Daily

daily@lists.cert.at

1 participants
3137 discussions

Tageszusammenfassung - Donnerstag 17-09-2015
by Daily end-of-shift report 17 Sep '15

17 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 16-09-2015 18:00 − Donnerstag 17-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** A Brief Introduction to #totalhash *** --------------------------------------------- #totalhash is Team Cymru's malware analysis database, providing static and dynamic analysis of malware samples free for non-commercial use. Haven't tried #totalhash yet? Here's a brief video with a few highlights on how to upload samples, search our database, and go down the rabbit hole .. --------------------------------------------- https://blog.team-cymru.org/2015/09/a-brief-introduction-to-totalhash/ *** Bugtraq: [security bulletin] HPSBGN03393 rev.2 - HP Operations Manager i, Remote Code Execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/536478 *** Stagefrightened? *** --------------------------------------------- There's been a lot of attention recently around a number of vulnerabilities in Android's libstagefright. There's been a lot of confusion about the remote exploitability of the issues, especially on modern devices. In this blog post we will demonstrate an exploit for one of the libstagefright vulnerabilities .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/09/stagefrightened.html *** ZDI-15-444: Symantec Web Gateway Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-444/ *** ZDI-15-443: Symantec Web Gateway Arbitrary PHP File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is required to exploit this vulnerability, however it can be bypassed via reflected cross-site scripting. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-443/ *** ZDI-15-445: (0Day) Avira Management Console Update Manager Service HTTP Header Use-After-Free Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Avira Management Console. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-445/ *** CMS Updater - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-150 *** --------------------------------------------- The module does not sufficiently protect the settings page allowing any user with the permission "access administration pages" to change settings. --------------------------------------------- https://www.drupal.org/node/2569599 *** Drupal 7 driver for SQL Server and SQL Azure - Moderately Critical - SQL Injection - SA-CONTRIB-2015-148 *** --------------------------------------------- Certain characters aren't properly escaped by the Drupal database API. A malicious user may be able to access restricted information by performing a specially-crafted search. --------------------------------------------- https://www.drupal.org/node/2569577 *** Who's Behind Bluetooth Skimming in Mexico? *** --------------------------------------------- In the previous two stories, I documented the damage wrought by an organized crime gang in Mexico that has been systematically bribing ATM technicians to install Bluetooth skimming components that allow thieves to steal card and PIN data wirelessly. What follows is a look at a mysterious new ATM company in Mexico that sources say may be tied to the skimming activity. --------------------------------------------- http://krebsonsecurity.com/2015/09/whos-behind-bluetooth-skimming-in-mexico/ *** iTunes 12.3: Mehr Sicherheit, weniger Fehler und ein grosser Download *** --------------------------------------------- Zusammen mit iOS 9 hat Apple auch eine neue Version von iTunes freigegeben. Apple beseitigte insbesondere unter Windows Sicherheitslücken, die sogar das Abgreifen von verschlüsselten Zugangsdaten im Netzwerk erlaubten. Zudem erhöht Apple die Sicherheit bei der Verwendung von Apple IDs. --------------------------------------------- http://www.golem.de/news/itunes-12-3-mehr-sicherheit-weniger-fehler-und-ein… *** Behind the scenes at BruCON, a European hacker conference *** --------------------------------------------- Setting up a local conference seems to be a popular way for infosec pros that havent got the time or means to travel to bring the people they want to meet and the knowledge they want to attain .. --------------------------------------------- http://www.net-security.org/secworld.php?id=18863 *** Seven years of malware linked to Russian state-backed cyber espionage *** --------------------------------------------- F-Secure report details "The Dukes" malware family and its Russian connections. For the past seven years, a cyber-espionage group operating out of Russia .. --------------------------------------------- http://arstechnica.com/security/2015/09/seven-years-of-malware-linked-to-ru… *** Throwback Thursday: Virus Writer and Distributors Attributable Viruses *** --------------------------------------------- This Throwback Thursday, we turn the clock back to July 1990, when VB looked at virus origins and some of the rare cases of attributable viruses.This week saw the confession of a former teenage virus writer: the author of the Leprosy .. --------------------------------------------- http://www.virusbtn.com/blog/2015/09_17.xml *** Studie: In den USA droht ein Wahlmaschinen-Debakel *** --------------------------------------------- on den 50 US-Staaten werden 43 im kommenden Jahr besonders fehleranfällige Wahlcomputer einsetzen, die mindestens zehn Jahre alt sind, heißt es in einer Analyse der New York University. Dies berge große Risiken. --------------------------------------------- http://heise.de/-2820268 *** MMD-0042-2015 - Polymorphic in ELF malware: Linux/Xor.DDOS *** --------------------------------------------- The threat of Linux/XOR.DDoS, a China-made ELF backdoor ddoser malware, its still on going. I received a good question from (I assumed from a victim of infection) asked about why the found malware is not the same as what was firstly executed ELF malware binary. This writing is short and covering .. --------------------------------------------- http://blog.malwaremustdie.org/2015/09/mmd-0042-2015-polymorphic-in-elf.html *** HTTP Evasions Explained - Part 2 - Deflate Compression *** --------------------------------------------- This is the second article in a series which will explain the evasions done by HTTP Evader. It covers the failure of several firewalls to support content some compressions supported by all or most browsers, notable the deflate compression. In short, it is possible to bypass the malware inspection of several firewalls by simply sending a response compressed by deflate: --------------------------------------------- http://noxxi.de/research/http-evader-explained-2-deflate.html

1 0

Tageszusammenfassung - Mittwoch 16-09-2015
by Daily end-of-shift report 16 Sep '15

16 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 15-09-2015 18:00 − Mittwoch 16-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** CoreBot Adds New Capabilities, Transitions to Banking Trojan *** --------------------------------------------- As many researchers expected it would, CoreBot, the credential-stealing malware that first surfaced last month, has added a bevy of new capabilities and reinvented itself as a robust banking Trojan. --------------------------------------------- http://threatpost.com/corebot-adds-new-capabilities-transitions-to-banking-… *** Hacking Team looks to hire hacker *** --------------------------------------------- Following the compromising of nearly all its databases and emails, and then the subsequent release of those company details, Hacking Team posted a job listing for a "hacker/developer." --------------------------------------------- http://www.scmagazine.com/hacking-team-looks-to-expand-team-after-breach/ar… *** WordPress Brute Force Attacks - 2015 Threat Landscape *** --------------------------------------------- One of the first server-level compromises I had to deal with in my life was around 15 years ago, and it was caused by an SSH brute force attack. A co-worker set up a test server and chose a very weak root password. A few days later, the box was compromised .. --------------------------------------------- https://blog.sucuri.net/2015/09/wordpress-brute-force-attacks-2015-threat-l… *** Malicious spam with zip attachments containing .js files, (Wed, Sep 16th) *** --------------------------------------------- On 2015-07-29, the ISC publisheda diary covering malicious spam (malspam) with zip archives of javascript (.js) files [1]. Since then, weve received notifications from others who have found this type of malspam. Lets revisit the spam filters, search for this type of email, and see if anything .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20153 *** "Unternehmen wollen Sicherheitslösungen aus Europa" *** --------------------------------------------- SBA Research hat den ersten österreichischen Inkubator für Cybersicherheits-Start-ups ins Leben gerufen. Die futurezone hat die Geschäftsführer des Kompetenzentrums befragt. --------------------------------------------- http://futurezone.at/thema/start-ups/unternehmen-wollen-sicherheitsloesunge… *** In Search of SYNful Routers *** --------------------------------------------- On Tuesday, September 15, 2015, Mandiant and FireEye disclosed SYNful Knock, a router implant discovered on fourteen Cisco routers in India, Mexico, the Philippines, and Ukraine. The implant consists a modified version of the Cisco firmware that provides attackers with unrestricted access to the router including the ability to load additional modules. The attack is .. --------------------------------------------- https://zmap.io/synful/ *** Can an inevitable evil be conquered? *** --------------------------------------------- Scanning an object (a file or web resource) with an Internet security program essentially comes down to making a binary decision: dangerous or safe? An antivirus engine puts forward the hypothesis that an object is malicious and then checks .. --------------------------------------------- http://securelist.com/blog/opinions/72180/can-an-inevitable-evil-be-conquer… *** Enthüllungsplattform Cryptome: PGP-Schlüssel kompromittiert *** --------------------------------------------- Mit Zugang zu den Schlüsseln der Plattform und des Gründers John Young könnten Angreifer verschlüsselte Mails lesen und sich als Betreiber der Webseite ausgeben. --------------------------------------------- http://heise.de/-2817797 *** Cyberkriminalität in Österreich: Fragen und Antworten *** --------------------------------------------- Das Bundeskriminalamt präsentiert gemeinsam mit der futurezone den Cybercrime-Report 2014. Wir laden am Montagabend zur Diskussion über Trends in der Cyberkriminalität. --------------------------------------------- http://futurezone.at/digital-life/cyberkriminalitaet-in-oesterreich-fragen-… *** Android-Passwortsperre lässt sich zum Teil leicht austricksen *** --------------------------------------------- Bei Nexus-Geräten demonstriert, unklar ob andere Geräte betroffen sind – Google liefert bereits Update --------------------------------------------- http://derstandard.at/2000022284907 *** Schneider Electric StruxureWare Building Expert Plaintext Credentials Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cleartext transmission vulnerability in Schneider Electric's StruxureWare Building Expert product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-01 *** 3S CODESYS Gateway Server Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a heap-based buffer overflow vulnerability in 3S-Smart Software Solutions GmbH's CODESYS Gateway Server. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-02 *** GE MDS PulseNET Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two vulnerabilities in GE's MDS PulseNET and MDS PulseNET Enterprise Network Management Software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-03 *** Advantech WebAccess Stack-Based Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a stack-based buffer overflow vulnerability in Advantech's WebAccess application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-04 *** Attacks over DNS *** --------------------------------------------- DNS is a naming system used for all devices connected to the Internet or a network. DNS is easy to remember instead of IP addresses for users. It is a method in which domain names are translated into an IP (Internet Protocol) addresses. The DNS works .. --------------------------------------------- http://resources.infosecinstitute.com/attacks-over-dns/ *** SYNful Knock - A Cisco router implant - Part II *** --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis0.h… *** Trojan.MWZLesson.a Trojan for POS terminals *** --------------------------------------------- For many years POS terminals remain one the most favorite targets for virus makers. Due to the fact that this technology is used by a large number of sales organizations around the world to process payments made using bank cards, cybercriminals just .. --------------------------------------------- http://news.drweb.com/show/?i=9615&lng=en&c=9 *** Einstweilige Verfügung: Fireeye geht juristisch gegen Sicherheitsforscher vor *** --------------------------------------------- Ein Team von Sicherheitsforschern wollte auf einer Konferenz über Sicherheitslücken in Fireeye-Produkten berichten. Fireeye sah durch die Präsentation Geschäftsgeheimnisse bedroht und hat eine einstweilige Verfügung erwirkt. --------------------------------------------- http://www.golem.de/news/einstweilige-verfuegung-fireeye-geht-juristisch-ge… *** TeslaCrypt 2.0: Cyber Crime Malware Behavior, Capabilities and Communications *** --------------------------------------------- As part of our normal course of operations as a cyber threat intelligence provider, we monitor the cyber crime underground and provide analysis to our clients on new and emerging threats. As you can imagine, we naturally run into large quantities of malware on a daily basis. From time to time, we .. --------------------------------------------- http://www.isightpartners.com/2015/09/teslacrypt-2-0-cyber-crime-malware-be… *** Free and Commercial Tools to Implement the SANS Top 20 Security Controls, Part 2 *** --------------------------------------------- This is Part 2 of a How-To is an effort to compile a list of tools (free and commercial) that can help an IT administrator comply with the Security Controls. In Part 1 we looked at Inventory of Authorized and Unauthorized Devices. The controls (ordered 1-20) are in order of importance. In other words, completing .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/free-and-commercial-to…

1 0

Tageszusammenfassung - Dienstag 15-09-2015
by Daily end-of-shift report 15 Sep '15

15 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 14-09-2015 18:00 − Dienstag 15-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Enabling QR codes in Internet Explorer, or a story of a cross-platform memory disclosure *** --------------------------------------------- Posted by Mateusz Jurczyk of Google Project ZeroIn the previous series of posts (parts #1 #2 #3 #4), we discussed the exploitation process of a serious 'blend' vulnerability (CVE-2015-0093 / CVE-2015-3052), which was special .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/09/enabling-qr-codes-in-internet… *** Mapping How Tor's Anonymity Network Spread Around the World *** --------------------------------------------- Germany has overtaken the US in total nodes, with France, the Netherlands, and Russia coming close behind.The post Mapping How Tor's Anonymity Network Spread Around the World appeared first on WIRED. --------------------------------------------- http://www.wired.com/2015/09/mapping-tors-anonymity-network-spread-around-w… *** Large Malvertising Campaign Goes (Almost) Undetected *** --------------------------------------------- A very stealthy malvertising campaign has gone under everybodys noses and exposed a large amount of people to malware. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/09/large-malvertising-cam… *** Tracking Bluetooth Skimmers in Mexico, Part II *** --------------------------------------------- I spent four days last week in Mexico, tracking the damage wrought by an organized crime ring that is bribing ATM technicians to place Bluetooth skimmers inside of cash machines in and around the tourist areas of Cancun. Today's piece chronicles the work of this gang in coastal regions farther south, following a trail of hacked ATMs from Playa Del Camen down to the ancient Mayan ruins in Tulum. --------------------------------------------- http://krebsonsecurity.com/2015/09/tracking-bluetooth-skimmers-in-mexico-pa… *** SYNful Knock - A Cisco router implant - Part I *** --------------------------------------------- Router implants, from any vendor in the enterprise space, have been largely believed to be theoretical in nature and especially in use. However, recent vendor advisories indicate that these have been seen in the wild. Mandiant can confirm the existence of at least 14 such router implants spread across four different countries: Ukraine, Philippines, Mexico, and India. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.ht… *** Hey, Oracle, whats in that VirtualBox security update? *crickets* *** --------------------------------------------- Debian team bit miffed about secretive vuln fixes in hypervisor software Its not just Microsoft keeping schtum on exactly whats inside its software updates. --------------------------------------------- www.theregister.co.uk/2015/09/15/oracle_virtualbox_security_updates/ *** Von Flugzeugen bis Mars-Rovern: Lücke im Echtzeitbetriebssystem VxWorks *** --------------------------------------------- Das Echtzeitbetriebssystem VxWorks ist verwundbar und Angreifer können eigenen Code ausführen. Das System kommt in rund 1,5 Milliarden Geräten zum Einsatz - darunter auch im Mars-Rover Curiosity. --------------------------------------------- http://heise.de/-2812783 *** Another LinkedIn Sockpuppet *** --------------------------------------------- According to LinkedIn, 11 of my connections can introduce me to someone who 'knows' Anna. I'm not so sure about that. According to IMDb, Anna Sentina is really Anna Akana. Maybe LinkedIn should start charging to 'verify' recruiter .. --------------------------------------------- https://labsblog.f-secure.com/2015/09/15/another-linkedin-sockpuppet/ *** Our First Certificate Is Now Live *** --------------------------------------------- Let's Encrypt passed another major milestone by issuing our first certificate. You can see it in action here. --------------------------------------------- https://letsencrypt.org/2015/09/14/our-first-cert.html *** KCI Attacks against TLS *** --------------------------------------------- Protection of Internet communication is crucial in todays hyperconnected world. The industry standard for encrypting private and sensitive communication data over potentially adversarial controlled network cables and radio signals is TLS. ESSE, the security team of RISE GmbH, discovered a .. --------------------------------------------- https://kcitls.org/ *** Hunting Asynchronous Vulnerabilities *** --------------------------------------------- As the video of my 44Con presentation Hunting Asynchronous Vulnerabilities probably wont be available for a while, I thought Id provide a mildly abridged (and less vendor-neutral) writeup of the core technical content. You can download the slides here. --------------------------------------------- http://blog.portswigger.net/2015/09/hunting-asynchronous-vulnerabilities.ht… *** WordPress 4.3.1 Security and Maintenance Release *** --------------------------------------------- https://wordpress.org/news/2015/09/wordpress-4-3-1/ *** VB2015 last-minute papers announced *** --------------------------------------------- Ten talks covering hot research added to the VB2015 programme.There are just over two weeks to go until more than 400 security professionals descend on Prague for VB2015, the 25th Virus Bulletin International Conference.With the addition of ten last-minute papers, the conference programme is now almost complete: two keynotes (by Ross Anderson and Costin Raiu), seven Small Talks and 51 regular presentations mean the three conference days are packed with interesting talks and discussions on a --------------------------------------------- http://www.virusbtn.com/blog/2015/09_15.xml?rss *** Finding Vulnerabilities in Core WordPress: A Bug Hunter�s Trilogy, Part III - Ultimatum *** --------------------------------------------- In this series of blog posts, Check Point vulnerability researcher Netanel Rubin tells a story in three acts - describing his long path of discovered flaws and vulnerabilities in core WordPress, leading him from a read-only 'Subscriber' user, through creating, editing and deleting posts, and all the way to performing SQL injection and persistent XSS attacks on 20% of the popular web. --------------------------------------------- http://blog.checkpoint.com/2015/09/15/finding-vulnerabilities-in-core-wordp…

1 0

Tageszusammenfassung - Montag 14-09-2015
by Daily end-of-shift report 14 Sep '15

14 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 11-09-2015 18:00 − Montag 14-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** FireEye wegen Umgang mit Sicherheitsforschern in der Kritik *** --------------------------------------------- Ein deutscher Forscher, der Lücken in Sicherheits-Gateways der Firma FireEye entdeckt hat, wurde per einstweiliger Verfügung dazu gezwungen, seinen Vortrag zu zensieren. Sein Firmenchef spricht von unprofessionellem Verhalten seitens FireEye. --------------------------------------------- http://heise.de/-2811690 *** Tracking a Bluetooth Skimmer Gang in Mexico *** --------------------------------------------- -Sept. 9, 12:30 p.m. CT, Yucatan Peninsula, Mexico: Halfway down the southbound four-lane highway from Cancun to the ancient ruins in Tulum, traffic inexplicably slowed to a halt. There was some sort of checkpoint ahead by the Mexican Federal Police. I began to wonder whether it was a good idea to have .. --------------------------------------------- http://krebsonsecurity.com/2015/09/tracking-a-bluetooth-skimmer-gang-in-mex… *** Neuer Android-Trojaner erpresst mit Lock-Screen-Sperre *** --------------------------------------------- Versucht über Trick Device-Admin-Rechte einzuholen – Nur jenseits des Play Stores verbreitet --------------------------------------------- http://derstandard.at/2000022182737 *** How Command and Control Servers Remain Resilient *** --------------------------------------------- One of the ways that malware activity on a network is spotted is via the activity of their network activity. However, in many cases this can be difficult to detect: there have been incidents where command-and-control (C&C) servers were able to stay .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/adapting-to-chan… *** "Die Gefahr ist real": Auto-Hacks schrecken Branche auf *** --------------------------------------------- IT-Forscher übernahmen mehrmals Kontrolle über Fahrzeuge --------------------------------------------- http://derstandard.at/2000022195679 *** Österreichische Forscher entdecken TLS-Schwachstelle *** --------------------------------------------- Facebook vergibt Bug Bounty-Award an Rise – "Sicherheits-Desaster" verhindert --------------------------------------------- http://derstandard.at/2000022197161 *** Bundestag-Hack war ein Phishing-Angriff über un.org *** --------------------------------------------- Die Angreifer auf den Bundestag haben wohl Mails mit gefälschter Absendeadresse verschickt, die einen Link auf Malware enthielten. Nicht nur der Bundestag, sondern mehrere internationale Organisationen seien gleichzeitig angegriffen worden. --------------------------------------------- http://heise.de/-2811847 *** The Wordpress Plugins Playground *** --------------------------------------------- This morning, I had a quick look at my web serverlog file and searched for malicious activity. Attacks like brute-force generate a lot of entries and thuscan be easily detected.Other scanners are working below the radar and search for very specific vulnerabilities. In this case, a single request is often .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20147 *** The Shade Encryptor: a Double Threat *** --------------------------------------------- A family of ransomware Trojans emerged in late 2014/early 2015, and quickly established itself among the top three most widespread encryptors. This threat has been assigned the verdict Trojan-Ransom.Win32.Shade according to Kaspersky Labs classification. The original name given to the encryptor by its creator is not known. --------------------------------------------- http://securelist.com/analysis/publications/72087/the-shade-encryptor-a-dou… *** HTTP Evasions Explained - Part 1 - Evading Using HTTP 0.9 *** --------------------------------------------- This is the first article in a series which will explain the evasions done by HTTP evader. It covers the case that most firewalls only block what they detected as explicitly bad and simply pass what they dont understand. The main technique used in this part is the old but still working HTTP 0.9 protocol. --------------------------------------------- http://noxxi.de/research/http-evader-explained-1-http09.html *** Exploiting CSRF against search with Lucene *** --------------------------------------------- Cross domain timing attacks can be used against Lucene to reliably extract information contained within its index. By repeatedly timing HTTP requests using JavaScript Lucene search boxes can be exploited in a similar way to time based blind-sql injection. --------------------------------------------- https://www.idontplaydarts.com/2015/09/cross-domain-timing-attacks-against-… *** Brief analysis of a SQL injection in Cacti 0.8.8b *** --------------------------------------------- Back in September 2013 I wanted to practice some code auditing and picked the latest version of Cacti (v0.8.8b at the time). I spent a few hours looking into the code and also assessing a running instance of Cacti and this exercise resulted in a few vulnerabilities. I was motivated to finally put together this .. --------------------------------------------- http://blog.whatever.io/2015/09/12/brief-analysis-of-a-sql-injection-in-cac… *** Addressing the Delayed Message Attack in Wireless IoT Environments *** --------------------------------------------- While many years have passed while we're waiting for IoT to take over the world, there are some recent signs that it might indeed eventually happen. With this in mind, issues related to IoT security tend to become more and more important. In this article, we won't be talking about current IoT security .. --------------------------------------------- http://ithare.com/addressing-the-delayed-message-attack-in-wireless-iot-env…

1 0

Tageszusammenfassung - Freitag 11-09-2015
by Daily end-of-shift report 11 Sep '15

11 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 10-09-2015 18:00 − Freitag 11-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Bundeslagebild Cybercrime: Crime-as-a-Service wächst weiter *** --------------------------------------------- Das Bundeskriminalamt hat auf seiner Cybercrime-Konferenz C³ das Lagebild Cybercrime veröffentlicht. Demnach steigt die Bedrohung auf allen Gebieten der computerunterstützen Kriminalität. --------------------------------------------- http://heise.de/-2810254 *** VMSA-2015-0003.11 *** --------------------------------------------- Oracle JRE is updated in VMware products to address a critical security issue that existed in earlier releases of Oracle JRE. VMware products running JRE 1.7 Update 75 or newer and JRE 1.6 Update 91 or newer are not vulnerable to CVE-2014-6593, .. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** OpenLDAP Bug in ber_get_next() Lets Remote Users Cause the Target Service to Crash *** --------------------------------------------- A vulnerability was reported in OpenLDAP. A remote user can cause the target service to crash. A remote user can send a specially crafted packet to cause the target slapd service to crash. --------------------------------------------- http://www.securitytracker.com/id/1033534 *** Yokogawa Multiple Products Buffer Overflow Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for stack-based buffer overflow vulnerabilities in multiple Yokogawa products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-253-01 *** Von T-Systems: Der Bundestag bekommt eine neue IT-Infrastruktur *** --------------------------------------------- Als Reaktion auf den Hackerangriff werden im Bundestag nun mehr als 10.000 Webseiten dauerhaft gesperrt. Außerdem soll T-Systems ein neues Netzwerk aufbauen. Bundestags-Mitarbeiter müssen ihre USB-Sticks bald zu Hause lassen. --------------------------------------------- http://www.golem.de/news/von-t-systems-der-bundestag-bekommt-eine-neue-it-i… *** Google veröffentlicht erstes monatliches Sicherheitsupdate *** --------------------------------------------- Nach der Entdeckung der Stagefright-Sicherheitslücke hatte Google angekündigt, einen monatlichen Patchday mit Sicherheitsupdates einzuführen. Jetzt sind die ersten Builds veröffentlicht worden. --------------------------------------------- http://www.golem.de/news/android-google-veroeffentlicht-erstes-monatliches-… *** Simulation zeigte Millionen Hacker-Angriffe auf Zug-Steuersysteme *** --------------------------------------------- Falle "HoneyTrain": Wer würde tatsächlich versuchen, in die originalgetreue Nachbildung eines Zug-Steuerungssystems einzudringen? --------------------------------------------- http://derstandard.at/2000022056115 *** Cyber criminal crew DD4BC extorts businesses via DDoS *** --------------------------------------------- According to a report recently issued by Akamai, the DD4BC criminal group has been responsible for at least 114 DDoS attacks on its customers. According the Akamai firm, the criminal crews known as DD4BC has carried out at least 114 .. --------------------------------------------- http://securityaffairs.co/wordpress/40034/cyber-crime/dd4bc-group-extortion… *** Analysing a new eBanking Trojan called Fobber *** --------------------------------------------- Some weeks ago we read an interesting blog by Malwarebytes about Fobber, a new e-banking focussed malware in the arena that seems to be a Tinba spinoff. We decided to have a closer look at it to find out whether Swiss critical infrastructures are targeted by it. Wed like to share our findings with you, because it contains some interesting advanced techniques .. --------------------------------------------- http://www.govcert.admin.ch/blog/12/analysing-a-new-ebanking-trojan-called-… *** SUCEFUL: Next Generation ATM Malware *** --------------------------------------------- You dip your debit card in an automated teller machine (ATM) and suddenly realize it is stuck inside, what happened? --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/09/suceful_next_genera.ht… *** A Retrospective on Ashely Madison and the Value of Threat Modeling *** --------------------------------------------- One of my favourite authors in the field of computer security is Gary McGraw. If you are not familiar with him, I'd suggest you start by reading his book Software Security: Building Security In. One of the key points he makes is a distinction .. --------------------------------------------- https://littlemaninmyhead.wordpress.com/2015/09/08/a-retrospective-on-ashel… *** A Peek Inside an Affiliate's Malspam Operation: Kovter and Miuref/Boaxxe Infections *** --------------------------------------------- In March of this year, reports of malspam campaigns utilizing an email attached '.doc.js' files, which tied back to the Kovter and Boaxxe clickfraud trojans. The analysis of these malware families have already been well documented .. --------------------------------------------- http://phishme.com/a-peek-inside-an-affiliates-malspam-operation-kovter-and…

1 0

Tageszusammenfassung - Donnerstag 10-09-2015
by Daily end-of-shift report 10 Sep '15

10 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 09-09-2015 18:00 − Donnerstag 10-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The Security Risks of Third-Party Data *** --------------------------------------------- Most of us get to be thoroughly relieved that our e-mails werent in the Ashley Madison database. But dont get too comfortable. Whatever secrets you have, even the ones you dont think of as secret, are more likely than you think to get dumped on the Internet. Its .. --------------------------------------------- https://www.schneier.com/blog/archives/2015/09/the_security_ri_4.html *** RESTful - Moderately Critical - Access bypass - SA-CONTRIB-2015-147 *** --------------------------------------------- This module enables you to expose your Drupal backend by generating a RESTful API.The module doesnt sufficiently account for cores page cache generation for anonymous users, when using non-cookie authentication providers. Authenticated users, .. --------------------------------------------- https://www.drupal.org/node/2565875 *** Twitter - Moderately Critical - Access bypass - SA-CONTRIB-2015-146 *** --------------------------------------------- This module enables you to pull in public tweets from Twitter accounts, post messages to Twitter to announce content changes, and authenticate using Twitter.The module doesnt sufficiently check for access when using the Twitter Post .. --------------------------------------------- https://www.drupal.org/node/2565827 *** A look through the spam filters - examining waves of Upatre malspam, (Thu, Sep 10th) *** --------------------------------------------- Any email filtering worth its cost should block numerous messages every day. however, Im always interested to see what exactly is being blocked. Perhaps the most common type of malicious spam (malspam) I see from the spam filters is Upatre-based malspam. Ive written diaries before about specific waves of Upatre malspam sending the Dyre banking Trojan [1, 2]. Ive only noticed emails with .zip .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20135 *** MSRT September 2015: Teerac *** --------------------------------------------- As part of our ongoing effort to provide better malware protection, the September release of the Microsoft Malicious Software Removal Tool (MSRT) will include detection for the prevalent ransomware family Win32/Teerac. We first detected Teerac in early 2014. Since then, the family has joined Win32/Crowti .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/09/08/msrt-september-2015-teer… *** How Do You Solve A Problem Like Attribution? *** --------------------------------------------- There was an advert for weed-killer a while back, the tagline was something along the lines of 'Kill the root, kill the weed'. That's true of many problems, better to get to the heart of the issue and deal with it there, rather than .. --------------------------------------------- https://blog.team-cymru.org/2015/09/how-do-you-solve-a-problem-like-attribu… *** Obfuscated URLs, where is that link taking you? *** --------------------------------------------- We take a look at ways to obfuscate URL the way scammers do by using shortening services and encoded search engine URLs. --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/09/obfuscated-urls-where-is-t… *** Ein Patch, zwei offene Lücken in Cisco-Gateways *** --------------------------------------------- In der Software von Ciscos Web Security Appliance (WSA) und der Email Security Appliance (ESA) der Firma klaffen Lücken, die es Angreifern aus der Ferne erlauben, die Gateways lahmzulegen. Nur für eine der drei Lücken gibt es Abhilfe. --------------------------------------------- http://heise.de/-2809896 *** Free and Commercial Tools to Implement the SANS Top 20 Security Controls, Part 1 *** --------------------------------------------- This is the first in a series about the tools available to implement the SANS Top 20 Security Controls. The SANS Top 20 Security Controls are not standards. If you want standards and procedures, check out the NIST 800 series Special Publications (SP). The controls are recommendations made by .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/free-and-commercial-to… *** The Latest on Stagefright: CVE-2015-1538 Exploit is Now Available for Testing Purposes *** --------------------------------------------- More than a month has passed since Zimperium first broke the news of zLabs' VP of Platform Research and Exploitation Joshua J. Drake's discovery of multiple critical vulnerabilities in Android's media library - libstagefright. In that time frame, the number and importance of the events that have unfolded is nothing short of amazing. Back in April and May we reported two sets of vulnerabilities to Google, both .. --------------------------------------------- https://blog.zimperium.com/the-latest-on-stagefright-cve-2015-1538-exploit-… *** Ashley Madison: Hacker knacken 11,2 Millionen Passwörter *** --------------------------------------------- Die Login-Dateien im Ashley-Madison-Fundus galten bislang als sicher, weil der Anbieter eine sichere Hashfunktion verwendet haben soll. Doch jetzt haben Hacker eine Schwachstelle gefunden, um einen Teil der Passwörter zu knacken. --------------------------------------------- http://www.golem.de/news/ashley-madison-hacker-knacken-11-2-millionen-passw…

1 0

Tageszusammenfassung - Mittwoch 9-09-2015
by Daily end-of-shift report 09 Sep '15

09 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 08-09-2015 18:00 − Mittwoch 09-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** PMASA-2015-4 *** --------------------------------------------- This vulnerability allows to complete the reCaptcha test and subsequently perform a brute force attack to guess user credentials without having to complete further reCaptcha tests. --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2015-4/ *** Cisco Application Visibility and Control FlexConnect UDP Vulnerability *** --------------------------------------------- A vulnerability in Cisco Application Visibility and Control (AVC) software for wireless networking could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40845 *** Cisco Security Management Appliance Log Rollover Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the web interface of the Cisco Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on a targeted device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40847 *** [20150908] - Core - XSS Vulnerability *** --------------------------------------------- http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerabi… *** MS15-SEP - Microsoft Security Bulletin Summary for September 2015 - Version: 1.1 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-SEP *** Malicious Google Search Console Verifications *** --------------------------------------------- This past summer we noticed a trend of more and more Blackhat SEO hacks trying to verify additional accounts as owners of compromised sites in Google Search Console (formerly Webmaster Tools). Google Search Console provides really useful .. --------------------------------------------- https://blog.sucuri.net/2015/09/malicious-google-search-console-verificatio… *** Advantech WebAccess Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a stack-based overflow vulnerability in Advantech's WebAccess application to NCCIC/ICS-CERT. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-251-01 *** Patchday: Microsoft stopft 55 Lücken, Adobe nur zwei *** --------------------------------------------- Während Microsoft diesen Monat an der Sicherheit von mehreren Anwendungen schraubt, konzentriert sich Adobe ausschließlich auf den Shockwave Player. --------------------------------------------- http://heise.de/-2808452 *** Turla APT Group Abusing Satellite Internet Links *** --------------------------------------------- Researchers at Kaspersky Lab have revealed that the Turla APT gang is using satellite-based Internet links to hide command-and-control activities. --------------------------------------------- http://threatpost.com/turla-apt-group-abusing-satellite-internet-links/1145… *** A Brief Examination of Hacking Team's Crypter: core-packer. *** --------------------------------------------- In this blog entry we investigate how Italian malware vendor Hacking Team obfuscated their malware, specifically the custom software they developed for this task called core-packer2. This analysis was a joint project between Will Cummings and Ethan Heilman. --------------------------------------------- http://ethanheilman.tumblr.com/post/128708937890/a-brief-examination-of-hac…

1 0

Tageszusammenfassung - Dienstag 8-09-2015
by Daily end-of-shift report 08 Sep '15

08 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 07-09-2015 18:00 − Dienstag 08-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The state of Ransomware in 2015 *** --------------------------------------------- Ransomware has been a threat for quite some years, although the ransomware as its currently known, encrypting files, has only been around a few years. This change started with the initial 2013 CryptoLocker infections authored by the .. --------------------------------------------- http://blog.fox-it.com/2015/09/07/the-state-of-ransomware-in-2015/ *** Adult Player: Porno-App erpresst Android-Nutzer mit Selfies *** --------------------------------------------- Die Porno-App Adult Player schießt ein Selbstporträt des Nutzers, sperrt das Smartphone und fordert zur Zahlung von 500 US-Dollar auf. Nutzer können sich mit einfachen Mitteln schützen. --------------------------------------------- http://www.golem.de/news/adult-player-porno-app-erpresst-android-nutzer-mit… *** Sofacy Recycles Carberp and Metasploit Code *** --------------------------------------------- The Sofacy Group (also known as Pawn Storm or APT28) is well known for deploying zero-day exploits in their APT campaigns. For example, two recent zero-days used by the Sofacy Group were exploiting vulnerabilities in Microsoft .. --------------------------------------------- https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasp… *** Unauthenticated Path Disclosure *** --------------------------------------------- It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation. --------------------------------------------- http://www.typo3.org/news/article/unauthenticated-path-disclosure/ *** Jeep-Hack: Fiat Chrysler ruft weitere Modelle zurück *** --------------------------------------------- Aufgrund einer Sicherheitslücke im Infotainmentsystem ruft Fiat Chrysler in den USA 7810 SUV-Modelle zurück. Davon sollen sich rund die Hälfte noch bei Händlern befinden, die das Update vor dem Verkauf einspielen können. Nach Bekanntwerden .. --------------------------------------------- http://heise.de/-2807879 *** Ashley Madison, Why Do Our Honeypots Have Accounts On Your Website? *** --------------------------------------------- She is 33 years old, from Los Angeles, 6 feet tall, sexy, aggressive, and a 'woman who knows what she wants', according to her profile. She is intriguing. However, her intrigue doesn't end .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/ashley-madison-w… *** Cyber Security - Getting the Message *** --------------------------------------------- There is a concept in the health and safety industry known as 'sign blindness'. This occurs when safety notices become so numerous, or so familiar, that the human brain simply filters .. --------------------------------------------- https://blog.team-cymru.org/2015/09/cyber-security-getting-the-message/ *** FireEye untersucht Root-Lücken in Sicherheits-Appliances *** --------------------------------------------- Sicherheitsforscher hatten schwerwiegende Lücken in den Appliances der Firma entdeckt. Ihre Hinweise blieben nach eigenen Angaben 18 Monate lang unbeantwortet. FireEye sagt, man wisse erst seit Montag von den Lücken. --------------------------------------------- http://heise.de/-2807930 *** iOS 8.4.1 Kernel Vulnerabilities in AppleHDQGasGaugeControl *** --------------------------------------------- When auditing iOS kernel executable, we found that the code quality of com.apple.driver.AppleHDQGasGaugeControl is very bad. In this blog, we will disclose 3 vulnerabilities in this kernel extension on the latest public iOS (version 8.4.1). More .. --------------------------------------------- http://blog.pangu.io/ios-8-4-1-kernel-vulns/ *** WhatsApp 'MaliciousCard' Vulnerabilities Allowed Attackers to Compromise Hundreds of Millions of WhatsApp Users *** --------------------------------------------- WhatsApp Web is a web-based extension of the WhatsApp application on your phone. The web application mirrors all messages sent and received, and fully synchronize your phone and your desktop computer so that users can see all messages on both devices. --------------------------------------------- http://blog.checkpoint.com/2015/09/08/whatsapp-maliciouscard-vulnerabilitie… *** Security Update Available for Adobe Shockwave Player (APSB15-22) *** --------------------------------------------- A security bulletin (APSB15-22) has been published regarding a security update for Adobe Shockwave Player. This update addresses critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1268

1 0

Tageszusammenfassung - Montag 7-09-2015
by Daily end-of-shift report 07 Sep '15

07 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 04-09-2015 18:00 − Montag 07-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Paper: Custom packer defeats multiple automation systems *** --------------------------------------------- Combination of anti-automation, anti-VM and anti-reverse engineering to make researchers lives harder.Ever since the number of new malware samples became so large we could no longer list them in Virus Bulletin magazine, security researchers .. --------------------------------------------- http://www.virusbtn.com/blog/2015/09_04.xml *** Neutrino exploit used to inject Teslascrypt into sites using outdated CMS tools *** --------------------------------------------- Heimdal Security reported an increase in malicious scripts infecting legitimate websites that then redirect the victim to the Neurtino exploit kit server that could potentially impact more than 400 million web users. --------------------------------------------- http://www.scmagazine.com/outdated-websites-deliver-teslacrypt-via-neutrino… *** Firefox-Sicherheitslücken: Angreifer hatte Zugriff auf Mozilla-Bugtracker *** --------------------------------------------- Ein priviligierter Account für den Mozilla-Bugtracker ist unter der Kontrolle eines Angreifers gewesen. Dadurch gelang es diesem, Informationen über noch nicht behobene Sicherheitslücken in Firefox zu erhalten. --------------------------------------------- http://www.golem.de/news/firefox-sicherheitsluecken-angreifer-hatte-zugriff… *** Extorting money from Ashley Madison customers is actually pretty easy *** --------------------------------------------- 1.05 bitcoins, or $243, is a low enough price to avoid further embarrassment. In the wake of the recent Ashley Madison e-mail dump, some customers have gotten demand e-mails like .. --------------------------------------------- http://arstechnica.com/business/2015/09/extorting-money-from-ashley-madison… *** Baby-Monitore sind leicht zu hacken *** --------------------------------------------- Wie ein Sicherheitsforscher herausfand, sind acht von neun Babyfons mit Internet-Verbindung relativ einfach als Spionage-Kameras einsetzbar. --------------------------------------------- http://futurezone.at/digital-life/baby-monitore-sind-leicht-zu-hacken/151.0… *** Auto-Hacking: Kritik an Sicherheitsupdates per Post *** --------------------------------------------- Wie stopft man kritische Sicherheitslücken in der Software von Autos? Nach Ansicht eines Sicherheitsexperten ist der von Fiat Chrysler gewählte Weg eine Einladung an Hacker. --------------------------------------------- http://www.golem.de/news/auto-hacking-kritik-an-sicherheitsupdates-per-post… *** Files on Seagate wireless disks can be poisoned, purloined *** --------------------------------------------- Download everything, seed with malware, move on to next sucker CERT.org has reported Seagate wireless hard drives include 'undocumented Telnet services' accessible with a hard-coded password and allowing unrestricted file .. --------------------------------------------- www.theregister.co.uk/2015/09/07/files_on_seagate_wireless_disks_can_be_poi… *** CryptDB: Angriff auf verschlüsselte Datenbanken *** --------------------------------------------- Ein Team von Microsoft-Wissenschaftlern hat einen Angriff auf die verschlüsselte Datenbank-Software CryptDB vorgestellt. Als Demonstrationsobjekt nutzte es US-Gesundheitsdatenbanken. Ein ehemaliger Entwickler kritisiert den Angriff jedoch als unrealistisch. --------------------------------------------- http://www.golem.de/news/cryptdb-angriff-auf-verschluesselte-datenbanken-15… *** Arrests Tied to Citadel, Dridex Malware *** --------------------------------------------- Authorities in Europe have arrested alleged key players behind the development and deployment of ultra-sophisticated banking malware, including Citadel and Dridex. The arrests involved a Russian national and a Moldovan man, both of whom were traveling .. --------------------------------------------- http://krebsonsecurity.com/2015/09/arrests-tied-to-citadel-dridex-malware/ *** Crypto-trouble in Poison Ivys C2 protocol *** --------------------------------------------- During the course of some research regarding the security of RAT C2 protocols and infrastructure i came across a stack buffer overflow disclosed in 2011 (OSVDB-83774) affecting the C2 server component of the Poison Ivy RAT. Poison Ivy (PIVY) is a golden oldie RAT probably everyone in infosec circles is familiar .. --------------------------------------------- https://samvartaka.github.io/malware/2015/09/07/poison-ivy-reliable-exploit… *** Ghost Got Secrets - Ghostbins Guts Part 1 *** --------------------------------------------- Privacy and anonymity are critical tools for maintaining freedom in our growingly-digital world. Even so, privacy and anonymity are commonly used by individuals performing malicious activities. These two sides of the same coin are what .. --------------------------------------------- http://l.avala.mp/blog/ghost-got-secrets-ghostbins-guts-part-1/

1 0

Tageszusammenfassung - Freitag 4-09-2015
by Daily end-of-shift report 04 Sep '15

04 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 03-09-2015 18:00 − Freitag 04-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** More Adult Themed Android Ransomware *** --------------------------------------------- During the course of our daily malware hunt, we came across a new mobile ransomware variant that leverages pornography to lure victims into downloading and installing it. Wed previously .. --------------------------------------------- http://research.zscaler.com/2015/09/more-adult-themed-android-ransomware.ht… *** Analyzing Popular Layer 7 Application DDoS Attacks *** --------------------------------------------- Distributed Denial of Service (DDoS) attacks have been a major concern for website owners for a while. All types of sites, from small to big, have been taken down and kept offline because of them. Even over-provisioned servers can be .. --------------------------------------------- https://blog.sucuri.net/2015/09/analyzing-popular-layer-7-application-ddos-… *** Cogent DataHub Code Injection Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a code injection vulnerability affecting the Cogent DataHub application produced by Cogent Real-Time Systems, Inc. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-246-01 *** Schneider Electric Modicon PLC Vulnerabilities *** --------------------------------------------- This advisory is a follow-up to the alert titled ICS-ALERT-15-224-02 Schneider Electric Modicon M340 PLC Station P34 Module Vulnerabilities that was published August 12, 2015, to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for vulnerabilities in the Schneider Electric Modicon PLC. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02 *** Moxa Industrial Managed Switch Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Moxa EDS-405A/EDS-408A series managed Ethernet switches. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-246-03 *** SMA Solar Technology AG Sunny WebBox Hard-coded Account Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a hard-coded account vulnerability in the SMA Solar Technology AG Sunny WebBox product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-181-02 *** APPLE-SA-2015-09-03-1 OS X: Flash Player plug-in blocked *** --------------------------------------------- Due to security issues in older versions, Apple has updated the web plug-in blocking mechanism to disable all versions prior to Flash Player 18.0.0.232. --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/Sep/msg00000.ht… *** Google, Mozilla, Microsoft to Sever RC4 Support in Early 2016 *** --------------------------------------------- Google and Mozilla today announced they've settled on a timeframe to permanently deprecate the shaky RC4 encryption algorithm. --------------------------------------------- http://threatpost.com/google-mozilla-microsoft-to-sever-rc4-support-in-earl… *** How to Kick-Out the Bad Guy? *** --------------------------------------------- A quick blog post about an issue I faced this morning. While drinking my morning coffee and reviewing what happened during the last night in my logs, I detected that one of my website (leakedin.com) was entirely mirrored by a guy from Brazil. I'm not against sharing information but in this case, it was consuming bandwidth and server resources for nothing. I was time to .. --------------------------------------------- https://blog.rootshell.be/2015/09/04/kick-bad-guy/ *** CVE-2014-7216: A Journey Through Yahoo's Bug Bounty Program *** --------------------------------------------- I have published another security advisory about a vulnerability, which I have 'recently' reported to Yahoo! via their Bug-Bounty program hosted by HackerOne. So this blog post is about the technical details of the CVE-2014-7216 (which is not very thrilling), but more about my experience with Yahoo's Bug Bounty program. --------------------------------------------- https://www.rcesecurity.com/2015/09/cve-2014-7216-a-journey-through-yahoos-… *** LinkedIn Sockpuppets Are Targeting Security Researchers *** --------------------------------------------- Multiple LinkedIn accounts recently targeted numerous security specialists in an attempt to map their social graphs. Several of our researchers received these LinkedIn invitations themselves and Daavid from our Threat Intelligence team decided to investigate. Here's an example of one so-called 'recruiter' account. --------------------------------------------- https://labsblog.f-secure.com/2015/09/03/linkedin-sockpuppets-targeting-sec… *** Office Malware: AGB gegen Spammer *** --------------------------------------------- Ein russischer Entwickler möchte nicht, dass seine Office Malware MWI von Spammern verwendet wird. Doch seine allgemeinen Geschäftsbedingungen zeigen nur begrenzt Wirkung. Ein kurioser Blick in den Malware-Markt. --------------------------------------------- http://www.golem.de/news/office-malware-agb-gegen-spammer-1509-116130.html *** Sleepy Puppy: Netflix-Tool jagt XXS-Lücken *** --------------------------------------------- Sicherheitsforscher können mit Sleepy Puppy tief in Netzwerken graben und an verschiedenen Stellen Schwachstellen für Cross-Site-Scripting ausfindig machen. --------------------------------------------- http://heise.de/-2805316 *** Nach Erpressungsversuch: Webhoster 1blu tauscht tausende SSL-Zertifikate *** --------------------------------------------- Vor zwei Monaten Erfuhr die Hosting-Firma, dass sich ein Angreifer weitreichenden Zugriff auf Kundendaten verschaffen konnte. Jetzt stellt sich heraus, dass offenbar auch die SSL-Zertifikate der Kunden betroffen sind. --------------------------------------------- http://heise.de/-2803573

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily