Daily

daily@lists.cert.at

1 participants
3085 discussions

Tageszusammenfassung - Dienstag 13-01-2015
by Daily end-of-shift report 13 Jan '15

13 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 12-01-2015 18:00 − Dienstag 13-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Remember Corel? Its just entered .DLL hell *** --------------------------------------------- Hijack hole found in Corel Draw and other doodleware Local zero day vulnerabilities have been disclosed in Corel applications, potentially affecting more than 100 million users. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/13/hijack_hole… *** Windows logging cheat sheet - Win 7/Win 2008 or later *** --------------------------------------------- This "Windows Logging Cheat Sheet" is intended to help you get started setting up basic and necessary Windows Audit Policy and Logging. By no means is this list extensive; but it does include some very common items that should be enabled, configured, gathered and harvested for any Log Management Program. Start with these settings and add to it as you understand better what is in your logs and what you need. --------------------------------------------- http://sniperforensicstoolkit.squarespace.com/storage/logging/Windows%20Log… *** Docker Secure Deployment Guidelines *** --------------------------------------------- The GitHub repository referenced below aims at providing some deployment guidelines for Docker developers and system administrators alike, that can be used to improve the security posture of Linux containers within a Dockerized environment. --------------------------------------------- http://blog.gdssecurity.com/labs/2015/1/12/docker-secure-deployment-guideli… *** Alert on unauthorized use of domain administrative account for Active Directory *** --------------------------------------------- At JPCERT/CC, we have observed multiple targeted attacks against domestic organizations where attackers intruded and stay within a corporate network for long periods of time and steal information. One characteristic of these attacks is that the attackers in the network steal credentials for the domain administrator account (herein, administrator account) in Active Directory, and leverage this administrator account to launch various attacks across the network. --------------------------------------------- https://www.jpcert.or.jp/english/at/2014/at140054.html *** Skeleton Key Malware Analysis *** --------------------------------------------- Dell SecureWorks Counter Threat Unit(TM) (CTU) researchers discovered malware that bypasses authentication on Active Directory (AD) systems that implement single-factor (password only) authentication. Threat actors can use a password of their choosing to authenticate as any user. ... Skeleton Key is deployed as an in-memory patch on a victims AD domain controllers to allow the threat actor to authenticate as any user, while legitimate users can continue to authenticate as normal. --------------------------------------------- http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-m… *** KeySweeper - Arduino-based Keylogger for Wireless Keyboards *** --------------------------------------------- Security researcher has developed a cheap USB wall charger that is capable to eavesdrop on almost any Microsoft wireless keyboard. MySpace mischief-maker Samy Kamkar has released a super-creepy keystroke logger for Microsoft wireless keyboards cunningly hidden in what appears to be a rather cheap, but functioning USB wall charger. The stealthy Arduino-based device,... --------------------------------------------- http://thehackernews.com/2015/01/KeySweeper-Arduino-Keyboard-Keylogger.html *** Gitrob: Putting the Open Source in OSINT *** --------------------------------------------- Sometimes employees might publish things that should not be publicly available. Things that contain sensitive information or things that could even lead to direct compromise of a system. This can happen by accident or because the employee does not know the sensitivity of the information. Gitrob is a command line tool that can help organizations and security professionals find such sensitive information. --------------------------------------------- http://michenriksen.com/blog/gitrob-putting-the-open-source-in-osint/ *** Aggressive Riskware Installation on Amazon Kindle (and Android) *** --------------------------------------------- As malware continues to grow on Android (900K malicious samples and 1,300 new per day), we sometimes forget attacks can also affect other devices... like Amazons Kindle. The Kindle indeed runs Fire OS, a fork of Android. Thus, in several cases, Android malware also work on Fire OS, and reciprocally. Proof below. ... --------------------------------------------- http://blog.fortinet.com/post/aggressive-riskware-installation-on-amazon-ki… *** OSXCollector: Forensic Collection and Automated Analysis for OS X *** --------------------------------------------- OSXCollector is an open source forensic evidence collection and analysis toolkit for OS X. It was developed in-house at Yelp to automate the digital forensics and incident response (DFIR) our crack team of responders had been doing manually. --------------------------------------------- http://engineeringblog.yelp.com/2015/01/osxcollector-forensic-collection-an… *** ICS London 2015 *** --------------------------------------------- SANS ICS London 2015 hosts four dedicated training courses for those tasked with securing Industrial Control Systems. This specialist training event takes place at the Grand Connaught Rooms in Londons West End, from April 27th to May 2nd 2015. --------------------------------------------- https://www.sans.org/event/ics-london-2015 *** Millionen Android-Geräte mit Sicherheitslücken auf Lebenszeit *** --------------------------------------------- Eine Kernkomponente von Android wird auf Geräten mit älteren Versionen nicht mehr mit Patches versorgt. Dabei ist vor allem deren Standardbrowser Einfallstor für Angreifer. --------------------------------------------- http://www.heise.de/security/meldung/Millionen-Android-Geraete-mit-Sicherhe… *** [2015-01-13] Multiple critical vulnerabilities in all snom desktop IP phones *** --------------------------------------------- All snom desktop IP phones are affected by multiple critical security issues in all available firmware versions. Attackers are able to completely compromise the phone with root access rights and install backdoors to the device which will even survive a factory reset. Furthermore, tapping into phone calls or surveilling the room is possible. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** [2015-01-13] Privilege Escalation & XSS & Missing Authentication in Ansible Tower *** --------------------------------------------- Attackers are able to elevate privileges and gain access to sensitive data of other organizations in Ansible Tower. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** [2015-01-13] Cross site request forgery vulnerability in XBMC / Kodi *** --------------------------------------------- An attacker could potentially gain access to sensitive information stored on the system where XBMC / Kodi is installed by exploiting CSRF issues. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** VU#533140: Tianocore UEFI implementation reclaim function vulnerable to buffer overflow *** --------------------------------------------- Vulnerability Note VU#533140 UEFI EDK1 vulnerable to buffer overflow Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview The EDK1 UEFI reference implementation contains a buffer overflow vulnerability. Description The open source EDK1 project provides a reference implementation of the Unified Extensible Firmware Interface (UEFI). Commercial UEFI implementations may incorporate portions of the EDK1 source code.According to Rafal Wojtczuk and Corey Kallenberg, a buffer... --------------------------------------------- http://www.kb.cert.org/vuls/id/533140 *** Cisco WebEx Meetings Server Information Disclosure Vulnerability *** --------------------------------------------- CVE-2015-0583 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** SSA-311299 (Last Update 2015-01-13): Vulnerabilities in iOS App SIMATIC WinCC Sm@rtClient *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** DFN-CERT-2015-0037 - Red Hat JBoss Data Virtualization: Mehrere Schwachstellen ermöglichen u. a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0037/

1 0

Tageszusammenfassung - Montag 12-01-2015
by Daily end-of-shift report 12 Jan '15

12 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 09-01-2015 18:00 − Montag 12-01-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** SnoopSnitch Android app notifies users of IMSI catchers, SS7 attacks *** --------------------------------------------- SnoopSnitch requires a rooted device with a Qualcomm chipset that runs stock Android 4.1 or higher. --------------------------------------------- http://www.scmagazine.com/free-app-flags-attempts-to-spy-on-mobile-phones/a… *** Cisco WebEx Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SAP NetWeaver Business Client for HTML Input Validation Flaws Permit Cross-Site Scripting Attacks *** --------------------------------------------- A vulnerability was reported in SAP NetWeaver Business Client for HTML. A remote user can conduct cross-site scripting attacks. The Business Client for HTML component does not properly filter HTML code from user-supplied input before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. --------------------------------------------- http://www.securitytracker.com/id/1031509 *** PLAID: Die seltsame Welt der ISO-Standards *** --------------------------------------------- Auf der Real World Crypto berichten Sicherheitsforscher über ihre Erfahrungen mit der ISO. Bei der Standardisierung des Authentifizierungsprotokolls PLAID offenbart sich teilweise eine erschreckende Unkenntnis in Sachen Kryptographie. --------------------------------------------- http://www.golem.de/news/plaid-die-seltsame-welt-der-iso-standards-1501-111… *** Dan J. Bernstein: Krypto-Algorithmen sicher designen *** --------------------------------------------- Der Kryptograph Dan Bernstein fordert auf der Real World Crypto seine Kollegen auf, kryptographische Algorithmen so zu designen, dass ein fehlerhafter Einsatz vermieden wird. Es sei keine gute Idee, immer den Programmierern die Schuld zu geben. --------------------------------------------- http://www.golem.de/news/dan-j-bernstein-krypto-algorithmen-sicher-designen… *** Google No Longer Provides Patches for WebView Jelly Bean and Prior *** --------------------------------------------- Google will no longer be providing security patches for vulnerabilities reported to affect only versions of Android's native WebView prior to 4.4. In other words, Google is now only supporting the current named version of Android (Lollipop, or 5.0) and the prior named version (KitKat, or 4.4). Jelly Bean (versions 4.0 through 4.3) and earlier will no longer see security patches for WebView from Google ... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2015/01/11/google-no… *** Securitys revamped index of pain readies for release *** --------------------------------------------- Comments sought on draft Common Vulnerability Scoring System 3.0 bug rating scheme The great unwashed has been afforded an opportunity to comment on a new scheme for classifying the severity of infosec vulnerabilities issued by the National Institute of Standards and Technology. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/12/securitys_r… *** Ntpdc Local Buffer Overflow *** --------------------------------------------- Alejandro Hdez (@nitr0usmx) recently tweeted about a trivial buffer overflow in ntpdc, a deprecated NTP query tool still available and packaged with any NTP install. He posted a screenshot of the crash as the result of a large buffer passed into a vulnerable gets call. After digging into it a bit, I decided it'd be a fun exploit to write, and it was. There are a few quarks to it that make it of particular interest, of which I've detailed below. --------------------------------------------- http://hatriot.github.io/blog/2015/01/06/ntpdc-exploit/ *** Deciphering the landscape for Privacy by Design. ENISA publishes its recommendations for policy makers, data protection authorities and experts *** --------------------------------------------- http://www.enisa.europa.eu/media/news-items/deciphering-the-landscape-for-p… *** Windows Elevation of Privilege in User Profile Service *** --------------------------------------------- Platform: Windows 8.1 Update 32/64 bit (No other OS tested) When a user logs into a computer the User Profile Service is used to create certain directories and mount the user hives (as a normal user account cannot do so). ... However there seems to be a bug in the way it handles impersonation, the first few resources in the profile get created under the user's token, but this changes to impersonating Local System part of the way through. --------------------------------------------- https://code.google.com/p/google-security-research/issues/detail?id=123 *** Do we need regular IT security fire drills? *** --------------------------------------------- IT security 'fire drills', supported by executive management and the risk committee should be conducted regularly in organizations, in order to understand the appropriate course of action in advance of a security breach. ... Organizations need to move beyond focusing purely on the prevention of security incidents, and start to concentrate on what they will do when an incident occurs. --------------------------------------------- http://www.net-security.org/secworld.php?id=17810 *** Diving into a Silverlight Exploit and Shellcode - Analysis and Techniques *** --------------------------------------------- http://www.checkpoint.com/downloads/partners/TCC-Silverlight-Jan2015.pdf *** Open-Source USB Exploitation Library - Teensyduino *** --------------------------------------------- What is Paensy? Paensy [pan-zee] is a combination of the word payload and Teensy - Paensy is an attacker-oriented, C-based library written for the development of Teensy devices. Paensy simplifies and optimizes mundane tasks and allows an easier platform for scripting. --------------------------------------------- http://malware.cat/?p=89 *** Protecting yourself from Powershell based VBA Macro Attacks *** --------------------------------------------- As some of you may know, I released a standalone Powershell script that will automatically generate a malicious VBA macro using different payloads and persistence methods. This can be found here: https://github.com/enigma0x3/Generate-Macro/blob/master/Generate-Macro.ps1 As a response, I have gotten a few questions from sysadmins about protecting their organizations from an attack like this. Since this type of attack relies on social engineering, there are only a handful of things you can do to --------------------------------------------- https://enigma0x3.wordpress.com/2015/01/11/protecting-yourself-from-powersh…

1 0

Tageszusammenfassung - Freitag 9-01-2015
by Daily end-of-shift report 09 Jan '15

09 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 08-01-2015 18:00 − Freitag 09-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** AIX for penetration testers (SANS Reading Room) *** --------------------------------------------- AIX is a widely used operating system by banks, insurance companies, power stations and universities. The operating system handles various sensitive or critical information for these services. There is limited public information for penetration testers about AIX hacking, compared the other common operating systems like Windows or Linux. --------------------------------------------- https://www.sans.org/reading-room/whitepapers/unix/aix-penetration-testers-… *** Datenschutzpanne in Mac OS X Yosemite *** --------------------------------------------- Die Spotlight genannte Suchfunktion der aktuellen Mac-OS-X-Version hat erneut ein Datenschutzproblem: Stößt sie auf HTML-Mails, lädt sie ungefragt Inhalte aus externen Quellen nach - zur Freude der Spammer. --------------------------------------------- http://www.heise.de/security/meldung/Datenschutzpanne-in-Mac-OS-X-Yosemite-… *** Netflix Credentials Targeted By Phishing Campaign *** --------------------------------------------- A new malicious email campaign has been observed by security researchers to target customers of Netflix by feeding them a message purporting to be an important notification from the media streaming service. ... Users are advised to check the legitimacy of the emails straight on the official page of the service and to avoid clicking on the provided link. All phishing messages can be forwarded to phishing(a)netflix.com for investigation. --------------------------------------------- http://news.softpedia.com/news/Netflix-Credentials-Targeted-By-Phishing-Cam… *** Microsoft advanced notification service changes. , (Fri, Jan 9th) *** --------------------------------------------- Quite a few of you have written in to let us know that Microsoft is changing the way in which they provide information (thanks to you all). ">You can read the full blog here --">/archive/2015/01/08/evolving-advance-notification-service-ans-in-2015.aspx In a nutshell if you want to be advised in advance younow need to register, select the products used and you will then be provided with information relating to the patches that will be released. If you are a premier customer your... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19167&rss *** Banking Trojans Disguised As ICS/SCADA Software Infecting Plants *** --------------------------------------------- Researcher spots spike in traditional financial malware hitting ICS/SCADA networks -- posing as popular GE, Siemens, and Advantech HMI products. A renowned ICS/SCADA security researcher has discovered a surprising twist in cyberattacks hitting plant floor networks: traditional banking Trojan malware posing as legitimate ICS software updates and files rather than the dreaded nation-state custom malware in the wake of Stuxnet. --------------------------------------------- http://www.darkreading.com/attacks-breaches/banking-trojans-disguised-as-ic… *** OpenBSD Releases a Portable Version of OpenNTPD *** --------------------------------------------- Noryungi (70322) writes Theo De Raadt roundly criticized NTP due to its recent security advisories, and pointed out that OpenBSD OpenNTPD was not vulnerable. However, it also had not been made portable to other OS in a long time. Brent Cook, also known for his work on the portable version of LibreSSL (OpenBSD cleanup and refactoring of OpenSSL) decided to take the matter in his own hands and released a new portable version of OpenNTPD. Everyone rejoice, compile and report issues! --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/NJ1R-3x9MVI/story01.htm *** No, the Linux leap second bug WONT crash the web *** --------------------------------------------- Fear the fear, not the second There's a reason space missions don't launch on the day a leap second is added to international clocks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/09/leap_second… *** Asus-Router schutzlos bei Angriffen aus dem eigenen Netz *** --------------------------------------------- Mindestens die Router RT-AC66 und RT-N66U können von Angreifern aus dem LAN komplett gekapert werden. Wahrscheinlich sind weitere Modelle betroffen. Firmware-Updates, die das Loch stopfen, gibt es noch nicht. --------------------------------------------- http://www.heise.de/security/meldung/Asus-Router-schutzlos-bei-Angriffen-au… *** USN-2456-1: GNU cpio vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2456-18th January, 2015cpio vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Ubuntu 10.04 LTSSummaryThe GNU cpio program could be made to crash or run programs if itopened a specially crafted file or received specially crafted input.Software description cpio - a program to manage archives of files DetailsMichal Zalewski discovered an out of bounds write issue in theprocess_copy_in... --------------------------------------------- http://www.ubuntu.com/usn/usn-2456-1/ *** Cisco Unified Communications Domain Manager Platform High CPU DoS Vulnerability *** --------------------------------------------- CVE-2014-8020 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco WebEx Meetings Server Authentication Bypass Vulnerability *** --------------------------------------------- CVE-2014-8033 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** DSA-3122 curl - security update *** --------------------------------------------- Andrey Labunets of Facebook discovered that cURL, an URL transferlibrary, fails to properly handle URLs with embedded end-of-linecharacters. An attacker able to make an application using libcurl toaccess a specially crafted URL via an HTTP proxy could use this flaw todo additional requests in a way that was not intended, or insertadditional request headers into the request. --------------------------------------------- https://www.debian.org/security/2015/dsa-3122 *** DSA-3121 file - security update *** --------------------------------------------- Multiple security issues have been found in file, a tool/library todetermine a file type. Processing a malformed file could result indenial of service. Most of the changes are related to parsing ELFfiles. --------------------------------------------- https://www.debian.org/security/2015/dsa-3121 *** Emerson HART DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights HART DTM library utilized in Emerson's HART DTM. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-008-01-0 *** Schneider Electric Wonderware InTouch Access Anywhere Server Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a stack-based buffer overflow vulnerability in the Wonderware InTouch Access Anywhere Server product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-008-02 *** TP-Link TL-WR840N Cross Site Request Forgery *** --------------------------------------------- Topic: TP-Link TL-WR840N Cross Site Request Forgery Risk: Low Text:Classification: //Dell SecureWorks/Confidential - Limited External Distribution: # # * Title: TP-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010041 *** Wireshark Security Advisories *** --------------------------------------------- wnpa-sec-2015-05. TLS/SSL decryption crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-04. SMTP dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-03. DEC DNA Routing Protocol dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-02. LPP dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-01. WCCP dissector crash. Fixed in 1.12.3, 1.10.12. --------------------------------------------- https://www.wireshark.org/security/ *** Several vulnerabilities have been found in the third party TYPO3 extensions *** --------------------------------------------- extension "Content Rating": http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… | extension "Content Rating Extbase": http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… --------------------------------------------- http://typo3.org/teams/security/security-bulletins

1 0

Tageszusammenfassung - Donnerstag 8-01-2015
by Daily end-of-shift report 08 Jan '15

08 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 07-01-2015 18:00 − Donnerstag 08-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Why patch management is ALSO REQUIRED in ICS infrastructure, (Wed, Jan 7th) *** --------------------------------------------- Security patch management is a delicate issue in critical infrastructure. This is caused for the specific configuration, operating system version and related software required by the ICS platform. Most support contracts states that any modification outside the parameters stated by the manufacturer will void the relation and release manufacturer and seller from any responsibility about malfunction and any consequence on the industrial process. Unfortunately, when we talk about ICS software... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19157&rss *** Assessing the risk of POODLE, (Thu, Jan 8th) *** --------------------------------------------- One of the biggest security announcements in the last year was definitely the POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability, which marked the real end of SSLv3. In a contrast with many other previously identified vulnerabilities in encryption algorithms used by SSLv3, this vulnerability is viable, and can be exploited by an attacker without jumping over too many obstacles or requiring large resources the POODLE vulnerability is real. While this raised quite a bit of... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19159&rss *** wmap - A Chrome Extension for Taking Screenshots of Web Services In Bulk *** --------------------------------------------- wmap is a Chrome extension written mostly in JavaScript which uses the Chrome browser to generate HTML screenshot reports of web services. --------------------------------------------- http://thehackerblog.com/wmap-a-chrome-extension-for-taking-screenshots-of-… *** B-Sides Ljubljana *** --------------------------------------------- First Security B-Sides Ljubljana is about to *happen*. BSides is community driven information security conference that will be held March 12th in Ljubljana, Slovenia, day after Cloud Security Alliance CEE Summit 2015. Call for papers is now online. --------------------------------------------- http://bsidesljubljana.si/ *** Bypassing OpenSSL Certificate Pinning in iOS Apps *** --------------------------------------------- When mobile applications communicate with an API or web service, this should generally happen via TLS/SSL (e.g., HTTPS). ... Since any of the CAs may issue a certificate for any hostname/server, security-conscious applications should "pin" the expected server certificate in the application, i.e., not accept any certificate but the one issued by the known-good CA which the application developer uses. --------------------------------------------- http://chargen.matasano.com/chargen/2015/1/6/bypassing-openssl-certificate-… *** PowerShell Toolkit: PowerSploit *** --------------------------------------------- PowerSploit is a collection of PowerShell scripts which can prove to be very useful during some exploitation and mostly post-exploitation phases of a penetration test. To get the latest version of PowerSploit, visit this URL: https://github.com/mattifestation/PowerSploit If you have GIT, then you can simply run the following command to get... --------------------------------------------- http://resources.infosecinstitute.com/powershell-toolkit-powersploit/ *** Using Free Tools To Detect Attacks On ICS/SCADA Networks *** --------------------------------------------- ICS/SCADA experts say open-source network security monitoring software is a simple and cheap way to catch hackers targeting plant operations. --------------------------------------------- http://www.darkreading.com/perimeter/using-free-tools-to-detect-attacks-on-… *** State of the Internet: Attack traffic, DDoS, IPv4 and IPv6 *** --------------------------------------------- Akamai today released its latest State of the Internet report, which provides insight into key global statistics such as connection speeds and broadband adoption across fixed and mobile networks, over... --------------------------------------------- http://www.net-security.org/secworld.php?id=17798 *** Windows exploitation in 2014 *** --------------------------------------------- Today, we published our research about Windows exploitation in 2014. This report contains interesting information about vulnerabilities in Microsoft Windows and Office patched over the course of the year, drive-by download attacks and mitigation techniques. --------------------------------------------- http://www.welivesecurity.com/2015/01/08/windows-exploitation-2014/ *** Netskope Cloud Report - January 2015 *** --------------------------------------------- In this quarterly Netskope Cloud Report, a key find in that as many as 15 percent of business users have had their credentials compromised. Since up to half of users re-use passwords for multiple accounts, the likelihood of users logging into business-critical apps with these credentials is high, putting business-sensitive data at risk. --------------------------------------------- https://www.netskope.com/reports/netskope-cloud-report-january-2015/ *** Deobfuscating Malicious Macros Using Python *** --------------------------------------------- Over the past few weeks, weve observed cybercriminals spamming users, particularly in the UK, using document files embedded with malicious macros masquerading as invoices. The attachment is either a Word or an Excel document file. Here are some examples incorporating brands based in the UK: Users must enable macros in order for these malicious documents to work. In some cases, the documents include instructions for enabling macros. You may think of document macro viruses as a thing... --------------------------------------------- http://blog.spiderlabs.com/2015/01/tips-for-deobfuscating-the-malicious-mac… *** vBulletin Releases Serious Vulnerability in VBSEO *** --------------------------------------------- The vBulletin team sent an email yesterday to all their clients about a potential security vulnerability on VBSEO. VBSEO is widely used SEO module for vBulletin that was discontinued last year. This makes the problem worse, no patches will be released for it. If you are using VBSEO, you have 3 options: Completely remove VBSEO... --------------------------------------------- http://blog.sucuri.net/2015/01/serious-vulnerability-on-vbseo.html *** Aviator Going Open Source *** --------------------------------------------- One of the most frequent criticisms we've heard at WhiteHat Security about Aviator is that it's not open source. There were a great many reasons why we didn't start off that way, not the least of which was getting the legal framework in place to allow it, but we also didn't want our efforts to... --------------------------------------------- https://blog.whitehatsec.com/aviator-going-open-source/ *** Evolving Microsofts Advance Notification Service in 2015 *** --------------------------------------------- Our Advance Notification Service (ANS) was created more than a decade ago as part of Update Tuesday to broadly communicate in advance, about the security updates being released for Microsoft products and services each month. Over the years, technology environments and customer needs have evolved, prompting us to evaluate our existing information and distribution channels. This desire to improve is why customers may have seen us introduce myBulletins to provide bulletin reports tailored to... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/01/07/evolving-advance-notific… *** OpenSSL Fixes Eight Security Vulnerabilities *** --------------------------------------------- The OpenSSL Project has released several new versions of the software that fix eight security vulnerabilities, including several certificate issues and a couple of denial-of-service flaws. The patches included in OpenSSL 1.0.0p, 1.0.1k and 0.98zd are not for critical or high-risk vulnerabilities, but they do fix some interesting vulnerabilities. Two of the bugs are rated moderate and the other... --------------------------------------------- http://threatpost.com/openssl-fixes-eight-security-vulnerabilities/110279 https://www.openssl.org/news/secadv_20150108.txt *** Cisco Secure Access Control Server Privilege Escalation Vulnerability *** --------------------------------------------- CVE-2014-8027 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Secure Access Control Server Multiple Cross-Site Scripting Vulnerabilities *** --------------------------------------------- CVE-2014-8028 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Secure Access Control Server Open Redirect Vulnerability *** --------------------------------------------- CVE-2014-8029 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Brother MFC-J4410DW Cross Site Scripting *** --------------------------------------------- Topic: Brother MFC-J4410DW Cross Site Scripting Risk: Low Text:Class Cross-Site Scripting Remote Yes Disclosed 9th October 2014 Published 7th January 2015 Credit Dave Daly of Dionach (vu... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010034 *** Pirelli Router WPA weak security *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99682 *** SA-CONTRIB-2015-010 - Log Watcher - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-010Project: Log Watcher (third-party module)Version: 6.xDate: 2015-January-07Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionLog Watcher allows you to monitor your site logs in a systematic way by setting up scheduled aggregations for specific log types.The report administration links are not properly protected from CSRF. A malicious user could cause a log --------------------------------------------- https://www.drupal.org/node/2403463 *** SA-CONTRIB-2015-007 - Htaccess - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-007Project: htaccess (third-party module)Version: 7.xDate: 2015-January-07Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionThe Htaccess module allows the creation and deployment of .htaccess files based on custom settings.Some administration links were not properly protected from Cross Site Request Forgery (CSRF). A malicious user could cause an administrator to deploy or --------------------------------------------- https://www.drupal.org/node/2403445 *** SA-CONTRIB-2015-005 - WikiWiki - SQL injection *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-005Project: WikiWiki (third-party module)Version: 6.xDate: 2015-January-07Security risk: 22/25 ( Highly Critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:AllVulnerability: SQL InjectionDescriptionWikiWiki module gives you one place to create, share and find wiki pages in your site.The module did not sanitize user input inside a database query thereby leading to a SQL Injection vulnerability.CVE identifier(s) issuedA CVE identifier will be requested, and --------------------------------------------- https://www.drupal.org/node/2403375

1 0

Tageszusammenfassung - Mittwoch 7-01-2015
by Daily end-of-shift report 07 Jan '15

07 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 05-01-2015 18:00 − Mittwoch 07-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Debunking Myths Around Industrial Control Systems Cybersecurity *** --------------------------------------------- General awareness for the need to improve cybersecurity in industrial control systems (ICS) has increased significantly in recent years, but there are still plenty of misconceptions. A recent incident that can be used to highlight... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/debunking-myths-around-i… *** Who's Attacking Whom? Realtime Attack Trackers *** --------------------------------------------- It seems nearly every day were reading about Internet attacks aimed at knocking sites offline and breaking into networks, but its often difficult to visualize this type of activity. In this post, well take a look at multiple services for tracking online attacks and attackers around the globe and in real-time. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/qZhz3RO9frg/ *** l+f: SSH mit Alu-Hut *** --------------------------------------------- Wer der NSA das Leben schwer machen will, kann das Fernwartungsprotokoll mit einigen Handgriffen auf der Kommandozeile abhärten. --------------------------------------------- http://www.heise.de/security/meldung/l-f-SSH-mit-Alu-Hut-2512471.html *** Inside Cryptowall 2.0 Ransomware *** --------------------------------------------- An analysis of Cryptowall 2.0 reveals that the ransomware relies on complex encryption routines and sandbox detection capabilities to survive. It also uses Tor for command and control, and can execute on 32- and 64-bit systems. --------------------------------------------- http://threatpost.com/inside-cryptowall-2-0-ransomware/110228 *** New Variant of Emotet Banking Malware targets German Users *** --------------------------------------------- A new Spam email campaign making the rounds in Germany are delivering a new variant of a powerful banking malware, a financial threat designed to steal users' online banking credentials, according to security researchers from Microsoft. The malware, identified as Emotet, was first spotted last June by security vendors at Trend Micro. The most standout features of Emotet is its network... --------------------------------------------- http://thehackernews.com/2015/01/emotet-banking-malware.html *** Linux DDoS Trojan hiding itself with an embedded rootkit *** --------------------------------------------- At the end of September 2014, a new threat for the Linux operating system dubbed XOR.DDoS forming a botnet for distributed denial-of-service attacks was reported ... In this blog post, we will describe the installation steps, the rootkit itself, and the communication protocol for getting attack commands. --------------------------------------------- https://blog.avast.com/2015/01/06/linux-ddos-trojan-hiding-itself-with-an-e… *** AOL Advertising Network Abused to Distribute Malware *** --------------------------------------------- Security researchers have uncovered a malvertising campaign used to distribute malware to visitors of The Huffington Post website, as well as several other sites, through malicious advertisements served over the AOL advertising network. At the end of last year, Cyphort Labs, security firm specialized in detecting malware threats, came across some malicious advertisements that were being --------------------------------------------- http://thehackernews.com/2015/01/aol-advertising-network-abused-to_6.html *** SPARTA - Network Infrastructure Penetration Testing Tool *** --------------------------------------------- SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase. It allows the tester to save time by having point-and-click access to his toolkit and by displaying all tool output in a convenient way. If little time is spent setting up commands and tools, more time can be spent focusing on analysing results. --------------------------------------------- http://hack-tools.blackploit.com/2015/01/sparta-network-infrastructure.html *** Malformed AndroidManifest.xml in Apps Can Crash Mobile Devices *** --------------------------------------------- Every Android app comprises of several components, including something called the AndroidManifest.xml file or the manifest file. This manifest file contains essential information for apps, "information the system must have before it can run any of the app's code." We came across a vulnerability related to the manifest file that may cause an affected device... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/malformed-androi… *** Interview with NYU-Poly's Professor Justin Cappos: Security Lessons From Retail Breaches *** --------------------------------------------- In our discussion, Professor Cappos has a lot to say about weaknesses with our current approach to password-based security as well as new technologies that can be applied to credit card transactions. ... Cappos offers some very practical advice on securing systems. --------------------------------------------- http://blog.varonis.com/conversation-nyu-polys-professor-justin-cappos-data… *** Is now the time to deploy embedded hypervisors for BYOD security? *** --------------------------------------------- The operating systems deployed on smartphones and tables, such as Apple IOS or Google Android, are designed as single-user platforms that dont offer much of the security or virtualization technology ... There are a number of approaches that seem viable to address the challenge including the following: ... Making enterprise or personal applications execute in a virtual machine that could either have sharply curtailed access to the device and the data it contains --------------------------------------------- http://www.zdnet.com/article/is-now-the-time-to-deploy-embedded-hypervisors… *** Spam Nation, book review: Inside todays cybercrime ecosystem *** --------------------------------------------- In Spam Nation, Krebs tells the tale of the Pharma Wars, in which duelling Russian spam kings squabble over territory, hacking each others systems, paying police to investigate each other. The even larger story is the economic conditions that fuel all this. Who clicks on these ads? --------------------------------------------- http://www.zdnet.com/article/spam-nation-book-review-inside-todays-cybercri… *** Twitter AnomalyDetection tool goes open source *** --------------------------------------------- Twitter has opened up suspicious activity tracker AnomalyDetection to developers. The social media giant said on Tuesday the tool, dubbed AnomalyDetection, is used by the firms team to detect unusual traffic events including traffic spikes and surges, as well as the presence of spam bots. --------------------------------------------- http://www.zdnet.com/article/twitter-anomalydetection-tool-goes-open-source/ *** CVE-2014-7911 - A Deep Dive Analysis of Android System Service Vulnerability and Exploitation *** --------------------------------------------- In this post we discuss CVE-2014-7911 and the various techniques that can be used to achieve privilege escalation. We also examine how some of these techniques can be blocked using several security mechanisms. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/cve-2014-7911-deep-dive-… *** The Connections Between MiniDuke, CosmicDuke and OnionDuke *** --------------------------------------------- In September, we blogged about CosmicDuke leveraging timely, political topics to deceive the recipient into opening the malicious document. After a more detailed analysis of the files we made two major discoveries. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002780.html *** DNS-Blacklist AHBL stellt Betrieb ein *** --------------------------------------------- Die DNS-Blacklist Abusive Hosts Blocking List (AHBL) stellt ihre Dienste endgültig ein. Wer sie befragt, erhält grundsätzlich einen Treffer als Antwort. Administratoren von Mailservern müssen jetzt handeln. --------------------------------------------- http://www.heise.de/newsticker/meldung/DNS-Blacklist-AHBL-stellt-Betrieb-ei… *** US-Cert warnt vor weiteren UEFI-BIOS-Lücken *** --------------------------------------------- Durch neue Lücken kann man die Schutzmechanismen abermals austricksen. Angreifer könnten so tief im System ein Bootkit verankern, dem kein Virenscanner etwas anhaben kann. Wieder sollen BIOS-Updates helfen. --------------------------------------------- http://www.heise.de/security/meldung/US-Cert-warnt-vor-weiteren-UEFI-BIOS-L… *** JSA10663 - Out of Cycle Security Bulletin: Multiple vulnerabilities in NTP *** --------------------------------------------- Product Affected: Junos OS, NSM Series devices, NSMXpress and NSM server software. | Problem: NTP.org has published a security advisory for six vulnerabilities resolved in ntpd (NTP daemon) that have been assigned four CVE IDs. In the worst case, some of these issues may allow remote unauthenticated attackers to execute code with the privileges of ntpd or cause a denial of service condition. --------------------------------------------- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10663 *** Open-Xchange XHTML File Input Validation Flaw Permits Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031488 *** Mantis BugTracker 1.2.17 XSS / DoS / Redirect *** --------------------------------------------- Topic: Mantis BugTracker 1.2.17 XSS / DoS / Redirect Risk: Medium Text:Mantis BugTracker 1.2.17 multiple security vulnerabilities. ****************************************************************... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010024 *** Open-Xchange Server 6 / OX AppSuite 7.6.1 Cross Site Scripting *** --------------------------------------------- Topic: Open-Xchange Server 6 / OX AppSuite 7.6.1 Cross Site Scripting Risk: Low Text:Product: Open-Xchange Server 6 / OX AppSuite Vendor: Open-Xchange GmbH Internal reference: 35512 (Bug ID) Vulnerability ty... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010020 *** DFN-CERT-2015-0005/ - ISC BIND: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- Eine Schwachstelle in BIND ermöglicht einem entfernten, nicht authentifizierten Angreifer einen Denial-of-Service-Zustand zu bewirken. Die Schwachstelle wird mit einem Update auf Version 9.9.6P1 für die SUSE Linux Enterprise 11 SP3 Produkte Software Development Kit, Server, Server für VMware und Desktop behoben. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0005/ *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM QRadar SIEM (CVE-2014-3567, CVE-2014-3568, CVE-2014-3508, CVE-2014-3511) *** --------------------------------------------- OpenSSL vulnerabilities were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by IBM QRadar SIEM. IBM QRadar SIEM has addressed the applicable CVEs. CVE(s): CVE-2014-3567 , CVE-2014-3568 , CVE-2014-3511 and CVE-2014-3508 ... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21691210 *** IBM Security Bulletin: Connect:Enterprise For UNIX and Connect:Enterprise clients are affected by the POODLE and OpenSSL vulnerabilities (CVE-2014-3566, CVE-2014-3567) *** --------------------------------------------- SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled in Connect:Enterprise For UNIX, Connect:Enterprise Command Line Client, Connect:Enterprise HTTP Option, and... --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21690537 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM InfoSphere Master Data Management (CVE-2014-3511, CVE-2014-3507, CVE-2014-3506, CVE-2014-3505 ) *** --------------------------------------------- OpenSSL vulnerabilities were disclosed on August 6th, 2014 by the OpenSSL Project. OpenSSL is used by IBM InfoSphere Master Data Management. IBM InfoSphere Master Data Management has addressed the applicable CVEs provided by OpenSSL. CVE(s):... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21691162 *** EMC Documentum Web Development Kit cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99632 *** EMC Documentum Web Development Kit weak security *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99636 *** Apache Traffic Server HttpTransact Boundary Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031499 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Operational Decision Manager, WebSphere ILOG JRules and WebSphere Business Events (CVE-2014-6506, CVE-2014-6511, CVE-2014-6457, CVE-2014-6558, CVE-2014-3065) *** --------------------------------------------- There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 and 7 that is used by IBM Operational Decision Manager (ODM), IBM ILOG JRules and IBM WebSphere Business Events (WBE). These issues were disclosed as part of the IBM... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21693686 *** DFN-CERT-2015-0012 - Xen: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- Eine Use-after-Free-Schwachstelle in Xen ermöglicht einem lokalen, nicht authentifizierten Angreifer Denial-of-Service-Angriffe durchzuführen. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0012/ *** DFN-CERT-2015-0013 - Exiv2: Eine Schwachstelle ermöglicht Denial-of-Service-Angriffe *** --------------------------------------------- Ein entfernter, nicht authentisierter Angreifer kann durch einen langen 'IKEY INFO Tag' Wert in einer AVI-Datei einen Absturz der Anwendung verursachen. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0013/ *** ZDI-15-006: ManageEngine Desktop Central MSP StatusUpdateServlet fileName File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-006/

1 0

Tageszusammenfassung - Montag 5-01-2015
by Daily end-of-shift report 05 Jan '15

05 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 02-01-2015 18:00 − Montag 05-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Before you enable those macros... *** --------------------------------------------- The Microsoft Malware Protection Center (MMPC) has recently seen an increasing number of threats using macros to spread their malicious code. This technique uses spam emails and social engineering to infect a system. Using macros in Microsoft Office can help increase productivity by automating some processes. However, malware authors have also exploited these capabilities. Since Microsoft set the default setting to "Disable all macros with notification", the number of macro-related... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/01/02/before-you-enable-those-… *** OpenSSL Cookbook *** --------------------------------------------- A short book that covers the most frequently used OpenSSL features and commands, by Ivan Ristić. OpenSSL Cookbook is a free ebook built around one chapter from Bulletproof SSL and TLS, a larger work that teaches how to deploy secure servers and web applications. --------------------------------------------- https://www.feistyduck.com/books/openssl-cookbook/ *** Defensible network architecture, (Mon, Jan 5th) *** --------------------------------------------- For the nearly 20 years since Zwicky, Cooper and Chapman first wrote about Firewalls the firewall has been the primary defense mechanism of nearly every entity attached to the Internet. While perimeter protection is still important in the modern enterprise, the fact is that the nature of Internet business has vastly changed and the crunchy perimeter and squishy inside approach has long since become outdated. You can two aspects of your business model that you cannot do without and which can give... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19141&rss *** Snooker WPA secrets with this WiFi tool *** --------------------------------------------- Jammed and canned Crypto geek George Chatzisofroniou has published a WiFi social engineering tool used to steal credentials and credit cards from users of secure wireless networks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/05/snooker_wpa… *** Hard disk hacking *** --------------------------------------------- ... Research like this has been done before for various bits of hardware: from PCI extension cards to embedded controllers in laptops to even Apple keyboards. Usually the research has been done in order to prove the hackability of these devices can lead to compromised software, so I decided to take the same approach: for this hack, I wanted to make a hard disk that could bypass software security. --------------------------------------------- http://spritesmods.com/?art=hddhack&page=1 *** Sicherheitslücke: Bitcoinbörse Bitstamp stellt vorerst Betrieb ein *** --------------------------------------------- Schon wieder eine Bitcoinbörse gehackt? Der Anbieter Bitstamp ist wegen einer kompromittierten Wallet fürs erste offline gegangen. Nutzer sollten keinesfalls Coins auf alte Einzahladressen überweisen. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-Bitcoinboerse-Bitsta… *** Several Electronic Arts Origin accounts hacked *** --------------------------------------------- Many gamers are finding purchases that they never made their accounts for Electronic Arts Origin service. Once again the gaming industry under attack. --------------------------------------------- http://securityaffairs.co/wordpress/31799/cyber-crime/electronic-arts-origi… *** Active Directory Recycle Bin: What is it, and how can I use it? *** --------------------------------------------- Remember the Windows 95 Recycle Bin? It was a big leap forward to recovering "deleted" files. Well, it turns out that Active Directory has it's own Recycle Bin for users, groups and computers, and it's called... wait for it.. the Active Directory Recycle Bin. Here's the good news about the Active Directory Recycle bin:... --------------------------------------------- http://blog.beyondtrust.com/active-directory-recycle-bin-what-is-it-and-how… *** Openwall 3.1 Released With Fixes for Shellshock, POODLE Attack *** --------------------------------------------- The maintainers of the Openwall security enhanced Linux distribution have released a new stable version, which includes fixes for a number of serious vulnerabilities, such as the Shellshock Bash bug and the flaw in SSLv3 that leads to the POODLE attack. Openwall is designed to be a small, compact Linux distribution for servers, appliances and... --------------------------------------------- http://threatpost.com/openwall-3-1-released-with-fixes-for-shellshock-poodl… *** ASUSWRT 3.0.0.4.376_1071 LAN Backdoor Command Execution *** --------------------------------------------- Topic: ASUSWRT 3.0.0.4.376_1071 LAN Backdoor Command Execution Risk: High Text:#!/usr/bin/env python3 # Exploit Title: ASUSWRT 3.0.0.4.376_1071 LAN Backdoor Command Execution # Date: 2014-10-11 # Vend... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010009 *** USN-2450-1: strongSwan vulnerability *** --------------------------------------------- Ubuntu Security Notice USN-2450-15th January, 2015 | strongswan vulnerability | A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.10 Ubuntu 14.04 LTS | Summary | strongSwan could be made to crash or run programs if it received specially crafted network traffic. | Software description | strongswan - IPsec VPN solution | Details | Mike Daskalakis discovered that strongSwan incorrectly handled IKEv2payloads that contained the Diffie-Hellman group 1025. A remote attackercould use this... --------------------------------------------- http://www.ubuntu.com/usn/usn-2450-1/ *** VU#976132: Some UEFI systems do not properly secure the EFI S3 Resume Boot Path boot script *** --------------------------------------------- Vulnerability Note VU#976132 Some UEFI systems do not properly secure the EFI S3 Resume Boot Path boot script Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview Some UEFI systems fail to properly restrict access to the boot script used by the EFI S3 Resume Boot Path, allowing an authenticated, local attacker to bypass various firmware write protections. Description According to Rafal Wojtczuk and Corey Kallenberg of The MITRE Corporation:"During the UEFI S3 Resume... --------------------------------------------- http://www.kb.cert.org/vuls/id/976132 *** VU#766164: Intel BIOS locking mechanism contains race condition that enables write protection bypass *** --------------------------------------------- Vulnerability Note VU#766164 Intel BIOS locking mechanism contains race condition that enables write protection bypass Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview A race condition exists in Intel chipsets that rely solely on the BIOS_CNTL.BIOSWE and BIOS_CNTL.BLE bits as a BIOS write locking mechanism. Successful exploitation of this vulnerability may result in a bypass of this locking mechanism. Description CWE-362: Concurrent Execution using Shared Resource with... --------------------------------------------- http://www.kb.cert.org/vuls/id/766164 *** VU#533140: UEFI EDK1 vulnerable to buffer overflow *** --------------------------------------------- Vulnerability Note VU#533140 UEFI EDK1 vulnerable to buffer overflow Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview The EDK1 UEFI reference implementation contains a buffer overflow vulnerability. Description The open source EDK1 project provides a reference implementation of the Unified Extensible Firmware Interface (UEFI). Commercial UEFI implementations may incorporate portions of the EDK1 source code.According to Rafal Wojtczuk and Corey Kallenberg, a buffer... --------------------------------------------- http://www.kb.cert.org/vuls/id/533140

1 0

Tageszusammenfassung - Freitag 2-01-2015
by Daily end-of-shift report 02 Jan '15

02 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 30-12-2014 18:00 − Freitag 02-01-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Miss a talk from the 31st CCC this year? No worries - theyre all already available online. (Reddit) *** --------------------------------------------- http://www.reddit.com/r/netsec/comments/2qvuog/miss_a_talk_from_the_31st_cc… *** Wordpress 4.1 XSS & CSRF Web Vulnerability *** --------------------------------------------- The Hackyard Security Group Researcher-Team leaded by 0x0A discovered a cross site request forgery issue and a cross site vulnerability in the Wordpress 4.1 --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120203 *** Log Analysis for Web Attacks: A Beginner's Guide *** --------------------------------------------- It is often the case that web applications face suspicious activities due to various reasons, such as a kid scanning a website using an automated vulnerability scanner or a person trying to fuzz a parameter for SQL Injection, etc. In many such cases, logs on the webserver have to the webserver have to be analyzed to figure out what is going on. If it is a serious case, it may require a forensic investigation. Apart from this, there are other scenarios as well. --------------------------------------------- http://resources.infosecinstitute.com/log-analysis-web-attacks-beginners-gu… *** Google Researcher Publishes Unpatched Windows 8.1 Security Vulnerability *** --------------------------------------------- An anonymous reader writes "Googles security research database has after a 90 day timeout automatically undisclosed a Windows 8.1 vulnerability which Microsoft hasnt yet patched. By design the system call NtApphelpCacheControl() in ahcache.sys allows application compatibility data to be cached for quick reuse when new processes are created. A normal user can query the cache but cannot add new cached entries as the operation is restricted to administrators. This is checked in the function --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/Q5qBW3crGPY/story01.htm *** 2014 Website Defacements *** --------------------------------------------- Defacements are the most visual and obvious hack that a website can suffer from. They also come parcelled with their own exquisite sense of dread. Nothing gives that gut-wrenching feeling of "I've been hacked" more than seeing this: Most malware that we see on a daily basis is driven by some desire to profit offRead More --------------------------------------------- http://blog.sucuri.net/2015/01/website-hacks-defacements-2014.html *** Spamhaus Botnet Summary 2014 *** --------------------------------------------- As 2014 ends, Spamhaus reviews the botnet threats that it detected in the past year, and provides facts and useful suggestions for ISPs and web hosts on the front lines of the battle against cybercrime. To nobodys surprise, botnet activity appears to be increasing. The majority of detected botnets are targeted at obtaining and exploiting banking and financial information. Botnet controllers (C&Cs) are hosted disproportionately on ISPs with understaffed abuse departments, inadequate abuse --------------------------------------------- http://www.spamhaus.org/news/article/720/spamhaus-botnet-summary-2014 *** Phil Zimmerman (PGP), Ladar Levison (Lavabit), & Team release Secure Email Protocol DIME *** --------------------------------------------- Full specs here: https://darkmail.info/downloads/dark-internet-mail-environment-december-201… (PDF) Full source code (libraries) here: https://github.com/lavabit/ Website: http://darkmail.info/ --------------------------------------------- http://www.reddit.com/r/netsec/comments/2qu2er/phil_zimmerman_pgp_ladar_lev… *** Trojan-horse hardware - a student prank demonstrates how easy it is to substitute a PIC for a dumb logic chip (Reddit) *** --------------------------------------------- http://www.reddit.com/r/netsec/comments/2r3cfs/trojanhorse_hardware_a_stude… *** Introduction to RFID Security *** --------------------------------------------- The main problem with RFID is related to its frequency. Someone with specific tools and enough knowledge on RFID (including complete documentation) could analyze the working frequency of an RFID tag and then decode the data or perform an attack such as cloning the RFID or doing a Denial-of-Service attack. --------------------------------------------- http://resources.infosecinstitute.com/introduction-rfid-security/ *** Hackers claim theyve found a frighteningly easy way to hack your iCloud account (Yahoo Security) *** --------------------------------------------- ... a hacker known as Pr0x13 has released a tool called iDict on GitHub that is capable of bypassing restrictions and authentication on any iCloud account, potentially giving hackers unfettered access to iOS devices. --------------------------------------------- http://news.yahoo.com/hackers-claim-ve-found-frighteningly-easy-way-hack-15…

1 0

Tageszusammenfassung - Dienstag 30-12-2014
by Daily end-of-shift report 30 Dec '14

30 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 29-12-2014 18:00 − Dienstag 30-12-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Can malware and hackers really cause giant physical disasters? *** --------------------------------------------- Could you really have a hacker or malware initiated meltdown? Yes, says the 2014 report of the German Office for Information Security... --------------------------------------------- https://nakedsecurity.sophos.com/2014/12/29/can-malware-and-hackers-really-… *** Will 2015 be the year we finally do something about DDoS? *** --------------------------------------------- Among the events of the past few days during the holidays was a DDoS attack on Sonys Playstation network and on Xbox Lives network. The attack was reportedly carried out by a group called Lizard Squad and by all measures is not .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19127 *** WhyDoWork AdSense 1.2 - XSS and CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7733 *** Open Season on VNC Servers Around the World *** --------------------------------------------- VNC, or Virtual Network Computing, is a way to control computers remotely across a network. Often times computers running VNC servers are on internal networks with firewalls protecting them from outside users. No one wants a malicious user to remotely connect to their computer and have their way with their computer, right? --------------------------------------------- https://medium.com/@kylestev/open-season-on-vnc-servers-around-the-world-4b… *** Stallman: Freie Software ist die Basis für IT-Sicherheit *** --------------------------------------------- Der Vater der Freien-Software-Gemeinde, Richard Stallman, hat auf dem 31C3 freie Software zum 'notwendigen Fundament der Cybersicherheit' erklärt. Proprietäre Programme entwickelten sich immer mehr zu Malware. --------------------------------------------- http://www.heise.de/security/meldung/Stallman-Freie-Software-ist-die-Basis-… *** Expect more ransomware and extortionware in 2015 *** --------------------------------------------- While we can expect to see the return of some of the issues we faced in 2014, there are still a number of new threats that we need to be aware of in the year to come. --------------------------------------------- http://www.scmagazine.com/expect-more-ransomware-and-extortionware-in-2015/… *** 31C3: Wie man ein Chemiewerk hackt *** --------------------------------------------- Die Sicherheit von Industrieanlagen wird oft beschworen, die Praxis lässt aber viel zu wünschen übrig. Beim CCC-Congress in Hamburg zeigten Hacker, wie man Industrieanlagen lahmlegen und Millionenschäden verursachen kann. --------------------------------------------- http://www.heise.de/security/meldung/31C3-Wie-man-ein-Chemiewerk-hackt-2507… *** Researchers Find 64-bit Version of Havex RAT *** --------------------------------------------- Trend Micro researchers have come across a 64-bit version of Havex, a remote access tool that has been used in cyber espionage campaigns aimed at industrial control systems. --------------------------------------------- http://www.securityweek.com/researchers-find-64-bit-version-havex-rat *** Save Our Souls (SOS) *** --------------------------------------------- Natural disasters are unexpected events that can cause severe financial and environmental loss as well as the loss of human life. As an enterprise, it is our responsibility to ensure that proper recovery strategies are in place, just .. --------------------------------------------- http://resources.infosecinstitute.com/save-souls-sos/ *** Sicherheit: BKA schaltet Botnetz mit tausenden Rechnern ab *** --------------------------------------------- Mehr als die Hälfte der Rechner eines vom BKA zerschlagenen Botnetzes sollen in Deutschland gestanden haben. In Zusammenarbeit mit dem BSI, dem Fraunhofer Institut und Antivirenherstellern wurden die betroffenen Nutzer informiert. --------------------------------------------- http://www.golem.de/news/sicherheit-bka-schaltet-botnetz-mit-tausenden-rech… *** 4G Security: Hacking USB Modem and SIM Card via SMS *** --------------------------------------------- Telecommunications operators are pushing fast and cheap 4G communications technology. Yet only the chosen few know just how insecure it is. While researching the security level of 4G communications, Positive Technologies experts managed to uncover USB modem vulnerabilities that allow a potential attacker to gain full control of the connected computer as .. --------------------------------------------- http://blog.ptsecurity.com/2014/12/4g-security-hacking-usb-modem-and-sim.ht… Next End-of-Shift report on 2015-01-02

1 0

Tageszusammenfassung - Montag 29-12-2014
by Daily end-of-shift report 29 Dec '14

29 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 23-12-2014 18:00 − Montag 29-12-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** DSA-3110 mediawiki - security update *** --------------------------------------------- A flaw was discovered in mediawiki, a wiki engine: thumb.php outputswikitext messages as raw HTML, potentially leading to cross-sitescripting (XSS). --------------------------------------------- https://www.debian.org/security/2014/dsa-3110 *** Multiple vulnerabilities in Info-ZIP UnZip *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99371 http://xforce.iss.net/xforce/xfdb/99373 http://xforce.iss.net/xforce/xfdb/99372 *** Evolution of Banking Malwares *** --------------------------------------------- Why are malware authors so interested in banking malware? Simply because this is where the money is! Nowadays, banking malware, specifically banking Trojans, are reaching alarming new levels of sophistication. Each day, new names .. --------------------------------------------- http://resources.infosecinstitute.com/evolution-banking-malwares-part-1/ http://resources.infosecinstitute.com/evolution-banking-malwares-part-2/ *** New Malware Campaign - WPcache-Blogger - Affects Thousands more WordPress Websites via RevSlider *** --------------------------------------------- If SoakSoak wasn't enough, we are starting to see a new malware campaign leveraging the RevSlider vulnerability and compromising thousands of WordPress sites in the last few days. --------------------------------------------- http://blog.sucuri.net/2014/12/new-malware-campaign-wpcache-blogger-affects… *** IBM Security AppScan Enterprise Bugs Let Remote Users Conduct Cross-Site Scrpting Attacks and Gain Full Control of the Target System *** --------------------------------------------- Several vulnerabilities were reported in IBM Security AppScan Enterprise. A remote user can execute arbitrary code on the target system. A remote authenticated user can execute arbitrary code on the target system. A remote user can conduct cross-site scripting attacks. --------------------------------------------- http://www.securitytracker.com/id/1031427 *** Multiple vulnerabilities in IPCop *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99397 http://xforce.iss.net/xforce/xfdb/99396 http://xforce.iss.net/xforce/xfdb/99398 *** ICANN: Phishing-Angriff keine Gefahr für die Rootzone *** --------------------------------------------- Von dem in der vergangenen Woche bekannt gewordenen Phishing-Angriff auf die ICANN ging keine Gefahr für die Sicherheit der Rootzone aus, versichert die Internetverwaltung. Dennoch könnte der Vorfall der ICANN politisch schaden. --------------------------------------------- http://www.heise.de/security/meldung/ICANN-Phishing-Angriff-keine-Gefahr-fu… *** ISC.org website hacked: Scan your PC for malware if you stopped by *** --------------------------------------------- Cryptographically signed BIND, DHCP code safe, were told The website for the Internet Systems Consortium, which develops the BIND DNS and ISC DHCP tools and runs some DNS root servers, has been hacked. --------------------------------------------- http://www.theregister.co.uk/2014/12/26/isc_org_hacked/ *** Vawtrak challenges almighty ZeuS as king of the botnets (The Register) *** --------------------------------------------- Crooks behind Vawtrak, a dangerous banking Trojan, are ramping up its reach and sophistication, security firms have warned. Vawtrak currently .. --------------------------------------------- http://www.theregister.co.uk/2014/12/27/vawtrak_challenges_almighty_zeus_as… *** Online-Banking und SS7-Hack: SMS-TANs sind unsicher *** --------------------------------------------- Gleich drei Vorträge am ersten Tag des jährlichen Chaos-Kongresses widmen sich Hacks rund um Mobilfunkstandards. Bereits jetzt ist klar: Sicherheitsanwendungen, die auf SMS setzen, werden unbrauchbar. Der gute alte TAN-Zettel aus Papier dürfte mehr Sicherheit bieten. --------------------------------------------- http://www.golem.de/news/online-banking-und-ss7-hack-sms-tans-sind-unsicher… *** Wieso ein Foto ausreicht, um Fingerabdruckscanner auszutricksen *** --------------------------------------------- Wissenschaftler verwendeten Foto von Händen der deutschen Verteidigungsministerin um Fingerabdruck-Attrappe zu erstellen --------------------------------------------- http://derstandard.at/2000009814288 *** Honey Pot Entertainment - SSH, (Sat, Dec 27th) *** --------------------------------------------- The Christmas period is a nice time to play with some honeypots and share some of the info they have been collecting. Currently I only have two functioning, both of them are located in the US. Each receives 20K or more login attempts per day. Im using a standard kippo installation, running as a non root user and using authbindto run the honeypoton port 22. Results are sent to a logging server for collection. One of the honeypots has no valid password so it will always fail Im mainly interested --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19121&rss *** 31C3: Thunderstrike greift MacBooks über Thunderbolt an *** --------------------------------------------- Über eine EFI-Schwachstelle lässt sich die Firmware von MacBooks manipulieren. Einmal infiziert,lässt sich der Schädling nicht einmal durch den Austausch der Festplatte entfernen. --------------------------------------------- http://www.heise.de/security/meldung/31C3-Thunderstrike-greift-MacBooks-ueb… *** C-Programmierung: Schutz für Code Pointer *** --------------------------------------------- Bugs in der Speicherverwaltung von C-Programmen gehören zu den häufigsten Sicherheitslücken. Da es aussichtslos sein dürfte, alle Lücken zu beheben, hat Mathias Prayer eine Strategie vorgestellt, mit der sich die meisten verhindern lassen. --------------------------------------------- http://www.golem.de/news/c-programmierung-schutz-fuer-code-pointer-1412-111… *** Rocket Kitten: Die Geschichte einer Malware-Analyse *** --------------------------------------------- Mit der Analyse von Malware für eine großflächige Spearphising-Attacke konnten Datenexperten die Angreifer enttarnen. In detektivischer Kleinarbeit haben sie dabei ausgefeilte Komponenten aufgedeckt und ein Land hinter dem Angriff ausgemacht. --------------------------------------------- http://www.golem.de/news/rocket-kitten-die-geschichte-einer-malware-analyse… *** Bots übernehmen Herrschaft über das Internet *** --------------------------------------------- 56 Prozent aller Webseitenbesuche nicht mehr von Menschen – Zunahme an gefährlichen Algorithmen --------------------------------------------- http://derstandard.at/2000009572838 *** Directory traversal vulnerabilities in multiple Wordpress themes *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99444 http://xforce.iss.net/xforce/xfdb/99452 http://xforce.iss.net/xforce/xfdb/99449 http://xforce.iss.net/xforce/xfdb/99447 http://xforce.iss.net/xforce/xfdb/99445 *** Massive Sicherheitslücken bei Kredit- und Bankomatkarten enthüllt *** --------------------------------------------- IT-Sicherheitsforscher zeigen am 31C3, dass Systeme trotz PIN einfach zu knacken sind .. --------------------------------------------- http://derstandard.at/2000009849645 *** Null Byte Injection in PHP *** --------------------------------------------- The null character is a control character with the value zero. It is presented in many character sets such as ASCII (American Standard Code of for Information Interchange), Unicode (Universal Character Set) and EBCDIC .. --------------------------------------------- http://resources.infosecinstitute.com/null-byte-injection-php/ *** Lücken in Industrieanlagen: Nicht nur Banken und Webseiten sollen verteidigt werden *** --------------------------------------------- Hacker sollen sich nicht mehr um die Sicherheit des Geldes und Daten von anderen kümmern. Stattdessen gilt es, den Fokus auf Industrieanlagen zu richten, auch, um Menschenleben zu schützen. (31C3, Netzwerk) --------------------------------------------- http://www.golem.de/news/luecken-in-industrieanlagen-nicht-nur-banken-und-w… *** Prying Eyes: Inside the NSAs War on Internet Security *** --------------------------------------------- US and British intelligence agencies undertake every effort imaginable to crack all types of encrypted Internet communication. The cloud, it seems, is full of holes. The good news: New Snowden documents show that some forms of encryption still cause problems for the NSA. --------------------------------------------- http://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-interne…

1 0

Tageszusammenfassung - Dienstag 23-12-2014
by Daily end-of-shift report 23 Dec '14

23 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 22-12-2014 18:00 − Dienstag 23-12-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco Jabber Guest Server *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SoakSoak Campaign Evolves - New Wave of Attacks *** --------------------------------------------- Since Sunday, we have seen a new wave of SoakSoak reinfections. The Javascript continues to evolve and load other scripts in order to infect additional websites. We have updates for concerned webmasters looking to stay on top of the threat and .. --------------------------------------------- http://blog.sucuri.net/2014/12/soaksoak-new-wave-evolution-attacks.html *** Apache CXF Certificate Validation Flaw Lets Remote Users Spoof SSL Servers *** --------------------------------------------- Apache CXF Certificate Validation Flaw Lets Remote Users Spoof SSL Servers. A remote user with the ability to conduct a man-in-the-middle attack can supply a specially crafted host name in an X.509 certificate subject's .. --------------------------------------------- http://www.securitytracker.com/id/1031419 *** Multiple vulnerabilities in VDG products *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99331 http://xforce.iss.net/xforce/xfdb/99334 http://xforce.iss.net/xforce/xfdb/99333 http://xforce.iss.net/xforce/xfdb/99332 *** Anunak: So geht Bankraub im 21. Jahrhundert *** --------------------------------------------- Die Security-Spezialisten von Fox-IT und Group-IB dokumentieren die Aktivitäten einer russischen Bande, die in die Netze von Banken eingebrochen ist und von dort aus Geldautomaten ausgeräumt hat. Rund 25 Millionen Dollar haben die so geklaut. --------------------------------------------- http://www.heise.de/security/meldung/Anunak-So-geht-Bankraub-im-21-Jahrhund… *** Top Facebook scams and malware attacks *** --------------------------------------------- Millions of people fell for Facebook scams in 2014. Though security experts, companies and tech-savvy users guard against Facebook cyber attacks, many unwary users continue to fall victim to scams on ... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2935 *** BSI-Kryptohandys: Kaum Anschluss unter dieser Nummer *** --------------------------------------------- Die Geräte sind angeblich sehr sicher und gewiss sehr teuer. Doch weil die vom BSI zertifizierten Kryptohandys viele Nachteile haben, liegen sie häufig in den Schubladen. Muss das so sein? --------------------------------------------- http://www.golem.de/news/bsi-kryptohandys-kaum-anschluss-unter-dieser-numme… *** NTP Daemon unter OS X: Kurzfristiges Update schließt Zeitserver-Sicherheitslücke *** --------------------------------------------- Apple hat ein Sicherheitsupdate für OS X veröffentlicht, das jeder installieren sollte. Geschlossen wird damit eine unangenehme Sicherheitslücke im Dienst für das Network Time Protocol. --------------------------------------------- http://www.golem.de/news/ntp-daemon-unter-os-x-kurzfristiges-update-schlies… *** Linux-Kernel: Live Patching soll im Frühjahr 2015 bereitstehen *** --------------------------------------------- Die Kernel-Entwickler wollen die Live-Patching-Technik mit Linux 3.20 im kommenden Frühjahr veröffentlichen. Zuvor soll der Code in Linux-Next aufgenommen werden. Ob dies tatsächlich geschieht, steht noch aus. --------------------------------------------- http://www.golem.de/news/linux-kernel-live-patching-soll-im-fruehjahr-2015-… *** Patches Not Cure-all for Shellshock *** --------------------------------------------- Earlier this year, Linux system administrators all over the world had to deal with the Shellshock vulnerability, which could lead to malicious code being run on Linux systems. Servers running various web services were at particular risk. By now, most major distributions have been able to .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/patches-not-cure… Next End-of-Shift report on 2014-12-29

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily