Daily

daily@lists.cert.at

1 participants
3150 discussions

Tageszusammenfassung - 07.02.2025
by Daily end-of-shift report 07 Feb '25

07 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 06-02-2025 18:00 − Freitag 07-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ DeepSeek Phishing Sites Pursue User Data, Crypto Wallets ∗∗∗ --------------------------------------------- Riding the wave of notoriety from the Chinese companys R1 AT chatbot, attackers are spinning up lookalike sites for different malicious use cases. --------------------------------------------- https://www.darkreading.com/cyber-risk/deepseek-phishing-sites-pursue-user-… ∗∗∗ Ohne Nutzerinteraktion: Kritische Outlook-Lücke wird aktiv ausgenutzt ∗∗∗ --------------------------------------------- Die Sicherheitslücke ermöglicht es Angreifern, durch per E-Mail verschickte und speziell gestaltete Hyperlinks Schadcode auszuführen. --------------------------------------------- https://www.golem.de/news/ohne-nutzerinteraktion-kritische-outlook-luecke-w… ∗∗∗ SSL 2.0 turns 30 this Sunday... Perhaps the time has come to let it die? ∗∗∗ --------------------------------------------- The SSL 2.0 protocol was originally published back in February of 1995[1], and although it was quickly found to have significant security weaknesses, and a more secure alternative was released only a year later, it still received a fairly wide adoption. --------------------------------------------- https://isc.sans.edu/diary/SSL+20+turns+30+this+Sunday+Perhaps+the+time+has… ∗∗∗ Screenshot-Reading Malware ∗∗∗ --------------------------------------------- Kaspersky is reporting on a new type of smartphone malware.The malware in question uses optical character recognition (OCR) to review a device’s photo library, seeking screenshots of recovery phrases for crypto wallets. Based on their assessment, infected Google Play apps have been downloaded more than 242,000 times. Kaspersky .. --------------------------------------------- https://www.schneier.com/blog/archives/2025/02/screenshot-reading-malware.h… ∗∗∗ Britische Regierung erzwingt Zugriff auf Apples verschlüsselte Cloud-Daten ∗∗∗ --------------------------------------------- Der Investigatory Powers Act wurde von Apple bereits öffentlich kritisiert. Nun hätten britische Sicherheitsbehörden gerne Zugriff auf Daten aller iCloud-User. --------------------------------------------- https://www.heise.de/news/Britische-Regierung-erzwingt-Zugriff-auf-Apples-v… ∗∗∗ BSI-Analyse von Nextcloud: Zwei-Faktor-Authentifizierung war angreifbar ∗∗∗ --------------------------------------------- Eine Codeanalyse des BSI förderte Schwachstellen in Nextcloud Server zutage. Unter anderem ließ sich die Zwei-Faktor-Authentifizierung umgehen. --------------------------------------------- https://www.heise.de/news/BSI-Analyse-von-Nextcloud-Zwei-Faktor-Authentifiz… ∗∗∗ 20 Million OpenAI accounts offered for sale ∗∗∗ --------------------------------------------- A cybercriminal calling themselves emirking is offering 20 million OpenAI accounts for sale on a Dark Web forum --------------------------------------------- https://www.malwarebytes.com/blog/news/2025/02/20-million-openai-accounts-o… ∗∗∗ ICS testing best results. Hint: Blend your approach ∗∗∗ --------------------------------------------- TL;DR Onsite ICS testing is risk averse Laboratory ICS device testing uncovers more A blended approach is key How that works Demonstrable benefits Introduction For safety’s sake onsite ICS .. --------------------------------------------- https://www.pentestpartners.com/security-blog/ics-testing-best-results-hint… ∗∗∗ US-Abgeordnete wollen Deepseek verbieten, Sicherheitsforscher warnen vor App ∗∗∗ --------------------------------------------- Parteienübergreifender Antrag will Nutzung auf Regierungsgeräten untersagen. Forscher fällen vernichtendes Urteil zur Sicherheit und finden problematische Datenübertragungen an mehrere chinesische Firmen --------------------------------------------- https://www.derstandard.at/story/3000000256396/us-abgeordnete-wollen-deepse… ∗∗∗ Vier italienische Aktivisten für Seerettung im Visier von Paragon-Spyware-Attacke ∗∗∗ --------------------------------------------- Vizepremier Salvini will in Israel Informationen über den Fall sammeln. Der Angriff erfolgte über Sicherheitslücke in Whatsapp --------------------------------------------- https://www.derstandard.at/story/3000000256452/vier-italienische-aktivisten… ∗∗∗ Chinese-Speaking Group Manipulates SEO with BadIIS ∗∗∗ --------------------------------------------- This blog post details our analysis of an SEO manipulation campaign targeting Asia. We also share recommendations that can help enterprises proactively secure their environment. --------------------------------------------- https://www.trendmicro.com/en_us/research/25/b/chinese-speaking-group-manip… ∗∗∗ Urteil: TLS-Verschlüsselung bei E-Mail-Rechnungen an Privatkunden zu wenig? ∗∗∗ --------------------------------------------- Der Fall einer per E-Mail geschickten Privatkunden-Rechnung, die von Kriminellen manipuliert wurde, wanderte vor Gericht. Der Knackpunkt: die Verschlüsselung. --------------------------------------------- https://heise.de/-10274040 ∗∗∗ Taiwan’s DeepSeek Ban Reflects Global Concerns Over AI Security ∗∗∗ --------------------------------------------- The Taiwan government’s recent decision to implement a ban on the use of the DeepSeek artificial intelligence chatbot within its public sector has drawn significant attention to the growing global concerns regarding .. --------------------------------------------- https://thecyberexpress.com/taiwans-deepseek-ban/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (openjdk-17), Fedora (firefox, FlightGear, java-1.8.0-openjdk, java-11-openjdk, java-latest-openjdk, and SimGear), Mageia (gstreamer), Red Hat (firefox, kernel, kernel-rt, libsoup, and python-jinja2), SUSE (bind, curl, dcmtk, etcd, firefox, google-osconfig-agent, krb5, openssl-1_1, podman, python311-cbor2, thunderbird, wget, and xrdp), and Ubuntu (glibc). --------------------------------------------- https://lwn.net/Articles/1008502/ ∗∗∗ [R2] Tenable Identity Exposure Version 3.77.8 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2025-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.02.2025
by Daily end-of-shift report 06 Feb '25

06 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 05-02-2025 18:00 − Donnerstag 06-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Ransomware payments declined in 2024 despite massive well-known hacks ∗∗∗ --------------------------------------------- Amount paid by victims to hackers declined by hundreds of millions of dollars. --------------------------------------------- https://arstechnica.com/security/2025/02/ransomware-payments-declined-in-20… ∗∗∗ Cisco Anyconnect: Hacker klonen Webseite der TU Dresden und verbreiten Malware ∗∗∗ --------------------------------------------- Mutmaßlich russische Angreifer wollten Nutzern von Cisco Anyconnect eine Malware unterjubeln. Mit einem Trick sollte die Masche unentdeckt bleiben. --------------------------------------------- https://www.golem.de/news/cisco-anyconnect-hacker-klonen-webseite-der-tu-dr… ∗∗∗ Scalable Vector Graphics files pose a novel phishing threat ∗∗∗ --------------------------------------------- The SVG file format can harbor malicious HTML, scripts, and malware --------------------------------------------- https://news.sophos.com/en-us/2025/02/05/svg-phishing/ ∗∗∗ Cisco stopft Sicherheitslücken in mehreren Produkten – auch kritische ∗∗∗ --------------------------------------------- In mehreren Produkten hat Cisco Sicherheitslücken entdeckt und warnt in Sicherheitsmitteilungen davor. Updates stehen bereit. --------------------------------------------- https://www.heise.de/news/Cisco-stopft-Sicherheitsluecken-in-mehreren-Produ… ∗∗∗ Thailand cuts power supply to Myanmar scam hubs ∗∗∗ --------------------------------------------- "It’s time to take decisive action,” Prime Minister Paethongthan Shinawatra said about Thailands move to cut off electricity from scam compounds in Myanmar border areas. --------------------------------------------- https://therecord.media/thailand-cuts-power-scam-compounds-myanmar ∗∗∗ U.S. Government Disclosed 39 Zero-Day Vulnerabilities in 2023, Per First-Ever Report ∗∗∗ --------------------------------------------- The number of zero-day vulnerabilities the government disclosed to vendors to be fixed, rather than keep them secret to exploit, comes out to about three a month. But the figure could rise dramatically under the Trump .. --------------------------------------------- https://www.zetter-zeroday.com/u-s-government-disclosed-39-zero-day-vulnera… ∗∗∗ Network security fundamentals ∗∗∗ --------------------------------------------- How to design, use, and maintain secure networks. --------------------------------------------- https://www.ncsc.gov.uk/guidance/network-security-fundamentals ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (asterisk and chromium), Fedora (FlightGear, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, java-latest-openjdk, and SimGear), Mageia (bind, chromium-browser-stable, python-django, and vim), Oracle (buildah, bzip2, firefox, keepalived, mariadb:10.11, and podman), Slackware (curl, mariadb, and mozilla), SUSE (cargo-audit-advisory-db-20250204 and python311-scikit-learn), and Ubuntu (ckeditor, krb5, and ruby2.7). --------------------------------------------- https://lwn.net/Articles/1008275/ ∗∗∗ OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-013 ∗∗∗ 2025-02-06: Cyber Security Advisory - Hard-coded credentials in ASPECT Energy Management System ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A6775&Lan… ∗∗∗ CISA Releases Six Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/02/06/cisa-releases-six-indust… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.02.2025
by Daily end-of-shift report 05 Feb '25

05 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 04-02-2025 18:00 − Mittwoch 05-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Kosteneinsparungen: Lets Encrypt stellt Ablaufwarnungen für Zertifikate ein ∗∗∗ --------------------------------------------- Ab Juni erinnert Lets Encrypt nicht mehr an ablaufende Zertifikate. Administratoren wird empfohlen, auf alternative Dienste umzusteigen. --------------------------------------------- https://www.golem.de/news/kosteneinsparungen-let-s-encrypt-stellt-ablaufwar… ∗∗∗ Netgear fixes critical bugs as Five Eyes warn about break-ins at the edge ∗∗∗ --------------------------------------------- International security squads all focus on stopping baddies busting in through routers, IoT kit etc Netgear is advising customers to upgrade their firmware after it patched two critical vulnerabilities affecting multiple routers. --------------------------------------------- https://www.theregister.com/2025/02/05/netgear_fixes_critical_bugs_while/ ∗∗∗ In eigener Sache, wir stellen ein: System-Administrator:in (m/w/d - Vollzeit - Wien) ∗∗∗ --------------------------------------------- Für die Betreuung unserer Informations- und Kommunikationstechnik suchen wir eine/n System-Administrator:in mit Fachwissen im Bereich IT- und Netzwerk-Security. --------------------------------------------- https://www.cert.at/de/ueber-uns/jobs/ ∗∗∗ 7-Zip: Mark-of-the-Web-Lücke wurde von Angreifern missbraucht ∗∗∗ --------------------------------------------- Die kürzlich gemeldete Mark-of-the-Web-Schwachstelle in 7-Zip wurde von Angreifern in freier Wildbahn für Schadcode-Schmuggel missbraucht. --------------------------------------------- https://www.heise.de/news/7-Zip-Mark-of-the-Web-Luecke-wurde-von-Angreifern… ∗∗∗ Support ausgelaufen: Keine Sicherheitsupdates mehr für attackierte Zyxel-Router ∗∗∗ --------------------------------------------- Derzeit hat es eine Mirai-Botnet-Malware auf bestimmte Routermodelle von Zyxel abgesehen. Weil der Support ausgelaufen ist, müssen Admins jetzt handeln. --------------------------------------------- https://www.heise.de/news/Support-ausgelaufen-Keine-Sicherheitsupdates-mehr… ∗∗∗ Who’s Behind the Seized Forums ‘Cracked’ & ‘Nulled’? ∗∗∗ --------------------------------------------- The FBI joined authorities across Europe last week in seizing domain names for Cracked and Nulled, English-language cybercrime forums with millions of users that trafficked in stolen data, hacking tools and malware. An investigation into the history of these communities shows their apparent co-founders quite openly operate an Internet .. --------------------------------------------- https://krebsonsecurity.com/2025/02/whos-behind-the-seized-forums-cracked-n… ∗∗∗ Secure sanitisation and disposal of storage media ∗∗∗ --------------------------------------------- How to ensure data cannot be recovered from electronic storage media. --------------------------------------------- https://www.ncsc.gov.uk/guidance/secure-sanitisation-storage-media ∗∗∗ Hackers Using Fake Microsoft ADFS Login Pages to Steal Credentials ∗∗∗ --------------------------------------------- A global phishing campaign is actively exploiting a legacy Microsoft authentication system to steal user credentials and bypass multi-factor authentication (MFA), targeting over 150 organizations. --------------------------------------------- https://hackread.com/hackers-fake-microsoft-adfs-login-pages-steal-credenti… ∗∗∗ Banking Malware Uses Live Numbers to Hijack OTPs, Targeting 50,000 Victims ∗∗∗ --------------------------------------------- A banking malware campaign using live phone numbers to redirect SMS messages has been identified by the zLabs research team, uncovering 1,000+ malicious apps and 2.5GB of exposed data. --------------------------------------------- https://hackread.com/banking-malware-live-numbers-hijack-otp-50000-victims/ ∗∗∗ Preventing account takeover on centralized cryptocurrency exchanges in 2025 ∗∗∗ --------------------------------------------- This blog post highlights key points from our new white paper Preventing Account Takeovers on Centralized Cryptocurrency Exchanges, which documents ATO-related attack vectors and defenses tailored to CEXes. --------------------------------------------- https://blog.trailofbits.com/2025/02/05/preventing-account-takeover-on-cent… ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple vulnerabilities in Defense Platform Home Edition ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN66673020/ ∗∗∗ Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Secure Web Appliance Range Request Bypass Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS, IOS XE, and IOS XR Software SNMP Denial of Service Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Identity Services Engine Insecure Java Deserialization and Authorization Bypass Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Expressway Series Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Secure Email and Web Manager and Secure Email Gateway Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance SNMP Polling Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.02.2025
by Daily end-of-shift report 04 Feb '25

04 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Montag 03-02-2025 18:00 − Dienstag 04-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ 7-Zip MotW bypass exploited in zero-day attacks against Ukraine ∗∗∗ --------------------------------------------- A 7-Zip vulnerability allowing attackers to bypass the Mark of the Web (MotW) Windows security feature was exploited by Russian hackers as a zero-day since September 2024. --------------------------------------------- https://www.bleepingcomputer.com/news/security/7-zip-motw-bypass-exploited-… ∗∗∗ Beyond the Chatbot: Meta Phishing with Fake Live Support ∗∗∗ --------------------------------------------- In a previous Trustwave SpiderLabs’ blog, we explored how cybercriminals exploit Facebook Messenger chatbots to execute social engineering attacks, deceiving users into falling victim to scams and phishing schemes. These attacks .. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/beyond-the-… ∗∗∗ Meet the Hired Guns Who Make Sure School Cyberattacks Stay Hidden ∗∗∗ --------------------------------------------- An investigation into more than 300 cyberattacks against US K–12 schools over the past five years shows how schools can withhold crucial details from students and parents whose data was stolen. --------------------------------------------- https://www.wired.com/story/meet-the-hired-guns-who-make-sure-school-cybera… ∗∗∗ Lets Encrypt: 6-Tage-Zertifikate, keine Ablauf-Nachrichten zu Zertifikaten mehr ∗∗∗ --------------------------------------------- Lets Encrypt sieht einige Änderungen vor: Zertifikate mit sechs Tagen Laufzeit kommen neu hinzu. Zertifikat-Ablauf-Nachrichten fallen weg. --------------------------------------------- https://www.heise.de/news/Let-s-Encrypt-Ende-von-Zertifikat-Ablauf-Nachrich… ∗∗∗ A tale of enumeration, and why pen testing can’t be automated ∗∗∗ --------------------------------------------- TL;DR In an engagement we found an open directory on the internet belonging to our client By enumerating it we found a zip archive with a configuration file holding usernames .. --------------------------------------------- https://www.pentestpartners.com/security-blog/a-tale-of-enumeration-and-why… ∗∗∗ Practice being punched in the face. The realities of incident response preparation ∗∗∗ --------------------------------------------- “Everyone has a plan until they get punched in the face.” This Mike Tyson boxing quote perfectly encapsulates the chaos of a cybersecurity breach. TL;DR Accept that your organisation may .. --------------------------------------------- https://www.pentestpartners.com/security-blog/practice-being-punched-in-the… ∗∗∗ Neue Masche mit gefälschtem Post-Käuferschutz bei Kleinanzeigen ∗∗∗ --------------------------------------------- Kriminelle geben sich auf Kleinanzeigenplattformen als Kaufinteressierte aus und täuschen vor, Ihr Produkt über den Post Käuferschutz bezahlen zu wollen. Sie locken Sie auf eine gefälschte Zahlungsplattform, wo Sie Ihre Kreditkartendaten eingeben sollen, um die Zahlung zu bestätigen. Tatsächlich geben Sie aber eine Zahlung frei und .. --------------------------------------------- https://www.watchlist-internet.at/news/neue-masche-mit-gefaelschtem-post-ka… ∗∗∗ Stealers on the Rise: A Closer Look at a Growing macOS Threat ∗∗∗ --------------------------------------------- Atomic Stealer, Poseidon Stealer and Cthulhu Stealer target macOS. We discuss their various properties and examine leverage of the AppleScript framework. --------------------------------------------- https://unit42.paloaltonetworks.com/macos-stealers-growing/ ∗∗∗ Law Enforcement disrupts Major Spam Delivery Service ∗∗∗ --------------------------------------------- “The Saim Raza-run websites operated as marketplaces that advertised and facilitated the sale of tools such as phishing kits, scam pages and email extractors often .. --------------------------------------------- https://www.truesec.com/hub/blog/law-enforcement-disrupts-major-spam-delive… ∗∗∗ Hackers Hide Malware in Fake DeepSeek PyPI Packages ∗∗∗ --------------------------------------------- Malicious DeepSeek packages on PyPI spread malware, stealing sensitive data like API keys. Learn how this attack targeted developers and how to protect yourself. --------------------------------------------- https://hackread.com/hackers-hide-malware-fake-deepseek-pypi-packages/ ∗∗∗ CVE-2023-6080: A Case Study on Third-Party Installer Abuse ∗∗∗ --------------------------------------------- Mandiant exploited flaws in the Microsoft Software Installer (MSI) repair action of Lakeside Softwares SysTrack installer to obtain arbitrary code execution. An attacker with low-privilege access to a system running the vulnerable version of SysTrack .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/cve-2023-6080-thir… ∗∗∗ CISA Partners with ASD’s ACSC, CCCS, NCSC-UK, and Other International and US Organizations to Release Guidance on Edge Devices ∗∗∗ --------------------------------------------- CISA—in partnership with international and U.S. organizations—released guidance to help organizations protect their network edge devices and appliances, such as firewalls, routers, virtual private networks (VPN) gateways, Internet of Things (IoT) devices, internet-facing servers, and internet-facing operational technology (OT) .. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/02/04/cisa-partners-asds-acsc-… ∗∗∗ 8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur ∗∗∗ --------------------------------------------- Surprise surprise, weve done it again. Weve demonstrated an ability to compromise significantly sensitive networks, including governments, militaries, space agencies, cyber security companies, .. --------------------------------------------- https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-… ∗∗∗ Go Supply Chain Attack: Malicious Package Exploits Go Module Proxy Caching for Persistence ∗∗∗ --------------------------------------------- Socket researchers have discovered a malicious typosquat package in the Go ecosystem, impersonating the widely used BoltDB database module (github.com/boltdb/bolt), a tool trusted by many organizations including Shopify and Heroku. The BoltDB package is widely adopted within the Go ecosystem, with 8,367 other packages depending on it. Its extensive .. --------------------------------------------- https://socket.dev/blog/malicious-package-exploits-go-module-proxy-caching-… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (openjdk-17), Fedora (chromium, fastd, ovn, and yq), Mageia (libxml2 and redis), Oracle (gstreamer1-plugins-base, gstreamer1-plugins-good), Red Hat (buildah, bzip2, galera, mariadb, grafana, keepalived, libsoup, mariadb:10.11, mariadb:10.5, mingw-glib2, podman, python-jinja2, and rsync), SUSE (bind, ignition, .. --------------------------------------------- https://lwn.net/Articles/1007886/ ∗∗∗ Synology-SA-25:01 DSM (PWN2OWN 2024) ∗∗∗ --------------------------------------------- A vulnerability allows man-in-the-middle attackers to hijack the authentication of administrators.The vulnerability reported by PWN2OWN 2024 (ZDI-CAN-25487) has been addressed. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_25_01 ∗∗∗ CISA Releases Nine Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- CISA released nine Industrial Control Systems (ICS) advisories on February 4, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.ICSA-25-035-01 Western Telematic Inc NPS Series, DSM Series, CPM SeriesICSA-25-035-02 Rockwell Automation 1756-L8zS3 and 1756-L3 and 1756-L3ICSA-25-035-03 .. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/02/04/cisa-releases-nine-indus… ∗∗∗ Security Vulnerabilities fixed in Thunderbird 135 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-11/ ∗∗∗ Security Vulnerabilities fixed in Thunderbird ESR 128.7 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-10/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 128.7 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-09/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 115.20 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-08/ ∗∗∗ Security Vulnerabilities fixed in Firefox 135 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-07/ ∗∗∗ Zyxel security advisory for command injection and insecure default credentials vulnerabilities in certain legacy DSL CPE ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.02.2025
by Daily end-of-shift report 03 Feb '25

03 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 31-01-2025 18:00 − Montag 03-02-2025 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ DeepSeek AI tools impersonated by infostealer malware on PyPI ∗∗∗ --------------------------------------------- Threat actors are taking advantage of the rise in popularity of the DeepSeek to promote two malicious infostealer packages on the Python Package Index (PyPI), where they impersonated developer tools for the AI platform. --------------------------------------------- https://www.bleepingcomputer.com/news/security/deepseek-ai-tools-impersonat… ∗∗∗ DeepSeek’s Safety Guardrails Failed Every Test Researchers Threw at Its AI Chatbot ∗∗∗ --------------------------------------------- Security researchers tested 50 well-known jailbreaks against DeepSeek’s popular new AI chatbot. It didn’t stop a single one. --------------------------------------------- https://www.wired.com/story/deepseeks-ai-jailbreak-prompt-injection-attacks/ ∗∗∗ What Cybersecurity Can Teach Us About the Human Body ∗∗∗ --------------------------------------------- Understanding cybersecurity can sometimes feel like steering a maze of technical terms and complex systems. But a recent infographic shared by @yanabantai on X (formerly Twitter) has made it simpler, offering a fresh perspective by comparing cybersecurity to the human body. --------------------------------------------- https://thecyberexpress.com/cybersecurity-about-the-human-body/ ∗∗∗ Erstmals leicht sinkende Tendenz bei Anzeigen zur Cyberkriminalität ∗∗∗ --------------------------------------------- Wenn in den nächsten Wochen die Kriminalstatistik veröffentlicht wird, ist von einer Trendumkehr bei Cybercrime auszugehen. Erstmals wird es in diesem Bereich einen leichten Rückgang bei den Anzeigen 2024 im Vergleich zu 2023 geben. --------------------------------------------- https://www.derstandard.at/story/3000000255493/erstmals-leicht-sinkende-ten… ∗∗∗ Phishing-Fallen: Wiener Polizei sucht Täter mittels Fahndungsfotos ∗∗∗ --------------------------------------------- Mit einer SMS und gefälschten Banken-Website wurden mehrere Menschen in Österreich in die Falle gelockt und bestohlen. [..] Mit Bildern aus Überwachungskameras jener Bankautomaten, wo Geld von den Opfern behoben wurde, wird nun nach den Verdächtigen gesucht. Die Fotos sind auf der Website der Polizei zu sehen. --------------------------------------------- https://futurezone.at/digital-life/phishing-wien-polizei-oesterreich-foto-b… ∗∗∗ Hacker nutzen Google Gemini für Cyber-Angriffe ∗∗∗ --------------------------------------------- Kriminelle nutzen Googles Künstliche Intelligenz Gemini für Cyberangriffe, Phishing und Spionage. [..] Die Hacker nutzen Gemini derzeit zwar nicht, um neue kriminelle Methoden ausfindig zu machen, aber um bestehende zu verbessern. --------------------------------------------- https://futurezone.at/digital-life/google-gemini-hacker-cyber-angriffe-iran… ∗∗∗ 1-Click Phishing Campaign Targets High-Profile X Accounts ∗∗∗ --------------------------------------------- In an attack vector thats been used before, threat actors aim to commit crypto fraud by hijacking highly followed users, thus reaching a broad audience of secondary victims. --------------------------------------------- https://www.darkreading.com/endpoint-security/one-click-phishing-campaign-h… ∗∗∗ Journalists and Civil Society Members Using WhatsApp Targeted by Paragon Spyware ∗∗∗ --------------------------------------------- This is yet another story of commercial spyware being used against journalists and civil society members. The journalists and other civil society members were being alerted of a possible breach of their devices, with WhatsApp telling the Guardian it had “high confidence” that the 90 users in question had been targeted and “possibly compromised. --------------------------------------------- https://www.schneier.com/blog/archives/2025/02/journalists-and-civil-societ… ∗∗∗ Further Adventures With CMPivot — Client Coercion ∗∗∗ --------------------------------------------- CMPivot queries can be used to coerce SMB authentication from SCCM client hosts. --------------------------------------------- https://posts.specterops.io/further-adventures-with-cmpivot-client-coercion… ∗∗∗ CVE-2023-6080: A Case Study on Third-Party Installer Abuse ∗∗∗ --------------------------------------------- Mandiant exploited flaws in the Microsoft Software Installer (MSI) repair action of Lakeside Softwares SysTrack installer to obtain arbitrary code execution. An attacker with low-privilege access to a system running the vulnerable version of SysTrack could escalate privileges locally. [..] August 7, 2024 - Confirmed vulnerability fixed in version 11.0 --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/cve-2023-6080-thir… ∗∗∗ OPA Gatekeeper Bypass Reveals Risks in Kubernetes Policy Engines ∗∗∗ --------------------------------------------- Implementing Kubernetes securely can be a daunting task. Fortunately, there are tools in the K8s toolshed that provide out-of-the-box solutions using a single click. One such tools is OPA Gatekeeper. It is a great out-of-the-box security checkpoint to enforce security policies on Kubernetes. But are users using it correctly? Do they understand its limitations? Our new research says not necessarily! --------------------------------------------- https://blog.aquasec.com/opa-gatekeeper-bypass-reveals-risks-in-kubernetes-… ∗∗∗ Stronger Than Ever: How We Turned a DDoS Attack Into a Lesson in Resilience ∗∗∗ --------------------------------------------- We were subjected to several attempted DDoS attacks, and the first cohort didn't even raise an alarm, but on the 23rd Jan, we noticed the first impact. [..] Maybe you and your organisation will face a similar issue in the future and you can be more aware of the ransom scam, maybe the lessons we learned here are something you can use to avoid similar issues of your own in the future, or maybe this blog post was just an interesting read for you. --------------------------------------------- https://scotthelme.ghost.io/stronger-than-ever-how-we-turned-a-ddos-attack-… ∗∗∗ Vulnerability & Patch Roundup — January 2025 ∗∗∗ --------------------------------------------- Vulnerability reports and responsible disclosures are essential for website security awareness and education. --------------------------------------------- https://blog.sucuri.net/2025/01/vulnerability-patch-roundup-january-2025.ht… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdates: Zahlreiche Lücken gefährden Backup-Appliances von Dell ∗∗∗ --------------------------------------------- Admins, die Backups mit Dells PowerProtect managen, sollten aus Sicherheitsgründen aktuelle Versionen von Data Domain Operating System (DD OS) installieren. Geschieht das nicht, können Angreifer Systeme vollständig kompromittieren. --------------------------------------------- https://www.heise.de/-10267578 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (git-lfs, libsoup, and unbound), Debian (dcmtk, ffmpeg, openjdk-11, pam-u2f, and python-aiohttp), Fedora (buku, chromium, jpegxl, nodejs18, nodejs20, and rust-routinator), Mageia (clamav, kernel, kmod-virtualbox, kmod-xtables-addons & dwarves, and kernel-linus), SUSE (apptainer, bind, buildah, chromedriver, clamav, dovecot24, ignition, kubelogin, libjxl, libQt5Bluetooth5-32bit, orc, owasp-modsecurity-crs, python-pydantic, python311-ipython, and stb), and Ubuntu (linux-azure and netdata). --------------------------------------------- https://lwn.net/Articles/1007646/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 31.01.2025
by Daily end-of-shift report 31 Jan '25

31 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 30-01-2025 18:00 − Freitag 31-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Windows Exploitation Tricks: Trapping Virtual Memory Access (2025 Update) ∗∗∗ --------------------------------------------- Back in 2021 I wrote a blog post about various ways you can build a virtual memory access trap primitive on Windows. The goal was to cause a reader or writer of a virtual memory address to halt for a significant (e.g. 1 or more seconds) amount of time, generally for the purpose of exploiting TOCTOU memory access .. --------------------------------------------- https://googleprojectzero.blogspot.com/2025/01/windows-exploitation-tricks-… ∗∗∗ Infrastructure Laundering: Blending in with the Cloud ∗∗∗ --------------------------------------------- In an effort to blend in and make their malicious traffic tougher to block, hosting firms catering to cybercriminals in China and Russia increasingly are funneling their operations through major U.S. cloud providers. Research published this week on one such outfit -- a sprawling network tied to Chinese organized crime gangs and aptly named "Funnull" -- highlights a persistent whac-a-mole problem facing cloud services. --------------------------------------------- https://krebsonsecurity.com/2025/01/infrastructure-laundering-blending-in-w… ∗∗∗ Operation "Talent" nimmt weltgrößte Plattformen für Cyberkriminalität vom Netz ∗∗∗ --------------------------------------------- Bei einer internationalen Aktion wurden die Cracking-Foren nulled.to und cracked.io vom Netz genommen --------------------------------------------- https://www.derstandard.at/story/3000000255412/operation-talent-nimmt-weltg… ∗∗∗ Recent Jailbreaks Demonstrate Emerging Threat to DeepSeek ∗∗∗ --------------------------------------------- Evaluation of three jailbreaking techniques on DeepSeek shows risks of generating prohibited content. --------------------------------------------- https://unit42.paloaltonetworks.com/jailbreaking-deepseek-three-techniques/ ∗∗∗ On hackers, hackers, and hilarious misunderstandings ∗∗∗ --------------------------------------------- "Hacker", as we in the bizz know well, carries different meanings for different people, and this can cause hilarious misunderstandings. Yesterday, the Polish TV network TVN aired the second part of an ongoing documentary about issues in NEWAG trains that were analyzed by Dragon Sector. Near the end, the documentary featured a recording .. --------------------------------------------- https://gynvael.coldwind.pl/?id=799 ∗∗∗ Cyberangriffe auf SimpleHelp RMM beobachtet ∗∗∗ --------------------------------------------- In SimepleHelp RMM missbrauchen Angreifer Sicherheitslücken, um Netzwerke zu kompromittieren. Updates stehen bereit. --------------------------------------------- https://heise.de/-10265414 ∗∗∗ The Slow Death of OCSP ∗∗∗ --------------------------------------------- Everybody is talking about OCSP now because, just last month, at the end of 2024, Let’s Encrypt announced it was going to stop supporting online certificate revocation checking. Beginning in early May 2025, there will no longer be any OCSP revocation information in Let’s Encrypt’s certificates. Once all its earlier certificates expire, Let’s Encrypt will shut down its OCSP servers. --------------------------------------------- https://www.feistyduck.com/newsletter/issue_121_the_slow_death_of_ocsp ∗∗∗ PyPI’s New Archival Feature Closes a Major Security Gap ∗∗∗ --------------------------------------------- A major security improvement has landed on PyPI: maintainers can now archive projects, making it clear when a package is no longer actively maintained. This long-awaited feature, developed by Trail of Bits and funded by Alpha-Omega, helps developers make informed decisions about dependencies while protecting the Python ecosystem from risks associated .. --------------------------------------------- https://socket.dev/blog/pypi-adds-support-for-archiving-projects ∗∗∗ VMware Aria Vulnerabilities Addressed ∗∗∗ --------------------------------------------- VMware Security Advisory VMSA-2025-0003 addresses multiple vulnerabilities identified in VMware Aria Operations for Logs and VMware Aria Operations. These vulnerabilities, if exploited, could allow attackers to .. --------------------------------------------- https://thecyberthrone.in/2025/01/31/vmware-aria-vulnerabilities-addressed/ ∗∗∗ DeepSeek’s Popularity Sparks Surge in Crypto Phishing and Malware Campaigns ∗∗∗ --------------------------------------------- The rapid rise of DeepSeek, a Chinese artificial intelligence company known for its open-source large language models (LLMs), has sparked not only excitement but also a significant increase in cyber threats. As of January 2025, the company launched its first free chatbot app, “DeepSeek – AI Assistant,” which quickly became the most downloaded .. --------------------------------------------- https://thecyberexpress.com/deepseeks-surge-sparks-malware-campaigns/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (libsoup), Debian (debian-security-support and redis), Fedora (expat, java-21-openjdk, lemonldap-ng, and phpMyAdmin), Mageia (chromium-browser-stable and git-lfs), Oracle (bzip2, git-lfs, libsoup, mariadb:10.11, mariadb:10.5, python-jinja2, redis, and unbound), Red Hat (git-lfs, libsoup, python-jinja2, .. --------------------------------------------- https://lwn.net/Articles/1007252/ ∗∗∗ VU#733789: ChatGPT-4o contains security bypass vulnerability through time and search functions called "Time Bandit" ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/733789 ∗∗∗ ZDI-25-060: Google Chrome AI Manager Use-After-Free Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-060/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.01.2025
by Daily end-of-shift report 30 Jan '25

30 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 29-01-2025 18:00 − Donnerstag 30-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ No need to RSVP: a closer look at the Tria stealer campaign ∗∗∗ --------------------------------------------- Kaspersky GReAT experts discovered a new campaign targeting Android devices in Malaysia and Brunei with the Tria stealer to collect data from apps like WhatsApp and Gmail. --------------------------------------------- https://securelist.com/tria-stealer-collects-sms-data-from-android-devices/… ∗∗∗ Exposed DeepSeek Database Revealed Chat Prompts and Internal Data ∗∗∗ --------------------------------------------- China-based DeepSeek has exploded in popularity, drawing greater scrutiny. Case in point: Security researchers found more than 1 million records, including user data and API keys, in an open database. --------------------------------------------- https://www.wired.com/story/exposed-deepseek-database-revealed-chat-prompts… ∗∗∗ Europol warnt vor gefälschten Medikamenten in Online-Angeboten ∗∗∗ --------------------------------------------- Europol hat 2024 Medikamente im Wert von rund 11,1 Millionen Euro beschlagnahmt. Sie waren gefälscht und für den Online-Handel vorgesehen. --------------------------------------------- https://www.heise.de/news/Europol-warnt-vor-gefaelschten-Medikamenten-in-On… ∗∗∗ Warten auf Patch: Das Admin-Interface Voyager für Laravel-Apps ist verwundbar ∗∗∗ --------------------------------------------- Sicherheitsforscher warnen vor möglichen Attacken auf Voyager. Bislang haben sich die Entwickler zu den Sicherheitslücken nicht geäußert. --------------------------------------------- https://www.heise.de/news/Warten-auf-Patch-Das-Admin-Interface-Voyager-fuer… ∗∗∗ Linux-related discussion as a cybersecurity threat ∗∗∗ --------------------------------------------- Starting on January 19, 2025 Facebooks internal policy makers decided that Linux is malware and labeled groups associated with Linux as being "cybersecurity threats". Any posts mentioning DistroWatch and multiple groups associated with Linux and Linux discussions have either been shut down or had many of their posts removed. Weve been hearing all week .. --------------------------------------------- https://lwn.net/Articles/1006328/ ∗∗∗ Betrugswelle auf Facebook: Gefälschte Lagerabverkäufe von Hofer und Zara ∗∗∗ --------------------------------------------- Aktuell kursieren auf Facebook Postings, die angeblich von bekannten Marken stammen und mit einem Lagerabverkauf werben. Nutzer:innen wird suggeriert, dass Unternehmen wie Hofer oder Zara kostenlose Kaffeemaschinen oder Geschenkboxen zu Sonderpreisen verschenken. Doch Vorsicht: Es handelt sich um gefälschte Angebote von Kriminellen, die es nur auf Kreditkartendaten abgesehen haben. --------------------------------------------- https://www.watchlist-internet.at/news/betrugswelle-auf-facebook-gefaelscht… ∗∗∗ Risikobild 2025 ∗∗∗ --------------------------------------------- Das österreichische Verteidigungsministerium präsentierte am 27. Jänner das "Risikobild 2025". Wie nicht anders zu erwarten war, dominieren geopolitische Herausforderungen die Risikolandschaft. Der Ukraine-Krieg, die Spannungen zwischen China und den USA sowie der Nahe Osten sind auch die ersten Themen, die mir einfallen würden, wenn mich .. --------------------------------------------- https://www.cert.at/de/blog/2025/1/risikobild-2025 ∗∗∗ Talos IR trends Q4 2024: Web shell usage and exploitation of public-facing applications spike ∗∗∗ --------------------------------------------- This new report from Cisco Talos Incident Response explores how threat actors increasingly deployed web shells against vulnerable web applications, and exploited vulnerable or unpatched public-facing applications to gain initial access. --------------------------------------------- https://blog.talosintelligence.com/talos-ir-trends-q4-2024/ ∗∗∗ FBI Seizes Leading Hacking Forums Cracked.io and Nulled.to ∗∗∗ --------------------------------------------- Nulled.to, Cracked.to and Cracked.io, major hacking forums, appear seized by the FBI as DNS records point to FBI. --------------------------------------------- https://hackread.com/fbi-seizes-hacking-forums-cracked-to-nulled-to/ ∗∗∗ Common OAuth Vulnerabilities ∗∗∗ --------------------------------------------- OAuth2’s popularity makes it a prime target for attackers. While it simplifies user login, its complexity can lead to misconfigurations that create security holes. Some of the more intricate vulnerabilities keep reappearing because the protocol’s inner workings are not always well-understood. In an effort to change that, we have decided to .. --------------------------------------------- https://blog.doyensec.com/2025/01/30/oauth-common-vulnerabilities.html ===================== = Vulnerabilities = ===================== ∗∗∗ Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-012 ∗∗∗ Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-011 ∗∗∗ Drupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-010 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-010 ∗∗∗ Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-009 ∗∗∗ Matomo Analytics - Moderately critical - Cross site request forgery - SA-CONTRIB-2025-008 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-008 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.01.2025
by Daily end-of-shift report 29 Jan '25

29 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 28-01-2025 18:00 − Mittwoch 29-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Threat predictions for industrial enterprises 2025 ∗∗∗ --------------------------------------------- Kaspersky ICS CERT analyzes industrial threat trends and makes forecasts on how the industrial threat landscape will look in 2025. --------------------------------------------- https://securelist.com/industrial-threat-predictions-2025/115327/ ∗∗∗ ExxonMobil Lobbyist Caught Hacking Climate Activists ∗∗∗ --------------------------------------------- The Department of Justice is investigating a lobbying firm representing ExxonMobil for hacking the phones of climate activists:The hacking was allegedly commissioned by a Washington, D.C., lobbying firm, according to a lawyer representing the U.S. government. The firm, in turn, was allegedly working on behalf of one of the world’s largest oil and gas .. --------------------------------------------- https://www.schneier.com/blog/archives/2025/01/exxonmobil-lobbyist-caught-h… ∗∗∗ Industrielle Kontrollsysteme: Attacken auf kritische Infrastrukturen möglich ∗∗∗ --------------------------------------------- Es sind wichtige Sicherheitsupdates für industriellen Steuerungssysteme von unter anderem Rockwell und Schneider erschienen. --------------------------------------------- https://www.heise.de/news/Industrielle-Kontrollsysteme-Attacken-auf-kritisc… ∗∗∗ Zwei Sidechannel-Attacken auf Apples M-Prozessoren ∗∗∗ --------------------------------------------- Die schwerwiegenden Sicherheitslücken lassen sich für Angriffe auf Webbrowser aus der Ferne nutzen. Betroffen sind viele Mobil- und Desktop-Geräte von Apple. --------------------------------------------- https://www.heise.de/news/Zwei-Sidechannel-Attacken-auf-Apples-M-Prozessore… ∗∗∗ How we estimate the risk from prompt injection attacks on AI systems ∗∗∗ --------------------------------------------- Modern AI systems, like Gemini, are more capable than ever, helping retrieve data and perform actions on behalf of users. However, data from external sources present new security challenges if untrusted sources are available to execute instructions on AI systems. Attackers can take advantage of this by hiding malicious instructions in data .. --------------------------------------------- http://security.googleblog.com/2025/01/how-we-estimate-risk-from-prompt.html ∗∗∗ Backups & DRP in the ransomware era ∗∗∗ --------------------------------------------- In today’s digital landscape, the threat of ransomware has forced organizations to reevaluate their disaster recovery plans. Traditional approaches to data protection were focused primarily on high availability and are no longer sufficient. As cyber threats evolve, so must our strategies for safeguarding critical information. This blog post explores the .. --------------------------------------------- https://blog.nviso.eu/2025/01/29/backups-drp-in-the-ransomware-era/ ∗∗∗ Hackers Actively Exploiting Fortinet Firewalls: Real-Time Insights from GreyNoise ∗∗∗ --------------------------------------------- This blog details how attackers are actively exploiting Fortinet FortiGate firewalls vulnerable to CVE-2022-40684, with real-time insights from GreyNoise to help defenders understand and respond to these threats. --------------------------------------------- https://www.greynoise.io/blog/hackers-actively-exploiting-fortinet-firewall… ∗∗∗ Active Exploitation of Zero-day Zyxel CPE Vulnerability (CVE-2024-40891) ∗∗∗ --------------------------------------------- CVE-2024-40891: Zyxel CPE Zero-day Exploitation. Hackers are actively exploiting a telnet-based command injection vulnerability in Zyxel CPE devices, impacting 1,500+ exposed systems. No patch is available yet. --------------------------------------------- https://www.greynoise.io/blog/active-exploitation-of-zero-day-zyxel-cpe-vul… ∗∗∗ Adversarial Misuse of Generative AI ∗∗∗ --------------------------------------------- Rapid advancements in artificial intelligence (AI) are unlocking new possibilities for the way we work and accelerating innovation in science, technology, and beyond. In cybersecurity, AI is poised to transform digital defense, empowering defenders and enhancing our collective security. Large language models (LLMs) open new possibilities for .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse… ∗∗∗ CVE-2024-46507: Yeti Platform Server-Side Template Injection (SSTI) ∗∗∗ --------------------------------------------- Yeti is a Forensic Intelligence platform and pipeline for DFIR teams. It allows threat intelligence and DFIR teams to catalog, search, and link pieces of intelligence such as IP addresses, TTPs, and threat actors. With 10,000 .. --------------------------------------------- https://rhinosecuritylabs.com/research/cve-2024-46507-yeti-server-side-temp… ∗∗∗ CISA Brings KEV Data to GitHub ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Security Agency (CISA) just made a major move to improve access and usability for its Known Exploited Vulnerabilities (KEV) catalog. Announced by Tod Beardsley on LinkedIn, CISA has launched a new kev-data repository on GitHub, allowing developers, researchers, and cybersecurity enthusiasts to access KEV data in .. --------------------------------------------- https://socket.dev/blog/cisa-brings-kev-data-to-github ∗∗∗ CVE-2024-49138 Windows CLFS heap-based buffer overflow analysis – Part 2 ∗∗∗ --------------------------------------------- In the previous article, we discussed a vulnerability in the LoadContainerQ() function inside clfs.sys. The root cause of the vulnerability was LoadContainerQ() using a CLFS_CONTAINER_CONTEXT.pContainer without checking if FlushImage() invalidated the General Metadata Block. --------------------------------------------- https://security.humanativaspa.it/cve-2024-49138-windows-clfs-heap-based-bu… ∗∗∗ CVE-2024-49138 Windows CLFS heap-based buffer overflow analysis – Part 1 ∗∗∗ --------------------------------------------- CVE-2024-49138 is a Windows vulnerability detected by CrowdStrike as exploited in the wild. Microsoft patched the vulnerability on December 10th, 2024 with KB5048685 (for Windows 11 .. --------------------------------------------- https://security.humanativaspa.it/cve-2024-49138-windows-clfs-heap-based-bu… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (bzip2, gimp:2.8, keepalived, mariadb:10.11, mariadb:10.5, python-jinja2, and redis), Debian (iperf3, libtar, and pdns-recursor), Fedora (abseil-cpp, dotnet8.0, dotnet9.0, golang, libsoup3, and vaultwarden), Oracle (gimp:2.8, iperf3, keepalived, kernel, redis:7, and unbound), Red Hat (libsoup), SUSE (amazon-ssm-agent, .. --------------------------------------------- https://lwn.net/Articles/1006677/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.01.2025
by Daily end-of-shift report 28 Jan '25

28 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Montag 27-01-2025 18:00 − Dienstag 28-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ EU sanctions Russian GRU hackers for cyberattacks against Estonia ∗∗∗ --------------------------------------------- The European Union sanctioned three hackers, part of Unit 29155 of Russias military intelligence service (GRU), for their involvement in cyberattacks targeting Estonias government agencies in 2020. --------------------------------------------- https://www.bleepingcomputer.com/news/security/eu-sanctions-russian-gru-hac… ∗∗∗ Israel: Hacker kapern Notfallsirenen und spielen arabische Musik ∗∗∗ --------------------------------------------- In mehreren israelischen Einrichtungen ist kürzlich unerwartet arabische Musik aus den Notfallsirenen ertönt. Eine Hackergruppe hat sich schuldig bekannt. --------------------------------------------- https://www.golem.de/news/israel-hacker-kapern-notfallsirenen-und-spielen-a… ∗∗∗ Beyond the hype: The business reality of AI for cybersecurity ∗∗∗ --------------------------------------------- Real-world insights from 400 IT leaders, plus practical guidance to enhance business outcomes --------------------------------------------- https://news.sophos.com/en-us/2025/01/28/beyond-the-hype-the-business-reali… ∗∗∗ Update: Cybercriminals still not fully on board the AI train (yet) ∗∗∗ --------------------------------------------- A year after our initial research on threat actors’ attitudes to generative AI, we revisit some underground forums and find that many cybercriminals are still skeptical – although there has been a slight shift. --------------------------------------------- https://news.sophos.com/en-us/2025/01/28/update-cybercriminals-still-not-fu… ∗∗∗ Top-Rated Chinese AI App DeepSeek Limits Registrations Amid Cyberattacks ∗∗∗ --------------------------------------------- DeepSeek, the Chinese AI startup that has captured much of the artificial intelligence (AI) buzz in recent days, said its restricting registrations on the service, citing malicious attacks."Due to large-scale malicious attacks on DeepSeeks services, .. --------------------------------------------- https://thehackernews.com/2025/01/top-rated-chinese-ai-app-deepseek.html ∗∗∗ Apple plugs security hole in its iThings thats already been exploited in iOS ∗∗∗ --------------------------------------------- Cupertino kicks off the year with a zero-day Apple has plugged a security hole in the software at the heart of its iPhones, iPads, Vision Pro goggles, Apple TVs and macOS Sequoia Macs, warning some miscreants have already exploited the bug. --------------------------------------------- https://www.theregister.com/2025/01/28/apple_cve_2025_24085/ ∗∗∗ Security pros more confident about fending off ransomware, despite being battered by attacks ∗∗∗ --------------------------------------------- Data leak, shmata leak. It will all work out, right? IT and security pros say they are more confident in their ability to manage ransomware attacks after nearly nine in ten (88 percent) were forced to contain efforts by criminals to breach their defenses in the past year. --------------------------------------------- https://www.theregister.com/2025/01/28/research_security_pros_gain_ransomwa… ∗∗∗ Auf Facebook konnte man E-Mail-Adressen, Telefonnummern, Einmalpasswörter, etc. von Fremden einsehen. ∗∗∗ --------------------------------------------- For an unknown period until the end of January 2024, Facebook appears to have suffered a data leak that has exposed users’ email addresses, phone numbers and other identifying information. [..] The issue was reported to Facebook via its bug bounty programme. While the demonstrated method stopped working two weeks after submission, the .. --------------------------------------------- https://social.leckse.net/@leckse/statuses/01JJPE94S1NQM62VY60S767S1H ∗∗∗ Sonicwall: Tausende Geräte für trivial angreifbare SSL-VPN-Lücke anfällig ∗∗∗ --------------------------------------------- Seit Anfang Januar gibt es einen Patch zum Schließen einer SSL-VPN-Lücke in Sonicwalls. Dennoch sind mehr als 5000 Geräte noch angreifbar. --------------------------------------------- https://www.heise.de/news/Leicht-angreifbare-Sonicwall-Luecke-Tausende-Gera… ∗∗∗ Teamviewer: Rechteausweitung durch Sicherheitslücke möglich ∗∗∗ --------------------------------------------- Teamviewer warnt vor einer Schwachstelle in den Windows-Versionen der Fernwartungssoftware, die Angreifern die Rechteausweitung ermöglicht. --------------------------------------------- https://www.heise.de/news/Teamviewer-Rechteausweitung-durch-Sicherheitsluec… ∗∗∗ A Tumultuous Week for Federal Cybersecurity Efforts ∗∗∗ --------------------------------------------- President Trump last week issued a flurry of executive orders that upended a number of government initiatives focused on improving the nations cybersecurity posture. The president fired all advisors from the Department of Homeland Securitys Cyber Safety Review Board, called for the creation of a strategic cryptocurrency reserve, and voided .. --------------------------------------------- https://krebsonsecurity.com/2025/01/a-tumultuous-week-for-federal-cybersecu… ∗∗∗ How Garmin watches reveal your personal data, and what you can do ∗∗∗ --------------------------------------------- TL;DR A walk-through of obtaining sensitive data from a Garmin watch using forensic techniques How digital forensics on a Garmin watch helped solve a double murder case A .. --------------------------------------------- https://www.pentestpartners.com/security-blog/how-garmin-watches-reveal-you… ∗∗∗ New TorNet backdoor seen in widespread campaign ∗∗∗ --------------------------------------------- Cisco Talos discovered an ongoing malicious campaign operated by a financially motivated threat actor targeting users, predominantly in Poland and Germany. --------------------------------------------- https://blog.talosintelligence.com/new-tornet-backdoor-campaign/ ∗∗∗ ScatterBrain: Unmasking the Shadow of PoisonPlugs Obfuscator ∗∗∗ --------------------------------------------- Since 2022, Google Threat Intelligence Group (GTIG) has been tracking multiple cyber espionage operations conducted by China-nexus actors utilizing POISONPLUG.SHADOW. These operations employ a custom obfuscating compiler that we refer to as "ScatterBrain," facilitating attacks against various entities across Europe and the Asia Pacific (APAC) region. ScatterBrain appears .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/scatterbrain-unmas… ∗∗∗ Stating the Obvious: Vulns On the Rise in 2025 ∗∗∗ --------------------------------------------- Join Ben Edwards, as he takes a brief look back at one of the stories that was most interesting to him as a security data nerd from 2024. --------------------------------------------- https://www.bitsight.com/blog/2025-predictions-for-cve-vulnerabilities ∗∗∗ Get FortiRekt, I Am The Super_Admin Now - Fortinet FortiOS Authentication Bypass CVE-2024-55591 ∗∗∗ --------------------------------------------- Welcome to Monday, and what an excitingly fresh start to the week were all having. Grab your coffee, grab your vodka - were diving into a currently exploited-in-the-wild critical Authentication Bypass affecting .. --------------------------------------------- https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fortios-a… ∗∗∗ Clone2Leak: Your Git Credentials Belong To Us ∗∗∗ --------------------------------------------- In October 2024, I was hunting bugs for the GitHub Bug Bounty program. After investigating GitHub Enterprise Server for a while, I felt bored and decided to try to find bugs on GitHub Desktop instead. --------------------------------------------- https://flatt.tech/research/posts/clone2leak-your-git-credentials-belong-to… ∗∗∗ Best practices for key derivation ∗∗∗ --------------------------------------------- By Marc Ilunga Key derivation is essential in many cryptographic applications, including key exchange, key management, secure communications, and building robust cryptographic primitives. But it’s also easy to get wrong: although .. --------------------------------------------- https://blog.trailofbits.com/2025/01/28/best-practices-for-key-derivation/ ===================== = Vulnerabilities = ===================== ∗∗∗ Vulnerability in ClamAV Discovered by OSS-Fuzz ∗∗∗ --------------------------------------------- A security vulnerability has been identified in ClamAV, stemming from a potential buffer overflow read issue in .. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-25-04 ∗∗∗ WordPress Plugin "Simple Image Sizes" vulnerable to cross-site scripting ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN88046370/ ∗∗∗ TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc) ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-ext-sa-2025-001 ∗∗∗ Rockwell Automation FactoryTalk ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-028-03 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.01.2025
by Daily end-of-shift report 27 Jan '25

27 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 24-01-2025 18:00 − Montag 27-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Eine verpasste Chance: Schwaches Passwort-Hashing in VxWorks ∗∗∗ --------------------------------------------- Die Sicherheit von eingebetteten Systemen, die Echtzeitbetriebssysteme (RTOS) wie Wind River VxWorks verwenden, ist in risikoreichen Bereichen wie OT, .. --------------------------------------------- https://sec-consult.com/de/blog/detail/eine-verpasste-chance-schwaches-pass… ∗∗∗ Cracking the Giant: How ODAT Challenges Oracle, the King of Databases ∗∗∗ --------------------------------------------- In the past decade, Oracle Database (Oracle DB) has reigned supreme in the competitive arena of database engine popularity ranking as shown in Figure 1 and Figure 2. This pervasiveness has led Oracle Database to be trusted by Fortune 500 companies (e.g. Netflix, LinkedIn, eBay, etc.) to house, process, and safeguard their critical data. Its .. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cracking-th… ∗∗∗ GitHub Desktop Vulnerability Risks Credential Leaks via Malicious Remote URLs ∗∗∗ --------------------------------------------- Multiple security vulnerabilities have been disclosed in GitHub Desktop as well as other Git-related projects that, if successfully exploited, could permit an attacker to gain unauthorized access to a users Git credentials."Git implements a protocol called Git Credential Protocol to retrieve credentials from the .. --------------------------------------------- https://thehackernews.com/2025/01/github-desktop-vulnerability-risks.html ∗∗∗ Scammers Are Creating Fake News Videos to Blackmail Victims ∗∗∗ --------------------------------------------- “Yahoo Boy” scammers are impersonating CNN and other news organizations to create videos that pressure victims into making blackmail payments. --------------------------------------------- https://www.wired.com/story/scammers-are-creating-fake-news-videos-to-black… ∗∗∗ Technical Analysis of Xloader Versions 6 and 7 | Part 1 ∗∗∗ --------------------------------------------- Xloader is a malware family that is the successor to Formbook with information stealing capabilities targeting web browsers, email clients, and File Transfer Protocol (FTP) applications. The malware is also able to deploy second-stage payloads to an infected system. The author of Xloader regularly adds new functionality to target more .. --------------------------------------------- https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-… ∗∗∗ Nach Sicherheitslücke bei D-Trust: CCC spricht von "Cyber-Augenwischerei" ∗∗∗ --------------------------------------------- Der Chaos Computer Club fordert vom Vertrauensdiensteanbieter D-Trust Verantwortung zu tragen und die Abschaffung des Hackerparagraphen. --------------------------------------------- https://www.heise.de/news/Nach-Sicherheitsluecke-bei-D-Trust-CCC-spricht-vo… ∗∗∗ Palo-Alto: Sicherheitslücken in Firmware und Bootloadern von Firewalls ∗∗∗ --------------------------------------------- Die Firmware und Bootloader von einigen Palo-Alto-Firewalls weisen Sicherheitslecks auf, die Angreifern das Einnisten nach Angriffen ermöglichen. --------------------------------------------- https://www.heise.de/news/Palo-Alto-Sicherheitsluecken-in-Firmware-und-Boot… ∗∗∗ Hacked buses blare out patriotic pro-European anthems in Tbilisi, attack government ∗∗∗ --------------------------------------------- Residents of Tbilisi, the capital city of Georgia, experienced an unexpected and unusual start to their Friday morning commute. As they boarded their public transport buses, they were greeted by a barrage of sound emanating .. --------------------------------------------- https://www.bitdefender.com/en-us/blog/hotforsecurity/hacked-buses-blare-ou… ∗∗∗ The 2024 Ransomware Landscape: Looking back on another painful year ∗∗∗ --------------------------------------------- In this post, we’ll examine the latest data points, discuss notable groups, and estimate the potential impact on victims — helping security teams plan their defenses for the months ahead. --------------------------------------------- https://www.rapid7.com/blog/post/2025/01/27/the-2024-ransomware-landscape-l… ∗∗∗ Brave Desktop Browser Vulnerability Lets Malicious Sites Appear Trusted ∗∗∗ --------------------------------------------- A critical vulnerability in Brave Browser allows malicious websites to appear as trusted sources during file uploads/downloads. --------------------------------------------- https://hackread.com/brave-desktop-browser-vulnerability-malicious-sites-tr… ∗∗∗ Datadog threat roundup: top insights for Q4 2024 ∗∗∗ --------------------------------------------- Threat insights from Datadog Security Labs for Q4 2024. --------------------------------------------- https://securitylabs.datadoghq.com/articles/2024-q4-threat-roundup/ ∗∗∗ Exploit Me, Baby, One More Time: Command Injection in Kubernetes Log Query ∗∗∗ --------------------------------------------- Kubernetes and containers in general have become a predominant force in the security world - and, as such, they’ve been a point of interest for researchers worldwide (including us). Our research journey initially led .. --------------------------------------------- https://www.akamai.com/blog/security-research/2024-january-kubernetes-log-q… ∗∗∗ Node.js EOL Versions CVE Dubbed the "Worst CVE of the Year" by Security Experts ∗∗∗ --------------------------------------------- On January 22, 2025, CVE-2025-23088 was published by HackerOne to inform users about the risks of continuing to use End-of-Life (EOL) versions of Node.js. This CVE has quickly sparked debate in the security community, with some experts labeling it the “worst CVE of the year” – not for its severity, but for the controversy surrounding .. --------------------------------------------- https://socket.dev/blog/node-js-eol-versions-cve-dubbed-the-worst-cve-of-th… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (git-lfs, java-17-openjdk, java-21-openjdk, kernel, and python-jinja2), Debian (git and git-lfs), Fedora (buildah, chromium, containers-common, freeipa, glibc, golang, mediawiki, pam-u2f, podman, and rsync), Mageia (glibc, iperf, openssl, phpmyadmin, and poppler), Oracle (firefox, git-lfs, grafana, .. --------------------------------------------- https://lwn.net/Articles/1006261/ ∗∗∗ Wind River Software VxWorks RTOS Weak Password Hashing Algorithms ∗∗∗ --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/wind-river-software-vxwo… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

← Newer
1
2
3
4
5
6
7
8
9
...
315
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily