Daily

daily@lists.cert.at

1 participants
3190 discussions

Tageszusammenfassung - Freitag 5-09-2014
by Daily end-of-shift report 05 Sep '14

05 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 04-09-2014 18:00 − Freitag 05-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** 5 things you should know about email unsubscribe links before you click *** --------------------------------------------- We all get emails we don't want and cleaning them up can be as easy as clicking unsubscribe at the bottom of the email. However, some of those handy little links can cause more trouble than they solve. --------------------------------------------- http://nakedsecurity.sophos.com/2014/09/04/5-things-you-should-know-about-e… *** Google acceleration of SHA-1 deprecation draws resistance *** --------------------------------------------- Google said Chrome 39, to be released within 12 weeks, will treat some sites as untrusted, accelerating the transition and user woes. --------------------------------------------- http://www.scmagazine.com/google-acceleration-of-sha-1-deprecation-draws-re… *** Fresh phish served with a helping of AES *** --------------------------------------------- Attempts to use encryption to make analysis of phishing websites more difficult may be a sign of things to come. Obfuscated phishing sites are nothing new. Various techniques such as JavaScript encryption tools (which offer very primitive obfuscation), data URIs (where the page content is mostly Base64-encoded), and .. --------------------------------------------- http://www.symantec.com/connect/blogs/fresh-phish-served-helping-aes *** Researchers discover two SQL injection flaws in WordPress security plugin *** --------------------------------------------- High-Tech Bridge discovered two SQL injection vulnerabilities in All In One WordPress Security and Firewall plugin and notified the vendor. --------------------------------------------- http://www.scmagazine.com/researchers-discover-two-sql-injection-flaws-in-w… *** Malware Bypasses Chrome Extension Security Feature *** --------------------------------------------- Originally created to extend a browser's functionality, browser extensions have become yet another tool for cybercriminals' schemes. Earlier this year, Google has addressed the issue of malicious browser extensions by .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/malware-bypasses… *** Red Hat Enterprise Virtualization Manager 3.4.2 update *** --------------------------------------------- It was discovered that, when loading XML/RSDL documents, the oVirt Engine back end module used an insecure DocumentBuilderFactory. A remote, authenticated attacker could use this flaw to read files accessible to the user running the .. --------------------------------------------- https://rhn.redhat.com/errata/RHSA-2014-1161.html *** Microsoft Security Bulletin Advance Notification for September 2014 *** --------------------------------------------- This is an advance notification of security bulletins that Microsoft is intending to release on September 9, 2014. ... The following table summarizes the security bulletins for this month in order of severity. Bulletin 1.. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-SEP *** renotification Security Advisory for Adobe Reader and Acrobat (APSB14-20) *** --------------------------------------------- Adobe is planning to release security updates on Tuesday, September 9, 2014 for Adobe Reader and Acrobat for Windows and Macintosh .. --------------------------------------------- http://helpx.adobe.com/security/products/reader/apsb14-20.html *** Apple verspricht mehr Sicherheit nach Hacker-Angriff *** --------------------------------------------- Apple-Nutzer sollen künftig über Versuche zur Passwortänderung informiert werden, um Datendiebstahl zu verhindern. --------------------------------------------- http://futurezone.at/digital-life/apple-verspricht-mehr-sicherheit-nach-hac… *** Apache POI 3.10.1-20140818 security issues with OOXML *** --------------------------------------------- The Apache POI project is pleased to announce the release of POI 3.10.1-20140818. This release is a bugfix release to fix two... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090022 *** Security of Password Managers *** --------------------------------------------- At USENIX Security this year there were two papers studying the security of password managers: David Silver, Suman Jana, and Dan Boneh, "Password Managers: Attacks and Defenses." Zhiwei Li, Warren He, Devdatta Akhawe, and Dawn Song, "The Emperors New Password Manager: Security Analysis of Web-based Password Managers." Its interesting work, especially because it looks at security problems in something that .. --------------------------------------------- https://www.schneier.com/blog/archives/2014/09/security_of_pas.html *** BankAPI - What is it? *** --------------------------------------------- BankAPI is a secure decentralized messaging system to send files/messages between banks and other types of financial institutions. There is a reference implementation of the protocol which can be used off-the-shelf, which is production grade quality and is not only for testing and demonstration, although it .. --------------------------------------------- https://github.com/trustly/bankapi/ *** Remote-Code-Execution-Lücke in F5 BigIP *** --------------------------------------------- Im Hochverfügbarkeits-Modus wiesen die Load-Balancer der Firma F5 ein Sicherheitsproblem auf, das Angreifern die volle Kontrolle über das System ermöglicht. Der Hersteller bessert nach. --------------------------------------------- http://www.heise.de/security/meldung/Remote-Code-Execution-Luecke-in-F5-Big…

1 0

Tageszusammenfassung - Donnerstag 4-09-2014
by Daily end-of-shift report 04 Sep '14

04 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 03-09-2014 18:00 − Donnerstag 04-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Paper: Prosecting the Citadel botnet - revealing the dominance of the Zeus descendent: part one *** --------------------------------------------- Aditya K. Sood and Rohit Bansal dissect botnet primarily used for financial fraud.It is unlikely that anyone still thinks that cybercrime is performed by 16-year-old kids who write short pieces of code that wreak havoc all over the world, but if you do still hold that belief, it wont hurt to take a look behind the scenes of a modern botnet operation. Todays botnets show how cybercrime has become a professional industry in which many tactics seen in the legitimate e-commerce and IT service --------------------------------------------- http://www.virusbtn.com/blog/2014/09_03.xml *** [webapps] - vBulletin 4.0.x - 4.1.2 (search.php, cat param) - SQL Injection Exploit *** --------------------------------------------- http://www.exploit-db.com/exploits/34526 *** WordPress Plugins Bogged Down with CSRF, XSS Vulnerabilities *** --------------------------------------------- A handful of bugs, mostly XSS and CSRF vulnerabilities, have been plaguing at least eight different Wordpress plugins as of late. --------------------------------------------- http://threatpost.com/wordpress-plugins-bogged-down-with-csrf-xss-vulnerabi… *** CERT/CC Enumerates Android App SSL Validation Failures *** --------------------------------------------- The CERT Coordination Center at Carnegie Mellon today released a list of Android applications hosted on Google Play and Amazon that it says fail to validate SSL certificates over HTTPS. --------------------------------------------- http://threatpost.com/certcc-enumerates-android-app-ssl-validation-failures… *** Splunk Enterprise 6.0.6 addresses two vulnerabilities *** --------------------------------------------- Description Splunk Enterprise version 6.0.6 addresses the following vulnerabilities: OpenSSL TLS protocol downgrade attack (SPL-88587, CVE-2014-3511) Reflective cross-site scripting (XSS) referer header vulnerability (SPL-85360) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on our Splunk .. --------------------------------------------- http://www.splunk.com/view/SP-CAAANE2 *** Identifying Firewalls from the Outside-In. Or, "Theres Gold in them thar UDP ports!", (Thu, Sep 4th) *** --------------------------------------------- In a penetration test, often the key to bypassing a security control is as simple as knowing identifying the platform its implemented on. In other words, its a lot easier to get past something if you know what it is. For instance, quite often youll be probing a set of perimeter addresses, and if there are no vulnerable hosts NAT-ed out for you, you might start .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18617 *** Mozilla Firefox <v32 Secret Leak PoC *** --------------------------------------------- Depending on a variety of factors, problems like that may leak secrets across web origins, or more prosaically, may help attackers bypass security measures such as ASLR. This code is a proof of concept for versions prior to 32. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090017 *** heap overflow in procmails formail utility *** --------------------------------------------- prcomails formail utility is vulnerable to a heap-based buffer overflow, caused by improper bounds checking when parsing addresses with unbalanced quotes. By sending an overly long argument, a remote attacker could overflow a buffer .. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95688 *** Kostenloses G-Data-Tool schützt vor BadUSB-Angriffen *** --------------------------------------------- Der G Data USB Keyboard Guard kontrolliert neu an den PC angeschlossene Tastaturen. Der Anwender kann damit entscheiden, ob er diese tatsächlich benutzen will oder ob er einen Angriff befürchtet und das Gerät lieber aussperrt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Kostenloses-G-Data-Tool-schuetzt-vor… *** Akamai warnt vor Linux-Server-Botnet *** --------------------------------------------- Mit einer Sicherheitswarnung mit "Risikofaktor: Hoch" warnt Netzwerk-Spezialist Akamai vor einem Botnetz aus Linux-Servern, das verteilte DoS-Attacken durchführt, um andere Server in die Knie zu zwingen. --------------------------------------------- http://www.heise.de/security/meldung/Akamai-warnt-vor-Linux-Server-Botnet-2… *** zAnti - Android Penetration Testing Toolkit (Free!) *** --------------------------------------------- zANTI is a comprehensive network diagnostics toolkit that enables complex audits and penetration tests at the push of a button. It provides cloud-based reporting that walks you through simple guidelines to ensure network safety. zANTI offers a comprehensive range of fully customizable scans to reveal everything from authentication, backdoor and brute-force attempts to database, DNS and protocol-specific attacks - including rogue access points. --------------------------------------------- http://hack-tools.blackploit.com/2014/09/zanti-android-penetration-testing.… *** New file-encrypting ransomware called CryptoGraphic Locker *** --------------------------------------------- A new file-encrypting ransomware was discovered today by BartBlaze called CryptoGraphic Locker. Just like other encrypting ransomware, this infection will scan your your data files and encrypt them so that they are unusable. The infection will then display a ransom note that requires you to purchase .. --------------------------------------------- http://www.bleepingcomputer.com/forums/t/546749/new-file-encrypting-ransomw… *** Apple OS X: Security Through Obscurity is becoming an Absurdity *** --------------------------------------------- Today's blog on a new Mac malware is a reminder that attackers go where the money is. Apple usage within the enterprise is growing rapidly, with 52 percent of newly issued computers being Macs according to Forrester. Forrester also .. --------------------------------------------- http://www.fireeye.com/blog/corporate/2014/09/apple-os-x-security-through-o… *** Forced to Adapt: XSLCmd Backdoor Now on OS X *** --------------------------------------------- Introduction FireEye Labs recently discovered a previously unknown variant of the APT backdoor XSLCmd - OSX.XSLCmd - which is designed to compromise Apple OS X systems. This .. --------------------------------------------- http://www.fireeye.com/blog/technical/malware-research/2014/09/forced-to-ad… *** VU#855836: Arris Touchstone cable modem information leakage vulnerabiliity *** --------------------------------------------- Arris Touchstone DG950A cable modem enables SNMP public access by default. Description CWE-200 - Information ExposureThe Arris Touchstone DG950A cable modem running software version 7.10.131 was found to expose sensitive .. --------------------------------------------- http://www.kb.cert.org/vuls/id/855836 *** Semalt botnet hijacked nearly 300k computers *** --------------------------------------------- The "Semalt" botnet is quickly spreading across the Internet, Incapsula researchers warn. The botnet is named after a Ukrainian startup that poses as a legitimate online SEO service, and it currently numbers around 290,000 malware infected machines that continually spam millions of websites in a large-scale, referrer spam campaign. --------------------------------------------- http://www.net-security.org/malware_news.php?id=2857

1 0

Tageszusammenfassung - Mittwoch 3-09-2014
by Daily end-of-shift report 03 Sep '14

03 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 02-09-2014 18:00 − Mittwoch 03-09-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Bugtraq: Defense in depth -- the Microsoft way (part 18): Microsoft Office 2010 registers command lines with unquoted pathnames *** --------------------------------------------- Microsoft Office 2010 registers the following command lines with unquoted pathnames containing spaces for various supported file types: --------------------------------------------- http://www.securityfocus.com/archive/1/533317 *** Quick Analysis of a DDoS Attack Using SSDP *** --------------------------------------------- Last week, one of our many clients came under an interesting attack. Enough that it was flagged for human intervention. The interesting aspect of the case was that it was a multi-faceted DDoS attack. The first issue we noticed was a Layer 7, HTTP Flood Attack, Distributed Denial of Service (DDoS) attack ... --------------------------------------------- http://blog.sucuri.net/2014/09/quick-analysis-of-a-ddos-attack-using-ssdp.h… *** New international cybercrime unit, J-CAT, launches pilot program *** --------------------------------------------- A new European cybercrime organization, the Joint Cybercrime Action Taskforce (J-CAT), announced the launch of its six-month pilot program yesterday. The group will investigate global cybercrime threats and targets, according to a release. The Federal Bureau of Investigation (FBI) and the U.K.'s National Crime Agency (NCA) have partnered up to create the unit. Other countries, including Canada and Australia, have signed on to the initiative. --------------------------------------------- http://www.scmagazine.com/new-international-cybercrime-unit-j-cat-launches-… *** ShadowServer Scans Confirm Scale of Netis Threat *** --------------------------------------------- Our friends at the ShadowServer Foundation are now scanning for the Netcore/Netis router backdoor which we found in August. Their findings are in line with what we published then: that the vast majority of those affected in China, with more than a million scanned IP addresses currently affected by this threat. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/CSrl4YNzdgE/ *** Firefox 32 released, time to update *** --------------------------------------------- Firefox 32 released, time to update - now with support for Public Certificate Pinning. Release notes here: https://www.mozilla.org/en-US/firefox/32.0/releasenotes/ --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18609&rss *** IBM Security Bulletin: Missing access restriction on service types in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (CVE-2014-4758) *** --------------------------------------------- When invoking a service using the callService URL, there is no access restriction based on the service type and services that were meant for internal use only are available for authenticated users. CVE(s): CVE-2014-4758 Affected product(s) and affected version(s): IBM Business Process Manager Standard V7.5.x, 8.0.x 8.5.x IBM Business Process Manager Express V7.5.x, 8.0.x 8.5.x IBM Business Process Manager Advanced V7.5.x, 8.0.x 8.5.x IBM WebSphere Lombardi Edition V7.2.x --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Mozilla Firefox for Android file: Protocol Lets Remote Users Obtain Potentially Sensitive Information in Certain Cases *** --------------------------------------------- A vulnerability was reported in Mozilla Firefox for Android. A remote user can obtain potentially sensitive information from the target user's system in certain cases. A remote user can create a specially crafted 'file:' URL that, when loaded by the target user, will access a local file in the Firefox profile directory and copy the data to the SD card without user intervention. A local application can then access the data. --------------------------------------------- http://www.securitytracker.com/id/1030792 *** LogAnalyzer 3.6.5 Cross Site Scripting *** --------------------------------------------- It was found that an XSS injection is possible on a syslog server running LogAnalyzer version 3.6.5. by changing the hostname of any entity logging to syslog server with LogAnalyzer to <script>alert("xss")</script>, and sending an arbitrary syslog message, a client-side script injection execution is possible. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090008 *** Exploit PHP's mail() to get remote code execution *** --------------------------------------------- While searching around the web for new nifty tricks I stumbled across this post about how to get remote code exeution exploiting PHP's mail() function. First, I must say that this is only going to happen under some really rare circustances. Never the less, it's really something to think about and keep an eye out for. I will explain an example scenario which I think could be a real life scenario later in this article. --------------------------------------------- http://securitysucks.info/exploit-phps-mail-to-get-remote-code-execution/ *** Tests compare Mac OS X anti-malware products *** --------------------------------------------- Every day, independent test lab AV-TEST.org captures more than 400,000 new malware samples for Windows and 5,000 new samples for Android. For the Mac they identify less than 100 per month. But there is malware out there for the Mac and it does hit users in the real world, if less often and less intensely than on the PC. ... Thats why AV-TEST just completed a test of 18 products in this space --------------------------------------------- http://www.zdnet.com/tests-compare-mac-os-x-anti-malware-products-700003317… *** Xen Project Maintenance Releases Available (Versions 4.4.1, 4.3.3, 4.2.5) *** --------------------------------------------- Vulnerabilities fixed: Xen 4.4.1 CVE-2014-2599 CVE-2014-3125 CVE-2014-3124 CVE-2014-2915 CVE-2014-2986 CVE-2014-3714 CVE-2014-3715 CVE-2014-3716 CVE-2014-3717 CVE-2014-3967 CVE-2014-3968 CVE-2014-3969 CVE-2014-4021 CVE-2014-4022 CVE-2014-5147 CVE-2014-5148 Xen 4.2.5 + 4.3.3 CVE-2014-2599 CVE-2014-3124 CVE-2014-3967 CVE-2014-3968 CVE-2014-4021 Apart from those there are many further bug fixes and improvements. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-09/msg00000.html *** ZDI-14-301: SAP Crystal Reports Datasource Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Crystal Reports. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-301/

1 0

Tageszusammenfassung - Dienstag 2-09-2014
by Daily end-of-shift report 02 Sep '14

02 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 01-09-2014 18:00 − Dienstag 02-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Bugtraq: Avira License Application - Cross Site Request Forgery Vulnerability *** --------------------------------------------- An independent Vulnerability Laboratory Researcher discovered a cross site request forgery vulnerability in the official Avira license account system web-application. --------------------------------------------- http://www.securityfocus.com/archive/1/533288 *** Dodging Browser Zero Days - Changing your Orgs Default Browser Centrally *** --------------------------------------------- In a recent story about "whats a sysadmin to do?", we suggested that since our browsers seem to take turns with zero days lately, that system administrator should have processes in place to prepare for when their corporate standard browser has a major vulnerability that doesnt yet have .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18601 *** [webapps] - WordPress Slideshow Gallery Plugin 1.4.6 - Shell Upload Vulnerability *** --------------------------------------------- http://www.exploit-db.com/exploits/34514 *** [webapps] - Mulitple WordPress Themes (admin-ajax.php, img param) - Arbitrary File Download *** --------------------------------------------- http://www.exploit-db.com/exploits/34511 *** Net-snmp SNMP Trap Processing Flaw Lets Remote Users Crash snmptrapd *** --------------------------------------------- http://www.securitytracker.com/id/1030789 *** Industrial software website used in watering hole attack *** --------------------------------------------- AlienVault Labs has discovered a watering hole attack thats using a framework developed for reconnaissance as the primary infection vector.The criminals responsible for the incident compromised an unnamed industrial software firms website, suggesting the potential for future attacks against .. --------------------------------------------- http://www.csoonline.com/article/2600772/data-protection/industrial-softwar… *** The Secret Life of SIM Cards *** --------------------------------------------- SIM cards can do more than just authenticate your phone with your carrier. Small apps can be installed and run directly on the SIM separate from and without knowledge of the phone OS. ... This talk, based on our experience building SIM apps for the Toorcamp GSM network, explains what (U)SIM Toolkit Applications are, how they work, and how to develop them. --------------------------------------------- http://www.ehacking.net/2014/08/the-secret-life-of-sim-cards.html *** IPv6 insecurities on 'IPv4-only' networks *** --------------------------------------------- When people hear about IPv6-specific security issues, they frequently tend to rate this as an argument in favour of delaying or avoiding IPv6 deployment on their enterprise or campus network. Even without IPv6 being consciously deployed, however, some of the IPv6-related security issues were already introduced to most networks many years ago. --------------------------------------------- http://securityblog.switch.ch/2014/08/26/ipv6-insecurities-on-ipv4-only-net… *** Using WPS on your Wi-Fi router may be even more dangerous than you think *** --------------------------------------------- In 2011, a researcher found that WPS was 10,000 times easier to crack than it was supposed to be. Now, another researcher has found that cracking it may be 10,000 times easier again... --------------------------------------------- http://nakedsecurity.sophos.com/2014/09/02/using-wps-may-be-even-more-dange… *** TYPO3-EXT-SA-2014-010: Several vulnerabilities in third party extensions *** --------------------------------------------- Several vulnerabilities have been found in the following third-party TYPO3 extensions: cwt_feedit, eu_ldap, flatmgr, jh_opengraphprotocol, ke_dompdf, lumophpinclude, news_pack, sb_akronymmanager, st_address_ma, weeaar_googlesitemap,. wt_directory --------------------------------------------- https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-… *** A Google Site Meant to Protect You Is Helping Hackers Attack You *** --------------------------------------------- It's long been suspected that hackers and nation-state spies are using Google's antivirus site to test their tools before unleashing them on victims. Now Brandon Dixon, an independent security researcher, has caught them in the act, tracking several high-profile hacking groups - including, surprisingly, two well-known nation-state teams - as they used VirusTotal to hone their code and develop their tradecraft. --------------------------------------------- http://www.wired.com/2014/09/how-hackers-use-virustotal

1 0

Tageszusammenfassung - Montag 1-09-2014
by Daily end-of-shift report 01 Sep '14

01 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 29-08-2014 18:00 − Montag 01-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** CryptoWall's Haul: $1M in Six Months *** --------------------------------------------- The CryptoWall ransomware has proven to be a profitable criminal enterprise, netting more than $1.1 million in six months. More than 1,600 victims have surfaced and more than 5 billion files have been encrypted. --------------------------------------------- http://threatpost.com/cryptowalls-haul-1m-in-six-months/107978 *** Kindle App for Android SSL certificate spoofing *** --------------------------------------------- Kindle App for Android could allow a remote attacker to conduct spoofing attacks, caused by the improper verification of SSL certificates. By persuading a victim to visit a Web site containing a specially-crafted certificate, a remote attacker could exploit this vulnerability using man-in-the-middle techniques to cause the victim to accept spoofed certificates. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95617 *** Glibc Heap Overflow in __gconv_translit_find() Lets Local Users Gain Elevated Privileges *** --------------------------------------------- A local user can set a specially crafted CHARSET environment variable value to trigger an off-by-one memory error and resulting heap overflow in __gconv_translit_find() and execute arbitrary code on the target system. The local user may be able to cause a set user id (setuid) root application that uses this environment variable to execute code with root privileges. --------------------------------------------- http://www.securitytracker.com/id/1030786 *** F5 Unauthenticated rsync access to Remote Root Code Execution *** --------------------------------------------- When configured in a high availability mode, the F5 solution suffers from an unauthenticated rsync access vulnerability that can be leveraged to upload a malicious SSH key and gain remote root access to the appliance. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080148 *** 1900/UDP (SSDP) Scanning and DDOS, (Sun, Aug 31st) *** --------------------------------------------- Over the last few weeks we have detected a significant increase in both scanning for 1900/UDP and a huge increase of 1900/UDP being used for amplified reflective DDOS attacks. 1900/UDP is the Simple Service Discovery Protocol (SSDP) which is a part of Universal Plug and Play (UPnP). The limited information available to me indicates that the majority of the devices that are .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18599 *** Rubbish WPS config sees WiFi router keys popped in seconds *** --------------------------------------------- Another day, another way in to your home router Passwords within routers sold by chipset manufacturer Broadcom and an unnamed vendor can be accessed within seconds thanks to weak or absent key randomisation, security bod Dominique Bongard has claimed. --------------------------------------------- http://www.theregister.co.uk/2014/09/01/wps_flaw_leaves_home_routers_vulner… *** Lynis 1.6.0 - Security auditing tool for Unix/Linux systems *** --------------------------------------------- Lynis is an open source security auditing tool. Primary goal is to help users with auditing and hardening of Unix and Linux based systems. The software is .. --------------------------------------------- http://hack-tools.blackploit.com/2014/08/lynis-160-security-auditing-tool-f… *** Mozilla: An die 100.000 Nutzerdaten unabsichtlich offengelegt *** --------------------------------------------- Zweite grosse Datenpanne innerhalb eines Monats beim Firefox-Hersteller --------------------------------------------- http://derstandard.at/2000005015299 *** Dircrypt: Ransomware liefert Schlüssel mit *** --------------------------------------------- Eine Analyse der Ransomware Dircrypt hat ergeben, dass die verschlüsselten Dateien des Erpressungstrojaners offenbar den Schlüssel mitliefern. Allerdings nur für einen Teil der Daten. --------------------------------------------- http://www.golem.de/news/dircrypt-ransomware-liefert-schluessel-mit-1409-10… *** APWG Q2 2014 report, phishing is even more dangerous *** --------------------------------------------- The APWG has published its new report related to phishing activities in the period April - June 2014, the document titled 'Phishing Activity Trends Report, 2nd Quarter 2014' states that online payment services and crypto-currency sites are .. --------------------------------------------- http://securityaffairs.co/wordpress/27935/cyber-crime/apwg-q2-2014-report.h…

1 0

Tageszusammenfassung - Freitag 29-08-2014
by Daily end-of-shift report 29 Aug '14

29 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 28-08-2014 18:00 − Freitag 29-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Heartbleed is the gift that keeps on giving as servers remain unpatched *** --------------------------------------------- An average of 7,000 attacks continue to seek out servers vulnerable to the bug. --------------------------------------------- http://arstechnica.com/security/2014/08/heartbleed-is-the-gift-that-keeps-o… *** PCI Council urges retailers to defend against Backoff POS attacks *** --------------------------------------------- The warning comes soon after the Secret Service and DHS issues a warning on the threat. --------------------------------------------- http://www.scmagazine.com/pci-council-urges-retailers-to-defend-against-bac… *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Django REMOTE_USER header security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95569 *** IBM Security Bulletin: Current Release of IBM SDK for Node.js is affected by CVE-2014-5256 *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks *** --------------------------------------------- A few days ago we detected a watering hole campaign in a website owned by one big industrial company.The website is related to software used for simulation and system engineering in a wide range of industries, including automotive, aerospace, and manufacturing.The attackers were able to compromise the website and include code that loaded a malicious Javascript .. --------------------------------------------- http://www.alienvault.com/open-threat-exchange/blog/scanbox-a-reconnaissanc… *** Squid Range Header Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030779 *** F5 BIG-IP ConfigSync Access Control Flaw Lets Remote Users Read and Write Arbitrary Files *** --------------------------------------------- http://www.securitytracker.com/id/1030778 *** F5 Enterprise Manager ConfigSync Access Control Flaw Lets Remote Users Read and Write Arbitrary Files *** --------------------------------------------- http://www.securitytracker.com/id/1030777 *** Sinkholing the Backoff POS Trojan *** --------------------------------------------- There is currently a lot of buzz about the Backoff point-of-sale Trojan that is designed to steal credit card information from computers that have POS terminals attached. --------------------------------------------- https://securelist.com/blog/research/66305/sinkholing-the-backoff-pos-troja… *** Nearly 100k Bugzilla Users Affected by Data Disclosure *** --------------------------------------------- The email addresses and encrypted passwords of nearly 100,000 users of Mozilla's Bugzilla system were left on a publicly accessible server for several months earlier this year, the company said. The disclosure comes just a few weeks after Mozilla advised members of its Mozilla Developer .. --------------------------------------------- http://threatpost.com/nearly-100k-bugzilla-users-affected-by-data-disclosur…

1 0

Tageszusammenfassung - Donnerstag 28-08-2014
by Daily end-of-shift report 28 Aug '14

28 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 27-08-2014 18:00 − Donnerstag 28-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** CG Automation Improper Input Validation *** --------------------------------------------- This advisory provides mitigation details for an improper input validation vulnerability in the CG Automation ePAQ-9410 Substation Gateway DNP3 protocol components. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-238-01 *** Schneider Electric Wonderware Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Schneider Electric Wonderware Information Server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-238-02 *** Mobile Security Roundup 1H 2014 *** --------------------------------------------- The first half of this year has been quite eventful for the mobile threat landscape. Sure, we had an idea the state of affairs from 2013 would continue on to this year, but we didn't know just to what extent. From ballooning mobile malware/high risk app numbers to vulnerabilities upon vulnerabilities, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/mobile-security-… *** MS14-045 - Important: Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation of Privilege (2984615) - Version: 3.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-045 *** Cisco 1800 Series ISDN Basic Rate Interface Denial of Service *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cybercriminals Leverage Rumored Windows 9 Developer Preview Release With Social Engineering *** --------------------------------------------- We're seeing schemes that are taking advantage of the buzz around the upcoming developer preview release of Windows 9 this September. One of the threats we saw was found using some combinations of keywords like Windows 9, free, leak and download in popular search engines. It involves a potentially malicious .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/cybercriminals-l… *** My WordPress Website Was Hacked *** --------------------------------------------- Before you freak out, allow me to clarify. It was one of several honeypots we have running. The honeypots are spread across the most commonly employed hosting companies. From Virtual Private Servers (VPS) to shared environments, to managed environments. In most instances we pay and .. --------------------------------------------- http://blog.sucuri.net/2014/08/my-wordpress-website-was-hacked.html *** One More Day of Trolling in POS Memory, (Wed, Aug 27th) *** --------------------------------------------- Further to the recent story on Memory Trolling for PCI data, I was able to spend one more day fishing in memory, I dug a bit deeper and come up with more fun Credit Card / Memory goodness with our friend the Point of Sale application. First of all, just searching for credit card numbers returns a lot of duplicates, as indicated in yesterdays .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18589 *** Smarthome: Die Ifa wird zur Messe der Sicherheitslücken *** --------------------------------------------- Auf der Internationalen Funkausstellung in Berlin (Ifa) wird das Smarthome zu einem grossen Thema. Kaspersky Lab warnt jetzt erneut vor potenziellen Sicherheitslücken im Heimnetz, und ein Blick in vergangene Meldungen zeigt, dass die .. --------------------------------------------- http://www.golem.de/news/smarthome-die-ifa-wird-zur-messe-der-sicherheitslu… *** [2014-08-28] Cross-Site Scripting vulnerabilities in F5 BIG-IP *** --------------------------------------------- Attacker can steal other users sessions, impersonate other users and to gain unauthorized access to the admin interface. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** LibreOffice 4.3.1/ .2.6-secfix *** --------------------------------------------- The Document Foundation announces LibreOffice 4.3.1, the first minor release of LibreOffice 4.3 "fresh" family, with over 100 fixes (including patches for two CVEs, backported to LibreOffice 4.2.6-secfix, which is also available for download now). --------------------------------------------- http://listarchives.documentfoundation.org/www/announce/msg00199.html *** Microsoft gibt Problem-Patch eine zweite Chance *** --------------------------------------------- Zumindest eine der vier zurückgezogenen Patches steht mit neuer KB-Nummer wieder zur Installation bereit. Er schliesst Lücken in Windows, durch die sich ein Angreifer höhere Rechte verschaffen kann. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-gibt-Problem-Patch-eine-zwei… *** Srizbi kernel-mode spambot reappears as Pitou *** --------------------------------------------- Malware possibly still in the brewing stage.In November 2007, we published an article by Kimmo Kasslin (F-Secure) and Elia Florio (Symantec), in which they analysed the Srizbi trojan, notable for being the first malware found in the wild that operated fully in kernel mode. It appears .. --------------------------------------------- http://www.virusbtn.com/blog/2014/08_28.xml?rss *** eCrime Research Symposium 2014 *** --------------------------------------------- The APWG is pleased to present eCrime 2014, a combined event that includes the 2014 Fall General Meeting, and eCrime Researchers Symposium. ... This eCrime Congress will include a one-day, members-only meeting on September 23rd and two full days of open sessions thereafter of programming that will be open to both members and non-members. --------------------------------------------- http://ecrimeresearch.org/events/ecrime2014/ *** Firefox soll falsche SSL-Zertifikate enttarnen *** --------------------------------------------- Auch Mozillas Browser wird künftig etwa beim Besuch von Google.com überprüfen, ob das ausgelieferte SSL-Zertifikat von einem Herausgeber stammt, den der Dienst üblicherweise benutzt. --------------------------------------------- http://www.heise.de/security/meldung/Firefox-soll-falsche-SSL-Zertifikate-e…

1 0

Tageszusammenfassung - Mittwoch 27-08-2014
by Daily end-of-shift report 27 Aug '14

27 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 26-08-2014 18:00 − Mittwoch 27-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Not all Java from java.com is legitimate *** --------------------------------------------- Isn't it ironic getting a Java exploit via java.com, the primary source for one of the most common used browser plugins? Current malvertising campaigns are able to do this. This blog post details a relatively new trend: real-time advertisement bidding platforms being infiltrated by cyber criminals spreading malware. --------------------------------------------- http://blog.fox-it.com/2014/08/27/malvertising-not-all-java-from-java-com-i… *** Multiple Cross-Site Scripting Vulnerabilities in Transport Gateway for Smart Call Home *** --------------------------------------------- A vulnerability in the web framework of Cisco Transport Gateway for Smart Call Home (TG-SCH) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Netflix Open Source Security Tools Solve Range of Challenges *** --------------------------------------------- Netflix engineers released two new application security tools to open source this week, a continuing effort from the streaming services company. --------------------------------------------- http://threatpost.com/netflix-open-source-security-tools-solve-range-of-cha… *** ZDI-14-296: Novell Groupwise Administration Server FileUploadServlet poLibMaintenanceFileSave Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to obtain sensitive information on vulnerable installations of Novell Groupwise. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-296/ *** VMware Support Tool temporary files denial of service *** --------------------------------------------- VMware Support Tool is vulnerable to a denial of service, caused by a symlink attack. Temporary files are created insecurely. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the system, which could allow the attacker to overwrite arbitrary files on the system and cause a denial of service. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95493 *** VMware Support Tool /tmp directory information disclosure *** --------------------------------------------- VMware Support Tool could allow a local attacker to obtain sensitive information, caused by insecure permissions being set for the /tmp directory. An attacker could exploit this vulnerability to obtain sensitive information. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95494 *** Vulnerability in Citrix CloudPlatform Virtual Router could result in unauthorised access to network resources *** --------------------------------------------- A vulnerability has been identified in the virtual router component of Citrix CloudPlatform, formerly known as Citrix CloudStack, that could allow .. --------------------------------------------- http://support.citrix.com/article/CTX140989 *** Citrix CloudPlatform Virtual Router Firewall Bug Lets Remote Users Access Network Resources *** --------------------------------------------- A vulnerability was reported in Citrix CloudPlatform Virtual Router. A remote user can bypass access controls to access network resources. --------------------------------------------- http://www.securitytracker.com/id/1030762 *** Google says - patch your Chrome *** --------------------------------------------- 64-bit browser loads cat vids FIFTEEN PERCENT faster! Google has dropped 50 patches for its flagship Chrome browser plugging holes and handed $30,000 to a lone bug hunter who reported a dangerous sandbox-busting attack. --------------------------------------------- www.theregister.co.uk/2014/08/27/goog_says_patch_your_chrome/ *** PCI Council wants YOU to give it things to DO *** --------------------------------------------- How about enforcing PCI DSS? Crusaders at the Payment Card Industry Security Standards Council have called for submissions into projects for 2015. --------------------------------------------- www.theregister.co.uk/2014/08/27/pci_council_wants_you_to_give_it_things_to… *** RSA Identity Management and Governance Authentication Flaw Lets Remote Users Bypass Authentication to Gain Access to the Target System *** --------------------------------------------- A vulnerability was reported in RSA Identity Management and Governance. A remote user can bypass authentication to gain access to the target system. --------------------------------------------- http://www.securitytracker.com/id/1030759 *** Sicherheitsupdate für Synology-Netzwerkspeicher *** --------------------------------------------- Auch ein NAS ist meist ein Linux-Server, der gehegt und gepflegt werden muss - insbesondere dann, wenn es über das Internet erreichbar ist. Synology hat deshalb unter anderem OpenSSL auf den aktuellen Stand gebracht und damit diverse Lücken geschlossen. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsupdate-fuer-Synology-Netzwe… *** VB2014 preview: Methods of malware persistence on Mac OS X *** --------------------------------------------- Patrick Wardle shows that OS X users really have something to worry about.In the weeks running up to VB2014 (the 24th Virus Bulletin International Conference), we will look at some of the research that will be presented at the event. Today, .. --------------------------------------------- http://www.virusbtn.com/blog/2014/08_27.xml *** IBM: Heartbleed Attacks Thousands of Servers Daily *** --------------------------------------------- The 2014 IBM X-Force Threat Intelligence Quarterly takes a look back at Heartbleed and how organizations were affected by it. --------------------------------------------- http://threatpost.com/ibm-heartbleed-attacks-thousands-of-servers-daily/107… *** ZDI-14-297: Juniper Network and Security Manager XDB Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Juniper Network and Security Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-297/

1 0

Tageszusammenfassung - Dienstag 26-08-2014
by Daily end-of-shift report 26 Aug '14

26 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 25-08-2014 18:00 − Dienstag 26-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Barracuda Networks Web Security Flex multiple modules cross-site scripting *** --------------------------------------------- Barracuda Networks Web Security Flex is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by multiple modules. A remote attacker could exploit this vulnerability using the Domain Alias, LDAP Host or Bind DN/Username field to inject malicious script into a Web page which would be .. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95445 *** Trolling Memory for Credit Cards in POS / PCI Environments, (Tue, Aug 26th) *** --------------------------------------------- In a recent penetration test, I was able to parlay a network oversight into access to a point of sale terminal. Given the discussions these days, the next step for me was an obvious one - memory analysis. My first step was to drive to the store I had compromised and purchase an .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18579 *** Point of Sale Terminal Protection - "Fortress PCI at the Mall", (Tue, Aug 26th) *** --------------------------------------------- This is a very broad topic, but over the last few months Ive seen some really nicly protected PCI termainls. Especially since many POS environments are still running Windows XP, this is an important topic to discuss. Things that Ive seen done very well: First of all, only allow access to the POS app - retail staff generally dont require access to email or the internet, at .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18581 *** Netis Routers Leave Wide Open Backdoor *** --------------------------------------------- Routers manufactured by Netcore, a popular brand for networking equipment in China, have a wide-open backdoor that can be fairly easily exploited by attackers. These products are also sold under the Netis brand name outside of China. This backdoor allows cybercriminals to easily run arbitrary .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-le… *** Attack flogged through shiny-clicky social media buttons *** --------------------------------------------- 66,000 users popped by malicious Flash fudging add-on Web admins beware: social media buttons that load scripts from unknown external sites could see your sites foisting the FlashPack exploit .. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/26/ek_flogged_… *** Glibc: Fehlerhaftes Null-Byte führt zu Root-Zugriff *** --------------------------------------------- Mitgliedern von Googles Project Zero ist es gelungen, einen kleinen Fehler in der Glibc auszunutzen, um unter einem Linux-System Root-Zugriff zu erhalten. Dafür mussten zahlreiche Hürden überwunden werden. --------------------------------------------- http://www.golem.de/news/glibc-fehlerhaftes-null-byte-fuehrt-zu-root-zugrif…

1 0

Tageszusammenfassung - Montag 25-08-2014
by Daily end-of-shift report 25 Aug '14

25 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 22-08-2014 18:00 − Montag 25-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Stiffed by Synolocker ransomware crims? Try F-Secures python tool *** --------------------------------------------- Unlock key doesnt always fit, says security biz Security firm F-Secure has released a tool to decrypt data scrambled by the Synolocker malware - assuming youve obtained the decryption key from the crooks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/23/f_secure_sy… *** QEMU ACPI PCI code execution *** --------------------------------------------- QEMU could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds access error in ACPI PCI hotplug interface. An attacker could exploit this vulnerability to corrupt QEMU process memory and obtain sensitive information. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95419 *** HP Service Manager Bugs Let Remote Users Gain Elevated Privileges, Modify Data, and Deny Service and Conduct Cross-Site Scripting and Cross-Site Requset Forgery Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1030756 *** OpenOffice Targeted Data Exposure Using Crafted OLE Objects *** --------------------------------------------- The exposure exploits the way OLE previews are generated to embed arbitrary file data into a specially crafted document when it is opened. Data exposure is possible if the updated document is distributed to other parties. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080102 *** OpenOffice 4.1.0 Calc Command Injection *** --------------------------------------------- The vulnerability allows command injection when loading Calc spreadsheets. Specially crafted documents can be used for command-injection attacks. Further exploits are possible but have not been verified. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080101 *** Fortinet FortiGate Flaw in FortiManager Protocol Service Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030753 *** NIST to sysadmins: clean up your SSH mess *** --------------------------------------------- Too many keys, too badly managed - NIST has taken a look at how companies use Secure Shell (SSH), and doesnt much like what it sees. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/25/nist_to_sys… *** Ransomware mit leistungsfähigen Password Stealer *** --------------------------------------------- Ransomware auch als 'WinLocker' bekannt, sind nach wie vor in unserem digitalen Alltag gegenwärtig und wird zudem von Cyberkriminellen mit weiteren und komplexeren Funktionen ausgestattet. Um an Informationen zu Funktionen und evtl. Hintermänner dieser Ransomware zu gelangen, haben Experten von Avast bei der neusten Generation dieser Malware, Indizien zu leistungsfähigen Modulen u.a. zum Diebstahl von Passwort und Zugangsdaten gefunden. --------------------------------------------- http://blog.botfrei.de/2014/08/ransomware-mit-leistungsfaehigen-password-st…

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily