======================= = End-of-Shift report = =======================
Timeframe: Donnerstag 13-10-2016 18:00 − Freitag 14-10-2016 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl
*** Gezinkte Primzahlen ermöglichen Hintertüren in Verschlüsselung *** --------------------------------------------- Ein Forscherteam hat aufgezeigt, dass man durch geschickte Konstruktion einer Primzahl eine Hintertür in Verschlüsselungsverfahren einbauen kann. Nicht auszuschließen, dass dies bei etablierten Verfahren längst passiert ist. --------------------------------------------- https://heise.de/-3347585
*** Security through Confusion – The FUD Factor *** --------------------------------------------- The FUD factor has been employed by sales and marketing teams from multiple industries for decades. It stands for fear, uncertainty and doubt (FUD) and first appeared in the 70’s as a tactic used by competitors in the computer .. --------------------------------------------- https://blog.sucuri.net/2016/10/security-confusion-fud-factor.html
*** Cyber Europe 2016: the pan-European exercise to protect EU Infrastructures against coordinated cyber-attack *** --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/cyber-europe-2016
*** Floating Down .Stream (Shady TLD Research, Part 17) *** --------------------------------------------- The end of September means the leaves are starting to change -- and our quarterly Top Ten list of the shadiest TLDs is changing as well, with three newcomers since last time .. --------------------------------------------- https://www.bluecoat.com/security-blog/2016-10-13/floating-down-stream-shady...
*** OSIsoft PI Web API 2015 R2 Service Account Permissions Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a permissions vulnerability in OSIsoft’s PI Web API. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-287-01
*** Siemens Automation License Manager Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for vulnerabilities in Siemen’s Automation License Manager (ALM). --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-287-02
*** Rockwell Automation Stratix Denial-of-Service and Memory Leak Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for vulnerabilities contained in Rockwell Automation’s Allen-Bradley Stratix industrial switches. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-287-04
*** Moxa ioLogik E1200 Series Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for vulnerabilities in Moxas ioLogik E1200 series application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-287-05
*** Fatek Automation Designer Memory Corruption Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for a heap memory corruption and two stack buffer overflow vulnerabilities in Fatek’s Automation PM and FV Designer applications. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-287-06
*** Kabona AB WDC Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for vulnerabilities in Kabona AB’s WebDatorCentral (WDC) application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-287-07
*** Pork Explosion flaw splatters Foxconns Android phones *** --------------------------------------------- Full compromise over USB bacon-ed in to smartmobes Security researcher John Sawyer says a limited backdoor has been found in some Foxconn-manufactured Android phones, allowing attackers to root phones they have in hand. --------------------------------------------- www.theregister.co.uk/2016/10/14/pork_explosion_foxconn_flaw/
*** LockyDump - All Your Configs Are Belong To Us *** --------------------------------------------- This post will discuss a new Locky configuration extractor that Talos is releasing, which we are naming LockyDump. This is the first open source tool which can dump .. --------------------------------------------- http://blog.talosintel.com/2016/10/lockydump.html
*** Quickly audit and adjust SSH server configurations with SSH-audit *** --------------------------------------------- SSH-audit is a standalone open source tool for auditing and fixing SSH server configurations. It has no dependencies and will run wherever Python is available. It supports OpenSSH, Dropbear SSH and libssh, and reports on every detail of the tested SSH server, including detailed information about .. --------------------------------------------- https://www.helpnetsecurity.com/2016/10/14/ssh-audit-fix-ssh-server-configur...
*** Magento-Updates: Checkout-Prozess als Einfallstor für Angreifer *** --------------------------------------------- Sicherheits-Patches für das Shop-System schließen mehrere Lücken. Zwei davon gelten als kritisch. --------------------------------------------- https://heise.de/-3350195
*** Apache OpenOffice 4.1.3 *** --------------------------------------------- Apache OpenOffice 4.1.3 ist ein Release zur Fehlerbeseitigung, welches Sicherheitsprobleme beseitigt, Wörterbücher aktualisiert und einige sonstige bekannte Fehler korrigiert. Allen Benutzern von Apache Openoffice 4.1.2 oder älteren Versionen wird empfohlen zu aktualisieren. --------------------------------------------- https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=65873798
*** SSHowDowN: Zwölf Jahre alter OpenSSH-Bug gefährdet unzählige IoT-Geräte *** --------------------------------------------- Akamai warnt davor, dass Kriminelle unvermindert Millionen IoT-Geräte für DDoS-Attacken kapern. Die dafür ausgenutzte Lücke ist älter als ein Jahrzehnt. Viele Geräte sollen sich nicht patchen lassen. --------------------------------------------- https://www.heise.de/newsticker/meldung/SSHowDowN-Zwoelf-Jahre-alter-OpenSSH...
*** Cyber-attacks Against Nuclear Plants: A Disconcerting Threat *** --------------------------------------------- Introduction A cyber-attack against critical infrastructure could cause the paralysis of critical operations with serious consequences for a country and its population. In a worst case scenario, a cyber-attack could affect processes that in .. --------------------------------------------- http://resources.infosecinstitute.com/cyber-attacks-against-nuclear-plants-a...
*** Wosign und Startcom: Mozilla macht Ernst mit dem Rauswurf *** --------------------------------------------- Mozilla hat auf der Entwicklermailingliste angekündigt, Zertifikaten von Wosign und Startcom mit der übernächsten Firefox Version 51 nicht mehr zu vertrauen. Die Version ist für den kommenden Januar geplant. --------------------------------------------- http://www.golem.de/news/wosign-und-startcom-mozilla-macht-ernst-mit-dem-rau...
*** GlobalSign annulliert versehentlich Zertifikate von vielen Webseiten *** --------------------------------------------- Aktuell warnen einige Webbrowser davor, dass Verbindungen zu Webseiten wie etwa Wikipedia nicht mehr gesichert sind, da mit dem Zertifikat der Seite etwas nicht stimmt. --------------------------------------------- https://heise.de/-3350544
*** IT-Experten des Bundesheeres finden kritische Lücke in Microsoft Office *** --------------------------------------------- Analyse eines Cyberangriffs – Schwachstelle wurde 11. Oktober mit einem Update beseitigt --------------------------------------------- http://derstandard.at/2000045921807