Daily

daily@lists.cert.at

1 participants
3190 discussions

Tageszusammenfassung - Montag 12-05-2014
by Daily end-of-shift report 12 May '14

12 May '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 09-05-2014 18:00 − Montag 12-05-2014 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Collabtive folder SQL injection *** --------------------------------------------- Collabtive is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the managefile.php script using the folder parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/93029 *** Cobbler kickstart value file include *** --------------------------------------------- Cobbler could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request using the Kickstart value when creating new profiles, to specify a malicious file from the local system, which could allow the attacker to obtain sensitive information or execute arbitrary code on the vulnerable Web server. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/93033 *** Bitcoin Miner Utilizing IRC Worm *** --------------------------------------------- Bitcoin miners have given a new reason for attackers to communicate en mass with infected users. IRC worms are not exactly the most hip way to communicate, but they remain effective at sending and receiving commands. I recently came across several samples which bit coin mining examples leveraging IRC. The malicious binary, once installed, queries for the network shares connected to the --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/2xQ7VPxF-ms/bitcoin-mine… *** strongSwan Null Pointer Dereference in Processing ID_DER_ASN1_DN ID Payloads Lets Remote Users Deny Service *** --------------------------------------------- A vulnerability was reported in strongSwan. A remote user can cause denial of service conditions. A remote user can send a specially crafted ID_DER_ASN1_DN ID payload to trigger a null pointer dereference and cause the target IKE service to crash. --------------------------------------------- http://www.securitytracker.com/id/1030209 *** G Data: Symantecs "Ende der Antivirensoftware" verunsichert Nutzer *** --------------------------------------------- Nicht verunsichern lassen und weiter Antivirensoftware kaufen - so lautet ein Aufruf von G Data. Symantec hatte zuvor erklärt, dass nur noch durchschnittlich 45 Prozent aller Angriffe von Antivirensoftware erkannt werden. --------------------------------------------- http://www.golem.de/news/g-data-symantecs-ende-der-antivirensoftware-veruns… *** Drupal Flag 7.x-3.5 Command Execution *** --------------------------------------------- Topic: Drupal Flag 7.x-3.5 Command Execution Risk: High Text:Drupal Flag 7.x-3.5 Module Vulnerability Report Author: Ubani Anthony Balogun Reported: May 07, 2014 ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014050054 *** Nach Heartbleed: Neues Zertifikat, alter Key *** --------------------------------------------- Nach dem Heartbleed-Bug haben viele Administratoren Zertifikate für TLS-Verbindungen ausgetauscht. Viele haben dabei jedoch einen fatalen Fehler begangen: Sie erstellten zwar ein neues Zertifikat, aber keinen neuen Schlüssel. (Technologie, Applikationen) --------------------------------------------- http://www.golem.de/news/nach-heartbleed-neues-zertifikat-alter-key-1405-10… *** Backdoor Xtrat Continues to Evade Detection *** --------------------------------------------- While reviewing recent reports scanned by ZULU, we came across a malicious report that drew our attention. It was notable as the final redirection downloaded ZIP content by accessing a PHP file on the domain www.stisanic.com. URL: hxxp://www[.]stisanic[.]com/wp-content/coblackberrycomnotasdevozdate07052014[.]php ZULUs virustotal check scored the file as higher risk. At the time 10 --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/OqS4L1x6ebQ/backdoor-xtr… *** Link-shortening service Bit.ly suffers data breach *** --------------------------------------------- We have reason to believe that Bitly account credentials have been compromised; specifically, users' email addresses, encrypted passwords, API keys and OAuth tokens. We have no indication at this time that any accounts have been accessed without permission. We have taken steps to ensure the security of all accounts, including disconnecting all users' Facebook and Twitter accounts. All users can safely reconnect these accounts at their next login. --------------------------------------------- http://blog.bitly.com/post/85169217199/urgent-security-update-regarding-you… *** Falsche Zertifikate unterwandern HTTPS-Verbindungen *** --------------------------------------------- Forscher sprechen von signifikantem Teil der verschlüsselten Kommunikation - Vor allem Firewalls und Antivirensoftware verantwortlich --------------------------------------------- http://derstandard.at/1399507237936 *** Linux-Kernel: Root-Rechte für Nutzer *** --------------------------------------------- Durch einen Fehler im Linux-Kernel kann ein einfacher Nutzer Root-Rechte erlangen. Bekannt ist der Fehler schon seit gut einer Woche, aber jetzt gibt es einen öffentlichen Exploit. --------------------------------------------- http://www.golem.de/news/linux-kernel-root-rechte-fuer-nutzer-1405-106407-r… *** Race Condition in the Linux kernel *** --------------------------------------------- The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. --------------------------------------------- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0196 *** Unbekannte bieten 33 Millionen E-Mail-Adressen feil *** --------------------------------------------- Das könnte die nächste Spam-Welle auslösen: Unbekannte bieten per E-Mail mehrere Millionen Mailadressen von deutschen Providern zum Kauf an. Angeblich handelt es sich um 100 Prozent gültige Adressen. --------------------------------------------- http://www.heise.de/security/meldung/Unbekannte-bieten-33-Millionen-E-Mail-… *** HPSBST03038 rev.1 - HP H-series Fibre Channel Switches, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with certain HP H-series Fibre Channel Switches. This vulnerability could be exploited remotely to disclose information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Bugtraq: ESA-2014-027: RSA NetWitness and RSA Security Analytics Authentication Bypass Vulnerability *** --------------------------------------------- RSA NetWitness and RSA Security Analytics each contain a security fix for an authentication bypass vulnerability that could potentially be exploited to compromise the affected system. When PAM for Kerberos is enabled, an attacker can authenticate to the vulnerable system with a valid user name and without specifying a password. This issue does not affect other authentication methods. --------------------------------------------- http://www.securityfocus.com/archive/1/532077

1 0

Tageszusammenfassung - Freitag 9-05-2014
by Daily end-of-shift report 09 May '14

09 May '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 08-05-2014 18:00 − Freitag 09-05-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Advance Notification Service for the May 2014 Security Bulletin Release *** --------------------------------------------- Today we provide Advance Notification Service (ANS) for the release of eight bulletins, two rated Critical and six rated Important in severity. These updates will address vulnerabilities for .NET Framework, Office, Internet Explorer, and Windows. As we do every month, we've scheduled the security bulletin release for the second Tuesday of the month, May 13, 2014, at approximately 10:00 a.m. PDT. Revisit this blog then for deployment guidance and further analysis together with a brief --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/05/08/advance-notification-ser… *** Prenotification Security Advisory for Adobe Reader and Acrobat *** --------------------------------------------- Adobe is planning to release security updates on Tuesday, May 13, 2014 for Adobe Reader and Acrobat XI (11.0.06) and earlier versions for Windows and Macintosh. --------------------------------------------- https://helpx.adobe.com/security/products/reader/apsb14-15.html *** SQL Injection In Insert, Update, And Delete *** --------------------------------------------- This is a brief whitepaper that goes over different payloads that can be leveraged in SQL injection attacks. --------------------------------------------- http://packetstormsecurity.com/files/126527/SQL-Injection-In-Insert-Update-… *** SNMP: The next big thing in DDoS Attacks? *** --------------------------------------------- It started with DNS: Simple short DNS queries are easily spoofed and the replies can be much larger then the request, leading to an amplification of the attack by orders of magnitude. Next came NTP. Same game, different actors: NTPs "monlist" feature allows for small requests (again: UDP, so trivially spoofed) and large responses. Today, we received a packet capture from a reader showing yet another reflective DDoS mode: SNMP. The "reflector" in this case... --------------------------------------------- https://isc.sans.edu/diary/SNMP%3A+The+next+big+thing+in+DDoS+Attacks%3F/18… *** Heartbleed, IE Zero Days, Firefox vulnerabilities - Whats a System Administrator to do? *** --------------------------------------------- With the recent headlines, weve seen heartbleed (which was not exclusive to Linux, but was predominately there), an IE zero day that had folks over-reacting with headlines of "stop using IE", but Firefox and Safari vulnerabilities where not that far back in the news either. So what is "safe"? And as an System Administrator or CSO what should you be doing to protect your organization? --------------------------------------------- https://isc.sans.edu/diary/Heartbleed%2C+IE+Zero+Days%2C+Firefox+vulnerabil… *** Exploit Kit Roundup: Best of Obfuscation Techniques *** --------------------------------------------- The world of exploit kits is an ever-changing one, if you happen to look away even just for one month, you'll come back to find that most everything has changed around you. Because of this, people like us, who work on a secure web gateway product, are continuously immersed in the world of exploit kits. Every once in a while it's a good idea to stop, take a look around us, and review what's changed. We would like to share some of the more interesting obfuscation techniques --------------------------------------------- http://feedproxy.google.com/~r/SpiderlabsAnterior/~3/R9KtNDgyouY/exploit-ki… *** Surge in Viknok infections bolsters click fraud campaign *** --------------------------------------------- Researchers detected over 16,500 Viknok infections in the first week of May alone. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/6mC7Lf47bgY/ *** Malicious DIY Java applet distribution platforms going mainstream - part two *** --------------------------------------------- In a cybercrime ecosystem, dominated by client-side exploits serving Web malware exploitation kits, cybercriminals continue relying on good old fashioned social engineering tricks in an attempt to trick gullible end users into knowingly/unknowingly installing malware. In a series of blog posts, we've been highlighting the existence of DIY (do-it-yourself), social engineering driven, Java drive-by type of Web based platforms, further enhancing the current efficient state of social... --------------------------------------------- http://feedproxy.google.com/~r/WebrootThreatBlog/~3/6wG1i4Gl5HQ/ *** Bitly shortens life of users passwords after credential compromise *** --------------------------------------------- OAuth tentacles mean its time to change ANOTHER password URL-shortening and online marketing outfit Bit.ly has warned its systems have been accessed by parties unknown and suggested users change their passwords. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/05/09/bitly_short… *** Weekly Metasploit Update: Disclosing Usernames, More Flash Bugs, and Wireshark Targets *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/05/08/weekly-me… *** Heartbleed: Noch immer 300.000 Server verwundbar *** --------------------------------------------- Vier Wochen nach Auftauchen der Lücke zeigt Untersuchung nur wenig Fortschritte --------------------------------------------- http://derstandard.at/1399507030882 *** Cyber Security Challenge sucht österreichische IT-Talente *** --------------------------------------------- Bereits zum dritten Mal wird im Rahmen der Cyber Security Challenge Austria nach jungen Hacker-Talenten gesucht. Dieses Jahr gibt es auch einen europaweiten Wettbewerb. --------------------------------------------- http://futurezone.at/netzpolitik/cyber-security-challenge-sucht-oesterreich… *** CVE-2014-3214: A Defect in Prefetch Can Cause Recursive Servers to Crash *** --------------------------------------------- A defect in the pre-fetch feature (which is enabled by default) can cause BIND 9.10.0 to terminate with a "REQUIRE" assertion failure if it processes queries whose answers have particular attributes. This can be triggered as the result of normal query processing. --------------------------------------------- https://kb.isc.org/article/AA-01161 *** QNAP-Photostation V.3.2 XSS *** --------------------------------------------- XSS-Lücke in QNAP-Photostation V.3.2 (auf QNAP NAS TS259+ Pro - Firmware 4.0.7 vom 12.04.2014) --------------------------------------------- http://sdcybercom.wordpress.com/2014/04/25/qnap-cross-site-scripting-nicht-… *** Digi International OpenSSL Vulnerability *** --------------------------------------------- Digi International has identified five products that are vulnerable to the OpenSSL Heartbleed bug. Digi International has produced downloadable firmware upgrade versions that mitigate this vulnerability. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-128-01 *** IBM Security Bulletins for TADDM *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Kaspersky Internet Security Null Pointer Dereference in prremote.dll Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1030203 *** Multiple BIG-IP products iControl command execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/93015 *** Security Bulletin: IBM iNotes Cross-Site Scripting Vulnerability (CVE-2014-0913) *** --------------------------------------------- IBM iNotes versions 9.0.1 and 8.5.3 Fix Pack 6 contain a cross-site scripting vulnerability. The fixes for these issues were introduced in IBM Domino and IBM iNotes versions 9.0.1 Fix Pack 1 and 8.5.3 Fix Pack 6 Interim Fix 2. --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21671981 *** HPSBMU03035 rev.1 - HP Network Node Manager I (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Cross-Site Scripting (XSS) *** --------------------------------------------- A potential security vulnerability has been identified with HP Network Node Manager I (NNMi) on HP-UX, Linux, Solaris, and Windows. This vulnerability could be exploited remotely to allow cross-site scripting (XSS). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBGN03008 rev.2 - HP Software Service Manager, "HeartBleed" OpenSSL Vulnerability, Remote Disclosure of Information *** --------------------------------------------- The Heartbleed vulnerability was detected in specific OpenSSL versions. OpenSSL is a 3rd party product that is embedded with some of HP Software products. This bulletin objective is to notify HP Software customers about products affected by the Heartbleed vulnerability. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** R7-2013-19.2 Disclosure: Yokogawa CENTUM CS 3000 BKESimmgr.exe Buffer Overflow (CVE-2014-0782) *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/05/09/r7-2013-1…

1 0

Tageszusammenfassung - Donnerstag 8-05-2014
by Daily end-of-shift report 08 May '14

08 May '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 07-05-2014 18:00 − Donnerstag 08-05-2014 18:00 Handler: L. Aaron Kaplan Co-Handler: Stephan Richter *** The State of Cryptography in 2014, Part 2: Hardware, Black Swans, and What To Do Now *** --------------------------------------------- We continue our look into the state of cryptography in 2014; Part 1 was posted earlier this week. Is Hardware Security Any Better? We closed the first post by asking: is hardware any more trustworthy? One would think that it is - but it's not. Recently, chip vendors have been incorporating cryptography into their CPUs or chipsets. Usually,... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/5erAjAwWMmU/ *** SIRv16: Cybercriminal tactics trend toward deceptive measures *** --------------------------------------------- Microsoft's Security Intelligence Report volume 16 (SIRv16) was released today, providing threat trends on malware encounter rates, infection rates, vulnerabilities, exploits, and more for 110 countries/regions worldwide. The report is designed to help IT and security professionals better protect themselves and their organizations from cyberattacks. Malware data is gathered from the Malicious Software Removal Tool (MSRT), which is used to calculate the infection rate... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/05/07/sirv16-cybercriminal-tac… *** Case Study: Analyzing the Origins of a DDoS Attack *** --------------------------------------------- Recently a client was experiencing a massive layer 7 DDOS attack, generating tens of thousands of random HTTP requests per second to the server. The architecture of the website included a cluster of three web servers responsible for handling all incoming traffic, which did little to alleviate the pressures brought about the attack. An interestingRead More --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/7nrfa2OwFuo/map-of-a-ddos-att… *** Systemkamera Samsung NX300 öffnet Hackern Tür und Tor *** --------------------------------------------- Die Kamera enthält eine ganze Reihe von Sicherheitslücken, inklusive einem weit offen stehenden X-Server und einem reprogrammierbaren NFC-Chip. Angreifer könnten diese nutzen, um Schadcode auf dem Gerät auszuführen. --------------------------------------------- http://www.heise.de/security/meldung/Systemkamera-Samsung-NX300-oeffnet-Hac… *** April 2014 virus activity review from Doctor Web *** --------------------------------------------- April 30, 2014 April 2014 proved to be quite fruitful in terms of the emergence of new threats. In particular, Doctor Webs security researchers discovered a new multi-purpose backdoor targeting Windows. Also registered were numerous incidents involving adware browser extensions for Mac OS X. In addition, a variety of signatures for Android malware were added to the virus databases. --------------------------------------------- http://news.drweb.com/show/?i=4376&lng=en&c=9 *** Volafox Mac OS X Memory Analysis Toolkit *** --------------------------------------------- Volafox is an open source toolkit that you can use for Mac OS X and BSD forensics. The tool is a python based and allows investigating security incidents and finding information for malwares and any malicious program on the system. Security analyst can have the following information using this tool:... --------------------------------------------- http://www.sectechno.com/2014/05/04/volafox-mac-os-x-memory-analysis-toolki… *** Security: Gravierende Lücke in AVG Remote Administration *** --------------------------------------------- Nutzer, die das Fernwartungspaket AVG Remote Administration nutzen, sollten dringend einen aktuellen Patch installieren. Bisher war es möglich, dass Angreifer über das Programm Code einschleusen konnten - aber das ist nicht die einzige Lücke, weitere stehen noch offen. --------------------------------------------- http://www.golem.de/news/security-gravierende-luecke-in-avg-remote-administ… *** [2014-05-08] Multiple critical vulnerabilities in AVG Remote Administration *** --------------------------------------------- Attackers are able to completely compromise the AVG Admin server (part of AVG Remote Administration) system as they can gain full access at the application and system level by exploiting remote code execution, authentication bypass, missing entity authentication and insecure encryption vulnerabilities. Attackers can also manage endpoints and possibly deploy attacker-controlled code on endpoints. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players *** --------------------------------------------- Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players. Exploitation of these vulnerabilities could allow a remote attacker to cause an affected player to crash and, in some cases, could allow a remote attacker to execute arbitrary code on the system of a targeted user. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** SA-CONTRIB-2014-049 - Organic Groups (OG) - Access Bypass *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-049Project: Organic groups (third-party module)Version: 7.xDate: 2014-May-07Security risk: Moderately criticalExploitable from: RemoteVulnerability: Access bypassDescriptionOrganic groups (OG) enables users to create and manage their own groups. Each group can have subscribers, and maintains a group home page where subscribers communicate amongst themselves.OG doesnt sufficiently check the permissions when a group member is pending or blocked status within... --------------------------------------------- https://drupal.org/node/2261245 *** Ruby on Rails Implicit Render Bug Lets Remote Users Obtain Files From the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1030210 *** HP Security Bulletins *** --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Vuln: vBulletin Multiple Cross Site Scripting Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/66972 *** Vuln: SAP Solution Manager Background Processing Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/67107 *** Vuln: SAP NetWeaver Portal WD Information Disclosure Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/67104 *** Security Advisory-Radius Vulnerability on Some Huawei Devices *** --------------------------------------------- On huawei Campus Switch, AR, SRG,WLAN devices, the RADIUS component cannot handle malformed RADIUS packets. This vulnerability allows attackers to repeatedly restart the device, causing a DoS attack (Vulnerability ID: HWPSIRT-2014-0307). --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor…

1 0

Tageszusammenfassung - Mittwoch 7-05-2014
by Daily end-of-shift report 07 May '14

07 May '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 06-05-2014 18:00 − Mittwoch 07-05-2014 18:00 Handler: L. Aaron Kaplan Co-Handler: Stephan Richter *** TLS 1.3 Working Group Has Consensus to Deprectate RSA Key Transport *** --------------------------------------------- RSA key transport cipher suites could be deprecated in TLS 1.3 in favor of Diffie-Hellman Exchange or Elliptic curve Diffie-Hellman. --------------------------------------------- http://threatpost.com/tls-1-3-working-group-has-consensus-to-deprectate-rsa… *** Antivirus is Dead: Long Live Antivirus! *** --------------------------------------------- An article in The Wall Street Journal this week quoted executives from antivirus pioneer Symantec uttering words that would have been industry heresy a few years ago, declaring antivirus software "dead" and stating that the company is focusing on developing technologies that attack online threats from a different angle. This hardly comes as news for anyone in the security industry whos been paying attention over the past few years, but Im writing about it because this is a great --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/INOFThmd17Q/ *** Sicherheit im Fokus der Linuxwochen in Wien *** --------------------------------------------- Von 8. bis 10. Mai finden auf der FH Technikum Wien zahlreiche Vorträge und Workshops zu Linux, Open Data und Open Source statt. --------------------------------------------- http://futurezone.at/digital-life/sicherheit-im-fokus-der-linuxwochen-in-wi… *** Video: NEXT Berlin *** --------------------------------------------- Mikko spoke at NEXT Berlin yesterday:And the video is now online: Arms Race. [24m15s] On 06/05/14 At 12:31 PM --------------------------------------------- http://www.f-secure.com/weblog/archives/00002701.html *** Erpressungstrojaner drohen Android-Nutzern *** --------------------------------------------- Sicherheitsforscher haben den ersten Trojaner entdeckt, der Android-Geräte befällt und von seinen Opfern Lösegeld erpresst. Der Schadcode mit dem Namen Koler.A befällt bereits Smartphones weltweit. --------------------------------------------- http://www.heise.de/security/meldung/Erpressungstrojaner-drohen-Android-Nut… *** Security: Gegen die Angst vor Angriffen aufs Smartphone *** --------------------------------------------- Für das Re:publica-Publikum haben die Sicherheitsexperten Linus Neumann und Ben Schlabs ein paar Tipps parat, wie Smartphones gesichert werden können. Und sie zeigen, wie Siri als Einbruchhelfer missbraucht werden kann. --------------------------------------------- http://www.golem.de/news/security-gegen-die-angst-vor-angriffen-aufs-smartp… *** Hintergrund: SSL-Fuzzing mit "Frankencerts" *** --------------------------------------------- Durch das Zusammenstückeln von Tausenden von echten SSL-Zertifikaten zu über acht Millionen "Frankencerts" haben Forscher Lücken in gängigen SSL-Bibliotheken gefunden. --------------------------------------------- http://www.heise.de/security/artikel/SSL-Fuzzing-mit-Frankencerts-2166135.h… *** New DNS Spoofing Technique: Why we havent covered it., (Wed, May 7th) *** --------------------------------------------- The last couple of days, a lot of readers sent us links to articles proclaiming yet another new flaw in DNS. "Critical Vulnerability in BIND Software Puts DNS Protocol Security At Risk" [1] claimed one article, going forward to state: "The students have found a way to compel DNS servers to connect with a specific server controlled by the attacker that could respond with a false IP address. “ So how bad is this really? First of all, here is a the --------------------------------------------- http://isc.sans.edu/diary.html?storyid=18079&rss *** OpenBSD-Entwickler bezweifeln angebliche OpenSSH-Schwachstelle *** --------------------------------------------- Der Exploit soll so schlimm wie der SSL-GAU Heartbleed sein und die wichtige Unix-Bibliothek OpenSSH betreffen. Allerdings sagen viele Entwickler, dass die Lücke wahrscheinlich nicht existiert. --------------------------------------------- http://www.heise.de/security/meldung/OpenBSD-Entwickler-bezweifeln-angeblic… *** Advanced Evasion Techniques (AET) a Major Concern for CIOs *** --------------------------------------------- According to a new Vanson Bourne study sponsored by McAfee, CIOs are adding yet another threat to their ever-growing list of network security concerns: Advanced Evasion Techniques, or AETs. Unlike Advanced Persistent Threats (APTs) and other advanced malware, Advanced Evasion Techniques are not types of malicious software. Rather, they are a technique used by threat [...]The post Advanced Evasion Techniques (AET) a Major Concern for CIOs appeared first on Seculert Blog on Advanced Threats and --------------------------------------------- http://www.seculert.com/blog/2014/05/advanced-evasion-techniques-aet-a-majo… *** ABB Relion 650 Series OpenSSL Vulnerability *** --------------------------------------------- ABB has identified an OpenSSL vulnerability in its Relion 650 series application. ABB is in the process of creating a patch that mitigates this vulnerability. This vulnerability could be exploited remotely. Exploits that target this vulnerability are known to be publicly available. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-126-01 *** Security Advisory- BootRom Menu and Boot Menu Vulnerabilities on Huawei Campus Switches *** --------------------------------------------- Some versions of Huawei Campus S7700/S9300/S9700 switches are affected by the BootRom and Boot Menu vulnerability. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** VU#902790: Fortinet Fortiweb 5.1 contains a cross-site request forgery vulnerability *** --------------------------------------------- Vulnerability Note VU#902790 Fortinet Fortiweb 5.1 contains a cross-site request forgery vulnerability Original Release date: 07 May 2014 | Last revised: 07 May 2014 Overview Fortinet Fortiweb prior to version 5.2.0 do not sufficiently verify whether a valid request was intentionally provided by the user, which results in a cross-site request forgery (CSRF) vulnerability. (CWE-352) Description CWE-352: Cross-Site Request Forgery (CSRF)Fortinet Fortiweb prior to version 5.2.0 do not... --------------------------------------------- http://www.kb.cert.org/vuls/id/902790 *** HPSBMU02994 rev.4 - HP BladeSystem c-Class Onboard Administrator (OA) running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified in HP BladeSystem c-Class Onboard Administrator (OA) running OpenSSL. This is the OpenSSL vulnerability known as "Heartbleed" which could be exploited remotely resulting in disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Dienstag 6-05-2014
by Daily end-of-shift report 06 May '14

06 May '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 05-05-2014 18:00 − Dienstag 06-05-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** NIST updates Transport Layer Security (TLS) guidelines *** --------------------------------------------- The National Institute of Standards and Technology (NIST) has released an update to a document that helps computer administrators maintain the security of information traveling across their networks. --------------------------------------------- http://www.net-security.org/secworld.php?id=16794 *** Finding Weak Remote Access Passwords on POS Devices *** --------------------------------------------- One of my key take-aways in the Verizon Data Breach Incident Report was that credentials are a major attack vector in 2013. Especially within the POS Intrusions, brute forcing and use of stolen creds was a major problem. --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/05/05/finding-w… *** Analyzing CVE-2014-0515 - The Recent Flash Zero-Day *** --------------------------------------------- Last week, Adobe released an advisory disclosing a new zero-day vulnerability in Flash Player. Looking into the exploit code used in attacks targeting this vulnerability, we found several interesting ties to other vulnerabilities - not all of them for Flash Player, either. To explain this, we will discuss the highlights of how this exploit was performed. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/H6laAIdlckU/ *** Live from InfoSecurity Europe 2014: The Nitty Gritty of Sandbox Evasion *** --------------------------------------------- Infosecurity Europe 2014 was a great gathering of the top minds in cybersecurity, and in case you missed the event, we were excited to capture live content from the show floor to share with our readers. Over the next few... --------------------------------------------- http://www.fireeye.com/blog/corporate/2014/05/live-from-infosecurity-europe… *** And the Web it keeps Changing: Recent security relevant changes to Browsers and HTML/HTTP Standards, (Tue, May 6th) *** --------------------------------------------- As we all know, web standards are only leaving "draft" status once they start becoming irrelevant. It is a constant challenge to keep up with how web browsers interpret standards and how the standards themselves keep changing. We are just going through one of the perpetual updates for our "Defending Web Applications" class, and I got reminded again about some of the changes we had to make over the last year or so. Autocomplete=Off This weekend we just had yet another post... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=18075&rss *** Watch a bank-raiding ZeuS bot command post get owned in 60 seconds *** --------------------------------------------- RC4? Shoddy PHP coding? You VXers should try a little harder Vid Web thieves may get more than they bargained for if tech pros follow the lead of one researcher - who demonstrated how to hack the systems remote-controlling the infamous ZeuS crime bot in 60 seconds. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/05/06/zeus_pwned_… *** The State of Cryptography in 2014, Part 1: On Fragility and Heartbleed *** --------------------------------------------- It seems like cryptography has been taking a knock recently. This is both good and bad, but is not actually true: cryptography is always under attack, and for that reason constantly evolves. That's bad, but it's good to realize that cryptography needs constant attention. The threat to cryptography can be very disruptive, as we most recently... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/kwDfInwBFvo/ *** Dropbox schließt Referer-Lücke *** --------------------------------------------- In begrenzten Rahmen geteilte Dropbox-Dokumente können beim Klick auf darin enthaltene Links enttarnt werden. Durch den Fix macht der Cloud-Dienstleister allerdings alle existierenden Dokumente unerreichbar. Diese müssen neu geteilt werden. --------------------------------------------- http://www.heise.de/security/meldung/Dropbox-schliesst-Referer-Luecke-21835… *** Security Bulletin: Multiple Vulnerabilities in IBM iNotes (CVE-2013-0589, CVE-2013-0592, CVE-2013-0594, CVE-2013-0595) *** --------------------------------------------- IBM iNotes versions prior to 8.5.3 Fix Pack 6 and 9.0.1 contain multiple security vulnerabilities: CVE-2013-0589, CVE-2013-0592, CVE-2013-0594 and CVE-2013-0595. --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21671622 *** Update for Vulnerability in Juniper Networks Windows In-Box Junos Pulse Client - Version: 1.0 *** --------------------------------------------- Microsoft is announcing the availability of an update for the Juniper Networks Windows In-Box Junos Pulse Client for Windows 8.1 and Windows RT 8.1. The update addresses a vulnerability in the Juniper VPN client by updating the affected Juniper VPN client libraries contained in affected versions of Microsoft Windows. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/2962393 *** Bugtraq: ESA-2014-028: EMC Cloud Tiering Appliance XML External Entity (XXE) and Information Disclosure Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/532031 *** Bugtraq: [security bulletin] HPSBGN03010 rev.4 - HP Software Server Automation running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/532037 *** Cisco Nexus 1000V Access Control List Bypass Vulnerability *** --------------------------------------------- A vulnerability in Cisco Nexus 1000V switches could allow an unauthenticated, remote attacker to bypass deny statements in access control lists (ACLs) with certain types of Internet Group Management Protocol version 2 (IGMPv2) or IGMP version 3 (IGMPv3) traffic. IGMP version 1 (IGMPv1) is not affected. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Broadcast Access Center for Telco and Wireless Cross-Site Request Forgery Vulnerability *** --------------------------------------------- A vulnerability in the web framework of the Cisco Broadcast Access Center for Telco and Wireless (BAC-TW) could allow an unauthenticated, remote attacker to perform a cross-site request forgery (CSRF) attack against the Cisco BAC-TW web interface. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Broadcast Access Center for Telco and Wireless Cross-Site Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web framework of the Cisco Broadcast Access Center for Telco and Wireless (BAC-TW) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the Cisco BAC-TW web interface. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Struts 2.3.16.3 Manipulation Fix *** --------------------------------------------- Topic: Struts 2.3.16.3 Manipulation Fix Risk: Medium Text:The Apache Struts group is pleased to announce that Struts 2.3.16.3 is available as a "General Availability" release.The GA de... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014050026

1 0

Tageszusammenfassung - Montag 5-05-2014
by Daily end-of-shift report 05 May '14

05 May '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 02-05-2014 18:00 − Montag 05-05-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Lnk files in Email Malware Distribution *** --------------------------------------------- Recently I have noticed more use of .lnk files used in malware distribution via email. These files are Windows Shortcut files, typically used for shortcuts on your system, such as on your desktop. The use of .lnk files in emails is not new, but a recent sample caught my eye and I took a closer look. The original email, as it would appear to the recipient, looked like this, purporting to be from an individual at Automatic Data Processing, and containing what looks to be a PDF document and a ZIP --------------------------------------------- http://feedproxy.google.com/~r/SpiderlabsAnterior/~3/VEYzrNB7xos/lnk-files-… *** PHP Updated to Fix OpenSSL Flaws, Other Bugs *** --------------------------------------------- The maintainers of PHP have released two new versions of the scripting language that fix a number of bugs, including a pair of vulnerabilities related to OpenSSL. Versions 5.4.28 and 5.5.12 both contain that important patch, as well as fixes for more than a dozen other vulnerabilities. The fix for the OpenSSL flaws is in both... --------------------------------------------- http://threatpost.com/php-updated-to-fix-heartbleed-other-bugs/105867 *** iOS 7 Update Silently Removes Encryption For Email Attachments *** --------------------------------------------- An anonymous reader writes "Apple has removed encrypted email attachments from iOS 7. Apple said back in June 2010 in regards to iOS 4.0: Data protection is available for devices that offer hardware encryption, including iPhone 3GS and later, all iPad models, and iPod touch (3rd generation and later). Data protection enhances the built-in hardware encryption by protecting the hardware encryption keys with your passcode. This provides an additional layer of protection for your email --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/FyN_d8fBQgo/story01.htm *** Attack Prediction: Malicious gTLD Squatting May Be The Next Big Threat *** --------------------------------------------- Late last year, ICANN began expanding the generic Top-Level Domains (gTLDs). In addition to the standard .COM, .ORG, and .NET TLDs, over 1,300 new names could become available in the next few years. These new gTLDs and internationalized domain names (IDNs) are awesome ideas if you think about the creativity sparked around the names one can possibly register. --------------------------------------------- http://labs.opendns.com/2014/04/23/malicious-gtld-squatting/ *** Spear Phishing Emails: A Psychological Tactic of Threat Actors *** --------------------------------------------- By exploiting network security vulnerabilities, today's generation of threat actors are able to install advanced polymorphic malware to steal data and damage reputations. But their manipulation efforts aren't limited to codes and machines - they extend to people, too. --------------------------------------------- http://www.seculert.com/blog/2014/05/spear-phishing-emails-a-psychological-… *** Evolution of Encrypting Ransomware *** --------------------------------------------- Recently we've seen a big change in the encrypting ransomware family and we're going to shed light on some of the newest variants and the stages of evolution that have led the high profile malware to where it is today. For those that aren't aware of what encrypting ransomware is, its a cryptovirus that encrypts all your data from local hard drives, network shared drives, removable hard drives and USB. The encryption is done using an RSA -2048 asymmetric public key which makes... --------------------------------------------- http://feedproxy.google.com/~r/WebrootThreatBlog/~3/hp9iym0nxN0/ *** Symantec Critical System Protection for Windows Default Policy Bypass *** --------------------------------------------- Revisions None Severity Symantec does not believe that this bypass represents Symantec Critical System Protection (SCSP) vulnerability. The policy bypass ... --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Bugtraq: [ANN][SECURITY] Struts 1 - CVE-2014-0114 -Mitigation Advice Available, Possible RCE Impact *** --------------------------------------------- http://www.securityfocus.com/archive/1/532008 *** Vuln: F5 Networks BIG-IQ Remote Privilege Escalation Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/67191 *** F5 BIG-IQ 4.1.0.2013.0 Password Change Exploit *** --------------------------------------------- Topic: F5 BIG-IQ 4.1.0.2013.0 Password Change Exploit Risk: High Text:## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-fr... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014050012 *** OpenSSL Null Pointer Dereference in do_ssl3_write() Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030188 *** [webapps] - Seagate BlackArmor NAS - Multiple Vulnerabilities *** --------------------------------------------- http://www.exploit-db.com/exploits/33159 *** Vuln: WordPress NextCellent Gallery Plugin CVE-2014-3123 Multiple Cross Site Scripting Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/67085 *** IBM Tivoli Netcool/Portal vulnerable to CVE-2014-0160 & CVE-2014-0076 *** --------------------------------------------- Security vulnerabilities have been discovered in OpenSSL. CVE(s): CVE-2014-0160 and CVE-2014-0076 Affected product(s) and affected version(s): IBM Tivoli Netcool/Portal 2.1.2 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21671783 X-Force Database: http://xforce.iss.net/xforce/xfdb/92322 X-Force Database: http://xforce.iss.net/xforce/xfdb/91990 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_tivoli_netcool_po… *** IBM Security Bulletin: Multiple OpenSSL vulnerabilities in Tivoli Endpoint Manager for Remote Control. (CVE-2013-4353,CVE-2013-6449) *** --------------------------------------------- Security vulnerabilities exist in the version of OpenSSL shipped with Tivoli Endpoint Manager for Remote Control. CVE(s): CVE-2013-4353 and CVE-2013-6449 Affected product(s) and affected version(s): Tivoli Endpoint Manager for Remote Control version 8.2.1. Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg21669040 X-Force Database: http://xforce.iss.net/xforce/xfdb/90201 X-Force --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Bugtraq: [HP security bulletins] *** --------------------------------------------- http://www.securityfocus.com/archive/1/532002 http://www.securityfocus.com/archive/1/532001 http://www.securityfocus.com/archive/1/532003 http://www.securityfocus.com/archive/1/532004 http://www.securityfocus.com/archive/1/532007 http://www.securityfocus.com/archive/1/532010 http://www.securityfocus.com/archive/1/532011 http://www.securityfocus.com/archive/1/532012 http://www.securityfocus.com/archive/1/532013 http://www.securityfocus.com/archive/1/532014 http://www.securityfocus.com/archive/1/532022 http://www.securityfocus.com/archive/1/532023

1 0

Tageszusammenfassung - Freitag 2-05-2014
by Daily end-of-shift report 02 May '14

02 May '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 30-04-2014 18:00 − Freitag 02-05-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Serious security flaw in OAuth, OpenID discovered *** --------------------------------------------- Attackers can use the "Covert Redirect" vulnerability in both open-source login systems to steal your data and redirect you to unsafe sites. --------------------------------------------- http://www.cnet.com/news/serious-security-flaw-in-oauth-and-openid-discover… *** Ubuntu schließt weitere Lücken im Unity-Sperrbildschirm *** --------------------------------------------- Mit zwei Updates für ihren Unity-Desktop haben die Entwickler der Linux-Distribution weitere Sicherheitsprobleme behoben. Diese hätten es ermöglicht, den Sperrbildschirm unter bestimmten Umständen zu umgehen. --------------------------------------------- http://www.heise.de/security/meldung/Ubuntu-schliesst-weitere-Luecken-im-Un… *** Security Update Released to Address Recent Internet Explorer Vulnerability *** --------------------------------------------- Today, we released a security update to address the Internet Explorer (IE) vulnerability first described in Security Advisory 2963983. This security update addresses every version of Internet Explorer. While we've seen only a limited number of targeted attacks, customers are advised to install this update promptly. The majority of our customers have automatic updates enabled and so will not need to take any action as protections will be downloaded and installed automatically. If... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/05/01/security-update-released… *** Sefnit Botnet Swaps Tor for SSH *** --------------------------------------------- Facebook security researchers spot a Sefnit/Mevade click-fraud and Bitcoin-mining botnet returning to its previous SSH command-and-control communications infrastructure. --------------------------------------------- http://www.darkreading.com/attacks-breaches/sefnit-botnet-swaps-tor-for-ssh… *** Factsheet DNS Amplification *** --------------------------------------------- DDoS-attacks have been hitting headlines the last year. In some of these attacks, attackers use a technique called DNS amplification. This factsheet will help network administrators in preventing DNS amplification attacks via their systems. --------------------------------------------- http://www.ncsc.nl/english/current-topics/news/factsheet-dns-amplification.… *** Apple Fixes Critical Hole in Developer Center *** --------------------------------------------- Apple patched a potentially serious hole in its Developer Center that could have given anyone unfettered access to personal contact information for Apple employees and partners. --------------------------------------------- http://threatpost.com/apple-fixes-critical-hole-in-developer-center/105848 *** All About Windows Tech Support Scams *** --------------------------------------------- *Editors Notes: The purpose of this research was to see exactly how this scam is carried out, and the extent to which it is done. DO NOT TRY THIS AT HOME. We used a clean machine, off network, to monitor the activity of the scammer. Have you ever received a phone call from a tech support person claiming to be from Microsoft, and that your Windows based machine has been found to have a virus on it? These cold calls typically come from loud call centers, and are targeting the uninformed and... --------------------------------------------- http://feedproxy.google.com/~r/WebrootThreatBlog/~3/qw_08fRmr5o/ *** SA-CONTRIB-2014-047 - Zen - Cross Site Scripting *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-047Project: Zen (third-party theme)Version: 7.xDate: 2014-April-30Security risk: Moderately criticalExploitable from: RemoteVulnerability: Cross Site ScriptingDescriptionThe Zen theme is a powerful, yet simple, HTML5 starting theme with a responsive, mobile-first grid design.The theme does not properly sanitize theme settings before they are used in the output of a page. Custom themes that have copied Zens template files (e.g. subthemes) may suffer from this --------------------------------------------- https://drupal.org/node/2254925 *** Cross-Site Scripting Vulnerability in Citrix NetScaler Gateway, formerly Citrix Access Gateway Enterprise Edition *** --------------------------------------------- Severity: Medium Description of Problem A Cross-Site Scripting (XSS) vulnerability has been identified in Citrix NetScaler Gateway, formerly known as Citrix Access Gateway Enterprise Edition... --------------------------------------------- http://support.citrix.com/article/CTX140291 *** Cisco TelePresence TC and TE Bugs Let Remote Users Execute Arbitrary Code and Deny Service and Let Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1030181 *** AMTELCO miSecure Vulnerabilities *** --------------------------------------------- Researcher Jared Bird of Allina Health reported multiple vulnerabilities in the AMTELCO miSecureMessage (MSM) medical messaging system. AMTELCO has an update available to all customers that mitigates the vulnerabilities. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-121-01 *** WordPress plugin EZPZ One Click Backup Command Injection *** --------------------------------------------- Topic: WordPress plugin EZPZ One Click Backup Command Injection Risk: High Text:Product: WordPress plugin EZPZ One Click Backup Vulnerability type: CWE-78 OS Command Injection Vulnerable versions: 12.03.10... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014050008 *** WordPress leaflet maps marker plugin SQL Injection Vulnerability *** --------------------------------------------- Topic: WordPress leaflet maps marker plugin SQL Injection Vulnerability Risk: Medium Text: # # Exploit Title: WordPress leaflet maps marker plugin SQL Injection Vulnerability # # Author: neo.hapsis #memb... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014050010

1 0

Tageszusammenfassung - Mittwoch 30-04-2014
by Daily end-of-shift report 30 Apr '14

30 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 29-04-2014 18:00 − Mittwoch 30-04-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** PHP Callback Functions: Another Way to Hide Backdoors *** --------------------------------------------- We often find new techniques employed by malware authors. Some are very interesting, others are pretty funny, and then there are those that really stump us in their creativity and effectiveness. This post is about the latter. Everyone who writes code in PHP knows what the eval() function is .. --------------------------------------------- http://blog.sucuri.net/2014/04/php-callback-functions-another-way-to-hide-b… *** [papers] - Introduction to Android Malware Analysis *** --------------------------------------------- http://www.exploit-db.com/download_pdf/33093 *** Xen HVMOP_set_mem_type Page Transition Flaw Lets Local Users on the Guest System Cause Denial of Service Conditions on the Host System *** --------------------------------------------- http://www.securitytracker.com/id/1030160 *** "Bypassing endpoint protections" @ BSides London *** --------------------------------------------- This week I presented at BSides London. The talk is titled "Layers on layers: bypassing endpoint protection". The purpose of this talk is to reiterate on the (well-known) common weakness of most endpoint protection products - their reliance on kernel integrity. Once the attacker achieves arbitrary code execution in the kernel, there .. --------------------------------------------- http://labs.bromium.com/2014/04/29/bypassing-endpoint-protections-bsides-lo… *** Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Be on the Lookout: Odd DNS Traffic, Possible C&C Traffic, (Wed, Apr 30th) *** --------------------------------------------- We got an email from one of our readers, including an interesting port 53 packet. While Wireshark and TCPDump try to decode it as DNS, it is almost certainly not DNS. The payload of the packet is .. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=18047&rss *** Mozilla Thunderbird Multiple Flaws Let Remote Users Execute Arbitrary Code, Deny Service, and Conduct Cross-Site Scripting Attacks and Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1030165 *** Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Deny Service, and Conduct Cross-Site Scripting Attacks and Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1030163 *** [2014-04-30] SQL injection and XSS vulnerabilities in Typo3 si_bibtex extension *** --------------------------------------------- By exploiting the SQL injection vulnerability in the Typo3 extension "si_bibtex", an attacker is able to gain full access to the Typo3 database. Depending on the location where the extension is used in the web application, this may be possible by an unauthenticated attacker. Furthermore, it is affected by persistent XSS. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Symantec Encryption Desktop (PGP) Memory Access Flaws Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030170 *** Friends dont let friends use Internet Explorer - advice from US, UK, EU *** --------------------------------------------- IE 6 to 11 at risk of hijacking, patch coming - but not for XP Microsoft has warned of a new security flaw in all versions of its Internet Explorer web browser for Windows PCs. A patch has yet to be released for the crocked code. --------------------------------------------- www.theregister.co.uk/2014/04/27/oops_we_did_it_again_microsoft_warns_of_ie… *** Botnetz für Altcoin-Mining nutzt Lücke in Nagiosüberwachung aus *** --------------------------------------------- Eine kürzlich veröffentlichte Sicherheitslücke im Netzwerkmonitor Nagios wird offenbar bereits ausgenutzt. Betroffen sind weit über 1000 weltweit verteilte Server, die für Mining-Zwecke missbraucht werden. --------------------------------------------- http://www.heise.de/newsticker/meldung/Botnetz-fuer-Altcoin-Mining-nutzt-Lu… *** Neuer Erpressungs-Trojaner verschlüsselt mit RSA-2048 *** --------------------------------------------- Es häufen sich Berichte über infizierte Windows-Systeme, auf denen ein Schadprogramm Dateien verschlüsselt und nur gegen Zahlung eines Lösegelds von 500 Euro wieder freigibt. Die sind via Tor in Bitcoins zu entrichten. --------------------------------------------- http://www.heise.de/security/meldung/Neuer-Erpressungs-Trojaner-verschluess… *** Protection strategies for the Security Advisory 2963983 IE 0day *** --------------------------------------------- We've received a number of customer inquiries about the workaround steps documented in Security Advisory 2963983 published on Saturday evening. We hope this blog post answers those questions. Steps you can take to stay safe The security advisory lists several options customers can take to stay safe. Those options are .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/04/30/protection-strategies-for… *** Six infosec tips I learned from Game of Thrones *** --------------------------------------------- In Westeros - the land of dark knights, backstabbing royals, dragons, wildings, wargs, red witches, and White Walkers - even the youngest ones have to learn basic self-defense if they're to have any hope of surviving the cruel fictional world imagined by A Game of Thrones (GOT) author, George R. R. Martin. And so too, must every CISO and security pro learn the latest information security best practices if they're to survive today's Internet threat landscape. --------------------------------------------- http://www.net-security.org/article.php?id=2001&p=1

1 0

Tageszusammenfassung - Dienstag 29-04-2014
by Daily end-of-shift report 29 Apr '14

29 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 28-04-2014 18:00 − Dienstag 29-04-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Update for Vulnerabilities in Adobe Flash Player in Internet Explorer - Version: 23.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/2755801 *** Ubuntu 14.04 lockscreen bypass, (Mon, Apr 28th) *** --------------------------------------------- Upgraded to Ubuntu 14.04? Hold down enter to bypass the lockscreen (what is old is new again): https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1308572 …" The reporter indicates that he was running Ubuntu 14.04 with all the packages updated. When the screen is locked with password, if holding ENTER, after some seconds the screen freezes and the lock screen .. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=18039 *** Cisco ASA DHCPv6 Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Researchers warn of resurgent Sefnit malware *** --------------------------------------------- Botnet returns using new tactics A malware infection which drew headlines January has returned and is using new techniques to infect and spread amongst users. --------------------------------------------- www.theregister.co.uk/2014/04/29/researchers_warn_of_resurgent_sefnit_malwa… *** Citrix NetScaler Application Delivery Controller and NetScaler Gateway Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in the management component of the Citrix NetScaler Application Delivery Controller .. --------------------------------------------- http://support.citrix.com/article/CTX140651 *** Massenhack bei AOL: Millionen Nutzer betroffen *** --------------------------------------------- Unbekannte verschaffen sich Zugang zu privaten Informationen - Unternehmen fordert zum ändern des Passworts auf --------------------------------------------- http://derstandard.at/1397521927406 *** The FireEye Advanced Threat Report 2013: European Edition *** --------------------------------------------- We recently published the 2013 FireEye Advanced Threat Report during RSA Conference, providing a global overview of the advanced attacks that FireEye discovered last year. We are now drilling that global analysis down into the European threat .. --------------------------------------------- http://www.fireeye.com/blog/corporate/2014/04/the-fireeye-advanced-threat-r… *** Cybercriminals Take Advantage Of Heartbleed With Spam *** --------------------------------------------- Since news about Heartbleed broke out earlier this month, the Internet has been full of updates, opinions and details about the vulnerability, with personalities ranging from security experts to celebrities talking about it. Being as opportunistic as they are, cybercriminals have taken notice of this and .. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/RKpGQ6-RSA8/ *** Q1 2014 Mobile Threat Report *** --------------------------------------------- Our Mobile Threat Report for Q1 2014 is out! Heres a couple of the things we cover in it:The vast majority of the new threats found was on Android (no surprise there), which accounted for 275 out of 277 new families we saw in this period, leaving 1 new malware apiece on iOS and Symbian.In Q1, .. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002699.html *** 6 free network vulnerability scanners *** --------------------------------------------- Vulnerability scanners can help you automate security auditing and can play a crucial role in your IT security. They can scan your network and websites for up to thousands of different security risks, produce a prioritized list of those you should patch, describe the vulnerabilities, and give steps on how to remediate them. Some can even automate the patching process. While these tools can .. --------------------------------------------- http://www.csoonline.com/article/2148841/data-protection/6-free-network-vul… *** Hashcat-Utils v1.0 Released *** --------------------------------------------- Hashcat-utils are a set of small utilities that are useful in advanced password cracking. They all are packed into multiple stand-alone binaries. All of these utils are designed to execute only one specific function. Since they all work with STDIN and STDOUT you can group them into chains. The programs are available for Linux and Windows on both 32 bit and 64 bit architectures. The programs are also available as open source. --------------------------------------------- http://www.toolswatch.org/2014/04/hashcat-utils-v1-0-released/

1 0

Tageszusammenfassung - Montag 28-04-2014
by Daily end-of-shift report 28 Apr '14

28 Apr '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 25-04-2014 18:00 − Montag 28-04-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Using Facebook Notes to DDoS any website *** --------------------------------------------- Facebook Notes allows users to include tags. Whenever a tag is used, Facebook crawls the image from the external server and caches it. Facebook will only cache the image once however using random get parameters the cache can be by-passed and the feature can be abused to cause a huge HTTP GET flood. --------------------------------------------- http://chr13.com/2014/04/20/using-facebook-notes-to-ddos-any-website/ *** Mozilla entschlackt Zertifkats-Überprüfung *** --------------------------------------------- Statt 81.865 sind jetzt nur noch 4167 Zeilen Code zum überprüfen von SSL-Zertifikaten nötig. Wer Sicherheitslücken in darin findet, erhält einen üppigen Finderlohn. --------------------------------------------- http://www.heise.de/security/meldung/Mozilla-entschlackt-Zertifkats-Ueberpr… *** Examining the Heartbleed-based FUD thats pitched to the public *** --------------------------------------------- The Heartbleed vulnerability has created a massive news cycle, and generated technical risk-based discussions that might actually do some good. But some of these discussions boggle the mind, spreading misinformation in order to generate clicks or sales.When security issues hit the mass media, such as Heartbleed, there is a good deal of Fear, Uncertainty, and Doubt - better known as FUD - that gets promoted on the airwaves and in print. --------------------------------------------- http://www.csoonline.com/article/2148461/application-security/examining-the… *** Sicherheitslücke bei Messaging-App Viber aufgedeckt *** --------------------------------------------- Bilder, Videos und Standortdaten, die man mit der Messaging-App Viber übermittelt, werden unverschlüsselt auf Servern gespeichert. Der Zugang dazu ist äußerst einfach. --------------------------------------------- http://futurezone.at/digital-life/sicherheitsluecke-bei-messaging-app-viber… *** Microsoft Warns of Attacks on IE Zero-Day *** --------------------------------------------- Microsoft is warning Internet Explorer users about active attacks that attempt to exploit a previously unknown security flaw in every supported version of IE. The vulnerability could be used to silently install malicious software without any help from users, save for perhaps merely browsing to a hacked or malicious site. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/PUm3t0AZZzc/ *** Neue Internet-Explorer-Lücke wird zum Ernstfall für Windows XP *** --------------------------------------------- Wird bereits aktiv ausgenutzt - Kein Update mehr für XP, andere Betriebssystemversion derzeit ebenfalls noch ungeschützt --------------------------------------------- http://derstandard.at/1397521804143 *** Biggest EU cyber security exercise to date: Cyber Europe 2014 taking place today *** --------------------------------------------- Today, 28 April 2014, European countries kick off the Cyber Europe 2014 (CE2014). CE2014 is a highly sophisticated cyber exercise, involving more than 600 security actors across Europe. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/biggest-eu-cyber-security-e… *** Cisco IOS XE Software Malformed L2TP Packet Vulnerability *** --------------------------------------------- A vulnerability in the Layer 2 Tunneling Protocol (L2TP) module of Cisco IOS XE on Cisco ASR 1000 Series Routers could allow an authenticated, remote attacker to cause a reload of the processing ESP card. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Security updates available for Adobe Flash Player (APSB14-13) *** --------------------------------------------- A Security Bulletin (APSB14-13) has been published regarding security updates for Adobe Flash Player. These updates address a critical vulnerability, and Adobe recommends users update their product installations to the latest versions --------------------------------------------- http://blogs.adobe.com/psirt/?p=1093

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily