=======================
= End-of-Shift report =
=======================
Timeframe: Donnerstag 18-09-2014 18:00 − Freitag 19-09-2014 18:00
Handler: Robert Waldner
Co-Handler: Alexander Riepl
*** WordFence WordPress Security Plugin Pushes a Security Update ***
---------------------------------------------
If you are one of the many users of the WordPress Security Plugin, WordFence, we highly encourage you to update. They recently pushed out an important security update that ..
---------------------------------------------
http://blog.sucuri.net/2014/09/security-disclosure-the-wordfence-wordpress-…
*** Multiple vulnerabilities in Cisco products ***
---------------------------------------------
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…
*** CosmicDuke and the latest political news ***
---------------------------------------------
After we had published the CosmicDuke report in July 2014, we continued to actively follow the malware. Today, we discovered two new samples that both leverage timely, political topics to deceive the recipient into opening ..
---------------------------------------------
http://www.f-secure.com/weblog/archives/00002745.html
*** Nuclear exploit kit - complete infection cycle ***
---------------------------------------------
Zscaler ThreatLabZ has been seeing a steady increase in the Nuclear Exploit Kit (EK) traffic over the past few weeks. The detection of malicious activity performed by this EK remains low, due to usage of dynamic content and heavy ..
---------------------------------------------
http://research.zscaler.com/2014/09/nuclear-exploit-kit-complete-infection.…
*** Web Scan looking for /info/whitelist.pac, (Fri, Sep 19th) ***
---------------------------------------------
Nathan reported today that he has been seeing a new trend of web scanning against his webservers looking for /info/whitelist.pac. The scanning he has observed is over SSL. He has been ..
---------------------------------------------
https://isc.sans.edu/diary.html?storyid=18675
*** Asterisk res_fax_spandsp Module Processing Flaw Lets Remote Authenticated Users Deny Service ***
---------------------------------------------
http://www.securitytracker.com/id/1030876
*** Asterisk SIP SUBSCRIBE Type Handling Flaw Lets Remote Authenticated Users Deny Service ***
---------------------------------------------
http://www.securitytracker.com/id/1030875
*** Android ist in Zukunft standardmässig verschlüsselt ***
---------------------------------------------
Wie Google offiziell bekannt gegeben hat, wird die Verschlüsselungsfunktion in Android L erstmals ab Werk eingeschaltet sein.
---------------------------------------------
http://futurezone.at/produkte/android-ist-in-zukunft-standardmaessig-versch…
*** Advantech WebAccess Vulnerabilities ***
---------------------------------------------
Researcher Ricardo Narvaja of Core Security Technologies has identified several buffer overflow vulnerabilities in Advantech's WebAccess application. Advantech has produced a patch that mitigates these vulnerabilities. The researcher has ..
---------------------------------------------
https://ics-cert.us-cert.gov//advisories/ICSA-14-261-01
*** Bugtraq: CVE ID Syntax Change - Deadline Approaching ***
---------------------------------------------
http://www.securityfocus.com/archive/1/533478
*** How to Detect SQL Injection Attacks ***
---------------------------------------------
SQL Injection (SQLi) attacks have been around for over a decade. You might wonder why they are still so prevalent. The main reason is that they still work on quite a few web application targets. In fact, according to Veracode's 2014 State of Security Software Report , SQL injection vulnerabilities still ..
---------------------------------------------
http://thehackernews.com/2014/09/how-to-detect-sql-injection-attacks.html
*** Hackerangriff auf Home Depot: 56 Millionen Kreditkarten betroffen ***
---------------------------------------------
Hacker sind weiter auf Beutezug durch den US-Einzelhandel: Erst verschafften sie sich Zugriff auf rund 40 Millionen Bankkarten bei Target-Supermärkten, jetzt könnten bei der Baumarktkette Home Depot 56 Millionen Karten betroffen sein.
---------------------------------------------
http://www.heise.de/security/meldung/Hackerangriff-auf-Home-Depot-56-Millio…
*** Cloudflare: TLS-Verbindungen ohne Schlüssel sollen Banken schützen ***
---------------------------------------------
Cloudflare bietet Kunden künftig ein neues Feature namens Keyless SSL, mit dem der Teil des TLS-Handshakes, der den privaten Schlüssel benötigt, ausgelagert werden kann. Damit können Unternehmen die Kontrolle über den Schlüssel behalten.
---------------------------------------------
http://www.golem.de/news/cloudflare-tls-verbindungen-ohne-schluessel-sollen…
*** XSS: Cross-Site-Scripting über DNS-Records ***
---------------------------------------------
Eine besonders kreative Variante einer Cross-Site-Scripting-Lücke macht auf der Webseite Hacker News die Runde: Mittels eines TXT-DNS-Records lässt sich auf zahlreichen Webseiten Javascript einfügen.
---------------------------------------------
http://www.golem.de/news/xss-cross-site-scripting-ueber-dns-records-1409-10…
=======================
= End-of-Shift report =
=======================
Timeframe: Mittwoch 17-09-2014 18:00 − Donnerstag 18-09-2014 18:00
Handler: Robert Waldner
Co-Handler: Alexander Riepl
*** How Cops Can Still Pull Data Off Your Locked iPhone, In Spite Of Apple ***
---------------------------------------------
A reminder to iPhone owners cheering Apple's latest privacy win: Just because Apple will no longer help police to turn your smartphone inside out doesn't mean it can prevent the cops from vivisecting the device on their own. On Wednesday evening Apple made news ..
---------------------------------------------
http://www.wired.com/2014/09/apple-iphone-security/
*** SA-CONTRIB-2014-091 - Survey Builder - Cross Site Scripting (XSS) ***
---------------------------------------------
When viewing surveys at "/surveys", the survey titles printed out are not sanitized. Any potentially dangerous code in the survey titles is also rendered. This vulnerability is mitigated by the fact that a user must have the "Create Survey" permission ..
---------------------------------------------
https://www.drupal.org/node/2340069
*** SA-CONTRIB-2014-088 - Mollom - Cross-site scripting (XSS) ***
---------------------------------------------
Mollom offers a feature to report submitted content as inappropriate which allows end users to indicate that a piece of site content is objectionable or out of place. When reporting content, the content title is not sufficiently sanitized to prevent cross-site scripting (XSS) attacks. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create content and the content type must ..
---------------------------------------------
https://www.drupal.org/node/2340029
*** Bugtraq: APPLE-SA-2014-09-17-2 Apple TV 7 ***
---------------------------------------------
http://www.securityfocus.com/archive/1/533468
*** D-BUS Buffer Overflow and Multiple Processing Flaws Let Local Users Obtain Elevated Privileges and Deny Service ***
---------------------------------------------
http://www.securitytracker.com/id/1030864
*** Apple OS X Multiple Flaws Let Remote Users Execute Arbitrary Code and Local Users Gain Elevated Privileges and Obtain Potentially Sensitive Information ***
---------------------------------------------
http://www.securitytracker.com/id/1030868
*** Open Web App Security Project releases new app dev opus ***
---------------------------------------------
The global security community has completed an 18-month effort to produce a guide it is hoped will boost the standard of web application testing and address new and dangerous technologies. Version 4 of the Open Web App Security Projects (OWASPs) Testing Guide was produced by more than 60 security bods from around the world with a core lead team of four.
---------------------------------------------
http://www.theregister.co.uk/2014/09/18/guide_to_obliterating_web_apps_publ…
*** Yokogawa CENTUM and Exaopc Vulnerability ***
---------------------------------------------
Tod Beardsley of Rapid7 Inc., and Jim Denaro of CipherLaw, have identified an authentication vulnerability and released proof-of-concept (exploit) code for the Yokogawa CENTUM CS 3000 series and Exaopc products. JPCERT and Yokogawa have mitigated this vulnerability.
---------------------------------------------
https://ics-cert.us-cert.gov//advisories/ICSA-14-260-01
=======================
= End-of-Shift report =
=======================
Timeframe: Dienstag 16-09-2014 18:00 − Mittwoch 17-09-2014 18:00
Handler: Robert Waldner
Co-Handler: Stephan Richter
*** https://yourfakebank.support -- TLD confusion starts!, (Tue, Sep 16th) ***
---------------------------------------------
Pretty much ever since the new top level domain (TLD) ".biz" went online a couple years ago, and the only ones buying domains in this space were the scammers, we kinda knew what would happen when ICANNs latest folly and money-grab went live. It looks like a number of the "new" top level domains, like ".support", ".club", etc have now come online. And again, it seems like only the crooks are buying. We are currently investigating a wave of phishing emails
---------------------------------------------
https://isc.sans.edu/diary.html?storyid=18651&rss
*** Hintergrund: Nach Snowden: Wenig Schlaf für Kryptoforscher ***
---------------------------------------------
Bei der Internet Engineering Task Force in Toronto stellte Lange vor kurzem einen Überblick über elliptische Kurven Verschlüsselung vor und riet dringend, sich für neuere Varianten zu entscheiden. Sie sprach am Rande der Veranstaltung mit heise Security.
---------------------------------------------
http://www.heise.de/security/artikel/Nach-Snowden-Wenig-Schlaf-fuer-Kryptof…
*** Virus activity overview: Adware and other security events of August 2014 ***
---------------------------------------------
September 1, 2014 The last summer month of 2014 witnessed not only a large number of encryption Trojans in action but also a myriad of malicious programs displaying annoying (and sometimes fraudulent) ads in an effort to generate revenue for the criminals behind them. Also at summers end, Chinese attackers intensified their efforts to port certain Linux malware programs to Windows. In addition, security researchers discovered new threats to Android. Viruses Statistics collected by Dr.Web
---------------------------------------------
http://news.drweb.com/show/?i=5935&lng=en&c=9
*** Netzwerkanalyse-Tool Message Analyzer in Version 1.1 veröffentlicht ***
---------------------------------------------
Microsoft hat sein Sniffing- und Analysetool Message Analyzer in der Version 1.1 herausgebracht. Die neue Fassung schneidet unter anderem Netzwerkdaten aus der Ferne mit oder entschlüsselt SSL-gesicherte Datenströme.
---------------------------------------------
http://www.heise.de/newsticker/meldung/Netzwerkanalyse-Tool-Message-Analyze…
*** Understanding the WordPress Security Plugin Ecosystem ***
---------------------------------------------
As a child, did you ever play that game where you sit in a circle and one person is responsible for whispering something into one persons ear, and that message gets relayed around the circle? Wasn't it always funny to see what the final message received would be? Oh and how it would have morphed as it was processed and conveyed by each individual in the group. This is what I see when I look at the WordPress Security Ecosystem.
---------------------------------------------
http://blog.sucuri.net/2014/09/understanding-the-wordpress-security-plugin-…
*** FreeBSD Denial of Service advisory (CVE-2004-0230), (Tue, Sep 16th) ***
---------------------------------------------
A vulnerability has been discovered by Johnathan Looney at the Juniper SIRT in FreeBSD (base for Junos and many other products) in the way that FreeBSD processes certain TCP packets (https://www.freebsd.org/security/advisories/FreeBSD-SA-14:19.tcp.asc) If you send TCP SYN packets for an existing connection (i.e. the correct source IP, source port, destination IP, destination port combination) the operating system will tear down the connection. The attack is similar to the "slipping in the
---------------------------------------------
https://isc.sans.edu/diary.html?storyid=18657&rss
*** EMC Documentum Content Server Flaws Let Remote Authenticated Users Gain Elevated Privileges ***
---------------------------------------------
http://www.securitytracker.com/id/1030855
*** Bugtraq: Android Bluetooth Pairing Packet Processing Vulnerability (by wangzq from NCNIPC) ***
---------------------------------------------
http://www.securityfocus.com/archive/1/533462
*** DSA-3025-1 apt -- security update ***
---------------------------------------------
It was discovered that APT, the high level package manager, does not properly invalidate unauthenticated data (CVE-2014-0488), performs incorrect verification of 304 replies (CVE-2014-0487), does not perform the checksum check when the Acquire::GzipIndexes option is used (CVE-2014-0489) and does not properly perform validation for binary packages downloaded by the apt-get download command (CVE-2014-0490). For the stable distribution (wheezy), these problems have been fixed in version...
---------------------------------------------
https://www.debian.org/security/2014/dsa-3025
*** Schneider Electric SCADA Expert ClearSCADA Vulnerabilities ***
---------------------------------------------
This advisory provides mitigation details for three vulnerabilities in Schneider Electric's StruxureWare SCADA Expert ClearSCADA.
---------------------------------------------
https://ics-cert.us-cert.gov//advisories/ICSA-14-259-01
*** IBM Security Bulletins ***
---------------------------------------------
https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…
=======================
= End-of-Shift report =
=======================
Timeframe: Montag 15-09-2014 18:00 − Dienstag 16-09-2014 18:00
Handler: Robert Waldner
Co-Handler: Alexander Riepl
*** Security updates available for Adobe Reader and Acrobat (APSB14-20) ***
---------------------------------------------
http://blogs.adobe.com/psirt/?p=1130
*** THREE QUARTERS of droid phones open to web page spy bug ***
---------------------------------------------
Metasploit module gobbles KitKat SOP slop A Metasploit module has been developed to easily exploit a dangerous flaw in 75 percent of Android devices that allows attackers to hijack a users open websites.
---------------------------------------------
http://www.theregister.co.uk/2014/09/16/three_quarters_of_droid_phones_open…
*** Attackers tapping on SNMP door to see if its open ***
---------------------------------------------
SANS spots new, dumb attack Googles DNS IP address is being spoofed by an attacker, apparently in an attempt to DDoS hosts vulnerable to a flaw in the SNMP protocol.
---------------------------------------------
http://www.theregister.co.uk/2014/09/16/attackers_tapping_on_snmp_door_to_s…
*** Kindle durch versteckte Codes in E-Books gefährdet ***
---------------------------------------------
Durch eine Sicherheitslücke im E-Reader Kindle können Angreifer an die Daten von Amazon-Kunden gelangen. Die Lücke tritt zum zweiten Mal auf.
---------------------------------------------
http://futurezone.at/digital-life/kindle-durch-versteckte-codes-in-e-books-…
*** Encrypt-then-MAC für TLS standardisiert ***
---------------------------------------------
Eine neue TLS-Erweiterung ermöglicht es, die Reihenfolge zwischen Authentifizierung und Verschlüsselung zu ändern. Die bisherige Methode führte zu Sicherheitsproblemen wie der Lucky-Thirteen-Attacke. ... Gegen die Lucky-Thirteen-Attacke wurden Workarounds in die gängigen Browser und TLS-Bibliotheken eingebaut, aber trotzdem gab es den Wunsch, das Problem generell zu beheben.
---------------------------------------------
http://www.golem.de/news/verschluesselung-encrypt-then-mac-fuer-tls-standar…
*** Ungestopftes Datenleck in Androids Open-Source-Browser ***
---------------------------------------------
Eine Lücke im AOSP-Browser von Android erlaubt es Webseiten die Daten anderer Seiten auszulesen. Die App wird in fast allen Android-Versionen vor Kit Kat mitgeliefert und dient vielen Custom-ROMs ebenfalls als Standard-Browser.
---------------------------------------------
http://www.heise.de/security/meldung/Ungestopftes-Datenleck-in-Androids-Ope…
*** AppLock Vulnerability Leaves Configuration Files Open for Exploit ***
---------------------------------------------
We have previously discussed about certain file locker apps that fail to do hide files properly. We recently came across yet another file locker app, AppLock, which has the same issue. However, the vulnerability concerning this app goes beyond improperly hiding files - the vulnerability can ..
---------------------------------------------
http://blog.trendmicro.com/trendlabs-security-intelligence/applock-vulnerab…
*** Twitter Vulnerability Allows Hacker to Delete Credit Cards from Any Twitter Account ***
---------------------------------------------
At the beginning of this month, just like other social networks, Twitter also started paying individuals for any flaws they uncover on its service with a fee of $140 or more offered per flaw under its new Bug Bounty program, and here comes the ..
---------------------------------------------
http://thehackernews.com/2014/09/twitter-vulnerability-allows-hacker-to_16.…
*** Metasploit gems from scratch ***
---------------------------------------------
https://community.rapid7.com/community/metasploit/blog/2014/09/16/metasploi…
=======================
= End-of-Shift report =
=======================
Timeframe: Freitag 12-09-2014 18:00 − Montag 15-09-2014 18:00
Handler: Robert Waldner
Co-Handler: Alexander Riepl
*** Squid Off-by-One in snmpHandleUdp() Lets Remote Users Execute Arbitrary Code ***
---------------------------------------------
A remote user can send a specially crafted UDP SNMP packet to trigger an off-by-one memory error in snmpHandleUdp() and potentially execute arbitrary code on the target system.
---------------------------------------------
http://www.securitytracker.com/id/1030838
*** Rooted SSH/SFTP Daemon Default Login Credentials ***
---------------------------------------------
The software comes pre-configured with a default login of User: root Password: abc123. This weak password
would easily be guessed leading to root compromise of the android system.
---------------------------------------------
http://cxsecurity.com/issue/WLB-2014090066
*** WordPress Photo Album Plus 5.4.4 Cross Site Scripting ***
---------------------------------------------
http://cxsecurity.com/issue/WLB-2014090061
*** Malware 'Eskimo' hat es auf Steam-Konten abgesehen ***
---------------------------------------------
Die Schadsoftware wird hauptsächlich im Twitch-Chat verbreitet - Guthaben sowie Items werden nach Hack übertragen
---------------------------------------------
http://derstandard.at/2000005543386
*** IRC: Chatnetzwerk Freenode gehackt ***
---------------------------------------------
Die Betreiber des IRC-Netzwerks Freenode haben eine Kompromittierung ihrer Server festgestellt. Alle Nutzer sollten vorsorglich ihr Passwort ändern.
---------------------------------------------
http://www.golem.de/news/irc-chatnetzwerk-freenode-wurde-gehackt-1409-10923…
*** Multiple vulnerabilities in IBM products ***
---------------------------------------------
https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_pureapplication_s…https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…
*** Trustwave.com: 2014 Business Password Analysis ***
---------------------------------------------
We set out to determine how easily we could crack a sample of 626,718 hashed passwords we collected during thousands of network penetration tests performed in 2013 and some performed in 2014. ... We recovered more than half of the passwords within just the first ..
---------------------------------------------
https://gsr.trustwave.com/topics/business-password-analysis/2014-business-p…
*** Moodle Bugs Let Remote Users Obtain Potentially Sensitive Information and Bypass Security Controls ***
---------------------------------------------
Moodle Bugs Let Remote Users Obtain Potentially Sensitive Information and Bypass Security Controls
---------------------------------------------
http://www.securitytracker.com/id/1030839
*** Hacking Canon Pixma Printers - Doomed Encryption ***
---------------------------------------------
This blog post is another in the series demonstrating current insecurities in devices categorised as the 'Internet of Things'. This instalment will reveal how the firmware on Canon Pixma printers (used in the home and by SMEs) can be modified from the Internet to run custom code. ... For demonstration purposes I decided to get Doom running on the printer (Doom as in the classic 90s computer game).
---------------------------------------------
http://www.contextis.co.uk/resources/blog/hacking-canon-pixma-printers-doom…
*** Bugtraq: Open-Xchange Security Advisory 2014-09-15 ***
---------------------------------------------
http://www.securityfocus.com/archive/1/533443
*** [Honeypot Alert] New Bot Malware (BoSSaBoTv2) Attacking Web Servers Discovered ***
---------------------------------------------
Our web honeypots picked up some interesting attack traffic. The initial web application attack vector (PHP-CGI vulnerability) is not new, the malware payload is. We wanted to get this information out to the community quickly due to the following combined threat elements - Active exploit attempts to upload/install the malware The overall low detection rates among AV vendors The malware is actively being sold in underground ..
---------------------------------------------
http://blog.spiderlabs.com/2014/09/honeypot-alert-bossabotv2-irc-botnetbitc…
=======================
= End-of-Shift report =
=======================
Timeframe: Donnerstag 11-09-2014 18:00 − Freitag 12-09-2014 18:00
Handler: Robert Waldner
Co-Handler: n/a
*** Hacker publishes tech support phone scammer slammer ***
---------------------------------------------
Security pro Matthew Weeks has released a Metasploit module that can take over computers running the Ammyy Admin remote control software popular among "Hi this is Microsoft, theres a problem with your computer" tech support scammers. Weeks day job is director at Root9b, but hes taken time to detail a zero-day flaw in Ammyy Admin he hopes will be used to fight back against tech support scammers.
---------------------------------------------
http://www.theregister.co.uk/2014/09/12/phone_scammer_slammer/
*** Cisco Unified Communications Manager glibc Arbitrary Code Execution Vulnerability ***
---------------------------------------------
A vulnerability in the GNU C library of Cisco Unified Communications Manager (Cisco Unified CM) could allow an unauthenticated, local attacker to input crafted data to cause a heap-based buffer overflow.
The vulnerability is due to incorrect sanitization of data. An attacker could exploit this vulnerability by setting an environment variable to a malicious value.
---------------------------------------------
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…
*** Schneider Electric VAMPSET Buffer Overflow ***
---------------------------------------------
This advisory provides mitigation details for a buffer overflow vulnerability in Schneider Electric's VAMPSET software product.
---------------------------------------------
https://ics-cert.us-cert.gov//advisories/ICSA-14-254-01
*** Ecava Integraxor SCADA Server Vulnerabilities ***
---------------------------------------------
This advisory provides mitigation details for vulnerabilities in the Ecava Integraxor SCADA Server.
---------------------------------------------
https://ics-cert.us-cert.gov//advisories/ICSA-14-224-01
*** Linux Kernel logi_dj_recv_destroy_djhid_device buffer overflow ***
---------------------------------------------
Linux Kernel is vulnerable to a buffer overflow, caused by improper bounds checking by the logi_dj_recv_destroy_djhid_device function. By sending an overly long string, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
---------------------------------------------
http://xforce.iss.net/xforce/xfdb/95928
*** DNS cache poisoning used to steal emails ***
---------------------------------------------
Does this happen in practice? CERT/CC researchers Jonathan Spring and Leigh Metcalf have evidence to suggest that it does. Using passive DNS data, they found a number of incorrect responses for A records belonging to mail servers of the big three webmail providers (Gmail, Yahoo! and Hotmail). Even though an increasing number of emails are sent over encrypted connections (using STARTTLS), there isnt really a way for the receiving mail server to enforce this, as HSTS does for secure HTTP
---------------------------------------------
https://www.virusbtn.com/blog/2014/09_12.xml?rss
*** Multiple security bulletins for IBM products ***
---------------------------------------------
https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…
=======================
= End-of-Shift report =
=======================
Timeframe: Mittwoch 10-09-2014 18:00 − Donnerstag 11-09-2014 18:00
Handler: Robert Waldner
Co-Handler: Alexander Riepl
*** iOS 8 stopft Hintertüren weitestgehend ***
---------------------------------------------
Apple hat die für Diagnosezwecke gedachten Systemdienste in iOS 8 grösstenteils abgeschottet, berichtet ein Sicherheitsforscher. Bislang lassen sich darüber zahlreiche Nutzerdaten auslesen.
---------------------------------------------
http://www.heise.de/security/meldung/iOS-8-stopft-Hintertueren-weitestgehen…
*** Multiple vulnerabilities in Juniper products ***
---------------------------------------------
http://kb.juniper.net/index?page=content&id=JSA10646http://kb.juniper.net/index?page=content&id=JSA10645http://kb.juniper.net/index?page=content&id=JSA10647
*** IBM Security Bulletin: Fixes available for Security Vulnerabilities in IBM WebSphere Portal (CVE-2014-4762; CVE-2014-4792) ***
---------------------------------------------
https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…
*** Apache Warns of Tomcat Remote Code Execution Vulnerability ***
---------------------------------------------
Some older versions of Apache Tomcat, the company's open source web server and servlet container, are vulnerable to remote code execution.
---------------------------------------------
http://threatpost.com/apache-warns-of-tomcat-remote-code-execution-vulnerab…
*** IBM Security Bulletin: Administrator password can be reset without authentication on SAN Volume Controller and Storwize Family (CVE-2014-4811) ***
---------------------------------------------
https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…
*** AIX OpenSSL Denial of Service due to double free ***
---------------------------------------------
https://www-304.ibm.com/connections/blogs/PSIRT/entry/aix_openssl_denial_of…
*** Cisco Unified Communications Manager GLIBC Arbitrary Code Execution Vulnerability ***
---------------------------------------------
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…
*** Cisco TelePresence System MXP Series Software Denial of Service Vulnerability ***
---------------------------------------------
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…
*** SA-CONTRIB-2014-087 - Drupal Commerce - Information disclosure ***
---------------------------------------------
Drupal Commerce is used to build eCommerce websites and applications of all sizes. The commerce_order module can be used to create new user accounts where email addresses are used as user names. Since user names are not considered ..
---------------------------------------------
https://www.drupal.org/node/2336357
*** Oracle MySQL Server MyISAM code execution ***
---------------------------------------------
http://xforce.iss.net/xforce/xfdb/95881
*** Swiss economy makes online security its priority ***
---------------------------------------------
Switzerland is one of the safest countries in the world. To make also the Internet a secure place in Switzerland, the Swiss online economy has started the Swiss Internet ..
---------------------------------------------
http://securityblog.switch.ch/2014/09/11/swiss-economy-makes-online-securit…
*** SHA1 deprecation: what you need to know ***
---------------------------------------------
The news is that SHA1, a very popular hashing function, is on the way out. Strictly speaking, this development is not new. The first signs of weaknesses in SHA1 appeared (almost) ten years ago. In 2012, some calculations showed how breaking SHA1 is becoming feasible for those who can afford it. In November 2013, Microsoft announced that they wouldnt be accepting SHA1 certificates after 2016.
---------------------------------------------
http://blog.ivanristic.com/2014/09/sha1-deprecation-what-you-need-to-know.h…
*** Tabnabbing: A New Type of Phishing Attack ***
---------------------------------------------
Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a page, the chase is up. You've escaped the attackers. In fact, the time that wary people are most wary is exactly when they first navigate to a site. What we don't expect is that a page we've been looking at will change behind our backs, when we aren't looking. That'll catch us by surprise.
---------------------------------------------
http://www.azarask.in/blog/post/a-new-type-of-phishing-attack/
*** Sicherheitslücke in vielen WordPress-Themes ***
---------------------------------------------
Ein Fehler im beliebten Plug-in Slider Revolution erlaubt es, beliebige Dateien vom Webserver herunterzuladen. Damit kann ein Angreifer im schlimmsten Fall den ganzen Server kompromittieren. Das Plug-in ist in einer grossen Zahl von Themes fest verbaut.
---------------------------------------------
http://www.heise.de/security/meldung/Sicherheitsluecke-in-vielen-WordPress-…
*** A system that facilitates malware identification in smartphones ***
---------------------------------------------
The tool, developed by these UC3M researchers, baptized DENDROID and detailed in a study published in the review Expert Systems with Applications, allows security analysts to scrutinize a large quantity of apps to determine the origins of a malware sample and the family to which it belongs.
---------------------------------------------
http://www.alphagalileo.org/ViewItem.aspx?ItemId=145206
*** Home Articles PCI Updates Skimming Prevention Guide - Best Practices for Protecting Merchants from POS Attacks ***
---------------------------------------------
At a time when retailers are seeing a surge in point-of-sale breaches, The PCI Security Standards Council has released an update to its guidance for merchants on protecting against card skimming attacks in POS environments.
---------------------------------------------
http://www.bankinfosecurity.co.uk/pci-updates-skimming-prevention-guide-a-7…
*** Key Flaw Enables Recovery of Files Encrypted by TorrentLocker ***
---------------------------------------------
Crypto ransomware, a relatively unknown phenomenon a couple of years ago, has exploded into one of the nastier malware problems for Internet users. Variants such as CryptoLocker and CryptoWall have been siphoning money from victims for some time, and now researchers have dissected a newer ..
---------------------------------------------
http://threatpost.com/key-flaw-enables-recovery-of-files-encrypted-by-torre…
=======================
= End-of-Shift report =
=======================
Timeframe: Dienstag 09-09-2014 18:00 − Mittwoch 10-09-2014 18:00
Handler: Robert Waldner
Co-Handler: n/a
*** Security updates available for Adobe Flash Player (APSB14-21) ***
---------------------------------------------
Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions
...
CVE-2014-0547, CVE-2014-0548, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, CVE-2014-0552, CVE-2014-0553, CVE-2014-0554, CVE-2014-0555, CVE-2014-0556, CVE-2014-0557, CVE-2014-0559
---------------------------------------------
http://helpx.adobe.com/security/products/flash-player/apsb14-21.html
*** Assessing risk for the September 2014 security updates ***
---------------------------------------------
Today we released four security bulletins addressing 42 unique CVE's. One bulletin has a maximum severity rating of Critical and the other three have maximum severity Important. This table is designed to help you prioritize the deployment of updates appropriately for your environment.
---------------------------------------------
http://blogs.technet.com/b/srd/archive/2014/09/09/assessing-risk-for-the-se…
*** MSRT September 2014 - Zemot ***
---------------------------------------------
​This month we added the Win32/Zemot family to the Malicious Software Removal Tool. The Zemot family of trojan downloaders are frequently used by malware with a number of different payloads. We started seeing activity from TrojanDownloader:Win32/Upatre.B in late 2013 and identified this threat as the main distributor of the click fraud malware PWS:Win32/Zbot.gen!AP and PWS:Win32/Zbot.CF. We renamed the downloader to Zemot in May 2014. Recently, other malware such as Win32/Rovnix,
---------------------------------------------
http://blogs.technet.com/b/mmpc/archive/2014/09/09/msrt-september-2014-zemo…
*** Microsoft IIS Web Server - CMD Process Contributing to Website Reinfections ***
---------------------------------------------
We often spend a lot of time talking about application level malware, but from time to time we do like to dabble in the ever so interesting web server infections as well. It is one of those things that comes with the job. Today, we're going to chat about an interesting reinfection case in which the client was running their website on a Microsoft's Internet Information Services (IIS) web server. Yes, contrary to popular belief many organizations, especially large enterprise
---------------------------------------------
http://blog.sucuri.net/2014/09/microsof-iis-web-server-cmd-process-contribu…
*** VMware vSphere product updates to third party libraries ***
---------------------------------------------
The Apache Struts library is updated to address a security issue. This issue may lead to remote code execution after authentication. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2014-0114 to this issue.
---------------------------------------------
http://www.vmware.com/security/advisories/VMSA-2014-0008.html
*** The September 2014 issue of our SWITCH Security Report is available! ***
---------------------------------------------
A new issue of our monthly SWITCH Security Report has just been released.
Topics:
- Inside information on government Trojans used internationally published on Twitter
- Page not found: Network blocking in in Switzerland and neighbouring countries
- Breaking bad - malvertising ransomware: ZeroLocker / CryptoLocker / CryptoWall / SynoLocker
- Canvas or cookies - choosing between Scylla and Charybdis
- The Clipboard: Interesting presentations, articles and videos
---------------------------------------------
http://securityblog.switch.ch/2014/09/10/the-september-2014-issue-of-our-sw…
=======================
= End-of-Shift report =
=======================
Timeframe: Montag 08-09-2014 18:00 − Dienstag 09-09-2014 18:00
Handler: Robert Waldner
Co-Handler: n/a
*** Cisco Unified Computing System E-Series Blade Servers Cisco Integrated Management Controller SSH Denial of Service Vulnerability ***
---------------------------------------------
A vulnerability in the Cisco Integrated Management Controller (Cisco IMC) SSH module of the Cisco Unified Computing System E-Series Blade servers could allow an unauthenticated, remote attacker to cause a denial of service condition.
The vulnerability is due to a failure to properly handle a crafted SSH packet. An attacker could exploit this vulnerability by sending a crafted packet to the SSH server running on the Cisco IMC of an affected device, which could result in the Cisco IMC becoming unresponsive. The operating system running on the blade will be unaffected.
---------------------------------------------
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-…
*** Cisco IOS XR Software DHCPv6 Denial Of Service Vulnerability ***
---------------------------------------------
A vulnerability in the DHCP version 6 (DHCPv6) code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the DHCPv6 server process on an affected device to crash.
The vulnerability is due to incorrect handling of malformed DHCPv6 packets. An attacker could exploit this vulnerability by sending a malformed DHCPv6 packet to an affected device configured with DHCPv6 server functionality. An exploit could allow the attacker to cause the DHCPv6 process on the device to crash.
---------------------------------------------
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…
*** Netgear ProSafe Plus Configuration Utility information disclosure ***
---------------------------------------------
Netgear ProSafe Plus Configuration Utility could allow a remote attacker to obtain sensitive information, caused by the storing of passwords in plaintext within the backup file. An attacker could exploit this vulnerability using the configuration backup file to obtain sensitive information.
---------------------------------------------
http://xforce.iss.net/xforce/xfdb/95780
*** Researchers reveal security issues in Android apps ***
---------------------------------------------
On Monday, the University of New Haven revealed its first video in a series of security findings.
---------------------------------------------
http://www.scmagazine.com/researchers-reveal-security-issues-in-android-app…
*** Why Google Is Pushing For a Web Free of SHA-1 ***
---------------------------------------------
An anonymous reader writes: Google recently announced Chrome will be gradually phasing out support for certificates using SHA-1 encryption. They said, "We need to ensure that by the time an attack against SHA-1 is demonstrated publicly, the web has already moved away from it." Developer Eric Mill has written up a post explaining why SHA-1 is dangerously weak, and why moving browsers away from acceptance of SHA-1 is a lengthy, but important process.
---------------------------------------------
http://rss.slashdot.org/~r/Slashdot/slashdot/~3/ME5Z29v_gGw/story01.htm
*** Salesforce: Oh no! Dyre RATs are thirsty for our customers logins ***
---------------------------------------------
But attacks werent the cause of server outage, were told Salesforce has warned that miscreants are trying to infect its customers with a remote access trojan (RAT) dubbed Dyre that siphons off Salesforce.com login data.
---------------------------------------------
http://go.theregister.com/feed/www.theregister.co.uk/2014/09/08/salesforcec…
*** H1 2014 Threat Report ***
---------------------------------------------
Our latest Threat Report is now available.
The report includes our statistics, incidents calendar and threatscape summaries for H1(Q1+Q2) 2014.
---------------------------------------------
http://www.f-secure.com/weblog/archives/00002741.html
*** QEMU VGA Emulator Bug Lets Local Guest Users Obtain Potentially Sensitive Information from the Host System ***
---------------------------------------------
Description: A vulnerability was reported in QEMU. A local user on a guest system can obtain potentially sensitive information from the host system.
A guest system Graphics Output Protocol driver can set a high resolution to trigger a flaw in the VGA emulator and obtain host memory contents.
Impact: A local user on a guest system can obtain potentially sensitive information from the host system memory.
---------------------------------------------
http://www.securitytracker.com/id/1030817
*** Enigmail PGP plugin forgets to encrypt mail sent as blind copies ***
---------------------------------------------
User now waiting for the bad guys come and get me with their water-boards Enigmail has patched a hole in the worlds most popular PGP email platform that caused mail to be sent unencrypted when all security check boxes were ticked.
---------------------------------------------
http://go.theregister.com/feed/www.theregister.co.uk/2014/09/09/enigmail_en…
*** Kaspersky Internet Security Android App Certificate Validation Flaw Lets Remote Users Spoof Servers ***
---------------------------------------------
A vulnerability was reported in Kaspersky Internet Security app for Android. A remote user can spoof servers.
The application (com.kms.free) does not verify X.509 certificates from SSL servers. A remote user with the ability conduct a man-in-the-middle attack can supply a specially crafted certificate to spoof an SSL server obtain or modify sensitive information
---------------------------------------------
http://www.securitytracker.com/id/1030815
*** OpenSSL Security Policy ***
---------------------------------------------
Recent flaws have captured the attention of the media and highlighted how much of the internet infrastructure is based on OpenSSL. Weve never published our policy on how we internally handle security issues; that process being based on experience and has evolved over the years.
---------------------------------------------
https://www.openssl.org/about/secpolicy.html
*** 'Google Dorking' - Waking Up Web Admins Everywhere ***
---------------------------------------------
Last July, the US Department of Homeland Security warned of a new kind of criminal attack: 'Google dorking'. This refers to asking Google for things they have found via special search operators. Let's look closely and see what this is. Google finds things online using a program that accesses web sites: the Google web crawler, called ...
---------------------------------------------
http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/DdLfN3jTMhw/
*** How a DNS Sinkhole Can Protect Against Malware ***
---------------------------------------------
The Domain Name Service (DNS) is an integral part of Internet access. It translates human-recognized domain names into computer-readable IP addresses in order to facilitate online communication and connection between devices. ... And one of the best ways to gain control is via DNS itself, in order to disrupt malware transmission at the very point of connection. A DNS sinkhole, or sinkhole server, gives organizations this control in order to prevent internal access to malicious websites.
---------------------------------------------
http://resources.infosecinstitute.com/dns-sinkhole-can-protect-malware/
*** Threat Spotlight: 'Kyle and Stan' Malvertising Network Threatens Windows and Mac Users With Mutating Malware ***
---------------------------------------------
Once the victim gets redirected to the final URL, the website automatically starts the download of a unique piece of malware for every user. The file is a bundle of legitimate software, like a media-player, and compiles malware and a unique-to-every-user configuration into the downloaded file. The attackers are purely relying on social engineering techniques, in order to get the user to install the software package. No drive-by exploits are being used thus far.
---------------------------------------------
https://blogs.cisco.com/security/kyle-and-stan/
*** Modern anti-spam and E2E crypto ***
---------------------------------------------
... asked me to write up some thoughts on how spam filtering and fully end to end crypto would interact, so its all available in one message instead of scattered over other threads. Specifically he asked for brain dumps on: - how does antispam currently work at large email providers - how would widespread E2E crypto affect this - what are the options for moving things to the client (and pros, cons) - is this feasible for email?
---------------------------------------------
https://moderncrypto.org/mail-archive/messaging/2014/000780.html
*** Research Finds No Large Scale Heartbleed Exploit Attempts Before Vulnerability Disclosure ***
---------------------------------------------
In the days and weeks following the public disclosure of the OpenSSL Heartbleed vulnerability in April, security researchers and others wondered aloud whether there were some organizations - perhaps the NSA - that had known about the bug for some time and had been using it for targeted attacks. A definitive answer to that question may never come, but ...
---------------------------------------------
http://threatpost.com/research-finds-no-large-scale-heartbleed-exploit-atte…
*** UPDATE: Upcoming Security Updates for Adobe Reader and Acrobat (APSB14-20) ***
---------------------------------------------
UPDATE: The security update for Adobe Reader and Acrobat has been re-scheduled from September 9, 2014 to the week of September 15, 2014. This delay was necessary to address issues identified during routine regression testing.
---------------------------------------------
http://blogs.adobe.com/psirt/?p=1121
=======================
= End-of-Shift report =
=======================
Timeframe: Freitag 05-09-2014 18:00 − Montag 08-09-2014 18:00
Handler: Robert Waldner
Co-Handler: Alexander Riepl
*** Apple IDs targeted by Kelihos botnet phishing campaign ***
---------------------------------------------
Botnet targets Apple customers, launching phishing email campaign to lure victims into disclosing their Apple IDs and passwords. Days after numerous celebrities were found to have their iCloud accounts compromised, a major botnet has turned its attention to Apple customers, launching a phishing email campaign ..
---------------------------------------------
http://www.symantec.com/connect/blogs/apple-ids-targeted-kelihos-botnet-phi…
*** USB firmware: An upcoming threat for home and enterprise users ***
---------------------------------------------
Every year, thousands of hackers and security researchers from around the world descend on Las Vegas to attend the annual Black Hat security conference. The conference boasts top notch security presentations from industry leaders - often centered on breaking computer security. Although many of the presentations are on breaking things, most of the ..
---------------------------------------------
http://blogs.technet.com/b/mmpc/archive/2014/09/02/usb-firmware-an-upcoming…
*** Stupid Spammer Tricks - Reversing Characters ***
---------------------------------------------
Spammers engaged in phishing attacks constantly try to get their emails past spam filters. They try many different tactics, and these can include taking advantage of HTML coding characteristics. These HTML tricks can make the email look normal when rendered in a mail client, but the actual ..
---------------------------------------------
http://blog.spiderlabs.com/2014/09/stupid-spammer-tricks-reversing-characte…
*** Mozilla 1024-Bit Cert Deprecation Leaves 107,000 Sites Untrusted ***
---------------------------------------------
Mozilla has deprecated 1024-bit RSA certificate authority certificates in Firefox 32 and Thunderbird. While there are pluses to the move such as a requirement for longer, stronger keys, at least 107,000 websites will no longer be trusted by Mozilla. Data from HD Moores Project Sonar, which ..
---------------------------------------------
http://it.slashdot.org/story/14/09/05/2120246/mozilla-1024-bit-cert-depreca…
*** Cisco Integrated Management Controller SSH Denial of Service Vulnerability ***
---------------------------------------------
A vulnerability in the Cisco Integrated Management Controller (Cisco IMC) SSH module of the Cisco Unified Computing System E-Series Blade servers could allow an unauthenticated, remote attacker to cause a denial of service condition.
---------------------------------------------
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…
*** Nuclear Exploit Kit and Flash CVE-2014-0515 ***
---------------------------------------------
For this blog, wed like to walk you through a recent attack involving Nuclear Exploit Kit (EK) that we analyzed. It was found leveraging CVE-2014-0515, a buffer overflow in Adobe Flash Player discovered in April 2014. Nuclear Exploit kit ..
---------------------------------------------
http://research.zscaler.com/2014/09/nuclear-exploit-kit-and-flash-cve-2014.…
*** WPS-Sicherheitslücke: Wahrscheinlich wenige Router betroffen ***
---------------------------------------------
Auf Anfrage von heise Netze haben sich einige Hersteller von in Deutschland verbreiteten Routern zur Sicherheitslücke in WPS-PIN geäussert, bei der sich die Zugangsnummer offline errechnen lässt.
---------------------------------------------
http://www.heise.de/security/meldung/WPS-Sicherheitsluecke-Wahrscheinlich-w…
*** Popular Photo Sharing Website Likes.com Vulnerable To Multiple Critical Flaws ***
---------------------------------------------
Likes.com, one of the emerging social networking site and popular image browsing platform, is found vulnerable to several critical vulnerabilities that could allow an attacker to completely delete users' account in just one click. Likes.com is a social networking website that helps you to connect ..
---------------------------------------------
http://thehackernews.com/2014/09/popular-photo-sharing-website.html
*** Demasking Google Users With a Timing Attack ***
---------------------------------------------
A 3rd party site can determine if a website viewer has access to a particular Google Drive document. ... How it works: The attack is straightforward. A malicious page repeatedly instantiates an image whose source points at the URL of a Google Drive document. If that document is viewable by the ..
---------------------------------------------
http://blog.andrewcantino.com/blog/2014/09/04/demasking-google-users-with-a…
*** Bugtraq: [security bulletin] HPSBUX03102 SSRT101681 rev.1 - HP-UX Apache Server Suite running Apache Tomcat or PHP, Remote Execution of Arbitrary Code and Denial of Service (DoS) and Other Vulnerabilities ***
---------------------------------------------
http://www.securityfocus.com/archive/1/533370
*** iCloud: Apple verschickt neue Warnhinweise ***
---------------------------------------------
Nach den aus iCloud-Accounts entwendeten Promi-Nacktfotos hat Apple damit begonnen, neue Benachrichtigungen zu versenden, wenn auf den Cloud-Dienst zugegriffen wird. Weitere Schutzfunktionen sind angekündigt.
---------------------------------------------
http://www.heise.de/security/meldung/iCloud-Apple-verschickt-neue-Warnhinwe…