Daily

daily@lists.cert.at

1 participants
3191 discussions

Tageszusammenfassung - Mittwoch 21-01-2015
by Daily end-of-shift report 21 Jan '15

21 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 20-01-2015 18:00 − Mittwoch 21-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Windows Firewall Hook Enumeration *** --------------------------------------------- tl;dr: We're going look in detail at Microsoft Windows Firewall Hook drivers from Windows 2000, XP and 20003. This functionality was leverage ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/01/windows-firewall-hook-enumeration/ *** DSA-3133 privoxy - security update *** --------------------------------------------- https://www.debian.org/security/2015/dsa-3133 *** Siemens SCALANCE X-300/X408 Switch Family DOS Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for denial-of-service vulnerabilities in the Siemens SCALANCE X-300/X408 switch family. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-020-01 *** Schneider Electric ETG3000 FactoryCast HMI Gateway Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities in Schneider Electric's ETG3000 series FactoryCast HMI Gateways. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-020-02 *** Oracle Critical Patch Update Advisory - January 2015 *** --------------------------------------------- Description A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the .. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html *** Google publiziert ungepatchte Lücke in OS X 10.9.5 *** --------------------------------------------- Nachdem der Internetriese im Rahmen seiner Responsible-Disclosure-Politik in den vergangenen Monaten gleich drei offene Windows-Lücken öffentlich machte, ist nun erstmals auch Apple dran. Der Konzern hatte offenbar nicht in der geforderten Zeit reagiert. --------------------------------------------- http://heise.de/-2523449 *** Cisco 2015 Annual Security Report: Java ist sicherer geworden *** --------------------------------------------- 2013 war kein gutes Jahr für Java, denn etliche Sicherheitslücken sorgten für verunsicherte Anwender. Gut, dass Oracle offenbar die richtigen Weichen gestellt hat, denn im vergangenen Jahr wurden deutlich weniger Lücken festgestellt. --------------------------------------------- http://heise.de/-2523408 *** Windows Server 2003 Reaches End of Life In July *** --------------------------------------------- Several readers sent word that were now less than six months away from the end of support for Windows Server 2003. Though the operating systems usage peaked in 2009, it still runs on millions of machines, and many IT departments are just now starting to look at replacements. Although .. --------------------------------------------- http://tech.slashdot.org/story/15/01/21/0423229/windows-server-2003-reaches… *** Bash data exfiltration through DNS (using bash builtin functions) *** --------------------------------------------- After gaining 'blind' command execution access to a compromised Linux host, data exfiltration can be difficult when the system ibinbash2s protected by a firewall. --------------------------------------------- https://forsec.nl/2015/01/bash-data-exfiltration-through-dns-using-bash-bui… *** Discovering and remediating an active but disused botnet *** --------------------------------------------- On a network I help manage, we kept getting malicious DNS alerts for 'luna1.pw' on an appliance we had installed. Due to the way the network was configured, we were able to see the name request coming in but no traffic activity. This .. --------------------------------------------- http://colin.keigher.ca/2015/01/discovering-and-remediating-active-but.html *** rt-sa-2014-010 *** --------------------------------------------- The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if the victim confirms an update on the webinterface during a MITM attack. --------------------------------------------- https://www.redteam-pentesting.de/advisories/rt-sa-2014-010.txt *** Unpatched Vulnerability (0day) in Flash Player is being exploited by Angler EK *** --------------------------------------------- This is a fast post. I will update it heavily in the coming hours/days. I spotted an instance of Angler EK which is sending three different bullets targeting Flash Player : --------------------------------------------- http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-f…

1 0

Tageszusammenfassung - Dienstag 20-01-2015
by Daily end-of-shift report 20 Jan '15

20 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 19-01-2015 18:00 − Dienstag 20-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** How Was Your Credit Card Stolen? *** --------------------------------------------- Almost once a week, I receive an email from a reader who has suffered credit card fraud and is seeking help figuring out which hacked merchant was responsible. I generally reply that this is a fruitless pursuit, and instead encourage readers to keep a close eye on their card statements and .. --------------------------------------------- http://krebsonsecurity.com/2015/01/how-was-your-credit-card-stolen/ *** Symantec Data Center Security: Server Advanced, Multiple Security Issues on Management Server and Protection Policies Rule Bypass *** --------------------------------------------- The management server for Symantec Critical System Protection (SCSP) 5.2.9 and Data Center Security: Server Advanced (SDCS:SA) 6.0.x is susceptible to security issues which could enable privileged access to the management server. Rules in the prevention policies could be bypassed if deployed to SCSP/SDCS:SA agents to restrict access to specific host functionality. --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Verschlüsselung: Neue Angriffe auf RC4 *** --------------------------------------------- Zwei Forscherteams kündigen unabhängig voneinander an, bald neue Angriffe gegen den RC4-Verschlüsselungsalgorithmus vorzustellen. Knapp ein Prozent der Webserver setzt immer noch ausschließlich auf RC4. --------------------------------------------- http://www.golem.de/news/verschluesselung-neue-angriffe-auf-rc4-1501-111805… *** PlugX Malware Found in Official Releases of League of Legends, Path of Exile *** --------------------------------------------- Hacks in Taiwan (HITCON), a security conference hosted in that country, has discovered an attack involving several online games. Official releases of two popular online games were found to be compromised, downloading malware onto computers. HITCON worked with Trend Micro to provide a clean-up .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/plugx-malware-fo… *** Symantec Critical System Protection Multiple Flaws Let Remote Authenticated Users Execute Arbitrary Code, Inject SQL Commands, Conduct Cross-Site Scripting Attacks, and Obtain Potentially Sensitive Information *** --------------------------------------------- Multiple vulnerabilities were reported in Symantec Critical System Protection. A remote authenticated user can execute arbitrary code on the target system. A remote user can conduct cross-site scripting attacks. A remote authenticated .. --------------------------------------------- http://www.securitytracker.com/id/1031566 *** Moodle Bugs Permit Cross-Site Scripting, Cross-Site Request Forgery, and Information Disclosure Attacks *** --------------------------------------------- Multiple vulnerabilities were reported in Moodle. A remote user can cause denial of service conditions. A remote user can conduct cross-site scripting and cross-site request forgery attacks. A remote user can obtain potentially sensitive information. --------------------------------------------- http://www.securitytracker.com/id/1031557 *** F-Secure: Bios-Trojaner aufzuspüren, ist "fast aussichtslos" *** --------------------------------------------- Weil die Antivirenhersteller keine Muster von Regierungs-Malware haben, die PC-Komponenten auf Firmware-Ebene infiziert, können sie diese kaum entdecken. Mikko Hypponen von F-Secure sieht vor allem die Hardwarehersteller in der Pflicht. --------------------------------------------- http://www.golem.de/news/f-secure-bios-trojaner-aufzuspueren-ist-fast-aussi… *** Glorious Leaders Not-That-Glorious Malwares - Part 2 *** --------------------------------------------- This is second (and last) part of the analysis of Korean Central News Agency Malware. If you havent read the first part yet, I would suggest reading that first here. First of all I should mention that its not launch.exe and .. --------------------------------------------- https://www.codeandsec.com/Glorious-Leaders-Not-That-Glorious-Malwares-Part… *** Owning Modems And Routers Silently *** --------------------------------------------- Do you have cable internet? Own a surfboard modem? Since most of my buddies in AZ do, I sent them to this page and to my amusement, they got knocked off the net for a few minutes. How? Javascript. Specifically a CSRF in the Motorolla Surfboard. --------------------------------------------- http://www.gironsec.com/blog/2015/01/owning_modems_and_routers_silently/ *** Libavcodec: Fehler erlauben Codeausführung in VLC-Codecbibliothek *** --------------------------------------------- Speziell präparierte Videodateien können zur Codeausführung unter anderem in VLC genutzt werden. Dessen Entwickler verhalten sich aber zurückhaltend, zudem werfen die Berichte einige Fragen auf. --------------------------------------------- http://www.golem.de/news/libavcodec-fehler-erlauben-codeausfuehrung-in-vlc-… *** Go Static or Go Home - Inviting the Trojan Horse Inside *** --------------------------------------------- And then, after all that spending on all that complexity for defense, some of us go on to install a DCMS (Dynamic Content Management System) as our public-facing web server. This approach is like building a mighty walled city and then inviting the Trojan horse inside, or making Achilles invulnerable to harm except for his heel. --------------------------------------------- http://queue.acm.org/detail.cfm?id=2721993 *** ENISA Warns of Internet Vulnerabilities (InfoRiskToday) *** --------------------------------------------- The Internet infrastructure remains susceptible to a variety of threats, including routing attacks, DNS spoofing and poisoning attacks and distributed denial-of-service disruptions. But a number of best practices can help prevent related exploits, a new EU government study says. --------------------------------------------- http://www.inforisktoday.com/enisa-warns-internet-vulnerabilities-a-7814 *** Session Hijacking Cheat Sheet *** --------------------------------------------- 'Session Hijacking' is an old and routine topic in the field of application security. To make it more interesting, in this article, we are going to focus on different ways it can be performed. Introduction for beginners Web .. --------------------------------------------- http://resources.infosecinstitute.com/session-hijacking-cheat-sheet/ *** Paper: Nesting doll: unwrapping Vawtrak *** --------------------------------------------- Raul Alvarez unwraps the many layers of an increasingly prevalent banking trojan.Banking trojans remain one of the most prevalent kinds of malware. Among them, trojans based on Zeus have long been the most prevalent, but in recent months a relatively new trojan has been challenging the reign of Zeus: Vawtrak.Also known as Neverquest or Snifula, Vawtrak initially targeted users of Japanese banking systems, but it has since broadened its scope. In a recent paper (pdf), Sophos researcher James --------------------------------------------- http://www.virusbtn.com/blog/2015/01_20.xml *** GoDaddy CSRF Vulnerability Allows Domain Takeover *** --------------------------------------------- tl;dr: An attacker can leverage a CSRF vulnerability to take over domains registered with GoDaddy. The vulnerability has been patched. --------------------------------------------- http://breakingbits.net/2015/01/18/taking-over-godaddy-accounts-using-csrf/ *** Finding Privilege Escalation Flaws in Linux *** --------------------------------------------- We often tend to ignore privilege escalation flaws. In order to take advantage of these vulnerabilities, an attacker first needs to have access to the system itself. But in particular for systems that many users have access to, it can be difficult to monitor them all for compromised .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19207

1 0

Tageszusammenfassung - Montag 19-01-2015
by Daily end-of-shift report 19 Jan '15

19 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 16-01-2015 18:00 − Montag 19-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Survey says security products waste our time *** --------------------------------------------- A survey of information-technology professionals published on Friday found that the average large organization has to sift through nearly 17,000 malware alerts each week to find the 19 percent that are considered reliable. The efforts at .. --------------------------------------------- http://arstechnica.com/security/2015/01/survey-says-security-products-waste… *** A Lot of Security Purchases Remain Shelfware *** --------------------------------------------- Companies may be investing more in security, but many are either underutilizing their new purchases or not using them at all, an Osterman Research survey shows. --------------------------------------------- http://www.darkreading.com/a-lot-of-security-purchases-remain-shelfware/d/d… *** Report: Mercenaries Behind APT Attacks *** --------------------------------------------- An increasing number of sophisticated cyber-attacks are not being launched by governments - or their intelligence services - but rather by opportunistic mercenaries who sell whatever they can steal to the highest bidder, according to a new .. --------------------------------------------- http://www.inforisktoday.com/report-mercenaries-behind-apt-attacks-a-7806 *** Dridex Banking Trojan Begins 2015 with a Bang *** --------------------------------------------- In October, we called out a series of attacks installing the Dridex Trojan using macros in Microsoft Word documents. Those attacks continued over the last few ... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/dridex-banking-trojan-be… *** Use-after-Free: New Protections, and how to Defeat them *** --------------------------------------------- The Problem Memory corruption has plagued computers for decades, and these bugs can often be transformed into working cyber-attacks. Memory corruption is a situation where an attacker (malicious user of an application or network protocol) is .. --------------------------------------------- http://labs.bromium.com/2015/01/17/use-after-free-new-protections-and-how-t… *** Bypassing the Android PIN using fast tapping - Lock screens are still hard *** --------------------------------------------- It turns out that during that brief period we have access to the phone and if we time our actions right, we can start programs or change settings by quickly tapping on the screen. Surely it's a bit tedious to do so, but .. --------------------------------------------- http://itinsight.hu/en/posts/articles/2015-01-28-android-bypass/ *** New Guide by ENISA: Actionable Information for Security Incident Response *** --------------------------------------------- ENISA publishes a good practice guide on Actionable Information for Security Incident Response, aiming to provide a picture of the challenges national CERTs and other security organizations encounter ... --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/new-guide-by-enisa-actionab… *** VB2014 paper: OPSEC for security researchers *** --------------------------------------------- Vicente Diaz teaches researchers the basics of OPSEC.Since the close of the VB2014 conference in Seattle in October, we have been sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added OPSEC for security researchers by Kaspersky researchers Vicente .. --------------------------------------------- http://www.virusbtn.com/blog/2015/01_19.xml *** DSA-3131 xdg-utils - security update *** --------------------------------------------- John Houwer discovered a way to cause xdg-open, a tool that automaticallyopens URLs in a users preferred application, to execute arbitrarycommands remotely. --------------------------------------------- https://www.debian.org/security/2015/dsa-3131 *** Hacked. A Short Story. *** --------------------------------------------- It all started when I was asked (as a freelancer) to configure exim4, so that newsletters would not fall into spam folders. They even sent me a link to a tutorial. I thought the work would take a couple of hours, including the DNS update, but I was wrong. After logging in as root, I started my favorite .. --------------------------------------------- http://kukuruku.co/hub/infosec/hacked-a-short-story-of-a-hack *** 2013-11-08: Remote code execution vulnerability in CAP 501 / CAP 505 / SMS 510 *** --------------------------------------------- http://search.abb.com/library/Download.aspx?DocumentID=1MRS757865&LanguageC… *** Tyupkin ATM Malware Analysis *** --------------------------------------------- Introduction Some time ago, Kaspersky discovered and reported a new type of malicious program called Tyupkin, which targets ATM machines by moving beyond targeting consumers with card skimmers that steal debit card numbers to directly getting cash .. --------------------------------------------- http://resources.infosecinstitute.com/tyupkin-atm-malware-analysis/ *** China: Attacke gegen Microsofts Outlook *** --------------------------------------------- Offenbar Versuch einer Man-in-the-Middle-Attacke - Angreifer wollten Verschlüsselung austricksen --------------------------------------------- http://derstandard.at/2000010596970 *** Certified Secure Advisory 14-01-2015-0.1 - PolarSSL *** --------------------------------------------- During a routine research session, Certified Secure found a "Use of uninitialized memory" vulnerability in the PolarSSL (https://polarssl.org) library. The vulnerability is present in the asn1_get_sequence_of routine that is .. --------------------------------------------- https://www.certifiedsecure.com/polarssl-advisory/ *** Traffic Patterns For CryptoWall 3.0 *** --------------------------------------------- This is a guest diary submitted by Brad Duncan. Various sources have reported version 3 of CryptoWall has appeared [1] [2] [3]. This malware is currently seen from exploit kits and phishing emails. CryptoWall is one of many ransomware trojans that encrypt the personal files on your computer .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19203

1 0

Tageszusammenfassung - Freitag 16-01-2015
by Daily end-of-shift report 16 Jan '15

16 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 15-01-2015 18:00 − Freitag 16-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Definitions matter. For crying out loud, securobods, BE SPECIFIC - ENISA *** --------------------------------------------- Use your words or the DDoSers will GET you.... Definitions matter when your infrastructure is under threat says European Union Agency for Network and Information Security (ENISA). --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/15/if_you_want… *** Critical Patch Update - January 2015 - Pre-Release Announcement *** --------------------------------------------- This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Critical Patch Update for January 2015, which will be released on Tuesday, January 20, 2015. While this Pre-Release Announcement is as accurate as possible at the time of publication, the information it contains may change before publication of the Critical Patch Update Advisory. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html *** Google AdWords Campaigns Hijacked by Malvertisers *** --------------------------------------------- Two Google AdWords campaigns have been hijacked by malvertisers and users are being redirected to fraud sites without even clicking the poisoned ads. --------------------------------------------- http://threatpost.com/google-adwords-campaigns-hijacked-by-malvertisers/110… *** Telekom-Tools für sichere Server-Konfiguration *** --------------------------------------------- Die Telekom nimmt Admins an die Hand und liefert kostenlose Tools, die bei der Härtung von nginx, MySQL und Co. helfen. --------------------------------------------- http://heise.de/-2517840 *** Sicherheitsfirmen warnen vor "Je Suis Charlie"-Trojaner *** --------------------------------------------- Vermeintliches Solidaritätsvideo lädt tatsächlich Schadsoftware auf den Rechner --------------------------------------------- http://derstandard.at/2000010489196 *** Seven Months' Worth of Mistakes: A Longitudinal Study of Typosquatting Abuse *** --------------------------------------------- In particular we reveal that, even though 95 percent of the popular domains we investigated are actively targeted by typosquatters, only few trademark owners protect themselves against this practice by proactively registering their own typosquatting domains. A small fraction of those typosquatted domains -- such as gooogle.com for google.com -- were registered by the legitimate website in a bid to foil typosquatters. --------------------------------------------- https://lirias.kuleuven.be/bitstream/123456789/471369/3/typos-final.pdf *** Employee Threat Assessment Template for Large Organizations *** --------------------------------------------- Despite the popular image of the hacker cracking distant servers from his basement, studies show that people with legitimate access to your information pose an even bigger threat. And when information is stolen from within, it's often harder to trace and determine the extent of the problem. The larger your [...]The post Employee Threat Assessment Template for Large Organizations appeared first on InfoSec Institute. --------------------------------------------- http://resources.infosecinstitute.com/employee-threat-assessment-template-l… *** Details zur kritischen Lücke im Telnet-Server von Windows *** --------------------------------------------- Auf einer chinesischen Website ist eine detaillierte Analyse der gerade erst gepatchten Telnet-Lücke aufgetaucht - und ein Proof-of-Concept. --------------------------------------------- http://heise.de/-2518951 *** Cisco Adaptive Security Appliance DHCPv6 Relay Denial of Service Vulnerability *** --------------------------------------------- CVE-2015-0578 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco Hosted WebEx Meeting Center Information Disclosure *** --------------------------------------------- CVE-2015-0590 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** T-Mobile Internet Manager UpdateCfg.ini SEH buffer overflow *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99945 *** Alienvault OSSIM Web UI command execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99951 *** Arbiter Systems 1094B GPS Clock Spoofing Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a GPS clock spoofing vulnerability in the Arbiter Systems 1094B clock. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-345-01 *** GE Proficy HMI/SCADA CIMPLICITY CimView Memory Access Violation *** --------------------------------------------- This advisory provides mitigation details for a memory access violation vulnerability in GE's CIMPLICITY CimView application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-289-02 *** Windows: Impersonation Check Bypass With CryptProtectMemory and CRYPTPROTECTMEMORY_SAME_LOGON flag *** --------------------------------------------- Platform: Windows 7, 8.1 Update 32/64 bit Class: Security Bypass/Information Disclosure The function CryptProtectMemory allows an application to encrypt memory for one of three scenarios, process, logon session and computer. When using the logon session option (CRYPTPROTECTMEMORY_SAME_LOGON flag) the encryption key is generated based on the logon session identifier, this is for sharing memory between processes running within the same logon. --------------------------------------------- https://code.google.com/p/google-security-research/issues/detail?id=128 *** DSA-3129 rpm - security update *** --------------------------------------------- Two vulnerabilities have been discovered in the RPM package manager. --------------------------------------------- https://www.debian.org/security/2015/dsa-3129 *** Information Disclosure in Direct Mail Subscription (direct_mail_subscription) *** --------------------------------------------- It has been discovered that the extension "Direct Mail Subscription" (direct_mail_subscription) is susceptible to Information Disclosure. --------------------------------------------- http://www.typo3.org/news/article/information-disclosure-in-direct-mail-sub… *** WiFi File Browser Pro v2.0.8 Code Execution Vulnerability *** --------------------------------------------- Topic: WiFi File Browser Pro v2.0.8 Code Execution Vulnerability Risk: High Text:Document Title: WiFi File Browser Pro v2.0.8 - Code Execution Vulnerability References (Source): == http:/... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010087

1 0

Tageszusammenfassung - Donnerstag 15-01-2015
by Daily end-of-shift report 15 Jan '15

15 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 14-01-2015 18:00 − Donnerstag 15-01-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** CryptoWall 3.0 Uses I2P Anonymity Network For CC Communications (SecurityWeek) *** --------------------------------------------- Almost two months have passed since the developers of CryptoWall released an updated version of the threat, but now they’re back to work. The malware, distributed via spam and malvertising campaigns, helped cybercriminals make a lot of money last year so it’s not surprising that its authors continue improving it. --------------------------------------------- http://www.securityweek.com/cryptowall-30-uses-i2p-anonymity-network-cc-com… *** AdSense Abused with Malvertising Campaign *** --------------------------------------------- Last weekend we noticed a large number of requests to scan websites for malware because they randomly redirected to some "magazine" websites. Most of them mentioned the lemode-mgz .com site. In all cases, the symptoms were the same. Some users randomly got redirected when they clicked on links or loaded new pages. They all reported... --------------------------------------------- http://blog.sucuri.net/2015/01/adsense-abused-with-malvertising-campaign.ht… *** Anatomy Of A Cyber-Physical Attack (Dark Reading) *** --------------------------------------------- "If you only consider hackers, you don’t have to be concerned that much. They won't be able to take down a power grid or blow up chemical facilities," says Ralph Langer, founder of Langner Communications and a top Stuxnet expert. The danger is when attackers have an understanding of the physical and engineering aspects of the plant or site they are targeting, he says. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/anatomy-of-a-cyber-phy… *** Kritik an Apples Zwei-Faktor-Schutz *** --------------------------------------------- Apples zweistufige Bestätigung deckt mehrere Cloud-Dienste des Konzerns gar nicht ab, bemängelt eine Nutzerin - ein Angreifer könne auf diese Weise tiefe Einblicke erhalten. --------------------------------------------- http://heise.de/-2517903 *** Private Schlüssel: Gitrob sucht sensible Daten bei Github *** --------------------------------------------- Immer wieder tauchen Daten wie private Schlüssel oder Passwörter in Github-Repositories auf. Mit Hilfe von Gitrob sollen diese gefunden werden können, um sich besser zu schützen. Das öffnet aber auch die Möglichkeiten für einen interessanten Angriff. --------------------------------------------- http://www.golem.de/news/private-schluessel-gitrob-sucht-sensible-daten-bei… *** Security and Military Experts Fall For "Open" Wi-Fi *** --------------------------------------------- According to The Local, an English-language newspaper in Sweden, Gustav Nipe watched earlier this week as around 100 politicians, military officers and journalists logged into a network called “Open Guest” and proceeded to search for various non-work-related things including “forest hikes” and monitor eBay auctions. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002783.html *** ATM: Attacking Multichannel Fraud (InfoRiskToday) *** --------------------------------------------- The increasing globalization of fraud perpetrated by sophisticated organized crime rings has spurred unprecedented growth in cross-channel attacks, security experts from three of the world's leading ATM manufacturers say. That's why ATM deployers can no longer build defenses that focus solely on the ATM channel, executives from Diebold Inc., Wincor Nixdorf AG and NCR Corp. say in this final part of an exclusive three-part interview with Information Security Media Group. --------------------------------------------- http://www.inforisktoday.com/interviews/atm-attacking-multichannel-fraud-i-… *** Patchday: Adobe schließt neun Lücken in Flash *** --------------------------------------------- Die Lücken, die Adobe nun in Flash geschlossen hat, betreffen alle Plattformen. Nutzer sollten die Updates schnellstmöglich installieren, da sie Angriffe aus dem Netz ermöglichen. --------------------------------------------- http://heise.de/-2517426 *** Cybercrime: Hacking als aufstrebender Wirtschaftszweig in Österreich *** --------------------------------------------- Internet-Sicherheitsbericht 2014 präsentiert - Ungeschützte Smartphones und Tablets als Ziele --------------------------------------------- http://derstandard.at/2000010445114 *** JSA10669 - 2015-01 Security Bulletin: Junos: Multiple vulnerabilities in libxml2 library *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10669&actp=RSS *** JSA10667 - 2015-01 Security Bulletin: Junos: Privilege escalation vulnerability (CVE-2014-6384) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10667&actp=RSS *** Cisco Identity Services Engine Cross-Site Scripting Vulnerability *** --------------------------------------------- CVE-2014-8022 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Unified Communications Domain Manager Admin GUI DoS Vulnerability *** --------------------------------------------- CVE-2015-0591 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Simple Security plugin for WordPress wp-admin/users.php script cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99931 *** SA-CONTRIB-2015-022 - nodeauthor - Cross Site Scripting (XSS) - Unsupported *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-022Project: nodeauthor (third-party module)Version: 7.xDate: 2015-January-14Security risk: 12/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site ScriptingDescriptionThis module displays node author information in a jQuery slider.The module doesnt sufficiently sanitize Profile2 fields in a provided block.This vulnerability is mitigated by the fact that an attacker must have a user account allowed to --------------------------------------------- https://www.drupal.org/node/2407401 *** SA-CONTRIB-2015-021 - Content Analysis - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-021Project: Content Analysis (third-party module)Version: 6.xDate: 2014-January-14Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThe Content Analysis module is an API designed to help modules that need to analyze content.The module fails to sanitize user input in log messages, leading to a Cross Site Scripting (XSS) vulnerability.This vulnerability is mitigated by the fact --------------------------------------------- https://www.drupal.org/node/2407395 *** SA-CONTRIB-2015-020 - Contact Form Fields - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-020Project: Contact form fields (third-party module)Version: 6.xDate: 2014-January-14Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionThe Contact Form Fields module enables you to create additional fields to site-wide contact form.Some links were not properly protected from CSRF. A malicious user could cause an administrator to delete fields by getting the --------------------------------------------- https://www.drupal.org/node/2407357 *** SA-CONTRIB-2015-018 - Video - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-018Project: Video (third-party module)Version: 7.xDate: 2015-January-14Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site ScriptingDescriptionThis module enables you to upload, convert and playback videos.The module doesnt sufficiently sanitize node titles when using the video WYSIWYG plugin, thereby opening a Cross Site Scripting (XSS) vulnerability.This vulnerability is mitigated by --------------------------------------------- https://www.drupal.org/node/2407341 *** SA-CONTRIB-2015-015 - Term Merge - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-015Project: Term merge (third-party module)Version: 7.xDate: 2015-January-14Security risk: 12/25 ( Moderately Critical) AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThis module enables you to merge (synonymous) taxonomy terms among themselves.The module doesnt sufficiently filter user input under certain conditions, thereby opening a Cross Site Scripting (XSS) vulnerability.This vulnerability is --------------------------------------------- https://www.drupal.org/node/2407315 *** PHPKIT result cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99904

1 0

Tageszusammenfassung - Mittwoch 14-01-2015
by Daily end-of-shift report 14 Jan '15

14 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 13-01-2015 18:00 − Mittwoch 14-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** AMD plugs firmware holes that allowed command injection *** --------------------------------------------- Bug your notherboard vendor for a fix, says boffin VID Chip maker AMD has patched holes across its firmware lines that could allow hackers to inject malware. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/14/amd_plugs_c… *** Hintergrund: Universeller SSL-Tester SSLyze *** --------------------------------------------- SSL mit Kommandozeilen-Tools von Hand zu testen, ist mühselig; SSLyze nimmt Admins viel dieser Arbeit ab. --------------------------------------------- http://www.heise.de/security/artikel/Universeller-SSL-Tester-SSLyze-2470008… *** Patchday: Microsoft stopft acht Lücken in Windows *** --------------------------------------------- Am Januar-Patchday überrascht die Firma damit, ausschließlich Lücken in Windows zu schließen. Für den Internet Explorer wird lediglich ein Patch vom Dezember noch einmal aufgewärmt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Patchday-Microsoft-stopft-acht-Lueck… *** MMD-0030-2015 New ELF malware on Shellshock: the ChinaZ *** --------------------------------------------- BackgroundThe bash Shellshock vulnerability is still proven to be one of the fastest way to spread ELF malware infection to NIX boxes in internet, along with Linux system that is still serving the vulnerable version. This fact that is not knowing only by internet security folks, but by the threat actors themself. Previously we announced linux/Mayhem malwarere was utilizing the shellshock previously, and now ELF malware actors in China is starting to utilized set of tools to spread more... --------------------------------------------- http://blog.malwaremustdie.org/2015/01/mmd-0030-2015-new-elf-malware-on.html *** Security updates available for Adobe Flash Player *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. ... CVE number: CVE-2015-0301, CVE-2015-0302, CVE-2015-0303, CVE-2015-0304, CVE-2015-0305, CVE-2015-0306, CVE-2015-0307, CVE-2015-0308, CVE-2015-0309 --------------------------------------------- http://helpx.adobe.com/security/products/flash-player/apsb15-01.html *** Asus schließt kritische Router-Lücke *** --------------------------------------------- Liefert wenige Tage nach Bekanntwerden Updates für zahlreiche Geräte --------------------------------------------- http://derstandard.at/2000010378742 *** Amsterdam 2015 FIRST Technical Colloquium *** --------------------------------------------- The FIRST Amsterdam Technical Colloquium (TC) 2015 will be hosted by Cisco Systems in Amsterdam, Netherlands. The event will be a plenary style conference held on the 5th and 6th of May 2015, with optional, free training sessions on May 4th. FIRST is looking for speakers that would like to present at this Technical Colloquium. This is a GREAT opportunity to give something back to FIRST and the industry, while practicing your speaking skills and sharing your hard work. --------------------------------------------- http://www.first.org/events/colloquia/amsterdam2015 *** At this rate it will hit the launch codes in... 5.3 minutes. *** --------------------------------------------- Hello everyone, in this post I would like to analyze an Android application which purpose is to manage and generate passwords securely. On their Play Store page they claim to use DES to encrypt passwords on local device and that DES key is derivated from you PIN code... --------------------------------------------- https://bughardy.me/at-this-rate-it-will-hit-the-launch-codes-in-5-3-minute… *** MSRT January 2015 - Dyzap *** --------------------------------------------- This month we added the Win32/Emotet and Win32/Dyzap malware families to the Malicious Software Removal Tool. Both Emotet and Dyzap are trojans that steal personal information, including banking credentials. In a previous blog we detailed how Emotet targets German-language banking websites. In this blog, we will focus on Dyzap - another prevalent banking trojan that predominantly targets English-speaking countries. Dyzap variants target credentials for online banking, crypto... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/01/13/msrt-january-2015-dyzap.… *** 4 Mega-Vulnerabilities Hiding in Plain Sight (Dark Reading) *** --------------------------------------------- How four recently discovered, high-impact vulnerabilities provided "god mode" access to 90% of the Internet for 15 years, and what that means for the future. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/4-mega-vulnerabilities… *** Phony Oracle Patches Making the Rounds *** --------------------------------------------- Attackers are circulating fake fixes for Oracle error messages and the company is warning users not to download any patches that don't come directly from Oracle. --------------------------------------------- http://threatpost.com/phony-oracle-patches-making-the-rounds/110415 *** Akamai: Probleme mit alten SSL-Implementierungen *** --------------------------------------------- Akamai verarbeitet eine Billiarde an Verbindungen pro Jahr. Brian Sniffen gibt Einblicke, was das bedeutet - und welche Schwierigkeiten darin bestehen, alte SSL-Implementierungen auszusperren. (Akamai, Android) --------------------------------------------- http://www.golem.de/news/akamai-probleme-mit-alten-ssl-implementierungen-15… *** JSA10670 - 2015-01 Security Bulletin: Junos: Malformed BGP FlowSpec prefix triggers rpd crash (CVE-2014-6386) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10670&actp=RSS *** JSA10668 - 2015-01 Security Bulletin: Junos: Fragmented OSPFv3 packets with IPsec AH may trigger kernel crash (CVE-2014-6385) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10668&actp=RSS *** JSA10666 - 2015-01 Security Bulletin: Junos: Firewall filter fails to match on port (CVE-2014-6383) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10666&actp=RSS *** JSA10665 - 2015-01 Security Bulletin: Junos: jpppd core when MX Series router receives crafted PAP Authenticate-Request (CVE-2014-6382) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10665&actp=RSS *** Cisco ASA DHCPv6 Relay DoS Vulnerability *** --------------------------------------------- CVE-2015-0578 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco TelePresence VCS and Expressway High CPU Utilization Vulnerability *** --------------------------------------------- CVE-2015-0579 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AsyncOS ISQ XSS Vulnerability *** --------------------------------------------- CVE-2015-0577 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AnyConnect User Interface Dialog Rendered When Connecting to Arbitrary Hosts Vulnerability *** --------------------------------------------- CVE-2014-3314 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** VU#117604: Panasonic Arbitrator Back-End Server (BES) uses unencrypted communication *** --------------------------------------------- Vulnerability Note VU#117604 Panasonic Arbitrator Back-End Server (BES) uses unencrypted communication Original Release date: 13 Jan 2015 | Last revised: 13 Jan 2015 Overview Panasonic Arbitrator Back-End Server (BES) uses an unencrypted channel to transmit data. Description CWE-319: Cleartext Transmission of Sensitive InformationPanasonic Arbitrator Back-End Server (BES) uses an unencrypted channel to transmit data between the client and server. It has been reported that Active Directory --------------------------------------------- http://www.kb.cert.org/vuls/id/117604 *** Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Conduct Cross-Site Request Forgery Attacks, and Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1031533 *** Foxit MobilePDF 4.4.0 Local File Inclusion / Arbitrary File Upload *** --------------------------------------------- Topic: Foxit MobilePDF 4.4.0 Local File Inclusion / Arbitrary File Upload Risk: High Text:Document Title: Foxit MobilePDF v4.4.0 iOS - Multiple Web Vulnerabilities References (Source): == http://w... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010071 *** Lexmark MarkVision Enterprise Arbitrary File Upload *** --------------------------------------------- This module exploits a code execution flaw in Lexmark MarkVision Enterprise before 2.1. A directory traversal in the fdFileUploadServlet servlet allows an unauthenticated attacker to upload arbitrary files, including arbitrary JSP code. This module has been tested successfully on Lexmark MarkVision Enterprise 2.0 with Windows 2003 SP2. --------------------------------------------- http://www.exploit-db.com/exploits/35776/ *** Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness *** --------------------------------------------- This tool checks whether a BMC machine is vulnerable to CVE-2014-8272 (http://www.kb.cert.org/vuls/id/843044) by logging the TemporarySessionID/SessionID in each IPMI v1.5 session, and checking that these values are incremental... --------------------------------------------- http://www.exploit-db.com/exploits/35770/ *** Simple Security <= 1.1.5 - Two Cross-Site Scripting (XSS) Vulnerabilities *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7753

1 0

Tageszusammenfassung - Dienstag 13-01-2015
by Daily end-of-shift report 13 Jan '15

13 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 12-01-2015 18:00 − Dienstag 13-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Remember Corel? Its just entered .DLL hell *** --------------------------------------------- Hijack hole found in Corel Draw and other doodleware Local zero day vulnerabilities have been disclosed in Corel applications, potentially affecting more than 100 million users. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/13/hijack_hole… *** Windows logging cheat sheet - Win 7/Win 2008 or later *** --------------------------------------------- This "Windows Logging Cheat Sheet" is intended to help you get started setting up basic and necessary Windows Audit Policy and Logging. By no means is this list extensive; but it does include some very common items that should be enabled, configured, gathered and harvested for any Log Management Program. Start with these settings and add to it as you understand better what is in your logs and what you need. --------------------------------------------- http://sniperforensicstoolkit.squarespace.com/storage/logging/Windows%20Log… *** Docker Secure Deployment Guidelines *** --------------------------------------------- The GitHub repository referenced below aims at providing some deployment guidelines for Docker developers and system administrators alike, that can be used to improve the security posture of Linux containers within a Dockerized environment. --------------------------------------------- http://blog.gdssecurity.com/labs/2015/1/12/docker-secure-deployment-guideli… *** Alert on unauthorized use of domain administrative account for Active Directory *** --------------------------------------------- At JPCERT/CC, we have observed multiple targeted attacks against domestic organizations where attackers intruded and stay within a corporate network for long periods of time and steal information. One characteristic of these attacks is that the attackers in the network steal credentials for the domain administrator account (herein, administrator account) in Active Directory, and leverage this administrator account to launch various attacks across the network. --------------------------------------------- https://www.jpcert.or.jp/english/at/2014/at140054.html *** Skeleton Key Malware Analysis *** --------------------------------------------- Dell SecureWorks Counter Threat Unit(TM) (CTU) researchers discovered malware that bypasses authentication on Active Directory (AD) systems that implement single-factor (password only) authentication. Threat actors can use a password of their choosing to authenticate as any user. ... Skeleton Key is deployed as an in-memory patch on a victims AD domain controllers to allow the threat actor to authenticate as any user, while legitimate users can continue to authenticate as normal. --------------------------------------------- http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-m… *** KeySweeper - Arduino-based Keylogger for Wireless Keyboards *** --------------------------------------------- Security researcher has developed a cheap USB wall charger that is capable to eavesdrop on almost any Microsoft wireless keyboard. MySpace mischief-maker Samy Kamkar has released a super-creepy keystroke logger for Microsoft wireless keyboards cunningly hidden in what appears to be a rather cheap, but functioning USB wall charger. The stealthy Arduino-based device,... --------------------------------------------- http://thehackernews.com/2015/01/KeySweeper-Arduino-Keyboard-Keylogger.html *** Gitrob: Putting the Open Source in OSINT *** --------------------------------------------- Sometimes employees might publish things that should not be publicly available. Things that contain sensitive information or things that could even lead to direct compromise of a system. This can happen by accident or because the employee does not know the sensitivity of the information. Gitrob is a command line tool that can help organizations and security professionals find such sensitive information. --------------------------------------------- http://michenriksen.com/blog/gitrob-putting-the-open-source-in-osint/ *** Aggressive Riskware Installation on Amazon Kindle (and Android) *** --------------------------------------------- As malware continues to grow on Android (900K malicious samples and 1,300 new per day), we sometimes forget attacks can also affect other devices... like Amazons Kindle. The Kindle indeed runs Fire OS, a fork of Android. Thus, in several cases, Android malware also work on Fire OS, and reciprocally. Proof below. ... --------------------------------------------- http://blog.fortinet.com/post/aggressive-riskware-installation-on-amazon-ki… *** OSXCollector: Forensic Collection and Automated Analysis for OS X *** --------------------------------------------- OSXCollector is an open source forensic evidence collection and analysis toolkit for OS X. It was developed in-house at Yelp to automate the digital forensics and incident response (DFIR) our crack team of responders had been doing manually. --------------------------------------------- http://engineeringblog.yelp.com/2015/01/osxcollector-forensic-collection-an… *** ICS London 2015 *** --------------------------------------------- SANS ICS London 2015 hosts four dedicated training courses for those tasked with securing Industrial Control Systems. This specialist training event takes place at the Grand Connaught Rooms in Londons West End, from April 27th to May 2nd 2015. --------------------------------------------- https://www.sans.org/event/ics-london-2015 *** Millionen Android-Geräte mit Sicherheitslücken auf Lebenszeit *** --------------------------------------------- Eine Kernkomponente von Android wird auf Geräten mit älteren Versionen nicht mehr mit Patches versorgt. Dabei ist vor allem deren Standardbrowser Einfallstor für Angreifer. --------------------------------------------- http://www.heise.de/security/meldung/Millionen-Android-Geraete-mit-Sicherhe… *** [2015-01-13] Multiple critical vulnerabilities in all snom desktop IP phones *** --------------------------------------------- All snom desktop IP phones are affected by multiple critical security issues in all available firmware versions. Attackers are able to completely compromise the phone with root access rights and install backdoors to the device which will even survive a factory reset. Furthermore, tapping into phone calls or surveilling the room is possible. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** [2015-01-13] Privilege Escalation & XSS & Missing Authentication in Ansible Tower *** --------------------------------------------- Attackers are able to elevate privileges and gain access to sensitive data of other organizations in Ansible Tower. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** [2015-01-13] Cross site request forgery vulnerability in XBMC / Kodi *** --------------------------------------------- An attacker could potentially gain access to sensitive information stored on the system where XBMC / Kodi is installed by exploiting CSRF issues. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** VU#533140: Tianocore UEFI implementation reclaim function vulnerable to buffer overflow *** --------------------------------------------- Vulnerability Note VU#533140 UEFI EDK1 vulnerable to buffer overflow Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview The EDK1 UEFI reference implementation contains a buffer overflow vulnerability. Description The open source EDK1 project provides a reference implementation of the Unified Extensible Firmware Interface (UEFI). Commercial UEFI implementations may incorporate portions of the EDK1 source code.According to Rafal Wojtczuk and Corey Kallenberg, a buffer... --------------------------------------------- http://www.kb.cert.org/vuls/id/533140 *** Cisco WebEx Meetings Server Information Disclosure Vulnerability *** --------------------------------------------- CVE-2015-0583 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** SSA-311299 (Last Update 2015-01-13): Vulnerabilities in iOS App SIMATIC WinCC Sm@rtClient *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** DFN-CERT-2015-0037 - Red Hat JBoss Data Virtualization: Mehrere Schwachstellen ermöglichen u. a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0037/

1 0

Tageszusammenfassung - Montag 12-01-2015
by Daily end-of-shift report 12 Jan '15

12 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 09-01-2015 18:00 − Montag 12-01-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** SnoopSnitch Android app notifies users of IMSI catchers, SS7 attacks *** --------------------------------------------- SnoopSnitch requires a rooted device with a Qualcomm chipset that runs stock Android 4.1 or higher. --------------------------------------------- http://www.scmagazine.com/free-app-flags-attempts-to-spy-on-mobile-phones/a… *** Cisco WebEx Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SAP NetWeaver Business Client for HTML Input Validation Flaws Permit Cross-Site Scripting Attacks *** --------------------------------------------- A vulnerability was reported in SAP NetWeaver Business Client for HTML. A remote user can conduct cross-site scripting attacks. The Business Client for HTML component does not properly filter HTML code from user-supplied input before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. --------------------------------------------- http://www.securitytracker.com/id/1031509 *** PLAID: Die seltsame Welt der ISO-Standards *** --------------------------------------------- Auf der Real World Crypto berichten Sicherheitsforscher über ihre Erfahrungen mit der ISO. Bei der Standardisierung des Authentifizierungsprotokolls PLAID offenbart sich teilweise eine erschreckende Unkenntnis in Sachen Kryptographie. --------------------------------------------- http://www.golem.de/news/plaid-die-seltsame-welt-der-iso-standards-1501-111… *** Dan J. Bernstein: Krypto-Algorithmen sicher designen *** --------------------------------------------- Der Kryptograph Dan Bernstein fordert auf der Real World Crypto seine Kollegen auf, kryptographische Algorithmen so zu designen, dass ein fehlerhafter Einsatz vermieden wird. Es sei keine gute Idee, immer den Programmierern die Schuld zu geben. --------------------------------------------- http://www.golem.de/news/dan-j-bernstein-krypto-algorithmen-sicher-designen… *** Google No Longer Provides Patches for WebView Jelly Bean and Prior *** --------------------------------------------- Google will no longer be providing security patches for vulnerabilities reported to affect only versions of Android's native WebView prior to 4.4. In other words, Google is now only supporting the current named version of Android (Lollipop, or 5.0) and the prior named version (KitKat, or 4.4). Jelly Bean (versions 4.0 through 4.3) and earlier will no longer see security patches for WebView from Google ... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2015/01/11/google-no… *** Securitys revamped index of pain readies for release *** --------------------------------------------- Comments sought on draft Common Vulnerability Scoring System 3.0 bug rating scheme The great unwashed has been afforded an opportunity to comment on a new scheme for classifying the severity of infosec vulnerabilities issued by the National Institute of Standards and Technology. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/12/securitys_r… *** Ntpdc Local Buffer Overflow *** --------------------------------------------- Alejandro Hdez (@nitr0usmx) recently tweeted about a trivial buffer overflow in ntpdc, a deprecated NTP query tool still available and packaged with any NTP install. He posted a screenshot of the crash as the result of a large buffer passed into a vulnerable gets call. After digging into it a bit, I decided it'd be a fun exploit to write, and it was. There are a few quarks to it that make it of particular interest, of which I've detailed below. --------------------------------------------- http://hatriot.github.io/blog/2015/01/06/ntpdc-exploit/ *** Deciphering the landscape for Privacy by Design. ENISA publishes its recommendations for policy makers, data protection authorities and experts *** --------------------------------------------- http://www.enisa.europa.eu/media/news-items/deciphering-the-landscape-for-p… *** Windows Elevation of Privilege in User Profile Service *** --------------------------------------------- Platform: Windows 8.1 Update 32/64 bit (No other OS tested) When a user logs into a computer the User Profile Service is used to create certain directories and mount the user hives (as a normal user account cannot do so). ... However there seems to be a bug in the way it handles impersonation, the first few resources in the profile get created under the user's token, but this changes to impersonating Local System part of the way through. --------------------------------------------- https://code.google.com/p/google-security-research/issues/detail?id=123 *** Do we need regular IT security fire drills? *** --------------------------------------------- IT security 'fire drills', supported by executive management and the risk committee should be conducted regularly in organizations, in order to understand the appropriate course of action in advance of a security breach. ... Organizations need to move beyond focusing purely on the prevention of security incidents, and start to concentrate on what they will do when an incident occurs. --------------------------------------------- http://www.net-security.org/secworld.php?id=17810 *** Diving into a Silverlight Exploit and Shellcode - Analysis and Techniques *** --------------------------------------------- http://www.checkpoint.com/downloads/partners/TCC-Silverlight-Jan2015.pdf *** Open-Source USB Exploitation Library - Teensyduino *** --------------------------------------------- What is Paensy? Paensy [pan-zee] is a combination of the word payload and Teensy - Paensy is an attacker-oriented, C-based library written for the development of Teensy devices. Paensy simplifies and optimizes mundane tasks and allows an easier platform for scripting. --------------------------------------------- http://malware.cat/?p=89 *** Protecting yourself from Powershell based VBA Macro Attacks *** --------------------------------------------- As some of you may know, I released a standalone Powershell script that will automatically generate a malicious VBA macro using different payloads and persistence methods. This can be found here: https://github.com/enigma0x3/Generate-Macro/blob/master/Generate-Macro.ps1 As a response, I have gotten a few questions from sysadmins about protecting their organizations from an attack like this. Since this type of attack relies on social engineering, there are only a handful of things you can do to --------------------------------------------- https://enigma0x3.wordpress.com/2015/01/11/protecting-yourself-from-powersh…

1 0

Tageszusammenfassung - Freitag 9-01-2015
by Daily end-of-shift report 09 Jan '15

09 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 08-01-2015 18:00 − Freitag 09-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** AIX for penetration testers (SANS Reading Room) *** --------------------------------------------- AIX is a widely used operating system by banks, insurance companies, power stations and universities. The operating system handles various sensitive or critical information for these services. There is limited public information for penetration testers about AIX hacking, compared the other common operating systems like Windows or Linux. --------------------------------------------- https://www.sans.org/reading-room/whitepapers/unix/aix-penetration-testers-… *** Datenschutzpanne in Mac OS X Yosemite *** --------------------------------------------- Die Spotlight genannte Suchfunktion der aktuellen Mac-OS-X-Version hat erneut ein Datenschutzproblem: Stößt sie auf HTML-Mails, lädt sie ungefragt Inhalte aus externen Quellen nach - zur Freude der Spammer. --------------------------------------------- http://www.heise.de/security/meldung/Datenschutzpanne-in-Mac-OS-X-Yosemite-… *** Netflix Credentials Targeted By Phishing Campaign *** --------------------------------------------- A new malicious email campaign has been observed by security researchers to target customers of Netflix by feeding them a message purporting to be an important notification from the media streaming service. ... Users are advised to check the legitimacy of the emails straight on the official page of the service and to avoid clicking on the provided link. All phishing messages can be forwarded to phishing(a)netflix.com for investigation. --------------------------------------------- http://news.softpedia.com/news/Netflix-Credentials-Targeted-By-Phishing-Cam… *** Microsoft advanced notification service changes. , (Fri, Jan 9th) *** --------------------------------------------- Quite a few of you have written in to let us know that Microsoft is changing the way in which they provide information (thanks to you all). ">You can read the full blog here --">/archive/2015/01/08/evolving-advance-notification-service-ans-in-2015.aspx In a nutshell if you want to be advised in advance younow need to register, select the products used and you will then be provided with information relating to the patches that will be released. If you are a premier customer your... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19167&rss *** Banking Trojans Disguised As ICS/SCADA Software Infecting Plants *** --------------------------------------------- Researcher spots spike in traditional financial malware hitting ICS/SCADA networks -- posing as popular GE, Siemens, and Advantech HMI products. A renowned ICS/SCADA security researcher has discovered a surprising twist in cyberattacks hitting plant floor networks: traditional banking Trojan malware posing as legitimate ICS software updates and files rather than the dreaded nation-state custom malware in the wake of Stuxnet. --------------------------------------------- http://www.darkreading.com/attacks-breaches/banking-trojans-disguised-as-ic… *** OpenBSD Releases a Portable Version of OpenNTPD *** --------------------------------------------- Noryungi (70322) writes Theo De Raadt roundly criticized NTP due to its recent security advisories, and pointed out that OpenBSD OpenNTPD was not vulnerable. However, it also had not been made portable to other OS in a long time. Brent Cook, also known for his work on the portable version of LibreSSL (OpenBSD cleanup and refactoring of OpenSSL) decided to take the matter in his own hands and released a new portable version of OpenNTPD. Everyone rejoice, compile and report issues! --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/NJ1R-3x9MVI/story01.htm *** No, the Linux leap second bug WONT crash the web *** --------------------------------------------- Fear the fear, not the second There's a reason space missions don't launch on the day a leap second is added to international clocks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/09/leap_second… *** Asus-Router schutzlos bei Angriffen aus dem eigenen Netz *** --------------------------------------------- Mindestens die Router RT-AC66 und RT-N66U können von Angreifern aus dem LAN komplett gekapert werden. Wahrscheinlich sind weitere Modelle betroffen. Firmware-Updates, die das Loch stopfen, gibt es noch nicht. --------------------------------------------- http://www.heise.de/security/meldung/Asus-Router-schutzlos-bei-Angriffen-au… *** USN-2456-1: GNU cpio vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2456-18th January, 2015cpio vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Ubuntu 10.04 LTSSummaryThe GNU cpio program could be made to crash or run programs if itopened a specially crafted file or received specially crafted input.Software description cpio - a program to manage archives of files DetailsMichal Zalewski discovered an out of bounds write issue in theprocess_copy_in... --------------------------------------------- http://www.ubuntu.com/usn/usn-2456-1/ *** Cisco Unified Communications Domain Manager Platform High CPU DoS Vulnerability *** --------------------------------------------- CVE-2014-8020 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco WebEx Meetings Server Authentication Bypass Vulnerability *** --------------------------------------------- CVE-2014-8033 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** DSA-3122 curl - security update *** --------------------------------------------- Andrey Labunets of Facebook discovered that cURL, an URL transferlibrary, fails to properly handle URLs with embedded end-of-linecharacters. An attacker able to make an application using libcurl toaccess a specially crafted URL via an HTTP proxy could use this flaw todo additional requests in a way that was not intended, or insertadditional request headers into the request. --------------------------------------------- https://www.debian.org/security/2015/dsa-3122 *** DSA-3121 file - security update *** --------------------------------------------- Multiple security issues have been found in file, a tool/library todetermine a file type. Processing a malformed file could result indenial of service. Most of the changes are related to parsing ELFfiles. --------------------------------------------- https://www.debian.org/security/2015/dsa-3121 *** Emerson HART DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights HART DTM library utilized in Emerson's HART DTM. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-008-01-0 *** Schneider Electric Wonderware InTouch Access Anywhere Server Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a stack-based buffer overflow vulnerability in the Wonderware InTouch Access Anywhere Server product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-008-02 *** TP-Link TL-WR840N Cross Site Request Forgery *** --------------------------------------------- Topic: TP-Link TL-WR840N Cross Site Request Forgery Risk: Low Text:Classification: //Dell SecureWorks/Confidential - Limited External Distribution: # # * Title: TP-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010041 *** Wireshark Security Advisories *** --------------------------------------------- wnpa-sec-2015-05. TLS/SSL decryption crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-04. SMTP dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-03. DEC DNA Routing Protocol dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-02. LPP dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-01. WCCP dissector crash. Fixed in 1.12.3, 1.10.12. --------------------------------------------- https://www.wireshark.org/security/ *** Several vulnerabilities have been found in the third party TYPO3 extensions *** --------------------------------------------- extension "Content Rating": http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… | extension "Content Rating Extbase": http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… --------------------------------------------- http://typo3.org/teams/security/security-bulletins

1 0

Tageszusammenfassung - Donnerstag 8-01-2015
by Daily end-of-shift report 08 Jan '15

08 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 07-01-2015 18:00 − Donnerstag 08-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Why patch management is ALSO REQUIRED in ICS infrastructure, (Wed, Jan 7th) *** --------------------------------------------- Security patch management is a delicate issue in critical infrastructure. This is caused for the specific configuration, operating system version and related software required by the ICS platform. Most support contracts states that any modification outside the parameters stated by the manufacturer will void the relation and release manufacturer and seller from any responsibility about malfunction and any consequence on the industrial process. Unfortunately, when we talk about ICS software... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19157&rss *** Assessing the risk of POODLE, (Thu, Jan 8th) *** --------------------------------------------- One of the biggest security announcements in the last year was definitely the POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability, which marked the real end of SSLv3. In a contrast with many other previously identified vulnerabilities in encryption algorithms used by SSLv3, this vulnerability is viable, and can be exploited by an attacker without jumping over too many obstacles or requiring large resources the POODLE vulnerability is real. While this raised quite a bit of... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19159&rss *** wmap - A Chrome Extension for Taking Screenshots of Web Services In Bulk *** --------------------------------------------- wmap is a Chrome extension written mostly in JavaScript which uses the Chrome browser to generate HTML screenshot reports of web services. --------------------------------------------- http://thehackerblog.com/wmap-a-chrome-extension-for-taking-screenshots-of-… *** B-Sides Ljubljana *** --------------------------------------------- First Security B-Sides Ljubljana is about to *happen*. BSides is community driven information security conference that will be held March 12th in Ljubljana, Slovenia, day after Cloud Security Alliance CEE Summit 2015. Call for papers is now online. --------------------------------------------- http://bsidesljubljana.si/ *** Bypassing OpenSSL Certificate Pinning in iOS Apps *** --------------------------------------------- When mobile applications communicate with an API or web service, this should generally happen via TLS/SSL (e.g., HTTPS). ... Since any of the CAs may issue a certificate for any hostname/server, security-conscious applications should "pin" the expected server certificate in the application, i.e., not accept any certificate but the one issued by the known-good CA which the application developer uses. --------------------------------------------- http://chargen.matasano.com/chargen/2015/1/6/bypassing-openssl-certificate-… *** PowerShell Toolkit: PowerSploit *** --------------------------------------------- PowerSploit is a collection of PowerShell scripts which can prove to be very useful during some exploitation and mostly post-exploitation phases of a penetration test. To get the latest version of PowerSploit, visit this URL: https://github.com/mattifestation/PowerSploit If you have GIT, then you can simply run the following command to get... --------------------------------------------- http://resources.infosecinstitute.com/powershell-toolkit-powersploit/ *** Using Free Tools To Detect Attacks On ICS/SCADA Networks *** --------------------------------------------- ICS/SCADA experts say open-source network security monitoring software is a simple and cheap way to catch hackers targeting plant operations. --------------------------------------------- http://www.darkreading.com/perimeter/using-free-tools-to-detect-attacks-on-… *** State of the Internet: Attack traffic, DDoS, IPv4 and IPv6 *** --------------------------------------------- Akamai today released its latest State of the Internet report, which provides insight into key global statistics such as connection speeds and broadband adoption across fixed and mobile networks, over... --------------------------------------------- http://www.net-security.org/secworld.php?id=17798 *** Windows exploitation in 2014 *** --------------------------------------------- Today, we published our research about Windows exploitation in 2014. This report contains interesting information about vulnerabilities in Microsoft Windows and Office patched over the course of the year, drive-by download attacks and mitigation techniques. --------------------------------------------- http://www.welivesecurity.com/2015/01/08/windows-exploitation-2014/ *** Netskope Cloud Report - January 2015 *** --------------------------------------------- In this quarterly Netskope Cloud Report, a key find in that as many as 15 percent of business users have had their credentials compromised. Since up to half of users re-use passwords for multiple accounts, the likelihood of users logging into business-critical apps with these credentials is high, putting business-sensitive data at risk. --------------------------------------------- https://www.netskope.com/reports/netskope-cloud-report-january-2015/ *** Deobfuscating Malicious Macros Using Python *** --------------------------------------------- Over the past few weeks, weve observed cybercriminals spamming users, particularly in the UK, using document files embedded with malicious macros masquerading as invoices. The attachment is either a Word or an Excel document file. Here are some examples incorporating brands based in the UK: Users must enable macros in order for these malicious documents to work. In some cases, the documents include instructions for enabling macros. You may think of document macro viruses as a thing... --------------------------------------------- http://blog.spiderlabs.com/2015/01/tips-for-deobfuscating-the-malicious-mac… *** vBulletin Releases Serious Vulnerability in VBSEO *** --------------------------------------------- The vBulletin team sent an email yesterday to all their clients about a potential security vulnerability on VBSEO. VBSEO is widely used SEO module for vBulletin that was discontinued last year. This makes the problem worse, no patches will be released for it. If you are using VBSEO, you have 3 options: Completely remove VBSEO... --------------------------------------------- http://blog.sucuri.net/2015/01/serious-vulnerability-on-vbseo.html *** Aviator Going Open Source *** --------------------------------------------- One of the most frequent criticisms we've heard at WhiteHat Security about Aviator is that it's not open source. There were a great many reasons why we didn't start off that way, not the least of which was getting the legal framework in place to allow it, but we also didn't want our efforts to... --------------------------------------------- https://blog.whitehatsec.com/aviator-going-open-source/ *** Evolving Microsofts Advance Notification Service in 2015 *** --------------------------------------------- Our Advance Notification Service (ANS) was created more than a decade ago as part of Update Tuesday to broadly communicate in advance, about the security updates being released for Microsoft products and services each month. Over the years, technology environments and customer needs have evolved, prompting us to evaluate our existing information and distribution channels. This desire to improve is why customers may have seen us introduce myBulletins to provide bulletin reports tailored to... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/01/07/evolving-advance-notific… *** OpenSSL Fixes Eight Security Vulnerabilities *** --------------------------------------------- The OpenSSL Project has released several new versions of the software that fix eight security vulnerabilities, including several certificate issues and a couple of denial-of-service flaws. The patches included in OpenSSL 1.0.0p, 1.0.1k and 0.98zd are not for critical or high-risk vulnerabilities, but they do fix some interesting vulnerabilities. Two of the bugs are rated moderate and the other... --------------------------------------------- http://threatpost.com/openssl-fixes-eight-security-vulnerabilities/110279 https://www.openssl.org/news/secadv_20150108.txt *** Cisco Secure Access Control Server Privilege Escalation Vulnerability *** --------------------------------------------- CVE-2014-8027 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Secure Access Control Server Multiple Cross-Site Scripting Vulnerabilities *** --------------------------------------------- CVE-2014-8028 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Secure Access Control Server Open Redirect Vulnerability *** --------------------------------------------- CVE-2014-8029 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Brother MFC-J4410DW Cross Site Scripting *** --------------------------------------------- Topic: Brother MFC-J4410DW Cross Site Scripting Risk: Low Text:Class Cross-Site Scripting Remote Yes Disclosed 9th October 2014 Published 7th January 2015 Credit Dave Daly of Dionach (vu... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010034 *** Pirelli Router WPA weak security *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99682 *** SA-CONTRIB-2015-010 - Log Watcher - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-010Project: Log Watcher (third-party module)Version: 6.xDate: 2015-January-07Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionLog Watcher allows you to monitor your site logs in a systematic way by setting up scheduled aggregations for specific log types.The report administration links are not properly protected from CSRF. A malicious user could cause a log --------------------------------------------- https://www.drupal.org/node/2403463 *** SA-CONTRIB-2015-007 - Htaccess - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-007Project: htaccess (third-party module)Version: 7.xDate: 2015-January-07Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionThe Htaccess module allows the creation and deployment of .htaccess files based on custom settings.Some administration links were not properly protected from Cross Site Request Forgery (CSRF). A malicious user could cause an administrator to deploy or --------------------------------------------- https://www.drupal.org/node/2403445 *** SA-CONTRIB-2015-005 - WikiWiki - SQL injection *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-005Project: WikiWiki (third-party module)Version: 6.xDate: 2015-January-07Security risk: 22/25 ( Highly Critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:AllVulnerability: SQL InjectionDescriptionWikiWiki module gives you one place to create, share and find wiki pages in your site.The module did not sanitize user input inside a database query thereby leading to a SQL Injection vulnerability.CVE identifier(s) issuedA CVE identifier will be requested, and --------------------------------------------- https://www.drupal.org/node/2403375

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily