mit Sicherheitsupdates einzuführen. Jetzt sind die ersten Builds veröffentlicht worden. --------------------------------------------- http://www.golem.de/news/android-google-veroeffentlicht-erstes-monatliches-… *** Simulation zeigte Millionen Hacker-Angriffe auf Zug-Steuersysteme *** --------------------------------------------- Falle "HoneyTrain": Wer würde tatsächlich versuchen, in die originalgetreue Nachbildung eines Zug-Steuerungssystems einzudringen? --------------------------------------------- http://derstandard.at/2000022056115 *** Cyber criminal crew DD4BC extorts businesses via DDoS *** --------------------------------------------- According to a report recently issued by Akamai, the DD4BC criminal group has been responsible for at least 114 DDoS attacks on its customers. According the Akamai firm, the criminal crews known as DD4BC has carried out at least 114 .. --------------------------------------------- http://securityaffairs.co/wordpress/40034/cyber-crime/dd4bc-group-extortion… *** Analysing a new eBanking Trojan called Fobber *** --------------------------------------------- Some weeks ago we read an interesting blog by Malwarebytes about Fobber, a new e-banking focussed malware in the arena that seems to be a Tinba spinoff. We decided to have a closer look at it to find out whether Swiss critical infrastructures are targeted by it. Wed like to share our findings with you, because it contains some interesting advanced techniques .. --------------------------------------------- http://www.govcert.admin.ch/blog/12/analysing-a-new-ebanking-trojan-called-… *** SUCEFUL: Next Generation ATM Malware *** --------------------------------------------- You dip your debit card in an automated teller machine (ATM) and suddenly realize it is stuck inside, what happened? --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/09/suceful_next_genera.ht… *** A Retrospective on Ashely Madison and the Value of Threat Modeling *** --------------------------------------------- One of my favourite authors in the field of computer security is Gary McGraw. If you are not familiar with him, I'd suggest you start by reading his book Software Security: Building Security In. One of the key points he makes is a distinction .. --------------------------------------------- https://littlemaninmyhead.wordpress.com/2015/09/08/a-retrospective-on-ashel… *** A Peek Inside an Affiliate's Malspam Operation: Kovter and Miuref/Boaxxe Infections *** --------------------------------------------- In March of this year, reports of malspam campaigns utilizing an email attached '.doc.js' files, which tied back to the Kovter and Boaxxe clickfraud trojans. The analysis of these malware families have already been well documented .. --------------------------------------------- http://phishme.com/a-peek-inside-an-affiliates-malspam-operation-kovter-and…

1 0

Tageszusammenfassung - Donnerstag 10-09-2015
by Daily end-of-shift report 10 Sep '15

10 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 09-09-2015 18:00 − Donnerstag 10-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The Security Risks of Third-Party Data *** --------------------------------------------- Most of us get to be thoroughly relieved that our e-mails werent in the Ashley Madison database. But dont get too comfortable. Whatever secrets you have, even the ones you dont think of as secret, are more likely than you think to get dumped on the Internet. Its .. --------------------------------------------- https://www.schneier.com/blog/archives/2015/09/the_security_ri_4.html *** RESTful - Moderately Critical - Access bypass - SA-CONTRIB-2015-147 *** --------------------------------------------- This module enables you to expose your Drupal backend by generating a RESTful API.The module doesnt sufficiently account for cores page cache generation for anonymous users, when using non-cookie authentication providers. Authenticated users, .. --------------------------------------------- https://www.drupal.org/node/2565875 *** Twitter - Moderately Critical - Access bypass - SA-CONTRIB-2015-146 *** --------------------------------------------- This module enables you to pull in public tweets from Twitter accounts, post messages to Twitter to announce content changes, and authenticate using Twitter.The module doesnt sufficiently check for access when using the Twitter Post .. --------------------------------------------- https://www.drupal.org/node/2565827 *** A look through the spam filters - examining waves of Upatre malspam, (Thu, Sep 10th) *** --------------------------------------------- Any email filtering worth its cost should block numerous messages every day. however, Im always interested to see what exactly is being blocked. Perhaps the most common type of malicious spam (malspam) I see from the spam filters is Upatre-based malspam. Ive written diaries before about specific waves of Upatre malspam sending the Dyre banking Trojan [1, 2]. Ive only noticed emails with .zip .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20135 *** MSRT September 2015: Teerac *** --------------------------------------------- As part of our ongoing effort to provide better malware protection, the September release of the Microsoft Malicious Software Removal Tool (MSRT) will include detection for the prevalent ransomware family Win32/Teerac. We first detected Teerac in early 2014. Since then, the family has joined Win32/Crowti .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/09/08/msrt-september-2015-teer… *** How Do You Solve A Problem Like Attribution? *** --------------------------------------------- There was an advert for weed-killer a while back, the tagline was something along the lines of 'Kill the root, kill the weed'. That's true of many problems, better to get to the heart of the issue and deal with it there, rather than .. --------------------------------------------- https://blog.team-cymru.org/2015/09/how-do-you-solve-a-problem-like-attribu… *** Obfuscated URLs, where is that link taking you? *** --------------------------------------------- We take a look at ways to obfuscate URL the way scammers do by using shortening services and encoded search engine URLs. --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/09/obfuscated-urls-where-is-t… *** Ein Patch, zwei offene Lücken in Cisco-Gateways *** --------------------------------------------- In der Software von Ciscos Web Security Appliance (WSA) und der Email Security Appliance (ESA) der Firma klaffen Lücken, die es Angreifern aus der Ferne erlauben, die Gateways lahmzulegen. Nur für eine der drei Lücken gibt es Abhilfe. --------------------------------------------- http://heise.de/-2809896 *** Free and Commercial Tools to Implement the SANS Top 20 Security Controls, Part 1 *** --------------------------------------------- This is the first in a series about the tools available to implement the SANS Top 20 Security Controls. The SANS Top 20 Security Controls are not standards. If you want standards and procedures, check out the NIST 800 series Special Publications (SP). The controls are recommendations made by .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/free-and-commercial-to… *** The Latest on Stagefright: CVE-2015-1538 Exploit is Now Available for Testing Purposes *** --------------------------------------------- More than a month has passed since Zimperium first broke the news of zLabs' VP of Platform Research and Exploitation Joshua J. Drake's discovery of multiple critical vulnerabilities in Android's media library - libstagefright. In that time frame, the number and importance of the events that have unfolded is nothing short of amazing. Back in April and May we reported two sets of vulnerabilities to Google, both .. --------------------------------------------- https://blog.zimperium.com/the-latest-on-stagefright-cve-2015-1538-exploit-… *** Ashley Madison: Hacker knacken 11,2 Millionen Passwörter *** --------------------------------------------- Die Login-Dateien im Ashley-Madison-Fundus galten bislang als sicher, weil der Anbieter eine sichere Hashfunktion verwendet haben soll. Doch jetzt haben Hacker eine Schwachstelle gefunden, um einen Teil der Passwörter zu knacken. --------------------------------------------- http://www.golem.de/news/ashley-madison-hacker-knacken-11-2-millionen-passw…

1 0

Tageszusammenfassung - Mittwoch 9-09-2015
by Daily end-of-shift report 09 Sep '15

09 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 08-09-2015 18:00 − Mittwoch 09-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** PMASA-2015-4 *** --------------------------------------------- This vulnerability allows to complete the reCaptcha test and subsequently perform a brute force attack to guess user credentials without having to complete further reCaptcha tests. --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2015-4/ *** Cisco Application Visibility and Control FlexConnect UDP Vulnerability *** --------------------------------------------- A vulnerability in Cisco Application Visibility and Control (AVC) software for wireless networking could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40845 *** Cisco Security Management Appliance Log Rollover Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the web interface of the Cisco Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on a targeted device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40847 *** [20150908] - Core - XSS Vulnerability *** --------------------------------------------- http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerabi… *** MS15-SEP - Microsoft Security Bulletin Summary for September 2015 - Version: 1.1 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-SEP *** Malicious Google Search Console Verifications *** --------------------------------------------- This past summer we noticed a trend of more and more Blackhat SEO hacks trying to verify additional accounts as owners of compromised sites in Google Search Console (formerly Webmaster Tools). Google Search Console provides really useful .. --------------------------------------------- https://blog.sucuri.net/2015/09/malicious-google-search-console-verificatio… *** Advantech WebAccess Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a stack-based overflow vulnerability in Advantech's WebAccess application to NCCIC/ICS-CERT. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-251-01 *** Patchday: Microsoft stopft 55 Lücken, Adobe nur zwei *** --------------------------------------------- Während Microsoft diesen Monat an der Sicherheit von mehreren Anwendungen schraubt, konzentriert sich Adobe ausschließlich auf den Shockwave Player. --------------------------------------------- http://heise.de/-2808452 *** Turla APT Group Abusing Satellite Internet Links *** --------------------------------------------- Researchers at Kaspersky Lab have revealed that the Turla APT gang is using satellite-based Internet links to hide command-and-control activities. --------------------------------------------- http://threatpost.com/turla-apt-group-abusing-satellite-internet-links/1145… *** A Brief Examination of Hacking Team's Crypter: core-packer. *** --------------------------------------------- In this blog entry we investigate how Italian malware vendor Hacking Team obfuscated their malware, specifically the custom software they developed for this task called core-packer2. This analysis was a joint project between Will Cummings and Ethan Heilman. --------------------------------------------- http://ethanheilman.tumblr.com/post/128708937890/a-brief-examination-of-hac…

1 0

Tageszusammenfassung - Dienstag 8-09-2015
by Daily end-of-shift report 08 Sep '15

08 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 07-09-2015 18:00 − Dienstag 08-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The state of Ransomware in 2015 *** --------------------------------------------- Ransomware has been a threat for quite some years, although the ransomware as its currently known, encrypting files, has only been around a few years. This change started with the initial 2013 CryptoLocker infections authored by the .. --------------------------------------------- http://blog.fox-it.com/2015/09/07/the-state-of-ransomware-in-2015/ *** Adult Player: Porno-App erpresst Android-Nutzer mit Selfies *** --------------------------------------------- Die Porno-App Adult Player schießt ein Selbstporträt des Nutzers, sperrt das Smartphone und fordert zur Zahlung von 500 US-Dollar auf. Nutzer können sich mit einfachen Mitteln schützen. --------------------------------------------- http://www.golem.de/news/adult-player-porno-app-erpresst-android-nutzer-mit… *** Sofacy Recycles Carberp and Metasploit Code *** --------------------------------------------- The Sofacy Group (also known as Pawn Storm or APT28) is well known for deploying zero-day exploits in their APT campaigns. For example, two recent zero-days used by the Sofacy Group were exploiting vulnerabilities in Microsoft .. --------------------------------------------- https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasp… *** Unauthenticated Path Disclosure *** --------------------------------------------- It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation. --------------------------------------------- http://www.typo3.org/news/article/unauthenticated-path-disclosure/ *** Jeep-Hack: Fiat Chrysler ruft weitere Modelle zurück *** --------------------------------------------- Aufgrund einer Sicherheitslücke im Infotainmentsystem ruft Fiat Chrysler in den USA 7810 SUV-Modelle zurück. Davon sollen sich rund die Hälfte noch bei Händlern befinden, die das Update vor dem Verkauf einspielen können. Nach Bekanntwerden .. --------------------------------------------- http://heise.de/-2807879 *** Ashley Madison, Why Do Our Honeypots Have Accounts On Your Website? *** --------------------------------------------- She is 33 years old, from Los Angeles, 6 feet tall, sexy, aggressive, and a 'woman who knows what she wants', according to her profile. She is intriguing. However, her intrigue doesn't end .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/ashley-madison-w… *** Cyber Security - Getting the Message *** --------------------------------------------- There is a concept in the health and safety industry known as 'sign blindness'. This occurs when safety notices become so numerous, or so familiar, that the human brain simply filters .. --------------------------------------------- https://blog.team-cymru.org/2015/09/cyber-security-getting-the-message/ *** FireEye untersucht Root-Lücken in Sicherheits-Appliances *** --------------------------------------------- Sicherheitsforscher hatten schwerwiegende Lücken in den Appliances der Firma entdeckt. Ihre Hinweise blieben nach eigenen Angaben 18 Monate lang unbeantwortet. FireEye sagt, man wisse erst seit Montag von den Lücken. --------------------------------------------- http://heise.de/-2807930 *** iOS 8.4.1 Kernel Vulnerabilities in AppleHDQGasGaugeControl *** --------------------------------------------- When auditing iOS kernel executable, we found that the code quality of com.apple.driver.AppleHDQGasGaugeControl is very bad. In this blog, we will disclose 3 vulnerabilities in this kernel extension on the latest public iOS (version 8.4.1). More .. --------------------------------------------- http://blog.pangu.io/ios-8-4-1-kernel-vulns/ *** WhatsApp 'MaliciousCard' Vulnerabilities Allowed Attackers to Compromise Hundreds of Millions of WhatsApp Users *** --------------------------------------------- WhatsApp Web is a web-based extension of the WhatsApp application on your phone. The web application mirrors all messages sent and received, and fully synchronize your phone and your desktop computer so that users can see all messages on both devices. --------------------------------------------- http://blog.checkpoint.com/2015/09/08/whatsapp-maliciouscard-vulnerabilitie… *** Security Update Available for Adobe Shockwave Player (APSB15-22) *** --------------------------------------------- A security bulletin (APSB15-22) has been published regarding a security update for Adobe Shockwave Player. This update addresses critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1268

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily