Daily

daily@lists.cert.at

1 participants
3137 discussions

Tageszusammenfassung - Donnerstag 20-08-2015
by Daily end-of-shift report 20 Aug '15

20 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 19-08-2015 18:00 − Donnerstag 20-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Inside the Unpatched OS X Vulnerabilities *** --------------------------------------------- Italian researcher Luca Todesco explains how exploiting two vulnerabilities in OS X gain enable root access for a hacker. He wont, however, say why he went public with details and exploit code before Apple patched. --------------------------------------------- http://threatpost.com/inside-the-unpatched-os-x-vulnerabilities/114344 *** Three bypasses and a fix for one of Flashs Vector. mitigations *** --------------------------------------------- Posted by Chris Evans, Cookie MonsterWith the release of Flash 18.0.0.209, two mitigations were introduced to combat abuse of Vector corruptions -- we covered these in a previous blog post. Flash 18.0.0.232 has just been released and it includes a change to the way one of the mitigations is implemented, to address Project Zero bug 482.This blog post notes some ways to bypass the way Adobe implemented the Vector. length checking mitigation. They are already fixed. It's not uncommon for new... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/three-bypasses-and-fix-for-on… *** AdBlocker Plus exploit puts OSX users at risk *** --------------------------------------------- A visit to the Apple store will give any consumer a false sense of security, you will be told that by buying a Mac you are safe from threats and malware. I have... --------------------------------------------- http://www.webroot.com/blog/2015/08/19/adblocker-plus-puts-osx-at-risk/ *** Evaluating the security of open source software *** --------------------------------------------- The Core Infrastructure Initiative (CII), a project managed by The Linux Foundation, is developing a new free Badge Program, seeking input from the open source community on the criteria to be used to ... --------------------------------------------- http://www.net-security.org/secworld.php?id=18786 *** A light-weight forensic analysis of the AshleyMadison Hack *** --------------------------------------------- So Ashley Madison(AM) got hacked, it was first announced about a month ago and the attackers claimed theyd drop the full monty of user data if the AM website did not cease operations. The AM parent company Avid Life Media(ALM) did not cease business operations for the site and true to their word; the attackers seemed of have leaked everything they promised on August 18th 2015 including:... --------------------------------------------- http://blog.includesecurity.com/2015/08/forensic-analysis-of-the-AshleyMadi… *** Popular Tools for Brute-force Attacks *** --------------------------------------------- The brute-force attack is still one of the most popular password cracking methods. Nevertheless, it is not just for password cracking. Brute-force attacks can also be used to discover hidden pages and content in a web application. This attack is basically "a hit and try" until you succeed. This attack sometimes takes longer, but its... --------------------------------------------- http://resources.infosecinstitute.com/popular-tools-for-brute-force-attacks/ *** Web.de und GMX führen PGP-Verschlüsselung für Mail ein *** --------------------------------------------- Sehr einfach zu bedienen, aber dennoch sicher soll die PGP-Erweiterung der Mail-Dienste von Web.de und GMX sein, die sich per Web-Oberfläche und Mobil-Apps nutzen lässt. --------------------------------------------- http://heise.de/-2786133 *** Yet another Android security flaw: This time EVERYTHING is affected *** --------------------------------------------- Multitasking security flap places entire user base at risk of neer-do-well activity Security researchers have discovered yet another source of security flaws in Android. This time the problem affects the mobile operating systems multitasking functionality rather than the handling of multimedia messages, the crux of a cyber of recent vulnerabilities* including the infamous Stagefright flaw. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/20/android_mul… *** [R1] Apache Vulnerabilities Affects Tenable SecurityCenter *** --------------------------------------------- http://www.tenable.com/security/tns-2015-11 *** Cisco Aggregation Services Router ASR 5000 and ASR 5500 OSPF Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40585 *** VU#276148: Dedicated Micros DVR products use plaintext protocols and require no password by default *** --------------------------------------------- Vulnerability Note VU#276148 Dedicated Micros DVR products use plaintext protocols and require no password by default Original Release date: 20 Aug 2015 | Last revised: 20 Aug 2015 Overview Dedicated Micros DVR products, including the DV-IP Express, SD Advanced, SD, EcoSense, and DS2, by default use plaintext protocols and require no password. Description CWE-311: Missing Encryption of Sensitive DataDedicated Micros DVR products by default use HTTP, telnet, and FTP rather than secure --------------------------------------------- http://www.kb.cert.org/vuls/id/276148 *** Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2015-003 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CORE-2015-003Project: Drupal core Version: 6.x, 7.xDate: 2015-August-19Security risk: 18/25 ( Critical) AC:Complex/A:User/CI:All/II:All/E:Proof/TD:AllVulnerability: Cross Site Scripting, Access bypass, SQL Injection, Open Redirect, Multiple vulnerabilitiesThis security advisory fixes multiple vulnerabilities. See below for a list.Cross-site Scripting - Ajax system - Drupal 7A vulnerability was found that allows a malicious user to perform a cross-site scripting attack by --------------------------------------------- https://www.drupal.org/SA-CORE-2015-003

1 0

Tageszusammenfassung - Mittwoch 19-08-2015
by Daily end-of-shift report 19 Aug '15

19 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 18-08-2015 18:00 − Mittwoch 19-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** SANS Incident Response Survey 2015 Infographic *** --------------------------------------------- So, you have a security policy, a blue team tasked with protecting your organization and an incident response plan. What happens when the inevitable occurs - you are attacked? SANS just released their 2015 Incident Response survey, summarizing results from 507 survey respondents who shared the top attack types they are seeing, and what is (and it not) working today in terms of incident response. The good news: malware, data breaches and Advanced Persistent Threats (APT's) were all... --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/sans-incident-response… *** Who should be responsible for IT security? *** --------------------------------------------- Hot potato, or hot job? Typically, when a cybersecurity problem arises, it's the IT department that gets it in the neck. Ostensibly, that makes sense. After all, if someone is in your network mining your database for corporate secrets, it's hardly the office manager or the accounts receivable department's lookout, right? --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/18/responsibil… *** Kehrtwende bei Mail-Sicherheit: Web.de und GMX führen DANE ein *** --------------------------------------------- Mit seinen beiden Diensten gehört United Internet zu den Gründern der Initiative "E-Mail made in Germany", die ein eigenes Verfahren für die Absicherung des Mail-Transports einsetzt. Dennoch soll nun die moderne DANE-Technik hinzukommen. --------------------------------------------- http://heise.de/-2782473 *** Später lesen: Schwerwiegende Backend-Lücken in Pocket nachgewiesen *** --------------------------------------------- Ohne viel Aufwand hat ein Sicherheitsforscher auf die Backend-Infrastruktur von Pocket zugreifen können. Die Fehler sind zwar inzwischen behoben, dem Streit um die Aufnahme der App zum späteren Lesen in den Firefox-Browser könnte dies aber neuen Anschub geben. --------------------------------------------- http://www.golem.de/news/spaeter-lesen-schwerwiegende-backend-luecken-in-po… *** Outsourcing critical infrastructure (such as DNS), (Wed, Aug 19th) *** --------------------------------------------- Migrating everything to cloud or various online services is becoming increasingly popular in last couple of years (and will probably not stop). However, leaving our most valuable jewels with someone else makes a lot of security people (me included) nervous. During some of the latest external penetration tests I noticed an increasing trend of companies moving some of their services to various cloud solutions or to their providers.target.com. IN ANSWER SECTION: target.com. 1365 IN NS --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20057&rss *** IE Bug Exploited In Wild After Microsoft Releases Out-Of-Band Patch *** --------------------------------------------- Remote code execution vulnerability in Internet Explorer versions 7 through 11 being used to drop PlugX RAT. --------------------------------------------- http://www.darkreading.com/attacks-breaches/ie-bug-exploited-in-wild-after-… *** MS15-093 - Critical: Security Update for Internet Explorer (3088903) - Version: 1.0 *** --------------------------------------------- This security update resolves a vulnerability in Internet Explorer. The vulnerability could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-093 *** Security Hotfix Available for LiveCycle Data Services (APSB15-20) *** --------------------------------------------- A Security Bulletin (APSB15-20) has been published regarding a hotfix for LiveCycle DS. This hotfix addresses an important vulnerability that could result in information disclosure. Adobe recommends users apply the hotfix using the instructions provided in the "Solution" section of the Security Bulletin. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1259 *** Fortinet FortiGate/FortiOS MAC Authentication Flaw Lets Remote Users Modify Data on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033256 *** Security Notice - Statement on "Fingerprints on Mobile Devices: Abusing and Leaking" at the Black Hat Conference *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** DSA-3337 gdk-pixbuf - security update *** --------------------------------------------- Gustavo Grieco discovered a heap overflow in the processing of BMP imageswhich may result in the execution of arbitrary code if a malformed imageis opened. --------------------------------------------- https://www.debian.org/security/2015/dsa-3337 *** Security Advisory: ICMP packet processing vulnerability CVE-2015-5058 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/000/sol17047.htm… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime and IBM WebSphere Application Server Liberty Profile affect WebSphere Appliance Management Center *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21963684 *** IBM Security Bulletin: Websphere Message Broker and IBM Integration Bus are affected by access control vulnerability (CVE-2015-2018) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21961734 *** Security Bulletin: Vulnerabilities in SSLv3 and GNU C library (glibc) affect multiple products shipped with Intelligent Cluster (CVE-2014-3566, CVE-2015-0235) *** --------------------------------------------- http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098516 *** Cisco TelePresence Video Communication Server Expressway Command Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40522 *** Cisco Unified Interaction Manager Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40555 *** Cisco TelePresence Video Communication Server Expressway Arbitrary File Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40518 *** Multiple Cisco Finesse Cross-Site Scripting Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40436

1 0

Tageszusammenfassung - Dienstag 18-08-2015
by Daily end-of-shift report 18 Aug '15

18 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 17-08-2015 18:00 − Dienstag 18-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Attacking ECMAScript Engines with Redefinition *** --------------------------------------------- Posted by Natalie Silvanovich = function () { return n; }ECMAScript has a property where almost all functions and variables can be dynamically redefined. This can lead to vulnerabilities in situations where native code assumes a function or variable behaves a certain way when accessed or does not have certain side effects when it can in fact be redefined. Project Zero has discovered 24 vulnerabilities involving ECMAScript redefinition in Adobe Flash in the past few months and similar issues... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/attacking-ecmascript-engines-… *** Tool Tip: Kansa Stafford released, PowerShell for DFIR, (Mon, Aug 17th) *** --------------------------------------------- In his most recent post, Guy asked Are You a Hunter?. Heres one way to become one. Dave Hull has just published the Stafford release of his exemplary PowerShell DFIR tool, Kansa. For the uninitiated, Kansa is amodular incident response framework in Powershell.(PS v3 or higher preferred)that uses Powershell Remoting to run user contributed modules across hosts in an enterprise to collect data for use during incident response, breach hunts, or for building an environmental baseline. Per Daves... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20049&rss *** Risky Schneider Electric SCADA Vulnerabilities Remain Unpatched *** --------------------------------------------- Vulnerabilities in Schneider Electric SCADA gear remain unpatched close to two weeks after they were disclosed during DEF CON. --------------------------------------------- http://threatpost.com/risky-schneider-electric-scada-vulnerabilities-remain… *** Ransomware goes OPEN SOURCE in the name of education *** --------------------------------------------- Won't somebody think of the script kiddies? Turkish security bod Utku Sen has published what appears to be the first open source ransomware that anyone to download and spread. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/18/ransomware_… *** How Not to Start an Encryption Company *** --------------------------------------------- Probably the quickest way for a security company to prompt an overwhelmingly hostile response from the security research community is to claim that its products and services are "unbreakable" by hackers. The second-fastest way to achieve that outcome is to have that statement come from an encryption company CEO who served several years in federal prison for running a $210 million Ponzi scheme. Heres the story of a company that managed to accomplish both at the same time and is now... --------------------------------------------- http://krebsonsecurity.com/2015/08/how-not-to-start-an-encryption-company/ *** Sicherheitsrisiko Mainframe: Großrechner aus dem Internet erreichbar *** --------------------------------------------- Ein Sicherheitsforscher warnt, dass Mainframes zu einem leichten Angriffsziel werden könnten. --------------------------------------------- http://www.heise.de/newsticker/meldung/Sicherheitsrisiko-Mainframe-Grossrec… *** 1&1, GMX und Web.de: Millionen E-Mail-Postfächer waren angreifbar *** --------------------------------------------- Bei den E-Mail-Anbietern 1&1, Gmx und Web.de klaffte bis vor wenigen Tagen eine Sicherheitslücke, über die Angreifer unter bestimmten Umständen Zugriff auf fremde Konten bekommen konnten. --------------------------------------------- http://heise.de/-2782618 *** When You Can't ARPSpoof *** --------------------------------------------- There are times during a penetration test when you are having difficulty gaining the credentials you want from a host that has already been compromised. You have successfully socially engineered a system administrator or other user with privileges to a web application and you have established a meterpreter shell. You can dump the password hashes... --------------------------------------------- http://resources.infosecinstitute.com/when-you-cant-arpspoof/ *** Reflection DDoS Attacks Abusing RPC Portmapper *** --------------------------------------------- Level 3 Communications has discovered a new type of reflection DDoS attack that takes advantage of RPC Portmapper to overwhelm networking services. --------------------------------------------- http://threatpost.com/reflection-ddos-attacks-abusing-rpc-portmapper/114318 *** SAP Afaria 7 Buffer Overflow *** --------------------------------------------- Topic: SAP Afaria 7 Buffer Overflow Risk: High Text:Application: SAP Afaria 7 Versions Affected: SAP Afaria 7, probably others Vendor URL: http://SAP.com Bugs: Buffer Overflow ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080088 *** DSA-3336 nss - security update *** --------------------------------------------- Several vulnerabilities have been discovered in nss, the Mozilla NetworkSecurity Service library. The Common Vulnerabilities and Exposures projectidentifies the following problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3336 *** Bugtraq: EMC Documentum Content Server: arbitrary code execution (incomplete fix in CVE-2015-4532) *** --------------------------------------------- http://www.securityfocus.com/archive/1/536244 *** ZDI-15-393: Foxit Reader TIFF Conversion Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-393/ *** GnuTLS ServerKeyExchange Validation Flaw May Let Remote Users Forge Signatures *** --------------------------------------------- http://www.securitytracker.com/id/1033225 *** DFN-CERT-2015-1277. Linux-Kernel: Mehrere Schwachstellen ermöglichen einen Denial-of-Service-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1277/ *** Security Notice - Statement about the Stagefright Security Vulnerability in Android OS Disclosed by Zimperium *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Security Advisory - DoS Vulnerability in Huawei MBB Product *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM UrbanCode Deploy and IBM UrbanCode Deploy with Patterns *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21964039 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM GPFS Native RAID (CVE-2015-2638, CVE-2015-4760, CVE-2015-2619, CVE-2015-2613) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1022565 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Rational RequisitePro (CVE-2015-1788, CVE-2015-1789, CVE-2015-1791) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21964441 *** Apache ActiveMQ Directory Traversal Flaw Lets Remote Users Upload Files and Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1033315 *** USN-2710-2: OpenSSH regression *** --------------------------------------------- Ubuntu Security Notice USN-2710-218th August, 2015openssh regressionA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryUSN-2710-1 introduced a regression in OpenSSH.Software description openssh - secure shell (SSH) for secure access to remote machines DetailsUSN-2710-1 fixed vulnerabilities in OpenSSH. The upstream fix forCVE-2015-5600 caused a regression resulting in random authenticationfailures in non-default... --------------------------------------------- http://www.ubuntu.com/usn/usn-2710-2/ *** VU#248692: Trend Micro Deep Discovery threat appliance contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#248692 Trend Micro Deep Discovery threat appliance contains multiple vulnerabilities Original Release date: 18 Aug 2015 | Last revised: 18 Aug 2015 Overview Multiple versions of the Trend Micro Deep Discovery threat appliance are vulnerable to cross-site scripting and authentication bypass. Description The Trend Micro Deep Discovery platform "enables you to detect, analyze, and respond to today's stealthy, targeted attacks in real time." It may be... --------------------------------------------- http://www.kb.cert.org/vuls/id/248692 *** Cisco TelePresence Video Communication Server Expressway Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40523

1 0

Tageszusammenfassung - Montag 17-08-2015
by Daily end-of-shift report 17 Aug '15

17 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 14-08-2015 18:00 − Montag 17-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** My browser visited Weather.com and all I got was this lousy malware (Updated) *** --------------------------------------------- New rash of malvertising attacks threatens millions of Web surfers. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/e7WRDtjeLUI/ *** Security: Neuer digitaler Erpressungsdienst aufgetaucht *** --------------------------------------------- Encryptor RaaS nennt sich ein neuer digitaler Erpressungsdienst, der im Tor-Netzwerk aufgetaucht ist. Sein Erschaffer hat offenbar bei Reddit dafür geworben. Angeblich soll es bereits erste Kunden geben. --------------------------------------------- http://www.golem.de/news/security-neuer-digitaler-erpressungsdienst-aufgeta… *** Unsicheres Smart Home: "Nutzer können nichts tun" *** --------------------------------------------- Wiener Sicherheitsforscher warnen davor aufs vernetzte Heim mit Funk-Alarmanlagen oder Türschlösser zu setzen, weil die funkgesteuerten Anlagen viele Risiken mit sich bringen. --------------------------------------------- http://futurezone.at/digital-life/unsicheres-smart-home-nutzer-koennen-nich… *** Five points of failure in recovering from an attack *** --------------------------------------------- An over emphasis on defense is leaving the financial sector exposed to cyber attack. An increase in threat levels has seen the sector bolster defenses by focusing on detection and attack response but ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/28f1ShUbbgo/secworld.php *** MediaServer Takes Another Hit with Latest Android Vulnerability *** --------------------------------------------- The "hits" keep on coming for Android's mediaserver component. We have discovered yet another Android mediaserver vulnerability, which can be exploited to perform attacks involving arbitrary code execution. With this new vulnerability, an attacker would be able to run their code with the same permissions that the mediaserver program already has as part of its... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/G8BEug87d7k/ *** Google plugs Google Admin app sandbox bypass 0-day *** --------------------------------------------- After having had some trouble with fixing a sandbox bypass vulnerability in the Google Admin Android app, the Google Security team has finally released on Friday an update that plugs the hole. Goog... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/Mf7jUvjZmF0/secworld.php *** Wieder Root-Lücke in OS X Yosemite - inklusive 10.10.5 *** --------------------------------------------- Nachdem das jüngste Update eine Rechteausweitung behoben hatte, ist nun die nächste entdeckt worden. Demonstrationscode für einen Exploit wurde bereits veröffentlicht. --------------------------------------------- http://heise.de/-2780509 *** BitTorrent clients can be made to participate in high-volume DoS attacks *** --------------------------------------------- A group of researchers have discovered a new type of DoS attack that can be pulled off by a single attacker exploiting weaknesses in the BitTorrent protocol family. The weaknesses in the Micro Tran... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/FUSeWaDyIkU/secworld.php *** In eigener Sache: Wartungsarbeiten Dienstag, 18. August 2015 *** --------------------------------------------- In eigener Sache: Wartungsarbeiten Dienstag, 18. August 2015 | 17. August 2015 | Am Dienstag, 18. August 2015, werden wir Wartungsarbeiten an unserer Infrastruktur vornehmen. Dies kann zu kurzen Service-Ausfällen führen (jeweils im Bereich weniger Minuten). Es gehen dabei keine Daten (zb Emails) verloren, es kann sich nur die Bearbeitung etwas verzögern. In dringenden Fällen können sie uns wie gewohnt... --------------------------------------------- http://www.cert.at/services/blog/20150817120322-1581.html *** Windows Platform Binary Table (WPBT) - BIOS PE backdoor *** --------------------------------------------- [...] This feature allows a BIOS to deliver the payload of an executable, which is run in memory, silently, each time a system is booted. The executable code is run under under Session Manager context (i.e. SYSTEM). --------------------------------------------- http://www.securityfocus.com/archive/1/536181/30/0/threaded *** VMSA-2015-0003.10 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** TOTOLink Backdoor Persistence *** --------------------------------------------- Topic: TOTOLink Backdoor Persistence Risk: High Text:Hello, This is an update to: - Backdoor and RCE found in 8 TOTOLINK router models (http://seclists.org/fulldisclosure/20... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080073 *** Bugtraq: BFS-SA-2015-002: OpenSSH PAM Privilege Separation Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536220 *** OSIsoft PI Data Archive Server Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for 56 vulnerabilities that were identified in OSIsoft PI System software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-225-01 *** Cisco Nexus Operating System Address Resolution Protocol Denial of Service Vulnerability *** --------------------------------------------- 40469 --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40469 *** Cisco TelePresence Video Communication Server Expressway Access Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40442 *** Cisco NX-OS Internet Group Management Protocol Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40470 *** F5 Security Advisories *** --------------------------------------------- *** Security Advisory: Multiple MySQL vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/17000/100/sol17115.htm… *** Security Advisory: Linux kernel vulnerability CVE-2015-1465 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/100/sol17124.htm… *** Security Advisory: Apache Commons FileUpload vulnerability CVE-2014-0050 *** https://support.f5.com:443/kb/en-us/solutions/public/15000/100/sol15189.htm… *** Security Advisory: Linux kernel vulnerability CVE-2015-2042 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/100/sol17118.htm… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in IBM Java SDK affect IBM Notes and Domino *** http://www.ibm.com/support/docview.wss?uid=swg21963812 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Rational RequisitePro (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21960340 *** IBM Security Bulletin: Security Vulnerability in Apache Batik (CVE-2015-0250) *** http://www.ibm.com/support/docview.wss?uid=swg21963994 *** IBM Security Bulletin: IBM WebSphere Application Server Liberty Profile vulnerability affects IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2015-1885) *** http://www.ibm.com/support/docview.wss?uid=swg21964102 *** IBM Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Content Classification CVE-2015-4760 *** http://www.ibm.com/support/docview.wss?uid=swg21963680 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM DataQuant for Workstation (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625) *** http://www.ibm.com/support/docview.wss?uid=swg21963822 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM InfoSphere Discovery (CVE-2015-1931 CVE-2015-2601 CVE-2015-2613 CVE-2015-2625) *** http://www.ibm.com/support/docview.wss?uid=swg21963191 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Version 5, affects: Websphere Dashboard Framework *** http://www.ibm.com/support/docview.wss?uid=swg21963164 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Version 5, affects: Lotus Widget Factory. *** http://www.ibm.com/support/docview.wss?uid=swg21963161 *** Bugtraq: ESA-2015-130: EMC Documentum WebTop and WebTop Clients Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536237 *** Bugtraq: ESA-2015-131: EMC Documentum Content Server Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536236 *** Bugtraq: ESA-2015-094: RSA Archer GRC Multiple Cross-Site Request Forgery Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536235 *** Bugtraq: ESA-2015-081: RSA BSAFE Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536234 *** WP REST API (WP API) <= 1.2.2 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8152 *** WP OAuth Server <= 3.1.4 - Insecure Pseudorandom Number Generation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8153

1 0

Tageszusammenfassung - Freitag 14-08-2015
by Daily end-of-shift report 14 Aug '15

14 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 13-08-2015 18:00 − Freitag 14-08-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** One font vulnerability to rule them all #3: Windows 8.1 32-bit sandbox escape exploitation *** --------------------------------------------- This is part #3 of the "One font vulnerability to rule them all" blog post series. In the previous posts, we introduced the "blend" PostScript operator vulnerability, discussed the Charstring primitives necessary to fully control the stack contents and used them to develop a reliable user-mode Adobe Reader exploit executing arbitrary C++ code embedded in the PDF file:One font vulnerability to rule them all #1: introducing the BLEND vulnerabilityOne font vulnerability to... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/one-font-vulnerability-to-rul… *** Adwind: another payload for botnet-based malspam, (Fri, Aug 14th) *** --------------------------------------------- Introduction Since mid-July 2015, Ive noticed an increase in malicious spam (malspam) caught by my employers spamfilters with java archive (.jar file) attachments. These .jar files are most often identified as Adwind. Adwind is a Java-based remote access tool (RAT) used by malware authors to infect computers with backdoor access. Theres no vulnerability involved. To infect a Windows computer, the user has to execute the malware by double-clicking on the .jar file. Im currently seeing enough... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20041&rss *** Windows 10: Gefährlicher Zertifikats-Wirrwarr *** --------------------------------------------- Windows 10 sammelt fleißig Benutzerdaten und überträgt sie an Microsoft. Ausgerechnet dabei verzichtet das Betriebssystem auf einen ansonsten verwendeten Schutz vor falschen Zertifikaten - sensible Daten könnten so zur leichten Beute werden. --------------------------------------------- http://heise.de/-2776810 *** CaVer: Neue Technik findet Schwachstellen in C++-Code *** --------------------------------------------- US-Wissenschaftler haben ein Verfahren entwickelt, das fehlerhafte Typumwandlungen in C++-Programmen zur Laufzeit identifiziert. Es hat bereits mehrere inzwischen behobene Schwachstellen in der GNU-libstd++ und in Firefox aufgespürt. --------------------------------------------- http://heise.de/-2778993 *** Was tun bei Handy-Verlust? *** --------------------------------------------- Besitzer sollten Sicherheitsvorkehrungen treffen --------------------------------------------- http://derstandard.at/2000020734740 *** Android-Sicherheitslücke: Googles Stagefright-Patch ist fehlerhaft *** --------------------------------------------- Google muss einen der Stagefright-Patches überarbeiten. Der Patch schließt die Sicherheitslücke nicht, und Android-Geräte sind weiterhin angreifbar. Ein korrigierter Patch für die Nexus-Modelle wird diesen Monat aber nicht mehr erscheinen. --------------------------------------------- http://www.golem.de/news/android-sicherheitsluecke-googles-stagefright-patc… *** Auslaufendes A-Trust Root-Zertifikat "A-Trust-nQual-03" *** --------------------------------------------- Auslaufendes A-Trust Root-Zertifikat "A-Trust-nQual-03" | 14. August 2015 | In den diversen Certificate Stores (Browser, Windows) ist ein Root-Zertifkat von A-Trust mit Gültigkeit bis 18. August 2015: A-Trust-nQual-03 SHA-1 Fingerprint D3:C0:63:F2:19:ED:07:3E:34:AD:5D:75:0B:32:76:29:FF:D5:9A:F2 | Unseren (limitierten) Recherchen nach gibt es im Certificate Store von Windows noch andere A-Trust Root-Zertifikate (auch mit SHA256, vgl. Microsoft Root Certificate Program). In den Certificate... --------------------------------------------- http://www.cert.at/services/blog/20150814120852-1571.html *** Eurocentric Ransomware Spam in Circulation *** --------------------------------------------- A number of spam runs are gunning for customers of various European businesses. Fake delivery messages and online bills quickly give way to Ransomware...Categories: Fraud/Scam AlertTags: emailmalwarephishransomwarespamtorrentlocker(Read more...) --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/08/eurocentric-ransomware-spa… *** Lampen, Schlösser, Alarmanlagen hackbar: Wiener fanden Schwachstelle in ZigBee-Standard *** --------------------------------------------- Sicherheitsfirma Cognosec weist auf Sicherheitsprobleme beim "smarten" Zuhause hin --------------------------------------------- http://derstandard.at/2000020752533 *** Why Vulnerability Research Is A Good Thing *** --------------------------------------------- Earlier this week Oracle's CSO released a blog post that talked about why people should stop looking for vulnerabilities in their software products. Needless to say, this did not go down well with the security community - and the post was soon taken down with a statement from the company adding that the post "does not reflect our... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Laorf2GvBCU/ *** Security, Reverse Engineering and EULAs *** --------------------------------------------- Like more than a few others, I experienced the infosec outrage against Mary Ann Davidson, Oracle's Chief Security Officer, before I actually read the now-redacted blog post. After taking the time to read what she actually wrote (still available through Google's web cache), I think there's more discussion to be had than I've seen so far. --------------------------------------------- http://www.tripwire.com/state-of-security/risk-based-security-for-executive… *** Apple Patches Critical OS X DYLD Flaw in Monster Update *** --------------------------------------------- Apple released hordes of patches for OS X, iOS, Safari and iOS Server, including fixes for the DYLD vulnerability disclosed in July. --------------------------------------------- http://threatpost.com/apple-patches-critical-os-x-dyld-flaw-in-monster-upda… *** Apple Security Updates *** --------------------------------------------- *** iOS 8.4.1 *** https://support.apple.com/kb/HT205030 *** OS X Yosemite 10.10.5 and Security Update 2015-006 *** https://support.apple.com/kb/HT205031 *** Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 *** https://support.apple.com/kb/HT205033 *** OS X Server v4.1.5 *** https://support.apple.com/kb/HT205032 *** Cisco Advisories *** --------------------------------------------- *** Cisco TelePresence Video Communication Server Expressway Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40441 *** Cisco TelePresence Video Communication Server Expressway Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40444 *** Cisco TelePresence Video Communication Server Expressway Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40443 *** ICS-CERT Alerts *** --------------------------------------------- *** Rockwell Automation 1769-L18ER and A LOGIX5318ER Vulnerability *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-225-01 *** Rockwell Automation 1766-L32 Series Vulnerability *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-225-02 *** KAKO HMI Hard-coded Password *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-01 *** Schneider Electric Modicon M340 PLC Station P34 Module Vulnerabilities *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-02 *** Prisma Web Vulnerabilities *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-03 *** Moxa ioLogik E2210 Vulnerabilities *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-04 *** DFN-CERT-2015-1258: Request Tracker: Eine Schwachstelle ermöglicht einen Cross-Site-Scripting-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1258/

1 0

Tageszusammenfassung - Donnerstag 13-08-2015
by Daily end-of-shift report 13 Aug '15

13 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 12-08-2015 18:00 − Donnerstag 13-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New SMiShing Campaign Targets T-Mobile Subscribers *** --------------------------------------------- Criminals after online credentials have homed in on T-Mobile users, luring them with a $20 discount in exchange for .. --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/08/new-smishing-campaign-targ… *** Android: Und noch eine schwere Sicherheitslücke *** --------------------------------------------- Forscher von IBM haben in Googles mobilem Betriebssystem eine Lücke entdeckt, die über die Hälfte aller Android-Geräte betrifft. Sie erlaubt das Übernehmen privilegierter Prozesse durch einen Angreifer. Google hat die Lücke bereits geschlossen. --------------------------------------------- http://heise.de/-2777648 *** Cisco ASA Unicast Reverse Path Forwarding (uRPF) Bypass Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40440 *** Cisco Warns Customers About Attacks Installing Malicious IOS Bootstrap Images *** --------------------------------------------- Cisco is warning enterprise customers about a spike in attacks in which hackers use valid credentials on IOS devices to log in as administrators and then upload malicious ROMMON images to take control of the devices. The ROM Monitor is the .. --------------------------------------------- http://threatpost.com/cisco-warns-customers-about-attacks-installing-malici… *** Cisco TelePresence Video Communication Server Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40433 *** Volkswagen-Hack nach langer Sperrverfügung veröffentlicht *** --------------------------------------------- Vor einigen Jahren haben Forscher entdeckt, dass sich Motorolas Megamos-Transponder, der in den Autoschlüsseln unter anderem von Volkswagen verwendet wird, angreifen lässt. VW ließ damals gerichtlich untersagen, Detailinformationen über die Lücke zu veröffentlichen. Jetzt ist dies gelungen. --------------------------------------------- http://www.golem.de/news/autoschluessel-volkswagen-hack-nach-langer-sperrve… *** Script injection vulnerability discovered in Salesforce *** --------------------------------------------- Elastica discovered an injection vulnerability in Salesforce which opened the door for attackers to use a trusted Salesforce application as a platform to conduct phishing attacks to steal end-users l... --------------------------------------------- http://www.net-security.org/secworld.php?id=18759 *** Spam and phishing in Q2 2015 *** --------------------------------------------- In Q2 2015, the percentage of spam in email traffic accounted for 53.4%. The USA (14.6%) and Russia (7.8%) remained the biggest sources of spam. China came third with 7.1%. The Anti-Phishing system was triggered 30,807,071 times on computers of Kaspersky Lab users. --------------------------------------------- http://securelist.com/analysis/quarterly-spam-reports/71759/spam-and-phishi… *** Berliner Internet-Provider 1blu Opfer einer Hacker-Attacke *** --------------------------------------------- Bislang unbekannte Angreifer haben sich Zugriff auf das interne System verschafft und erpressen den Berliner Internet-Provider nun. --------------------------------------------- http://futurezone.at/digital-life/berliner-internet-provider-1blu-opfer-ein… *** VoIP Fraud - Brute Force and Ignorance *** --------------------------------------------- The topic of VoIP fraud seems to ebb and flow within the IT-industry press, but struggle to break the surface of mainstream media. Specialist publications report flaws in commonly-used home routers and widespread campaigns against corporate VoIP PBXes while these stories are bypass .. --------------------------------------------- https://blog.team-cymru.org/2015/08/voip-fraud-brute-force-and-ignorance/ *** YARA: Simple and Effective Way of Dissecting Malware *** --------------------------------------------- In this article, we will learn about the YARA tool, which gives a very simple and highly effective way of identifying and classifying malware. We all know that Reverse Engineering is the highly recommended method for performing a complete post-mortem .. --------------------------------------------- http://resources.infosecinstitute.com/yara-simple-effective-way-dissecting-… *** Erster Nexus Patch Day: Google schliesst 21 Sicherheitslücken *** --------------------------------------------- Acht davon "kritisch" - Neben Bugs in Stagefright noch zahlreiche andere Probleme bereinigt --------------------------------------------- http://derstandard.at/2000020697116 *** TOTOLINK Update - How to NOT handle security issues *** --------------------------------------------- This post is an an update to: Backdoor and RCE found in 8 TOTOLINK router models Backdoor credentials found in 4 TOTOLINK router models 4 TOTOLINK router models vulnerable to CSRF and XSS attacks 15 TOTOLINK router models vulnerable to multiple RCEs --------------------------------------------- https://pierrekim.github.io/blog/2015-08-13-TOTOLINK-how-to-NOT-handle-secu…

1 0

Tageszusammenfassung - Mittwoch 12-08-2015
by Daily end-of-shift report 12 Aug '15

12 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 11-08-2015 18:00 − Mittwoch 12-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** MS15-AUG - Microsoft Security Bulletin Summary for August 2015 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-AUG *** Adobe, MS Push Patches, Oracle Drops Drama *** --------------------------------------------- Adobe today pushed another update to seal nearly three dozen security holes in its Flash Player software. Microsoft also released 14 patch bundles, including a large number of fixes for computers running its new Windows 10 operating system. Not to be left out of Patch Tuesday, Oracles chief security officer lobbed something .. --------------------------------------------- http://krebsonsecurity.com/2015/08/adobe-ms-push-patches-oracle-drops-drama/ *** Defending against CVE-2015-1769: a logical issue exploited via a malicious USB stick *** --------------------------------------------- Today Microsoft released update MS15-085 to address CVE-2015-1769, an important severity security issue in Mount Manager. It affects both client and server versions, from Windows Vista to Windows 10. The goal of this blog post .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2015/08/11/defending-against-cve-201… *** MSRT August 2015: Vawtrak *** --------------------------------------------- As part of our ongoing effort to provide better malware protection, we are adding the following detections to the Microsoft Malicious Software Removal Tool (MSRT) this month: Win32/Vawtrak Win32/Critroni Win32/Kasidet Critroni is a ransomware malware family that can lock your files and ask .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/08/11/msrt-august-2015-vawtrak… *** Emerging ransomware: Troldesh *** --------------------------------------------- Troldesh (detected as variants of Win32/Troldesh) started to show up in the early part of 2015 and became more prevalent in June this year. Overall detections have so far lessened in July - except for a notable spike around the 8th of the month, .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/08/09/emerging-ransomware-trol… *** OpenSSH 7.0 Released *** --------------------------------------------- An anonymous reader writes: Today the OpenSSH project maintainers announced the release of version 7.0. This release is focusing on deprecating weak and unsafe cryptographic methods, though some of the work wont be complete until 7.1. This release removes support for the following: the legacy SSH v1 protocol, .. --------------------------------------------- http://it.slashdot.org/story/15/08/11/2340247/openssh-70-released *** IoT security is RUBBISH says IoT vendor collective *** --------------------------------------------- Online Trust Alliance calls on gadget vendors to stop acting like clowns A vendor group whose membership includes Microsoft, Symantec, Verisign, ADT and TRUSTe reckons the Internet of Things (IoT) market is being pushed with no regard to either .. --------------------------------------------- http://www.theregister.co.uk/2015/08/12/iot_security_is_rubbish_says_iot_ve… *** KCI-Angriff auf TLS missbraucht Clientzertifikate *** --------------------------------------------- Ein komplexer Angriff nutzt eine trickreiche Kombination aus Clientzertifikaten und einem statischen Diffie-Hellman-Schlüsselaustausch. Der Angriff ist nur in sehr speziellen Situationen relevant, doch es zeigt sich wieder einmal, dass das TLS-Protokoll selbst Sicherheitslücken hat. --------------------------------------------- http://www.golem.de/news/schluesselaustausch-kci-angriff-auf-tls-missbrauch… *** Hacker ermöglichen Börsen-Insidergeschäfte in Millionenhöhe *** --------------------------------------------- Pressemitteilungen beinhalten gelegentlich Informationen, die an der Börse viel Geld wert sind - vor allem, wenn sie vor ihrer Veröffentlichung in die Hände von Tätern gelangen, die damit Insidergeschäfte machen. In den USA wurde ein Verbrecherring zerschlagen, der über 100 Millionen US-Dollar damit verdient haben soll. --------------------------------------------- http://www.golem.de/news/pressemitteilungen-hacker-ermoeglichen-boersen-ins… *** Schneider Electric IMT25 DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a memory corruption vulnerability in Schneider Electric IMT25 DTM component. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-223-01 *** Blacklists miss 90% of malware blogged IP love *** --------------------------------------------- Correlate all the things. Threat intelligence firm RecordedFuture says popular web blacklists are missing thousands of IP addresses linked to malware data theft. --------------------------------------------- http://www.theregister.co.uk/2015/08/12/two_shady_men_walk_into_a_bar_black… *** Security: Lenovos sanktioniertes Rootkit *** --------------------------------------------- Nach einer kompletten Neuinstallation von Windows auf einem Lenovo-Laptop wurde zur Überraschung eines Anwenders plötzlich auch ein Lenovo-Dienst gestartet. Er vermutete eine Art Bios-Rootkit und lag damit offenbar gar nicht so falsch. --------------------------------------------- http://www.golem.de/news/security-lenovos-sanktioniertes-rootkit-1508-11571… *** Windows Service Accounts - Why They're Evil and Why Pentesters Love them! *** --------------------------------------------- Windows Service Accounts have been one of those enterprise neccessary evils - things that you have to have, but nobody ever talks about or considers to be a problem. All too often, these service accounts are in the Domain Admins group, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20029 *** August 2015 Security Update Release Summary *** --------------------------------------------- Today we released security updates to provide protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are .. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/08/11/august-2015-security-upd… *** Thunderstrike 2: Mac firmware worm details *** --------------------------------------------- This is the annotated transcript of our DefCon 23 / BlackHat 2015 talk, which presented the full details of Thunderstrike 2, the first firmware worm for Apples Macs that can spread via both software or Thunderbolt hardware accessories and writes .. --------------------------------------------- https://trmm.net/Thunderstrike2_details *** Firefox Under Fire: Anatomy of latest 0-day attack *** --------------------------------------------- On the August 6th, the Mozilla Foundation released a security update for the Firefox web browser that fixes the CVE-2015-4495 vulnerability in Firefox's embedded PDF viewer, PDF.js. This vulnerability allows attackers to bypass the same-origin policy and execute JavaScript remotely that will be .. --------------------------------------------- http://www.welivesecurity.com/2015/08/11/firefox-under-fire-anatomy-of-late… *** Finding Vulnerabilities in Core WordPress: A Bug Hunter's Trilogy, Part II - Supremacy *** --------------------------------------------- In this series of blog posts, Check Point vulnerability researcher Netanel Rubin tells a story in three acts - describing his long path of discovered flaws and vulnerabilities in .. --------------------------------------------- http://blog.checkpoint.com/2015/08/11/finding-vulnerabilities-in-core-wordp… *** SSD Advisory - ZendXml Multibyte Payloads XXE/XEE *** --------------------------------------------- The XML standard defines a concept of an external entites. XXE (XML eXternal Entity) attack is an attack on an application that parses XML input from untrusted sources using incorrectly configured XML parser. The application may be forced to open arbitrary files and/or network resources. Exploiting XXE issues on PHP applications may also lead to denial of service or in some cases (for example, when an 'expect' PHP module is installed) lead to command execution. --------------------------------------------- https://blogs.securiteam.com/index.php/archives/2550

1 0

Tageszusammenfassung - Dienstag 11-08-2015
by Daily end-of-shift report 11 Aug '15

11 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 10-08-2015 18:00 − Dienstag 11-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Beliebige SSL-Zertifikate durch Missbrauch der Uralt-Internettechnik BGP *** --------------------------------------------- Das für das globale Internet unabdingbare Border Gateway Protocol (BGP) lässt sich leicht manipulieren. Ein Hacker beschrieb auf der Black Hat, wie man darüber gültige SSL-Zertifikate für beliebige Domains ausstellen lassen kann. --------------------------------------------- http://heise.de/-2774454 *** Cisco WebEx Meetings Server Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=36968 *** Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=33996 *** CVE-2015-2419 - Internet Explorer Double-Free in Angler EK *** --------------------------------------------- The Angler Exploit Kit (EK) recently added support for an Internet Explorer (IE) vulnerability (CVE-2015-2419) that was patched in July 2015. Quickly exploiting recently patched vulnerabilities is standard for Angler EK authors, but the target has been Adobe Flash Player since the .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/08/cve-2015-2419_inte.html *** The Italian Connection: An analysis of exploit supply chains and digital quartermasters *** --------------------------------------------- On July 5, 2015 an unknown hacker publicly announced on Twitter that he had breached the internal network of Hacking Team - an Italian pentesting company known .. --------------------------------------------- http://blog.shadowserver.org/2015/08/10/the-italian-connection-an-analysis-… *** QNAP Turbo NAS Series Devices Multiple Flaws Let Remote Users Conduct Cross-Site Scripting Attacks, Traverse the Directory, Execute Arbitrary Code, and Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1033224 *** QNAP Logging Error Lets Local Users Obtain Disk Encryption Keys *** --------------------------------------------- http://www.securitytracker.com/id/1033223 *** Internal modem can be exploited by malware to gain persistence *** --------------------------------------------- Two security experts at the last Def Con hacking conference have demonstrated how Internal LTE/3G modems can be hacked to help malware survive OS reinstalls Many users totally ignore that LTE/3G modems built into new business laptops and .. --------------------------------------------- http://securityaffairs.co/wordpress/39252/hacking/internal-modem-hacking.ht… *** Who's Behind Your Proxy? Uncovering Bunitu's Secrets *** --------------------------------------------- In our previous analysis we showed how the Bunitu Trojan was distributed via the Neutrino exploit kit in various malvertising campaigns. After spending more time analyzing .. --------------------------------------------- https://blog.malwarebytes.org/botnets/2015/08/whos-behind-your-proxy-uncove… *** Watch out for Costly Mobile Ads *** --------------------------------------------- There are lots of ways you can have a bad hair day with a mobile device - a rogue app from the Play Store, a dubious file from a non-official source or even a phish attack which takes advantage of a mobile's smaller screen size. A less annoying issue is pop-ups, adverts .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/08/watch-out-for-costly-… *** Tanksysteme ungeschützt im Netz: Leichte Beute für Hacker *** --------------------------------------------- Bankomatkassen an Zapfsäulen wurden bereits zum Ziel von Hackerangriffen, um Daten zu stehlen. Doch Tankstellen könnten von Kriminellen im Internet auch für weitaus gefährlichere Attacken ins Visier genommen werden. Das Forscherteam von Rapid7 fand laut "Wired" .. --------------------------------------------- http://derstandard.at/2000020547838 *** Vulnerabilities iframe <= 3.0 *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8150 https://wpvulndb.com/vulnerabilities/8149 *** Threat Group-3390 Targets Organizations for Cyberespionage *** --------------------------------------------- Dell SecureWorks Counter Threat Unit(TM) (CTU) researchers investigated activities associated with Threat Group-3390[1] (TG-3390). Analysis of TG-3390s operations, targeting, and tools led CTU researchers to assess with moderate confidence .. --------------------------------------------- http://www.secureworks.com/cyber-threat-intelligence/threats/threat-group-3… *** Instant KARMA Might Still Get You *** --------------------------------------------- About a year ago, I started looking into Android applications that arent validating SSL certificates. Users of these applications could be at risk if they fall victim to a man-in-the-middle (MITM) attack. Earlier this year, I also wrote about .. --------------------------------------------- https://insights.sei.cmu.edu/cert/2015/08/instant-karma-might-still-get-you… *** Dynamic DNS Security and Potential Threats *** --------------------------------------------- Recently I began to notice a trend that Dynamic DNS providers have been repeatedly abused as a part of malware campaigns. How is dynamic DNS a threat to your enterprise? What can be done to mitigate this threat? Before we answer these questions, .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-a… *** Another Android hole: "OCtoRuTA" - One (Java) Class to Rule Them All *** --------------------------------------------- Yet another large-scale vulnerability has been revealed in Android. This one lets an otherwise innocent-looking app go rogue, and enjoy privileges normally limited to the trusted parts of Android. --------------------------------------------- https://nakedsecurity.sophos.com/2015/08/11/another-android-hole-octoruta-o… *** Kali Linux 2.0 Released *** --------------------------------------------- We're still buzzing and recovering from the Black Hat and DEF CON conferences where we finished presenting our new Kali Linux Dojo, which was a blast. With the help of a few good people, the Dojo rooms were set up ready for the masses - where many .. --------------------------------------------- https://www.kali.org/releases/kali-linux-20-released/ *** Security Updates Available for Adobe Flash Player (APSB15-19) *** --------------------------------------------- A security bulletin (APSB15-19) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1254 *** Mobilfunkdaten bei Facebook massenhaft auslesbar *** --------------------------------------------- Einem Entwickler ist es gelungen, mit einem kleinen Skript binnen weniger Minuten zahlreiche Mobilfunknummern von Nutzern über Facebook abzufragen. Sicherheitsexperten drängen auf eine andere Voreinstellung. --------------------------------------------- http://heise.de/-2776623

1 0

Tageszusammenfassung - Montag 10-08-2015
by Daily end-of-shift report 10 Aug '15

10 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 07-08-2015 18:00 − Montag 10-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Tech Firm Ubiquiti Suffers $46M Cyberheist *** --------------------------------------------- Networking firm Ubiquiti Networks Inc. disclosed this week that cyber thieves recently stole $46.7 million using an increasingly common scam in which crooks spoof communications from executives at the victim firm in a bid to initiate unauthorized international wire transfers. --------------------------------------------- http://krebsonsecurity.com/2015/08/tech-firm-ubiquiti-suffers-46m-cyberheis… *** Welcome to The Internet of Compromised Things *** --------------------------------------------- This post is a bit of a public service announcement, so Ill get right to the point: Every time you use WiFi, ask yourself: could I be connecting to the Internet through a compromised router with malware?Its becoming more and .. --------------------------------------------- http://blog.codinghorror.com/welcome-to-the-internet-of-compromised-things/ *** Black Hat: Schadsoftware per Windows-Update mit WSUS *** --------------------------------------------- Zwei Sicherheitsforscher demonstrierten auf der Black-Hat-Konferenz, wie sich die Windows Server Update Services (WSUS) zum Verteilen von gefälschten Windows-Updates in einem Unternehmensnetz benutzen lassen. Es gibt jedoch ein schlichtes Gegenmittel. --------------------------------------------- http://heise.de/-2775156 *** Black Hat: SMM weiterhin grosses Einfallstor *** --------------------------------------------- Ein Computerwissenschaftler zeigt ein Scheunentor, das schon zwanzig Jahre offen steht. --------------------------------------------- http://heise.de/-2775248 *** RIG Reloaded - Examining the Architecture of RIG Exploit Kit 3.0 *** --------------------------------------------- A few months ago the RIG exploit kit took quite a hit when its source code was leaked by a disgruntled reseller. At the time we wrote a blog post detailing the inner workings of RIGs infrastructure and business model,... --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/RIG-Reloaded---Examining-the… *** Stagefright: Online-Ganoven tarnen Android-Trojaner als Sicherheitsupdate *** --------------------------------------------- Während die meisten Hersteller keine oder wenige Firmware-Updates anbieten, die vor den gefährlichen Stagefright-Lücken schützen, können Online-Abzocker vermeintlich schon liefern. Es handelt sich dabei allerdings um einen Trojaner. --------------------------------------------- http://heise.de/-2775388 *** WP Statistics <= 9.5.1 - Referer Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8145 *** Stagefright: Motorola verspricht umfassende Updates *** --------------------------------------------- Auch wenn es bisher noch keine Hinweise auf entsprechende Angriffe gibt – die vor zwei Wochen bekannt gewordenen Sicherheitslücken im Media Framework Stagefright haben ordentlich Bewegung in die Android-Welt gebracht. Nach Google, LG und Samsung meldet sich mit Motorola nun der nächste Hersteller zu Wort – und verspricht umfassende Updates. --------------------------------------------- http://derstandard.at/2000020502273 *** Data, Technologies and Security - Part 1 *** --------------------------------------------- A lot of technologies present themselves as solutions for multiple challenges. At BinaryEdge, we are big adepts of analyzing all the different technologies until we see what correctly adapts and fits our environment. From a security .. --------------------------------------------- http://blog.binaryedge.io/2015/08/10/data-technologies-and-security-part-1/ *** What's Next in Malware After Kuluoz? *** --------------------------------------------- Regular readers of this blog have heard all about the infamous Kuluoz malware. This family was the latest evolution of the Asprox malware and at its peak in 2014 it accounted for 80% of .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/08/whats-next-in-malware-af… *** Getting in with the Proxmark 3 and ProxBrute *** --------------------------------------------- As a member of the Physical Security team here at SpiderLabs, some of my job responsibilities include getting into a facility by any (non-destructive) means necessary. When a client has decided once and for all that theyve trained their guards and fortified the gates, its time to test those defenses to measure just how resilient they actually are to an attack. And thats where we come in. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Getting-in-with-the-Pro… *** Google Analytics by Yoast <= 5.4.4 - Authenticated Stored Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8147 *** Mass Dark Web Scanning With PunkSPIDER *** --------------------------------------------- A while back we did some work in scanning Tor hidden services for vulnerabilities (read about it here - btw I love this article for its use of dark web and explaining that the term is highly disputed). Basically, if you dont want to read it, we did a massive scan of the Tor network for web app vulnerabilities as part of our .. --------------------------------------------- http://alex.hyperiongray.com/posts/289994-scanning-the-dark-web *** Stagefright Vulnerability Disclosure *** --------------------------------------------- StageFright which handles multiple media formats, is a system service for Android. This service is implemented by Native C++. The following diagram shows how media applications interact with .. --------------------------------------------- http://translate.wooyun.io/2015/08/08/Stagefright-Vulnerability-Disclosure.… *** Darkhotel APT Latest to Use Hacking Team Zero Day *** --------------------------------------------- The Darkhotel APT gang has extended its geographic reach to victims in a host of additional countries, and has added to its cache of zero days with its use of a HackingTeam exploit for a Flash zero-day vulnerability. --------------------------------------------- http://threatpost.com/darkhotel-apt-latest-to-use-hacking-team-zero-day/114…

1 0

Tageszusammenfassung - Freitag 7-08-2015
by Daily end-of-shift report 07 Aug '15

07 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 06-08-2015 18:00 − Freitag 07-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Updated DGA Changer Malware Generates Fake Domain Stream *** --------------------------------------------- Researchers at Seculert have discovered the latest twist to DGA Changer, which now is able to generate a fake stream of domains if it detects it's being executed in a virtual machine. --------------------------------------------- http://threatpost.com/updated-dga-changer-malware-generates-fake-domain-str… *** BLEKey Device Breaks RFID Physical Access Controls *** --------------------------------------------- A device called BEKey which is the size of a quarter and can be installed in 60 seconds on a proximity card reader could potentially be used to break physical access controls in 80 percent of deployments. --------------------------------------------- http://threatpost.com/blekey-device-breaks-rfid-physical-access-controls/11… *** BIND Denial of Service Vulnerability Blamed on Windows 2000 Compatibility Code *** --------------------------------------------- The BIND implementation of the Domain Name System (DNS) is a critical part of the infrastructure of the Internet. For example, almost all of the 13 root name servers use BIND. On July 28 a vulnerability was published in BIND that could be anonymously exploited by an attacker. To crash the server, all an attacker would have to... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/OQsKsP-w1DU/ *** Schwachstelle: Certifi-Gate erlaubt Zertifikatsmissbrauch unter Android *** --------------------------------------------- Bösartige Apps können in Android legitime Zertifikate nutzen, um erhöhte Rechte zu erhalten. Die Entdecker der Schwachstelle haben dieser den Namen Certifi-Gate gegeben. Google bestätigt die Lücke, betont aber, dass Apps im Play Store auf ein solches Missbrauchspotential überprüft würden. --------------------------------------------- http://www.golem.de/news/schwachstelle-certifi-gate-erlaubt-zertifikatsmiss… *** HTTPS: BGP-Angriff gefährdet TLS-Zertifikatssystem *** --------------------------------------------- Auf der Black Hat weisen Sicherheitsforscher auf ein Problem mit TLS-Zertifizierungsstellen hin: Die Prüfung, wem eine Domain gehört, findet über ein ungesichertes Netz statt. Dieser Weg ist angreifbar - beispielsweise mittels des Routingprotokolls BGP. --------------------------------------------- http://www.golem.de/news/https-bgp-angriff-gefaehrdet-tls-zertifikatssystem… *** Kryptographie: Rechenfehler mit großen Zahlen *** --------------------------------------------- Kryptographische Algorithmen benötigen oft Berechnungen mit großen Ganzzahlen. Immer wieder werden Fehler in den entsprechenden Bibliotheken gefunden. Diese können zu Sicherheitslücken werden. --------------------------------------------- http://www.golem.de/news/kryptographie-rechenfehler-mit-grossen-zahlen-1508… *** Zwölf Sicherheitslücken in PHP geschlossen, Support für Version 5.5 ausgelaufen *** --------------------------------------------- Das PHP-Entwickerteam hat seinen Interpreter sicherer gemacht und weist darauf hin, dass der Support für Version 5.5 vor kurzem abgelaufen ist. Wer kann, sollte auf Version 5.6 umsteigen. --------------------------------------------- http://heise.de/-2774343 *** The GasPot experiment: Hackers target gas tanks *** --------------------------------------------- Physically tampering with gasoline tanks is dangerous enough, given how volatile gas can be. Altering a fuel gauge can cause a tank to overflow, and a simple spark can set everything ablaze. But imagi... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/5bYYfndJK74/secworld.php *** Auto-Hacking: Gehackte Teslas lassen sich bei voller Fahrt ausschalten *** --------------------------------------------- Insgesamt sechs Lücken haben IT-Sicherheitsforscher in der Software der Automobile von Tesla entdeckt. Über sie gelang es ihnen, die Kontrolle über das Fahrzeug zu übernehmen. --------------------------------------------- http://www.golem.de/news/auto-hacking-gehackte-teslas-lassen-sich-bei-volle… *** Firefox exploit found in the wild *** --------------------------------------------- Yesterday morning, August 5, a Firefox user informed us that an advertisement on a news site in Russia was serving a Firefox exploit that searched for sensitive files and uploaded them to a server that appears to be in Ukraine. This morning Mozilla released security updates that fix the vulnerability. All Firefox users are urged to update to Firefox 39.0.3. The fix has also been shipped in Firefox ESR 38.1.1. https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/ --------------------------------------------- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-w… *** CrackLord: Gratis-Tool zum Steuern von Cracking-Clustern *** --------------------------------------------- Forscher haben mit CrackLord eine Open-Source-Software vorgestellt, die CPU-/GPU-Cluster zum Cracken von Passwörtern ansteuert und Aufgaben verwaltet und verteilt. --------------------------------------------- http://heise.de/-2774582 *** Scada-Sicherheit: Siemens-PLC wird zum Einbruchswerkzeug *** --------------------------------------------- Über die oftmals frei aus dem Internet zugänglichen Programmable Logic Controller (PLC) zum Steuern von Scada-Systemen können Angreifer Scanner zum Spionieren in Industrie-Systeme schmuggeln. Die dafür nötige Software steht frei zum Download. --------------------------------------------- http://heise.de/-2774812 *** Citrix XenServer Security Update for CVE-2015-5154 *** --------------------------------------------- A security vulnerability has been identified in Citrix XenServer that may allow a malicious administrator of an HVM guest VM to compromise the host ... --------------------------------------------- http://support.citrix.com/article/CTX201593 *** USN-2706-1: OpenJDK 6 vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2706-16th August, 2015openjdk-6 vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTSSummarySeveral security issues were fixed in OpenJDK 6.Software description openjdk-6 - Open Source Java implementation DetailsSeveral vulnerabilities were discovered in the OpenJDK JRE related toinformation disclosure, data integrity, and availability. An attackercould exploit these to cause a denial of service or expose sensitivedata... --------------------------------------------- http://www.ubuntu.com/usn/usn-2706-1/ *** Security Advisory: Java SE vulnerabilities CVE-2015-2590 and CVE-2015-4732 *** --------------------------------------------- (SOL17079) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/000/sol17079.htm… *** DSA-3329 linux - security update *** --------------------------------------------- Several vulnerabilities have been discovered in the Linux kernelthat may lead to a privilege escalation, denial of service orinformation leak. --------------------------------------------- https://www.debian.org/security/2015/dsa-3329 *** Apache Subversion Bugs Let Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1033215 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: A Security Vulnerability, exists in the Android platform used by the Cordova tools in Rational Application Developer for WebSphere Software (CVE-2015-1835) *** http://www.ibm.com/support/docview.wss?uid=swg21962128 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect IBM Security Identity Governance *** http://www.ibm.com/support/docview.wss?rs=0&uid=swg21963438 *** IBM Security Bulletin: A vulnerability in Diffie-Hellman ciphers affects the IBM FlashSystem V840 (CVE 2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005344 *** IBM Security Bulletin: A vulnerability in Diffie-Hellman ciphers affects the IBM FlashSystem 840 (CVE 2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005339 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21960191 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Tivoli Monitoring (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962739 *** IBM Security Bulletin: A vulnerability in Open Source Struts affects the IBM FlashSystem 840 (CVE 2015-1831) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005329 *** IBM Security Bulletin: Multiple vulnerabilities in Java affect the IBM FlashSystem V840 (CVEs 2015-0204, 2015-0488, and 2015-1916) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005328 *** IBM Security Bulletin: A vulnerability in Open Source Struts affect the IBM FlashSystem V840 (CVE 2015-1831) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005331 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-0488, CVE-2015-0478, CVE-2015-1916) *** http://www.ibm.com/support/docview.wss?uid=swg21883959 *** IBM Security Bulletin: Multiple vulnerabilities in the unzip utility affect IBM Security Access Manager for Mobile. *** http://www.ibm.com/support/docview.wss?uid=swg21963158 *** IBM Security Bulletin: Multiple vulnerability in Product IBM Tivoli Common Reporting(CVE-2015-0488, CVE-2015-0478, CVE-2015-2808, CVE-2015-1916, CVE-2014-0227, CVE-2015-0209 , CVE-2015-0286 , CVE-2015-0289) *** http://www.ibm.com/support/docview.wss?uid=swg21963024 *** IBM Security Bulletin: A vulnerability in Open Source OpenSSL affects the IBM FlashSystem 840 (CVE 2015-0286) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005341 *** IBM Security Bulletin: Vulnerability in Open Source Apache Tomcat affect the IBM FlashSystem V840, (CVE-2014-0227) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005204

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily