Daily

daily@lists.cert.at

1 participants
3190 discussions

Tageszusammenfassung - Montag 25-03-2013
by Daily end-of-shift report 25 Mar '13

25 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 22-03-2013 18:00 − Montag 25-03-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** SANS Pen Test Berlin 2013 *** --------------------------------------------- "SANS Pen Test Berlin 2013 takes place from June 3rd to June 8th in the Radisson Blu Hotel on the bank of Berlins River Spree. SANS once again presents a world class line up of pen test training courses led by SANS globally renowned, expert instructors. As well as the unique SANS training experience, we will also be offering a series of @Night talks and social functions, plus the opportunity to take place in NetWars...." --------------------------------------------- http://www.sans.org/event/pentest-berlin-2013 *** Apple: Sicherheitslücke in Account-Recovery-Tool *** --------------------------------------------- Laut US-Berichten genügte es bis zum Freitag, die Mail-Adresse und das Geburtsdatum von Apple-ID-Inhabern zu kennen, um deren Passwort zu ersetzen. --------------------------------------------- http://heise.de.feedsportal.com/c/35207/f/653902/s/29e6e636/l/0L0Sheise0Bde… *** Bundeskriminalamt warnt vor neuem Lösegeld-Trojaner *** --------------------------------------------- Erenut ist Schadsoftware im Umlauf, die Betroffenen unterstellt, jugendpornografisches Material zu verbreiten und zu einer Geldzahlung auffordert. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/29e7d088/l/0L0Sheise0Bde0Csec… *** Schwache Schlüssel bei NetBSD *** --------------------------------------------- Eine falsch gesetzte Klammer im Programmcode von NetBSD führt dazu, dass das System schwache kryptografische Schlüssel erzeugt. Besonders betroffen sind Schlüssel für OpenSSH-Server. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/29eea8f1/l/0L0Sheise0Bde0Csec… *** Wordpress wp-video-commando Plugin XSS *** --------------------------------------------- Topic: Wordpress wp-video-commando Plugin XSS Risk: Low Text:# Exploit Title: Wordpress wp-video-commando Plugin Xss ((|)) # Vulnerability ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/lkXYceohQoo/WLB-20… *** MongoDB: Exploit im Netz, Metasploit-Modul in der Mache *** --------------------------------------------- Administratoren von MongoDB mit der Version 2.2.3 sollten so schnell wie möglich auf die aktuelle Version 2.4.1 wechseln. Es ist ein Exploit aufgetaucht, der einen serverseitigen Buffer-Overflow und Crash verursachen kann. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/29f72124/l/0L0Sheise0Bde0Csec… *** [papers] - Hacking Trust Relationships Between SIP Gateways *** --------------------------------------------- Hacking Trust Relationships Between SIP Gateways --------------------------------------------- http://www.exploit-db.com/download_pdf/24878 *** Moodle Multiple Vulnerabilities *** --------------------------------------------- Two weaknesses and multiple vulnerabilities have been reported in Moodle, which can be exploited by malicious users to disclose potentially sensitive information, manipulate certain data, and conduct script insertion attacks and by malicious people to disclose potentially sensitive and system information. --------------------------------------------- https://secunia.com/advisories/52691 *** Novell ZENworks Configuration Management Control Center Arbitrary File Upload Vulnerability *** --------------------------------------------- A vulnerability has been reported in Novell ZENworks Configuration Management, which can be exploited by malicious people to compromise the vulnerable system. --------------------------------------------- https://secunia.com/advisories/52784

1 0

Tageszusammenfassung - Freitag 22-03-2013
by Daily end-of-shift report 22 Mar '13

22 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 21-03-2013 18:00 − Freitag 22-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Symantec Enterprise Vault privilege escalation *** --------------------------------------------- Symantec Enterprise Vault privilege escalation --------------------------------------------- http://xforce.iss.net/xforce/xfdb/82989 *** Symantec NetBackup Appliance Management Console Lets Remote Authenticated Users Download Files *** --------------------------------------------- A vulnerability was reported in Symantec NetBackup Appliance. A remote authenticated user can view files on the target system. --------------------------------------------- http://www.securitytracker.com/id/1028329 *** Symantec finds Linux wiper malware used in S. Korean attacks *** --------------------------------------------- "Security vendors analyzing the code used in the cyberattacks against South Korea are finding nasty components designed to wreck infected computers. Tucked inside a piece of Windows malware used in the attacks is a component that erases Linux machines, an analysis from Symantec has found. The malware, which it called Jokra, is unusual, Symantec said. --------------------------------------------- http://www.csoonline.com/article/730574/symantec-finds-linux-wiper-malware-… *** LibreOffice 4.0.1.2 Update Spoofing *** --------------------------------------------- Topic: LibreOffice 4.0.1.2 Update Spoofing Risk: Medium Text:[waraxe-2013-SA#099] - Update Spoofing Vulnerability in LibreOffice 4.0.1.2 = Author: Janek Vind "waraxe" Date... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/5kWhqQ69Ci0/WLB-20… *** Joomla Component com_wordpress XSS Vulnerability *** --------------------------------------------- Topic: Joomla Component com_wordpress XSS Vulnerability Risk: Low Text:# Title : joomla Component com_wordpress XSS Vulnerability # Date: 2013-03-15 --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/xJniCtV-cHo/WLB-20… *** Spotted: cybercriminals working on new Western Union based 'money mule management' script *** --------------------------------------------- By Dancho Danchev Risk-forwarding is an inseparable part of the cybercrime ecosystem. Whether it's the use of malware-infected hosts as stepping-stones, the issuing of License Agreements for your latest rootkit release stating that it's meant to be tested against the customer's own systems you wish or the selling of cheap access to verified PayPal accounts.... --------------------------------------------- http://feedproxy.google.com/~r/WebrootThreatBlog/~3/lnqwrG1Fm4A/ *** EuroForensics 2013: 4th International Forensic Sciences Conference & Exhibition *** --------------------------------------------- "4th International Forensic Sciences, Cyber Security and Surveillance Technologies Conference & Exhibition takes place in Harbiye Military Museum Istanbul, Turkey 27-29 March 2013. The 4th Euroforensics has been designed as the primary international conference and exhibition for sourcing digital forensics products, equipment and services, and to provide a complete source of education, best practice, training and networking for the entire forensics and security sector and supply chain. --------------------------------------------- http://www.forensicfocus.com/News/article/sid=2018/ *** IBM Lotus Notes Multiple Vulnerabilities *** --------------------------------------------- IBM Lotus Notes Multiple Vulnerabilities --------------------------------------------- https://secunia.com/advisories/52599 *** RealPlayer Heap Overflow in Processing MP4 Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- A vulnerability was reported in RealPlayer. A remote user can cause arbitrary code to be executed on the target user's system. --------------------------------------------- http://www.securitytracker.com/id/1028332 *** CoreFTP "DELE" Buffer Overflow Vulnerability *** --------------------------------------------- CoreFTP "DELE" Buffer Overflow Vulnerability --------------------------------------------- https://secunia.com/advisories/52736 *** Links im Tarnkleid *** --------------------------------------------- Der Link soll zu Heise führen, aber dann landet der Nutzer woanders. Der "Mouse-Over"-Test enttarnt die Umleitung nicht. auch ein Blick in den Quellcode hilft nicht gleich weiter. Links lassen sich so manipulieren, dass es im Zweifel zu spät auffällt. --------------------------------------------- http://www.heise.de/security/meldung/Links-im-Tarnkleid-1828362.html *** Privacy 101: Skype Leaks Your Location *** --------------------------------------------- The events of the past week reminded me of a privacy topic Ive been meaning to revisit: That voice-over-IP telephony service Skype constantly exposes your Internet address to the entire world, and that there are now numerous free and commercial tools that can be used to link Skype user account names to numeric Internet addresses.Related Posts:Rogue Antivirus Via Skype Phone Call?Google Adds 1-Time Passwords to Gmail, AppsThe Scrap Value of a Hacked PC, RevisitedEarn a Diploma from Scam UThe --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/pOQV1cF-XH8/ *** Apple Adds Two-Factor Authentication to iTunes Accounts *** --------------------------------------------- Apple has introduced a new two-factor authentication system designed to help protect users iTunes and App Store accounts and prevent attackers or unauthorized users from taking over users accounts. The system is similar to the one that Google has implemented for Gmail, utilizing verification codes sent via SMS. The move by Apple comes years after Google made the change with Gmail two-factor authentication in response to a series of targeted attacks against Gmail users.... --------------------------------------------- http://threatpost.com/en_us/blogs/apple-adds-two-factor-authentication-itun… *** vbulletin 4.1.5 attachment SQLI *** --------------------------------------------- Topic: vbulletin 4.1.5 attachment SQLI Risk: Medium Text:vbulletin 4.1.5 attachment SQLI examine variables came across sq-injection, as later found to be inherent to all vbulletin ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/8PX5zvE7-bM/WLB-20… *** vBulletin x.x.x Customer Area 0day *** --------------------------------------------- Topic: vBulletin x.x.x Customer Area 0day Risk: Medium Text:vBulletin x.x.x Customer Area 0day - vBulletin x.x.x Customer Area 0day Perl script got leaked so decided ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/nLzgCibjUrQ/WLB-20… *** vBulletin 5.0.0 all Beta releases SQL Injection Exploit 0day *** --------------------------------------------- Topic: vBulletin 5.0.0 all Beta releases SQL Injection Exploit 0day Risk: Medium Text:vBulletin 5.0.0 all Beta releases SQL Injection Exploit 0day ************************************************** ************... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/ovrdpW5le4o/WLB-20…

1 0

Tageszusammenfassung - Donnerstag 21-03-2013
by Daily end-of-shift report 21 Mar '13

21 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 20-03-2013 18:00 − Donnerstag 21-03-2013 18:00 Handler: Robert Waldner Co-Handler: Christian Wojner *** AMD Catalyst Control Center Update Spoofing Vulnerability *** --------------------------------------------- AMD Catalyst Control Center Update Spoofing Vulnerability --------------------------------------------- https://secunia.com/advisories/52696 *** tokend (Apple, Gemalto) privacy leak & arbitrary file creation *** --------------------------------------------- Topic: tokend (Apple, Gemalto) privacy leak & arbitrary file creation Risk: High Text:Tokend is a module for OS X CDSA/Keychain subsystem for accessing smart cards. It acts as a bridge between the apple KeyChain ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/EQ1oxqfYnQA/WLB-20… *** OpenSC.tokend privacy leak & arbitrary file creation *** --------------------------------------------- Topic: OpenSC.tokend privacy leak & arbitrary file creation Risk: High Text:OpenSC.tokend (1,2) is a Tokend module for OS X CDSA/Keychain subsystem for accessing smart cards. As is common in such bridge... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/QSRbtZTKohQ/WLB-20… *** Linux Kernel kvm Multiple Vulns *** --------------------------------------------- Topic: Linux Kernel kvm Multiple Vulns Risk: High Text:* CVE-2013-1796 Description of the problem: If the guest sets the GPA of the time_page so that the request to update the tim... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/ajIh5W6bo-g/WLB-20… *** Resilient Cyber Systems Symposium (Resilience Week 2013) *** --------------------------------------------- "Announcement and call for papers for the 1st International Symposium on Resilient Cyber Systems, which will be held as part of the Resilience Week in San Francisco, in August 2013. Topics of Interest include:- Resilient Cyber Frameworks and Architectures: multi-agent systems for monitoring and control, supervisory control and data acquisition, distributed sense making and coordination- Moving Target Defense: Moving target defense technologies, evaluation metrics, visualization and command --------------------------------------------- http://cybersystems2013.inl.gov/ *** Another iPhone passcode bypass spell revealed *** --------------------------------------------- Turn off Siri, remove SIM, add unicorn blood, phone and contacts are yours Apples recent release of iOS 6.1.3, complete with fix for the weird keypress sequence that allowed access to and export of iPhone address books, seems to have been just a little bit futile after a new bug with the same effects emerged.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/21/another_mag… *** libvirt Group Privileges Error Lets Local Users Modify Certain Files on the Target System *** --------------------------------------------- A vulnerability was reported in libvirt. A local user can modify certain files on the target system. --------------------------------------------- http://www.securitytracker.com/id/1028323 *** Linux Kernel i915 driver in the Direct Rendering Manager Integer Overflow *** --------------------------------------------- Topic: Linux Kernel i915 driver in the Direct Rendering Manager Integer Overflow Risk: Medium Text:It is possible to wrap the counter used to allocate the buffer for relocation copies. This could lead to heap writing overflow... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/uuWQ-E59VLw/WLB-20… *** Drupal Views Module View Configuration Fields Script Insertion Vulnerabilities *** --------------------------------------------- Drupal Views Module View Configuration Fields Script Insertion Vulnerabilities --------------------------------------------- https://secunia.com/advisories/51540 *** IBM Rational ClearQuest reflected cross-site scripting *** --------------------------------------------- IBM Rational ClearQuest reflected cross-site scripting --------------------------------------------- http://xforce.iss.net/xforce/xfdb/80061

1 0

Tageszusammenfassung - Mittwoch 20-03-2013
by Daily end-of-shift report 20 Mar '13

20 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 19-03-2013 18:00 − Mittwoch 20-03-2013 18:00 Handler: Robert Waldner Co-Handler: Matthias Fraidl *** Security firm publishes details about Java issue, asks for second opinion *** --------------------------------------------- "Making good on their promise, Security Exploration has published technical details about a Java issue that they consider to be a security vulnerability, but Oracle has categorized as demonstrating "allowed behavior"."As of Mar 18, 2013 no information was received from Oracle that would indicate that Issue 54 is treated by the company as a security vulnerability," they wrote on Monday. ..." --------------------------------------------- http://www.net-security.org/secworld.php?id=14617 *** Google fully implements security feature on DNS lookups *** --------------------------------------------- "Google has fully implemented a security feature that ensures a person looking up a website isnt inadvertently directed to a fake one. The Internet company has run its own free public Domain Name System (DNS) lookup service, called Public DNS, since 2009. DNS lookups are required to translate a domain name, such as www...." --------------------------------------------- http://www.computerworld.com.au/article/456804/google_fully_implements_secu… *** Samsung Android Remote Owning Devices *youtube *** --------------------------------------------- Topic: Samsung Android Remote Owning Devices *youtube Risk: High Text:I was planning to open a blog since some months, but I decided to do it only now, to summarize some of the findings of a quick ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/zRL6QVbdylE/WLB-20… *** Strategie zu Cyberkriminalität beschlossen *** --------------------------------------------- Regierung will sich künftig besser koordinieren --------------------------------------------- http://futurezone.at/netzpolitik/14759-strategie-zu-cyberkriminalitaet-besc… *** CVSS Security-Bug Rating System Gets A Makeover *** --------------------------------------------- "In 2005, three companies--Cisco, Qualys and Symantec--announced the Common Vulnerability Scoring System (CVSS) as a way to rank the security impact of software flaws and the potential risks they posed to companies. In theory, the flaw scoring system aims to give security professionals, researchers and software vendors a repeatable way to rank the severity of a vulnerability by measuring the issues base exploitability, how that evolves over time, and the impact the security bug has on the --------------------------------------------- http://www.darkreading.com/vulnerability-management/167901026/security/secu… *** MySQL yaSSL Two Buffer Overflow Vulnerabilities *** --------------------------------------------- MySQL yaSSL Two Buffer Overflow Vulnerabilities --------------------------------------------- https://secunia.com/advisories/52445 *** Linux Kernel ext3 Message Logging Format String Vulnerabilities *** --------------------------------------------- Linux Kernel ext3 Message Logging Format String Vulnerabilities --------------------------------------------- https://secunia.com/advisories/52661 *** IBM WebSphere Commerce password information disclosure *** --------------------------------------------- IBM WebSphere Commerce password information disclosure --------------------------------------------- http://xforce.iss.net/xforce/xfdb/80206 *** Google Picasa BMP and TIFF Images Processing Vulnerabilities *** --------------------------------------------- Google Picasa BMP and TIFF Images Processing Vulnerabilities --------------------------------------------- https://secunia.com/advisories/51652

1 0

Tageszusammenfassung - Dienstag 19-03-2013
by Daily end-of-shift report 19 Mar '13

19 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-03-2013 18:00 − Dienstag 19-03-2013 18:00 Handler: Robert Waldner Co-Handler: Matthias Fraidl *** EA Origin vuln puts players at risk *** --------------------------------------------- Game platform allows remote exploits, millions vulnerable A flaw in EAs Origin game store puts its 40 million or so users at risk of remote execution vulnerabilities… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/19/ea_origin_b… *** Vuln: Cisco IOS and IOS XE Insecure Password Hash Weakness *** --------------------------------------------- Cisco IOS and IOS XE Insecure Password Hash Weakness --------------------------------------------- http://www.securityfocus.com/bid/58557 *** Oracle Automated Service Manager Unsafe Temporary Files Let Local Users Modify Files on the Target System. *** --------------------------------------------- A vulnerability was reported in Oracle Automated Service Manager. A local user can modify files on the target system. --------------------------------------------- http://www.securitytracker.com/id/1028310 *** Siemens SIMATIC WinCC TIA Portal Multiple Vulnerabilities *** --------------------------------------------- Siemens SIMATIC WinCC TIA Portal Multiple Vulnerabilities --------------------------------------------- https://secunia.com/advisories/52646 *** McAfee Vulnerability Manager Unspecified Cross-Site Scripting Vulnerability *** --------------------------------------------- McAfee Vulnerability Manager Unspecified Cross-Site Scripting Vulnerability --------------------------------------------- https://secunia.com/advisories/52688 *** Joomla! RSFiles! Component "cid" SQL Injection Vulnerability *** --------------------------------------------- Joomla! RSFiles! Component "cid" SQL Injection Vulnerability --------------------------------------------- https://secunia.com/advisories/52668 *** Ruby on Rails Multiple Vulnerabilities *** --------------------------------------------- Ruby on Rails Multiple Vulnerabilities --------------------------------------------- https://secunia.com/advisories/52656 *** IBM WebSphere Application Server Multiple Java Vulnerabilities *** --------------------------------------------- IBM WebSphere Application Server Multiple Java Vulnerabilities --------------------------------------------- https://secunia.com/advisories/52703 *** Aruba Mobility Controller Administration WebUI SSID Script Insertion Vulnerability *** --------------------------------------------- Aruba Mobility Controller Administration WebUI SSID Script Insertion Vulnerability --------------------------------------------- https://secunia.com/advisories/52690 *** [webapps] - ViewGit 0.0.6 - Multiple XSS Vulnerabilities *** --------------------------------------------- ViewGit 0.0.6 - Multiple XSS Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/24862 *** [webapps] - WordPress Count per Day Plugin 3.2.5 (counter.php) - XSS Vulnerability *** --------------------------------------------- WordPress Count per Day Plugin 3.2.5 (counter.php) - XSS Vulnerability --------------------------------------------- http://www.exploit-db.com/exploits/24859 *** Botnetz scannt das Internet mit Hilfe von gehackten Endgeräten *** --------------------------------------------- Ein Hacker hat einen eigenen "Internet Census 2012" mittels eines extra dafür eingerichteten Botnetzes erstellt. Ergebnis der Aktion: 420 Millionen aktive Geräte antworten auf Anfragen - und jede Menge Sicherheitslecks kommen ans Licht. --------------------------------------------- http://www.heise.de/newsticker/meldung/Botnetz-scannt-das-Internet-mit-Hilf… *** Bugtraq: VUPEN Security Research - Mozilla Firefox "nsHTMLEditRules" Use-After-Free (MFSA-2013-29 / CVE-2013-0787) *** --------------------------------------------- VUPEN Security Research - Mozilla Firefox "nsHTMLEditRules" Use-After-Free (MFSA-2013-29 / CVE-2013-0787) --------------------------------------------- http://www.securityfocus.com/archive/1/526050

1 0

Tageszusammenfassung - Montag 18-03-2013
by Daily end-of-shift report 18 Mar '13

18 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 15-03-2013 18:00 − Montag 18-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** Expert: Social Networks Targeted for Drive-By Exploits *** --------------------------------------------- "Malware was spread in unique ways in 2012, particularly through drive-by exploits. In 2013, organizations can expect more exploits targeting social networks, says Adam Kujawa of anti-malware vendor Malwarebytes."The method in which the links to drive-bys have been spread was pretty unique [in 2012]," says Kujawa, a malware intelligence analyst. "We can see that moving over into 2013."Kujawa says cybercriminals are increasingly targeting social networking sites and --------------------------------------------- http://www.govinfosecurity.com/malware-emerging-trends-a-5598 *** The World Has No Room For Cowards *** --------------------------------------------- Its not often that one has the opportunity to be the target of a kinetic and cyber attack at the same time. But that is exactly whats happened to me and my Web site over the past 24 hours. On Thursday afternoon, my site was the target of a fairly massive denial of service attack. That attack was punctuated by a visit from a heavily armed local police unit that was tricked into responding to a 911 call spoofed to look like it came from my home. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/uD9Evlztjaw/ *** Debian Security Advisory DSA-2649 lighttpd *** --------------------------------------------- fixed socket name in world-writable directory --------------------------------------------- http://www.debian.org/security/2013/dsa-2649 *** Sicherheitsunternehmen analysiert Angriffe auf Industriesteuerungen *** --------------------------------------------- Auf der Security-Konferenz Black Hat Europe stellte Trend Micro einen Forschungsbericht über einen einen Praxisversuch vor und zeigt, von wo aus und auf welche Art industrielle Systeme mit Malware angegriffen werden. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsunternehmen-analysiert-Angr… *** Analysis of the Booter.TW *** --------------------------------------------- "Earlier this week, famous InfoSec blogger Brian Krebs website suffered from a denial of service attack that knocked it offline. Following the attack Brian posted an article, "The World has No Room for Cowards", which detailed how he had been SWATed following the attacks against his site. In his article he talked about some of the indicators of who may be behind the attack...." --------------------------------------------- http://www.reversecurity.com/2013/03/analysis-of-bootertw.html *** Android malware analysis tool *** --------------------------------------------- "Bluebox Labs announced Dexter, a free tool to help researchers and enterprise security teams analyze applications for malware and vulnerabilities. The Dexter platform provides software architecture information presented through a web-based user interface...." --------------------------------------------- http://www.net-security.org/secworld.php?id=14605 *** You Only Click Twice: FinFisher's Global Proliferation *** --------------------------------------------- This post describes the results of a comprehensive global Internet scan for the command and control servers of FinFisher's surveillance software. It also details the discovery of a campaign using FinFisher in Ethiopia used to target individuals linked to an opposition group. --------------------------------------------- https://citizenlab.org/2013/03/you-only-click-twice-finfishers-global-proli… *** Online Security Tools (Malware, Sandboxes, Hash Checking, Cracking, DNSBL, SSL, BGP) *** --------------------------------------------- Some readers and friends convinced me recently to start posting some articles in english as well - to reach a wider audience. Lets start with a quick post containing a list of very useful online security tools. The services are very useful for incident responders, forensicators and security information practitioners. --------------------------------------------- http://sseguranca.blogspot.fr/2012/03/online-security-tools-malware-sandbox… *** Bugtraq: [SECURITY] [DSA 2646-1] typo3-src security update *** --------------------------------------------- [SECURITY] [DSA 2646-1] typo3-src security update --------------------------------------------- http://www.securityfocus.com/archive/1/526030 *** From Russia With Bots: Finding The Source Of Cyber Attacks *** --------------------------------------------- While media and government source continue to allude to China as the biggest source of cyber attacks hitting innocent servers on the Internet, recent evidence instead suggests it's the Russian Federation that's king of the cyber attack mountain. --------------------------------------------- http://readwrite.com/2013/03/18/from-russia-with-bots-finding-the-source-of…

1 0

Tageszusammenfassung - Freitag 15-03-2013
by Daily end-of-shift report 15 Mar '13

15 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 14-03-2013 18:00 − Freitag 15-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** Vulnerability Summary for the Week of March 4, 2013 *** --------------------------------------------- "The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains --------------------------------------------- http://www.us-cert.gov/ncas/bulletins/SB13-070 *** Debian Security Advisory DSA-2644 wireshark *** --------------------------------------------- several vulnerabilities --------------------------------------------- http://www.debian.org/security/2013/dsa-2644 *** Open-Xchange Server 6 - Multiple Vulnerabilities *** --------------------------------------------- Open-Xchange Server 6 - Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/24791 *** Mac OS X 10.8.3 steht bereit *** --------------------------------------------- Seit November testete Apple die nächste Version von Mountain Lion in Entwicklerkreisen schon, nun ist der Download für die Allgemeinheit verfügbar. Für Snow Leopard und Lion steht außerdem ein Sicherheitsupdate-Paket bereit. --------------------------------------------- http://www.heise.de/security/meldung/Mac-OS-X-10-8-3-steht-bereit-1823278.h… *** You've Been Hacked, But For How Long? *** --------------------------------------------- One of the big themes at the recent RSA Conference was awareness of threats already inside the network. The way you learn about these threats and lower your 'Mean Time To Know' (MTTW) about an intrusion is with profile-based network monitoring. --------------------------------------------- http://www.darkreading.com/blog/240150779/you-ve-been-hacked-but-for-how-lo… *** Security appliances are riddled with serious vulnerabilities, researcher says *** --------------------------------------------- The majority of email and Web gateways, firewalls, remote access servers, UTM (united threat management) systems and other security appliances have serious vulnerabilities, according to a security researcher who analyzed products from multiple vendors. --------------------------------------------- http://www.techworld.com.au/article/456433/security_appliances_riddled_seri… *** Trend Micro dupes wannabe hackers with honeypot scam *** --------------------------------------------- "Security firm Trend Micro has duped hackers into attacking fake industrial control systems (ICS), collecting invaluable data on their attack methods and goals and revealing surprising insights on the UKs hacking scene. The research was revealed at Blackhat Europe 2013 in Amsterdam on Friday and is the result of a collaborative project between Trend Micro and Scada security researcher Kyle Wilhoit. --------------------------------------------- http://www.v3.co.uk/v3-uk/news/2254867/trend-micro-dupes-wannabe-hackers-wi… *** UMTS-Sticks von Huawei gefährden Sicherheit der Nutzer *** --------------------------------------------- Ein russischer Hacker hat die Treiber-Software der UMTS-Sticks von Huawei untersucht. Ergebnis: zahlreiche Schwachstellen, die es Angreifern leicht machen, die Rechner der Stick-Nutzer zu infizieren. Auch eine massenhafte Infektion ist denkbar. --------------------------------------------- http://www.heise.de/security/meldung/UMTS-Sticks-von-Huawei-gefaehrden-Sich… *** Der Feind in meinem Dock *** --------------------------------------------- In Notebook-Docks von Dell ist noch viel Platz. Ein Sicherheitsforscher hat darin einen Mini-PC untergebracht, der Netzwerkverkehr, Audio- und Videosignale sowie USB-Datenverkehr des angedockten Notebooks ausspioniert. --------------------------------------------- http://www.heise.de/security/meldung/Der-Feind-in-meinem-Dock-1823723.html *** Highlights from BlackHat Europe 2013 in Amsterdam *** --------------------------------------------- Every year as Europe wakes up from the cold winter to the warm days of spring, BlackHat traditionally descends to Amsterdam. This year's conference is taking place on March 14-15 at the NH Grand Hotel Krasnapolsky, right Dam Square, the heart of Amsterdam. As spring doesn't necessarily equal warm days here in Europe right now, the 500 or so BlackHat participants hit the conference rooms to attend quite a few interesting talks. Here's a summary of the best talks at BlackHat Europe --------------------------------------------- http://www.securelist.com/en/blog/208194175/Highlights_from_BlackHat_Europe… *** TeamViewer authentication protocol *** --------------------------------------------- When a coworker recently gave me access to his system he recommended I use TeamViewer. TeamViewer is a free tool that is used to set up and use a VPN connection as well as allowing the user to remotely take control of another person's computer from their system. Given that it was my first time using this software, I decided to take a peek at the traffic. --------------------------------------------- http://blog.accuvantlabs.com/blog/bthomas/teamviewer-authentication-protocol *** Seagate blog compromised, leads to Blackhole and malware *** --------------------------------------------- A blog of well-known hard disk drive manufacturer Seagate has been compromised to contain malicious iFrame injections that redirect users to websites hosting the Blackhole exploit kit, warns Sophos. --------------------------------------------- http://www.net-security.org/malware_news.php?id=2440

1 0

Tageszusammenfassung - Donnerstag 14-03-2013
by Daily end-of-shift report 14 Mar '13

14 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-03-2013 18:00 − Donnerstag 14-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: Otmar Lendl *** Heimtückische Hintertür in TP-Link-Routern *** --------------------------------------------- Quasi auf Zuruf laden einige WLAN-Router eine ausführbare Datei aus dem Netz und führen die dann auch gleich mit Root-Rechten aus. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/298834fb/l/0L0Sheise0Bde0Csec… *** Kaspersky fixt IPv6-Problem der Internet Security Suite *** --------------------------------------------- Ein einziges, etwas seltsames IPv6-Paket genügt, um einen Windows-PC mit Kasperskys Firewall zum Stillstand zu bringen. Nach der Veröffentlichung des Problems will es der Hersteller jetzt beseitigen. --------------------------------------------- http://www.heise.de/security/meldung/Kaspersky-fixt-IPv6-Problem-der-Intern… *** Mobile Drive-By Malware example *** --------------------------------------------- "Several days ago we received a complaint about javascrpt. ru. After a bit of research, we found that it tries to mimic ajax...." --------------------------------------------- http://blog.avast.com/2013/03/11/mobile-drive-by-malware-example/ *** US national vulnerability database hacked *** --------------------------------------------- Malware infection forces government vuln catalog offline The US governments online catalog of cyber-vulnerabilities has been taken offline ironically, due to a software vulnerability. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/14/us_malware_… *** Encryption Trojan attacks Spain and France *** --------------------------------------------- March 13, 2013 Russian anti-virus company Doctor Web has registered an ongoing massive spread of the encryption malware Trojan.ArchiveLock across PCs outside Russia. The program, dubbed Trojan.ArchiveLock.20, is infecting increasingly more computers in France and Spain. Last August, Doctor Web issued a warning about Trojan.ArchiveLock encryption malware. This program uses the archiver WinRAR to encrypt files. To spread the malware, criminals mount a brute force attack via the RDP protocol on --------------------------------------------- http://news.drweb.com/show/?i=3379&lng=en&c=9 *** Drupal Node Parameter Control 6.x Access Bypass *** --------------------------------------------- Topic: Drupal Node Parameter Control 6.x Access Bypass Risk: High Text:View online: http://drupal.org/node/1942330 * Advisory ID: DRUPAL-SA-CONTRIB-2013-034 * Project: Node Parameter Control... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/D5fwYJPc7EI/WLB-20… *** Expert Finds Way to Retrieve Facebook Authentication Token and Hack Any Account *** --------------------------------------------- "Security researcher Nir Goldshlager has identified yet another Facebook OAuth vulnerability that can be exploited to hack any account. In the attack method he presented back in February, the expert used the app_id of the Facebook Messenger to gain full access to accounts. The social media company has addressed the issue by using regex protection, but Goldshlager has discovered another method to exploit the Facebook Messenger app_id...." --------------------------------------------- http://news.softpedia.com/news/Expert-Finds-Way-to-Retrieve-Facebook-Authen… *** Cyber-attack in the Czech Republic - Thieves in the night *** --------------------------------------------- "A MYSTERIOUS wave of cyber-attacks in the Czech Republicthe most extensive in the countrys historyon March 11th briefly disabled the web site for Unicredit, a bank. Other targets have included media, banks, mobile phone operators, the stock exchange and even the Czech National Bank. All but the Unicredit attack were so-called DDoS (distributed denial of service) attacks...." --------------------------------------------- http://www.economist.com/blogs/easternapproaches/2013/03/cyber-attack-czech… *** Check Point 2013 Security Report Released *** --------------------------------------------- "The Check Point company has just released its already well known Check Point 2013 Security Report series report. The Check point 2013 Security Report examines top security threats, risky web applications that compromise network security, and loss of data caused by employees unintentionally. Based on research of 900 companies and 120,000 hours of monitored traffic, Check Points research reveals startling details of real risks faced by enterprises including:64% infected with bots91% used --------------------------------------------- http://www.felipemartins.info/2013/03/check-point-2013-security-report-rele… *** Antiviren-Software AVG hielt Systemdatei für Trojaner *** --------------------------------------------- Eine fälschlicherweise als Malware identifizierte Windows-DLL bescherte einigen AVG-Nutzern einen unruhigen Vormittag. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/299137b5/l/0L0Sheise0Bde0Csec… *** Erneuter Krypto-Angriff auf SSL/TLS-Verschlüsselung *** --------------------------------------------- Der vorgestellte Angriff auf das häufig eingesetzte Verschlüsselungsverfahren RC4 ist zwar noch nicht wirklich praktikabel, erschüttert aber das Fundament für sichere Internet-Verbindungen. --------------------------------------------- http://www.heise.de/security/meldung/Erneuter-Krypto-Angriff-auf-SSL-TLS-Ve… *** Blog: Reminder: be careful opening invoices on the 21st March *** --------------------------------------------- On March 4th we spotted a large number of unusual emails being blocked by our Linux Mail Security product. The emails all contained the same PDF attachment but were being sent from many different source addresses. --------------------------------------------- http://www.securelist.com/en/blog/837/Reminder_be_careful_opening_invoices_… *** Microsoft continues to focus on security in their products *** --------------------------------------------- "86% of vulnerabilities discovered in the most popular 50 programs in 2012 were in non-Microsoft (or third-party) programs. The result was published today in the Secunia Vulnerability Review 2013 that analyzes the evolution of software vulnerabilities from a global, industry, enterprise, and endpoint perspective. The identified 86% represent an increase from 2011, when non-Microsoft programs represented 78% of vulnerabilities discovered in the Top 50 most popular programs...." --------------------------------------------- http://www.net-security.org/secworld.php?id=14595

1 0

Tageszusammenfassung - Mittwoch 13-03-2013
by Daily end-of-shift report 13 Mar '13

13 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-03-2013 18:00 − Mittwoch 13-03-2013 18:00 Handler: Stephan Richter Co-Handler: L. Aaron Kaplan *** MS13-026 - Important : Vulnerability in Office Outlook for Mac Could Allow Information Disclosure (2813682) - Version: 1.0 *** --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-026 *** MS13-003 - Important : Vulnerabilities in System Center Operations Manager Could Allow Elevation of Privilege (2748552) - Version: 2.0 *** --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-003 *** Flash: Unseren monatlichen Patch gib uns heute *** --------------------------------------------- Adobe veröffentlicht wieder Sicherheits-Updates für den Flash-Player, diesmal ausnahmsweise nicht außer der Reihe. Eine wesentliche Lücke bleibt dabei aber ungestopft. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/297e24e3/l/0L0Sheise0Bde0Csec… *** ASUS RT-N66U multiple vulns *** --------------------------------------------- Topic: ASUS RT-N66U multiple vulns Risk: Medium Text:Vulnerable product: ASUS RT-N66U Vulnerabilities: - Linux 2.6.22.19 - Old libraries and executables Interesting vulnerabili... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/o7EbpwGc_yk/WLB-20… *** Google rolls out initiative to help hacked sites *** --------------------------------------------- "With its new informational series, the Web giant aims to answer questions about why a site was hacked, what malware may have been used, and how to wipe the site clean of bugs. Its not pretty when a Web site gets a "this site may be compromised" or "this site may harm your computer" status note. Many webmasters and Web site owners can be at a loss of what to do in these situations...." --------------------------------------------- http://news.cnet.com/8301-1023_3-57573986-93/google-rolls-out-initiative-to… *** Security-Linux Kali tritt Nachfolge von BackTrack an *** --------------------------------------------- Mit einer neuen Tool-Auswahl und einem modernen Linux-Unterbau lässt Kali die Altlasten von BackTrack hinter sich. Die Distribution für Pentester, Admins und Forensiker steht ab sofort zum Download bereit. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2983f19a/l/0L0Sheise0Bde0Csec… *** Security agency tells Europe to find alternative to risky email *** --------------------------------------------- "European governments and businesses should investigate alternative communication channels to e-mail in the longer term after a string of alarming attacks, the EUs cyber security agency warned today (13 March) in a special alert. The European Network and Information Security Agency (ENISA) issued the so-called Flash Note in the wake of recent major cyber-attacks, calling for Europes businesses and governments to take urgent action to combat emerging cyber-attack trends. The report cites... --------------------------------------------- http://www.euractiv.com/infosociety/security-agency-tells-europe-fin-news-5… *** Exploit Kit Distribution in the Wild *** --------------------------------------------- Have you ever wondered which exploit kits are the most prevalent?We have been tracking several exploit kits that we have identified these past few months and its interesting to see which gets the biggest chunk of the pie:56% of the coverage is owned by only three exploit kits: Blackhole, Sweet Orange, and Cool.Blackhole, a kit that has been around for almost three years, is still keeping a strong presence at no. 1 with 27% of the exploit kit coverage. Followed by Sweet Orange with 18% and Cool... --------------------------------------------- http://www.f-secure.com/weblog/archives/00002522.html *** (IN)SECURE Magazine Issue 37 released *** --------------------------------------------- "IN)SECURE Magazine is a freely available digital security magazine discussing some of the hottest information security topics. Issue #37 has just been released - download the magazine! The articles in this issue include:Becoming a malware analystReview: Nipper StudioFive questions for Microsofts Chief Privacy OfficerApplication security testing for AJAX and JSONPenetrating and achieving persistence in highly secured networksReport: RSA Conference 2013Social engineering: An underestimated... --------------------------------------------- http://www.net-security.org/insecuremag.php *** Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1, (Wed, Mar 13th) *** --------------------------------------------- At Shmoocon 2013 Jake Williams (@MalwareJake) and I gave a presentation entitled Wipe the Drive. The point of the presentation was that you should always wipe the drive and reinstall the OS after a confirmed malware infection. We all know wiping the drive is the safest move but there are business pressures to simply remove the known malware and move on. Also, because we are security professionals there is often an expectation that we are able to remove all the malware. But, in my and Jakes... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15394&rss *** Bugtraq: Open-Xchange Security Advisory 2013-03-13 *** --------------------------------------------- http://www.securityfocus.com/archive/1/525979 *** Bugtraq: SEC Consult SA-20130313-0 :: QlikView Desktop Client Integer Overflow *** --------------------------------------------- http://www.securityfocus.com/archive/1/525980 *** Issue with SWFUploader Could Lead to XSS Vulnerabilities, Content Spoofing *** --------------------------------------------- Many versions of SWFUpload – an applet that combines Flash and JavaScript that’s used in millions of websites, including WordPress sites– are vulnerable to content spoofing and a cross-site scripting vulnerability that could lead to the takeover of accounts, according to reports this week. --------------------------------------------- https://threatpost.com/en_us/blogs/issue-swfuploader-could-lead-xss-vulnera…

1 0

Tageszusammenfassung - Dienstag 12-03-2013
by Daily end-of-shift report 12 Mar '13

12 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 11-03-2013 18:00 − Dienstag 12-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: Christian Wojner *** Improving the security for Android embedded systems *** --------------------------------------------- "McAfee has delivered a whitelisting security solution for Android based embedded systems. McAfee Application Control for Android resides in the Android kernel, embedded in the operating system and provides protection from the installation or execution of a malicious application on an Android-based device. McAfee also provides protection at the application layer to Android devices...." --------------------------------------------- http://www.net-security.org/secworld.php?id=14574 *** Blacklist NJABL geht außer Betrieb *** --------------------------------------------- Die Anti-Spam-Blacklist NJABL hat ihre Datenbasis bereits ausgeblendet. Verantwortlichen von Mailservern, die sie dennoch weiterhin abfragen, droht Ungemach, sobald der Hoster auch die Namensdienst-Einträge abklemmt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2971dffa/l/0L0Sheise0Bde0Csec… *** Australien: Hackerangriffe auf die Zentralbank *** --------------------------------------------- Australische Medien berichten von Hackerangriffen auf die Zentralbank des Landes und sprechen dabei von Spuren nach China und kompromittierten Informationen. Die Zentralbank bestätigt, dass es Cyberattacken gab, sonst nichts. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2971ee42/l/0L0Sheise0Bde0Csec… *** Google Docs CSRF & Clickjacking *** --------------------------------------------- Topic: Google Docs CSRF & Clickjacking Risk: Medium Text:CSRF & Clickjacking : Google Document, Drawing, Forms, Spreadsheet, Presentation Attacker can create Google Document, Dra... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/K1SfuqKrTTM/WLB-20… *** Vuln: Piwik Unspecified Cross Site Scripting Vulnerability *** --------------------------------------------- Piwik Unspecified Cross Site Scripting Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/58392 *** TinyMCE XSS Vulnerability *** --------------------------------------------- Topic: TinyMCE XSS Vulnerability Risk: Low Text:Vulnerability Report Author: Justin C. Klein Keane Date: 5 March, 2013 CVE-2012-4230 Descrip... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/vAEUomxc8S8/WLB-20… *** Windows 8: Flash als Standard *** --------------------------------------------- Der Internet Explorer unter Windows 8 und RT soll wesentlich mehr Flash-Inhalte per default zulassen. Damit rückt der Software-Hersteller noch weiter von seiner bisherigen Linie bei der Flash-Unterstützung ab. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2977bea5/l/0L0Sheise0Bde0Csec… *** Chess CAPTCHA - a serious defence against spammers? *** --------------------------------------------- "CAPTCHAs - the questions that a website asks you to answer to prove if youre a human being or not - come in many shapes and forms. Although they most commonly ask you to decipher some words hidden in a distorted graphic, there are more elaborate versions which can ask you to solve some complicated mathematical calculation or ask you to add toppings to a pizza in an attempt to stop automated bots leaving spammy messages...." --------------------------------------------- http://nakedsecurity.sophos.com/2013/03/12/chess-captcha/ *** Phishing emails sent in pairs to lend authenticity, says training company *** --------------------------------------------- "Phishing emails are now being deployed in pairs to create the illusion of authenticity, says security awareness training firm PhishMe. Phishing emails try to trick the recipient into doing something risky by disguising malicious attachments or links in seemingly genuine content. In this new type of phishing email campaign, attackers typically send out a benign email that contains nothing harmful and does not ask for any information or response from the recipient...." --------------------------------------------- http://www.computerweekly.com/news/2240179364/Phishing-emails-sent-in-pairs… *** Google Play: Potentially Unwanted *** --------------------------------------------- Google Play has a problem and it isnt malware.Depending on location, Potentially Unwanted Applications (PUA) can be rather difficult to avoid.Heres a screenshot of User Reviews from a "weather widget" application:In English (both U.S. and U.K.), there are eight user reviews. Just eight. Even if you click on a link to "Read All User Reviews".But if you use the Danish UI this is one additional review youll see:And its good that Danes can see it, because the --------------------------------------------- http://www.f-secure.com/weblog/archives/00002521.html

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily