Daily

daily@lists.cert.at

1 participants
3249 discussions

Tageszusammenfassung - Mittwoch 20-01-2016
by Daily end-of-shift report 20 Jan '16

20 Jan '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 19-01-2016 18:00 − Mittwoch 20-01-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** Survey shows many businesses aren't encrypting private employee data *** --------------------------------------------- Many companies arent encrypting their own employees private data, according to a Sophos survey of IT decision makers in six countries. --------------------------------------------- https://nakedsecurity.sophos.com/2016/01/19/survey-shows-many-businesses-ar… *** Android Malware Steals Voice-Based Two-Factor Authentication Codes (January 13 and 18, 2016) *** --------------------------------------------- Symantec has detected malware created for Android devices that steals single-use passcodes generated to add a layer of security to online banking authentication procedures... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/18/5/201 *** Dridex banking malware adds a new trick *** --------------------------------------------- Dridex, the banking malware that wont go away, has been improved upon once again.IBMs X-Force researchers have found that the latest version of Dridex uses a DNS (Domain Name System) trick to direct victims to fake banking websites.The technique, known as DNS cache poisoning, involves changing DNS settings to direct someone asking for a legitimate banking website to a fake site.DNS cache poisoning is a powerful attack. Even if a person types in the correct domain name for a bank, the fake... --------------------------------------------- http://www.cio.com/article/3024244/dridex-banking-malware-adds-a-new-trick.… *** /tmp, %TEMP%, ~/Desktop, T:\, ... A goldmine for pentesters!, (Wed, Jan 20th) *** --------------------------------------------- When you are performing a penetration test, you need to learn how your target is working: What kind of technologies and tools are used, how internal usernames are generated, email addresses format, ... Grabbing for such information is called the reconnaissance phase. Once you collected enough details, you can prepare your different scenarios to attack the target.All pentesters have their personal toolbox that has been enhanced day after day. In many cases, there is no real magic: to abuse or... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20631&rss *** Critical Patch Update: Oracle stellt 248 Sicherheitspatches bereit *** --------------------------------------------- Die bislang größte Sicherheitsptach-Sammlung von Oracle ist da und fixt Lücken in Database, Java, MySQL und Co. Dieses Mal steht Oracles E-Business Suite im Mittelpunkt. --------------------------------------------- http://heise.de/-3077692 *** Apple Releases Patches for iOS, OS X and Safari *** --------------------------------------------- Apple released security updates for iOS, OS X and Safari, patching a number of kernel-level code-execution vulnerabilities. --------------------------------------------- http://threatpost.com/apple-releases-patches-for-ios-os-x-and-safari/115946/ *** Trojan for Android preinstalled on Phillips s307 firmware *** --------------------------------------------- January 20, 2016 The past year was marked by a big number of firmware Trojans for Android capable to covertly download and install various software and display annoying advertisements. Android.Cooee.1 incorporated into the graphical shell of some cheap Chinese smartphones was one of them. Virus makers obviously continued to preinstall Android.Cooee.1 into mobile devices. This time, however, Doctor Web security researchers detected the Trojan on firmware of a well-known electronics manufacturer. --------------------------------------------- http://news.drweb.com/show/?i=9792&lng=en&c=9 *** Primes, parameters and moduli *** --------------------------------------------- First a brief history of Diffie-Hellman for those not familiar with it The short version of Diffie-Hellman is that two parties (Alice and Bob) want to share a secret so they can encrypt their communications and talk securely without an... --------------------------------------------- https://securityblog.redhat.com/2016/01/20/primes-parameters-and-moduli/ *** Serious flaw patched in Intel Driver Update Utility *** --------------------------------------------- A software utility that helps users download the latest drivers for their Intel hardware components contained a vulnerability that could have allowed man-in-the-middle attackers to execute malicious code on computers.The tool, known as the Intel Driver Update Utility, can be downloaded from Intels support website. It provides an easy way to find the latest drivers for various Intel chipsets, graphics cards, wireless cards, desktop boards, Intel NUC mini PCs or the Intel Compute Stick. --------------------------------------------- http://www.cio.com/article/3024345/serious-flaw-patched-in-intel-driver-upd… *** Cisco Guide to Harden Cisco IOS Devices *** --------------------------------------------- This document contains information to help you secure your Cisco IOS system devices, which increases the overall security of your network. Structured around the three planes into which functions of a network device can be categorized, this document provides an overview of each included feature and references to related documentation. --------------------------------------------- http://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html *** Security Advisory: BIND vulnerability CVE-2015-8704 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/53/sol53445000.html?… *** Intel Driver Update Utility 2.2.0.5 Man-In-The-Middle *** --------------------------------------------- Topic: Intel Driver Update Utility 2.2.0.5 Man-In-The-Middle Risk: Medium Text:1. Advisory Information Title: Intel Driver Update Utility MiTM Advisory ID: CORE-2016-0001 Advisory URL: http://www.cores... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016010119 *** Oracle Critical Patch Update Advisory - January 2016 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html *** Oracle Linux Bulletin - January 2016 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867… *** HPSBGN03534 rev.1 - HPE Performance Center using Microsoft Report Viewer, Remote Disclosure of Information, Cross-Site Scripting (XSS) *** --------------------------------------------- A vulnerability in Microsoft Report Viewer was addressed by HPE Performance Center. This is a Cross-Site scripting (XSS) vulnerability that could allow remote information disclosure. --------------------------------------------- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr… *** Xen Security Advisory CVE-2016-1571 / XSA-168 *** --------------------------------------------- VMX: intercept issue with INVLPG on non-canonical address --------------------------------------------- http://xenbits.xen.org/xsa/advisory-168.html *** Xen Security Advisory CVE-2016-1570 / XSA-167 *** --------------------------------------------- PV superpage functionality missing sanity checks --------------------------------------------- http://xenbits.xen.org/xsa/advisory-167.html *** Cisco Modular Encoding Platform D9036 Software Default Credentials Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Unified Computing System Manager and Cisco Firepower 9000 Remote Command Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** DFN-CERT-2016-0109: Foxit Reader, Foxit PhantomPDF: Mehrere Schwachstellen ermöglichen Denial-of-Service-Angriffe und das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-0109/ *** DFN-CERT-2016-0106: NTP: Mehrere Schwachstellen ermöglichen u.a. das Darstellen falscher Informationen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-0106/ *** APPLE-SA-2016-01-19-3 Safari 9.0.3 *** --------------------------------------------- APPLE-SA-2016-01-19-3 Safari 9.0.3Safari 9.0.3 is now available and addresses the following:WebKitAvailable for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,OS X El Capitan v10.11 to v10.11.2Impact: Visiting a maliciously crafted website may lead to arbitrarycode execution [...] --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2016/Jan/msg00004.ht… *** APPLE-SA-2016-01-19-2 OS X El Capitan 10.11.3 and Security Update 2016-001 *** --------------------------------------------- APPLE-SA-2016-01-19-2 OS X El Capitan 10.11.3 and Security Update2016-001OS X El Capitan 10.11.3 and Security Update 2016-001 is now availableand addresses the following:AppleGraphicsPowerManagementAvailable for: OS X El Capitan v10.11 to v10.11. [...] --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2016/Jan/msg00003.ht… *** APPLE-SA-2016-01-19-1 iOS 9.2.1 *** --------------------------------------------- APPLE-SA-2016-01-19-1 iOS 9.2.1iOS 9.2.1 is now available and addresses the following:Disk ImagesAvailable for: iPhone 4s and later,iPod touch (5th generation) and later, iPad 2 and laterImpact: A local user may be able to execute arbitrary code withkernel privileges [...] --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2016/Jan/msg00002.ht… *** DSA-3449 bind9 - security update *** --------------------------------------------- It was discovered that specific APL RR data could trigger an INSISTfailure in apl_42.c and cause the BIND DNS server to exit, leading to adenial-of-service. --------------------------------------------- https://www.debian.org/security/2016/dsa-3449 *** Siemens OZW672 and OZW772 XSS Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a cross-site scripting vulnerability in Siemens OZW672 and OZW772 devices. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-019-01 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM FlashSystem model V840 (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005584 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM FlashSystem model 840 (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005585 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSH affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance (CVE-2016-0777, CVE-2016-0778) *** http://www.ibm.com/support/docview.wss?uid=swg2C1000044 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM SAN Volume Controller and Storwize Family (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005583 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM Sterling Connect:Express for UNIX (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21974473 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM Sterling Connect:Direct for UNIX (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21974888 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in the GSKit component of IBM WebSphere MQ (CVE-2016-0201) *** http://www.ibm.com/support/docview.wss?uid=swg21974466 --------------------------------------------- *** IBM Security Bulletin: IBM Spectrum Scale is affected by a security vulnerability (CVE-2015-7488) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005580 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in IBM SDK for Node.js affect IBM Business Process Manager Configuration Editor (CVE-2015-8027, CVE-2015-3194, CVE-2015-3195, CVE-2015-3196) *** http://www.ibm.com/support/docview.wss?uid=swg21974459 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum Scale (CVE-2015-4843, CVE-2015-4805, CVE-2015-4810, CVE-2015-4806, CVE-2015-4871, CVE-2015-4902) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005579 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM API Management (CVE-2015-4872 CVE-2015-4911 CVE-2015-4893 CVE-2015-4803) *** http://www.ibm.com/support/docview.wss?uid=swg21974673 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SD affect Guardium Data Reduction *** http://www.ibm.com/support/docview.wss?uid=swg21973724 --------------------------------------------- *** IBM Security Bulletin:Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Composite Application Manager for Transactions (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=swg21971951 --------------------------------------------- *** IBM Security Bulletin: Multiple Security Vulnerabilities exist in IBM Cognos Express. *** http://www.ibm.com/support/docview.wss?uid=swg21972376 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 19-01-2016
by Daily end-of-shift report 19 Jan '16

19 Jan '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-01-2016 18:00 − Dienstag 19-01-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** FDA Issues Guidelines on Medical Device Cybersecurity *** --------------------------------------------- The Food and Drug Administration (FDA) issued a new set of draft guidelines on Friday in hopes medical device manufacturers address cybersecurity risks in their products. --------------------------------------------- http://threatpost.com/fda-issues-guidelines-on-medical-device-cybersecurity… *** Good practice guide on disclosing vulnerabilities *** --------------------------------------------- ENISA published a good practice guide on vulnerability disclosure, aiming to provide a picture of the challenges the security researchers, the vendors and other involved stakeholders are confronted wi... --------------------------------------------- http://www.net-security.org/secworld.php?id=19342 *** Microsoft asks: We've taken down botnets for you. How about a kill switch? *** --------------------------------------------- Its like pulling a smoking car off the road... Oh, hang on Last December, Microsoft intercepted traffic on users' PCs and helped break up a botnet. And nobody complained. So the company very tentatively asked at a session on ethics and policy in Brussels this week whether it should do more. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/01/19/microsoft_b… *** Security: XSS-Lücke in Yahoo-Mail gefixt *** --------------------------------------------- Eine XSS-Lücke in Yahoo-Mail ermöglichte es Angreifern, fremde Accounts zu übernehmen. Sie hätten alle E-Mails der Nutzer weiterleiten und ausgehende E-Mails mit Viren infizieren können, schreibt ein Sicherheitsforscher. Yahoo hat bereits reagiert. --------------------------------------------- http://www.golem.de/news/security-xss-luecke-in-yahoo-mail-gefixt-1601-1186… *** Angler Exploit Kit's January Vacation *** --------------------------------------------- Since last year, we've been monitoring various redirectors which lead to exploit kits (EK). One of the redirectors in question routes to either Angler EK or Neutrino EK. SANS ISC has also observed this particular redirector switching between these two kits. At the beginning of this year, we noticed a sudden significant drop in our... --------------------------------------------- https://labsblog.f-secure.com/2016/01/19/angler-exploit-kits-january-vacati… *** Root-Exploit: Android und Linux anfällig für Rechte-Trickserei *** --------------------------------------------- Der Schlüsselbund des Kernels stattet mit einem Trick seit 2012 jeden Nutzer mit Root-Rechten aus. Allerdings muss der Nutzer dafür bereits angemeldet sein. --------------------------------------------- http://heise.de/-3076663 *** MSN Home Page Drops More Malware Via Malvertising *** --------------------------------------------- Visitors to the MSN homepage may have been exposed to malvertising.Categories: MalvertisingTags: ad spiritappnexusmalvertisingmsn(Read more...) --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2016/01/msn-home-page-drops-mo… *** Cisco Web Security Appliance Security Bypass Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Moodle Bugs Let Remote Users Access Hidden Course and Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1034694

1 0

Tageszusammenfassung - Montag 18-01-2016
by Daily end-of-shift report 18 Jan '16

18 Jan '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 15-01-2016 18:00 − Montag 18-01-2016 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** Cisco FireSIGHT Management Center Stored Cross-Site Scripting Vulnerabilities *** --------------------------------------------- Multiple vulnerabilities in the web framework of Cisco FireSIGHT Management Center could allow an unauthenticated, remote attacker to execute a stored cross-site scripting (XSS) attack against a user of the Cisco FireSIGHT Management Center web interface. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Easily Exploitable Vulnerability Could Cause Physical Damage to Industrial Motors *** --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/18/4/307 *** Cisco FireSIGHT Management Center DOM-Based Cross-Site Scripting Vulnerability *** --------------------------------------------- Cisco FireSIGHT Management Center (MC) contains a DOM-based cross-site scripting vulnerability (XSS) in the management page. An unauthenticated, remote attacker could persuade a user to perform a malicious action, allowing the attacker to perform a XSS attack. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** IBM Security Bulletin: Vulnerabilities in GNU grep utility affect IBM Security Network Protection (CVE-2012-5667, and CVE-2015-1345) *** --------------------------------------------- The grep utility searches through textual input for lines that contain a match to a specified pattern and then prints the matching lines. Security vulnerabilities have been discovered in grep utility used with IBM Security Network Protection. --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21972209 *** IBM Security Bulletin: IBM WebSphere Application Server Liberty Profile vulnerability affects IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2015-2017) *** --------------------------------------------- WebSphere Application Server Liberty Profile that is embedded in TADDM could allow a remote attacker to has access to the customer app or a form which sends the contents in a header will be able to split the response and add headers to the response. The customer application will allow cross-site scripting, web cache poisoning, and other similar exploits. --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21974782 *** Cisco Adaptive Security Appliance Information Disclosure Vulnerability *** --------------------------------------------- A vulnerability in the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional attacks. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** The SLOTH attack and IKE/IPsec *** --------------------------------------------- The IKE daemons in RHEL7 (libreswan) and RHEL6 (openswan) are not vulnerable to the SLOTH attack. But the attack is still interesting to look at . The SLOTH attack released today is a new transcript collision attack against .. --------------------------------------------- https://securityblog.redhat.com/2016/01/15/the-sloth-attack-and-ikeipsec/ *** Schwere Lücke bei Überwachungskameras von Hofer und Aldi *** --------------------------------------------- Sicherheitsexperten warnen vor Überwachungskameras der Marke Maginon. Diese erlauben den ungeschützten Zugriff auf Bild und Ton, aber auch WLAN- und E-Mail-Passwörter. --------------------------------------------- http://futurezone.at/produkte/schwere-luecke-bei-ueberwachungskameras-von-h… *** LostPass *** --------------------------------------------- I have discovered a phishing attack against LastPass that allows an attacker to steal a LastPass users email, password, and even two-factor auth code, giving full access to all passwords and documents stored in LastPass. --------------------------------------------- https://www.seancassidy.me/lostpass.html *** Privilege Escalation on Windows 7,8,10, Server 2008, Server 2012 - and a new network attack *** --------------------------------------------- Hot Potato (aka: Potato) takes advantage of known issues in Windows to gain local privilege escalation in default configurations, namely NTLM relay (specifically HTTP->SMB relay) and NBNS spoofing. --------------------------------------------- http://foxglovesecurity.com/2016/01/16/hot-potato/ *** HTTP Evasions Explained - Part 10 - Lazy Browsers *** --------------------------------------------- The previous parts of this series looked at firewalls and browsers as black boxes which just behave that way for unknown reason. For this part I took a closer look at the source code of Chromium and Firefox. This way Ive found even more ways to construct HTTP which is insanely broken but still gets accepted by the .. --------------------------------------------- http://noxxi.de/research/http-evader-explained-10-lazy-browsers.html *** nic.at bringt "Security-Lock" für Domains *** --------------------------------------------- Schutz soll verhindern, dass eine Domain irrtümlich unerreichbar oder manipuliert wird --------------------------------------------- http://derstandard.at/2000029286062

1 0

Tageszusammenfassung - Freitag 15-01-2016
by Daily end-of-shift report 15 Jan '16

15 Jan '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 14-01-2016 18:00 − Freitag 15-01-2016 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** NCCIC/ICS-CERT Monitor for November-December 2015 *** --------------------------------------------- The NCCIC/ICS-CERT Monitor for November-December 2015 is a summary of ICS-CERT activities for that period of time. --------------------------------------------- https://ics-cert.us-cert.gov/monitors/ICS-MM201512 Download: https://ics-cert.us-cert.gov/sites/default/files/Monitors/ICS-CERT%20Monito… *** Oracle Critical Patch Update - January 2016 - Pre-Release Announcement *** --------------------------------------------- [...] This Critical Patch Update contains 248 new security vulnerability fixes across hundreds of Oracle products. Some of the vulnerabilities addressed in this Critical Patch Update affect multiple products. Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html *** Creator of MegalodonHTTP DDoS Botnet Arrested *** --------------------------------------------- Last month, the Norway police arrested five hackers accused of running the MegalodonHTTP Remote Access Trojan (RAT). The arrests came as part of the joint operation between Norway's Kripos National Criminal Investigation Service and Europol, codenamed "OP Falling sTAR." According to the United States security firm, all the five men, aged between 16 and 24 years and located in Romania,... --------------------------------------------- https://thehackernews.com/2016/01/MegalodonHTTP-DDoS-Botnet.html *** Kreditkartenhack bei VISA: Unter anderem A1-Kunden betroffen *** --------------------------------------------- Ein Drittanbieter in Island wurde angegriffen - rund 2.000 A1 Visa-Kunden erhalten neue Karte --------------------------------------------- http://derstandard.at/2000029114201 *** Updated BlackEnergy Trojan Grows More Powerful *** --------------------------------------------- In late December, a cyberattack caused a power outage in the Ukraine, plunging hundreds of thousands of citizens into darkness for hours. Threat researchers soon confirmed that the BlackEnergy malware package, first developed in 2007, was the culprit. They also discovered that the malware has been significantly upgraded since its first release. --------------------------------------------- https://blogs.mcafee.com/mcafee-labs/updated-blackenergy-trojan-grows-more-… *** Wieder sicher: Authentifizierungsprotokoll OAuth *** --------------------------------------------- Angreifer sollen abermals Log-in-Daten von Nutzern abgreifen können, wenn diese sich mittels OAuth bei Online-Services anmelden. Die Schwachstellen wurden bereits geschlossen. Sicherheitsforscher attestieren dem Protokoll insgesamt eine hohe Sicherheit. --------------------------------------------- http://heise.de/-3071639 *** Spamming Someone from PayPal *** --------------------------------------------- Troy Hunt has identified a new spam vector. PayPal allows someone to send someone else a $0 invoice. The spam is in the notes field. But its a legitimate e-mail from PayPal, so it evades many of the traditional spam filters. Presumably it doesnt cost anything to send a $0 invoice via PayPal. Hopefully, the company will close this loophole... --------------------------------------------- https://www.schneier.com/blog/archives/2016/01/spamming_someon.html *** OS Xs Gatekeeper bypassed again *** --------------------------------------------- Do you remember when, last October, Synack director of research Patrick Wardle found a simple way to evade OS Xs Gatekeeper defense mechanism by bundling up a legitimate Apple-signed app with a malic... --------------------------------------------- http://www.net-security.org/secworld.php?id=19336 *** Advantech WebAccess Vulnerabilities *** --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 *** Manage Engine Applications Manager 12 Multiple Vulnerabilities *** --------------------------------------------- Applications Manager suffers from multiple vulnerabilities including XSS, CSRF and Privilege Escalation. --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5292.php

1 0

Tageszusammenfassung - Donnerstag 14-01-2016
by Daily end-of-shift report 14 Jan '16

14 Jan '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-01-2016 18:00 − Donnerstag 14-01-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** SlemBunk Part II: Prolonged Attack Chain and Better-Organized Campaign *** --------------------------------------------- Our follow-up investigation of a nasty Android banking malware we identified at the tail end of last year has not only revealed that the trojan is more persistent than we initially realized - thus making for a much more dangerous threat - but that it is also being used as part of an ongoing and evolving campaign. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2016/01/slembunk-part-two.html *** Faulty ransomware renders files unrecoverable, even by the attacker *** --------------------------------------------- A cybercriminal has built a ransomware program based on proof-of-concept code released online, but messed up the implementation, resulting in victims files being completely unrecoverable.Researchers from antivirus vendor Trend Micro recently .. --------------------------------------------- http://www.cio.com/article/3022159/faulty-ransomware-renders-files-unrecove… *** As easy as Citrix123 - hacker claims he popped Citrixs CMS *** --------------------------------------------- And once he was in, it became possible to pour malware onto all customers, allegedly A Russian hacker claims he broke into systems run by Citrix, and gained access to potentially a huge number of customers. --------------------------------------------- www.theregister.co.uk/2016/01/13/ruskie_hacker_pops_citrix/ *** Ex-NSA-Chef: Hintertüren für Verschlüsselung sind eine furchtbare Idee *** --------------------------------------------- Michael Hayden widerspricht den Forderungen von FBI-Boss James Comey --------------------------------------------- http://derstandard.at/2000029033330 *** RedHen CRM - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-002 *** --------------------------------------------- The Redhen set of modules allows you to build a CRM features in a Drupal site.When rendering individual Contacts, this module does not properly filter the certain data prior to display. When rendering listing of notes or engagement scores, .. --------------------------------------------- https://www.drupal.org/node/2649800 *** Cisco kämpft mit statischem Passwort und fixt kritische Lücken *** --------------------------------------------- In Ciscos Identity Services Engine klafft eine als kritisch und eine als hoch eingestufte Schwachstelle. Neben der Wireless-LAN-Controller-Software sind auch noch Aironet-Basisstationen der 1800-Serie verwundbar. Sicherheitsupdates stehen bereit. --------------------------------------------- http://heise.de/-3070756 *** Angriff der Cyber-Eichhörnchen *** --------------------------------------------- Eichhörnchen sind eine größere Gefahr für Internet- und Stromleitungen als Hacker. Das zeigt die Webseite CyberSquirrel1 auf augenzwinkernde Art und Weise. --------------------------------------------- http://www.golem.de/news/internet-und-stromausfaelle-angriff-der-cyber-eich… *** OpenSSL version 1.1.0 pre release 2 published *** --------------------------------------------- OpenSSL 1.1.0 is currently in alpha. OpenSSL 1.1.0 pre release 2 has now been made available. For details of changes and known issues see the release .. --------------------------------------------- https://mta.openssl.org/pipermail/openssl-announce/2016-January/000057.html *** Triple-Seven: OpenSSH-Schwachstelle leakt geheime Schlüssel *** --------------------------------------------- Eine unfertige Option, die bei OpenSSH seit 2010 standardmäßig aktiviert ist, führt dazu, dass gekaperte Server die geheimen Schlüssel der sich verbindenden Nutzer auslesen können. Updates, welche die Lücke schließen, stehen bereit. --------------------------------------------- http://heise.de/-3071372 *** Ransomware a Threat to Cloud Services, Too *** --------------------------------------------- Ransomware -- malicious software that encrypts the victims files and holds them hostage unless and until the victim pays a ransom in Bitcoin -- has emerged as a potent and increasingly common threat online. But many Internet users are unaware that ransomware also can just as easily seize control over files stored on cloud services. --------------------------------------------- http://krebsonsecurity.com/2016/01/ransomware-a-threat-to-cloud-services-to…

1 0

Tageszusammenfassung - Mittwoch 13-01-2016
by Daily end-of-shift report 13 Jan '16

13 Jan '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-01-2016 18:00 − Mittwoch 13-01-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security Bulletins Posted for Adobe Acrobat and Reader *** --------------------------------------------- Security Bulletins for Adobe Acrobat and Reader (APSB16-02) have been published. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using the instructions referenced in the relevant security bulletin. This posting .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1311 *** There Goes The Neighborhood - Bad Actors on GMHOST Alexander Mulgin Serginovic *** --------------------------------------------- Whether they encourage it or not, some network operators become known and favored by criminals such as those that operate exploit kit (EK) and malware infrastructure. After .. --------------------------------------------- http://research.zscaler.com/2016/01/there-goes-neighborhood-bad-actors-on.h… *** MS16-JAN - Microsoft Security Bulletin Summary for January 2016 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS16-JAN *** Raising the Dead *** --------------------------------------------- It's a bit late for Halloween but the ability to resurrect the dead (processes that is) is an interesting type of security issue when dealing with multi-user Windows systems such as Terminal Servers. Specifically this blog is about this issue which I reported to Microsoft and was fixed in bulletin .. --------------------------------------------- http://googleprojectzero.blogspot.com/2016/01/raising-dead.html *** FortiOS SSH Undocumented Interactive Login Vulnerability *** --------------------------------------------- http://www.fortiguard.com/advisory/fortios-ssh-undocumented-interactive-log… *** Ransomware Strikes Websites *** --------------------------------------------- Ransomware is one of the most insidious types of malware that one can come across. These infections will encrypt all files on the target computer as well as any hard drives connected to the machine - pictures, videos, text files - you .. --------------------------------------------- https://blog.sucuri.net/2016/01/ransomware-strikes-websites.html *** Triaging the exploitability of IE/EDGE crashes *** --------------------------------------------- Both Internet Explorer (IE) and Edge have seen significant changes in order to help protect customers from security threats. This work has featured a number of mitigations that together have not only rendered classes of vulnerabilities not-exploitable, but also dramatically raised the cost .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2016/01/12/triaging-the-exploitabili… *** Die smarte Türklingel verrät das WLAN-Passwort *** --------------------------------------------- Eine Gegensprechanlage, die mit dem Smartphone zusammenarbeitet. Klingt eigentlich praktisch, doch leider weist das Gerät Sicherheitsmängel auf, wie Hacker jetzt herausfanden. --------------------------------------------- http://www.golem.de/news/internet-of-things-die-smarte-tuerklingel-verraet-… *** Backdoor bei Fortinet vermutet: Firma spricht von Lücke *** --------------------------------------------- Alternative Login-Methode in Software entdeckt – Patch bereits 2014 veröffentlicht --------------------------------------------- http://derstandard.at/2000028972976 *** A Case of Too Much Information: Ransomware Code Shared Publicly for 'Educational Purposes', Used Maliciously Anyway *** --------------------------------------------- Researchers, whether independent or from security vendors, have a responsibility to properly disseminate the information they gathered to help the industry as well as users. Even with the best intentions, improper disclosure of sensitive information .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/a-case-of-too-mu… *** Security: Verizon routet 4 Millionen Spammer-IPs *** --------------------------------------------- IPv4-Adressen sind ein knappes Gut. Doch der US-Anbieter Verizon reagiere trotzdem nicht auf Missbrauchsmitteilungen, kritisiert eine Sicherheitsfirma. --------------------------------------------- http://www.golem.de/news/security-verizon-routet-4-millionen-spammer-ips-16… *** [HTB23279]: Multiple SQL Injection Vulnerabilities in mcart.xls Bitrix Module *** --------------------------------------------- High-Tech Bridge Security Research Lab discovered multiple SQL Injection vulnerabilities in mcart.xls Bitrix module, which can be exploited to execute arbitrary SQL queries and obtain potentially sensitive data, modify information in database and gain complete control over the vulnerable website. --------------------------------------------- https://www.htbridge.com/advisory/HTB23279 *** [HTB23283]: Remote Code Execution in Roundcube *** --------------------------------------------- High-Tech Bridge Security Research Lab discovered a path traversal vulnerability in a popular webmail client Roundcube. Vulnerability can be exploited to gain access to sensitive information and under certain circumstances to execute arbitrary code and totally compromise the vulnerable server. --------------------------------------------- https://www.htbridge.com/advisory/HTB23283 *** Hacking Team's Leak Helped Researchers Hunt Down a Zero-Day *** --------------------------------------------- Researchers at Kaspersky Lab have, for the first time, discovered a valuable zero-day exploit after intentionally going on the hunt for it. --------------------------------------------- http://www.wired.com/2016/01/hacking-team-leak-helps-kaspersky-researchers-… *** Denial-of-Service Flaw Patched in DHCP *** --------------------------------------------- The Internet Systems Consortium (ISC) on Tuesday patched a denial-of-service vulnerability in numerous versions of DHCP. --------------------------------------------- http://threatpost.com/denial-of-service-flaw-patched-in-dhcp/115875/ *** The SLOTH attack and IKE/IPsec *** --------------------------------------------- Executive Summary: The IKE daemons in RHEL7 (libreswan) and RHEL6 (openswan) are not vulnerable to the SLOTH attack. But the attack is still interesting to look at . The SLOTH attack released today is a new transcript collision attack against .. --------------------------------------------- https://securityblog.redhat.com/2016/01/13/the-sloth-attack-and-ikeipsec/

1 0

Tageszusammenfassung - Dienstag 12-01-2016
by Daily end-of-shift report 12 Jan '16

12 Jan '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 11-01-2016 18:00 − Dienstag 12-01-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Angler Exploit Kit Continues to Evade Detection: Over 90,000 Websites Compromised *** --------------------------------------------- Exploit Kits (EK), arguably the most impactful malicious infrastructure on the Internet, constantly evolve to evade detection by security technology. Tremendous effort has been spent on tracking new variations of different EK families. In .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2016/01/angler-exploit-kit-conti… *** Mac OS X, iOS, and Flash Had the Most Discovered Vulnerabilities in 2015 *** --------------------------------------------- Interesting analysis: Which software had the most publicly disclosed vulnerabilities this year? The winner is none other than Apples Mac OS X, with 384 vulnerabilities. The runner-up? Apples iOS, with 375 vulnerabilities. Rounding out the top five are Adobes Flash Player, with 314 vulnerabilities; Adobes AIR .. --------------------------------------------- https://www.schneier.com/blog/archives/2016/01/mac_os_x_ios_an.html *** DSA-3440 sudo - security update *** --------------------------------------------- When sudo is configured to allow a user to edit files under a directory that they can already write to without using sudo, they can actuallyedit (read and write) arbitrary files. Daniel Svartman reported that aconfiguration like this might .. --------------------------------------------- https://www.debian.org/security/2016/dsa-3440 *** Ransom32 - look at the malicious package *** --------------------------------------------- Ransom32 is a new ransomware implemented in a very atypical style. In our post, we will focus on some implementation details of the malicious package. --------------------------------------------- https://blog.malwarebytes.org/intelligence/2016/01/ransom32-look-at-the-mal… *** Say 'Cyber' again - Ars cringes through CSI: Cyber *** --------------------------------------------- CBS endangered cyber-procedural: Plane hacking! Software defined radio! White noise! OMG! --------------------------------------------- http://arstechnica.com/the-multiverse/2016/01/say-cyber-again-ars-cringes-t… *** McAfee Application Control - The dinosaurs want their vuln back *** --------------------------------------------- The experts of the SEC Consult Vulnerability Lab conducted research in the field of the security of application whitelisting in critical infrastructures. In the course of that research the security of McAfee Application Control was checked.The experts developed several methods to bypass the provided protections .. --------------------------------------------- http://blog.sec-consult.com/2016/01/mcafee-application-control-dinosaurs.ht… *** (ISC)2 SecureAustria *** --------------------------------------------- How can we know what we are protecting if we struggle to understand and keep up with how we and our organizations are changing? It�s time to get a grip on the far-reaching and fundamental changes that are occurring in business today. --------------------------------------------- https://www.sba-research.org/events/isc2-secureaustria/ *** Sicherheit: Aus für alte IE-Versionen trifft jeden fünften Webnutzer *** --------------------------------------------- Über die Jahre hat Microsoft eine Fülle unterschiedlicher Versionen des Internet Explorers veröffentlicht. Nun entledigt man sich der Support-Pflichten für einen großen Teil derselben: Ab sofort liefert Microsoft keinerlei Updates mehr für Internet Explorer 8 bis 10. --------------------------------------------- http://derstandard.at/2000028882047 *** Cops Say They Can Access Encrypted Emails on So-Called PGP BlackBerrys *** --------------------------------------------- Dutch investigators have confirmed to Motherboard that they are able to read encrypted messages sent on PGP BlackBerry phones�custom, security-focused BlackBerry devices that come complete with an encrypted email feature, and which reportedly may be used by organized criminal groups. --------------------------------------------- https://motherboard.vice.com/read/cops-say-they-can-access-encrypted-emails… *** Ongoing Sophisticated Malware Campaign Compromising ICS (Update C) *** --------------------------------------------- This alert update is a follow-up to the updated NCCIC/ICS-CERT Alert titled ICS-ALERT-14-281-01B Ongoing Sophisticated Malware Campaign Compromising ICS that was published December 10, 2014, on the ICS-CERT web site. | ICS-CERT has identified a sophisticated malware campaign that has compromised numerous .. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-14-281-01B *** Experts warn Neutrino and RIG exploit kit activity spike *** --------------------------------------------- Security experts at Heimdal Security are warning a spike in cyber attacks leveraging the popular Neutrino and RIG exploit kit. Cyber criminals always exploit new opportunities and users' bad habits, now crooks behind the recent campaigns relying on Neutrino and RIG exploit kits are ramping up attacks .. --------------------------------------------- http://securityaffairs.co/wordpress/43482/cyber-crime/neutrino-rig-exploit-… *** Group using DDoS attacks to extort business gets hit by European law enforcement *** --------------------------------------------- On 15 and 16 December, law enforcement agencies from Austria, Bosnia and Herzegovina, Germany and the United Kingdom joined forces with Europol in the framework of an operation against the ... --------------------------------------------- http://www.net-security.org/secworld.php?id=19314 *** Schwere Sicherheitslücken im Passwort-Manager von Trend Micro *** --------------------------------------------- Google-Forscher Tavis Ormandy deckt wieder einmal Schwachstellen in Anti-Viren-Software auf. Bei Trend Micro stellt er konsterniert fest: "Das Lächerlichste, was ich je gesehen habe." --------------------------------------------- http://heise.de/-3069140 *** UPC: Standard-WLAN-Passwörter kinderleicht zu knacken *** --------------------------------------------- Neuer Hack erlaubt Berechnung basierend auf der ESSID – UPC prüft Klage gegen Sicherheitsforscher. --------------------------------------------- http://derstandard.at/2000028921659 *** An Easy Way for Hackers to Remotely Burn Industrial Motors *** --------------------------------------------- Devices that control the speed of industrial motors operating water plant pumps and other equipment can be remotely hacked and destroyed. --------------------------------------------- http://www.wired.com/2016/01/an-easy-way-for-hackers-to-remotely-burn-indus…

1 0

Tageszusammenfassung - Montag 11-01-2016
by Daily end-of-shift report 11 Jan '16

11 Jan '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 08-01-2016 18:00 − Montag 11-01-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** GM Asks Friendly Hackers to Report Its Cars' Security Flaws *** --------------------------------------------- The auto giant becomes the first in Detroit to extend an olive branch to car hackers. --------------------------------------------- http://www.wired.com/2016/01/gm-asks-friendly-hackers-to-report-its-cars-se… *** STIX - Looking at a Campaign, Part 1 *** --------------------------------------------- Now we come to a useful application of STIX: characterizing a campaign. --------------------------------------------- http://www.scmagazine.com/stix--looking-at-a-campaign-part-1/article/464093/ *** ZDI-16-007: McAfee Application Control Kernel Driver Memory Corruption Privilege Escalation Vulnerability *** --------------------------------------------- This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of McAfee Application Control. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-16-007/ *** Advancing the Security of Juniper Products *** --------------------------------------------- BOB WORRALL, SVP CHIEF INFORMATION OFFICER makes provides more detail on the ScreenOS investigation and security steps being taken with Junos and across Juniper. --------------------------------------------- http://forums.juniper.net/t5/Security-Incident-Response/Advancing-the-Secur… *** Virtual Bitlocker Containers, (Sat, Jan 9th) *** --------------------------------------------- This week, I gotan interestingquestion from a customer: What do you recommend to safely store files in a directoryon my laptop?. They are plenty of ways to achievethis, the right choice depending on the encryption reliability, the ease of use and .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20593 *** MMD-0049-2016 - A case of java trojan (downloader/RCE) for remote minerd hack *** --------------------------------------------- This is a short post for supporting the takedown purpose. Warning: Sorry, theres nothing fancy nor "in-depth analysis" in here :-) The scheme is so bad, so I think its best for all to know for mitigation and hardening purpose. In this case, a bad actor was .. --------------------------------------------- http://blog.malwaremustdie.org/2016/01/mmd-0049-2016-case-of-java-trojan.ht… *** Studie: Mittelstand unterschätzt Gefahr durch Cyber-Kriminalität *** --------------------------------------------- Die Schäden steigen, das Bewusstsein für IT-Sicherheit nicht: Laut einer Studie schützen sich Mittelständler nur unzureichend gegen IT-Angriffe. Dabei zwingt sie der Gesetzgeber längst zum Handeln. --------------------------------------------- http://heise.de/-3067640 *** Jänner-Update: Google schließt kritische Lücken in Android *** --------------------------------------------- Google scheint seinen Sicherheits-Update-Rhythmus gefunden zu haben – zumindest wenn es um die eigenen Geräte geht. Aktuell liefert Google das Jänner-Update für Android an die Smartphones und Tablets der Nexus-Linie aus. --------------------------------------------- http://derstandard.at/2000028786638 *** NSA-Spionagevorwürfe: Juniper verspricht weitere Updates *** --------------------------------------------- Vom US-Geheimdienst eingebrachter Zufallszahlengenerator wird aus Netzwerk-Betriebssystem entfernt --------------------------------------------- http://derstandard.at/2000028789875 *** A Look Inside Cybercriminal Call Centers *** --------------------------------------------- Crooks who make a living via identity theft schemes, dating scams and other con games often run into trouble when presented with a phone-based challenge that requires them to demonstrate mastery of a language they dont speak fluently. Enter the .. --------------------------------------------- http://krebsonsecurity.com/2016/01/a-look-inside-cybercriminal-call-centers/ *** Android: Schadsoftware aus Play Store hunderttausendfach installiert *** --------------------------------------------- Geht es um Android-Malware fällt der Ratschlag für die Nutzer meist recht simpel aus: Wer auf die Installation von Apps aus unsicheren Quellen verzichtet, ist üblicherweise auch nicht gefährdet. Doch in einem aktuellen Fall ist es Angreifern nun gelungen, die Sicherheitschecks des Play Store auszutricksen. --------------------------------------------- http://derstandard.at/2000028774967 *** Hackerangriff auf Rechenzentrumsbetreiber Interxion *** --------------------------------------------- Im Dezember kam es zu einem Einbruch auf das eigene CRM-System --------------------------------------------- http://derstandard.at/2000028816801 *** Klickbetrug: Unter dem Deckmantel der Cookie-Warnung *** --------------------------------------------- Online-Gauner verstecken sich im wahrsten Sinne des Wortes hinter Cookie-Warnungen und sammeln so Klicks auf Werbeanzeigen ein. --------------------------------------------- http://heise.de/-3067995 *** OAuth2 & OpenID - HTTPS Bicycle Attack *** --------------------------------------------- The OAuth 2.0 protocol allows users to grant relying parties access to resources at identity providers. In addition to being used for this kind of authorization, OAuth is also often employed for authentication in single sign-on (SSO) systems. OAuth 2.0 is, in fact, one of the most widely used .. --------------------------------------------- https://cxsecurity.com/issue/WLB-2016010064 *** PHP-Updates über alle Versionen beheben einige Sicherheitsprobleme *** --------------------------------------------- Die Macher der Skriptsprache empfehlen den Nutzern von PHP 7.0, 5.5 und 5.6 die Installation der aktuellen Security-Releases. Gleichzeitig gibt ein Blick auf GitHub und das PHP-Wiki eine Vorschau auf kommende Funktionen in PHP 7.1. --------------------------------------------- http://heise.de/-3068170 *** DSA-3438 xscreensaver - security update *** --------------------------------------------- It was discovered that unplugging one of the monitors in a multi-monitorsetup can cause xscreensaver to crash. Someone with physical access toa machine could use this problem to bypass a locked session. --------------------------------------------- https://www.debian.org/security/2016/dsa-3438 *** Unverschlüsselte CMS-Updates: Drupal gelobt Besserung *** --------------------------------------------- Das Update-Verfahren des beliebten Content Management Systems Drupal liefert Aktualisierungen unverschlüsselt aus. Ein Problem, das seit Jahren bekannt ist und von Angreifern missbraucht werden kann, um Seiten zu kapern. --------------------------------------------- http://heise.de/-3068105 *** About CVE-2015-8518: SAP Adaptive Server Enterprise Extended Stored Procedure Unauthorized Invocation *** --------------------------------------------- SAP released an update for SAP ASE 16.0 and 15.7 that addresses a serious security flaw discovered by Martin Rakhmanov, lead security researcher at Trustwave, that has been around for a long time. Suppose there is a user joe in... --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/About-CVE-2015-8518--SAP-Ada… *** How Nvidia breaks Chrome Incognito *** --------------------------------------------- When I launched Diablo III, I didn't expect the pornography I had been looking at hours previously to be splashed on the screen. But that's exactly what replaced the black loading screen. Like a scene from hollywood, the game temporarily froze as it launched, preventing any attempt to clear the screen. The game unfroze just before clearing the screen, and I was able to grab a screenshot (censored with bright red): --------------------------------------------- https://charliehorse55.wordpress.com/2016/01/09/how-nvidia-breaks-chrome-in…

1 0

Tageszusammenfassung - Freitag 8-01-2016
by Daily end-of-shift report 08 Jan '16

08 Jan '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 07-01-2016 18:00 − Freitag 08-01-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Upcoming Security Updates for Adobe Acrobat and Reader (APSB16-02) *** --------------------------------------------- A prenotification Security Advisory (APSB16-02) has been posted regarding upcoming updates for Adobe Acrobat and Reader scheduled for Tuesday, January 12, 2016. We will continue to provide updates on the upcoming release via the Security Advisory as well as the... --------------------------------------------- https://blogs.adobe.com/psirt/?p=1308 *** Android-powered smart TVs targeted by malicious apps *** --------------------------------------------- Smart TVs running older versions of Android are being targeted by several websites offering apps containing malware, according to Trend Micro.The security vendor wrote on Thursday that it found a handful of app websites targeting people in the U.S. and Canada by offering the malicious apps.The apps are exploiting a flaw in Android that dates to 2014, showing that many smart TVs do not have the latest patches."Most smart TVs today use older versions of Android, which still contain this... --------------------------------------------- http://www.cio.com/article/3020357/android-powered-smart-tvs-targeted-by-ma… *** Good news, OAuth is almost secure *** --------------------------------------------- Boffins turn up a couple of protocol vulns in Facebooks login stanard German boffins believe there are protocol flaws in Facebooks ubiquitous OAuth protocol that render it vulnerable to attack. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/01/08/good_news_o… *** Anschlussmissbrauch durch schwerwiegende Lücke bei o2 *** --------------------------------------------- Seit über einem Jahr versucht o2 eine Schwachstelle im DSL-Netz zu schließen, durch die man fremde VoIP-Anschlüsse kapern kann. Bisher ist das nur zum Teil gelungen. --------------------------------------------- http://heise.de/-3066225 *** Checkpoint chaps hack whacks air-gaps flat *** --------------------------------------------- Bought a shiny IP KVM? Uh-oh 32c3 Checkpoint malware men Yaniv Balmas and Lior Oppenheim have developed an air gap-hopping malware system that can quietly infect, plunder, and maintain persistence on networked and physically separated computers. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/01/08/checkpoint_… *** Streaming-Dongle EZCast öffnet Hintertür ins Heimnetzwerk *** --------------------------------------------- Sicherheitsforscher haben Schwachstellen im HDMI-Dongle EZCast entdeckt. Über die können sich Angreifer Zugang zum Heimnetzwerk des Anwenders verschaffen - unabhängig davon, wie gut das Netz sonst geschützt ist. --------------------------------------------- http://heise.de/-3066210 *** Sicherheitspatches: VMware unterbindet Rechteausweitung *** --------------------------------------------- VMware dichtet seine Anwendungen ESXi, Fusion, Player und Workstation ab. Die abgesicherten Versionen stehen für Linux, OS X und Windows bereit. Von der Lücke scheint aber nur Windows bedroht zu sein. --------------------------------------------- http://www.heise.de/newsticker/meldung/Sicherheitspatches-VMware-unterbinde… *** Blocking Shodan isnt some sort of magical fix that will protect your data *** --------------------------------------------- Earlier this week, a threat alert from Check Point singled out Shodan as a risk to enterprise operations. The advisory warns Check Point customers about the service, highlighting some of the instances where sensitive data was exposed to the public because Shodan indexed it. When asked about the advisory [archive], Ron Davidson, Head of Threat Intelligence and Research at Check Point, said the company was seeing an increase in the variety and frequency of suspect scans, "including scanners... --------------------------------------------- http://www.csoonline.com/article/3020108/techology-business/blocking-shodan… *** Apple beseitigt gravierende QuickTime-Sicherheitslücken für Windows *** --------------------------------------------- Angreifer können mit Hilfe einer manipulierten Videodatei Schadcode einschleusen, erklärt Apple. Das Update beseitigt die Schwachstellen in Windows 7 und Vista. --------------------------------------------- http://heise.de/-3067145 *** Cracking Damn Insecure and Vulnerable App (DIVA) - Part 2: *** --------------------------------------------- In the previous article, we have seen the solutions for the first two challenges. In this article we will discuss the insecure data storage vulnerabilities in DIVA. --------------------------------------------- http://resources.infosecinstitute.com/cracking-damn-insecure-and-vulnerable… *** rt-sa-2015-005 *** --------------------------------------------- o2/Telefonica Germany: ACS Discloses VoIP/SIP Credentials --------------------------------------------- https://www.redteam-pentesting.de/advisories/rt-sa-2015-005.txt *** VMSA-2016-0001 *** --------------------------------------------- VMware ESXi, Fusion, Player, and Workstation updates address important guest privilege escalation vulnerability --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2016-0001.html *** PHP Bugs May Let Remote Users Obtain Potentially Sensitive Information, Gain Elevated Privileges, or Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1034608 *** APPLE-SA-2016-01-07-1 QuickTime 7.7.9 *** --------------------------------------------- APPLE-SA-2016-01-07-1 QuickTime 7.7.9[Re-sending with a valid signature]QuickTime 7.7.9 is now available and addresses the following:QuickTimeAvailable for: Windows 7 and Windows VistaImpact: Viewing a maliciously crafted movie file may lead to an [...] --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2016/Jan/msg00001.ht… *** DFN-CERT-2016-0001: Mozilla Firefox, Network Security Services, OpenSSL, GnuTLS: Eine Schwachstelle ermöglicht das Umgehen von Sicherheitsvorkehrungen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-0001/ *** USN-2865-1: GnuTLS vulnerability *** --------------------------------------------- Ubuntu Security Notice USN-2865-18th January, 2016gnutls26, gnutls28 vulnerabilityA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryGnuTLS could be made to expose sensitive information over the network.Software description gnutls26 - GNU TLS library gnutls28 - GNU TLS library DetailsKarthikeyan Bhargavan and Gaetan Leurent discovered that GnuTLS incorrectlyallowed MD5 to be used for TLS 1.2 connections. If a remote... --------------------------------------------- http://www.ubuntu.com/usn/usn-2865-1/ *** Bugtraq: [security bulletin] HPSBUX03435 SSRT102977 rev.1 - HP-UX Web Server Suite running Apache, Remote Denial of Service (DoS) *** --------------------------------------------- http://www.securityfocus.com/archive/1/537254 *** Security Advisory: Privilege escalation vulnerability CVE-2015-7393 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/75/sol75136237.html?… *** Security Advisory: BIG-IP AOM password sync vulnerability CVE-2015-8611 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/05/sol05272632.html?… *** Security Advisory: F5 Path MTU Discovery vulnerability CVE-2015-7759 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/22/sol22843911.html?…

1 0

Tageszusammenfassung - Donnerstag 7-01-2016
by Daily end-of-shift report 07 Jan '16

07 Jan '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 05-01-2016 18:00 − Donnerstag 07-01-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Ab Dienstag: Aus für Internet Explorer 8, 9 und 10 *** --------------------------------------------- Microsoft stellt ab dem 12. Jänner den Support für die veralteten Internet-Explorer-Versionen 8,9 und 10 ein. Diese erhalten künftig keine Updates mehr. --------------------------------------------- http://futurezone.at/produkte/ab-dienstag-aus-fuer-internet-explorer-8-9-un… https://www.microsoft.com/en-us/WindowsForBusiness/End-of-IE-support *** Site Updates: ISC/DShield API and ipinfo_ascii.html Page, (Wed, Jan 6th) *** --------------------------------------------- We are planning a couple of updates to the ways data can be retrieved automatically from this site. The main reason for this is to make it easier for us to maintain and support some of these features. The main idea will be that we focus automatic data retrieval to our API (isc.sans.edu/api or dshield.org/api). It should be the only place that is used to have scripts retrieve data. In the past, we had a couple of other pages that supported automatic data retrieval. For example, ipinfo_ascii.html... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20577&rss *** How long is your password? HTTPS Bicycle attack reveals that and more *** --------------------------------------------- Get your 2FA on, slackers A new attack on supposedly secure communication streams raises questions over the resilience of passwords, security researchers warn. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/01/06/https_bicyc… *** Mozilla warns Firefox fans its SHA-1 ban could bork their security *** --------------------------------------------- Protection mechanism screws other protection mechanisms. What a tangled web we weave Mozilla has warned Firefox users they may be cut off from more of the web than expected - now that the browser rejects new HTTPS certificates that use the weak SHA-1 algorithm. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/01/07/mozilla_war… https://blog.mozilla.org/security/2016/01/06/man-in-the-middle-interfering-… *** MD5/SHA1: Sloth-Angriffe nutzen alte Hash-Algorithmen aus *** --------------------------------------------- Neue Angriffe gegen TLS: Krypto-Forscher präsentieren mit Sloth mehrere Schwächen in TLS-Implementierungen und im Protokoll selbst. Am kritischsten ist ein Angriff auf Client-Authentifizierungen mit RSA und MD5. --------------------------------------------- http://www.golem.de/news/md5-sha1-sloth-angriffe-nutzen-alte-hash-algorithm… *** Encrypted Blackphone Patches Serious Modem Flaw *** --------------------------------------------- msm1267 writes: Silent Circle, makers of the security and privacy focused Blackphone, have patched a vulnerability that could allow a malicious mobile application or remote attacker to access the devices modem and perform any number of actions. Researchers at SentinelOne discovered an open socket on the Blackphone that an attacker could abuse to intercept calls, set call forwarding, read SMS messages, mute the phone and more. Blackphone is marketed toward privacy-conscious users; it includes... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/ocmLGjQf8XY/encrypted-black… *** OS-X-Security-and-Privacy-Guide *** --------------------------------------------- This is a collection of thoughts on securing a modern Apple Mac computer using OS X 10.11 "El Capitan", as well as steps to improving online privacy. This guide is targeted to "power users" who wish to adopt enterprise-standard security, but is also suitable for novice users with an interest in improving their privacy and security on a Mac. --------------------------------------------- https://github.com/drduh/OS-X-Security-and-Privacy-Guide *** Drupal - Insecure Update Process *** --------------------------------------------- Just a few days after installing Drupal v7.39, I noticed there was a security update available: Drupal v7.41. This new version fixes an open redirect in the Drupal core. In spite of my Drupal update process checking for updates, according to my local instance, everything was up to date: Issue #1: Whenever the Drupal update process fails, Drupal states that everything is up to date instead of giving a warning. --------------------------------------------- http://blog.ioactive.com/2016/01/drupal-insecure-update-process.html *** Jetzt Update installieren: WordPress behebt XSS-Lücke *** --------------------------------------------- Über eine Cross-Site-Scripting-Schwachstelle können Angreifer WordPress-Installationen kompromittieren. Betroffen sind alle Versionen bis einschließlich WordPress 4.4. --------------------------------------------- http://heise.de/-3065193 https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance… *** AVM-Router: Fritzbox-Lücke erlaubt Telefonate auf fremde Kosten *** --------------------------------------------- Durch eine kritische Lücke in den Fritzboxen können Angreifer etwa Telefonate auf fremde Rechnung führen und Code als Root ausführen. Die Lücke hat AVM bereits geschlossen, die Details wurden jedoch bis heute unter Verschluss gehalten. --------------------------------------------- http://heise.de/-3065588 *** A new, open source tool proves: Even after patching, deserializing will still kill you *** --------------------------------------------- Whats the problem here? ... When deserializing most objects, the code calls ObjectInputStream#resolveClass() as part of the process. This method is where all the patches and hardening against recent exploits take place. Because that method is never involved in deserializing Strings, anyone can use this to attack an application thats "fully patched" against the recent spate of attacks. --------------------------------------------- https://www.contrastsecurity.com/security-influencers/java-deserializing-op… *** rt-sa-2015-001 *** --------------------------------------------- AVM FRITZ!Box: Remote Code Execution via Buffer Overflow --------------------------------------------- https://www.redteam-pentesting.de/advisories/rt-sa-2015-001.txt *** rt-sa-2014-014 *** --------------------------------------------- AVM FRITZ!Box: Arbitrary Code Execution Through Manipulated Firmware Images --------------------------------------------- https://www.redteam-pentesting.de/advisories/rt-sa-2014-014.txt *** Bugtraq: [SYSS-2015-062] ownCloud Information Exposure Through Directory Listing (CVE-2016-1499) *** --------------------------------------------- [SYSS-2015-062] ownCloud Information Exposure Through Directory Listing (CVE-2016-1499) --------------------------------------------- http://www.securityfocus.com/archive/1/537244 *** DFN-CERT-2016-0023: Node.js-WS: Eine Schwachstelle ermöglicht das Ausspähen von Informationen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-0023/ *** DFN-CERT-2016-0028: Shotwell: Eine Schwachstelle ermöglicht das Umgehen von Sicherheitsvorkehrungen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-0028/ *** DFN-CERT-2016-0004: Mozilla Thunderbird, Debian Icedove: Mehrere Schwachstellen ermöglichen u.a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- Version 3 (2016-01-05 17:52) | Debian stellt für die Distributionen Wheezy (old stable), Jessie (stable) und Stretch (testing) Sicherheitsupdates auf die Icedove Version 38.5.0 bereit. Die Schwachstellen CVE-2015-7210 und CVE-2015-7222 werden von diesen nicht adressiert. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-0004/ *** Security Advisory: QEMU vulnerability CVE-2012-3515 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/13/sol13405416.html?… *** Security Advisory: Out-of-bounds memory vulnerability with the BIG-IP APM system CVE-2015-8098 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/43/sol43552605.html?… *** DSA-3435 git - security update *** --------------------------------------------- Blake Burkhart discovered that the Git git-remote-ext helper incorrectlyhandled recursive clones of git repositories. A remote attacker couldpossibly use this issue to execute arbitary code by injecting commandsvia crafted URLs. --------------------------------------------- https://www.debian.org/security/2016/dsa-3435 *** Advantech EKI Vulnerabilities (Update B) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-15-344-01A Advantech EKI Vulnerabilities that was published December 15, 2015, on the NCCIC/ICS-CERT web site. This advisory provides information regarding several vulnerabilities in Advantech's EKI devices. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-344-01 *** D-Link DCS-931L Arbitrary File Upload *** --------------------------------------------- Topic: D-Link DCS-931L Arbitrary File Upload Risk: High Text:## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-f... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016010028

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily