Daily

daily@lists.cert.at

1 participants
3085 discussions

Tageszusammenfassung - Mittwoch 22-04-2015
by Daily end-of-shift report 22 Apr '15

22 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-04-2015 18:00 − Mittwoch 22-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** How attackers exploit end-users psychology *** --------------------------------------------- At RSA Conference 2015, Proofpoint released the results of its annual study that details the ways attackers exploit end-users psychology to circumvent IT security. Last year was the year attacke... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/tTatKVMFrgE/secworld.php *** How to hack Avaya phones with a simple text editor *** --------------------------------------------- At RSA conference 2015 a researcher demonstrated that Avaya's Ethernet office phones can be compromised with just a simple text editor. At the RSA conference 2015 in San Francisco, Dr Ang Cui from Columbia University PhD and Red Ballon Security cofounder announced that Avaya's Ethernet office phones can be compromised with just a simple text... --------------------------------------------- http://securityaffairs.co/wordpress/36187/hacking/how-to-hack-avaya-phone.h… *** 2 out of 3 IT pros put systems at risk by making undocumented changes *** --------------------------------------------- The Netwrix 2015 State of IT Changes Survey of more than 700 IT professionals across 40 industries found that 70% of companies forget about documenting changes, up from 57% last year. Most surprisingl... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/4YM1XhU4vq4/secworld.php *** The CozyDuke APT *** --------------------------------------------- CozyDuke (aka CozyBear, CozyCar or "Office Monkeys") is a threat actor that became increasingly active in the 2nd half of 2014 and hit a variety of targets. The White House and Department of State are two of the most spectacular... --------------------------------------------- http://securelist.com/blog/research/69731/the-cozyduke-apt/ *** CozyDuke, TLP: White *** --------------------------------------------- This whitepaper provides an overview of CozyDuke, a set of tools used by one or more malicious actors for performing targeted attacks against high profile organizations, such as governmental organizations and other entities that work closely with these institutions. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002804.html *** "No iOS Zone" - A New Vulnerability Allows DoS Attacks on iOS Devices *** --------------------------------------------- In today's RSA Conference presentation, (Tuesday, April 21, 2015 | 3:30 PM - 4:20 PM | West | Room: 2001) Adi Sharabani, CEO and my fellow co-founder at Skycure, and I covered the lifecycle of vulnerabilities and vendor pitfalls. We also shared some details about a vulnerability our team recently identified in iOS 8 - a vulnerability that we are currently working with Apple to fix. --------------------------------------------- https://www.skycure.com/blog/ios-shield-allows-dos-attacks-on-ios-devices/ *** Regular expressions and recommended practices *** --------------------------------------------- Whenever a security person crosses a vulnerability report, one of the the first steps is to ensure that the reported problem is actually a vulnerability. Usually, the issue falls into well known and studied categories and this step is done... --------------------------------------------- https://securityblog.redhat.com/2015/04/22/regular-expressions-and-recommen… *** RSA 2015: Thousands of Android apps found to be vulnerable *** --------------------------------------------- Vulnerability testing by CERT found tens of thousands of Android apps are vulnerable and no full register exists as they dont all get CVE assigned. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/42uHv7yPt0M/ *** RSA 2015: Experts discuss six dangerous attack techniques *** --------------------------------------------- Data breaches, ransomware, and threats against industrial control system were were discussed during an RSA Conference 2015 session on dangerous attack techniques. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/yup3ar8W41U/ *** SSA-994726 (Last Update 2015-04-22): GHOST Vulnerability in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-451236 (Last Update 2015-04-22): Vulnerability in SIMATIC ProSave, SIMATIC CFC, SIMATIC STEP 7, SIMOTION Scout, and STARTER *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** HPSBGN03308 rev.1 - HP TippingPoint Security Management System (SMS) and TippingPoint Virtual Security Management System (vSMS), Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with the HP TippingPoint Security Management System (SMS) and vSMS. A vulnerability in JBOSS RMI could be exploited to allow remote code execution. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04626974 *** Manage Engine Firewall Analyzer 8.3 Build 8300 Cross Site Scripting *** --------------------------------------------- Topic: Manage Engine Firewall Analyzer 8.3 Build 8300 Cross Site Scripting Risk: Low Text: = Reflected XSS Vulnerability In Manage Engine Firewall Analyzer = . contents:: Table Of Content Overview == ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040128 *** Cisco FireSIGHT Management Center Web Framework HTTP Header Redirection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38486 *** Cisco Unified MeetingPlace Web Services Directory SOAP API Endpoints Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38461 *** Cisco Unified MeetingPlace Server Multiple State Changing URL API Functionalities Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38460 *** DSA-3231 subversion - security update *** --------------------------------------------- Several vulnerabilities were discovered in Subversion, a version controlsystem. The Common Vulnerabilities and Exposures project identifies thefollowing problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3231 *** Glibc Buffer Overflow in getanswer_r() Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032178 *** Platform Agent 2011.1r2 *** --------------------------------------------- Abstract: The Novell Audit Platform Agent (Platform Agent) facilitates auditing events by transmitting log data from multiple applications to the Audit server.Document ID: 5207351Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:Platform-Agent_2011.1r2.sha256 (93 bytes)Platform-Agent_2011.1r2.zip (16.8 MB)Products:Sentinel 7.0Sentinel 7.0.1Sentinel 7.0.2Sentinel 7.0.3Sentinel 7.1Sentinel 7.1.1Sentinel 7.1.2Sentinel 7.2Sentinel 7.2.1Sentinel 7.2.2Sentinel 7.3Sentinel Log --------------------------------------------- https://download.novell.com/Download?buildid=dpHkpNu89zw~

1 0

Tageszusammenfassung - Dienstag 21-04-2015
by Daily end-of-shift report 21 Apr '15

21 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-04-2015 18:00 − Dienstag 21-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** JavaScript CPU cache snooper tells crooks EVERYTHING you do online *** --------------------------------------------- New research sends browser kingpins scurrying for fixes Four Cornell University boffins reckon they can spy on keystrokes and mouse clicks in a web browser tab by snooping on the PCs processor caches. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/21/cache_creep… *** New fileless malware found in the wild *** --------------------------------------------- Since the discovery of the Poweliks fileless Trojan in August 2014, researchers have been expecting other similar malware to pop up. The wait over: Phasebot malware, which also has fileless infecti... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/fLPIj0uz1VY/malware_news.… *** Cross-Site-Scripting: Zahlreiche Wordpress-Plugins verwenden Funktion fehlerhaft *** --------------------------------------------- Eine schlecht dokumentierte Funktion der Wordpress-API ist von zahlreichen populären Plugins fehlerhaft verwendet worden. Der Fehler führt zu Cross-Site-Scripting-Lücken: Betroffen sind unter anderem das Jetpack-Plugin, die Plugins von Yoast und das All-in-one-SEO-Plugin. --------------------------------------------- http://www.golem.de/news/cross-site-scripting-zahlreiche-wordpress-plugins-… *** 2nd workshop on National Cyber Security Strategies: 13th May *** --------------------------------------------- ENISA and the Latvian Ministry of Defence are hosting on the 13th of May 2015, the 2nd workshop on National Cyber Security Strategies in Riga, during the Presidency of the Council of the European Union. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/2nd-workshop-on-national-cyber-… *** Fehlerhafte Netzwerkbibliothek macht iOS-Apps angreifbar *** --------------------------------------------- Durch einen Bug in der Bibliothek AFNetwork kann man die verschlüsselten Verbindungen zahlreicher Apps angreifen, die sie einsetzen. Eine Online-Datenbank verrät, welche Apps betroffen waren oder sind. --------------------------------------------- http://heise.de/-2615960 *** WordPress 4.1.2 Security Release *** --------------------------------------------- WordPress 4.1.2 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately. --------------------------------------------- https://wordpress.org/news/2015/04/wordpress-4-1-2/ *** Security Advisory: glibc vulnerability CVE-2013-7424 *** --------------------------------------------- (SOL16472) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/400/sol16472.htm… *** VU#260780: NetNanny uses a shared private key and root CA *** --------------------------------------------- Vulnerability Note VU#260780 NetNanny uses a shared private key and root CA Original Release date: 20 Apr 2015 | Last revised: 20 Apr 2015 Overview NetNanny uses a shared private key and root Certificate Authority (CA), making systems broadly vulnerable to HTTPS spoofing. Description NetNanny installs a Man-in-the-Middle (MITM) proxy as well as a new trusted root CA certificate. The certificate used by NetNanny is shared among all installations of NetNanny. Furthermore, the private key used --------------------------------------------- http://www.kb.cert.org/vuls/id/260780 *** Cisco Unified MeetingPlace Custom Prompts languageShortName Parameter Arbitrary Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38455 *** Cisco Unified MeetingPlace Administrative Web Interface Reflected Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38459 *** HPSBMU03321 rev.1 - HP Data Protector, Remote Increase of Privilege, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Data Protector. These vulnerabilities could be remotely exploited to allow an increase of privilege, create a Denial of Service (DoS), or execute arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBGN03305 rev.1 - HP Business Service Management (BSM) products running SSLv3, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Business Service Management (BSM), SiteScope, Business Service Management (BSM) Integration Adaptor, Operations Manager for Windows, Unix and Linux, Reporter, Operation Agent Virtual Appliance, Performance Manager, Virtualization Performance Viewer, Operations Agent, BSM Connector and Service Health Reporter running SSLv3. The vulnerability could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04626982

1 0

Tageszusammenfassung - Montag 20-04-2015
by Daily end-of-shift report 20 Apr '15

20 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-04-2015 18:00 − Montag 20-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Handling Special PDF Compression Methods, (Sun, Apr 19th) *** --------------------------------------------- Maarten Van Horenbeeck posted a diary entry (July 2008) explaining how scripts and data are stored in PDF documents (using streams), and demonstrated a Perl script to decompress streams. A couple of months before, I had started developing my pdf-parser tool, and Maartens diary entry motivated me to continue adding features to pdf-parser. Extracting and decompressing a stream (for example containing a JavaScript script) is easy with pdf-parser. You select the object that contains the stream... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19597&rss *** Taking Down Fraud Sites is Whac-a-Mole *** --------------------------------------------- I've been doing quite a bit of public speaking lately - usually about cybercrime and underground activity - and there's one question that nearly always comes from the audience: "Why are these fraud Web sites allowed to operate, and not simply taken down?" This post is intended to serve as the go-to spot for answering... --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/Da3rhmEIBt0/ *** An Analysis Of MS15-034 *** --------------------------------------------- By now you've undoubtedly heard about MS15-034. The following is a collection of my cursory research and thoughts on this vulnerability. --------------------------------------------- http://www.securitysift.com/an-analysis-of-ms15-034/ *** How to use a malicious JPEG to hack corporate networks *** --------------------------------------------- Security researcher Marcus Murray discovered a method to exploit a malicious JPEG to compromise modern Windows servers inside corporate networks. Security expert and penetration tester Marcus Murray discovered a way to use a malicious JPEG to compromise modern Windows servers and elevate privileges over targeted networks. The researcher has demonstrated the attack a few days.... --------------------------------------------- http://securityaffairs.co/wordpress/36130/hacking/malicious-jpeg-hack-corpo… *** Fiesta Exploit Kit Spreading Crypto-Ransomware - Who Is Affected? *** --------------------------------------------- Exploits kits have long been used to deliver threats to users, but they seem to have gone retro: it was recently being used to deliver fake antivirus malware. We closely monitor exploit kit activity because of their widespread use (we discussed their use in malvertising recently), so it was no great surprise to see the Fiesta... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/F_yFw0VwfG8/ *** "Rootpipe"-Lücke in OS X besteht offenbar weiter *** --------------------------------------------- Trotz Patch in der letzten Yosemite-Version scheint die Rechteausweitung nicht behoben zu sein. Schadcode soll die Lücke schon 2014 ausgenutzt haben. Ein Blogger zeigt unterdessen eine Möglichkeit auf, den Bug auch in früheren OS-X-Versionen zu fixen. --------------------------------------------- http://heise.de/-2612346 *** Bypassing Same Origin Policy, Part 3: Clickjacking, Cursorjacking & Filejacking *** --------------------------------------------- Same origin bypasses using clickjacking Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web... --------------------------------------------- http://resources.infosecinstitute.com/bypassing-same-origin-policy-part-3-c… *** Bypassing Packet Filters with IP Fragmentation Overlapping *** --------------------------------------------- 1. Introduction The process of IP fragmentation occurs when the data of the network layer is too large to be transmitted over the data link layer in one piece. Then the data of the network layer is split into several pieces (fragments), and this process is called IP fragmentation. The intention of this article is... --------------------------------------------- http://resources.infosecinstitute.com/bypassing-packet-filters-with-ip-frag… *** Threats From Within: The Out of Office Reply *** --------------------------------------------- As the guy who sends out the marketing emails at Cyveillance (yes, I'm THAT guy) I see a lot of Out-of-Office auto-responders in any given month. Having worked in cybersecurity for more than seven years, I've developed an appreciation for both information and physical security. With the RSA Conference coming up in a few days, and awaiting my barrage of Out of Office emails, I think now is the perfect time to discuss this seemingly innocuous topic. Why? Amazingly, even in the security... --------------------------------------------- https://blog.cyveillance.com/threats-from-within-the-out-of-office-reply/ *** Upatre malware gets full SSL comms encryption *** --------------------------------------------- The extremely popular Upatre Trojan downloader has undergone considerable changes that will make it and its communication more difficult to spot and block. The changes were implemented in the new v... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/qIIbd4nwtHA/malware_news.… *** Critical Magento Shoplift Vulnerability (SUPEE-5344) - Patch Immediately! *** --------------------------------------------- The Magento team released a critical security patch (SUPEE-5344) to address a remote command execution (RCE) vulnerability back in February. It's been more than two months since the release and still more than 50% of all the Magento installations have not been patched, leaving them open to attacks. This means hundreds of thousands of websites are... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/lfn2WVKTfWo/critical-magento-… *** DSA-3228 ppp - security update *** --------------------------------------------- Emanuele Rocca discovered that ppp, a daemon implementing thePoint-to-Point Protocol, was subject to a buffer overflow whencommunicating with a RADIUS server. This would allow unauthenticatedusers to cause a denial-of-service by crashing the daemon. --------------------------------------------- https://www.debian.org/security/2015/dsa-3228 *** GnuTLS RSA PKCS security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/102423 *** Zenworks Architecture ZDI Vulnerability - See TID 7016431 *** --------------------------------------------- Abstract: Fix for ZDI-CAN-2491: ZENworks Preboot Policy Service Stack Buffer Overflow Remote Code Execution Vulnerability Document ID: 5206350Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:ZCM_11.3.2_FRU1_Patch_921190.zip (3.53 MB)ZCM_11.2.4_MU1_Patch_921190.zip (1.63 MB)Products:ZENworks Configuration Management 11.3.2ZENworks Configuration Management 11.2.4ZENworks Configuration Management 11.3.1ZENworks Configuration Management 11 SP3Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=BJbybNUmQRQ~ *** Invoice - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-085 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-085Project: Invoice (third-party module)Version: 6.x, 7.xDate: 2015-March-25 Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Cross Site Request ForgeryDescriptionInvoice module allows you to create invoices in Drupal.The module doesnt sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability.Additionally, some URLs were not --------------------------------------------- https://www.drupal.org/node/2459337 *** DSA-3229 mysql-5.5 - security update *** --------------------------------------------- Several issues have been discovered in the MySQL database server. Thevulnerabilities are addressed by upgrading MySQL to the new upstreamversion 5.5.43. Please see the MySQL 5.5 Release Notes and OraclesCritical Patch Update advisory for further details: --------------------------------------------- https://www.debian.org/security/2015/dsa-3229 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Sterling Connect:Direct for UNIX (CVE-2015-0286, CVE-2015-0287, CVE-2015-0289, CVE-2015-0292, CVE-2015-0293, CVE-2015-0209, CVE-2015-0288) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21883028 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Rational Tau (CVE-2015-0208, CVE-2015-0286, CVE-2015-0292) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21713653 *** IBM Security Bulletin: RC4 stream cipher vulnerability and HTTP request smuggling vulnerability affect IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2015-2808, CVE-2014-0227) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21882717 *** Bugtraq: CVE-2014-7953 Android backup agent code execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/535296 *** Android 4.4 MTP Path Traversal *** --------------------------------------------- Topic: Android 4.4 MTP Path Traversal Risk: Medium Text:MTP path traversal vulnerability in Android 4.4 -- doSendObjectInfo() method of the MtpServer class implemen... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040116

1 0

Tageszusammenfassung - Freitag 17-04-2015
by Daily end-of-shift report 17 Apr '15

17 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 16-04-2015 18:00 − Freitag 17-04-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Internet broken as usual. *** --------------------------------------------- We continue to see active exploitation against MS15-034. But nothing different from yesterday, so back to Infocon Green for now. (Fri, Apr 17th) --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19593&rss *** USB Defense: Stop Data Walking Out The Door *** --------------------------------------------- The bad news is that internal data breaches are on the rise. And one of the biggest culprits? USB devices. In the past few years, there has been many organizations tracking down the loss of sensitive/confidential information due to the usage of USB drives and other mass storage media. --------------------------------------------- http://thehackernews.com/2015/04/usb-security-software.html *** US-Polizei schickt Malware an Whistleblower-Anwalt *** --------------------------------------------- Drei Whistelblower beschuldigen eine Polizei in Arkansas der Korruption und des Mobbings. Das Gericht ordnet die Freigabe von Dokumenten an. Die Polizei schickt eine Festplatte mit Passwortlogger, Backdoor und Command&Control Software. --------------------------------------------- http://heise.de/-2610436 *** On false alarms in detection of DGA botnet domains - part 1 *** --------------------------------------------- Domain Generation Algorithms are often used in botnets to create specially crafted domain names which point to C&C servers. The main purpose of this is to make it more difficult to block connections to these servers (for example with domain blacklists) or to protect the C&C channel (and botnet itself) from a takeover. Often domains generated this way are composed of random .. --------------------------------------------- http://www.cert.pl//news/9887/langswitch_lang/en *** Google's April Fool's prank inadvertently broke their security *** --------------------------------------------- As part of its traditional series of April Fools day jokes, Google used its own .google gTLD to launch a backwards version of its home page from the domain com.google on 1st April. However, this years joke inadvertently undermined an important security feature on Googles real homepage, which made it vulnerable to user interface redressing attacks such as click-jacking. This vulnerability would have allowed a remote attacker to change a users search settings, including turning off SafeSearch --------------------------------------------- http://news.netcraft.com/archives/2015/04/17/googles-april-fools-prank-inad… *** GnuTLS Certificate Validation Flaw Lets Remote Users Force a Signature Algorithm Downgrade *** --------------------------------------------- A vulnerability was reported in GnuTLS. A remote user can force the use of a weaker signature algorithm. The software does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm specified in the certificate. A remote user can exploit this to force the use of a weaker encryption algorithm. --------------------------------------------- http://www.securitytracker.com/id/1032148

1 0

Tageszusammenfassung - Donnerstag 16-04-2015
by Daily end-of-shift report 16 Apr '15

16 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 15-04-2015 18:00 − Donnerstag 16-04-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Impacts of a Hack on a Magento Ecommerce Website *** --------------------------------------------- Recently we wrote about the impacts of a hacked website and how it is important to give website visitors a safe online experience In this post, I'll show you how a hacked website results in almost immediate loss of money. We are not talking about drive-by infections that can be prevented by using a good anti-virus, updated software, and extensions like NoScript. ... This time, we're talking about using legitimate sites that have absolutely no externally visible signs of compromise. --------------------------------------------- https://blog.sucuri.net/2015/04/impacts-of-a-hack-on-a-magento-ecommerce-we… *** Services - Critical - Multiple Vulnerabilites - SA-CONTRIB-2015-096 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-096 Project: Services (third-party module) Version: 7.x Date: 2015-April-15 Security risk: 16/25 ( Critical) AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access bypass, Arbitrary PHP code execution --------------------------------------------- https://www.drupal.org/node/2471879 *** Display Suite - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-095 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-095 Project: Display Suite (third-party module) Version: 7.x Date: 2015-April-15 Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting --------------------------------------------- https://www.drupal.org/node/2471733 *** The Delicate Art of Remote Checks - A Glance Into MS15-034 *** --------------------------------------------- Recently, the research team posted a testing script for the MS15-034 vulnerability to pastebin for the greater community to test. We received some feedback about how exactly we figured out how to check, and remote checks in general. --------------------------------------------- http://blog.beyondtrust.com/the-delicate-art-of-remote-checks-a-glance-into… *** Denial of Service Attacks Possible with OpenSSL Vulnerability CVE-2015-1787 *** --------------------------------------------- On March 19 we wrote about how OpenSSL disclosed and fixed 13 vulnerabilities to address several security holes. Among the vulnerabilities addressed was CVE-2015-1787, which can result in a complete denial of service on an application compiled with OpenSSL library. This blog post will tackle how the bug can be exploited ... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Q6dMoVlcsE4/ *** Exploit kits (still) pushing Teslacrypt ransomware, (Thu, Apr 16th) *** --------------------------------------------- Teslacrypt is a form of ransomware that was first noted in January of this year. This malware apparently targets video game-related files. Ive seen Teslacrypt dropped by the Sweet Orange exploit kit (EK), and its also been dropped by Nuclear EK. McAfee saw it dropped by Angler EK last month. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19581&rss *** New POS Malware Emerges - Punkey *** --------------------------------------------- During a recent United States Secret Service investigation, Trustwave encountered a new family of POS malware, that we named Punkey. It appears to have evolved from the NewPOSthings family of malware first discovered by Dennis Schwarz and Dave Loftus at... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/New-POS-Malware-Emerges… *** IBM stellt seine Security-Datenbank ins Netz *** --------------------------------------------- IBM Security macht seine IT-Sicherheitsdatenbank künftig auf der Sharing-Plattform X-Force Exchange in der Cloud zugänglich. --------------------------------------------- http://heise.de/-2608795 *** crossdomain.xml : Beware of Wildcards *** --------------------------------------------- This blog entry will describe a wide spread Flash vulnerability that affected many big websites including paypal.com. The description will picture the state of the website paypal.com and ebay.com in 2013-2014. The vulnerabilities were completely fixed two weeks ago. Therefore, it is not possible to reproduce this vulnerability as-is. --------------------------------------------- http://blog.h3xstream.com/2015/04/crossdomainxml-beware-of-wildcards.html *** Cisco Secure Access Control Server Dashboard Page Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38403 *** Cisco Secure Desktop Cache Cleaner Command Execution Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS XR Software BVI Routed Packet Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-…

1 0

Tageszusammenfassung - Mittwoch 15-04-2015
by Daily end-of-shift report 15 Apr '15

15 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 14-04-2015 18:00 − Mittwoch 15-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Adobe Security Bulletins Posted *** --------------------------------------------- The following Security Bulletins have been posted today: APSB15-06: Security updates available for Adobe Flash Player APSB15-07: Security update: hotfixes available for ColdFusion APSB15-08: Security bulletin available .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1190 *** MSRT April: Unskal, Saluchtra, Dexter and IeEnablerCby *** --------------------------------------------- This month we added four new malware families to the Malicious Software Removal Tool: Win32/Saluchtra, Win32/Dexter, Win32/Unskal and Win32/IeEnablerCby, further protecting customers against malicious activity. IeEnablerCby is .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/04/14/msrt-april-unskal-saluch… *** Cisco TelePresence Collaboration Desk and Room Endpoints HTML Redirect Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38350 *** Cisco Web Security Appliance Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38351 *** Critical Patch Update - April 2015 *** --------------------------------------------- This Critical Patch Update contains 98 new security fixes across the product families listed below. Please note that a blog entry summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is .. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html *** Solaris Third Party Bulletin - April 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.h… *** Alte Xorg-Lücke bedroht haufenweise Drittsoftware *** --------------------------------------------- Die Lücke wurde bereits 2013 gestopft. Programme, die unter der Verwendung von Headern aus verwundbaren Versionen übersetzt wurden, sind allerdings nach wie vor angreifbar. --------------------------------------------- http://heise.de/-2606536 *** What the Ridiculous Fuck, D-Link?! *** --------------------------------------------- As mentioned in an update to my post on the HNAP bug in the DIR-890L, the same bug was reported earlier this year in the DIR-645, and a patch was released. D-Link .. --------------------------------------------- http://www.devttys0.com/2015/04/what-the-ridiculous-fuck-d-link/ *** Das Imperium schlägt zurück: Hacker-Gruppen ziehen gegeneinander zu Felde *** --------------------------------------------- Zwei Cyberspionage-Gruppen kamen sich in die Quere und attackierten sich wechselseitig. Sicherheitsforscher sehen hier einen neuen Trend, bei dem sich Hacker-Gruppen gezielt gegenseitig anfeinden. --------------------------------------------- http://heise.de/-2607493 *** Microsoft Security Bulletin Summary for April 2015 *** --------------------------------------------- This bulletin summary lists security bulletins released for April 2015. For information about how to receive automatic notifications whenever Microsoft security bulletins are .. --------------------------------------------- https://technet.microsoft.com/library/security/ms15-apr

1 0

Tageszusammenfassung - Dienstag 14-04-2015
by Daily end-of-shift report 14 Apr '15

14 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 13-04-2015 18:00 − Dienstag 14-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Web Security Appliance Python File Processing Privilege Escalation Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38306 *** Linux 4.0 freigegeben: Sicherheitslücken im laufenden Betrieb korrigieren *** --------------------------------------------- Bei Linux 4.0 lassen sich Sicherheitslücken ohne Neustart des Systems beheben. Ein verzögertes Aktualisieren von Dateieigenschaften soll die Performance von Ext4 verbessern. --------------------------------------------- http://heise.de/-2600691 *** A Tale of Two Exploits *** --------------------------------------------- CVE-2015-0336 is a type confusion vulnerability in the AS2 NetConnection class. I reported this issue in January and soon wrote a proof-of-concept exploit for the bug. The issue was patched by Adobe in March and less than a .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/04/a-tale-of-two-exploits.html *** Bioazih RAT: How clean-file metadata can help keep you safe *** --------------------------------------------- As mentioned in our previous blog post about the Microsoft Clean-File Metadata initiative, there are a number of benefits for our partners and customers who use our clean or released-file metadata, specifically during antimalware whitelisting efforts. Using the authoritative metadata manifest .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/04/13/bioazih-rat-how-clean-fi… *** New Trojan for Linux attacks websites *** --------------------------------------------- April 13, 2015 Doctor Web security researchers have examined a new Trojan that can infect computers with Linux operating system. This malicious program possesses the ability to scan remote websites for vulnerabilities and to attack resources with the specified HTTP protocol addresses. Criminals can .. --------------------------------------------- http://news.drweb.com/show/?i=9386&lng=en&c=9 *** IT-Sicherheit: Auch Medizintechnik lässt sich hacken *** --------------------------------------------- Überdosis nicht mehr ausgeschlossen: Der Sicherheitsforscher Billy Rios kann eine in Krankenhäusern verwendete Infusionspumpe über das Intranet manipulieren. --------------------------------------------- http://www.golem.de/news/it-sicherheit-auch-medizintechnik-laesst-sich-hack… *** As Ransomware Attacks Evolve, More Potential Victims Are at Risk *** --------------------------------------------- In early December, as most people were dealing with the stress of looking for the perfect holiday gifts and planning out their upcoming celebrations, police officers in .. --------------------------------------------- http://threatpost.com/as-ransomware-attacks-evolve-more-potential-victims-a… *** Sicherheitssoftware klemmt Windows vom IPv6-Internet ab *** --------------------------------------------- Die Sicherheitssoftware Warsaw 1.5.1 für Windows blockiert Internetserver, die sowohl über IPv6 als auch IPv4 erreichbar sind. Betroffen sind vor allem mehrere Millionen brasilianischer Windows-Geräte, deren Nutzer Homebanking betreiben. --------------------------------------------- http://heise.de/-2603192 *** TV5Monde - A (tentative) technical analysis *** --------------------------------------------- As it may appear surprising that a TV station can be forced to stop broadcasting after having its website defaced and social network accounts controlled by some hackers, I've tried to collect publicly available technical information and improve my understanding of this interesting issue. Below you .. --------------------------------------------- http://www.fixsing.com/tv5monde-a-tentative-technical-analysis/ *** Hardening IIS Security *** --------------------------------------------- Security is an essential part of a web application and should be taken into consideration from the first stage of the development process. A website couldn't ever be secure enough unless you would undertake necessary security .. --------------------------------------------- http://resources.infosecinstitute.com/hardening-iis-security/ *** Verschlüsselung: Auch Mozilla will HTTPS zum Standard machen *** --------------------------------------------- Ein Vorschlag von Mozilla sieht vor, dass der Firefox-Browser künftig bestimmte neue Features nur noch über HTTPS-Verbindungen zulässt. Langfristig wird angestrebt, dass alle Webseiten HTTPS benutzen. --------------------------------------------- http://www.golem.de/news/verschluesselung-auch-mozilla-will-https-zum-stand…

1 0

Tageszusammenfassung - Montag 13-04-2015
by Daily end-of-shift report 13 Apr '15

13 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 10-04-2015 18:00 − Montag 13-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Web Security Appliance Pickle Python Module Arbitrary Code Execution Vulnerability *** --------------------------------------------- A vulnerability in the status checking process of support remote access tunnels in the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to execute arbitrary Python code on a targeted system. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38305 *** Hacking the D-Link DIR-890L *** --------------------------------------------- The past 6 months have been incredibly busy, and I haven't been keeping up with D-Link's latest shenanigans. In need of some entertainment, I went to their web page today and was greeted by this atrocity: I think the most .. --------------------------------------------- http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/ *** Reversing Belkin's WPS Pin Algorithm *** --------------------------------------------- After finding D-Link's WPS algorithm, I was curious to see which vendors might have similar algorithms, so I grabbed some Belkin firmware and started dissecting it. This particular firmware uses the SuperTask! RTOS, and in fact uses the .. --------------------------------------------- http://www.devttys0.com/2015/04/reversing-belkins-wps-pin-algorithm/ *** Digital Certificates: Who Can You Trust? *** --------------------------------------------- Digital certificates are the backbone of the Public Key Infrastructure (PKI), which is the basis of trust online. Digital certificates are often compared to signatures; we can trust a document because it has a signature, or certificate authority (CA) by someone we trust. Simply put, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/digital-certific… *** APT 30 and the Mechanics of a Long-Running Cyber Espionage Operation *** --------------------------------------------- Having some of the world's most active economies, Asia Pacific countries are more likely to be a target of targeted attacks than the rest of the world. In Operation Quantum Entanglement, Pacific Ring of Fire: PlugX / Kaba and other FireEye reports, we have highlighted how Northeast Asian countries have been .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/04/apt_30_and_the_mecha.h… *** Polizeiorganisation Interpol verstärkt Kampf gegen Cyberkriminalität *** --------------------------------------------- Zum Kampf gegen die Internetkriminalität und andere neue Bedrohungen hat die internationale Polizeiorganisation Interpol ein Forschungszentrum in Singapur eröffnet. Der Interpol-Weltkomplex für Innovation (IGCI) soll .. --------------------------------------------- http://heise.de/-2599811 *** Windows XP noch auf zehntausenden Berliner Behörden-PCs *** --------------------------------------------- Seit einem Jahr gibt es keine offiziellen Patches mehr für Windows XP. Dennoch ist das fast 14 Jahre alte Betriebssystem noch weiter verbreitet, als Sicherheitsexperten lieb ist. In der Berliner Verwaltung sollen es sogar noch zehntausende PCs sein. Der Datenschutzbeauftragte Alexander Dix fordert nun die Abschaltung aller Behördenrechner. --------------------------------------------- http://derstandard.at/2000014223975 *** Zero Access Malware *** --------------------------------------------- The Zero Access trojan (Maxx++, Sierief, Crimeware) has affected millions of computers worldwide, and it is the number one cause of cyber click fraud and Bitcoin mining on the Internet. Once the trojan has been delivered into the system, it .. --------------------------------------------- http://resources.infosecinstitute.com/zero-access-malware/ *** Microsoft partners with Interpol, industry to disrupt global malware attack affecting more than 770,000 PCs in past six months *** --------------------------------------------- Today Interpol and the Dutch National High Tech Crime Unit (DNHTCU) announced the disruption of Simda.AT, a significant malware threat affecting more than 770,000 computers in over 190 countries. The Simda.AT variant first appeared in .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/04/12/microsoft-partners-with-… *** How to bypass Google's Santa LOCKDOWN mode *** --------------------------------------------- Santa is a binary whitelisting/blacklisting system made by Google's Macintosh Operations Team. While I refer to it as Google's Santa it is not an official Google product. It is based on a kernel extension and userland components to .. --------------------------------------------- https://reverse.put.as/2015/04/13/how-to-bypass-googles-santa-lockdown-mode/ *** Huthos VPS Provider: Totally legit, 1000% not a criminal organization - Andrew Morris *** --------------------------------------------- I observed a hacker trying to compromise one of my internet-facing Linux servers and repurpose it to sell to unknowing legitimate customers. --------------------------------------------- http://morris.guru/huthos-the-totally-100-legit-vps-provider/ *** OS X 10.10.3 soll gegen Adware helfen *** --------------------------------------------- Apple hat weitere Massnahmen gegen Adware ergriffen, die verstärkt kostenlosen Mac-Programmen beim Download beigelegt wird und unter anderem Browser-Einstellungen ändert. --------------------------------------------- http://heise.de/-2601940 *** VU#672268: Microsoft Windows NTLM automatically authenticates via SMB when following a file:// URL *** --------------------------------------------- Software running on Microsoft Windows that utilizes HTTP requests can be forwarded to a file:// protocol on a malicious server, which causes Windows to automatically attempt authentication via SMB to the malicious server in some circumstances. The .. --------------------------------------------- http://www.kb.cert.org/vuls/id/672268

1 0

Tageszusammenfassung - Freitag 10-04-2015
by Daily end-of-shift report 10 Apr '15

10 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 09-04-2015 18:00 − Freitag 10-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Beebone: FBI und Europol legen Wurm-Netz lahm *** --------------------------------------------- Das interessante am ausgeschalteten Beebone-Botnetz ist der Schädling dahinter: Es handelt sich um einen Downloader, der anderen Unrat nachlädt, sich selber weiter verbreitet und dabei ständig mutiert. --------------------------------------------- http://heise.de/-2598111 *** How To Create a Website Backup Strategy *** --------------------------------------------- We've all heard it million times before - backups are important. Still, the reality is that even today, backups remain one of the most overlooked and under-utilized precautions we can take to protect our vital data. Why are backups so important Put simply, a good set of backups can save your website when absolutely everythingRead More --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/II8TR_qV6OA/how-to-create-a-w… *** 122 online forums compromised to redirect visitors to Fiesta exploit kit *** --------------------------------------------- Over a hundred forum websites have been compromised and injected with code that redirects users to sites hosting the Fiesta exploit kit, Cyphort researchers have found. These are not highly popular... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/4VryRaL3aoc/malware_news.… *** Don't Be Fodder for China's "Great Cannon" *** --------------------------------------------- China has been actively diverting unencrypted Web traffic destined for its top online search service -- Baidu.com -- so that some visitors from outside of the country were unwittingly enlisted in a novel and unsettling series of denial-of-service attacks aimed at sidelining sites that distribute anti-censorship tools, according to research released this week. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/-n1M-QyvCoA/ *** Cisco and Level 3 team up to squash brute force server hijackers *** --------------------------------------------- #DownWithSSHPsychos Cisco and service provider Level 3 have teamed up take down netblocks linked to brute-force hack kingpins SSHPsychos, severely degrading (but not destroying) the groups potential to hack servers in the process. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/10/sshpsychos_… *** In eigener Sache: Wartungsarbeiten 16. 4. 2015 *** --------------------------------------------- In eigener Sache: Wartungsarbeiten 16.4.2015 | 10. April 2015 | Am Donnerstag, 16. April 2015, werden wir Wartungsarbeiten an unserer Infrastruktur vornehmen. Dies kann zu kurzen Service-Ausfällen führen (jeweils im Bereich weniger Minuten). Es gehen dabei keine Daten (zb Emails) verloren, es kann sich nur die Bearbeitung etwas verzögern. In dringenden Fällen können sie uns wie gewohnt telefonisch unter +43 1 505 64 16 78 erreichen. --------------------------------------------- http://www.cert.at/services/blog/20150410112411-1466.html *** Cisco Aggregate Services Router 9000 ASR9K Security Bypass Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38292 *** Red Hat JBoss XML External Entity Expansion Flaw Lets Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1032017 *** VMSA-2015-0003.1 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** f5 Security Advisories *** --------------------------------------------- *** Security Advisory: FreeType vulnerabilities CVE-2014-9656 and CVE-2014-9659 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16380.htm… *** Security Advisory: Linux kernel vulnerability CVE-2014-9683 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16381.htm… *** Security Advisory: OpenSSL vulnerability CVE-2012-2110 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/200/sol16285.htm… *** Security Advisory: Linux file utility vulnerabilities CVE-2014-8116 / CVE-2014-8117 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16347.htm… *** Security Advisory: GnuPG vulnerability CVE-2013-4576 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16396.htm… *** Security Advisory: Linux RPM vulnerability CVE-2013-6435 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16383.htm… *** Security Advisory: Multiple MySQL vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16389.htm… *** Security Advisory: NTP vulnerability CVE-2014-9297 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16392.htm… *** Security Advisory: Python vulnerability CVE-2006-4980 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16398.htm… *** Security Advisory: Multiple MySQL vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16385.htm… *** Security Advisory: NTP vulnerability CVE-2014-9298 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16393.htm… *** Security Advisory: Apache Tomcat vulnerability CVE-2014-0227 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16344.htm… *** DFN-CERT-2015-0483 - F5 Networks BIG-IP Protocol Security Module (PSM), F5 Networks BIG-IP Systeme: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- 08.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0483/ *** DFN-CERT-2015-0318 - IBM Java, IBM Notes, IBM Domino: Mehrere Schwachstellen ermöglichen die Übernahme der Systemkontrolle *** --------------------------------------------- 10.03.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0318/ *** Security_Advisory-Xen Vulnerabilities on Huawei FusionSphere products *** --------------------------------------------- Apr 10, 2015 10:12 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [2015-04-10] Unauthenticated Local File Disclosure in multiple TP-LINK products *** --------------------------------------------- Attackers can read sensitive configuration files without prior authentication on multiple TP-LINK devices. These files e.g. include the administrator credentials and the WPA passphrase. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015…

1 0

Tageszusammenfassung - Donnerstag 9-04-2015
by Daily end-of-shift report 09 Apr '15

09 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 08-04-2015 18:00 − Donnerstag 09-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Securing high-risk, third-party relationships *** --------------------------------------------- High-profile attacks reveal that malicious hackers target third-party vendors and supply chain partners as a backdoor into their primary target, according to CyberArk Software. Organizations in e... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/vSpu1uYwxR4/secworld.php *** AlienSpy RAT exploited to deliver the popular Citadel Trojan *** --------------------------------------------- Security experts at Fidelis firm discovered that variants of the AlienSpy remote access trojan (RAT) are currently being used in global phishing campaigns. Cyber criminals have exploited the AlienSpy RAT to deliver the popular Citadel banking Trojan and maintain the persistence inside the targeted architecture with a backdoor mechanism. Criminal crews used AlienSpy RAT to compromise systems in... --------------------------------------------- http://securityaffairs.co/wordpress/35802/cyber-crime/alienspy-rat-citadel-… *** Apple aktualisiert Safari für OS X 10.8, 10.9 und 10.10 *** --------------------------------------------- Mit den Versionen 8.0.5, 7.1.5 und 6.2.5 seines Browsers behebt Cupertino jede Menge Sicherheitslücken, darunter auch ein altes Problem im Privatmodus. --------------------------------------------- http://heise.de/-2597649 *** 44 Relevant Cyber Security Conferences around the World *** --------------------------------------------- Wherever you may be in the world, chances are there's a cyber security event happening near you this year. Cyber security conferences are important and necessary for the industry and for each of us, individually, because they help bring together the community. What's more, innovation often spurs after having a meaningful discussion with a peer or a mentor, or after being part of a conversation on your favorite topic in the field of information security. --------------------------------------------- https://heimdalsecurity.com/blog/44-relevant-cyber-security-conferences-aro… *** Polymorphic Beebone botnet sinkholed in international police operation *** --------------------------------------------- On April 8, a global operation targeted the Beebone (also known as AAEH) botnet, a polymorphic downloader bot which installs various forms of malware on victims' computers. Initial figures show tha... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/MGj0qJKKZ0I/secworld.php *** Deadly combination of Upatre and Dyre Trojans still actively targeting users *** --------------------------------------------- Upatre (or Waski) is a downloader Trojan that has lately become the malware of choice for cyber crooks to deliver additional, more dangerous malware on users computers. A few weeks ago, Swiss and ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/IJ4tqq_YAUU/malware_news.… *** LG software disables Windows security feature, developer says *** --------------------------------------------- LG Split Screen software that comes with the companys ultra wide monitors stealthily weakens Windows users defenses by deactivating the OS User Account Control (UAC) feature, developer Christopher ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/1t_AM7tskik/secworld.php *** Hidden backdoor API to root privileges in Apple OS X *** --------------------------------------------- The Admin framework in Apple OS X contains a hidden backdoor API to root privileges. It's been there for several years (at least since 2011), I found it in October 2014 and it can be exploited to escalate privileges to root from any user account in the system. --------------------------------------------- https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-pri… *** The Banking Trojan Emotet: Detailed Analysis *** --------------------------------------------- The Emotet Trojan is a highly automated and developing, territorially-targeted bank threat. Its small size, the dispersal methods used and the modular architecture, all make Emotet a very effective weapon for the cyber-criminal. --------------------------------------------- http://securelist.com/analysis/69560/the-banking-trojan-emotet-detailed-ana… *** Apple Leaves CNNIC Root in iOS, OSX Certificate Trust Lists *** --------------------------------------------- When it was revealed late last month that a Chinese certificate authority had allowed an intermediate CA to issue unauthorized certificates for some Google domains, both Google and Mozilla reacted quickly and dropped trust in CNNIC altogether, Apple has kept the root certificates in its trusted store for both iOS and OSX. Apple on Wednesday released... --------------------------------------------- http://threatpost.com/apple-leaves-cnnic-root-in-ios-osx-certificate-trust-… *** TA15-098A: AAEH *** --------------------------------------------- Original release date: April 09, 2015 Systems Affected Microsoft Windows 95, 98, Me, 2000, XP, Vista, 7, and 8Microsoft Server 2003, Server 2008, Server 2008 R2, and Server 2012 Overview AAEH is a family of polymorphic downloaders created with the primary purpose of downloading other malware, including password stealers, rootkits, fake antivirus, and ransomware.The United States Department of Homeland Security (DHS), in collaboration with Europol, the Federal Bureau of Investigation (FBI) and... --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-098A *** ZDI-15-119: IBM Tivoli Storage Manager FastBack CRYPTO_S_EncryptBufferToBuffer Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/OQuaNiGQOf8/ *** ZDI-15-118: IBM Tivoli Storage Manager FastBack Mount CMountDismount::GetVaultDump Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/RumTeWThXlw/ *** DFN-CERT-2015-0484 - F5 Networks BIG-IP Protocol Security Module (PSM), F5 Networks BIG-IP Systeme: Eine Schwachstelle ermöglicht das Ausführen beliebigen Programmcodes *** --------------------------------------------- 08.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0484/ *** DFN-CERT-2015-0477 - MantisBT: Mehrere Schwachstellen ermöglichen u. a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- 08.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0477/ *** Asterisk TLS Certificate Validation Flaw With Null Byte in Common Name Lets Remote Users Bypass Certificate Validation *** --------------------------------------------- http://www.securitytracker.com/id/1032052 *** CiviCRM private report - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-094 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-094Project: CiviCRM private report (third-party module)Version: 6.x, 7.xDate: 2015-April-08 Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionCiviCRM private report module enables users to create their own private copies of CiviCRM reports, which they can modify and save to meet their needs without requiring the "Administer reports" permission.The --------------------------------------------- https://www.drupal.org/node/2467697 *** [2015-04-09] Multiple XSS & XSRF vulnerabilities in Comalatech Comala Workflows *** --------------------------------------------- XSS and XSRF vulnerabilities within the Confluence plugin Comala Workflows of Comalatech enable an attacker to perform unauthorized actions in the name of another logged-in user and attack other users of the web application with JavaScript code, browser exploits or Trojan horses. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Juniper Security Advisories *** --------------------------------------------- *** JSA10679 - 2015-04 Security Bulletin: OpenSSL 8th January 2015 advisory. *** http://kb.juniper.net/index?page=content&id=JSA10679&actp=RSS *** JSA10680 - 2015-04 Security Bulletin: OpenSSL 19th March 2015 advisory *** http://kb.juniper.net/index?page=content&id=JSA10680&actp=RSS *** JSA10678 - 2015-04 Security Bulletin: Junos: Insufficient entropy on QFX3500 and QFX3600 platforms when the system boots up (CVE-2015-3006) *** http://kb.juniper.net/index?page=content&id=JSA10678&actp=RSS *** JSA10677 - 2015-04 Security Bulletin: SRX Series: Cross-Site-Scripting Vulnerability in Dynamic VPN (CVE-2015-3005). *** http://kb.juniper.net/index?page=content&id=JSA10677&actp=RSS *** JSA10676 - 2015-04 Security Bulletin: SRX Series: ISC BIND vulnerability denial of service in delegation handling (CVE-2014-8500) *** http://kb.juniper.net/index?page=content&id=JSA10676&actp=RSS *** JSA10675 - 2015-04 Security Bulletin: Junos J-Web: Clickjacking vulnerability (CVE-2015-3004) *** http://kb.juniper.net/index?page=content&id=JSA10675&actp=RSS *** JSA10674 - 2015-04 Security Bulletin: Junos: Multiple privilege escalation vulnerabilities in Junos CLI (CVE-2015-3003) *** http://kb.juniper.net/index?page=content&id=JSA10674&actp=RSS *** JSA10673 - 2015-04 Security Bulletin: IDP: Multiple vulnerabilities addressed by third party software updates. *** http://kb.juniper.net/index?page=content&id=JSA10673&actp=RSS *** JSA10672 - 2015-04 Security Bulletin: SRX Series: disconnecting from console may not automatically log out (CVE-2015-3002) *** http://kb.juniper.net/index?page=content&id=JSA10672&actp=RSS *** Apple Security Advisories *** --------------------------------------------- Apple TV 7.2 https://support.apple.com/kb/HT204662 *** iOS 8.3 *** https://support.apple.com/kb/HT204661 *** OS X Yosemite 10.10.3 and Security Update 2015-004 *** https://support.apple.com/kb/HT204659 *** Safari 8.0.5, Safari 7.1.5, and Safari 6.2.5 *** https://support.apple.com/kb/HT204658 *** OS X Yosemite 10.10.3 Combo Update *** https://support.apple.com/kb/DL1804 *** OS X Yosemite 10.10.3 Update *** https://support.apple.com/kb/DL1805 *** Security Update 2015-004 Mountain Lion *** https://support.apple.com/kb/DL1802 *** Security Update 2015-004 Mavericks *** https://support.apple.com/kb/DL1803 *** iOS 8.3 *** https://support.apple.com/kb/DL1806 *** Xcode 6.3 *** https://support.apple.com/kb/HT204663

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily