Daily

daily@lists.cert.at

1 participants
3085 discussions

Tageszusammenfassung - Dienstag 10-02-2015
by Daily end-of-shift report 10 Feb '15

10 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 09-02-2015 18:00 − Dienstag 10-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Safer Internet Day: BSI-Poster für mehr Sicherheit im Netz *** --------------------------------------------- Mit 40 "leicht umsetzbaren" Tipps sollen Internetnutzer die allermeisten Standardangriffe im Internet abwehren können, meint das Bundesamt für Sicherheit in der Informationstechnik. Deswegen hat es die auf Postern zusammengefasst und online gestellt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Safer-Internet-Day-BSI-Poster-fuer-m… *** European Cyber Security Month reporting to the benefit of EU citizen *** --------------------------------------------- ENISA publishes a report on the deployment of the European Cyber Security Month. The objective of this report is to: * Present its preparatory work * Carry out an objective evaluation * Draw conclusions that can be used in future editions of the ECSM --------------------------------------------- http://www.enisa.europa.eu/media/news-items/european-cyber-security-month-r… *** TR-32 - key-value store and NoSQL security recommendations *** --------------------------------------------- Key-value stores, caches or NoSQL databases became an important piece of software in today's internet and web services. In contrast to conventional DB sytems, the security model of NoSQL data stores is often very limited due to their inherent nature to be used within internal trusted networks. Strong attention should be given to the configuration of key-value stores especially regarding their access from the Internet. --------------------------------------------- http://www.circl.lu/pub/tr-32/ *** PlugX, Go-To Malware for Targeted Attacks, More Prominent Than Ever *** --------------------------------------------- The popular remote access tool PlugX enjoyed an ascent in popularity in 2014 and is now a go-to malware for attack groups. --------------------------------------------- http://threatpost.com/plugx-go-to-malware-for-targeted-attacks-more-promine… *** Cisco Security Advisories *** --------------------------------------------- Cisco Prime Infrastructure Cross-Site Scripting Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco Prime Infrastructure Cross-Site Request Forgery Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco IOS Software Zone-Based Firewall Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS Software Kernel Timer Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Prime Security Manager Cross-Site Scripting Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco Prime Infrastructure Cross-Frame Scripting Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco IOS Shell Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Montag 9-02-2015
by Daily end-of-shift report 09 Feb '15

09 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 06-02-2015 18:00 − Montag 09-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Analyzing Angler: The World's Most Sophisticated Exploit Kit *** --------------------------------------------- Anglers unique obfuscation, ability to detect antivirus and virtual machines, encrypted payload and fileless infection have some calling it the most sophisticated exploit kit. --------------------------------------------- http://threatpost.com/analyzing-angler-the-worlds-most-sophisticated-exploi… *** Bindead - a static analysis tool for binaries. *** --------------------------------------------- Bindead is an analyzer for executable machine code. It features a disassembler that translates machine code bits into an assembler like language (RREIL) that in turn is then analyzed by the static analysis component using abstract interpretation. As Bindead operates on the machine code level, it can be used without having the source code of the program to be analyzed. In fact, the purpose of Bindead is to help with the reverse engineering of executable code or binaries. --------------------------------------------- https://bitbucket.org/mihaila/bindead/wiki/Home *** ENISA: Threat Landscape for Smart Home and Media Convergence *** --------------------------------------------- The study identifies threats to all asset classes, across the several alternative design pathways to smart homes. As it develops, the smart home will exhibit a high cyber security risk profile for the individual context, with additional systematic effects on broader information security. --------------------------------------------- https://www.enisa.europa.eu/activities/risk-management/evolving-threat-envi… *** Online Windows Binary Analyzer *** --------------------------------------------- http://labs.nccgroup.com/NCCGroupWindowsBinaryAnalyzer/ *** Firmware Forensics: Diffs, Timelines, ELFs and Backdoors *** --------------------------------------------- This post covers some common techniques that I use to analyze and reverse firmware images. These techniques are particularly useful to dissect malicious firmwares, spot backdoors and detect unwanted modifications. --------------------------------------------- http://w00tsec.blogspot.co.at/2015/02/firmware-forensics-diffs-timelines-el… *** Moodle Directory Traversal Flaw Lets Remote Users View Arbitrary Files *** --------------------------------------------- A vulnerability was reported in Moodle. A remote user can view files on the target system. The software does not properly validate user-supplied input to some scripts that serve JavaScript. A remote user can supply a specially crafted request containing the '../' string to view files on target system that are located outside of the document directory. --------------------------------------------- http://www.securitytracker.com/id/1031712 *** Cisco Security Advisories *** --------------------------------------------- Cisco AsyncOS Software Uuencode Email Filtering Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Adaptive Security Appliance WebVPN Content Rewriter Denial of Service Vunerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… --------------------------------------------- Cisco AsyncOS Software Uuencoded Email Filtering Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Adaptive Security Appliance WebVPN Content Rewriter Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013…

1 0

Tageszusammenfassung - Freitag 6-02-2015
by Daily end-of-shift report 06 Feb '15

06 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 05-02-2015 18:00 − Freitag 06-02-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Filmkan: Mysterious Turkish Botnet Grows Through Facebook *** --------------------------------------------- On January 31, a security researcher named Mohammad Faghani posted an analysis of malware that was being distributed through Facebook posts. Based on the number of .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/02/filmkan-mysterious-turki… *** Microsoft: Firmen entdecken Cyberattacken erst nach 243 Tagen *** --------------------------------------------- Firmen brauchen nach Angaben von Microsoft durchschnittlich 243 Tage, um eine Cyberattacke auf ihr Netzwerk zu entdecken. "Sie haben 243 Tage lang .. --------------------------------------------- http://derstandard.at/2000011347067 *** Revetons design refreshed - Winter 2015 *** --------------------------------------------- Those days Reveton is mainly pushed on adult traffic via "standalone" CVE-2015-0311 flash (posing as advert) calling an Xtea encoded stream. After not far from 2 years with the same design it's now showing some .. --------------------------------------------- http://malware.dontneedcoffee.com/2015/02/RevetonWinter2015.html *** The Anthem Breach: What We Know Now *** --------------------------------------------- I learned about the breach directly from the CEO before all the hype and speculation hit. This is the level of caring and responsibility I personally expect as an Anthem customer. So now that the news is out there, let's talk about the technical aspects of the breach. --------------------------------------------- http://blog.beyondtrust.com/the-anthem-breach-what-we-know-now *** GE and MACTek HART Device DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the HART Device Type Manager (DTM) library utilized in GE and MACTek's HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-036-01 *** Pepperl+Fuchs Hart Device DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights GmbH HART Device DTM library utilized in Pepperl+Fuchs' HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-036-02 *** CodeWrights GmbH HART Device DTM Vulnerability (Update C) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-15-012-01B CodeWrights GmbH HART DTM Vulnerability that was published January 27, 2015, .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-012-01C *** Datenschutz: Wie sicher ist die IP-Telefonie? *** --------------------------------------------- Können Dritte ohne großen Aufwand IP-Telefonate mithören? Die Antwort ist wie so oft: Jein. Denn trotz mangelnder Verschlüsselung ist die IP-Telefonie nicht ganz so unsicher wie behauptet - zumindest ist es für Angreifer schwierig, Telefonate abzuhören. --------------------------------------------- http://www.golem.de/news/datenschutz-wie-sicher-ist-die-ip-telefonie-1502-1… *** Preparing for the unknown - A peek into Cyber Europe *** --------------------------------------------- ENISA is supporting Member States to cope with major cybersecurity crises with its flagship Cyber Europe programme. Five years after the first ever European wide cyber exercise, Cyber Europe evolved into a unique multinational crisis simulation which immerses participants into the unknown. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/preparing-for-the-unknown-a-pee… *** 7 Best WordPress Security Plugins *** --------------------------------------------- WordPress is the most popular blogging platform in the world. Millions of websites including various popular blogs are using WordPress as a content publishing platform. So, hackers are also more interested in hacking .. --------------------------------------------- http://resources.infosecinstitute.com/7-best-wordpress-security-plugins/ *** Neue Spuren im Sony-Hack führen nach Russland *** --------------------------------------------- Neue Indizien im Fall des Sony-Hacks sollen belegen, dass russische Hacker in den Vorfall involviert sind. Einem Bericht zufolge haben diese aktuell immer noch Zugriff auf das Netzwerk von Sony Pictures Entertainment. --------------------------------------------- http://heise.de/-2543005 *** Fessleak malvertising campaign used to serve ransomware *** --------------------------------------------- Invincea has been monitoring the Fessleak campaign in which hackers leveraged Adobe Flash Player exploits and file-less infections to serve ransomware. --------------------------------------------- http://securityaffairs.co/wordpress/33153/cyber-crime/fessleak-malvertising…

1 0

Tageszusammenfassung - Donnerstag 5-02-2015
by Daily end-of-shift report 05 Feb '15

05 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 04-02-2015 18:00 − Donnerstag 05-02-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Zero-day in the Fancybox-for-WordPress Plugin *** --------------------------------------------- Our research team was alerted to a possible malware outbreak affecting many WordPress websites. All the infections had a similar malicious iframe from '203koko' injected into the website. We were also directed to a forum thread .. --------------------------------------------- http://blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugi… *** SA-CONTRIB-2015-037 - Path Breadcrumbs - Access Bypass *** --------------------------------------------- https://www.drupal.org/node/2420139 *** Analyzing CVE-2015-0313: The New Flash Player Zero Day *** --------------------------------------------- Adobe has started rolling out an update to Flash Player which fixes the zero-day vulnerability we discussed earlier this week. This particular vulnerability can be exploited .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-20… *** Russische Malware zielt auf iOS-Geräte, saugt alle Daten ab *** --------------------------------------------- Die IT-Sicherheitsfirma "TrendLabs" berichtet, dass eine SpyWare namens XAgent sich mittlerweile auf iPhone und iPads ausgebreitet hat. Bereits vergangenes Jahr war von dem Schadprogramm die Rede, damals griff die Anwendung Windows-Rechner in Regierungsorganisationen, .. --------------------------------------------- http://derstandard.at/2000011311181 *** Sicherheitsstandards ignoriert: BMW-Hack war vermeidbar *** --------------------------------------------- Der kürzlich bekannt gewordene Hack von Autos der Marke BMW wäre auf einfache Weise vermeidbar gewesen. Das Computermagazin c’t zeigt im Detail, wie der Autokonzern zentrale .. --------------------------------------------- http://derstandard.at/2000011322698 *** Flash Zero Days Dominate Exploit Landscape *** --------------------------------------------- The recent Flash zero-day vulnerabilities and exploits have uncovered the relatively quiet Hanjuan exploit kit, and further exposed the dangers of malvertising. --------------------------------------------- http://threatpost.com/flash-zero-days-dominate-exploit-landscape/110871 *** Internet Explorer Cross-Site Scripting Vulnerability Now Public *** --------------------------------------------- Security researcher David Leo has disclosed a new vulnerability in Microsoft Internet Explorer. The vulnerability allows the same origin policy of the browser to be violated. The same-origin policy restricts how a document or .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/internet-explore… *** Anatomy of a Brute Force Campaign: The Story of Hee Thai Limited *** --------------------------------------------- This is the tale of an ongoing SSH brute forcing campaign, targeting servers and network devices, that distributes a new family of Linux rootkit malware named 'XOR.DDoS'. While typical DDoS bots are straightforward in operation and often programmed in a high-level script such as PHP or Perl, the XOR.DDoS family is programming in C/C++ and incorporates multiple .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/02/anatomy_of_a_brutef.ht… *** Security updates available for Adobe Flash Player (APSB15-04) *** --------------------------------------------- A Security Bulletin (APSB15-04) has been published regarding security updates for Adobe Flash Player. These updates address CVE-2015-0313, which is being actively exploited in the wild via drive-by-download attacks against systems .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1175

1 0

Tageszusammenfassung - Mittwoch 4-02-2015
by Daily end-of-shift report 04 Feb '15

04 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 03-02-2015 18:00 − Mittwoch 04-02-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New Wave of CTB-Locker/Critroni Ransomware Hitting Victims *** --------------------------------------------- There is a new wave of attacks delivering the CTB-Locker or Critroni crypto ransomware, arriving through spam messages with a variety of lures in several different countries. CTB-Locker is one of the newer variants in the crypto .. --------------------------------------------- http://threatpost.com/new-wave-of-ctb-lockercritroni-ransomware-hitting-vic… *** Advisory - Dangerous "nonce" leak in UpdraftPlus *** --------------------------------------------- Advisory for: UpdraftPlus Security Risk: High Exploitation level: Remote DREAD Score: 7/10 Vulnerability: Privilege Escalation Patched Version: 1.9.51 If you're a user of the UpdraftPlus plugin for WordPress, now is the time to update. During .. --------------------------------------------- http://blog.sucuri.net/2015/02/advisory-dangerous-nonce-leak-in-updraftplus… *** UpdraftPlus <= 1.9.50 - Privilege Escalation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7781 *** 1,800 Domains Overtaken by Flash Zero Day *** --------------------------------------------- Researchers at Cisco say that a Flash zero day exploit has compromised 1,800 domains, the majority of those during a 48-hour period last week. --------------------------------------------- http://threatpost.com/1800-domains-overtaken-by-flash-zero-day/110835 *** Multiple vulnerabilities in Cisco Unified IP Phone 9900 *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** MIT Kerberos Multiple Flaws in kadmind Let Remote Users Obtain Potentially Sensitive Information and Remote Authenticted Users Execute Arbitrary Code *** --------------------------------------------- MIT Kerberos Multiple Flaws in kadmind Let Remote Users Obtain Potentially Sensitive Information and Remote Authenticted Users Execute Arbitrary Code --------------------------------------------- http://www.securitytracker.com/id/1031691 *** Siemens SCALANCE X-200IRT Switch Family User Impersonation Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a user impersonation vulnerability in the Siemens SCALANCE X-200IRT Switch Family. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-034-01 *** Siemens Ruggedcom WIN Vulnerability *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities in the Siemens Ruggedcom WIN firmware. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-034-02 *** An In-depth analysis of the Fiesta Exploit Kit: An infection in 2015 *** --------------------------------------------- A while ago I blogged about the Fiesta exploit kit, this was back in September 2013 [Fiesta Exploit Kit analysis serving MSIE exploit CVE-2013-2551] in this blog I focused on the integration of the MSIE exploit and parts of the landing page. --------------------------------------------- http://blog.0x3a.com/post/110052845124/an-in-depth-analysis-of-the-fiesta-e… *** Play Store: Weit verbreitete Apps zeigen Adware verzögert an *** --------------------------------------------- Apps aus Googles Play Store mit Downloadzahlen von stellenweise über 5 Millionen beinhalten Adware, die den Nutzer zu dubiosen Appstores oder Anwendungen mit Premium-SMS-Versand weiterleiten. Interessant ist dabei die Art und Weise, wie die Werbung an den Nutzer gebracht wird. --------------------------------------------- http://www.golem.de/news/play-store-weit-verbreitete-apps-zeigen-adware-ver… *** Threat Analysis Template For BYOD Applications *** --------------------------------------------- Your IT department is certainly not at a loss when it comes to worrying about BYOD applications. Indeed, the list of threats to enterprise applications and the data they contain is a long one, and security professionals are .. --------------------------------------------- http://resources.infosecinstitute.com/threat-analysis-template-byod-applica… *** So schützen Sie sich vor der Flash-Lücke *** --------------------------------------------- Während Adobe weiterhin keine konkreten Schutzmaßnahmen kennt oder nennt, rät das BSI ganz klar zur Deinstallation des Flash Player. Wer nicht handelt und Flash weiterhin aktiv lässt, geht ein großes Risiko ein. --------------------------------------------- http://heise.de/-2539858 *** Cisco WebEx Meetings Server Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Pawn Storm Update: iOS Espionage App Found *** --------------------------------------------- In our continued research on Operation Pawn Storm, we found one interesting poisoned pawn - spyware specifically designed for espionage on iOS devices. While spyware targeting Apple users is highly notable by itself, this particular spyware is also involved in a targeted attack. Background .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-updat…

1 0

Tageszusammenfassung - Dienstag 3-02-2015
by Daily end-of-shift report 03 Feb '15

03 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 02-02-2015 18:00 − Dienstag 03-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Cisco Anyconnect and Cisco HostScan Web Launch XSS Vulnerability *** --------------------------------------------- A vulnerability in Cisco AnyConnect Secure Mobility Client and Cisco Host Scan could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the client when AnyConnect is launched through the web interface. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco UCS C-Series Rack Servers Integrated Management Controller Cross-Frame Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web interface of the Cisco Integrated Management Controller of the Cisco Unified Computing System C-Series Rack Servers could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Remember Me Safely - Secure Long-Term Authentication Strategies *** --------------------------------------------- Lets say you have a web application with a user authentication system, wherein users must provide a username (or email address) and password to access certain resources. Lets also say that its properly designed (it uses .. --------------------------------------------- https://resonantcore.net/blog/2015/02/remember-me-safely-secure-long-term-a… *** How a penetration test helps you meet PCI compliance guidelines *** --------------------------------------------- In order to protect credit card data, sometimes businesses have to think like a hacker. Every year, merchants who transmit, process, or store payment card data must conduct a suite of security test... --------------------------------------------- http://www.net-security.org/article.php?id=2213 *** Trotz Update: Adobe warnt vor neuer Flash Player-Lücke *** --------------------------------------------- Nachdem vor einer Woche kritische Sicherheitslücken geschlossen wurden, muss Adobe erneut warnen --------------------------------------------- http://derstandard.at/2000011209756 *** DSA-3151 python-django - security update *** --------------------------------------------- Several vulnerabilities were discovered in Django, a high-level Pythonweb development framework. The Common Vulnerabilities and Exposuresproject identifies the following problems: --------------------------------------------- https://www.debian.org/security/2015/dsa-3151 *** Creative Evasion Technique Against Website Firewalls *** --------------------------------------------- During one of our recent in-house Capture The Flag (CTF) events, I was playing with the idea of what could be done with Non-Breaking Spaces. I really wanted to win and surely there had to be a way through the existing evasion controls. This post is going to be a bit code-heavy for most end-users,Read More --------------------------------------------- http://blog.sucuri.net/2015/02/creative-evasion-technique-against-website-f… *** XSS, XFS, Open Redirect Vulnerabilities Found on About.com (SecurityWeek) *** --------------------------------------------- http://www.securityweek.com/xss-xfs-open-redirect-vulnerabilities-found-abo… *** Beware of emails pushing Google Chrome updates! *** --------------------------------------------- Google Chrome users are being actively targeted with a spam email campaign impersonating the Internet giant, urging them to download a newer version of the popular browser because theirs .. --------------------------------------------- http://www.net-security.org/malware_news.php *** Online-Erpresser verschlüsseln Datenbank und fordern 50.000 US-Dollar Lösegeld *** --------------------------------------------- Sicherheitsexperten habe eine perfide Erpressungsmasche entdeckt: Die Täter manipulieren Web-Dienste so, dass sie die von den Nutzern eingegebenen Daten verschlüsselt speichern. --------------------------------------------- http://heise.de/-2535621 *** Low VirusTotal detection rates for new malware, do they matter? *** --------------------------------------------- It is not as important as is often suggested - and doesn't mean the malware is allowed to execute.It is fairly common these days for security researchers to write about new malware attacks and point to low anti-virus detection rates when the affected sample is uploaded to VirusTotals multi-AV .. --------------------------------------------- http://www.virusbtn.com/blog/2015/02_03.xml? *** Google belohnt auch Sicherheitsforscher, die keine Lücken finden *** --------------------------------------------- Wer nach neuen Schwachstellen sucht, weiss nie, ob sich die investierte Zeit rechnet. Bei traditionellen Bug Bounties winkt schliesslich nur im Erfolgsfall Bares. Google experimentiert nun mit einem neuen Ansatz. --------------------------------------------- http://heise.de/-2535890 *** Dumping Git Data from Misconfigured Web Servers *** --------------------------------------------- Every so often when performing a penetration test against a web application or a range of external/internal servers I come across publicly accessible .git directories. Git is a revision control tool that helps keep track of .. --------------------------------------------- https://blog.netspi.com/dumping-git-data-from-misconfigured-web-servers/

1 0

Tageszusammenfassung - Montag 2-02-2015
by Daily end-of-shift report 02 Feb '15

02 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 30-01-2015 18:00 − Montag 02-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Security Advisory for Adobe Flash Player (APSA15-02) *** --------------------------------------------- A Security Advisory (APSA15-02) has been published regarding a critical vulnerability (CVE-2015-0313) in Adobe Flash Player 16.0.0.296 and earlier versions for Windows, Macintosh and Linux. We are aware of reports that this .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1171 *** Cisco NX-OS Software TACACS+ Command Authorization Vulnerability *** --------------------------------------------- The vulnerability is due to incorrect processing of very long command-line interface (CLI) commands by the TACACS+ command authorization feature. An attacker could exploit this vulnerability by being locally authenticated and executing a long CLI command that is subject to command authorization. An exploit could allow the attacker to cause the device to reload. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cobham Sailor 900 VSAT Buffer Overflow Vulnerability *** --------------------------------------------- This alert provides early notice of uncoordinated buffer overflow vulnerability disclosure of the Cobham Sailor 900 VSAT. --------------------------------------------- https://ics-cert.us-cert.gov//alerts/ICS-ALERT-15-030-01 *** Analysis Of An Interesting Windows Kernel Change Mitigating Vulnerabilities In Some Security Products *** --------------------------------------------- Last year I started researching into the Windows kernel to get a better understanding of privilege escalation vulnerabilities. Vulnerabilities in the kernel are a serious issue as they could be used to bypass browsers sandboxes and end up compromising the entire system. In general most people .. --------------------------------------------- https://www.greyhathacker.net/?p=818 *** Akamai's state of the internet security *** --------------------------------------------- A significant increase in the number of DDoS attacks was measured in Q4 2014: a 57 percent increase compared to last quarter and a 90 percent increase compared to Q4 2013. No attack size records were broken. A new attack vector using a Christmas tree packet generated one of the quarters nine largest attacks. --------------------------------------------- http://www.stateoftheinternet.com/downloads/pdfs/2014-internet-security-rep… *** Check autorun entries with VirusTotal - Autoruns v13 *** --------------------------------------------- Version 13 of Autoruns which was release January 29, 2015 includes a very handy feature to check unknown autorun entries with Virustotal 'automatically'. It's integrated .. --------------------------------------------- http://infected.io/41/check-autorun-entries-with-virustotal-autoruns-v13 *** HipChat Security Notice and Password Reset *** --------------------------------------------- Atlassian's security team has discovered and blocked suspicious activity on the HipChat service that resulted in unauthorized access to names, usernames, email addresses, and encrypted passwords for a very small percentage (<2%) of our users. We have no evidence that any payment information was accessed. --------------------------------------------- https://blog.hipchat.com/2015/02/01/hipchat-security-notice-and-password-re… *** Dshell *** --------------------------------------------- An extensible network forensic analysis framework. Enables rapid development of plugins to support the dissection of network packet captures. Key features: Robust stream reassembly IPv4 and IPv6 support Custom output handlers Chainable decoders --------------------------------------------- https://github.com/USArmyResearchLab/Dshell *** Multiple vulnerabilities in Wordpress-plugins *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7777 https://wpvulndb.com/vulnerabilities/7779 https://wpvulndb.com/vulnerabilities/7778 *** RansomWeb ransomware targets companies databases *** --------------------------------------------- Encryption first added as a patch, key only removed when all backups are encrypted.Make backups, they said. Then you wont have to worry about ransomware, they said.Ransomware has quickly become one of the most frustrating kinds of cyber attack. We all know that our devices could suddenly die, and if .. --------------------------------------------- http://www.virusbtn.com/blog/2015/02_02.xml *** Internet Explorer 11 lässt Webseiten Anwender ausspionieren *** --------------------------------------------- Sicherheitsexperten haben eine Schwachstelle im Internet Explorer 11 gefunden, über die Angreifer Webseiten so manipulieren können, dass sie den Anwender ausspionieren. Ein Patch lässt noch auf sich warten – andere Web-Browser sind aber nicht anfällig. --------------------------------------------- http://heise.de/-2534975 *** Flash-Player deaktivieren! Schon wieder Angriffe auf ungepatchte Lücke *** --------------------------------------------- Und täglich grüßt die Flash-Lücke: Nur eine Woche war Ruhe, jetzt ist die nächste kritische Schwachstelle aufgetaucht. Da diese bereits ausgenutzt wird, sollte Flash wieder ein mal abgeschaltet werden. --------------------------------------------- http://heise.de/-2535100 *** OpenSSH: Key-Rotation für die Secure Shell *** --------------------------------------------- Bei der nächsten Version von OpenSSH wird es möglich sein, Server-Keys mit einem automatisierten Verfahren zu rotieren. Bislang ließen sich Schlüssel bei SSH nur mit viel .. --------------------------------------------- http://www.golem.de/news/openssh-key-rotation-fuer-die-secure-shell-1502-11…

1 0

Tageszusammenfassung - Freitag 30-01-2015
by Daily end-of-shift report 30 Jan '15

30 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 29-01-2015 18:00 − Freitag 30-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** The Vast World of Fraudulent Routing *** --------------------------------------------- As network security engineers have attempted to categorize blocks of IP addresses associated with spam or malware for subsequent filtering at their firewalls, the bad guys have had to evolve to continue to target their victims. Since routing ... --------------------------------------------- http://research.dyn.com/2015/01/vast-world-of-fraudulent-routing/ *** Neue Outlook-App: Microsoft liest auch bei Firmenmails mit *** --------------------------------------------- Neue App für Android und iOS mit zweifelhafter Funktionalität - Exchange- und iCloud-Passwörter online gespeichert --------------------------------------------- http://derstandard.at/2000011053283 *** The Internet of Dangerous Things *** --------------------------------------------- Distributed denial-of-service (DDoS) attacks designed to silence end users and sideline Web sites grew with alarming frequency and size last year, according to new data released this week. Those findings dovetail quite closely with .. --------------------------------------------- http://krebsonsecurity.com/2015/01/the-internet-of-dangerous-things/ *** Microsoft Publishes Information Sharing Guidelines *** --------------------------------------------- Microsoft publishes a framework and guidelines on how to effectively set up and operate threat information sharing exchanges in hopes that organizations will actually share data. --------------------------------------------- http://threatpost.com/microsoft-publishes-information-sharing-guidelines/11… *** Blubrry PowerPress <= 6.0 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7773 *** Honeywell HART DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights GmbH HART .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-029-01 *** Multiple vulnerabilities in Cisco WebEx Meetings *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** D-Link routers vulnerable to DNS hijacking *** --------------------------------------------- Todor Donev, a member of the Ethical Hacker research team, says that the vulnerability is found in the ZynOS firmware of the device, D-Links DSL-2740R ADSL modem/wireless router. The firmware in question is implemented in many networking equipment manufactured by D-Link, TP-Link Technologies and ZTE, he noted ... Donev hasnt notified D-Link of this flaw, but has released exploit code for the flaw in a security advisory. --------------------------------------------- http://www.net-security.org/secworld.php?id=17888 *** Drei neue Versionen von Safari: Sicherheitslücken geschlossen *** --------------------------------------------- Für OS X 10.10, OS X 10.9 und OS X 10.8 stehen Updates für den Apple-Browser zur Verfügung. Sie beheben vor allem Sicherheitslücken. --------------------------------------------- http://heise.de/-2530322 *** Nearly half of all DDoS attacks uses multiple attack vectors *** --------------------------------------------- Akamai released a new security report that provides analysis and insight into the global attack threat landscape including DDoS attacks. Akamai observed a 52 percent increase in average peak band... --------------------------------------------- http://www.net-security.org/secworld.php?id=17896 *** GHOST glibc Vulnerability Affects WordPress and PHP applications *** --------------------------------------------- ... security researchers have discovered that PHP applications, including the WordPress Content Management System (CMS), could also be affected by the bug. ... According to the Sucuri researcher Marc-Alexandre Montpas, GHOST vulnerability could be a big issue for WordPress CMS, as it uses wp_http_validate_url() function to validate every pingback post URL. --------------------------------------------- http://thehackernews.com/2015/01/ghost-linux-security-vulnerability_29.html *** BMW-Patzer schürt Angst vor Hackerangriffen auf Autos *** --------------------------------------------- Schwachstelle beim deutschen Autohersteller inzwischen behoben - --------------------------------------------- http://derstandard.at/2000011080438 *** We got hacked! Now what? *** --------------------------------------------- Almost a year ago, I experienced my first real security incident. The companys bulletin board was compromised and it was my job to oversee and coordinate the incident response. The teams and I where pretty much thrown into the cold water, as weve never experienced an incident of that size before. --------------------------------------------- https://www.hashtagsecurity.com/we-got-hacked-now-what/ *** Vertipper-Domains als Geschäftsmodell *** --------------------------------------------- Einer Studie zufolge können Markeninhaber kaum verhindern, dass sogenannte Typosquatter Internet-Domains registrieren, die dem eigenen Namen nur fast entsprechen. --------------------------------------------- http://heise.de/-2533708

1 0

Tageszusammenfassung - Donnerstag 29-01-2015
by Daily end-of-shift report 29 Jan '15

29 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 28-01-2015 18:00 − Donnerstag 29-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** IT-Security-Links #69 *** --------------------------------------------- Trojan.Tubrosa is a new click-fraud malware. The attackers compromise victims' computers via Spam campaigns to use them to automatically inflate their YouTube video views. The malware .. --------------------------------------------- http://securityblog.switch.ch/2015/01/27/it-security-links-69/ *** Asterisk Project Security Advisory - AST-2015-002 *** --------------------------------------------- CVE-2014-8150 reported an HTTP request injection vulnerability in libcURL. Asterisk uses libcURL in its func_curl.so module (the CURL() dialplan function), as well as its res_config_curl.so (cURL realtime backend) modules. Since Asterisk .. --------------------------------------------- http://downloads.asterisk.org/pub/security/AST-2015-002.html *** ENISA Cloud Certification Schemes Metaframework *** --------------------------------------------- ENISA publishes a meta-framework and an online tool to help customers with cloud security when buying cloud services. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa-cloud-certification-s… *** Debian Security Advisory DSA-3143-1 virtualbox -- security update *** --------------------------------------------- CVE-2015-0377, CVE-2015-0418. Two vulnerabilities have been discovered in VirtualBox, a x86 virtualisation solution, which might result in denial of service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3143 *** CVE-2015-0311 (Flash up to 16.0.0.287) integrating Exploit Kits *** --------------------------------------------- Patched with Flash 16.0.0.296 the CVE-2015-0311 has been first seen exploited by Angler EK ( 2015-01-20 ) , soon after used in "standalone" mode in huge malvert campaign (pushing either Reveton, either Bedep (doing adfraud and .. --------------------------------------------- http://malware.dontneedcoffee.com/2015/01/cve-2015-0311-flash-up-to-1600287…

1 0

Tageszusammenfassung - Mittwoch 28-01-2015
by Daily end-of-shift report 28 Jan '15

28 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 27-01-2015 18:00 − Mittwoch 28-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** 2755801 - Update for Vulnerabilities in Adobe Flash Player in Internet Explorer - Version: 36.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/2755801 *** USN-2486-1: OpenJDK 6 vulnerabilities *** --------------------------------------------- Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial .. --------------------------------------------- http://www.ubuntu.com/usn/usn-2486-1/ *** VMware Security Advisories - 1 New, 1 Updated, (Wed, Jan 28th) *** --------------------------------------------- VMware has released an new and updated security advisory today. The two security advisories, listed below, address numerous vulnerabilities in the VMware .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19241 *** Magnetrol HART DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input validation vulnerability in the CodeWrights GmbH HART DTM library utilized by some Magnetrol products. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-027-01 *** Schneider Electric Multiple Products Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in Schneider Electric's SoMove Lite software package. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-027-02 *** CodeWrights GmbH HART DTM Vulnerability (Update B) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-15-012-01A CodeWrights GmbH HART DTM Vulnerability that was published January 13, 2015, on the ICS-CERT web site. This updated advisory provides mitigation details for an improper input validation vulnerability in CodeWrights .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-012-01B *** Bug in ultra secure BlackPhone let attackers decrypt texts, stalk users *** --------------------------------------------- A recently fixed vulnerability in the BlackPhone instant messaging application gave attackers the ability to decrypt messages, steal contacts, and control vital functions of the device, which is marketed as a more secure way to protect communications from government and criminal snoops. --------------------------------------------- http://arstechnica.com/security/2015/01/bug-in-ultra-secure-blackphone-let-… *** CVE-2015-0016: Escaping the Internet Explorer Sandbox *** --------------------------------------------- I analyzed this vulnerability (designated as CVE-2015-0016) because it may be the first vulnerability in the wild that showed the capability to escape the Internet Explorer sandbox. As sandboxing represents a key part of exploit mitigation techniques, any exploit that can break established sandboxes is worth a second look. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2015-0016-es… *** Multiple vulnerabilities in the FreeBSD kernel code *** --------------------------------------------- Francisco Falcon from the Core Exploit Writers Team found multiple vulnerabilities in the FreeBSD kernel code that implements the vt console driver (previously known as Newcons) and the .. --------------------------------------------- http://www.net-security.org/secworld.php?id=17882 *** Neue Apple-TV-Software behebt zahlreiche Sicherheitslücken *** --------------------------------------------- Neben iOS 8.1.3 und OS X 10.10.2 hat Apple am Dienstagabend auch noch ein Update der Software seiner Multimediabox veröffentlicht. Neue Funktionen hat die offenbar nicht, dafür jede Menge Fixes. --------------------------------------------- http://heise.de/-2530119 *** Apple security updates 27 Jan 2015 *** --------------------------------------------- http://support.apple.com/en-us/HT1222

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily