Daily

daily@lists.cert.at

1 participants
3085 discussions

Tageszusammenfassung - Freitag 21-11-2014
by Daily end-of-shift report 21 Nov '14

21 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 20-11-2014 18:00 − Freitag 21-11-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Rich Telemetry for Cyber Incident Response and Malicious Code Analysis on Microsoft Windows *** --------------------------------------------- 5..4..3..2..1..launch Earlier this week we launched the first product from the research and development efforts of the NCC Group Security Labs team. NCC Group Security Labs is a combined centre within NCC Group which brings together experts from Security Technical Assurance, Security Research, Cyber Defence Operations and Security Software Development to work on innovative software solutions for real-world cyber security problems. The Problem The world of Cyber Defence Operations involves, in... --------------------------------------------- https://www.nccgroup.com/en/blog/2014/11/rich-telemetry-for-cyber-incident-… *** Securing Personal Data: ENISA guidelines on Cryptographic solutions *** --------------------------------------------- ENISA is launching two reports today. The “Algorithms, key size and parameters” report of 2014 is a reference document providing a set of guidelines to decision makers, in particular specialists designing and implementing cryptographic solutions for personal data protection within commercial organisations or governmental services for citizens. The “Study on cryptographic protocols” provides an implementation perspective, covering guidelines regarding protocols required to protect commercial online communications containing personal data. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/securing-personal-data-enis… *** Weekly Metasploit Wrapup: Exploiting Mobile Security Software *** --------------------------------------------- Exploiting Security Software: Android Edition --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/11/21/weekly-me… *** VB2014 paper: Sweeping the IP space: the hunt for evil on the Internet *** --------------------------------------------- Dhia Mahjoub explains how the topology of the AS graph can be used to uncover hotspots of maliciousness.Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added Sweeping the IP space: the hunt for evil on the Internet by OpenDNS researcher Dhia Mahjoub.The Internet is often described as a network of networks. These individual networks are called Autonomous Systems (AS): collections of IPv4 and IPv6 network... --------------------------------------------- http://www.virusbtn.com/blog/2014/11_21.xml?rss *** WordPress 4.0.1 Update Patches Critical XSS Vulnerability *** --------------------------------------------- The latest version of WordPress, 4.0.1, patches a critical cross-site scripting vulnerability in comment fields that enables admin-level control over a website. --------------------------------------------- http://threatpost.com/wordpress-4-0-1-update-patches-critical-xss-vulnerabi… *** The Internet of Things (IoT) will fail if security has no context *** --------------------------------------------- The Internet of Things requires a new way of thinking and acting, one that will protect a business and help it grow. --------------------------------------------- http://www.scmagazine.com/the-internet-of-things-iot-will-fail-if-security-… *** Detekt - Free Anti-Malware Tool To Detect Govt. Surveillance Malware *** --------------------------------------------- Human rights experts and Privacy International have launched a free tool allowing users to scan their computers for surveillance spyware, typically used by governments and other organizations to spy on human rights activists and journalists around the world. This free-of-charge anti-surveillance tool, called Detekt, is an open source software app released in partnership with Human rights... --------------------------------------------- http://thehackernews.com/2014/11/detekt-free-anti-malware-tool-to-detect_20… *** Most Targeted Attacks Exploit Privileged Accounts *** --------------------------------------------- Most targeted attacks exploit privileged account access according to a new report commissioned by the security firm CyberArk. --------------------------------------------- http://threatpost.com/most-targeted-attacks-exploit-privileged-accounts/109… *** Security Advisory - High severity - WP-Statistics WordPress Plugin *** --------------------------------------------- Advisory for: WordPress WP-Statistics Plugin Security Risk: High (DREAD score : 7/10) Exploitation level: Easy/Remote Vulnerability: Stored XSS which executes on the administration panel. Patched Version: 8.3.1 If you're using the WP-Statistics WordPress plugin on your website, now is the time to update. While doing a routine audit for our Website Firewall product, we discovered... --------------------------------------------- http://blog.sucuri.net/2014/11/security-advisory-high-severity-wp-statistic… *** Splunk Enterprise versions 6.0.7 and 5.0.11 address three vulnerabilities *** --------------------------------------------- Description Splunk Enterprise versions 6.0.7 and 5.0.11 address three vulnerabilities OpenSSL session ticket memory leak (SPL-91947, CVE-2014-3567) TLS protocol enhancements related to POODLE (SPL-92062,CVE-2014-3566) Persistent cross-site scripting (XSS) via Dashboard (SPL-89216, CVE-2014-5466) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on our Splunk Product... --------------------------------------------- http://www.splunk.com/view/SP-CAAANST *** GNU C Library wordexp() command execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98852 *** PCRE pcre_exec.c buffer overflow *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98854 *** Multiple Huawei HiLink products cross-site request forgery *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98858 *** Asterisk DB Dialplan Function Lets Remote Authenticated Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031251 *** Asterisk CONFBRIDGE Lets Remote Authenticated Users Execute Arbitrary System Commands *** --------------------------------------------- http://www.securitytracker.com/id/1031250 *** Asterisk ConfBridge State Transition Error Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031247 *** Asterisk PJSIP Channel Driver Flaw in res_pjsip_refer Module Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031249 *** Asterisk PJSIP Channel Driver Race Condition Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031248 *** Asterisk PJSIP ACL Bug Lets Remote Users Bypass Access Controls *** --------------------------------------------- http://www.securitytracker.com/id/1031246 *** HPSBHF03052 rev.2 - HP Network Products running OpenSSL, Multiple Remote Vulnerabilities *** --------------------------------------------- Version:1 (rev.1) - 20 June 2014 Initial release Version:2 (rev.2) - 20 November 2014 Removed iMC Platform Products, 5900 virtual switch, and Router 8800 products. Further analysis revealed that those products as not vulnerable. Added additional products. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04347622 *** ZDI-14-385: Dell Sonicwall GMS Virtual Appliance Multiple Remote Code Execution Vulnerabilities *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Dell SonicWALL Global Management System (GMS) virtual appliance. Authentication is required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-385/

1 0

Tageszusammenfassung - Donnerstag 20-11-2014
by Daily end-of-shift report 20 Nov '14

20 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 19-11-2014 18:00 − Donnerstag 20-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** ROVNIX Infects Systems with Password-Protected Macros *** --------------------------------------------- We recently found that the malware family ROVNIX is capable of being distributed via macro downloader. This malware technique was previously seen in the DRIDEX malware, which was notable for using the same routines. DRIDEX is also known as the successor of the banking malware CRIDEX. Though a fairly old method for infection, cybercriminals realized that using malicious macros work... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/0rtiBt3T3E4/ *** Citadel Variant Targets Password Managers *** --------------------------------------------- Some Citadel-infected computers have received a new configuration file, a keylogger triggered to go after the master passwords from three leading password management tools. --------------------------------------------- http://threatpost.com/citadel-variant-targets-password-managers/109493 *** CryptoPHP: Analysis of a hidden threat inside popular content management systems *** --------------------------------------------- CryptoPHP is a threat that uses backdoored Joomla, WordPress and Drupal themes and plug-ins to compromise webservers on a large scale. By publishing pirated themes and plug-ins free for anyone to use instead of having to pay for them, the CryptoPHP actor is social engineering site administrators into installing the included backdoor on their server. --------------------------------------------- http://blog.fox-it.com/2014/11/18/cryptophp-analysis-of-a-hidden-threat-ins… *** An inside look: gathering and analyzing the SIR data *** --------------------------------------------- At the Microsoft Malware Protection Center, threat data is a critical source of information to help protect our customers. We use it to understand what's going on in the overall malware ecosystem, determine the best way to protect our customers, and find the most effective way to deliver that protection. We also use the data to produce a number of reports to help our customers. This includes our bi-annual Security Intelligence Report (SIR). This blog post gives you a behind-the-scenes... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/11/19/an-inside-look-gathering… *** Annual Privacy Forum 2014 materials and APF2015 - Call for partnership *** --------------------------------------------- ENISA's Information Security and Data Protection Unit announces the commencement of preparations for the Annual Privacy Forum of 2015. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/annual-privacy-forum-2014-mater… *** Electronic Arts: Datenpanne bei Origin *** --------------------------------------------- Einblicke in persönliche Daten von anderen Nutzern zeigt derzeit Origin, das Onlineportal von Electronic Arts, beim Zugriff auf die Foren an. --------------------------------------------- http://www.golem.de/news/electronic-arts-datenpanne-bei-origin-1411-110689-… *** How Splitting A Computer Into Multiple Realities Can Protect You From Hackers *** --------------------------------------------- Eight years ago, polish hacker Joanna Rutkowska was experimenting with rootkits - tough-to-detect spyware that infects the deepest level of a computer's operating system - when she came up with a devious notion: What if, instead of putting spyware inside a victim's computer, you put the victim's computer inside the spyware? At the time, a technology known... --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/40ab9794/sc/4/l/0L0Swired0N0C20A1… *** Vulnerabilities identified in three Advantech products *** --------------------------------------------- Researchers with Core Security have identified vulnerabilities in three products manufactured by Advantech, some of which can be exploited remotely. --------------------------------------------- http://www.scmagazine.com/vulnerabilities-identified-in-three-advantech-pro… *** Bugtraq: [CORE-2014-0009] - Advantech EKI-6340 Command Injection *** --------------------------------------------- http://www.securityfocus.com/archive/1/534021 *** Bugtraq: [CORE-2014-0008] - Advantech AdamView Buffer Overflow *** --------------------------------------------- http://www.securityfocus.com/archive/1/534022 *** Bugtraq: [CORE-2014-0010] - Advantech WebAccess Stack-based Buffer Overflow *** --------------------------------------------- http://www.securityfocus.com/archive/1/534023 *** Drupal Patches Denial of Service Vulnerability; Details Disclosed *** --------------------------------------------- Drupal has released a patched a denial of service and account hijacking vulnerability, details of which were disclosed by the researchers who discovered the issue. --------------------------------------------- http://threatpost.com/drupal-patches-denial-of-service-vulnerability-detail… *** Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2014-006 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CORE-2014-006Project: Drupal core Version: 6.x, 7.xDate: 2014-November-19Security risk: 14/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Multiple vulnerabilitiesDescriptionSession hijacking (Drupal 6 and 7)A specially crafted request can give a user access to another users session, allowing an attacker to hijack a random session.This attack is known to be possible on certain Drupal 7 sites which serve both HTTP and HTTPS... --------------------------------------------- https://www.drupal.org/SA-CORE-2014-006 *** DRUPAL Security Advisories for Third-Party Modules *** --------------------------------------------- https://www.drupal.org/node/2378287 https://www.drupal.org/node/2378279 https://www.drupal.org/node/2378441 https://www.drupal.org/node/2378401 https://www.drupal.org/node/2378367 *** R7-2014-18: Hikvision DVR Devices - Multiple Vulnerabilities *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/11/19/r7-2014-1… *** Paid Memberships Pro plugin for WordPress getfile.php directory traversal *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98805 *** Lsyncd default-rsyncssh.lua command execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98806 *** Security Advisory-App Validity Check Bypass Vulnerability in Huawei P7 Smartphone *** --------------------------------------------- Nov 20, 2014 14:53 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Vuln: MantisBT core/file_api.php Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/71104 *** Xen Security Advisory 113 - Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling *** --------------------------------------------- An error handling path in the processing of MMU_MACHPHYS_UPDATE failed to drop a page reference which was acquired in an earlier processing step. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-11/msg00003.html *** IBM Security Network Protection Shell Command Injection *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98519 *** IBM Security Bulletins related to POODLE *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Other IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Mittwoch 19-11-2014
by Daily end-of-shift report 19 Nov '14

19 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 18-11-2014 18:00 − Mittwoch 19-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** MS14-068 - Critical: Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780) - Version: 1.0 *** --------------------------------------------- This security update resolves a privately reported vulnerability in Microsoft Windows Kerberos KDC that could allow an attacker to elevate unprivileged domain user account privileges to those of the domain administrator account. An attacker could use these elevated privileges to compromise any computer in the domain, including domain controllers. An attacker must have valid domain credentials to... --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-068 *** Additional information about CVE-2014-6324 *** --------------------------------------------- Today Microsoft released update MS14-068 to address CVE-2014-6324, a Windows Kerberos implementation elevation of privilege vulnerability that is being exploited in-the-wild in limited, targeted attacks. The goal of this blog post is to provide additional information about the vulnerability, update priority, and detection guidance for defenders. Microsoft recommends customers apply this update to their domain controllers as quickly as possible. Vulnerability Details CVE-2014-6324 allows... --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-ab… *** Google Removes SSLv3 Fallback Support From Chrome *** --------------------------------------------- Google has released Chrome 39, fixing 42 security vulnerabilities and removing support for the fallback to SSLv3, the component that was the target of the POODLE attack revealed last month. When the POODLE attack was disclosed by several Google researchers in October, the company said that it had added a change to Chrome that would... --------------------------------------------- http://threatpost.com/google-removes-sslv3-fallback-support-from-chrome/109… *** A New Free CA *** --------------------------------------------- Announcing Lets Encrypt, a new free certificate authority. This is a joint project of EFF, Mozilla, Cisco, Akamai, and the University of Michigan. This is an absolutely fantastic idea. The anchor for any TLS-protected communication is a public-key certificate which demonstrates that the server youre actually talking to is the server you intended to talk to. For many server operators,... --------------------------------------------- https://www.schneier.com/blog/archives/2014/11/a_new_free_ca.html *** Survey: real-time SIEM solutions help orgs detect attacks within minutes *** --------------------------------------------- Real-time security information and event management solutions help organizations detect targeted attacks and advanced persistent threats within minutes, according to a McAfee survey. --------------------------------------------- http://www.scmagazine.com/survey-real-time-siem-solutions-help-orgs-detect-… *** POWELIKS Levels Up With New Autostart Mechanism *** --------------------------------------------- Last August, we wrote about POWELIKS's malware routines that are known for hiding its malicious codes in the registry entry as part of its evasion tactics. In the newer samples we spotted, malware detected as TROJ_POWELIKS.B employed a new autostart mechanism and removes users' privileges in viewing the registry's content. As a result, users won't be able to suspect that... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/zurdvNxST00/ *** Pan-European Cyber Security Competition organised by ENISA *** --------------------------------------------- Today (19 November 2014) the European Union Agency for Network and Information Security (ENISA) is happy to announce the planning of the 1st pan-European Cyber Security Competition in 2015. The competition is organised jointly in collaboration with experienced organisations from EU Member States for students. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/pan-european-cyber-security-com… *** RSS Reveals Malware Injections *** --------------------------------------------- There are multiple different ways to detect invisible malware on a website: You can scrutinize the HTML code of web pages. Use external scanners like SiteCheck or UnmaskParasites. Get alerts from anti-viruses or search engines (both in search results and via their Webmaster Tools). Try to open web pages with different User-Agents and check for... --------------------------------------------- http://blog.sucuri.net/2014/11/rss-reveals-malware-injections.html *** Test Tool for Web App Security Scanners Released by Google *** --------------------------------------------- A new tool was open-sourced by Google on Tuesday, aiming at improving the efficiency of automated web security scanners by evaluating them with patterns of vulnerabilities already seen in the wild. --------------------------------------------- http://news.softpedia.com/news/Test-Tool-for-Web-App-Security-Scanners-Rele… *** Microsoft bessert beim SChannel-Patch nach *** --------------------------------------------- Still und heimlich haben die Windows-Macher am Dienstag mit dem Update außer der Reihe auch eine neue Revision des SChannel-Patches ausgeliefert. Diese soll die Probleme mit der TLS-Verschlüsselung und massive Performance-Einbußen bei SQL Server beheben. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-bessert-beim-SChannel-Patch-… *** Most advanced mobile botnet EVER is coming for your OFFICE Androids *** --------------------------------------------- NotCompatible A newly discovered variant of NotCompatible is establishing what has been called the most advanced mobile botnet yet created. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/19/android_bot… *** jQuery: Cross-Site-Scripting in Captcha-Beispielcode weit verbreitet *** --------------------------------------------- Ein populäres jQuery-Plugin liefert Code mit einer Cross-Site-Scripting-Lücke aus. Der verwundbare Code stammt ursprünglich von einem Beispielskript für Captchas, das auf sehr vielen Webseiten zu finden ist. --------------------------------------------- http://www.golem.de/news/jquery-cross-site-scripting-in-captcha-beispielcod… *** A Peek Inside a PoS Scammer's Toolbox *** --------------------------------------------- PoS malware has been receiving a tremendous amount of attention in the past two years with high profile incidents like Target, Home Depot, and Kmart. With the massive "Black Friday" shopping season coming up, PoS malware will surely get additional publicity. This high profile nature means, we constantly look for evolving PoS malware and look into their behavior... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/xF7gxViXP4A/ *** Nasty Security Bug Fixed in Android Lollipop 5.0 *** --------------------------------------------- There is a vulnerability in Android versions below 5.0 that could allow an attacker to bypass ASLR and run arbitrary code on a target device under certain circumstances. The bug was fixed in Lollipop, the newest version of the mobile OS, released earlier this week. The vulnerability lies in java.io.ObjectInputStream, which fails to check whether... --------------------------------------------- http://threatpost.com/nasty-security-bug-fixed-in-android-lollipop-5-0/1094… *** Cisco Unified Communications Manager IM and Presence Service Enumeration Vulnerability *** --------------------------------------------- CVE-2014-8000 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Multiple Samsung Galaxy Devices knox code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98780 *** Google Chrome pdfium code execution *** --------------------------------------------- Google Chrome pdfium code execution --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98790 *** Bugtraq: [SECURITY] [DSA 3074-2] php5 regression update *** --------------------------------------------- http://www.securityfocus.com/archive/1/534018 *** Bugtraq: Reflected Cross-Site Scripting (XSS) in Simple Email Form Joomla Extension *** --------------------------------------------- http://www.securityfocus.com/archive/1/534017

1 0

Tageszusammenfassung - Dienstag 18-11-2014
by Daily end-of-shift report 18 Nov '14

18 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 17-11-2014 18:00 − Dienstag 18-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Out-of-band release for Security Bulletin MS14-068 *** --------------------------------------------- On Tuesday, November 18, 2014, at approximately 10 a.m. PST, we will release an out-of-band security update to address a vulnerability in Windows. We strongly encourage customers to apply this update as soon as possible, following the directions in the security bulletin. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/11/18/out-of-band-release-for-… *** VB2014 paper: Optimized mal-ops. Hack the ad network like a boss *** --------------------------------------------- Why buying ad space makes perfect sense for those wanting to spread malware.Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added Optimized mal-ops. Hack the ad network like a boss by Bromium researchers Vadim Kotov and Rahul Kashyap.Malicious advertisements (malvertising) go back more than a decade, yet in recent months we have seen a surge in these attacks, including the Kyle and Stan campaign, which... --------------------------------------------- http://www.virusbtn.com/blog/2014/11_18.xml?rss *** l+f: Lücken bei BitTorrent Sync *** --------------------------------------------- Ein Security-Audit hat eine Reihe kleinerer und größerer Lücken im Filesharing-Dienst gefunden. --------------------------------------------- http://www.heise.de/security/meldung/l-f-Luecken-bei-BitTorrent-Sync-245985… *** Matsnu Botnet DGA Discovers Power of Words *** --------------------------------------------- The Matsnu botnet has deployed a new domain generation algorithm that builds domain names from a list of nouns and verbs. The plain English phrases help the DGA elude detection. --------------------------------------------- http://threatpost.com/matsnu-botnet-dga-discovers-power-of-words/109426 *** Cisco Releases Security Analytics Framework to Open Source *** --------------------------------------------- Ciscos OpenSOC, a security analytics framework, has been released to open source. --------------------------------------------- http://threatpost.com/cisco-releases-security-analytics-framework-to-open-s… *** The NSAs Efforts to Ban Cryptographic Research in the 1970s *** --------------------------------------------- New article on the NSAs efforts to control academic cryptographic research in the 1970s. It includes new interviews with public-key cryptography inventor Martin Hellman and then NSA-director Bobby Inman.... --------------------------------------------- https://www.schneier.com/blog/archives/2014/11/the_nsas_effort.html *** Flashpack Exploit Kit Used in Free Ads, Leads to Malware Delivery Mechanism *** --------------------------------------------- In the entry FlashPack Exploit Leads to New Family of Malware, we tackled the Flashpack exploit kit and how it uses three URLs namely (http://{malicious domain}/[a-z]{3}[0-9]{10,12}/loxotrap.php, http://{malicious domain}/[0-9,a-z]{6,10}/load0515p6jse9.php, http://{malicious domain}/[a-z]{3}[0-9]{10,12}/ldcigar.php) as its landing site. We monitored the abovementioned URLs and found out that the FlashPack exploit kit is now using free ads to distribute malware such as... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/-FQFl818dVo/ *** IT threat evolution Q3 2014 *** --------------------------------------------- Kaspersky Lab products detected and neutralized a total of 1,325,106,041 threats in the third quarter of 2014. Our solutions blocked 696,977 attacks that attempted to launch malware capable of stealing money from online banking accounts. Were detected 74,489 new malicious mobile programs, including 7010 mobile banking Trojans. --------------------------------------------- http://securelist.com/analysis/quarterly-malware-reports/67637/it-threat-ev… *** Microsofts SChannel-Fix wird zum Problem-Patch *** --------------------------------------------- Microsoft hat bestätigt, dass der Patch für die Krypto-Funktion von Windows auf Servern zu Problemen führt. Es soll sowohl SQL Server als auch IIS beeinträchtigen. Das Update wird aber nach wie vor verteilt. --------------------------------------------- http://www.heise.de/security/meldung/Microsofts-SChannel-Fix-wird-zum-Probl… *** Cisco IOS DLSw Information Disclosure Vulnerability *** --------------------------------------------- CVE-2014-7992 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Integrated Management Controller Cross-Site Request Forgery Vulnerability *** --------------------------------------------- CVE-2014-7996 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Vuln: Check Point Security Gateway Multiple Denial of Service Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/67993 *** Rails Action Pack Bug Lets Remote Users Determine if Specified Files Exist on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1031217 *** Moodle Bugs Permit Cross-Site Scripting, Cross-Site Request Forgery, and Information Disclosure Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031215 *** Tcpdump Multiple Flaws Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031235 *** Xen Security Advisory 110 (CVE-2014-8595) - Missing privilege level checks in x86 emulation of far branches *** --------------------------------------------- The emulation of far branch instructions (CALL, JMP, and RETF in Intel assembly syntax, LCALL, LJMP, and LRET in AT&T assembly syntax) incompletely performs privilege checks. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-11/msg00001.html *** Xen Security Advisory 109 (CVE-2014-8594) - Insufficient restrictions on certain MMU update hypercalls *** --------------------------------------------- MMU update operations targeting page tables are intended to be used on PV guests only. The lack of a respective check made it possible for such operations to access certain function pointers which remain NULL when the target guest is using Hardware Assisted Paging (HAP). --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-11/msg00002.html *** Apple Security Advisories *** --------------------------------------------- APPLE-SA-2014-11-17-1 iOS 8.1.1 APPLE-SA-2014-11-17-2 OS X Yosemite 10.10.1 APPLE-SA-2014-11-17-3 Apple TV 7.0.2 --------------------------------------------- http://support.apple.com/kb/HT1222 *** IBM Security Bulletins related to a Vulnerability in SSLv3 (POODLE) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Other IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Montag 17-11-2014
by Daily end-of-shift report 17 Nov '14

17 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 14-11-2014 18:00 − Montag 17-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Microsoft Updates MS14-066, (Sun, Nov 16th) *** --------------------------------------------- Microsoft updated MS14-066 to warn users about some problems caused by the additional ciphers added with the update [1]. It appears that clients who may not support these ciphers may fail to connect at all. The quick fix is to remove the ciphers by editing the respective registry entry (see the KB article link below for more details). One user reported to us performance issues when connecting from MSFT Access to SQL Server, which are related to these ciphers. Sadly, MS14-066hasnt been --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18957&rss *** EVERYTHING needs crypto says Internet Architecture Board *** --------------------------------------------- Calls for all new protocols to protect privacy, all the time, everywhere The Internet Architecture Board (IAB) has called for encryption to become the norm for all internet traffic. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/16/net_gurus_f… *** "Maskierte Apps": Apple veröffentlicht Sicherheitsrichtlinien für App-Installation *** --------------------------------------------- Mit Enterprise-Zertifikaten signierte Apps lassen sich am App Store vorbei auf iOS-Geräten installieren. Angreifer können das nutzen, um Apps durch manipulierte Versionen zu ersetzen. Mit Tipps will Apple Nutzer für Malware sensibilisieren. --------------------------------------------- http://www.heise.de/security/meldung/Maskierte-Apps-Apple-veroeffentlicht-S… *** 91. Treffen der IETF: Das Kapern von BGP-Routen verhindern *** --------------------------------------------- Immer wieder wird Internet-Verkehr unbemerkt über seltsame Wege zum eigentlichen Ziel umgeleitet. Ob es sich um Abhör-Aktionen handelt oder nur um Pannen, ist oft unklar. Nun könnten Netzbetreiber ein Mittel dagegen in die Hand bekommen. --------------------------------------------- http://www.heise.de/newsticker/meldung/91-Treffen-der-IETF-Das-Kapern-von-B… *** Attack reveals 81 percent of Tor users but admins call for calm *** --------------------------------------------- Cisco Netflow a handy tool for cheapskate attackers The Tor project has urged calm after new research found 81 percent of users could be identified using Ciscos NetFlow tool. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/17/deanonymiza… *** WinShock PoC clocked: But DONT PANIC... Its no Heartbleed *** --------------------------------------------- SChannel exploit opens an easily closed door Security researchers have released a proof-of-concept exploit against the SChannel crypto library flaw patched by Microsoft last week. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/17/ms_schannel… *** Jetzt patchen: Details zur SChannel-Lücke in Windows im Umlauf *** --------------------------------------------- Administratoren sollten Patches für die kritische Sicherheitslücke in Windows, die Microsoft letzte Woche geschlossen hat, umgehend einspielen. Ansonsten riskieren sie, dass Angreifer über das Netz Schadcode einschleusen. --------------------------------------------- http://www.heise.de/security/meldung/Jetzt-patchen-Details-zur-SChannel-Lue… *** Book review: Bulletproof SSL and TLS *** --------------------------------------------- Must-read for anyone working with one of the Internets most important protocols.I was reading Ivan Ristićs book Bulletproof SSL and TLS when rumours started to appear about an attack against SSL 3.0, which would soon become commonly known as the POODLE attack. Thanks to the book, I was quickly able to read up on the differences between SSL 3.0 and its successor, TLS 1.0, which wasnt vulnerable to the attack. Elsewhere in the book, a few pages are dedicated to protocol downgrade attacks,... --------------------------------------------- http://www.virusbtn.com/blog/2014/11_17.xml?rss *** Holy cow! Fasthosts outage blamed on DDoS hack attack AND Windows 2003 vuln *** --------------------------------------------- Monday, bloody Monday Fasthosts five-hour collapse today has been blamed on a Distributed Denial of Service attack and a security flaw spotted on its Windows 2003 shared web server kit. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/17/fasthosts_o… *** Comedy spam blunder raises a smile to start the week *** --------------------------------------------- We all get lots of spam. Enough, even with junk folders and spam filters, to be more than merely annoying. So heres a spamming mistake to make you smile... --------------------------------------------- https://nakedsecurity.sophos.com/2014/11/17/comedy-spam-blunder-raises-a-sm… *** Cisco Aironet DHCP Denial of Service Vulnerabilty *** --------------------------------------------- CVE-2014-7997 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Aironet EAP Debugging Denial of Service Vulnerability *** --------------------------------------------- CVE-2014-7998 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SSA-860967 (Last Update 2014-11-14): GNU Bash Vulnerabilities in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Hot fix to address POODLE SSLv3 vunerability on Designer 4.0.2 AU5 SVN HTTPS access *** --------------------------------------------- Abstract: Designer 4.0.2 uses SSLv3 to access SVN repositories over HTTPS, making it vulnerable to the poodle weakness in the SSL protocol (CVE-2014-3566). This hot fix addresses the issue by disabling SSLv3 and allowing usage of TLSv1 instead.Document ID: 5195492Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:Designer402AU5HF1.zip (2.09 MB)Products:Identity Manager 4.0.2Identity Manager Roles Based Provisioning Module 4.0.2Designer for Identity... --------------------------------------------- https://download.novell.com/Download?buildid=NjOScYlrw_E~ *** Hot Patch 2 for Novell Messenger 2.2 (security fixes to Messengers server and client components) *** --------------------------------------------- https://download.novell.com/Download?buildid=I2DgXp6pwVY~ https://download.novell.com/Download?buildid=sJ4Wcd1G7Bo~ https://download.novell.com/Download?buildid=66t5njTLVmk~ *** DSA-3073 libgcrypt11 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3073 *** Vuln: GnuTLS CVE-2014-8564 Multiple Heap Corruption Denial of Service Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/71003 *** HPSBGN03192 rev.1 - HP Remote Device Access: Instant Customer Access Server (iCAS) running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Remote Device Access: Instant Customer Access Server (iCAS) running OpenSSL. This is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" also known as "Poodle", which could be exploited remotely to allow disclosure of information. SSLv3 is enabled by default in the current HP iCAS client software. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Security Bulletin: IBM Systems Director (ISD) is affected by vulnerability in the Console Login Window (CVE-2013-5423) *** --------------------------------------------- IBM Systems Director is affected by a vulnerability in the Console Login Window (CVE-2013-5423). CVE(s): CVE-2013-5423 Affected product(s) and affected version(s): Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096563 X-Force Database: http://xforce.iss.net/xforce/xfdb/87485 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect GPFS V3.5 for Windows (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568) *** --------------------------------------------- OpenSSL vulnerabilities along with SSL 3 Fallback protection (TLS_FALLBACK_SCSV) were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by GPFS V3.5 for Windows. GPFS V3.5 for Windows has addressed the applicable CVEs and included the SSL 3.0 Fallback protection (TLS_FALLBACK_SCSV) provided by OpenSSL. CVE(s): CVE-2014-3513, CVE-2014-3567 and CVE-2014-3568 Affected product(s) and affected version(s): OpenSSH for GPFS V3.5 for Windows Refer to the following reference --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletins: Vulnerability in SSLv3 affects multiple products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_vul… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** [webapps] - MyBB Forums 1.8.2 - Stored XSS Vulnerability *** --------------------------------------------- http://www.exploit-db.com/exploits/35266

1 0

Tageszusammenfassung - Freitag 14-11-2014
by Daily end-of-shift report 14 Nov '14

14 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 13-11-2014 18:00 − Freitag 14-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Network Hijackers Exploit Technical Loophole *** --------------------------------------------- Spammers have been working methodically to hijack large chunks of Internet real estate by exploiting a technical and bureaucratic loophole in the way that various regions of the globe keep track of the worlds Internet address ranges. --------------------------------------------- http://krebsonsecurity.com/2014/11/network-hijackers-exploit-technical-loop… *** BASHLITE Affects Devices Running on BusyBox *** --------------------------------------------- When news of the Shellshock vulnerability broke out at the end of September, we spotted several attacks that leveraged the said vulnerability, thus manifesting the prevalence or even evolution on how attackers used the .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects… *** OnionDuke: APT Attacks Via the Tor Network *** --------------------------------------------- Recently, research was published identifying a Tor exit node, located in Russia, that was consistently and maliciously modifying any uncompressed Windows executables downloaded through it. Naturally this piqued our interest, so we decided to peer down the rabbit hole. Suffice to say, the hole was a lot deeper than we expected! In fact, it went all the way .. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002764.html *** The Art of Website Malware Removal - The Basics *** --------------------------------------------- When talking about defense against malicious hacks, the attack vector is a common topic for Information Security (InfoSec) professionals. The primary concern is to understand the anatomy of the attack and prevent it from happening .. --------------------------------------------- http://blog.sucuri.net/2014/11/the-art-of-website-malware-removal-the-basic… *** Android 5: Lollipop verschlüsselt - noch besser *** --------------------------------------------- Mehr Sicherheit für persönliche Daten: Ab Android 5.0 aktiviert Google die automatische Verschlüsselung. Es ist nur eine von vielen zusätzlichen Sicherheitsfunktionen in Lollipop. --------------------------------------------- http://www.golem.de/news/android-5-lollipop-verschluesselt-noch-besser-1411… *** Gefälschte iOS-Apps: Apple sind keine Angriffe bekannt *** --------------------------------------------- Apple sieht nach einer Warnung vor Hacker-Angriffen mit gefälschten iOS-Apps keinen akuten Handlungsbedarf. "Uns sind keine Kunden bekannt, die von einer solchen Attacke betroffen gewesen wären", erklärte der Konzern gegenüber .. --------------------------------------------- http://www.heise.de/security/meldung/Gefaelschte-iOS-Apps-Apple-sind-keine-… *** Son of Stuxnet - The Digital Hunt for Duqu, a Dangerous and Cunning U.S.-Israeli Spy Virus *** --------------------------------------------- Boldizsar Bencsath took a bite from his sandwich and stared at his computer screen. The software he was trying to install on his machine was taking forever to load, and he still had a dozen things to do before the Fall 2011 semester began at the Budapest University of Technology and Economics, where .. --------------------------------------------- https://firstlook.org/theintercept/2014/11/12/stuxnet/ *** Android und iPhone beim Mobile Pwn2Own gefällt *** --------------------------------------------- Alle drei grossen Mobil-Betriebssysteme sind bei der diesjährigen Mobile-Ausgabe von HPs Pwn2Own-Wettbewerb erfolgreichen Hacks zum Opfer gefallen. Der Angriff auf Windows Phone ist dabei allerdings im Vergleich noch eher harmlos. --------------------------------------------- http://www.heise.de/security/meldung/Android-und-iPhone-beim-Mobile-Pwn2Own… *** SChannel Update and Experimental Vulnerability Scanner (MS14-066), (Fri, Nov 14th) *** --------------------------------------------- Just a quick update on the SChannel problem (MS14-066, CVE-2014-6321). So far, there is still no public available exploit for the vulnerability, and details are still sparse. But apparently, there is some progress in developing a .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18953

1 0

Tageszusammenfassung - Donnerstag 13-11-2014
by Daily end-of-shift report 13 Nov '14

13 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 12-11-2014 18:00 − Donnerstag 13-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** DNSSEC mit zu kurzen RSA-Schlüsseln *** --------------------------------------------- Unter anderem bei DNSSEC kommen noch sehr oft RSA-Schlüssel mit 1024 Bit zum Einsatz. Das könnte noch gefährlicher sein, als bisher angenommen, warnen Kryptologen. --------------------------------------------- http://www.heise.de/security/meldung/DNSSEC-mit-zu-kurzen-RSA-Schluesseln-2… *** Microsoft Patchday November 2014 *** --------------------------------------------- Normalerweise schreiben wir nichts über die monatlichen Patchdays von Microsoft: wir schreiben ja auch nicht, wenn ein heller Feuerball in der Früh im Osten über den Horizont steigt. Fast jeder IT Verantwortliche kennt das monatliche Spiel: Lesen, bewerten, eventuell testen dann der Rollout der Patches auf Server und Clients. Dieses .. --------------------------------------------- http://www.cert.at/services/blog/20141112130155-1300.html *** Evolution of Upatre Trojan Downloader *** --------------------------------------------- Upatre is a Trojan Downloader family that once installed, is responsible for stealing information and downloading additional malware onto the victim machine. It typically arrives via spammed e-mail messages from the Cutwail Botnet, either as an attachment or via a URL pointing to a remote hosting site. We are also seeing Exploit Kits being used as a vector for Upatre infections in the wild. --------------------------------------------- http://research.zscaler.com/2014/11/evolution-of-upatre-trojan-downloader.h… *** SA-CONTRIB-2014-109 - Freelinking - Cross Site Scripting (XSS) *** --------------------------------------------- The Freelinking module implements a filter framework for easier creation of HTML links to other pages on the site or to external sites. The module does not sanitize the node title when providing a link to the node, opening a Cross Site Scripting (XSS) vulnerability. --------------------------------------------- https://www.drupal.org/node/2373981 *** SA-CONTRIB-2014-108 - Webform Component Roles - Access Bypass *** --------------------------------------------- The Webform component module enables site admins to limit visibility or editability of webform components based on user roles. The module doesn't sufficiently check that disabled component values are not modified upon submission of the form. --------------------------------------------- https://www.drupal.org/node/2373973 *** SA-CONTRIB-2014-107 - Scheduler - Cross Site Scripting *** --------------------------------------------- The Scheduler module allows nodes to be published and unpublished on specified dates. The module allows administrators to provide additional help text on the content editing form when scheduling is enabled. The module doesn't sufficiently filter the help text which could lead to a Cross Site Scripting (XSS) attack. This vulnerability is mitigated by the fact that an .. --------------------------------------------- https://www.drupal.org/node/2373961 *** Annus HORRIBILIS! ALL the main TLS stacks now officially pwned in 2014 *** --------------------------------------------- Critical crypto 0-day not the worst of mega Nov patch batch The appearance of a critical vuln in Microsoft SChannel - patched as part of this years bumper November Patch Tuesday - means that every major TLS stack has now fallen to a critical flaw at some time during this year. --------------------------------------------- http://www.theregister.co.uk/2014/11/12/ms_crypto_library_megaflaw/ *** Use Protection if Peering Promiscuously *** --------------------------------------------- Last week, I wrote a blog post discussing the dangers of BGP routing leaks between peers, illustrating the problem using examples of recent snafus between China Telecom and Russia’s Vimpelcom. This follow-up blog post provides three additional examples of misbehaving peers and further demonstrates the impact unmonitored routes can have on Internet performance .. --------------------------------------------- http://research.dyn.com/2014/11/use-protection-if-peering-promiscuously/ *** Microsoft stopft ein fast zwei Jahrzehnte altes Sicherheitsloch *** --------------------------------------------- Microsoft hat eine seit fast zwei Jahrzehnten existierende Sicherheitslücke in seinem Windows-Betriebssystem gestopft. Microsoft stufte das Problem in einem am Mittwoch veröffentlichten Sicherheitshinweis als "ernst" ein und stellte ein Update zur Verfügung. --------------------------------------------- http://derstandard.at/2000008083067 *** Phisher zielen auf Apple-Pay-Interessenten ab *** --------------------------------------------- Mit einer auf deutschsprachige Nutzer ausgelegten E-Mail wird derzeit nach Apple-ID-Accounts geangelt. Sie laden vorgeblich zur Registrierung für den bislang nur in den USA verfügbaren iPhone-Bezahldienst ein. --------------------------------------------- http://www.heise.de/security/meldung/Phisher-zielen-auf-Apple-Pay-Interesse…

1 0

Tageszusammenfassung - Mittwoch 12-11-2014
by Daily end-of-shift report 12 Nov '14

12 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 11-11-2014 18:00 − Mittwoch 12-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB14-24) *** --------------------------------------------- A Security Bulletin (APSB14-24) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using the instructions referenced in the security bulletin. --------------------------------------------- http://blogs.adobe.com/psirt/?p=1141 *** MS14-NOV - Microsoft Security Bulletin Summary for November 2014 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-NOV *** Assessing Risk for the November 2014 Security Updates *** --------------------------------------------- Today we released fourteen security bulletins addressing 33 unique CVEs. Four bulletins have a maximum severity rating of Critical, eight have a maximum severity rating of Important, and two have a maximum severity rating of Moderate. This table is designed to help you prioritize .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-no… *** Erpressung mit Kinderpornos: Exploit-Kit Angler verteilt Android-Trojaner *** --------------------------------------------- Ein Virenforscher hat einen perfiden Schädling entdeckt, der Android-Nutzer mit kinderpornografischem Material zu erpressen versucht. Er wird bereits über das verbreitete Exploit-Kit Angler verteilt. --------------------------------------------- http://www.heise.de/security/meldung/Erpressung-mit-Kinderpornos-Exploit-Ki… *** Rockwell Automation Connected Components Workbench ActiveX Component Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two custom ActiveX Component vulnerabilities in Rockwell Automation's Connected Components Workbench application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-294-01 *** Security: Dutzende Schwachstellen in Newsletter-Diensten behoben *** --------------------------------------------- Die Sicherheitslücken reichen von XSS-Fehlern über unsichere Formulare bis hin zu SQL-Injection-Schwachstellen: In drei weit verbreiteten E-Mail-Marketing- und Newsletter-Diensten haben IT-Sicherheitsexperten zahlreiche Schwachstellen entdeckt. Sie sind in Absprache mit den Herstellern inzwischen behoben worden. --------------------------------------------- http://www.golem.de/news/security-dutzende-schwachstellen-in-newsletter-die… *** MSRT November 2014 - Tofsee *** --------------------------------------------- This month we added the Win32/Tofsee and Win32/Zoxpng malware families to the Malicious Software Removal Tool. Zoxpng is a backdoor component that can execute remote commands from a malicious hacker. It is related to Win32/Hikiti and the other threats added to the MSRT last .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/11/11/msrt-november-2014-tofse… *** The Psychology Behind Why Websites Get Hacked *** --------------------------------------------- It's an everyday conversation for security professionals that interact with everyday website owners. The one where we have to explain that just because everything seems fine, doesn't mean that the best security practices .. --------------------------------------------- http://blog.sucuri.net/2014/11/the-psychology-behind-why-websites-get-hacke… *** Bugtraq: CVE-2014-8731 - RCE in phpMemcachedAdmin <=1.2.2 *** --------------------------------------------- http://www.securityfocus.com/archive/1/533968 *** SAP Governance, Risk and Compliance (SAP GRC) Multiple Critical Vulnerabilities *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014110071 *** Expired antimalware software is nearly as unsafe as having no protection at all *** --------------------------------------------- Analyzing data to find the root cause of infections has been a long-standing focus of the MMPC. One area weve been investigating is the correlation between endpoint protection and infection rates. Back in version 14 of the Security Intelligence Report (SIRv14), we first published data on infection .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/11/12/expired-antimalware-soft… *** Only Half of USB Devices Have an Unpatchable Flaw, But No One Knows Which Half *** --------------------------------------------- After testing the USB controller chips of all eight major manufacturers, the researcher who first discovered BadUSB has some good news and some bad news. The post .. --------------------------------------------- http://www.wired.com/2014/11/badusb-only-affects-half-of-usbs/

1 0

Tageszusammenfassung - Dienstag 11-11-2014
by Daily end-of-shift report 11 Nov '14

11 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 10-11-2014 18:00 − Dienstag 11-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Unified Communications Manager Remote Mobile Access Subsystem Vulnerability *** --------------------------------------------- A vulnerability in the Remote Mobile Access Subsystem in Cisco Unified Communications Manager (Cisco Unified CM) could allow an unauthenticated, remote attacker to supply a crafted Transport Layer Security (TLS) certificate that may be accepted by the affected device. The vulnerability is due to improper validation of the SAN field of a TLS certificate. An attacker could exploit this vulnerability by impersonating a VCS core device and supplying a certificate signed by a certificate authority trusted by the Cisco Unified CM that contains crafted values in the SAN field. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Lessons Learn from attacks on Kippo honeypots, (Mon, Nov 10th) *** --------------------------------------------- A number of my fellow Handlers have discussed Kippo, a SSH honeypot that can record adversarial behaviour, be it human or machine. Normal behaviour against my set of Kippo honeypots is randomly predictable; a mixture of known bad IP ranges, researchers or from behind TOR scanning and probing, would be attackers manually entering information from their jump boxes .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18935 *** Hackerangriff auf US-Post *** --------------------------------------------- Der staatliche US Postal Service ist Opfer eines Hackerangriffs geworden. Dabei hätten die Angreifer möglicherweise Zugriff auf persönliche Daten von mehr als 800.000 Beschäftigten sowie von Kunden erhalten, die den Kundendienst per Mail oder Telefon kontaktiert hätten, teilte das Unternehmen .. --------------------------------------------- http://derstandard.at/2000007973390 *** iOS: Schwachstelle erlaubt Installation manipulierter Apps *** --------------------------------------------- Zum zweiten Mal innerhalb weniger Tage entdeckten Datenexperten eine potenzielle Angriffsmethode für Malware in Apples mobilem Betriebssystem iOS. Die IT-Sicherheitsfirma Fireeye warnt vor einer Infizierung von iPhones oder iPads mit einer Methode namens Masque Attack, die auch ohne Jailbreak funktioniert. Dabei .. --------------------------------------------- http://www.golem.de/news/ios-schwachstelle-erlaubt-installation-manipuliert… *** Operation Poisoned Handover: Unveiling Ties Between APT Activity in Hong Kong's Pro-Democracy Movement *** --------------------------------------------- As the pro-democracy movement in Hong Kong has continued, we've been watching for indications of confrontation taking place in cyberspace. Protests began in September and have continued to escalate. In recent weeks, attackers have launched .. --------------------------------------------- http://www.fireeye.com/blog/technical/2014/11/operation-poisoned-handover-u… *** Old-time phishing scams are working just fine, Google finds *** --------------------------------------------- A new Google study has found that the true masterpieces of phishing are successful 45% of the time. Its just another example of how phishers may be old dogs, but they can sure learn new tricks. --------------------------------------------- http://nakedsecurity.sophos.com/2014/11/11/old-time-phishing-scams-are-work… *** Stuxnet: Zero Victims *** --------------------------------------------- We collected Stuxnet files for two years. After analyzing more than 2,000 of these files, we were able to identify the organizations that were the first victims of the worms different variants in 2009 and 2010. Perhaps an analysis of their activity can explain why they became "patients zero" (the original, or zero, victims). --------------------------------------------- http://securelist.com/analysis/publications/67483/stuxnet-zero-victims/ *** Important EMET 5.1 Update. Apply before Patches today, (Tue, Nov 11th) *** --------------------------------------------- Microsoft yesterday release EMET 5.1 . One particular sentence in Microsofts blog post suggests that you should apply this update (if you are using EMET) BEFORE you apply the Interent Explorer patch Microsoft is going to release in a couple of hours: ">If you are using Internet Explorer 11, either on Windows 7 or Windows 8.1, and have deployed EMET 5.0, it is .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18939

1 0

Tageszusammenfassung - Montag 10-11-2014
by Daily end-of-shift report 10 Nov '14

10 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 07-11-2014 18:00 − Montag 10-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** WireLurker zielt auch als Windows-Trojaner auf iOS-Geräte ab *** --------------------------------------------- Nebem dem Mac-Trojaner haben Sicherheitsforscher inzwischen auch eine Windows-Ausführung aufgespürt. Sie hat es ebenfalls auf angeschlossene iPhones oder iPads abgesehen und schleust auf diesen Malware ein. --------------------------------------------- http://www.heise.de/security/meldung/WireLurker-zielt-auch-als-Windows-Troj… *** VU#432608: IBM Notes Traveler for Android transmits user credentials over HTTP *** --------------------------------------------- The IBM Notes Traveler application for Android does not enforce the use of HTTPS for transmitting user credentials, which can allow an attacker to obtain this information. --------------------------------------------- http://www.kb.cert.org/vuls/id/432608 *** Malicious iframe Injector Found in Adobe Flash File (.SWF) *** --------------------------------------------- Finding malware in Adobe Flash files (.swf) is nothing new, but it usually affects personal computers, not servers. Typically, a hidden iframe is used to drop a binary browser exploit with .SWF files, infecting the client machine. This time we saw the opposite, where a binary .SWF file injects an invisible iframe. This .. --------------------------------------------- http://blog.sucuri.net/2014/11/malicious-injector-in-swf-adobe-flash-file.h… *** Keine Entwarnung beim Router-Farming *** --------------------------------------------- Laut Mitarbeitern der tschechichen CZ.NIC Labs gibt es weltweit mehr als eine halbe Million Router, die ihre Konfiguration und damit das Zugangspasswort unbemerkt herausgeben. Angreifer können Nutzer der Router auf Phishing-Seiten umleiten. --------------------------------------------- http://www.heise.de/security/meldung/Keine-Entwarnung-beim-Router-Farming-2… *** Security: Bilder tausender unsicherer Webcams im Internet zu sehen *** --------------------------------------------- Menschen zu Hause in ihrem Fernsehsessel oder bei der Arbeit am Rechner: Das zeigt eine Webseite - ohne dass die Betroffenen davon wissen. Die unbekannten Betreiber haben dafür weltweit tausende Webcams angezapft. (Datenschutz, Netzwerk) --------------------------------------------- http://www.golem.de/news/security-tausende-unsichere-webcams-im-internet-zu… *** Einfache Lösung zum Live-Patching des Linux-Kernels *** --------------------------------------------- Red-Hat- und Suse-Mitarbeiter arbeiten gemeinsam an einer Live-Patching-Lösung für den Linux-Kernel. Erster Code wurde jetzt veröffentlicht, kann aber weniger Lücken stopfen als Kpatch und kGraft. --------------------------------------------- http://www.heise.de/security/meldung/Einfache-Loesung-zum-Live-Patching-des… *** BND-Kauf von Zero Days: CCC warnt vor "Mitmischen im Schwachstellen-Schwarzmarkt" *** --------------------------------------------- "An Dreistigkeit kaum zu überbieten": Der Chaos Computer Club kritisiert die angeblichen Pläne des BND zum Ankauf von bislang unbekannten Sicherheitslücken. Das Geld liesse sich viel besser verwenden. --------------------------------------------- http://www.golem.de/news/bnd-kauf-von-zero-days-ccc-warnt-vor-mitmischen-im… *** The Dangers of Hosted Scripts - Hacked jQuery Timers *** --------------------------------------------- Google blacklisted a client's website claiming that malicious content was being displayed from forogozoropoto.2waky.com. A scan didn't reveal anything suspicious. The next step was to check all third-party scripts on the website. Soon we found the offending script. It was hxxp://jquery.offput.ca/js/jquery.timers.js - a jQuery Timers plugin that was .. --------------------------------------------- http://blog.sucuri.net/2014/11/the-dangers-of-hosted-scripts-hacked-jquery-… *** Removing Wirelurker from Your iOS or OSX Device *** --------------------------------------------- In an earlier blog post, we tackled what Wirelurker malware is and its security implications and risks for iOS and OSX devices. Within hours of the discovery of this malware, a Windows-based malware (detected as TROJ_WIRELURK.A) that performs the same attack was also seen in the wild. In this blog post, we'dd like .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/removing-wirelur… *** Angriff im Hotel-Netz *** --------------------------------------------- Unter dem Namen Darkhotel berichtet Kaspersky über eine Gruppe von Angreifern mit einer ungewöhnlichen Vorgehensweise: Sie attackieren ihre Opfer auf Auslandsreisen im Netz des Hotels. --------------------------------------------- http://www.heise.de/security/meldung/Angriff-im-Hotel-Netz-2445108.html *** TA14-310A: Microsoft Ending Support for Windows Server 2003 Operating System *** --------------------------------------------- Microsoft is ending support for the Windows Server 2003 operating system on July 14, 2015.[1] After this date, this product will no longer receive:Security patches that help protect PCs from harmful viruses, spyware, and other malicious software. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA14-310A *** Verschlüsselung: Parallele Angriffe auf RSA-Schlüssel mit 1.024 Bit *** --------------------------------------------- Kurze RSA-Schlüssel lassen sich schneller und günstiger brechen, wenn man einen Angriff auf viele Schlüssel gleichzeitig durchführt. Insbesondere bei DNSSEC sind RSA-Schlüssel mit 1.024 Bit noch in breitem Einsatz. --------------------------------------------- http://www.golem.de/news/verschluesselung-parallele-angriffe-auf-rsa-schlue… *** EMET 5.1 is available *** --------------------------------------------- Today, we're releasing the Enhanced Mitigation Experience Toolkit (EMET) 5.1 which will continue to improve your security posture by providing increased application compatibility and hardened mitigations. You can download EMET 5.1 from microsoft.com/emet. Following is the list of the main changes and improvements: Several application compatibility issues .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/11/10/emet-5-1-is-available.aspx

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily