Daily

daily@lists.cert.at

1 participants
3191 discussions

Tageszusammenfassung - Mittwoch 4-02-2015
by Daily end-of-shift report 04 Feb '15

04 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 03-02-2015 18:00 − Mittwoch 04-02-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New Wave of CTB-Locker/Critroni Ransomware Hitting Victims *** --------------------------------------------- There is a new wave of attacks delivering the CTB-Locker or Critroni crypto ransomware, arriving through spam messages with a variety of lures in several different countries. CTB-Locker is one of the newer variants in the crypto .. --------------------------------------------- http://threatpost.com/new-wave-of-ctb-lockercritroni-ransomware-hitting-vic… *** Advisory - Dangerous "nonce" leak in UpdraftPlus *** --------------------------------------------- Advisory for: UpdraftPlus Security Risk: High Exploitation level: Remote DREAD Score: 7/10 Vulnerability: Privilege Escalation Patched Version: 1.9.51 If you're a user of the UpdraftPlus plugin for WordPress, now is the time to update. During .. --------------------------------------------- http://blog.sucuri.net/2015/02/advisory-dangerous-nonce-leak-in-updraftplus… *** UpdraftPlus <= 1.9.50 - Privilege Escalation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7781 *** 1,800 Domains Overtaken by Flash Zero Day *** --------------------------------------------- Researchers at Cisco say that a Flash zero day exploit has compromised 1,800 domains, the majority of those during a 48-hour period last week. --------------------------------------------- http://threatpost.com/1800-domains-overtaken-by-flash-zero-day/110835 *** Multiple vulnerabilities in Cisco Unified IP Phone 9900 *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** MIT Kerberos Multiple Flaws in kadmind Let Remote Users Obtain Potentially Sensitive Information and Remote Authenticted Users Execute Arbitrary Code *** --------------------------------------------- MIT Kerberos Multiple Flaws in kadmind Let Remote Users Obtain Potentially Sensitive Information and Remote Authenticted Users Execute Arbitrary Code --------------------------------------------- http://www.securitytracker.com/id/1031691 *** Siemens SCALANCE X-200IRT Switch Family User Impersonation Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a user impersonation vulnerability in the Siemens SCALANCE X-200IRT Switch Family. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-034-01 *** Siemens Ruggedcom WIN Vulnerability *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities in the Siemens Ruggedcom WIN firmware. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-034-02 *** An In-depth analysis of the Fiesta Exploit Kit: An infection in 2015 *** --------------------------------------------- A while ago I blogged about the Fiesta exploit kit, this was back in September 2013 [Fiesta Exploit Kit analysis serving MSIE exploit CVE-2013-2551] in this blog I focused on the integration of the MSIE exploit and parts of the landing page. --------------------------------------------- http://blog.0x3a.com/post/110052845124/an-in-depth-analysis-of-the-fiesta-e… *** Play Store: Weit verbreitete Apps zeigen Adware verzögert an *** --------------------------------------------- Apps aus Googles Play Store mit Downloadzahlen von stellenweise über 5 Millionen beinhalten Adware, die den Nutzer zu dubiosen Appstores oder Anwendungen mit Premium-SMS-Versand weiterleiten. Interessant ist dabei die Art und Weise, wie die Werbung an den Nutzer gebracht wird. --------------------------------------------- http://www.golem.de/news/play-store-weit-verbreitete-apps-zeigen-adware-ver… *** Threat Analysis Template For BYOD Applications *** --------------------------------------------- Your IT department is certainly not at a loss when it comes to worrying about BYOD applications. Indeed, the list of threats to enterprise applications and the data they contain is a long one, and security professionals are .. --------------------------------------------- http://resources.infosecinstitute.com/threat-analysis-template-byod-applica… *** So schützen Sie sich vor der Flash-Lücke *** --------------------------------------------- Während Adobe weiterhin keine konkreten Schutzmaßnahmen kennt oder nennt, rät das BSI ganz klar zur Deinstallation des Flash Player. Wer nicht handelt und Flash weiterhin aktiv lässt, geht ein großes Risiko ein. --------------------------------------------- http://heise.de/-2539858 *** Cisco WebEx Meetings Server Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Pawn Storm Update: iOS Espionage App Found *** --------------------------------------------- In our continued research on Operation Pawn Storm, we found one interesting poisoned pawn - spyware specifically designed for espionage on iOS devices. While spyware targeting Apple users is highly notable by itself, this particular spyware is also involved in a targeted attack. Background .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-updat…

1 0

Tageszusammenfassung - Dienstag 3-02-2015
by Daily end-of-shift report 03 Feb '15

03 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 02-02-2015 18:00 − Dienstag 03-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Cisco Anyconnect and Cisco HostScan Web Launch XSS Vulnerability *** --------------------------------------------- A vulnerability in Cisco AnyConnect Secure Mobility Client and Cisco Host Scan could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the client when AnyConnect is launched through the web interface. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco UCS C-Series Rack Servers Integrated Management Controller Cross-Frame Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web interface of the Cisco Integrated Management Controller of the Cisco Unified Computing System C-Series Rack Servers could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Remember Me Safely - Secure Long-Term Authentication Strategies *** --------------------------------------------- Lets say you have a web application with a user authentication system, wherein users must provide a username (or email address) and password to access certain resources. Lets also say that its properly designed (it uses .. --------------------------------------------- https://resonantcore.net/blog/2015/02/remember-me-safely-secure-long-term-a… *** How a penetration test helps you meet PCI compliance guidelines *** --------------------------------------------- In order to protect credit card data, sometimes businesses have to think like a hacker. Every year, merchants who transmit, process, or store payment card data must conduct a suite of security test... --------------------------------------------- http://www.net-security.org/article.php?id=2213 *** Trotz Update: Adobe warnt vor neuer Flash Player-Lücke *** --------------------------------------------- Nachdem vor einer Woche kritische Sicherheitslücken geschlossen wurden, muss Adobe erneut warnen --------------------------------------------- http://derstandard.at/2000011209756 *** DSA-3151 python-django - security update *** --------------------------------------------- Several vulnerabilities were discovered in Django, a high-level Pythonweb development framework. The Common Vulnerabilities and Exposuresproject identifies the following problems: --------------------------------------------- https://www.debian.org/security/2015/dsa-3151 *** Creative Evasion Technique Against Website Firewalls *** --------------------------------------------- During one of our recent in-house Capture The Flag (CTF) events, I was playing with the idea of what could be done with Non-Breaking Spaces. I really wanted to win and surely there had to be a way through the existing evasion controls. This post is going to be a bit code-heavy for most end-users,Read More --------------------------------------------- http://blog.sucuri.net/2015/02/creative-evasion-technique-against-website-f… *** XSS, XFS, Open Redirect Vulnerabilities Found on About.com (SecurityWeek) *** --------------------------------------------- http://www.securityweek.com/xss-xfs-open-redirect-vulnerabilities-found-abo… *** Beware of emails pushing Google Chrome updates! *** --------------------------------------------- Google Chrome users are being actively targeted with a spam email campaign impersonating the Internet giant, urging them to download a newer version of the popular browser because theirs .. --------------------------------------------- http://www.net-security.org/malware_news.php *** Online-Erpresser verschlüsseln Datenbank und fordern 50.000 US-Dollar Lösegeld *** --------------------------------------------- Sicherheitsexperten habe eine perfide Erpressungsmasche entdeckt: Die Täter manipulieren Web-Dienste so, dass sie die von den Nutzern eingegebenen Daten verschlüsselt speichern. --------------------------------------------- http://heise.de/-2535621 *** Low VirusTotal detection rates for new malware, do they matter? *** --------------------------------------------- It is not as important as is often suggested - and doesn't mean the malware is allowed to execute.It is fairly common these days for security researchers to write about new malware attacks and point to low anti-virus detection rates when the affected sample is uploaded to VirusTotals multi-AV .. --------------------------------------------- http://www.virusbtn.com/blog/2015/02_03.xml? *** Google belohnt auch Sicherheitsforscher, die keine Lücken finden *** --------------------------------------------- Wer nach neuen Schwachstellen sucht, weiss nie, ob sich die investierte Zeit rechnet. Bei traditionellen Bug Bounties winkt schliesslich nur im Erfolgsfall Bares. Google experimentiert nun mit einem neuen Ansatz. --------------------------------------------- http://heise.de/-2535890 *** Dumping Git Data from Misconfigured Web Servers *** --------------------------------------------- Every so often when performing a penetration test against a web application or a range of external/internal servers I come across publicly accessible .git directories. Git is a revision control tool that helps keep track of .. --------------------------------------------- https://blog.netspi.com/dumping-git-data-from-misconfigured-web-servers/

1 0

Tageszusammenfassung - Montag 2-02-2015
by Daily end-of-shift report 02 Feb '15

02 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 30-01-2015 18:00 − Montag 02-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Security Advisory for Adobe Flash Player (APSA15-02) *** --------------------------------------------- A Security Advisory (APSA15-02) has been published regarding a critical vulnerability (CVE-2015-0313) in Adobe Flash Player 16.0.0.296 and earlier versions for Windows, Macintosh and Linux. We are aware of reports that this .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1171 *** Cisco NX-OS Software TACACS+ Command Authorization Vulnerability *** --------------------------------------------- The vulnerability is due to incorrect processing of very long command-line interface (CLI) commands by the TACACS+ command authorization feature. An attacker could exploit this vulnerability by being locally authenticated and executing a long CLI command that is subject to command authorization. An exploit could allow the attacker to cause the device to reload. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cobham Sailor 900 VSAT Buffer Overflow Vulnerability *** --------------------------------------------- This alert provides early notice of uncoordinated buffer overflow vulnerability disclosure of the Cobham Sailor 900 VSAT. --------------------------------------------- https://ics-cert.us-cert.gov//alerts/ICS-ALERT-15-030-01 *** Analysis Of An Interesting Windows Kernel Change Mitigating Vulnerabilities In Some Security Products *** --------------------------------------------- Last year I started researching into the Windows kernel to get a better understanding of privilege escalation vulnerabilities. Vulnerabilities in the kernel are a serious issue as they could be used to bypass browsers sandboxes and end up compromising the entire system. In general most people .. --------------------------------------------- https://www.greyhathacker.net/?p=818 *** Akamai's state of the internet security *** --------------------------------------------- A significant increase in the number of DDoS attacks was measured in Q4 2014: a 57 percent increase compared to last quarter and a 90 percent increase compared to Q4 2013. No attack size records were broken. A new attack vector using a Christmas tree packet generated one of the quarters nine largest attacks. --------------------------------------------- http://www.stateoftheinternet.com/downloads/pdfs/2014-internet-security-rep… *** Check autorun entries with VirusTotal - Autoruns v13 *** --------------------------------------------- Version 13 of Autoruns which was release January 29, 2015 includes a very handy feature to check unknown autorun entries with Virustotal 'automatically'. It's integrated .. --------------------------------------------- http://infected.io/41/check-autorun-entries-with-virustotal-autoruns-v13 *** HipChat Security Notice and Password Reset *** --------------------------------------------- Atlassian's security team has discovered and blocked suspicious activity on the HipChat service that resulted in unauthorized access to names, usernames, email addresses, and encrypted passwords for a very small percentage (<2%) of our users. We have no evidence that any payment information was accessed. --------------------------------------------- https://blog.hipchat.com/2015/02/01/hipchat-security-notice-and-password-re… *** Dshell *** --------------------------------------------- An extensible network forensic analysis framework. Enables rapid development of plugins to support the dissection of network packet captures. Key features: Robust stream reassembly IPv4 and IPv6 support Custom output handlers Chainable decoders --------------------------------------------- https://github.com/USArmyResearchLab/Dshell *** Multiple vulnerabilities in Wordpress-plugins *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7777 https://wpvulndb.com/vulnerabilities/7779 https://wpvulndb.com/vulnerabilities/7778 *** RansomWeb ransomware targets companies databases *** --------------------------------------------- Encryption first added as a patch, key only removed when all backups are encrypted.Make backups, they said. Then you wont have to worry about ransomware, they said.Ransomware has quickly become one of the most frustrating kinds of cyber attack. We all know that our devices could suddenly die, and if .. --------------------------------------------- http://www.virusbtn.com/blog/2015/02_02.xml *** Internet Explorer 11 lässt Webseiten Anwender ausspionieren *** --------------------------------------------- Sicherheitsexperten haben eine Schwachstelle im Internet Explorer 11 gefunden, über die Angreifer Webseiten so manipulieren können, dass sie den Anwender ausspionieren. Ein Patch lässt noch auf sich warten – andere Web-Browser sind aber nicht anfällig. --------------------------------------------- http://heise.de/-2534975 *** Flash-Player deaktivieren! Schon wieder Angriffe auf ungepatchte Lücke *** --------------------------------------------- Und täglich grüßt die Flash-Lücke: Nur eine Woche war Ruhe, jetzt ist die nächste kritische Schwachstelle aufgetaucht. Da diese bereits ausgenutzt wird, sollte Flash wieder ein mal abgeschaltet werden. --------------------------------------------- http://heise.de/-2535100 *** OpenSSH: Key-Rotation für die Secure Shell *** --------------------------------------------- Bei der nächsten Version von OpenSSH wird es möglich sein, Server-Keys mit einem automatisierten Verfahren zu rotieren. Bislang ließen sich Schlüssel bei SSH nur mit viel .. --------------------------------------------- http://www.golem.de/news/openssh-key-rotation-fuer-die-secure-shell-1502-11…

1 0

Tageszusammenfassung - Freitag 30-01-2015
by Daily end-of-shift report 30 Jan '15

30 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 29-01-2015 18:00 − Freitag 30-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** The Vast World of Fraudulent Routing *** --------------------------------------------- As network security engineers have attempted to categorize blocks of IP addresses associated with spam or malware for subsequent filtering at their firewalls, the bad guys have had to evolve to continue to target their victims. Since routing ... --------------------------------------------- http://research.dyn.com/2015/01/vast-world-of-fraudulent-routing/ *** Neue Outlook-App: Microsoft liest auch bei Firmenmails mit *** --------------------------------------------- Neue App für Android und iOS mit zweifelhafter Funktionalität - Exchange- und iCloud-Passwörter online gespeichert --------------------------------------------- http://derstandard.at/2000011053283 *** The Internet of Dangerous Things *** --------------------------------------------- Distributed denial-of-service (DDoS) attacks designed to silence end users and sideline Web sites grew with alarming frequency and size last year, according to new data released this week. Those findings dovetail quite closely with .. --------------------------------------------- http://krebsonsecurity.com/2015/01/the-internet-of-dangerous-things/ *** Microsoft Publishes Information Sharing Guidelines *** --------------------------------------------- Microsoft publishes a framework and guidelines on how to effectively set up and operate threat information sharing exchanges in hopes that organizations will actually share data. --------------------------------------------- http://threatpost.com/microsoft-publishes-information-sharing-guidelines/11… *** Blubrry PowerPress <= 6.0 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7773 *** Honeywell HART DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights GmbH HART .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-029-01 *** Multiple vulnerabilities in Cisco WebEx Meetings *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** D-Link routers vulnerable to DNS hijacking *** --------------------------------------------- Todor Donev, a member of the Ethical Hacker research team, says that the vulnerability is found in the ZynOS firmware of the device, D-Links DSL-2740R ADSL modem/wireless router. The firmware in question is implemented in many networking equipment manufactured by D-Link, TP-Link Technologies and ZTE, he noted ... Donev hasnt notified D-Link of this flaw, but has released exploit code for the flaw in a security advisory. --------------------------------------------- http://www.net-security.org/secworld.php?id=17888 *** Drei neue Versionen von Safari: Sicherheitslücken geschlossen *** --------------------------------------------- Für OS X 10.10, OS X 10.9 und OS X 10.8 stehen Updates für den Apple-Browser zur Verfügung. Sie beheben vor allem Sicherheitslücken. --------------------------------------------- http://heise.de/-2530322 *** Nearly half of all DDoS attacks uses multiple attack vectors *** --------------------------------------------- Akamai released a new security report that provides analysis and insight into the global attack threat landscape including DDoS attacks. Akamai observed a 52 percent increase in average peak band... --------------------------------------------- http://www.net-security.org/secworld.php?id=17896 *** GHOST glibc Vulnerability Affects WordPress and PHP applications *** --------------------------------------------- ... security researchers have discovered that PHP applications, including the WordPress Content Management System (CMS), could also be affected by the bug. ... According to the Sucuri researcher Marc-Alexandre Montpas, GHOST vulnerability could be a big issue for WordPress CMS, as it uses wp_http_validate_url() function to validate every pingback post URL. --------------------------------------------- http://thehackernews.com/2015/01/ghost-linux-security-vulnerability_29.html *** BMW-Patzer schürt Angst vor Hackerangriffen auf Autos *** --------------------------------------------- Schwachstelle beim deutschen Autohersteller inzwischen behoben - --------------------------------------------- http://derstandard.at/2000011080438 *** We got hacked! Now what? *** --------------------------------------------- Almost a year ago, I experienced my first real security incident. The companys bulletin board was compromised and it was my job to oversee and coordinate the incident response. The teams and I where pretty much thrown into the cold water, as weve never experienced an incident of that size before. --------------------------------------------- https://www.hashtagsecurity.com/we-got-hacked-now-what/ *** Vertipper-Domains als Geschäftsmodell *** --------------------------------------------- Einer Studie zufolge können Markeninhaber kaum verhindern, dass sogenannte Typosquatter Internet-Domains registrieren, die dem eigenen Namen nur fast entsprechen. --------------------------------------------- http://heise.de/-2533708

1 0

Tageszusammenfassung - Donnerstag 29-01-2015
by Daily end-of-shift report 29 Jan '15

29 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 28-01-2015 18:00 − Donnerstag 29-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** IT-Security-Links #69 *** --------------------------------------------- Trojan.Tubrosa is a new click-fraud malware. The attackers compromise victims' computers via Spam campaigns to use them to automatically inflate their YouTube video views. The malware .. --------------------------------------------- http://securityblog.switch.ch/2015/01/27/it-security-links-69/ *** Asterisk Project Security Advisory - AST-2015-002 *** --------------------------------------------- CVE-2014-8150 reported an HTTP request injection vulnerability in libcURL. Asterisk uses libcURL in its func_curl.so module (the CURL() dialplan function), as well as its res_config_curl.so (cURL realtime backend) modules. Since Asterisk .. --------------------------------------------- http://downloads.asterisk.org/pub/security/AST-2015-002.html *** ENISA Cloud Certification Schemes Metaframework *** --------------------------------------------- ENISA publishes a meta-framework and an online tool to help customers with cloud security when buying cloud services. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa-cloud-certification-s… *** Debian Security Advisory DSA-3143-1 virtualbox -- security update *** --------------------------------------------- CVE-2015-0377, CVE-2015-0418. Two vulnerabilities have been discovered in VirtualBox, a x86 virtualisation solution, which might result in denial of service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3143 *** CVE-2015-0311 (Flash up to 16.0.0.287) integrating Exploit Kits *** --------------------------------------------- Patched with Flash 16.0.0.296 the CVE-2015-0311 has been first seen exploited by Angler EK ( 2015-01-20 ) , soon after used in "standalone" mode in huge malvert campaign (pushing either Reveton, either Bedep (doing adfraud and .. --------------------------------------------- http://malware.dontneedcoffee.com/2015/01/cve-2015-0311-flash-up-to-1600287…

1 0

Tageszusammenfassung - Mittwoch 28-01-2015
by Daily end-of-shift report 28 Jan '15

28 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 27-01-2015 18:00 − Mittwoch 28-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** 2755801 - Update for Vulnerabilities in Adobe Flash Player in Internet Explorer - Version: 36.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/2755801 *** USN-2486-1: OpenJDK 6 vulnerabilities *** --------------------------------------------- Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial .. --------------------------------------------- http://www.ubuntu.com/usn/usn-2486-1/ *** VMware Security Advisories - 1 New, 1 Updated, (Wed, Jan 28th) *** --------------------------------------------- VMware has released an new and updated security advisory today. The two security advisories, listed below, address numerous vulnerabilities in the VMware .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19241 *** Magnetrol HART DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input validation vulnerability in the CodeWrights GmbH HART DTM library utilized by some Magnetrol products. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-027-01 *** Schneider Electric Multiple Products Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in Schneider Electric's SoMove Lite software package. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-027-02 *** CodeWrights GmbH HART DTM Vulnerability (Update B) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-15-012-01A CodeWrights GmbH HART DTM Vulnerability that was published January 13, 2015, on the ICS-CERT web site. This updated advisory provides mitigation details for an improper input validation vulnerability in CodeWrights .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-012-01B *** Bug in ultra secure BlackPhone let attackers decrypt texts, stalk users *** --------------------------------------------- A recently fixed vulnerability in the BlackPhone instant messaging application gave attackers the ability to decrypt messages, steal contacts, and control vital functions of the device, which is marketed as a more secure way to protect communications from government and criminal snoops. --------------------------------------------- http://arstechnica.com/security/2015/01/bug-in-ultra-secure-blackphone-let-… *** CVE-2015-0016: Escaping the Internet Explorer Sandbox *** --------------------------------------------- I analyzed this vulnerability (designated as CVE-2015-0016) because it may be the first vulnerability in the wild that showed the capability to escape the Internet Explorer sandbox. As sandboxing represents a key part of exploit mitigation techniques, any exploit that can break established sandboxes is worth a second look. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2015-0016-es… *** Multiple vulnerabilities in the FreeBSD kernel code *** --------------------------------------------- Francisco Falcon from the Core Exploit Writers Team found multiple vulnerabilities in the FreeBSD kernel code that implements the vt console driver (previously known as Newcons) and the .. --------------------------------------------- http://www.net-security.org/secworld.php?id=17882 *** Neue Apple-TV-Software behebt zahlreiche Sicherheitslücken *** --------------------------------------------- Neben iOS 8.1.3 und OS X 10.10.2 hat Apple am Dienstagabend auch noch ein Update der Software seiner Multimediabox veröffentlicht. Neue Funktionen hat die offenbar nicht, dafür jede Menge Fixes. --------------------------------------------- http://heise.de/-2530119 *** Apple security updates 27 Jan 2015 *** --------------------------------------------- http://support.apple.com/en-us/HT1222

1 0

Tageszusammenfassung - Dienstag 27-01-2015
by Daily end-of-shift report 27 Jan '15

27 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 26-01-2015 18:00 − Dienstag 27-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Java is the biggest vulnerability for US computers *** --------------------------------------------- Oracles Java poses the single biggest security risk to US desktops, according to a new report from Copenhagen-based security vendor Secunia ApS, because of its penetration rate, number of vulnerabilities, and patch status.According to the report, 48 percent of users arent running the .. --------------------------------------------- http://www.csoonline.com/article/2875535/application-security/java-is-the-b… *** Beyond "fake invoice" scams - crooks can get money out of real invoices, too! *** --------------------------------------------- If I told you to change your record of a suppliers bank account so I got all the payments, would you do so? 1000s of companies did, and didnt spot the misdirected payments until an average of $100,000 had gone west... --------------------------------------------- https://nakedsecurity.sophos.com/2015/01/26/beyond-fake-invoice-scams-crook… *** ENISA draws the Cyber Threat Landscape 2014: 15 top cyber threats, cyber threat agents, cyber-attack methods and threat trends for emerging technology areas *** --------------------------------------------- ENISA's Threat Landscape 2014 (ETL 2014) published today is the third yearly report in sequence, consolidating and analysing the top cyber threats and the evolution, encountered in 2014. ENISA Threat Landscape 2014, an activity contributing towards achieving the objectives formulated in the Cyber Security Strategy for the EU, stresses the importance of threat analysis and the identification of emerging trends in cyber security. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa-draws-the-cyber-threa… *** Critical glibc update (CVE-2015-0235) in gethostbyname() calls *** --------------------------------------------- A heap-based buffer overflow was found in glibc's __nss_hostname_digits_dots() function, which is used by the gethostbyname() and gethostbyname2() glibc function calls. A remote attacker able to make an application call either of these functions could use this flaw to execute arbitrary code with the permissions of the user running the application. --------------------------------------------- http://ma.ttias.be/critical-glibc-update-cve-2015-0235-gethostbyname-calls/ *** Security updates available for Adobe Flash Player *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of reports that CVE-2015-0311 is actively being exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below. Adobe recommends .. --------------------------------------------- https://helpx.adobe.com/security/products/flash-player/apsb15-03.html

1 0

Tageszusammenfassung - Montag 26-01-2015
by Daily end-of-shift report 26 Jan '15

26 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 23-01-2015 18:00 − Montag 26-01-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** System Center Endpoint Protection support for Windows Server 2003 *** --------------------------------------------- >From July 14, 2015, Windows Server 2003 will cease to be a supported operating system. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/01/23/system-center-endpoint-p… *** Sicherheitslücke in Millionen Android-Geräten: Google empfiehlt Chrome oder Firefox als Abhilfe *** --------------------------------------------- Scharfe Kritik gibt es seit bekannt wurde, dass Google Sicherheitslücken im alten Standard-Browser von Android nicht mehr schließen will. Die Abhilfe, die Google nun empfiehlt, ist nicht so recht befriedigend. --------------------------------------------- http://heise.de/-2528130 *** OS X 10.10.2: Apple patcht "Thunderstrike"-Angriff und Googles Zeroday-Lücken *** --------------------------------------------- In der jüngsten Yosemite-Beta sollen gleich mehrere problematische Fehler behoben sein. Wann die Finalversion erscheint, bleibt unklar. Der Entdeckter von "Thunderstrike" kritisierte Apple. --------------------------------------------- http://www.heise.de/newsticker/meldung/OS-X-10-10-2-Apple-patcht-Thunderstr… *** Firewall-Update: IPFire 2.15 auf Core Update 86 aktualisiert *** --------------------------------------------- Die Aktualisierung stopft etliche Sicherheitslücken in diversen Paketen. Die Entwickler empfehlen daher dringend, das Update umgehend einzuspielen und die Firewall anschließend neu zu starten. --------------------------------------------- http://heise.de/-2528391 *** Adobe stiftet Verwirrung mit falschen Versionsangaben für Flash *** --------------------------------------------- Die Flash-Macher haben die kritische Lücke in ihrer Software endlich geschlossen. Leider vermitteln sie auf der offiziellen Flash-Webseite noch den Eindruck, die verwundbare Version wäre die neueste und damit sicher. --------------------------------------------- http://www.heise.de/newsticker/meldung/Adobe-stiftet-Verwirrung-mit-falsche… *** Factsheet: Help! My website is vulnerable to SQL injection *** --------------------------------------------- SQL injection is a popular and frequently used attack on websites, which attackers use to steal large volumes of (client) information. Although there are other types of attacks for capturing this information, SQL injection appears to be a frequently used method.A website becomes vulnerable to SQL injection when attackers are able to influence the queries sent by a website to a database. --------------------------------------------- https://www.ncsc.nl/english/services/expertise-advice/knowledge-sharing/fac… *** Demystifying Cross-Site Request Forgery *** --------------------------------------------- Continuously ranked in the OWASP Top Ten, a large majority of the development community still doesnt understand Cross-Site Request Forgery (CSRF). After years of penetration tests and code reviews, my experiences show that a high percentage of applications, especially new applications, do not have proper CSRF protections in place. This post provides a refresher on CSRF and provides a common defense for this issue. --------------------------------------------- http://software-security.sans.org/blog/2015/01/23/demystifying-cross-site-r… *** Analyzing CVE-2015-0311: Flash Zero Day Vulnerability *** --------------------------------------------- Last week a major zero-day vulnerability (was found in Adobe Flash Player. Over the weekend, Adobe started releasing an update to fix the vulnerability: users who have enabled auto-update have already received the newest version (16.0.0.296). Our analysis has confirmed that the vulnerable code has been modified. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/2RZECpZzdak/ *** Cisco 2900 Series Integrated Services Router Network-Based Application Recognition Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Network-Based Application Recognition (NBAR) protocol process of the Cisco 2900 Series Integrated Services Router could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability occurs when the NBAR process locks. An attacker could exploit this vulnerability by sending simple IP version 4 (IPv4) packets through the router. An exploit could allow the attacker to cause a DoS condition that would require a router restart. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Freitag 23-01-2015
by Daily end-of-shift report 23 Jan '15

23 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 22-01-2015 18:00 − Freitag 23-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Malvertising leading to Flash Zero Day via Angler Exploit Kit *** --------------------------------------------- Background As part of our daily research activity, we came across this blog mentioning an Angler Exploit Kit (EK) instance serving a possible zero day Adobe Flash exploit .. --------------------------------------------- http://research.zscaler.com/2015/01/malvertising-leading-to-flash-zero-day.… *** UPDATED: Security updates available for Adobe Flash Player (APSB15-02) *** --------------------------------------------- A Security Bulletin (APSB15-02) has been published regarding security updates for Adobe Flash Player. These updates address a vulnerability (CVE-2015-0310) that .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1157 *** New RATs Emerge from Leaked Njw0rm Source Code *** --------------------------------------------- In the middle of my research on the remote access Trojan (RAT) known as 'njrat' or 'Njw0rm', I stumbled upon dev-point.com, a site that disguises itself as a site for 'IT enthusiasts' but actually hosts various downloaders, different types of spyware, and RATs. I explored the site and found that they host .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-… *** Multiple vulerabilities in McAffee products *** --------------------------------------------- http://www.securitytracker.com/id/1031618 http://www.securitytracker.com/id/1031617 http://www.securitytracker.com/id/1031616 *** Google Apps Flaw Allowed Hacker to Hijack Account and Disable Two-factor Authentication *** --------------------------------------------- A critical cross-site scripting (XSS) vulnerability in the Google Apps administrator console allowed cyber criminals to force a Google Apps admins to execute just about .. --------------------------------------------- http://thehackernews.com/2015/01/google-account-hacking.html *** Google veröffentlicht weitere OS-X-Lücken *** --------------------------------------------- Im vergangenen Jahr gegründet, dreht Googles Project Zero derzeit so etwas wie eine Vorstellungstour bei den großen Softwareherstellern. Wenn auch wohl nicht ganz in deren Sinne. Nach einer Reihe von Fehlern in Microsofts Windows, ist nun offenbar Apples OS X an der Reihe. --------------------------------------------- http://derstandard.at/2000010780464 *** Microsoft lässt Server-2003-Lücke ungepatcht *** --------------------------------------------- Eine Sicherheitslücke im Netzwerkerkennungsdienst NLA von Windows Server 2003 wird nicht geschlossen, obwohl das Betriebssystem eigentlich noch Sicherheitsupdates erhalten sollte. --------------------------------------------- http://heise.de/-2526994 *** Scareware App Downloaded Over a Million Times from Google Play *** --------------------------------------------- We have recently been investigating an antivirus app in the Google Play store that was displaying fake virus detection results to scare users into purchasing .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/scareware-app-downloaded… *** Adobe will Flash-Lücke erst nächste Woche schliessen *** --------------------------------------------- Im Flash Player klafft eine kritische Lücke, über die Angreifer das System komplett übernehmen können. Diese wird bereits aktiv ausgenutzt. Adobe will sich trotzdem bis nächste Woche mit dem Patch Zeit lassen. --------------------------------------------- http://heise.de/-2527107 *** The Likelihood of Cyber-Terrorism Today *** --------------------------------------------- Introduction The virtual space has over time become something of real importance for business, politics, work, communities and communications. In becoming gradually more and more dependent and addicted to the Internet, .. --------------------------------------------- http://resources.infosecinstitute.com/likelihood-cyber-terrorism-today/ *** How Vulnerabilities Happen: Input Validation Problems, (Fri, Jan 23rd) *** --------------------------------------------- We would like to thank Richard Ackroyd of RandomStormfor reporting a critical input validation error in our site to us. As we have done before, here is how it happened so hopefully you can learn from it as well. Lets start with a bit of ,, --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19221 *** The Internet of Gas Station Tank Gauges *** --------------------------------------------- Automated tank gauges (ATGs) are used to monitor fuel tank inventory levels, track deliveries, raise alarms that indicate problems with the tank or gauge (such as a fuel spill), and to perform leak tests in accordance with environmental regulatory .. --------------------------------------------- https://community.rapid7.com/community/infosec/blog/2015/01/22/the-internet… *** Siemens SIMATIC S7-1200 CPU Web Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an open redirect vulnerability in the SIMATIC S7-1200 CPU family. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-022-01 *** 1&1: Kundenportal akzeptierte jedes Passwort *** --------------------------------------------- Durch eine schwerwiegende Panne stand ein Reseller-Kundenportal von 1&1 sperrangelweit offen. Mit einem beliebigen Passwort bekam man administrativen Zugriff auf Hosting-Pakete und Domains - offenbar sogar auf 1und1.de, gmx.de und web.de. --------------------------------------------- http://heise.de/-2527421 *** Deja vu: PHP-Entwickler schliessen Sicherheitslücke zum zweiten Mal *** --------------------------------------------- Sicherheitsforscher Stefan Esser hat wieder zugeschlagen: Dieses Mal musste er eine von ihm entdeckte Lücke zweimal stopfen lassen. Diese erlaubt es, PHP-Applikationen unter bestimmten Bedingungen aus der Ferne anzugreifen. --------------------------------------------- http://heise.de/-2527525

1 0

Tageszusammenfassung - Donnerstag 22-01-2015
by Daily end-of-shift report 22 Jan '15

22 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 21-01-2015 18:00 − Donnerstag 22-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** "Zero-Day"-Sicherheitslücke in Adobe Flash Player (aktiv ausgenützt) *** --------------------------------------------- Wie der bekannte Sicherheitsforscher "Kafeine" in seinem Blog berichtet (http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-f…), scheint es eine neue, noch ungepatchte Sicherheitslücke im Adobe Flash Player zu geben, die aktiv von zumindest einem Exploit Kit ausgenützt wird. --------------------------------------------- https://cert.at/warnings/all/20150122.html *** Security updates available for Adobe Flash Player (APSB15-02) *** --------------------------------------------- A Security Bulletin (APSB15-02) has been published regarding security updates for Adobe Flash Player. These updates address a vulnerability (CVE-2015-0310) that could be used to circumvent memory randomization mitigations on the Windows platform. Adobe is aware of reports that an .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1157 *** Security Advisory - Vulnerabilities in Pagelines/Platform theme for WordPress *** --------------------------------------------- Users of both the Pagelines and Platform themes should update as soon as possible. During a routine audit for our WAF, we found two dangerous issues: A Privilege Escalation vulnerability .. --------------------------------------------- http://blog.sucuri.net/2015/01/security-advisory-vulnerabilities-in-pagelin… *** Tubrosa threat drives millions of views to scammers' YouTube gaming videos *** --------------------------------------------- Cybercriminals are fraudulently earning advertising revenue by spreading click-fraud threat Trojan.Tubrosa, which sends compromised computers to their .. --------------------------------------------- http://www.symantec.com/connect/blogs/tubrosa-threat-drives-millions-views-… *** CTB-Locker Ransomware Includes Freemium Feature, Extends Deadline *** --------------------------------------------- Last July we came across a crypto-ransomware variant known as Critroni or Curve-Tor-Bitcoin (CTB) Locker. We observed recent improvements to the CTB malware, which now offer a 'free decryption' service, extended deadline to .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/ctb-locker-ranso… *** Multiple vulnerabilities in third-party Drupal-modules *** --------------------------------------------- https://www.drupal.org/node/2411737 https://www.drupal.org/node/2411539 https://www.drupal.org/node/2411527 *** Energy Harvesting: Tastatur erkennt Benutzer durch Eigenheiten beim Tippen *** --------------------------------------------- Tippe, und ich sage dir, wer du bist: Forscher in den USA und China haben eine Tastatur entwickelt, die ihren Besitzer am Tippen erkennt. Das könnte eine Ergänzung zu herkömmlichen Passwörtern sein. Die Tastatur gewinnt per Energy Harvesting elektrische Energie aus den Tippbewegungen. --------------------------------------------- http://www.golem.de/news/energy-harvesting-tastatur-erkennt-benutzer-durch-… *** Is 123456 Really The Most Common Password? *** --------------------------------------------- I recently worked with SplashData to compile their 2014 Worst Passwords List and yes, 123456 tops the list. In the data set of 3.3 million passwords I used for SplashData, almost 20,000 of those were in fact 123456. But how often do you really see people using that, or the second most common .. --------------------------------------------- https://xato.net/passwords/123456-common-password/ *** An analysis of Regins Hopscotch and Legspin *** --------------------------------------------- Perhaps one of the most interesting things we observed in the Regin malware operation are the forgotten codenames for some of its modules. We decided to analyse two of these modules in more detail. --------------------------------------------- http://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-a… *** Confluence Security Advisory - 2015-01-21 *** --------------------------------------------- We have discovered and fixed a vulnerability in our fork of WebWork. Attackers can use this vulnerability to execute Java code of their choice on systems that use this framework. The attacker needs to have an account and be able to access the Confluence web interface. --------------------------------------------- https://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+-… *** Yes, Every Freeware Download Site is Serving Crapware *** --------------------------------------------- When we wrote about what happens when you install the top ten apps from CNET Downloads, about half of the comments were from people saying, 'Well you should download from a trusted source.' The only problem is that there isn't a freeware download site that is free of crapware or adware. And here's the result of our investigation to prove it. --------------------------------------------- http://www.howtogeek.com/207692/yes-every-freeware-download-site-is-serving… *** Contact Form 3.82 - Unauthorized Language Manipulation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7761 *** Dataurization of URLs for A More Effective Phishing Campaign *** --------------------------------------------- Phishing with data: URIs is not a new idea. The concept is relatively simple, taking advantage of many user's inexperience with how data: URIs function in order to trick them into entering credentials into a phishing page. We've seen this .. --------------------------------------------- https://thehackerblog.com/dataurization-of-urls-for-a-more-effective-phishi…

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily