======================= = End-of-Shift report = =======================
Timeframe: Mittwoch 19-03-2014 18:00 − Donnerstag 20-03-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter
*** ZBOT Adds Clickbot Routine To Arsenal *** --------------------------------------------- The ZeuS/ZBOT malware family is probably one of the most well-known malware families today . It is normally known for stealing credentials associated with online banking accounts. However, ZBOT is no one-trick pony. Some ZBOT variants perform other routines like downloading or dropping other threats like ransomware. We recently came across one variant detected as TROJ_ZCLICK.A,... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/rrelQiGbzao/
*** New BlackOS Software Package Sold In Underground Forums *** --------------------------------------------- We recently came across this particular post in an underground forum: Figure 1. Underground forum post This particular post in Russian was advertising a new product, known as "BlackOS". Contrary to the name, it is not an operating system. However, it is definitely "black", or malicious: it is used to manage and redirect Internet traffic... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/mA8O58qz-TQ/
*** Phishing: Gehackter EA-Server hostet falsche Apple-Webseite *** --------------------------------------------- Kriminelle Hacker haben auf Servern des Spieleherstellers Electronic Arts eine gefälschte Webseite untergebracht, die Apple-IDs samt Passwörtern und Kreditkarteninformationen verlangt. Wie viele Nutzer ihre Daten dort eingegeben haben, ist nicht bekannt. --------------------------------------------- http://www.golem.de/news/phishing-gehackter-ea-server-hostet-falsche-apple-w...
*** "goto fail": Apple drängt Nutzer zum Update *** --------------------------------------------- Der Mac-Hersteller fordert inzwischen dazu auf, das Update auf OS X 10.9.2 alsbald möglich zu installieren - falls noch nicht geschehen. Ältere Versionen von OS X Mavericks und iOS weisen eine gravierende SSL-Schwachstelle auf. --------------------------------------------- http://www.heise.de/security/meldung/goto-fail-Apple-draengt-Nutzer-zum-Upda...
*** Android: Sicherheitslücken wegen fehlender Updates bleiben Problem *** --------------------------------------------- 70 Prozent aller Android-Geräte weltweit besitzen eine Browser-Lücke, glaubt ein Forscher. Der simple Aufruf einer Website reicht, um sie auszunutzen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Android-Sicherheitsluecken-wegen-fehl...
*** Analysis: Spam report: February 2014 *** --------------------------------------------- The share of spam in global email traffic decreased by 7.6 percentage points and averaged 65.7% in January. As forecasted, the drop in the share of spam was due to a lull early in January when there is less business activity and a large number of botnets are turned off. --------------------------------------------- http://www.securelist.com/en/analysis/204792328/Spam_report_February_2014
*** Protokollanalyse: Mogeln im Quizduell *** --------------------------------------------- Entwickler verlassen sich zu sehr auf HTTPS und verzichten auf grundlegende Sicherheitsmaßnahmen. Über eine Man-in-the-Middle-Attacke konnten Security-Forscher in den Datenverkehr zwischen App-Server und Apps hineinsehen - und entdeckten Sonderbares. --------------------------------------------- http://www.golem.de/news/protokollanalyse-mogeln-im-quizduell-1403-105276-rs...
*** Cisco IronPort AsyncOS Software for ESA and SMA File Validation Flaw Lets Remote Authenticated Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1029937
*** SA-CONTRIB-2014-033 - Nivo Slider - Cross Site Scripting *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-033Project: Nivo Slider (third-party module)Version: 7.xDate: 2014-March-19Security risk: Moderately criticalExploitable from: RemoteVulnerability: Cross Site ScriptingDescriptionNivo Slider provides a way to showcase featured content. Nivo Slider gives administrators a simple method of adding slides to the slideshow, an administration interface to configure slideshow settings, and simple slider positioning using the Drupal block system.The module doesnt... --------------------------------------------- https://drupal.org/node/2221481