Daily

daily@lists.cert.at

1 participants
3085 discussions

Tageszusammenfassung - Freitag 22-05-2015
by Daily end-of-shift report 22 May '15

22 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 21-05-2015 18:00 − Freitag 22-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Fake jQuery Scripts in Nulled WordPress Plugins *** --------------------------------------------- We recently investigated some random redirects on a WordPress website that would only happen to certain visitors. Traffic analysis showed us that it was not a server-side redirect, rather it happened due to some script loaded by the web pages. A quick look through the HTML code revealed this script: It was very suspicious for... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/NmLDakrD_1U/fake-jquery-scrip… *** Researchers publish developer guidance for medical device security *** --------------------------------------------- The guidance is organized into 10 categories, and serves as "starting point for a more complete code," report authors said. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/jvWoZydXqwc/ *** Researchers observe SVG files being used to distribute ransomware *** --------------------------------------------- When downloaded and executed, the SVG files cause websites to open up that download what appears to be CryptoWall ransomware. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/Aa-yVI5Bd-A/ *** Exploring CVE-2015-1701 - A Win32k Elevation of Privilege Vulnerability Used in Targeted Attacks *** --------------------------------------------- Our analysis of the win32k.sys vulnerability used in a recent targeted attack reveals that it opens up an easy way to bypass the sandbox, making it a bigger threat than originally thought. As mentioned in Microsoft security bulletin MS15-051, CVE-2015-1701 is an elevation of privilege vulnerability that exists when the Win32k.sys kernel-mode driver improperly handles... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/RuzGqW0kQdY/ *** Digital Agenda Seminar: European Cyber Security Month *** --------------------------------------------- Within the context of European Cyber Security Month (ECSM) preparations, the ENISA team is organising several seminars and trainings in order to build up the coalition for Cybersecurity Education action. You are invited to participate in the second seminar in Berlin, Germany on June 5th, 2015. In this half-day seminar we discuss and provide the latest information on Digital Agenda topics such as e-skills, Network Information Security, educational tools and advocacy initiatives. To participate it is necessary to confirm participation to daria.catalui(a)enisa.europa.eu by June 4th, 2015. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/digital-agenda-seminar-european… *** Daten von Millionen zurückgesetzten Android-Smartphones wiederherstellbar *** --------------------------------------------- Wer sein Android-Smartphone verkauft hat, muss befürchten, dass trotz gelöschten Gerätespeichers noch private Daten wie etwa Nachrichten und Log-in-Daten im Speicher schlummern, die unter Umständen wiedergehergestellt werden können. --------------------------------------------- http://heise.de/-2663267 *** Forensic Analysis of Smartphone Factory Reset Function *** --------------------------------------------- ADISA, the organisation that sets security standards around the secure disposal of IT Assets, has released new research into the forensic analysis of smartphone factory reset functions. Written by Steve Mellings, Founder of ADISA, and Professor Andrew Blyth of the University of South Wales, the white paper explores how effective smartphone factory reset functions actually are at removing data. This data is then used to offer businesses and individual users advice on how best to protect their... --------------------------------------------- http://www.informationsecuritybuzz.com/forensic-analysis-of-smartphone-fact… *** When Security Makes Users Asleep! *** --------------------------------------------- It's a fact, in industries or on building sites, professional people make mistakes or, worse, get injured. Why? Because their attention is reduced at a certain point. When you're doing the same job all day long, you get tired and lack of concentration. The same can apply in information security! For a long time, more and more solutions are deployed in companies to protect their data and users. Just... --------------------------------------------- http://blog.rootshell.be/2015/05/22/when-security-makes-users-asleep/ *** Citrix Security Advisory for DHE_EXPORT TLS Vulnerability CVE-2015-4000 *** --------------------------------------------- A TLS protocol vulnerability has been recently disclosed that could result in attackers being able to intercept and modify SSL/TLS encrypted traffic ... --------------------------------------------- http://support.citrix.com/article/CTX201114 *** Citrix Security Advisory for CVE-2015-3456 *** --------------------------------------------- Citrix is aware of the recent vulnerability that has been reported against the Xen hypervisor. This issue is known as the ... --------------------------------------------- http://support.citrix.com/article/CTX201078 *** python-kerberos checkPassword() spoofing *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/103310 *** Cisco Access Control Server Representational State Transfer Application Programming Interface Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38946 *** ICU Buffer Overflows in resolveImplicitLevels() Let Remote Users Deny Service and Potentially Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032366 *** Schneider Electric OFS Server Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a DLL hijacking vulnerability in the Schneider Electric OPC Factory Server (OFS) server application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01 *** Emerson AMS Device Manager SQL Injection Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on April 21, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for an SQL injection vulnerability in the Emerson AMS Device Manager application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-111-01 *** OleumTech WIO Family Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-202-01 OleumTech WIO Family Vulnerabilities that was published July 21, 2014. This advisory provides vulnerability details in the OleumTech WIO family including the sensors and the DH2 data collector. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-202-01A *** HPSBMU03336 rev.1- HP Helion OpenStack affected by VENOM, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- A potential security vulnerability has identitfied with HP Helion OpenStack. The vulnerability could be exploited resulting in Denial of Service (DoS) or execution of arbitrary code. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?calledBy=&docId=emr_na-c… *Next End-of-Shift report on 2015-05-26*

1 0

Tageszusammenfassung - Donnerstag 21-05-2015
by Daily end-of-shift report 21 May '15

21 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 20-05-2015 18:00 − Donnerstag 21-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** RIG Exploit Kit Infection Cycle Analysis *** --------------------------------------------- Overview Happy belated birthday to RIG exploit kit! First seen around April 2014, RIG has been in the news several times over the past year. In February, the source code was reportedly leaked online, which likely spurred some of the recent changes weve observed in the kit. ThreatLabZ has been keeping an eye on RIG and in this post well cover an example of a full RIG infection cycle. Delivery... --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/JM9Mp15Wupg/rig-exploit-… *** New Router Attack Displays Fake Warning Messages *** --------------------------------------------- Just because security researchers report about threats doesn't mean we're exempted from them. I recently experienced an incident at home that involved tampered DNS router settings. I was redirected to warning pages that strongly resemble those used in previous FAKEAV attacks. I noticed that my home internet router DNS settings have been modified from its default settings. (My router... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/dJj2wXBlvgk/ *** Exploit kits delivering Necurs, (Thu, May 21st) *** --------------------------------------------- Introduction In the past few days, weve seenNuclear and Anglerexploit kits (EKs) deliveringmalware identified as Necurs. It certainly isntthe only payload sentfrom Nuclear and otherEKs, but I hadnt really looked into EK traffic sending Necurs lately. Documented as early as 2012, Necurs is a type of malware that opens a back door on the infected computer [1]. It may also disable antivirus products as well as download additional malware [1][2]. I sawNecurs as a malware payload from Nuclear and... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19719&rss *** Das Erste-Hilfe-Kit gegen Krypto-Trojaner *** --------------------------------------------- Mit einer Reihe von Werkzeugen will ein Forscher den Opfern von Erpressungs-Trojanern helfen, ihre Daten zu retten und ihre Systeme zu reinigen. Allerdings ist bei der Anwendung Vorsicht geboten. --------------------------------------------- http://heise.de/-2661154 *** Mumblehard Malware *** --------------------------------------------- Introduction In this article, we will learn about a malware known as Mumblehard which is known for targeting Linux and BSD OS. This malware opens a backdoor that gives the full control of the infected machine to cybercriminals. Mumblehard malware -Components Perl Backdoor Perl backdoor will request for commands from its Command &Control Server and... --------------------------------------------- http://resources.infosecinstitute.com/mumblehard-malware/ *** Logjam: the latest TLS vulnerability explained *** --------------------------------------------- 21 May 2015 by Filippo Valsorda --------------------------------------------- https://blog.cloudflare.com/logjam-the-latest-tls-vulnerability-explained/ *** The Logjam (and Another) Vulnerability against Diffie-Hellman Key Exchange *** --------------------------------------------- Logjam is a new attack against the Diffie-Hellman key-exchange protocol used in TLS. Basically: The Logjam attack allows a man-in-the-middle attacker to downgrade vulnerable TLS connections to 512-bit export-grade cryptography. This allows the attacker to read and modify any data passed over the connection. The attack is reminiscent of the FREAK attack, but is due to a flaw in the... --------------------------------------------- https://www.schneier.com/blog/archives/2015/05/the_logjam_and_.html *** CVE-2015-4000 alias "Logjam" .. *** --------------------------------------------- http://www.cert.at/services/blog/20150521111403-1485.html *** Vuln: OpenSSL CVE-2015-0288 Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/73237 *** Vuln: OpenSSL /evp/encode.c Remote Memory Corruption Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/73228 *** Samba Memory Corruption Error in prs_append_some_prs_data() Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032362 *** Cisco Security Manager Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=34325 *** Cisco Adaptive Security Appliance Protocol Independent Multicast Registration Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38937 *** Cisco Prime Central for HCS Multiple Cross-Site Request Forgery Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38927 *** DSA-3265 zendframework - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in Zend Framework, a PHPframework. Except for CVE-2015-3154, all these issues were already fixedin the version initially shipped with Jessie. --------------------------------------------- https://www.debian.org/security/2015/dsa-3265

1 0

Tageszusammenfassung - Mittwoch 20-05-2015
by Daily end-of-shift report 20 May '15

20 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 19-05-2015 18:00 − Mittwoch 20-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Logjam - vulnerabilities in Diffie-Hellman key exchange affect browsers and servers using TLS, (Wed, May 20th) *** --------------------------------------------- Theres a new vulnerability in town... As reported by the Wall Street Journal, The new bug, dubbed LogJam, is a cousin of Freak. But its in the basic design of TLS itself, meaning all Web browsers, and some email servers, are vulnerable. [1] According to the article, Internet-security experts crafted a fix for a previously undisclosed bug in security tools used by all modern Web browsers. But deploying the fix could break the Internet for thousands of websites. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19717&rss *** Logjam: PFS Deployment Guide *** --------------------------------------------- Guide to Deploying Diffie-Hellman for TLS | Our study finds that the current real-world deployment of Diffie-Hellman is less secure than previously believed. This page explains how to properly deploy Diffie-Hellman on your server. | We have three recommendations for correctly deploying Diffie-Hellman for TLS:... --------------------------------------------- https://weakdh.org/sysadmin.html *** DDoS Attacks on the rise in Q1 2015, says Akamai *** --------------------------------------------- DDoS attacks even more dangerous according to the last report published by Akamai Technologies, the "Q1 2015 State of the Internet - Security Report". According to Akamai Technologies, Q1 2015 showed that distributed denial-of-service attacks are on the rise again, and according to Akamai Technologies, Q1 set a record for the number of DDoS attacks,... --------------------------------------------- http://securityaffairs.co/wordpress/36983/security/akamai-ddos-q1-2015.html *** "Los Pollos Hermanos" ransomware - what will they think of next? *** --------------------------------------------- The latest visual meme in ransomware comes from a cult TV show...about ficticious crooks. Paul Ducklin walks you through "PolloCrypt," more correctly known as Troj/LPoLock-A... --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/jdSKvU31t58/ *** JSON, Homoiconicity, and Database Access *** --------------------------------------------- During a recent review of an internal web application based on the Node.js platform, we discovered that combining JavaScript Object Notation (JSON) and database access (database query generators or object-relational mappers, ORMs) creates interesting security challenges, particularly for JavaScript programming... --------------------------------------------- https://securityblog.redhat.com/2015/05/20/json-homoiconicity-and-database-… *** iOS Security Guide (iOS 8.3) *** --------------------------------------------- https://www.apple.com/business/docs/iOS_Security_Guide.pdf *** What We Learned From a Data Exfiltration Incident at an Electric Utility *** --------------------------------------------- We often hear about the dangers of a cyberattacks taking down the grid, but seldom is public information available about the loss of sensitive information, particularly from the OT. The confidential information in this case was the utilitys smart grid and metering R&D knowledge base, which is intellectual property and information that attackers can use to compromise the smart grid. --------------------------------------------- http://www.elp.com/articles/powergrid_international/print/volume-20/issue-5… *** 5 Signs Credentials In Your Network Are Being Compromised *** --------------------------------------------- Where should you start to keep ahead of attackers using insiders to steal corporate secrets or personal identifiable information? Check out these common scenarios. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/5-signs-credentials-in… *** Update soll Mac-Outlook 2011 reanimieren *** --------------------------------------------- Mit Version 14.5.1 der Office-Version 2011 für OS X will Microsoft ein Problem bei Outlook beseitigen - der E-Mail-Client ließ sich nach Installation des vorausgehehenden Updates unter Umständen nicht mehr verwenden. --------------------------------------------- http://www.heise.de/newsticker/meldung/Update-soll-Mac-Outlook-2011-reanimi… *** MS15-046 - Version: 2.0 *** --------------------------------------------- V2.0 (May 19, 2015): Bulletin revised to announce the release of the Microsoft Office for Mac 14.5.1 update. The release addresses a potential issue with Microsoft Outlook for Mac when customers install the Microsoft Office for Mac 14.5.0 update. Customers who have not already installed the 14.5.0 update should install the 14.5.1 update to be fully protected from this vulnerability. To avoid the possibility of future issues with Microsoft Outlook for Mac, Microsoft recommends that customers... --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-046 *** HPSBGN03286 rev.1 - HP LoadRunner, Buffer Overflow *** --------------------------------------------- A potential security vulnerability has been identified with HP LoadRunner. The vulnerability could be exploited remotely to allow a buffer overflow. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04594015 *** HPSBUX03334 SSRT102000 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilities. --------------------------------------------- https://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04679334 *** HPSBUX03333 SSRT102029 rev.1 - HP-UX Running NTP, Remote Denial of Service (DoS), or Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running NTP. These could be exploited remotely to create a Denial of Service (DoS), or other vulnerabilities. --------------------------------------------- https://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04679309 *** Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability *** --------------------------------------------- 38913 --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38913 *** ZDI-15-235: ManageEngine Applications Manager CommonAPIUtil getMGList groupId SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/x_So65VKXQk/ *** ZDI-15-234: ManageEngine Applications Manager CommonAPIUtil SyncMonitors haid SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/NDUhf-djzIs/ *** ZDI-15-233: Valve Steam Client Detection Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute a denial of service attack on vulnerable installations of Valve Steam. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/z6v9MWWd9O4/ *** Hikvision DS-7108HWI-SH XML Injection, AoF and BF vulnerabilities *** --------------------------------------------- Topic: Hikvision DS-7108HWI-SH XML Injection, AoF and BF vulnerabilities Risk: High Text:Hello list! There are vulnerabilities in Hikvision DS-7108HWI-SH. These are XML Injection, Abuse of Functionality and Bru... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050127 *** IPsec-Tools 0-day Denial of Service *** --------------------------------------------- Topic: IPsec-Tools 0-day Denial of Service Risk: High Text:Denial of Service in IPsec-Tools Vulnerability Report May 19, 2015 Product: IPsec-Tools Version: 0.8.2 Website: http:/... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050128 *** Security Advisory - Two Privilege Escalation Vulnerabilities in Huawei Mate 7 Smartphones *** --------------------------------------------- May 20, 2015 14:40 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [HTB23257]: Stored XSS in WP Photo Album Plus WordPress Plugin *** --------------------------------------------- Product: WP Photo Album Plus WordPress Plugin v6.1.2Vulnerability Type: Cross-Site Scripting [CWE-79]Risk level: Medium Creater: J.N. BreetveltAdvisory Publication: April 29, 2015 [without technical details]Public Disclosure: May 20, 2015 CVE Reference: CVE-2015-3647 CVSSv2 Base Score: 5 (AV:N/AC:L/Au:N/C:N/I:P/A:N) Vulnerability Details: High-Tech Bridge Security Research Lab discovered stored XSS vulnerability in WP Photo Album Plus WordPress plugin, which can be exploited to perform... --------------------------------------------- https://www.htbridge.com/advisory/HTB23257 *** Bugtraq: Eisbär SCADA (All Versions - iOS, Android & W8) - Persistent UI Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535576

1 0

Tageszusammenfassung - Dienstag 19-05-2015
by Daily end-of-shift report 19 May '15

19 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-05-2015 18:00 − Dienstag 19-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Tracking SSL Issues with the SSL Labs API *** --------------------------------------------- The SSL and TLS protocols have been on the front of the stage for months. Besides many vulnerabilities disclosed in the OpenSSL library, the deployment of SSL and TLS is not always easy. They are weak cyphers (like RC4), weak signatures, certificates issues (self-signed, expiration or fake ones). Other useful features are mis-understood and not often not configured like PFS ("Perfect Forward Secrecy"). Encryption effectiveness is directly related... --------------------------------------------- http://blog.rootshell.be/2015/05/18/tracking-ssl-issues-with-the-ssl-labs-a… *** Magnitude Exploit Kit leading to Ransomware via Malvertising *** --------------------------------------------- Magnitude Exploit Kit is a malicious exploit package that leverages a victim's vulnerable browser plugins in order to download a malicious payload to a system. This technique is known as a drive-by-download attack, which is often leveraged on compromised websites and malicious advertising networks. We recently found a number of compromised pages following the structure of fake search engine... --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/YQBX1Zq733A/magnitude-ex… *** Website Security - How Do Websites Get Hacked? *** --------------------------------------------- In 2014 the total number of websites on the internet reached 1 billion, today it's hovering somewhere in the neighborhood of 944 million due to websites going inactive and it is expected to normalize again at 1 billion sometime in 2015. Let's take a minute to absorb that number for a moment. Another surprising statistic is... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/w0FMyW_q_bA/website-security-… *** Cyber Security Challenge 2015 *** --------------------------------------------- Cyber Security Challenge 2015 | 19. Mai 2015 | Auch heuer gibt es wieder die Cyber Security Challenge zur Suche von Hacker-Nachwuchstalenten. 2015 wird das europäische Finale zwischen 6 Ländern ausgespielt, und Österreich muss den Titel verteidigen.Die Qualifizierungsrunde läuft heuer von 4. Mai bis 3. August und steht Schülern und Studenten offen. Details siehe www.verbotengut.at.Wir wollen wieder ein gutes Team zusammenbekommen, wir bitten daher alle Leser, diesen Hinweis... --------------------------------------------- http://www.cert.at/services/blog/20150519084602-1482.html *** Cmstar Downloader: Lurid and Enfal's New Cousin *** --------------------------------------------- In recent weeks, Unit 42 has been analyzing delivery documents used in spear-phishing attacks that drop a custom downloader used in cyber espionage attacks. This specific downloader, Cmstar, is associated with the Lurid downloader also known as "Enfal". Cmstar was named for the log message "CM**" used by the downloader. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/05/cmstar-downloader-lurid-… *** SSH-Client Putty: Trojaner-Version im Umlauf *** --------------------------------------------- Wer mit dem SSH-Client Putty auf Geräte zugreifen will, sollte auf die Quelle des Clients achten. Aktuell geistert nämlich eine Version durch das Internet, die einen Trojaner auf Computer schmuggelt, um Daten abzugreifen. --------------------------------------------- http://heise.de/-2654274 *** More on Chris Roberts and Avionics Security *** --------------------------------------------- Last month ago I blogged about security researcher Chris Roberts being detained by the FBI after tweeting about avionics security while on a United flight: But to me, the fascinating part of this story is that a computer was monitoring the Twitter feed and understood the obscure references, alerted a person who figured out who wrote them, researched what flight... --------------------------------------------- https://www.schneier.com/blog/archives/2015/05/more_on_chris_r.html *** How much money do cyber crooks collect via crypto ransomware? *** --------------------------------------------- FireEye researchers have calculated that the cybercriminals wielding TeslaCrypt and AlphaCrypt have managed to extort $76,522 from 163 victims in only two months. "This amount may seem trivial co... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/uK_6Ovw0K9M/malware_news.… *** Address spoofing Safari bug opens door for phishing attacks *** --------------------------------------------- Hacker David Leo has released a PoC exploit for a Safari vulnerability that can be misused to trick users into thinking they are on one site while they are actually on another - a boon for phishers. ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/6F6ptWfI8rw/secworld.php *** Address-Spoofing Bug Haunts Android Stock Browser *** --------------------------------------------- There's an easily exploitable vulnerability in the Android stock browser that enables an attacker to spoof the URL in the address bar and force a victim to visit a malicious site while believing he is visiting a benign one. Security researcher Rafay Baloch discovered the vulnerability and developed the technique for exploiting it. The problem... --------------------------------------------- http://threatpost.com/address-spoofing-bug-haunts-android-stock-browser/112… *** KCodes NetUSB: How a Small Taiwanese Software Company Can Impact the Security of Millions of Devices Worldwide *** --------------------------------------------- Today the SEC Consult Vulnerability Lab released an advisory regarding a vulnerability in a software component called NetUSB. This post intends to give some background information about this vulnerability.NetUSB is a proprietary technology developed by the Taiwanese company KCodes, intended to provide "USB over IP" functionality. USB devices (e.g. printers, external hard drives, flash drives) plugged into a Linux-based embedded system (e.g. a router, an access point or a dedicated... --------------------------------------------- http://blog.sec-consult.com/2015/05/kcodes-netusb-how-small-taiwanese.html *** [2015-05-19] Critical buffer overflow vulnerability in KCodes NetUSB *** --------------------------------------------- KCodes NetUSB is vulnerable to a buffer overflow via the network that results in a denial of service or code execution. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Cisco Sourcefire 3D System Lights-Out Management Arbitrary File Upload Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38905 *** IBM Security Bulletin: WebSphere Message Broker and IBM Integration Bus are affected by cross-site scripting (XSS) Vulnerabilities in Dojo Toolkit *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21902837 *** Moodle Multiple Flaws Let Remote Users Conduct Cross-Site Scripting Attacks, Obtain Potentially Sensitive Information, and Bypass Security Restrictions *** --------------------------------------------- http://www.securitytracker.com/id/1032358 *** Bugtraq: [SECURITY] [DSA 3175-2] kfreebsd-9 security update *** --------------------------------------------- http://www.securityfocus.com/archive/1/535562

1 0

Tageszusammenfassung - Montag 18-05-2015
by Daily end-of-shift report 18 May '15

18 May '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 15-05-2015 18:00 − Montag 18-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Cyberattacks on Oil and Gas Firms Launched with no Malware at all *** --------------------------------------------- Oil and gas industry targeted by hackers with a genuine looking windows file, not a malware. The attacks are ongoing for about two years. A unique targeted attack being underway for about two consecutive years exploits Windows file functions that look legitimate and a couple of homemade scripts - but not malware - in order... --------------------------------------------- http://securityaffairs.co/wordpress/36843/cyber-crime/cyberattacks-on-oil-a… *** Microsoft Stops Chinese Group from Using TechNet Site for Attacks (May 14, 2015) *** --------------------------------------------- Microsoft and FireEye have taken steps to prevent a group of Chinese cyber criminals known as APT17 from using the companys TechNet website in its attacks... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/38/302 *** VENOM - Does it live up to the hype?, (Sat, May 16th) *** --------------------------------------------- Unless you have been hiding under a rock this week you have heard about VENOM. The first article that I saw was fromZDNet with the headline of Bigger than Heartbleed, Venom security vulnerability threatens most datacenters. Pretty provocative stuff. Is VENOM really worth that much hype? VENOM stands for Virtualized Environment Neglected Operations Manipulation. The cuteacronym basically means that the exploit takes advantage of a vulnerability in legacy code.In short thevulnerability is... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19701&rss *** AEADs: getting better at symmetric cryptography *** --------------------------------------------- I gave a talk a couple of weeks ago at the Yahoo Unconference. The conference was at the end of a particually hard week for a bunch of reasons and I fear that the talk wasn't that great. (Afterwards I got home about 3pm and pretty much slept until the following morning.) This post is a, hopefully clearer, articulation of its contents. --------------------------------------------- http://www.imperialviolet.org/2015/05/16/aeads.html *** About the supposed factoring of a 4096 bit RSA key *** --------------------------------------------- tl;dr News about a broken 4096 bit RSA key are not true. It is just a faulty copy of a valid key. Earlier today a blog post claiming the factoring of a 4096 bit RSA key was published and quickly made it to the top of Hacker News. The key in question was the PGP key of a well-known Linux kernel developer. I already commented on Hacker News why this is most likely wrong, but I thought Id write up some more details. To understand what is going on I have to explain some background both on RSA and... --------------------------------------------- https://blog.hboeck.de/archives/872-No,-nobody-has-factored-a-4096-bit-RSA-… *** Google App Engine: Google reagiert träge auf Java-Sicherheitslücken *** --------------------------------------------- Klammheimlich patcht Google Java-Schwachstellen in seiner Entwicklungsumgebung App Engine und ignoriert den Entdecker der Lücken weitgehend. Einige Sicherheitslücken klaffen immer noch. --------------------------------------------- http://heise.de/-2652121 *** Angreifer nutzen kritische Lücke in ProFTPD aus *** --------------------------------------------- Wer den FTP-Server ProFTPD betreibt, muss handeln: Durch eine schwerwiegende Schwachstelle können Online-Ganoven beliebigen Code ausführen. Und das tun sie auch bereits. --------------------------------------------- http://heise.de/-2652114 *** Screech! Grand Theft Auto V malware mods warning *** --------------------------------------------- Gamers find themselves in latest Mods & Rockstar punch-up Cybercrooks are cooking up malware disguised as mods for the Grand Theft Auto V video game. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/18/gta_malware… *** Rombertiks disk wiping mechanism is aimed at pirates, not researchers *** --------------------------------------------- Rombertik, the information-stealing malware that was recently analyzed by Cisco researchers and which apparently tries to prevent researchers from doing so by rewriting the computers Master Boot Reco... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/oE0fh7NZ4sg/malware_news.… *** Oracle Patches VENOM Vulnerability *** --------------------------------------------- Oracle on Saturday released its patch for the VENOM vulnerability, a guest escape flaw that affects many virtualization platforms. --------------------------------------------- http://threatpost.com/oracle-patches-venom-vulnerability/112868 *** openssh 6.8p1 heap buffer overflow *** --------------------------------------------- Topic: openssh 6.8p1 heap buffer overflow Risk: High Text:Quick background story: I started a while ago to develop a solution to use american fuzzy lop with networking input. I did so b... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050105 *** Bugtraq: [SE-2014-02] Unconfirmed / unpatched vulnerabilities in Google App Engine *** --------------------------------------------- http://www.securityfocus.com/archive/1/535548 *** ZDI-15-230: ManageEngine Applications Manager IT360UtilitiesServlet query SQL Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/qN5KZVA4xgA/ *** ZDI-15-229: ManageEngine Applications Manager DowntimeSchedulerServlet TASKID SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/PLAGhXOxQh0/ *** ZDI-15-231: Dell Sonicwall GMS Virtual Appliance Multiple Remote Code Execution Vulnerabilities *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Dell SonicWALL Global Management System (GMS) virtual appliance. Authentication is required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/HtMlLoJoKXI/ *** Cisco Web Security Appliance Web Tracking Report Page Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38884 *** DSA-3261 libmodule-signature-perl - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in libmodule-signature-perl, aPerl module to manipulate CPAN SIGNATURE files. The CommonVulnerabilities and Exposures project identifies the following problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3261 *** SAP Sybase Unwired Platform Online Data Proxy Discloses Password and Username Information to Local Users *** --------------------------------------------- http://www.securitytracker.com/id/1032310 *** SAP Customer Relationship Management Bugs Let Users Execute Arbitrary Code and Remote Users Inject SQL Commands *** --------------------------------------------- http://www.securitytracker.com/id/1032309 *** SAP NetWeaver RFC SDK Discloses Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1032308

1 0

Tageszusammenfassung - Freitag 15-05-2015
by Daily end-of-shift report 15 May '15

15 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-05-2015 18:00 − Freitag 15-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38789 http://tools.cisco.com/security/center/viewAlert.x?alertId=38808 http://tools.cisco.com/security/center/viewAlert.x?alertId=38811 http://tools.cisco.com/security/center/viewAlert.x?alertId=38833 http://tools.cisco.com/security/center/viewAlert.x?alertId=38864 http://tools.cisco.com/security/center/viewAlert.x?alertId=38865 http://tools.cisco.com/security/center/viewAlert.x?alertId=38866 http://tools.cisco.com/security/center/viewAlert.x?alertId=38869 http://tools.cisco.com/security/center/viewAlert.x?alertId=38868 *** Multiple vulnerabilities in Loxone Smart Home (part 2) *** --------------------------------------------- The Loxone Smart Home vulnerabilities published in February 2015 (SA-20150227-0) have not been fixed entirely and can still be exploited. Furthermore, new security issues have been identified. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Openlitespeed <= 1.3.10 Multiple Vulnerabilities *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050096 *** Hospira LifeCare PCA Infusion System Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-125-01 Hospira LifeCare PCA Infusion System Vulnerabilities that was published May 5, 2015, on the NCCIC/ICS-CERT web site. This advisory provides compensating measures for an improper authorization vulnerability and an insufficient verification .. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01A *** Organizational Challenges in the Internet of Things *** --------------------------------------------- As a result of the increase in cyber-attacks launched by nation-states, cybercriminals, hacktivist groups and other entities, it has become increasingly important to understand the ecosystem of hardware, O/S, software, and services that are used in each organization's network, including .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/organizational-c… *** Mobile Spy Software Maker mSpy Hacked, Customer Data Leaked *** --------------------------------------------- mSpy, the makers of a dubious software-as-a-service product that claims to help more than two million people spy on the mobile devices of their kids and partners, appears to have been massively hacked. Last week, a huge trove of data apparently stolen from the companys servers was posted on the Dark Web, .. --------------------------------------------- http://krebsonsecurity.com/2015/05/mobile-spy-software-maker-mspy-hacked-cu… *** Vulnerabilities in PHPMyAdmin *** --------------------------------------------- http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php *** Kritik an fehlenden Sicherheitsfunktionen der Apple Watch *** --------------------------------------------- Die Apple Watch lässt sich ohne Kenntnis des Gerätecodes zurücksetzen – im Unterschied zu iPhone und iPad gibt es allerdings keine Aktivierungssperre, die die frische Inbetriebnahme durch einen Dieb verhindert. --------------------------------------------- http://heise.de/-2650499 *** Erpresser drohen zahlreichen deutschen Shops mit DDoS-Attacken *** --------------------------------------------- Eine Erpresserwelle verunsichert Betreiber von deutschen Online-Shops: Wer nicht zahlt, verliert womöglich Kunden. Was tun? --------------------------------------------- http://heise.de/-2650465 *** McAfees Reinigungs-Tool Stinger installiert heimlichen Wächter *** --------------------------------------------- Wer McAfees Scan-Tool "Stinger" benutzt, um seinen PC zu säubern, bekommt ungefragt einen Virenwächter im Betastadium untergeschoben. Einen Opt-Out gibt es nicht. --------------------------------------------- http://heise.de/-2645759 *** Hacking communities in the Deep Web *** --------------------------------------------- The role of hackers has changed over the years, in the past these professionals were viewed as dangerous criminals that needed to be kept at arm's length; meanwhile today they are highly sought from private companies, intelligence .. --------------------------------------------- http://resources.infosecinstitute.com/hacking-communities-in-the-deep-web/ *** SAP LZC LZH Compression Multiple Vulnerabilities *** --------------------------------------------- SAP products make use of a proprietary implementation of the Lempel-Ziv-Thomas (LZC) adaptive dictionary compression algorithm and the Lempel-Ziv-Huffman (LZH) compression algorithm [1] . These compression algorithms are used across several SAP products and programs. Vulnerabilities were found in the .. --------------------------------------------- http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vul… *** Latest Microsoft Security Intelligence Report Now Available *** --------------------------------------------- This volume of the SIR focuses on the second half of 2014 and contains longer term trend data as well. SIR volume 18 contains data, insights and practical guidance on a range of global and regional cybersecurity threats including vulnerability disclosures, malware and unwanted software including the latest on .. --------------------------------------------- http://blogs.microsoft.com/cybertrust/2015/05/14/latest-microsoft-security-… *** If Youre Typing the Word MCRYPT Into Your Code, Youre Doing It Wrong *** --------------------------------------------- Foreword: You probably should not be deploying your own cryptography to begin with, especially if you dont already understand that encryption is not authentication. For production systems, use PECL libsodium or defuse/php-encryption and save yourself the headache. The rest of this post is intended for PHP developers who still want to write their own cryptography code, or already have. --------------------------------------------- https://paragonie.com/blog/2015/05/if-you-re-typing-word-mcrypt-into-your-c… *** One year of DANE Tales and Lessons Learned *** --------------------------------------------- https://ripe70.ripe.net/presentations/183-dane-ripe.pdf *** Cylance SPEAR Team: A Threat Actor Resurfaces *** --------------------------------------------- Attackers typically shut down campaigns or halt activity after they are exposed by security researchers, thereby creating the impression they have dropped off the map. This often leads to a false sense of security within the community and perpetuates the idea that public exposure makes us all safer. While the .. --------------------------------------------- http://blog.cylance.com/spear-a-threat-actor-resurfaces

1 0

Tageszusammenfassung - Mittwoch 13-05-2015
by Daily end-of-shift report 13 May '15

13 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-05-2015 18:00 − Mittwoch 13-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Adobe Security Bulletins Posted *** --------------------------------------------- The following Security Bulletins have been posted today: APSB15-09: Security updates available for Adobe Flash Player APSB15-10: Security updates available for Adobe Reader and Acrobat Customers of the affected products should consult the relevant .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1197 *** How Social Media Blacklisting Happens *** --------------------------------------------- In today's world, we are all browsing websites online and sharing content on a multitude of social media platforms every day. Worldwide social media users exceeded 2 billion back in .. --------------------------------------------- https://blog.sucuri.net/2015/05/how-social-media-blacklisting-happens.html *** Cisco Headend Digital Broadband Delivery System Cross-Site Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web-based administration interface of the Cisco Headend Digital Broadband Delivery System could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38767 *** Another look at Niteris : post exploitation WMI and Fiddler checks *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/05/another-look-at-niteris-post.html *** Adobe, Microsoft Push Critical Security Fixes *** --------------------------------------------- Microsoft today issued 13 patch bundles to fix roughly four dozen security vulnerabilities in Windows and associated software. Separately, Adobe pushed updates to fix a slew of critical flaws in its Flash Player and Adobe Air software, .. --------------------------------------------- http://krebsonsecurity.com/2015/05/adobe-microsoft-push-critical-security-f… *** [2015-05-13] Multiple critical vulnerabilities in WSO2 Identity Server *** --------------------------------------------- An unauthenticated attacker is able to read arbitrary local files from the WSO2 Identity Server by using the SAMLv2 authentication interface. Moreover, targeted attacks against users or administrators of the Identity Server may be conducted using CSRF and XSS vulnerabilities. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Security: Wie Google Android sicher macht *** --------------------------------------------- HTTPS soll ausgemustert, Android sicherer werden, und es soll ein PGP-Plugin für Gmail geben: Google verstärkt seinen Einsatz im Bereich IT-Sicherheit enorm. Wir haben mit Googles IT-Sicherheitsexperten Stephan Somogyi darüber gesprochen. (Google, Gmail) --------------------------------------------- http://www.golem.de/news/security-wie-google-android-sicher-macht-1505-1140… *** Microsoft Security Bulletin Summary for May 2015 *** --------------------------------------------- This bulletin summary lists security bulletins released for May 2015. For information about how to receive automatic notifications whenever Microsoft security bulletins are issued, visit Microsoft Technical Security Notifications. Microsoft also .. --------------------------------------------- https://technet.microsoft.com/library/security/ms15-may *** VENOM, don't get bitten. *** --------------------------------------------- QEMU is a generic and open source machine emulator and virtualizer and is incorporated in some Red Hat products as a foundation and hardware emulation layer for running virtual machines under the Xen and KVM hypervisors. CVE-2015-3456 (aka VENOM) .. --------------------------------------------- https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/ *** Anatomy of an APT Attack: Step by Step Approach *** --------------------------------------------- This article will explore the technique, design and the inner workings of an APT (Advanced Persistent Threat) attack. It will also relate various stages of attack with a few attacks that were custom-created to penetrate enterprises for extraction of internal data, trade secrets, and sensitive business .. --------------------------------------------- http://resources.infosecinstitute.com/anatomy-of-an-apt-attack-step-by-step… *** Spam and Phishing in the First Quarter of 2015 *** --------------------------------------------- The share of spam in email traffic in the first quarter of 2015 was 59.2%; the percentage of spam gradually declined during the quarter. Spam traffic included a large number of mass mailings with Microsoft Word or Excel attachments containing macro viruses. --------------------------------------------- http://securelist.com/analysis/quarterly-spam-reports/69932/spam-and-phishi… *** OSIsoft PI AF Incorrect Default Permissions Vulnerability *** --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-132-01 *** Edge: Wie Microsoft seinen neuen Browser absichern will *** --------------------------------------------- Detailliert beschreibt Microsoft neue und bekannte Techniken, mit denen die Sicherheit des Edge-Browsers "fundamental" verbessert werden soll. Dabei hilft auch der Verzicht auf alte Technik des Internet Explorers. --------------------------------------------- http://www.golem.de/news/edge-wie-microsoft-seinen-neuen-browser-absichern-… Aufgrund des morgigen (14.05.2015) Feiertages erscheint der nächste End-of-Shift-Report erst am Freitag, den 15.05.2015.

1 0

Tageszusammenfassung - Dienstag 12-05-2015
by Daily end-of-shift report 12 May '15

12 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 11-05-2015 18:00 − Dienstag 12-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Steganography and Malware: Concealing Code and C&C Traffic *** --------------------------------------------- In our earlier post discussing steganography, I discussed how it is now being used to hide configuration data by malware attackers. Let's go discuss this subject another facet of this topic in this post: how actual malware code is hidden in similar ways. Security analysts will probably throw their hands up in the air and say, 'we've .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/steganography-an… *** Add GitHub dorking to list of security concerns *** --------------------------------------------- One of the big lessons that weve learned in the last 10 years is that even little pieces of once disparate data, gathered in a single location, can yield startling truths. With Facebook, that lesson crystallized with the introduction of its Graph Search feature in 2013, when the online world .. --------------------------------------------- http://www.csoonline.com/article/2921177/application-security/add-github-do… *** Golem.de-Test mit Kaspersky: So sicher sind Fototerminals und Copyshops *** --------------------------------------------- Wie gefährlich ist es, mit beschreibbaren USB-Sticks und SD-Karten Fotos und Dateien ausdrucken zu lassen? Golem.de hat zusammen mit dem Sicherheitsunternehmen Kaspersky getestet, ob auch Windows-XP-Terminals ohne Virenscanner sicher sind. --------------------------------------------- http://www.golem.de/news/golem-de-test-mit-kaspersky-so-sicher-sind-fototer… *** Verschlüsselte OSGP-Kommunikation von Smart Metern leicht belauschbar *** --------------------------------------------- Wenn Geräte im Smart Grid Informationen austauschen, könnten Angreifer trotz Krypto-Einsatz zumindest beim Standard Open Smart Grid Protocol Daten abgreifen. Sicherheitsforscher machen dafür das schwache Protokoll verantwortlich. --------------------------------------------- http://heise.de/-2642228 *** The State of ASLR on Android Lollipop *** --------------------------------------------- Modern platforms like Android devices enforce execute protections on memory, so injecting code into the process is often no longer the lowest hanging fruit for exploitation. Reusing the existing code and data has become the norm, and statistical defense via Address-Space Layout randomization is still the only widely available .. --------------------------------------------- https://copperhead.co/2015/05/11/aslr-android-zygote *** How secure will our data be in the post-quantum era? *** --------------------------------------------- Build your security for the next 50 years. If the speed of processing doubles every two years, make sure your cryptographic systems can't be brute forced in 50 years. If you use 2048 bit RSA, it will take some quadrillion years to break it. Good enough, right? --------------------------------------------- https://medium.com/@amarchenkova/how-secure-will-our-data-be-in-the-post-qu… *** Bublik Trojan - Variant Evolves with New Features *** --------------------------------------------- While there are many similar types of malware in use today, Bublik is being used for malicious activity and appears to be under active development, suggesting that its creators have paying customers. Because security involves a dynamic interaction .. --------------------------------------------- http://www.isightpartners.com/2015/05/bublik-trojan-variant-evolves-with-ne…

1 0

Tageszusammenfassung - Montag 11-05-2015
by Daily end-of-shift report 11 May '15

11 May '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 08-05-2015 18:00 − Montag 11-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Wireless LAN Controller Wireless Web Authentication Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the wireless web authentication subsystem of Cisco Wireless LAN Controller (WLC) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38749 *** VMSA-2015-0003.8 *** --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** Cisco Unified Communications Manager root Shell Access Local Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in the local read file of the Cisco Unified Communications Manager could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38763 *** Who's Scanning Your Network? (A: Everyone) *** --------------------------------------------- Not long ago I heard from a reader who wanted advice on how to stop someone from scanning his home network, or at least recommendations about to whom he should report the person doing the scanning. I couldnt believe that people actually still cared about scanning, and I told him as much: These days there are .. --------------------------------------------- http://krebsonsecurity.com/2015/05/whos-scanning-your-network-a-everyone/ *** NCSC publishes factsheet Help! My website has been defaced *** --------------------------------------------- To deface a website the attacker changes the content of existing pages or adds new ones. Hundreds of websites are defaced every day, often without being specifically targeted. It is becoming increasingly common for defacements to .. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/ncsc-publishes-factsheet-he… *** Jellyfish: Malware nistet sich in GPUs ein *** --------------------------------------------- Nutzt eine Malware den Prozessor einer Grafikkarte, ist sie nicht nur schwerer aufzuspüren, sondern kann auch die höhere Rechenleistung der GPU nutzen. Jellyfish will zeigen, dass solcher Schadcode funktioniert. --------------------------------------------- http://www.golem.de/news/jellyfish-malware-nistet-sich-in-gpus-ein-1505-113… *** Yubikey: Nie mehr schlechte Passwörter *** --------------------------------------------- Unser Autor hat 152 Onlinekonten, die er möglichst gut absichern will. Mit dem Passwortmanager Keepass und einem sogenannten Token - dem Yubikey Neo. Eine Anleitung. --------------------------------------------- http://www.golem.de/news/yubikey-nie-mehr-schlechte-passwoerter-1505-113872… *** Tor-Bridges für Amazon EC2 eingestampft *** --------------------------------------------- Ab sofort wird es schwerer, Nutzern alternative Zugänge zum Anonymisierungsnetz Tor zur Verfügung zu stellen. Das entsprechende Projekt für Cloud-Images wurde eingestellt. --------------------------------------------- http://heise.de/-2640793 *** 60 Days of Watching Hackers Attack Elasticsearch *** --------------------------------------------- Two months ago, one of my DigitalOcean instances started attacking another host with massive amounts of bogus traffic. I was notified by the abuse team at DO that my VPS was participating in a DDoS attack. I managed to track down that the .. --------------------------------------------- https://jordan-wright.github.io/blog/2015/05/11/60-days-of-watching-hackers… *** Finger printing: Print the Finger of an Application *** --------------------------------------------- When performing a Web Application Security Assessment, an important step is Fingerprinting which allows for further exploitation by an attacker. So as a security researcher/pentester, we should do well at fingerprinting the web server, which gives lot of information like application name, software version, .. --------------------------------------------- http://resources.infosecinstitute.com/finger-printing-print-the-finger-of-a… *** Angler exploit kit using tricks to avoid referrer chain leading back to malvertisement provider *** --------------------------------------------- For some time I've been seeing the Angler exploit kit pop up and infect clients without through malvertising campaigns without having a referer when visitng the landing page. The reason why this is interesting is that it makes it a lot harder to track down the malicious creative IDs which can .. --------------------------------------------- http://blog.0x3a.com/post/118366451134/angler-exploit-kit-using-tricks-to-a…

1 0

{Spam?} Tageszusammenfassung - Freitag 8-05-2015
by Daily end-of-shift report 08 May '15

08 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 07-05-2015 18:00 − Freitag 08-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Upcoming Security Updates for Adobe Reader and Acrobat (APSB15-10) *** --------------------------------------------- A prenotification Security Advisory has been posted regarding upcoming Adobe Reader and Acrobat updates scheduled for Tuesday, May 12, 2015. We will continue to provide updates on the upcoming release via the Security Advisory as well as the Adobe PSIRT blog. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1193 *** Compromised WordPress sites leaking credentials *** --------------------------------------------- Zscaler recently observed a credentials leak campaign on multiple WordPress sites. The compromised sites run backdoor code, which activates when the user submits login credentials. The credentials are encoded and sent to an attacker website in the form of a GET request. Till now, we have identified only one domain "conyouse.com" which is collecting all the credentials from these compromised --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/63XGcunva0k/compromised-… *** GPU-based malware, the evolution of rootkits and keyloggers *** --------------------------------------------- Malware developers have presented two proof-of-concept malware, a rootkit and a keylogger, which exploit the GPU of the infected host. Malware authors always demonstrate a great creativity and the ability to propose even more effective solutions, recently developers have published two strains of malware, Jellyfish rootkit and the Demon keylogger, that implement an unusual way to run on a victim's... --------------------------------------------- http://securityaffairs.co/wordpress/36634/malware/gpu-based-malware.html *** Almost EVERY SAP install hackable, researchers say *** --------------------------------------------- Even worse when you tinker with it. A staggering 95 percent of enterprise SAP installations contain high-severity vulnerabilities that could allow systems to be hijacked, researchers say. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/08/sap_95_perc… *** l+f: Kritische Lücke in Überwachungs-Software für kritische Systeme *** --------------------------------------------- Über einen Bug in Symantecs Server-Überwachungs-Software können Angreifer den Systemen beliebige Dateien unterjubeln und diese ausführen. --------------------------------------------- http://heise.de/-2638669 *** The USBKILL anti-forensics tool - it doesnt do *quite* what it says on the tin *** --------------------------------------------- A hacker who very modestly goes by the handle Hephaestos has just announced an "anti-forensic kill switch" dubbed, well, usbkill. It doesnt do quite what the name might suggest, and it could cut either way, so use it with care! --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/tzGEjCOTbq4/ *** Flawed Open Smart Grid Protocol is a risk for Smart Grid *** --------------------------------------------- More than four million smart meters and similar devices worldwide are open to cyber attacks due to the security issued in the Open Smart Grid Protocol. The Open Smart Grid Protocol (OSGP) is a family of specifications published by the European Telecommunications Standards Institute (ETSI) that are implemented today by more than four million smart... --------------------------------------------- http://securityaffairs.co/wordpress/36648/hacking/flaws-open-smart-grid-pro… *** IETF spezifiziert Richtlinien für den Einsatz von Verschlüsselung *** --------------------------------------------- Das Gremium für Internet-Standards dokumentiert Richtlinien für den sinnvollen Einsatz der Transportverschlüsselung TLS. Der RFC 7525 enthält gute Anleitungen, Tipps und Hinweise auf Fallstricke für jeden, der Verschlüsselung selbst einrichtet. --------------------------------------------- http://heise.de/-2639221 *** Angreifer können Viren-Scanner von BullGuard und Panda lahmlegen *** --------------------------------------------- Mehrere Antiviren-Anwendungen von BullGuard und Panda weisen eine Sicherheitslücke auf, über die Angreifer die Schutzfunktionen deaktivieren können. --------------------------------------------- http://heise.de/-2639307 *** DSA-3253 pound - security update *** --------------------------------------------- Pound, a HTTP reverse proxy and load balancer, had several issuesrelated to vulnerabilities in the Secure Sockets Layer (SSL) protocol. --------------------------------------------- https://www.debian.org/security/2015/dsa-3253 *** Sentinel 7.3 HF1 (Sentinel 7.3.0.1) Build 1800 7.3.0.1 *** --------------------------------------------- Abstract: Sentinel 7.3.0.1 upgrade patch for Sentinel 7.Document ID: 5202070Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:sentinel_server-7.3.0.1-1817.x86_64.tar.gz.sha256 (109 bytes)sentinel_server-7.3.0.1-1817.x86_64.tar.gz (1.67 GB)Products:Sentinel 7.1SentinelSentinel 7.1.1Sentinel 7.1.2Sentinel 7.XSentinel 7.3Sentinel 7.2.2Sentinel 7.2.1Sentinel 7.2Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=mBuUwDq2kD0~ *** Rockwell Automation RSLinx Classic Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on April 21, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for a stack-based buffer overflow vulnerability in Rockwell Automation's OPCTest.exe, which is a test client for RSLinx Classic's support of the OPC-DA protocol. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-111-02 *** VMSA-2015-0003.7 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** ZDI Security Advisories for EMC AutoStart and for ManageEngine Products *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/published/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in current releases of IBM WebSphere Real Time *** http://www.ibm.com/support/docview.wss?uid=swg21902444 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tivoli System Automation for Multiplatforms (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21882749 *** IBM Security Bulletin: Multiple Kernel vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022146 *** IBM Security Bulletin: A Security Vulnerability exists in the Dojo runtime that affects Rational Application Developer *** http://www.ibm.com/support/docview.wss?uid=swg21883926 *** Security Bulletin: Vulnerability in SSLv3 affects Upward Integration Modules (UIM) (CVE-2014-3566) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097659 *** IBM Security Bulletin: PowerKVM is affected by a Qemu vulnerability (CVE-2015-1779) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022149 *** IBM Security Bulletin: Multiple Unzip vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022145 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Endpoint Manager (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21883852 *** Security Bulletin: Vulnerability in RC4 stream cipher affects IBM ToolsCenter (CVE-2015-2808) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097676

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily