Daily

daily@lists.cert.at

1 participants
3085 discussions

Tageszusammenfassung - 09.08.2021
by Daily end-of-shift report 09 Aug '21

09 Aug '21

===================== = End-of-Day report = ===================== Timeframe: Freitag 06-08-2021 18:00 − Montag 09-08-2021 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Verschlüsselung: Sicherheitsrisiko STARTTLS ∗∗∗ --------------------------------------------- Das STARTTLS-Verfahren hat zahlreiche Sicherheitsrisiken. Überall, wo es möglich ist, hat die direkte Nutzung von TLS nur Vorteile. --------------------------------------------- https://www.golem.de/news/verschluesselung-sicherheitsrisiko-starttls-2108-… ∗∗∗ Black Hat: DNS-as-a-Service könnte Netzwerkinfrastruktur verraten ∗∗∗ --------------------------------------------- Durch einen Trick konnten Sicherheitsforscher Informationen über die Netzwerkinfrastruktur der Kunden eines DNS-as-a-Service-Anbieters erlangen. --------------------------------------------- https://heise.de/-6157720 ∗∗∗ Exchange ProxyShell-Lücke: Scans suchen nach verwundbaren Servern ∗∗∗ --------------------------------------------- Mehrere tausend Server sind allein in Deutschland für die neue Exchange-Lücke anfällig. Dabei gibt es längst Patches von Microsoft. --------------------------------------------- https://heise.de/-6158946 ∗∗∗ Die Anatomie nativer IIS‑Malware ∗∗∗ --------------------------------------------- ESET-Forscher veröffentlichen ein Whitepaper, das Bedrohungen durch IIS-Webserver genau unter die Lupe nimmt --------------------------------------------- https://www.welivesecurity.com/deutsch/2021/08/06/die-anatomie-nativer-iis-… ∗∗∗ IQ-Test auf offiziell-qi-test.com führt in die Abo-Falle! ∗∗∗ --------------------------------------------- Mit nur 30 Fragen kann man einen zertifizierten IQ-Test durchführen, heißt es auf der Webseite offiziell-qi-test.com. Erst nachdem der Test durchgeführt wurde, wird man erstmals auf Kosten hingewiesen: Um das Ergebnis zu sehen soll man 3,90 Euro zahlen. Doch Achtung: Im Kleingedruckten finden sich weitere Kosten und eine Abo-Falle! --------------------------------------------- https://www.watchlist-internet.at/news/iq-test-auf-offiziell-qi-testcom-fue… ∗∗∗ Cisco: Firewall manager RCE bug is a zero-day, patch incoming ∗∗∗ --------------------------------------------- In a Thursday security advisory update, Cisco revealed that a remote code execution (RCE) vulnerability in the Adaptive Security Device Manager (ADSM) Launcher disclosed last month is a zero-day bug that has yet to receive a security update. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisco-firewall-manager-rce-b… ∗∗∗ Synology warns of malware infecting NAS devices with ransomware ∗∗∗ --------------------------------------------- Taiwan-based NAS maker Synology has warned customers that the StealthWorker botnet is targeting their network-attached storage devices in ongoing brute-force attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/synology-warns-of-malware-in… ∗∗∗ SQL Injection in WordPress Plugins: ORDER and ORDER BY as Overlooked Injection Points ∗∗∗ --------------------------------------------- Trustwave SpiderLabs recently undertook a survey of some 100 popular WordPress plugins for possible SQL Injection vulnerabilities. Some good news is that in the vast majority, no such vulnerabilities were identified. Most plugins were found to be using either prepared statements or suitable sanitization when incorporating user-controlled data in a query. Of the five vulnerable plugins identified, some patterns emerged, [...] --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/sql-injecti… ∗∗∗ Beware! New Android Malware Hacks Thousands of Facebook Accounts ∗∗∗ --------------------------------------------- A new Android trojan has been found to compromise Facebook accounts of over 10,000 users in at least 144 countries since March 2021 via fraudulent apps distributed through Google Play Store and other third-party app marketplaces. Dubbed "FlyTrap," the previously undocumented malware is believed to be part of a family of trojans that employ social engineering tricks to breach Facebook accounts [...] --------------------------------------------- https://thehackernews.com/2021/08/beware-new-android-malware-hacks.html ∗∗∗ Phishing Sites Targeting Scammers and Thieves ∗∗∗ --------------------------------------------- I was preparing to knock off work on a recent Friday evening when a curious and annoying email came in via the contact form on this site: “Hello I go by the username Nuclear27 on your site Briansclub[.]com,” wrote “Mitch,” confusing me with the proprietor of perhaps the underground’s largest bazaar for stolen credit and identity data. “I made a deposit to my wallet on the site but nothing has shown up yet and I would like to know why.” --------------------------------------------- https://krebsonsecurity.com/2021/08/phishing-sites-targeting-scammers-and-t… ∗∗∗ Routers and modems running Arcadyan firmware are under attack ∗∗∗ --------------------------------------------- Routers and modems running a version of the Arcadyan firmware, including devices from ASUS, Orange, Vodafone, and Verizon, are currently under attack from a threat actor attempting to ensnare the devices into their DDoS botnet. --------------------------------------------- https://therecord.media/routers-and-modems-running-arcadyan-firmware-are-un… ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-21-951: (0Day) Delta Industrial Automation DOPSoft XLS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation DOPSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-951/ ∗∗∗ Sicherheitsrelevanter Bug in net-Bibliothek von Go und Rust ∗∗∗ --------------------------------------------- Die Bibliothek net in Go und Rust verhält sich nicht standardkonform und verschluckt führende Nullen. Angreifer könnten so falsche IP-Adressen einschleusen. --------------------------------------------- https://heise.de/-6157969 ∗∗∗ Exchange Server jetzt patchen: Angreifer suchen aktiv nach neuer Lücke ∗∗∗ --------------------------------------------- Admins sollten ihre Exchange Server zügig aktualisieren. Nachdem Forscher einen neuen Angriff vorgestellt haben, probieren Angreifer ihn offenbar gezielt aus. --------------------------------------------- https://heise.de/-6158190 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ansible and bluez), Fedora (curl, kernel, mod_auth_openidc, rust-rav1e, and webkit2gtk3), Mageia (kernel and kernel-linus), openSUSE (php7 and python-reportlab), Oracle (ruby:2.7), Red Hat (microcode_ctl), SUSE (fastjar, kvm, mariadb, php7, php72, php74, and python-Pillow), and Ubuntu (docker.io). --------------------------------------------- https://lwn.net/Articles/865680/ ∗∗∗ Apple fixes AWDL bug that could be used to escape air-gapped networks ∗∗∗ --------------------------------------------- Apple has fixed a vulnerability in its Apple Wireless Direct Link (AWDL) technology that could have been abused by threat actors to escape and steal data from air-gapped networks. --------------------------------------------- https://therecord.media/apple-fixed-awdl-bug-that-could-be-used-to-escape-a… ∗∗∗ Apache Tomcat vulnerability CVE-2021-33037 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K32469285 ∗∗∗ Security Bulletin: Vulnerability in IBM® SDK Java™ Technology Edition, Version 7, Version 8, that is used by IBM Workload Scheduler. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-sdk-… ∗∗∗ Security Bulletin: Vulnerability in IBM® SDK Java™ Technology Edition, Version 7, Version 8, that is used by IBM Workload Scheduler. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-sdk-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in OpenSSL may affect IBM Workload Scheduler ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: CVE-2020-1968 vulnerability in OpenSSL may affect IBM Workload Scheduler ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-1968-vulnerabili… ∗∗∗ Security Bulletin: Multiple vulnerabilities in OpenSSL may affect IBM Workload Scheduler ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in GNU Binutils affect IBM Netezza Platform Software ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: ICN Is Vulnerable to Improper Input Validation ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-icn-is-vulnerable-to-impr… ∗∗∗ Security Bulletin: Vulnerability in bind (CVE-2021-25215) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-bind-cve… ∗∗∗ Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Monitoring ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-ja… ∗∗∗ Security Bulletin: openSSL and Apache Hadoop vulnerability impacting Aspera High-Speed Transfer Server, Aspera High-Speed Transfer Endpoint, Aspera Desktop Client, Aspera On Demand (CVE-2020-1971, CVE-2020-9492) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-openssl-and-apache-hadoop… ∗∗∗ Security Bulletin: Vulnerability in Dojo affects WebSphere Application Server (CVE-2020-5258) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-dojo-aff… ∗∗∗ Security Bulletin: Stack overflow via TIS_CODESET environment variable in IBM Workload Scheduler ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-stack-overflow-via-tis_co… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.08.2021
by Daily end-of-shift report 06 Aug '21

06 Aug '21

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 05-08-2021 18:00 − Freitag 06-08-2021 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Linux version of BlackMatter ransomware targets VMware ESXi servers ∗∗∗ --------------------------------------------- The BlackMatter gang has joined the ranks of ransomware operations to develop a Linux encryptor that targets VMwares ESXi virtual machine platform. --------------------------------------------- https://www.bleepingcomputer.com/news/security/linux-version-of-blackmatter… ∗∗∗ Lockbit 2.0: Ransomware will Firmen-Insider rekrutieren ∗∗∗ --------------------------------------------- Die Ransomware-Gruppe Lockbit sucht auf ungewöhnliche Weise nach Insidern, die ihr Zugangsdaten übermitteln sollen. --------------------------------------------- https://www.golem.de/news/lockbit-2-0-ransomware-will-firmen-insider-rekrut… ∗∗∗ Malicious Microsoft Word Remains A Key Infection Vector, (Fri, Aug 6th) ∗∗∗ --------------------------------------------- Despite Microsoft's attempts to make its Office suite more secure and disable many automatic features, despite the fact that users are warned that suspicious documents should not be opened, malicious Word documents remain a key infection vector today. --------------------------------------------- https://isc.sans.edu/diary/rss/27716 ∗∗∗ Using “Master Faces” to Bypass Face-Recognition Authenticating Systems ∗∗∗ --------------------------------------------- A master face is a face image that passes face-based identity-authentication for a large portion of the population. These faces can be used to impersonate, with a high probability of success, any user, without having access to any user-information. --------------------------------------------- https://www.schneier.com/blog/archives/2021/08/using-master-faces-to-bypass… ∗∗∗ EU officials investigating breach of Cybersecurity Atlas project ∗∗∗ --------------------------------------------- The European Commission is investigating a breach of its Cybersecurity Atlas project after a copy of the site’s backend database was put up for sale on an underground cybercrime forum on Monday. --------------------------------------------- https://therecord.media/eu-officials-investigating-breach-of-cybersecurity-… ∗∗∗ Security-Oscars: And the Pwnie goes to … ∗∗∗ --------------------------------------------- Der Pandemie zum Trotz hat die Pwnie-Jury auch in diesem Jahr die Security-Oscars verliehen – und natürlich auch "Goldene Himbeeren". --------------------------------------------- https://heise.de/-6157581 ∗∗∗ What is Tor? ∗∗∗ --------------------------------------------- We give a brief overview of Tor, the secure communications tool. We explain what it is, how you can use it, and some of the potential drawbacks. --------------------------------------------- https://blog.malwarebytes.com/privacy-2/2021/08/what-is-tor/ ∗∗∗ Black Hat: How cybersecurity incidents can become a legal minefield ∗∗∗ --------------------------------------------- Facing a cyberattack? Pick up the phone and talk to legal help as well as incident response. --------------------------------------------- https://www.zdnet.com/article/black-hat-how-cybersecurity-can-be-a-legal-mi… ∗∗∗ Disgruntled ransomware affiliate leaks the Conti gang’s technical manuals ∗∗∗ --------------------------------------------- A disgruntled member of the Conti ransomware program has leaked today the manuals and technical guides used by the Conti gang to train affiliate members on how to access, move laterally, and escalate access inside a hacked company and then exfiltrate its data before encrypting files. --------------------------------------------- https://therecord.media/disgruntled-ransomware-affiliate-leaks-the-conti-ga… ===================== = Vulnerabilities = ===================== ∗∗∗ VU#357312: HTTP Request Smuggling in Web Proxies ∗∗∗ --------------------------------------------- HTTP web proxies and web accelerators that support HTTP/2 for an HTTP/1.1 backend webserver are vulnerable to HTTP Request Smuggling. --------------------------------------------- https://kb.cert.org/vuls/id/357312 ∗∗∗ Kindle: Mit Schadcode infizierte E-Books konnten Amazon-Account kapern ∗∗∗ --------------------------------------------- Mit infizierten E-Books konnten Sicherheitsforscher Kindle-Reader und sogar Amazon-Konten übernehmen. Amazon hat die Lücke mittlerweile geschlossen. --------------------------------------------- https://heise.de/-6157512 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (tomcat8), Mageia (bluez, exiv2, fetchmail, libsndfile, nodejs, php-pear, python-pillow, and rabbitmq-server), openSUSE (apache-commons-compress, balsa, djvulibre, mariadb, mysql-connector-java, nodejs8, opera, and spice-vdagent), Red Hat (ruby:2.7), SUSE (apache-commons-compress, djvulibre, java-11-openjdk, libsndfile, mariadb, nodejs8, and spice-vdagent), and Ubuntu (docker.io). --------------------------------------------- https://lwn.net/Articles/865465/ ∗∗∗ Black Hat: BadAlloc bugs expose millions of IoT devices to hijack ∗∗∗ --------------------------------------------- BadAlloc vulnerabilities impact millions of devices worldwide. --------------------------------------------- https://www.zdnet.com/article/black-hat-badalloc-bugs-expose-millions-of-io… ∗∗∗ Security Bulletin: Vulnerability in IBM® SDK Java™ Technology Edition, Version 7, Version 8, that is used by IBM Workload Scheduler. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-sdk-… ∗∗∗ Security Bulletin: Vulnerability in IBM® SDK Java™ Technology Edition, Version 7, Version 8, that is used by IBM Workload Scheduler. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-sdk-… ∗∗∗ Free Micropatches for "PetitPotam" ∗∗∗ --------------------------------------------- https://blog.0patch.com/2021/08/free-micropatches-for-petitpotam.html ∗∗∗ HCC Embedded InterNiche TCP/IP stack, NicheLite ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-217-01 ∗∗∗ FATEK Automation FvDesigner ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-217-02 ∗∗∗ mySCADA myPRO ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-217-03 ∗∗∗ Advantech WebAccess SCADA ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-217-04 ∗∗∗ CISA Releases Security Advisory for InterNiche Products ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/08/05/cisa-releases-sec… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.08.2021
by Daily end-of-shift report 05 Aug '21

05 Aug '21

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 04-08-2021 18:00 − Donnerstag 05-08-2021 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Ransomware: Unternehmen beklagen immense Schäden durch Cyberangriffe ∗∗∗ --------------------------------------------- Die Angriffe mit Ransomware nehmen massiv zu, zeigt nun auch der Bitkom-Verband. Auch das Homeoffice wird sicherheitskritisch. --------------------------------------------- https://www.golem.de/news/ransomware-unternehmen-beklagen-immense-schaeden-… ∗∗∗ Cisco beseitigt kritische Schwachstellen aus Small Business-Routern der RV-Serie ∗∗∗ --------------------------------------------- Jetzt updaten: Remote Code Execution und Denial-of-Service wären mögliche Angriffskonsequenzen. Auch für weitere Cisco-Produkte sind wichtige Updates verfügbar. --------------------------------------------- https://heise.de/-6155856 ∗∗∗ Sicherheitsforscher entdecken Schwachstellen in Industriekontrollsystemen von Mitsubishi ∗∗∗ --------------------------------------------- Die Patches sind bereits in Arbeit, aber noch nicht erhältlich. Grund dafür ist ein aufwändiges Zertifizierungsverfahren. Möglicherweise sind auch Produkte anderer Hersteller betroffen. --------------------------------------------- https://www.zdnet.de/88396132/sicherheitsforscher-entdecken-schwachstellen-… ∗∗∗ Black Hat USA 2021: Security Advisories – mehr Durchblick dank Automatisierung ∗∗∗ --------------------------------------------- Uneinheitliche Advisory-Formate kosten wertvolle Zeit. Und wie beschreibt man eigentlich eine "Nicht-Verwundbarkeit"? CSAF und VEX sollen Abhilfe schaffen. --------------------------------------------- https://heise.de/-6155594 ∗∗∗ Microsoft Teams korrekt absichern ∗∗∗ --------------------------------------------- Microsoft Teams ist beliebt, gerät aber immer stärker ins Visier von Hackern. Wie Sie den Schutz der Kollaborations-Software am besten bewerkstelligen, schildert Bert Skorupski, Senior Manager Sales Engineering bei Quest Software, im ersten Teil eines zweiteiligen Gastbeitrages. --------------------------------------------- https://www.zdnet.de/88396112/microsoft-teams-korrekt-absichern/ ∗∗∗ Vorsicht vor mykundenservice.com: Hohe Telefonrechnung droht! ∗∗∗ --------------------------------------------- Während die meisten Unternehmen Kontakttelefonnummern offen kommunizieren, tun dies andere nicht. Da wäre eine Sammlung von Kontaktnummern durchaus hilfreich. Auf mykundenservice.com verspricht man zwar eine solche Sammlung, doch eigentlich lockt man zum Anruf einer 0900-Nummer. Achtung: Hier entstehen hohe Kosten! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-mykundenservicecom-hohe… ∗∗∗ How to Protect against EMOTET - "The World’s Most Dangerous Malware" ∗∗∗ --------------------------------------------- In the summer of 2020, malware infections were on a clear rise. Many new variants were appearing, and enterprises, government agencies, business leaders, and public officials were all voicing concern. Yet, seven years after it was first discovered, the spread of the EMOTET malware was arguably most concerning of all. --------------------------------------------- https://www.beyondtrust.com/blog/entry/how-to-protect-against-emotet-the-wo… ∗∗∗ Windows admins now can block external devices via layered Group Policy ∗∗∗ --------------------------------------------- Microsoft has added support for layered Group Policies, which allow IT admins to control what internal or external devices users can be installed on corporate endpoints across their organizations network. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/windows-admins-now-can-bloc… ∗∗∗ MacOS Flaw in Telegram Retrieves Deleted Messages ∗∗∗ --------------------------------------------- Telegram declined to fix a scenario in which the flaw can be exploited, spurring a Trustwave researcher to decline a bug bounty and to disclose his findings instead. --------------------------------------------- https://threatpost.com/macos-flaw-in-telegram-retrieves-deleted-messages/16… ∗∗∗ Examining Unique Magento Backdoors ∗∗∗ --------------------------------------------- During a recent investigation into a compromised Magento ecommerce environment, we discovered the presence of five different backdoors that would provide attackers with code execution capabilities. The techniques used by the attackers in these backdoors illustrates the ever-changing landscape of website security and highlights some of the tactics used to avoid traditional backdoor detection. --------------------------------------------- https://blog.sucuri.net/2021/08/examining-unique-magento-backdoors.html ∗∗∗ Microsoft Patched the Issue With Windows Containers That Enabled Siloscape ∗∗∗ --------------------------------------------- Microsoft recently added additional security checks that address the Windows container escape that enabled Siloscape. --------------------------------------------- https://unit42.paloaltonetworks.com/windows-container-escape-patch/ ∗∗∗ Meet Prometheus, the secret TDS behind some of today’s malware campaigns ∗∗∗ --------------------------------------------- A recently discovered cybercrime service is helping malware gangs distribute their malicious payloads to unsuspecting users using a network of hacked websites. --------------------------------------------- https://therecord.media/meet-prometheus-the-secret-tds-behind-some-of-today… ∗∗∗ Pegasus Spyware: How It Works and What It Collects ∗∗∗ --------------------------------------------- An NSO document leaked to the internet reveals how the Pegasus spyware - sold to intelligence and law enforcement agencies around the world - can be used to spy on targeted mobile phones. --------------------------------------------- https://zetter.substack.com/p/pegasus-spyware-how-it-works-and ∗∗∗ From Stranger to DA // Using PetitPotam to NTLM relay to Domain Administrator ∗∗∗ --------------------------------------------- Knock knock, who’s there? Your new DA! Several vulnerabilities that have been recently disclosed, namely: MS-EFSRPC – AKA PetitPotam Credential Relaying abusing the AD CS role Any attacker with internal network access, such as a phished client or a malicious planted device in the network, can take over the entire Active Directory domain without any [...] --------------------------------------------- https://blog.truesec.com/2021/08/05/from-stranger-to-da-using-petitpotam-to… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Security Advisories 2021-08-04 ∗∗∗ --------------------------------------------- 1 critical, 4 high, 2 medium severity --------------------------------------------- https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&secur… ∗∗∗ SA44858 - 9.1R12 Security Fixes ∗∗∗ --------------------------------------------- [...] Fixes for all the CVEs listed above have been included in the latest version of PCS, 9.1R12, which was released on 2 August 2021. We strongly encourage you to upgrade to ensure your organization is protected. --------------------------------------------- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44858 ∗∗∗ VMSA-2021-0016 ∗∗∗ --------------------------------------------- VMware Workspace One Access, Identity Manager and vRealize Automation address multiple vulnerabilities (CVE-2021-22002, CVE-2021-22003) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2021-0016.html ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (jetty9 and openexr), openSUSE (mariadb and virtualbox), Red Hat (go-toolset-1.15 and go-toolset-1.15-golang), SUSE (djvulibre and mariadb), and Ubuntu (opencryptoki). --------------------------------------------- https://lwn.net/Articles/865306/ ∗∗∗ Amazon and Google patch major bug in their DNS-as-a-Service platforms ∗∗∗ --------------------------------------------- At the Black Hat security conference today, two security researchers have disclosed a security issue impacting hosted DNS service providers that can be abused to hijack the platforms nodes, intercept some of the incoming DNS traffic, and then map customers internal networks. --------------------------------------------- https://therecord.media/amazon-and-google-patch-major-bug-in-their-dns-as-a… ∗∗∗ IBM Security Bulletins 2021-08-04 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ BIG-IP LTM HTTP/2 desync attacks: malicious CRLF placement security exposure ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K97045220 ∗∗∗ BIG-IP LTM HTTP/2 desync attacks: request line injection ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K63312282 ∗∗∗ ffmpeg: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-0832 ∗∗∗ Red Hat OpenShift: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K21-0835 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.08.2021
by Daily end-of-shift report 04 Aug '21

04 Aug '21

===================== = End-of-Day report = ===================== Timeframe: Dienstag 03-08-2021 18:00 − Mittwoch 04-08-2021 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New Cobalt Strike bugs allow takedown of attackers’ servers ∗∗∗ --------------------------------------------- Security researchers have discovered Cobalt Strike denial of service (DoS) vulnerabilities that allow blocking beacon command-and-control (C2) communication channels and new deployments. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-cobalt-strike-bugs-allow… ∗∗∗ Phishing Campaign Dangles SharePoint File-Shares ∗∗∗ --------------------------------------------- Attackers spoof sender addresses to appear legitimate in a crafty campaign that can slip past numerous detections, Microsoft researchers have discovered. --------------------------------------------- https://threatpost.com/phishing-sharepoint-file-shares/168356/ ∗∗∗ Three Problems with Two Factor Authentication, (Tue, Aug 3rd) ∗∗∗ --------------------------------------------- Usability remains a challenge for two-factor authentication. I recently came across a review of a healthcare-related mobile app, and a one-star review complained about how unusable the application is due to its two-factor requirement. --------------------------------------------- https://isc.sans.edu/diary/rss/27704 ∗∗∗ Pivoting and Hunting for Shenanigans from a Reported Phishing Domain, (Wed, Aug 4th) ∗∗∗ --------------------------------------------- I was alerted to a web page masquerading as a local financial institution earlier in the day. The phishing web page was constructed well, looked extremely similar to the financial institutions actual page and had input fields for victims to input their credentials. --------------------------------------------- https://isc.sans.edu/diary/rss/27710 ∗∗∗ SAML is insecure by design ∗∗∗ --------------------------------------------- SAML uses signatures based on computed values. The practice is inherently insecure and thus SAML as a design is insecure. --------------------------------------------- https://joonas.fi/2021/08/saml-is-insecure-by-design/ ∗∗∗ Vulnerability Spotlight: Use-after-free vulnerability in tinyobjloader ∗∗∗ --------------------------------------------- Cisco Talos recently discovered a use-after-free vulnerability in a specific function of tinyobjloader. --------------------------------------------- https://blog.talosintelligence.com/2021/08/vuln-spotlight-.html ∗∗∗ Value of PLC Key Switch Monitoring to Keep Critical Systems More Secure ∗∗∗ --------------------------------------------- Programmable Logic Controllers (PLC) and Safety Instrumented Systems (SIS) Controllers have historically included an external switch, generally in the form of a key, to perform maintenance and troubleshooting. --------------------------------------------- https://www.dragos.com/blog/industry-news/value-of-plc-key-switch-monitorin… ∗∗∗ OpSec Leaky Images ∗∗∗ --------------------------------------------- Hackers love your marketing department. Fact! Your marketing department love telling the world what happens in your company, then they attach images to the posts, often of staff at work. --------------------------------------------- https://www.pentestpartners.com/security-blog/opsec-leaky-images/ ∗∗∗ Achtung Scheckbetrug: Restaurant-BesitzerInnen erhalten betrügerische Reservierungsanfragen! ∗∗∗ --------------------------------------------- BetrügerInnen versuchen mit vermeintlichen Reservierungen an das Geld von Restaurant-BesitzerInnen zu kommen: Wenn ein vermeintlicher Gast aus dem Ausland für eine größere Gruppe reservieren und das Geld vorab per Scheck bezahlen will, gilt es vorsichtig zu sein. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-scheckbetrug-restaurant-besi… ∗∗∗ IntelMQ 3.0 - Configuration, Domain based workflow, IEPs ∗∗∗ --------------------------------------------- We are happy to announce the completion of the IntelMQ 3.0 milestone. --------------------------------------------- https://cert.at/en/blog/2021/8/intelmq-30-domain-based-workflow-ieps ∗∗∗ Shodan Verified Vulns 2021-08-01 ∗∗∗ --------------------------------------------- Schwachstellen machen leider keine Pause im Sommer und entsprechend haben wir auch diesen Monat wieder einen Blick auf jene geworfen, die Shodan in Österreich sieht. --------------------------------------------- https://cert.at/de/aktuelles/2021/8/shodan-verified-vulns-2021-08-01 ===================== = Vulnerabilities = ===================== ∗∗∗ INFRA:HALT: Neue Schwachstellen im TCP/IP-Stack von Industriegeräten entdeckt ∗∗∗ --------------------------------------------- Das Forscherteam um "Amnesia:33", "Number:Jack" und Co. hat weitere Schwachstellen gefunden – diesmal im "NicheStack" für den Bereich Operational Technology. --------------------------------------------- https://heise.de/-6154631 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (asterisk, libpam-tacplus, and wordpress), Fedora (buildah and podman), openSUSE (thunderbird and webkit2gtk3), Oracle (kernel and varnish:6), SUSE (kernel, kvm, and webkit2gtk3), and Ubuntu (libdbi-perl and php-pear). --------------------------------------------- https://lwn.net/Articles/865192/ ∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container could allow a remote attacker to execute arbitrary code due to CVE-2021-33195 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris… ∗∗∗ Security Bulletin: Vulnerability in Apache Commons IO may affect Cúram Social Program Management (CVE-2021-29425) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-c… ∗∗∗ Security Bulletin: Vulnerability in Dojo may affect Cúram Social Program Management (CVE-2020-5258) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-dojo-may… ∗∗∗ Security Bulletin: IBM API Connect is impacted by reflected cross site scripting (CVE-2020-4707) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-is-impact… ∗∗∗ PHOENIX CONTACT : Products utilizing WIBU SYSTEMS CodeMeter components in versions prior to V7.21a ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2021-036 ∗∗∗ PHOENIX CONTACT : DoS for PLCnext Control devices in versions prior to 2021.0.5 LTS ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2021-029 ∗∗∗ Dell integrated Dell Remote Access Controller: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0830 ∗∗∗ Cross Site Request Forgery (CSRF) vulnerability in Bosch IP cameras ∗∗∗ --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-033305-bt.html ∗∗∗ SYSS-2021-042: Tiny Java Web Server and Servlet Container (TJWS) – Reflected Cross-Site Scripting ∗∗∗ --------------------------------------------- https://www.syss.de/pentest-blog/syss-2021-042-tiny-java-web-server-and-ser… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.08.2021
by Daily end-of-shift report 03 Aug '21

03 Aug '21

===================== = End-of-Day report = ===================== Timeframe: Montag 02-08-2021 18:00 − Dienstag 03-08-2021 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Supply-Chain-Angriffe: EU-Behörde empfiehlt Code-Checks für Abhängigkeiten ∗∗∗ --------------------------------------------- Als Reaktion auf Angriffe wie bei Solarwinds hat die zuständige EU-Behörde einen einfachen Rat. Doch entsprechende Maßnahmen kann offenbar nicht mal Microsoft umsetzen. --------------------------------------------- https://www.golem.de/news/supply-chain-angriffe-eu-behoerde-empfiehlt-code-… ∗∗∗ Do You Trust Your Smart TV? ∗∗∗ --------------------------------------------- Did you ever stop to think that the office smart TV used for company presentations, Zoom meetings, and other work-related activities may not be so trustworthy? --------------------------------------------- https://securityaffairs.co/wordpress/120752/iot/smart-tv-security.html ∗∗∗ Android-Patchday: Google bessert unter anderem beim Media Framework nach ∗∗∗ --------------------------------------------- Updates für das mobile Betriebssystem zielen wieder einmal auf das Media Framework, beseitigen aber etwa auch kritische Lücken aus Qualcomm-Komponenten. --------------------------------------------- https://heise.de/-6154130 ∗∗∗ RDP brute force attacks explained ∗∗∗ --------------------------------------------- A simple and straightforward explanation of what RDP brute force attacks are, why they are so dangerous, and what you can do about them. --------------------------------------------- https://blog.malwarebytes.com/explained/2021/08/rdp-brute-force-attacks-exp… ∗∗∗ Gefälschte A1-Rechnung führt zu Schadsoftware ∗∗∗ --------------------------------------------- Aktuell werden gefälschte A1-E-Mails mit dem Betreff "Rechnung vom 04.07.2021" versendet. Im E-Mail wird behauptet, dass eine Zahlung nicht bearbeitet werden konnte. --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-a1-rechnung-fuehrt-zu-sc… ∗∗∗ Raccoon stealer-as-a-service will now try to grab your cryptocurrency ∗∗∗ --------------------------------------------- The malware has been upgraded to target even more financial information. --------------------------------------------- https://www.zdnet.com/article/raccoon-stealer-as-a-service-will-now-try-to-… ∗∗∗ CISA and NSA Release Kubernetes Hardening Guidance ∗∗∗ --------------------------------------------- The National Security Agency (NSA) and CISA have released Kubernetes Hardening Guidance, a cybersecurity technical report detailing the complexities of securely managing Kubernetes—an open-source, container-orchestration system used to automate deploying, scaling, and managing containerized applications. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/08/02/cisa-and-nsa-rele… ∗∗∗ Positive Technologies: APT group targeting government agencies around the world detected in Russia for the first time ∗∗∗ --------------------------------------------- Positive Technologies Expert Security Center (PT ESC) revealed new attacks by APT31 and analyzed its new tool—a malicious software that allows criminals to control a victim’s computer or network by using remote access. --------------------------------------------- https://www.ptsecurity.com/ww-en/about/news/positive-technologies-apt-group… ∗∗∗ PetitPotam-Angriffe auf Windows durch RPC-Filter blocken ∗∗∗ --------------------------------------------- Sicherheitsforscher haben kürzlich einen neuen Angriffsvektor namens PetitPotam offen gelegt. Mittels eines NTLM-Relay-Angriffs kann jeder Windows Domain Controller übernommen werden. --------------------------------------------- https://www.borncity.com/blog/2021/08/03/petitpotam-angriffe-auf-windows-du… ===================== = Vulnerabilities = ===================== ∗∗∗ VU#405600: Microsoft Windows Active Directory Certificate Services can allow for AD compromise via PetitPotam NTLM relay attacks ∗∗∗ --------------------------------------------- Microsoft Windows Active Directory Certificate Services (AD CS) by default can be used as a target for NTLM relay attacks, which can allow a domain-joined computer to take over the entire Active Directory. --------------------------------------------- https://kb.cert.org/vuls/id/405600 ∗∗∗ PwnedPiper: Rohrpostsysteme in US-Krankenhäusern über Firmware-Lücken angreifbar ∗∗∗ --------------------------------------------- Sicherheitslücken erlaubten Forschern die komplette Übernahme von "Translogic"-Rohrpostsystemen. Hersteller Swisslog Healthcare hat Updates veröffentlicht. --------------------------------------------- https://heise.de/-6153319 ∗∗∗ Chrome: Browser-Update für den Desktop schließt Sicherheitslücken ∗∗∗ --------------------------------------------- Für die Windows-, Linux- und macOS-Ausgaben des Chrome-Browsers ist ein Update mit insgesamt zehn Security-Fixes verfügbar. --------------------------------------------- https://heise.de/-6153994 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (chromium, nodejs, nodejs-lts-erbium, and nodejs-lts-fermium), Debian (pyxdg, shiro, and vlc), openSUSE (qemu), Oracle (lasso), Red Hat (glibc, lasso, rh-php73-php, rh-varnish6-varnish, and varnish:6), Scientific Linux (lasso), SUSE (dbus-1, lasso, python-Pillow, and qemu), and Ubuntu (exiv2, gnutls28, and qpdf). --------------------------------------------- https://lwn.net/Articles/865029/ ∗∗∗ Code Execution Flaw Found in Cisco Firepower Device Manager On-Box Software ∗∗∗ --------------------------------------------- Cisco has addressed a vulnerability in the Firepower Device Manager (FDM) On-Box software that could be exploited to gain code execution on vulnerable devices. --------------------------------------------- https://www.securityweek.com/code-execution-flaw-found-cisco-firepower-devi… ∗∗∗ Bypassing Authentication on Arcadyan Routers with CVE-2021–20090 and rooting some Buffalo ∗∗∗ --------------------------------------------- In the following sections we will look at how I took the Buffalo devices apart, did a not-so-great solder job, and used a shell offered up on UART to help find a couple of bugs that could let users bypass authentication to the web interface and enable a root BusyBox shell on telnet. --------------------------------------------- https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-ro… ∗∗∗ Spyware-ähnliche Funktionen in China-App Bejing One Pass gefunden ∗∗∗ --------------------------------------------- Ausländische Firmen, die in China tätig sind, benötigen die App Beijing One Pass, um Zugang zu einer digitalen Plattform für die Verwaltung der staatlichen Leistungen für Arbeitnehmer zu erhalten. Nun haben Sicherheitsspezialisten in dieser App Spyware ähnliche Funktionen gefunden. --------------------------------------------- https://www.borncity.com/blog/2021/08/02/spyware-hnliche-funktionen-in-chin… ∗∗∗ Security Bulletin: A vulneraqbility in SQLite affects IBM Cloud Application Performance Managment R esponse Time Monitoring Agent (CVE-2021-20227) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulneraqbility-in-sqlit… ∗∗∗ Security Bulletin: A vulnerabilty in encoding/unicode in the UTF-16 decoder has been found in x/text package before v0.3.3 for Go that could lead to an infinite loop and denial of service, affecting IBM Cloud Pak for Applications ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerabilty-in-encodin… ∗∗∗ Security Bulletin: A vulneraqbility in SQLite affects IBM Cloud Application Performance Managment R esponse Time Monitoring Agent (CVE-2021-20227) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulneraqbility-in-sqlit… ∗∗∗ Security Bulletin: Vulnerability in ksh affects AIX (CVE-2021-29741) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ksh-affe… ∗∗∗ JSA11209 ∗∗∗ --------------------------------------------- https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11209 ∗∗∗ Linux kernel vulnerability CVE-2021-33909 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K75133288?utm_source=f5support&utm_mediu… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.08.2021
by Daily end-of-shift report 02 Aug '21

02 Aug '21

===================== = End-of-Day report = ===================== Timeframe: Freitag 30-07-2021 18:00 − Montag 02-08-2021 18:00 Handler: Thomas Pribitzer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Linux eBPF bug gets root privileges on Ubuntu - Exploit released ∗∗∗ --------------------------------------------- CVE-2021-3490. A security researcher released exploit code for a high-severity vulnerability in Linux kernel eBPF (Extended Berkeley Packet Filter) that can give an attacker increased privileges on Ubuntu machines. ... If properly exploited, a local attacker could get kernel privileges to run arbitrary code on the machine. --------------------------------------------- https://www.bleepingcomputer.com/news/security/linux-ebpf-bug-gets-root-pri… ∗∗∗ Remote print server gives anyone Windows admin privileges on a PC ∗∗∗ --------------------------------------------- A researcher has created a remote print server allowing any Windows user with limited privileges to gain complete control over a device simply by installing a print driver. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/remote-print-server-gives-a… ∗∗∗ New APT Hacking Group Targets Microsoft IIS Servers with ASP.NET Exploits ∗∗∗ --------------------------------------------- A new highly capable and persistent threat actor has been targeting major high-profile public and private entities in the U.S. as part of a series of targeted cyber intrusion attacks by exploiting internet-facing Microsoft Internet Information Services (IIS) servers to infiltrate their networks. --------------------------------------------- https://thehackernews.com/2021/08/new-apt-hacking-group-targets-microsoft.h… ∗∗∗ PwnedPiper threatens thousands of hospitals worldwide, patch your systems now ∗∗∗ --------------------------------------------- Nine critical vulnerabilities in a popular hospital pneumatic tube software could give attackers control of infrastructure and allow them to launch additional attacks that cripple healthcare operations. Discovered by researchers at security platform provider Armis and dubbed PwnedPiper, the vulnerabilities are in the Nexus Control Panel software used by Translogic pneumatic tube systems (PTS) built by Swisslog Healthcare. --------------------------------------------- https://www.techrepublic.com/article/pwnedpiper-threatens-thousands-of-hosp… ∗∗∗ Vultur: Android-Trojaner späht Login-Daten für Bankkonten und E-Wallets aus ∗∗∗ --------------------------------------------- Die fernsteuerbare Malware Vultur für Android-Smartphones nutzt Funktionen zur Bildschirmaufzeichnung, um sensible Informationen auf Handys zu stehlen. --------------------------------------------- https://heise.de/-6152250 ∗∗∗ Palo Alto Networks Discloses New Attack Surface Targeting Microsoft IIS and SQL Server at Black Hat Asia 2021 ∗∗∗ --------------------------------------------- The technique allows attackers to remotely attack IIS and SQL Server to gain SYSTEM privileges by using Microsoft Jet database engine vulnerabilities. ... In response to this research, Microsoft released a complex patch to mitigate this attack surface. However, the patch is turned off by default and most Jet vulnerabilities are still not patched. We highly recommend that our customers proactively turn on mitigation to disable remote tables access in the registry and stay cautious of these kinds of attacks. --------------------------------------------- https://unit42.paloaltonetworks.com/iis-and-sql-server/ ∗∗∗ Decryptor released for Prometheus ransomware victims ∗∗∗ --------------------------------------------- Taiwanese security firm CyCraft has released a free application that can help victims of the Prometheus ransomware recover and decrypt some of their files. --------------------------------------------- https://therecord.media/decryptor-released-for-prometheus-ransomware-victim… ===================== = Vulnerabilities = ===================== ∗∗∗ Foxit PDF Reader und Editor: Updates beseitigen zahlreiche Schwachstellen ∗∗∗ --------------------------------------------- Für Foxits PDF-Software für Windows und macOS stehen Aktualisierungen bereit, die unter anderem vor Remote Code Execution-Angriffen schützen sollen. --------------------------------------------- https://heise.de/-6152683 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (389-ds-base, consul, containerd, geckodriver, powerdns, vivaldi, webkit2gtk, and wpewebkit), Debian (aspell, condor, libsndfile, linuxptp, and lrzip), and Fedora (bluez, buildah, java-1.8.0-openjdk, java-11-openjdk, java-latest-openjdk, kernel, kernel-tools, mbedtls, mingw-exiv2, mingw-python-pillow, mrxvt, python-pillow, python2-pillow, redis, and seamonkey). --------------------------------------------- https://lwn.net/Articles/864898/ ∗∗∗ MISP: Schwachstellen ermöglichen Cross-Site Scripting ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MISP ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0823 ∗∗∗ Security Bulletin: October 2020 Patch Update for Java ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-october-2020-patch-update… ∗∗∗ Security Bulletin: Apache Commons ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-commons/ ∗∗∗ Security Bulletin: Vulnerability in ksh affects AIX (CVE-2021-29741) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ksh-affe… ∗∗∗ Security Bulletin: Potential vulnerability with Node.js lodash module ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-w… ∗∗∗ Security Bulletin: Potential vulnerability with FasterXML jackson-databind ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-w… ∗∗∗ Security Bulletin: Cloud Pak for Security has several security vulnerabilities addressed in the latest version ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cloud-pak-for-security-ha… ∗∗∗ Security Bulletin: Potential vulnerability with Node.js ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-w… ∗∗∗ Security Bulletin: January 2021 Patch Update for Java ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-january-2021-patch-update… ∗∗∗ Security Bulletin: Oct 2020 Patch Update for Java ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-oct-2020-patch-update-for… ∗∗∗ Security Bulletin: IBM API Connect is impacted by multiple OpenSSL vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connect-is-impact… ∗∗∗ Security Bulletin: Potential vulnerability with Node.js ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-w… ∗∗∗ Security Bulletin: Potential vulnerability in Java ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-i… ∗∗∗ Security Bulletin: Potential vulnerability with Node.js ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-w… ∗∗∗ Security Bulletin: October 2020 Patch Update for Java ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-october-2020-patch-update… ∗∗∗ Security Bulletin: User Behavior Analytics application add on to IBM QRadar SIEM performs improper CSRF checking for some components ( CVE-2021-29757) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-user-behavior-analytics-a… ∗∗∗ Security Bulletin: Potential vulnerability with Node.js lodash module ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-w… ∗∗∗ Security Bulletin: IBM Security Privileged Identity Manager is affected by XML External Entity Injection vulnerability in WebSphere (CVE-2020-4949) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-privileged-i… ∗∗∗ Security Bulletin: Potential vulnerability with Node.js ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-w… ∗∗∗ Security Bulletin: Vulnerability in npm affects IBM VM Recovery Manager DR ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-npm-affe… ∗∗∗ Security Bulletin: Potential vulnerability in OpenSSL ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-i… ∗∗∗ Security Bulletin: Vulnerability in npm affects IBM VM Recovery Manager HA ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-npm-affe… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.07.2021
by Daily end-of-shift report 30 Jul '21

30 Jul '21

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 29-07-2021 18:00 − Freitag 30-07-2021 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ [SANS ISC] Infected With a .reg File ∗∗∗ --------------------------------------------- I published the following diary on isc.sans.edu: “Infected With a .reg File“: Yesterday, I reported a piece of malware that uses archive.org to fetch its next stage. Today, I spotted another file that is also interesting: A Windows Registry file (with a “.reg” extension). Such files are text files created by exporting values [...] --------------------------------------------- https://blog.rootshell.be/2021/07/30/sans-isc-infected-with-a-reg-file/ ∗∗∗ The Life Cycle of a Breached Database ∗∗∗ --------------------------------------------- Every time there is another data breach, we are asked to change our password at the breached entity. But the reality is that in most cases by the time the victim organization discloses an incident publicly the information has already been harvested many times over by profit-seeking cybercriminals. Heres a closer look at what typically transpires in the weeks or months before an organization notifies its users about a breached database. --------------------------------------------- https://krebsonsecurity.com/2021/07/the-life-cycle-of-a-breached-database/ ∗∗∗ Threat Spotlight: Solarmarker ∗∗∗ --------------------------------------------- Cisco Talos has observed new activity from Solarmarker, a highly modular .NET-based information stealer and keylogger.A previous staging module, "d.m," used with this malware has been replaced by a new module dubbed "Mars." --------------------------------------------- https://blog.talosintelligence.com/2021/07/threat-spotlight-solarmarker.html ∗∗∗ This Week in Security: Fail2RCE, TPM Sniffing, Fishy Leaks, and Decompiling ∗∗∗ --------------------------------------------- Fail2ban is a great tool for dynamically blocking IP addresses that show bad behavior, like making repeated login attempts. It was just announced that a vulnerability could allow an attacker [...] --------------------------------------------- https://hackaday.com/2021/07/30/this-week-in-security-fail2rce-tpm-sniffing… ∗∗∗ Bear Tracks: Infrastructure Patterns Lead to More Than 30 Active APT29 C2 Servers ∗∗∗ --------------------------------------------- RiskIQs Team Atlas has uncovered still more infrastructure actively serving WellMess/WellMail. The timing here is notable. Only one month ago, the American and Russian heads of state held a summit wherein Russias aggressive cyber campaigns topped the list of President Bidens strategic concerns. Given this context, RiskIQ’s Team Atlas paid particular attention to APT around and after this summit, which took place on June 16. This report will be of particular interest to those tracking APT29 and targets and victims of WellMess/WellMail, who may benefit from the tactical intelligence provided below. --------------------------------------------- https://www.riskiq.com/blog/external-threat-management/apt29-bear-tracks/ ∗∗∗ NSA Releases Guidance on Securing Wireless Devices While in Public ∗∗∗ --------------------------------------------- The National Security Agency (NSA) has released an information sheet with guidance on securing wireless devices while in public for National Security System, Department of Defense, and Defense Industrial Base teleworkers, as well as the general public. This information sheet provides information on malicious techniques used by cyber actors to target wireless devices and ways to protect against it. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/07/30/nsa-releases-guid… ∗∗∗ Python team fixes bug that allowed takeover of PyPI repository ∗∗∗ --------------------------------------------- The Python security team has fixed today three vulnerabilities impacting the Python Package Index (PyPI), the official repository for Python libraries, including one that could have allowed a threat actor to take full control over the portal. --------------------------------------------- https://therecord.media/python-team-fixes-bug-that-allowed-takeover-of-pypi… ===================== = Vulnerabilities = ===================== ∗∗∗ Panasonic Sanyo CCTV Network Camera 2.03-0x CSRF Disable Authentication / Change Password ∗∗∗ --------------------------------------------- The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. These actions can be exploited to perform authentication detriment and account password change with administrative privileges if a logged-in user visits a malicious web site. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5659.php ∗∗∗ Cisco Web Security Appliance Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied XML input for the web interface. An attacker could exploit this vulnerability by uploading crafted XML configuration files that contain scripting code to a vulnerable device. (Version 1.1 - Added a new fixed release.) --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Multiple Vulnerabilities Patched in WordPress Download Manager ∗∗∗ --------------------------------------------- On May 4, 2021, the Wordfence Threat Intelligence Team initiated the responsible disclosure process for WordPress Download Manager, a WordPress plugin installed on over 100,000 sites. We found two separate vulnerabilities, including a sensitive information disclosure as well as a file upload vulnerability which could have resulted in Remote Code Execution in some configurations. --------------------------------------------- https://www.wordfence.com/blog/2021/07/wordpress-download-manager-vulnerabi… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libsndfile and openjdk-11), Fedora (php-pear and seamonkey), openSUSE (fastjar and php7), SUSE (php72, qemu, and sqlite3), and Ubuntu (libsndfile, php-pear, and qpdf). --------------------------------------------- https://lwn.net/Articles/864684/ ∗∗∗ PEPPERL+FUCHS: Security Advisory for PrintNightmare Vulnerability in multiple HMI Devices ∗∗∗ --------------------------------------------- A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2021-034 ∗∗∗ Hitachi ABB Power Grids eSOMS ∗∗∗ --------------------------------------------- This advisory contains mitigations for an Insufficiently Protected Credentials vulnerability in Hitachi ABB Power Grids eSOMS management software. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-210-01 ∗∗∗ Wibu-Systems CodeMeter Runtime ∗∗∗ --------------------------------------------- This advisory contains mitigations for Buffer Over-read vulnerabilities in Wibu-Systems CodeMeter Runtime license manager software. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-210-02 ∗∗∗ Security Bulletin: De-serialization Vulnerability Affects IBM Partner Engagement Manager (CVE-2021-29781) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-de-serialization-vulnerab… ∗∗∗ Security Bulletin: Vulnerabilities in Java and WLP affects IBM Cloud Application Business Insights ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-java-a… ∗∗∗ Security Bulletin: WebSphere Application Server is vulnerable to a Privilege Escalation vulnerability (CVE-2021-29736) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-ser… ∗∗∗ Security Bulletin: Vulnerability in BIND affects AIX (CVE-2021-25215) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-bind-aff… ∗∗∗ Security Bulletin: i2 Analyze has an information disclosure vulnerability (CVE-2019-17638) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-i2-analyze-has-an-informa… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in IBM Guardium Data Encryption (GDE) ( CVE-2021-20417, CVE-2021-20415) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.07.2021
by Daily end-of-shift report 29 Jul '21

29 Jul '21

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 28-07-2021 18:00 − Donnerstag 29-07-2021 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Verschlüsselung: Windows-Verschlüsselung Bitlocker trotz TPM-Schutz umgangen ∗∗∗ --------------------------------------------- Eine mit Bitlocker verschlüsselte SSD mit TPM-Schutz lässt sich relativ einfach knacken. Ein Passwort schützt, ist aber nicht der Standard. --------------------------------------------- https://www.golem.de/news/verschluesselung-windows-verschluesselung-bitlock… ∗∗∗ Voucher von EUSC 2021 für kostenlose Hotelübernachtungen? Versteckte Kosten! ∗∗∗ --------------------------------------------- Auf Facebook und Instagram wird von „EUCS 2021“ eine Umfrage zu Tourismuspräferenzen beworben. Als Dankeschön für die Teilnahme wird ein Voucher für 3 kostenlose Übernachtungen für 2 Personen versprochen. Beim Einlösen dieses Gutscheins werden jedoch unterschiedliche Gebühren fällig. --------------------------------------------- https://www.watchlist-internet.at/news/voucher-von-eusc-2021-fuer-kostenlos… ∗∗∗ Microsoft Security Update Revisions (29. Juli 2021) ∗∗∗ --------------------------------------------- Kurzinformation für Windows-Admins im Firmenumfeld. Microsoft hat die Nacht zum 29.7.2021 revidierte Sicherheitsupdates zur Abschwächung der NTLM Relay Attacken auf Active Directory-Zertifikate und zur Schwachstelle CVE-2021-36934 (Windows Elevation of Privilege Vulnerability) veröffentlicht. Ich stelle es man unkommentiert hier zur Info [...] --------------------------------------------- https://www.borncity.com/blog/2021/07/29/microsoft-security-update-revision… ∗∗∗ DoppelPaymer ransomware gang rebrands as the Grief group ∗∗∗ --------------------------------------------- After a period of little to no activity, the DoppelPaymer ransomware operation has made a rebranding move, now going by the name Grief (a.k.a. Pay or Grief). --------------------------------------------- https://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-gang… ∗∗∗ Tools To Quickly Extract Indicators of Compromise ∗∗∗ --------------------------------------------- Brush up on indicators of compromise, their relationship to your internal threat intelligence, and tools to help you quickly extract them from PDFs and plain text. --------------------------------------------- https://www.domaintools.com/resources/blog/tools-to-quickly-extract-indicat… ∗∗∗ APT trends report Q2 2021 ∗∗∗ --------------------------------------------- This is our latest summary of advanced persistent threat (APT) activity, focusing on significant events that we observed during Q2 2021: attacks against Microsoft Exchange servers, APT29 and APT31 activities, targeting campaigns, etc. --------------------------------------------- https://securelist.com/apt-trends-report-q2-2021/103517/ ∗∗∗ Reboot of PunkSpider Tool at DEF CON Stirs Debate ∗∗∗ --------------------------------------------- Researchers plan to introduce a revamp of PunkSpider, which helps identify flaws in websites so companies can make their back-end systems more secure, at DEF CON. --------------------------------------------- https://threatpost.com/punkspider-def-con-debate/168223/ ∗∗∗ Six Malicious Linux Shell Scripts Used to Evade Defenses and How to Stop Them ∗∗∗ --------------------------------------------- Uptycs Threat Research outline how malicious Linux shell scripts are used to cloak attacks and how defenders can detect and mitigate against them. --------------------------------------------- https://threatpost.com/six-malicious-linux-shell-scripts-how-to-stop-them/1… ∗∗∗ BazaCall: Phony call centers lead to exfiltration and ransomware ∗∗∗ --------------------------------------------- Our continued investigation into BazaCall campaigns, those that use fraudulent call centers that trick unsuspecting users into downloading the BazaLoader malware, shows that this threat is more dangerous than what’s been discussed publicly in other security blogs and covered by the media. --------------------------------------------- https://www.microsoft.com/security/blog/2021/07/29/bazacall-phony-call-cent… ∗∗∗ Malicious Content Delivered Through archive.org, (Thu, Jul 29th) ∗∗∗ --------------------------------------------- archive.org[1], also known as the "way back machine" is a very popular Internet site that allows you to travel back in time and browse old versions of a website (like the ISC website[2]). It works like regular search engines and continuously crawls the internet via bots. But there is another way to store content on archive.org: You may create an account and upload some content by yourself. --------------------------------------------- https://isc.sans.edu/diary/rss/27688 ∗∗∗ Stylish Magento Card Stealer loads Without Script Tags ∗∗∗ --------------------------------------------- Recently one of our analysts, Weston H., found a very interesting credit card stealer in a Magento environment which loads a malicious JavaScript without using any script tags. In this post I will go over how it was found, how to decode it and how it works! --------------------------------------------- https://blog.sucuri.net/2021/07/stylish-magento-card-stealer-loads-without-… ∗∗∗ Crimea "manifesto" deploys VBA Rat using double attack vectors ∗∗∗ --------------------------------------------- On July 21, 2021, we identified a suspicious document named "Манифест.docx" ("Manifest.docx") that downloads and executes two templates: one is macro-enabled and the other is an html object that contains an Internet Explorer exploit. While both techniques rely on template injection to drop a full-featured Remote Access Trojan, the IE exploit (CVE-2021-26411) previously used by the Lazarus APT is an unusual discovery. --------------------------------------------- https://blog.malwarebytes.com/threat-intelligence/2021/07/crimea-manifesto-… ∗∗∗ “Netfilter Rootkit II ” Continues to Hold WHQL Signatures ∗∗∗ --------------------------------------------- Recently, 360 Security Center discovered that a malicious driver “Netfilter rootkit” with WHQL signature was revealed in mid-June. WHQL signature means that after the [...] --------------------------------------------- https://blog.360totalsecurity.com/en/netfilter-rootkit-ii-continues-to-hold… ∗∗∗ Turn Off, Turn On: Simple Step Can Thwart Top Phone Hackers ∗∗∗ --------------------------------------------- Regularly rebooting smartphones can make even the most sophisticated hackers work harder to maintain access and steal data from a phone --------------------------------------------- https://www.securityweek.com/turn-turn-simple-step-can-thwart-top-phone-hac… ∗∗∗ McAfee: Babuk ransomware decryptor causes encryption beyond repair ∗∗∗ --------------------------------------------- Babuk announced earlier this year that it would be targeting Linux/UNIX and ESXi or VMware systems with ransomware. --------------------------------------------- https://www.zdnet.com/article/mcafee-babuk-ransomware-decryptor-causes-encr… ∗∗∗ New Android malware records smartphones via VNC to steal passwords ∗∗∗ --------------------------------------------- Security researchers have discovered a novel piece of Android malware that uses the VNC technology to record a victims smartphone screen in order to collect and steal their passwords. --------------------------------------------- https://therecord.media/new-android-malware-records-smartphones-via-vnc-to-… ∗∗∗ Communication during a hacker attack ∗∗∗ --------------------------------------------- You cannot trust your office PC during a major incident. You can neither trust your usual communication and collaboration tools. If an attacker can authenticate on any domain-joined device with any domain user, the game is over. --------------------------------------------- https://securityguide.me/issues/communication-during-a-hacker-attack ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-21-909: (0Day) Microsoft 3D Viewer 3MF File Parsing Use-After-Free Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft 3D Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-21-909/ ∗∗∗ Drupal: Wichtiges Sicherheitsupdate für "Pages Restriction Access"-Modul ∗∗∗ --------------------------------------------- Ein Update für "Pages Restriction Access" für die 8er-Versionsreihe des CMS Drupal beseitigt Zugriffsmöglichkeiten über eine kritische Sicherheitslücke. --------------------------------------------- https://heise.de/-6150416 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (webkit2gtk), Fedora (ruby and webkit2gtk3), Mageia (aspell and varnish), openSUSE (git), SUSE (ardana-cobbler, cassandra, cassandra-kit, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-heat-templates, openstack-monasca-installer, openstack-nova, python-Django, python-elementpath, python-eventlet, python-py, python-pysaml2, python-six, python-xmlschema and git), and Ubuntu (libsndfile, mariadb-10.3, and [...] --------------------------------------------- https://lwn.net/Articles/864577/ ∗∗∗ Tomcat vulnerability CVE-2021-30640 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K35033051 ∗∗∗ Apache Tomcat vulnerability CVE-2021-30639 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K87895241 ∗∗∗ Security Bulletin: Multiple vulnerabilities in OpenSSL affects IBM InfoSphere Information Server ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: glibc vulnerability affects IBM Elastic Storage System (CVE-2021-27219) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-glibc-vulnerability-affec… ∗∗∗ Security Bulletin: A vulnerability in IBM WebSphere Application Server Liberty affects IBM Elastic Storage System (CVE-2020-5258) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-we… ∗∗∗ Security Bulletin: IBM® Db2® could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. (CVE-2020-4739) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-could-allow-a-loc… ∗∗∗ Security Bulletin: This Power System update is being released to address CVE 2021-20505 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-this-power-system-update-… ∗∗∗ Security Bulletin: A vulnerability in IBM WebSphere Application Server affects IBM Spectrum Scale. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-we… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities fixed in Openssl as shipped with IBM Security Verify products ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.07.2021
by Daily end-of-shift report 28 Jul '21

28 Jul '21

===================== = End-of-Day report = ===================== Timeframe: Dienstag 27-07-2021 18:00 − Mittwoch 28-07-2021 18:00 Handler: Robert Waldner Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Haron and BlackMatter are the latest groups to crash the ransomware party ∗∗∗ --------------------------------------------- The additions come as the number of high-severity ransomware attacks ratchet up. --------------------------------------------- https://arstechnica.com/?p=1783582 ∗∗∗ LockBit ransomware now encrypts Windows domains using group policies ∗∗∗ --------------------------------------------- An new version of the LockBit 2.0 ransomware has been found that automates the encryption of a Windows domain using Active Directory group policies. --------------------------------------------- https://www.bleepingcomputer.com/news/security/lockbit-ransomware-now-encry… ∗∗∗ Sicherheitswarnung: BSI sieht kaum Schutzmöglichkeiten vor Pegasus ∗∗∗ --------------------------------------------- Das BSI hat eine offizielle Warnung vor der Spionagesoftware Pegasus veröffentlicht. Die Bedrohungslage wird aber nicht als kritisch eingestuft. --------------------------------------------- https://www.golem.de/news/sicherheitswarnung-bsi-sieht-kaum-schutzmoeglichk… ∗∗∗ UBEL is the New Oscorp — Android Credential Stealing Malware Active in the Wild ∗∗∗ --------------------------------------------- An Android malware that was observed abusing accessibility services in the device to hijack user credentials from European banking applications has morphed into an entirely new botnet as part of a renewed campaign that began in May 2021. --------------------------------------------- https://thehackernews.com/2021/07/ubel-is-new-oscorp-android-credential.html ∗∗∗ Top 25 der Sicherheitslücken: Buffer Overflows als größte Gefahrenquelle ∗∗∗ --------------------------------------------- Eine kürzlich veröffentlichte Auswertung von häufigen Softwareschwachstellen liefert eine Übersicht über die 25 gefährlichsten Arten. --------------------------------------------- https://heise.de/-6148053 ∗∗∗ Vorsicht bei der Urlaubsbuchung: BetrügerInnen geben sich als türkische Luxus-Hotels aus! ∗∗∗ --------------------------------------------- Wer einen Urlaub in der Türkei buchen will, sollte sich vor BetrügerInnen in Acht nehmen, die Webseiten türkischer Luxus-Hotels kopieren. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-bei-der-urlaubsbuchung-betr… ∗∗∗ THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group ∗∗∗ --------------------------------------------- We provide a technical overview of the previously unseen PlugX variant THOR, indicators of compromise and a new tool for payload decryption. --------------------------------------------- https://unit42.paloaltonetworks.com/thor-plugx-variant/ ∗∗∗ Ransomware Families: 2021 Data to Supplement the Unit 42 Ransomware Threat Report ∗∗∗ --------------------------------------------- We discuss the propagation of different ransomware families we observed in the wild in early 2021 and the different types of extortion used. --------------------------------------------- https://unit42.paloaltonetworks.com/ransomware-families/ ∗∗∗ Top Routinely Exploited Vulnerabilities ∗∗∗ --------------------------------------------- CISA, the Australian Cyber Security Centre (ACSC), the United Kingdom’s National Cyber Security Centre (NCSC), and the U.S. Federal Bureau of Investigation (FBI) have released the Joint Cybersecurity Advisory Top Routinely Exploited Vulnerabilities, which details the top vulnerabilities routinely exploited by malicious actors in 2020 and those being widely exploited thus far in 2021. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2021/07/28/top-routinely-exp… ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Microsoft Hyper-V bug could haunt orgs for a long time ∗∗∗ --------------------------------------------- Technical details are now available for a vulnerability that affects Hyper-V, Microsofts native hypervisor for creating virtual machines on Windows systems and in Azure cloud computing environment. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-microsoft-hyper-v-b… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (golang), Mageia (curl, filezilla, jdom/jdom2, netty, pdfbox, perl-Mojolicious, perl-Net-CIDR-Lite, perl-Net-Netmask, python-urllib3, python3, quassel, transfig, and virtualbox), openSUSE (umoci), Red Hat (rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon and rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon), and SUSE (firefox, glibc, libsndfile, linuxptp, qemu, and umoci). --------------------------------------------- https://lwn.net/Articles/864497/ ∗∗∗ Security Bulletin: A security vulnerability in Ruby on Rails affects IBM Cloud Pak for Multicloud Management Infrastructure Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Oracle Database Server Vulnerability Affects IBM Emptoris Supplier Lifecycle Mgmt (CVE-2021-2207) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-oracle-database-server-vu… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Vulnerabilities Affect IBM Emptoris Contract Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Vulnerabilities Affect IBM Emptoris Program Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: Vulnerability deferred from Oracle Oct 2020 CPU for Java 8 (CVE-2020-14781 ) may affect IBM® SDK, Java™ Technology Edition and IBM Operations Analytics Predictive Insights ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-deferred-fr… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Vulnerabilities Affect IBM Emptoris Sourcing ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: IBM Analyst's Notebook Premium uses a component with known vulnerabilities (CVE-2020-16013, CVE-2020-16009, CVE-2020-15999) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-analysts-notebook-pre… ∗∗∗ Security Bulletin: Vulnerabilities in Java and WLP affects IBM Cloud Application Business Insights ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-java-a… ∗∗∗ Security Bulletin: Vulnerabilities in IBM Guardium Data Encryption (GDE) (CVE-2020-7676) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-gu… ∗∗∗ Security Bulletin: Vulnerability in npm affects IBM VM Recovery Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-npm-affe… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: HTTP Header Vulnerability Affects IBM Sterling Connect:Direct Browser User Interface (CVE-2021-20560) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-http-header-vulnerability… ∗∗∗ Security Bulletin: Multiple vulnerabilites affect Engineering Lifecycle Management and IBM Engineering products. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilites-a… ∗∗∗ Security Bulletin: RabbitMQ as used by IBM QRadar SIEM is vulnerable to unsafe deserialization (CVE-2020-36282) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-rabbitmq-as-used-by-ibm-q… ∗∗∗ Security Bulletin: Information disclosure vulnerability in IBM i2 Analyze (CVE-2021-29766) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-information-disclosure-vu… ∗∗∗ Security Bulletin: IBM Transparent Could Tiering is affected by a vulnerability in Apache Commons IO ( CVE-2021-29425) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-transparent-could-tie… ∗∗∗ Security Bulletin: i2 Analyse and Analyst's Notebook Premium have hyperlink clicking vulnerability (CVE-2021-29770) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-i2-analyse-and-analysts-n… ∗∗∗ Security Bulletin: Vulnerability in npm affects IBM VM Recovery Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-npm-affe… ∗∗∗ SECURITY BULLETIN: July 28, 2021, Security Bulletin for Worry-Free Business Security ∗∗∗ --------------------------------------------- https://success.trendmicro.com/solution/000287820 ∗∗∗ SECURITY BULLETIN: July 28, 2021, Security Bulletin for Trend Micro Apex One and Apex One as a Service ∗∗∗ --------------------------------------------- https://success.trendmicro.com/solution/000287819 ∗∗∗ MISP: Schwachstelle ermöglicht Cross-Site Scripting ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0814 ∗∗∗ KUKA KR C4 ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-208-01 ∗∗∗ Mitsubishi Electric GOT2000 series and GT SoftGOT2000 ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-208-02 ∗∗∗ Geutebrück G-Cam E2 and G-Code ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03 ∗∗∗ LCDS LAquis SCADA ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-208-04 ∗∗∗ Delta Electronics DIAScreen ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-21-208-05 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.07.2021
by Daily end-of-shift report 27 Jul '21

27 Jul '21

===================== = End-of-Day report = ===================== Timeframe: Montag 26-07-2021 18:00 − Dienstag 27-07-2021 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Failed Malspam: Recovering The Password, (Mon, Jul 26th) ∗∗∗ --------------------------------------------- Jan's diary entry "One way to fail at malspam - give recipients the wrong password for an encrypted attachment" got my attention: it's an opportunity for me to do some password cracking. --------------------------------------------- https://isc.sans.edu/diary/rss/27674 ∗∗∗ Hiding Malware in ML Models ∗∗∗ --------------------------------------------- “EvilModel: Hiding Malware Inside of Neural Network Models”. --------------------------------------------- https://www.schneier.com/blog/archives/2021/07/hiding-malware-in-ml-models.… ∗∗∗ OSX.XLoader hides little except its main purpose: What we learned in the installation process ∗∗∗ --------------------------------------------- We dig into OSX.XLoader, also known as X Loader, which is the latest threat to macOS that bears some similarities to novice malware. --------------------------------------------- https://blog.malwarebytes.com/mac/2021/07/osx-xloader-hides-little-except-i… ∗∗∗ Malware developers turn to exotic programming languages to thwart researchers ∗∗∗ --------------------------------------------- They are focused on exploiting pain points in code analysis and reverse-engineering. --------------------------------------------- https://www.zdnet.com/article/malware-developers-turn-to-exotic-programming… ∗∗∗ Wie MSPs am besten mit der Ransomware-Krise umgehen können ∗∗∗ --------------------------------------------- Managed Service Provider (MSPs) spielen eine kritische Rolle im Kampf gegen Schadsoftware. Allerdings traf die Ransomware-Attacke auf Kaseya dutzende von MSPs mit voller Wucht und dadurch mittelbar auch deren Kunden. --------------------------------------------- https://www.zdnet.de/88395971/wie-msps-am-besten-mit-der-ransomware-krise-u… ∗∗∗ Praying Mantis APT targets IIS servers with ASP.NET exploits ∗∗∗ --------------------------------------------- A new advanced persistent threat (APT) group has been seen carrying out attacks against Microsoft IIS web servers using old exploits in ASP.NET applications in order to plant a backdoor and then pivot to companys internal networks. --------------------------------------------- https://therecord.media/praying-mantis-apt-targets-iis-servers-with-asp-net… ===================== = Vulnerabilities = ===================== ∗∗∗ Apple fixes zero-day affecting iPhones and Macs, exploited in the wild ∗∗∗ --------------------------------------------- Apple has released security updates to address a zero-day vulnerability exploited in the wild and impacting iPhones, iPads, and Macs. --------------------------------------------- https://www.bleepingcomputer.com/news/apple/apple-fixes-zero-day-affecting-… ∗∗∗ Researchers warn of unpatched Kaseya Unitrends backup vulnerabilities ∗∗∗ --------------------------------------------- Security researchers warn of new zero-day vulnerabilities in the Kaseya Unitrends service and advise users not to expose the service to the Internet. --------------------------------------------- https://www.bleepingcomputer.com/news/security/researchers-warn-of-unpatche… ∗∗∗ Moodle: Neue Versionen beseitigen Remote-Angriffsmöglichkeit via Shibboleth ∗∗∗ --------------------------------------------- Mehrere Versionen der Lernplattform sind, allerdings nur bei aktivierter Shibboleth-Authentifizierung, aus der Ferne angreifbar. Updates stehen bereit. --------------------------------------------- https://heise.de/-6148879 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (drupal7), Fedora (linux-firmware), openSUSE (qemu), Oracle (kernel and thunderbird), Red Hat (thunderbird), Scientific Linux (java-1.8.0-openjdk, java-11-openjdk, kernel, and thunderbird), SUSE (dbus-1, libvirt, linuxptp, qemu, and slurm), and Ubuntu (aspell and mysql-5.7, mysql-8.0). --------------------------------------------- https://lwn.net/Articles/864439/ ∗∗∗ Vulnerabilities Allow Hacking of Zimbra Webmail Servers With Single Email ∗∗∗ --------------------------------------------- Vulnerabilities in the Zimbra enterprise webmail solution could allow an attacker to gain unrestricted access to an organization’s sent and received email messages, software security firm SonarSource reveals. --------------------------------------------- https://www.securityweek.com/vulnerabilities-allow-hacking-zimbra-webmail-s… ∗∗∗ Security Bulletin: A security vulnerability in Golang Go affects IBM Cloud Pak for Multicloud Management Managed services ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: XSS Security Vulnerabilty Affects Mailbox UI of IBM Sterling B2B Integrator (CVE-2021-20562) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-xss-security-vulnerabilty… ∗∗∗ Security Bulletin: A security vulnerability in Ruby on Rails affects IBM Cloud Pak for Multicloud Management Infrastructure Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: GRUB2 as used by IBM QRadar SIEM is vulnerable to arbitrary code execution ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-grub2-as-used-by-ibm-qrad… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to an XML External Entity Injection (XXE) attack (CVE-2021-20399) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ MIT Kerberos: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0809 ∗∗∗ VLC: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0807 ∗∗∗ Foxit Reader: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K21-0812 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily