[CERT-daily] Tageszusammenfassung - Donnerstag 3-01-2013

Thu Jan 3 18:11:53 CET 2013

=======================
= End-of-Shift report =
=======================
Timeframe:   Mittwoch 02-01-2013 18:00 − Donnerstag 03-01-2013 18:00
Handler:     Matthias Fraidl
Co-Handler:  L. Aaron Kaplan

*** BSI warnt vor Sicherheitslücke im VLC Media Player ***
---------------------------------------------
Das Bundesamt für Sicherheit in der Informationstechnik rät Nutzern der populären quelloffenen Videoabspielsoftware, auf die aktuelle Version 2.0.5 umzusteigen.
---------------------------------------------
http://rss.feedsportal.com/c/32407/f/463925/s/27218c1d/l/0L0Sheise0Bde0Cmeldung0CBSI0Ewarnt0Evor0ESicherheitsluecke0Eim0EVLC0EMedia0EPlayer0E17759860Bhtml0Cfrom0Crss0A9/story01.htm


*** Energy Manufacturer Also Victimized by IE Zero Day in Watering Hole Attack ***
---------------------------------------------
"This weeks watering hole attack exploiting a zero-day vulnerability in Internet Explorer was not limited to the influential Council on Foreign Relations site. A Metasploit contributor said an energy manufacturers website has been serving malware related to the attack since September. Researcher Eric Romang said that Capstone Turbine Corp., which builds power generation equipment for utilities, has been infected with malware exploiting CVE 2012-4969 for four months and the latest IE
---------------------------------------------
http://threatpost.com/en_us/blogs/energy-manufacturer-also-victimized-ie-zero-day-watering-hole-attack-010213


*** 6 Big cyber security predictions for 2013 ***
---------------------------------------------
"If there is any weakness in security, you can guarantee the criminals will try to exploit it. And if a cyber criminal discovers a weakness in one community, it wont be long before that isolated crime turns into a trend. The commercialization of malware is rapidly becoming a well-organized and highly lucrative business...."
---------------------------------------------
http://venturebeat.com/2013/01/02/6-big-cyber-security-predictions-for-2013/


*** Malware SNEAK dons cunning disguise, opens creaky back door to servers ***
---------------------------------------------
Java-based exploit targets web-hosting servers A malicious backdoor designed to infect web servers poses a severe threat, Trend Micro warns.
---------------------------------------------
http://go.theregister.com/feed/www.theregister.co.uk/2013/01/03/web_server_backdoor_peril/


*** A New Way of Detecting Cybersecurity Attacks ***
---------------------------------------------
"Rajeev Bhargava is an acknowledged pioneer in the networking and software industry, and CEO of Toronto-based Decision Zone Inc. His career spans more than 30 years within the engineering and IT industry, and he has been closely associated with many of its major developments. Rajeev has advised many of North Americas largest organizations within the telecom, financial, high tech, military, retail, aerospace and government industries. He is the inventor of an anomaly detection solution used
---------------------------------------------
http://www.digitalcommunities.com/articles/A-New-Way-of-Detecting-Cyber-Security-Attacks.html


*** Lücke in Ruby on Rails erlaubt SQL-Injections ***
---------------------------------------------
Alle aktuellen Versionen des Fameworks Ruby on Rails sind von einer Sicherheitslücke betroffen, die das Einschleusen von beliebigem SQL-Code ermöglicht. Nutzer sollten ihre Software möglichst schnell aktualisieren.
---------------------------------------------
http://www.heise.de/meldung/Luecke-in-Ruby-on-Rails-erlaubt-SQL-Injections-1776279.html/from/atom10


*** Virenverseuchte Dia-Scanner bei Tchibo verkauft ***
---------------------------------------------
Der Kaffeeröster Tchibo hat in der Vorweihnachtszeit des vergangenen Jahres einen virenverseuchten Dia-Scanner verkauft. Das Gerät wurde ab dem 11. Dezember 2012 für 60 Euro über die Filialen und den Tchibo-Onlineshop angeboten.
---------------------------------------------
http://www.heise.de/meldung/Virenverseuchte-Dia-Scanner-bei-Tchibo-verkauft-1776500.html/from/atom10


*** Invasion of the Botnets ***
---------------------------------------------
"Millions and millions of PCs have been silently infiltrated with bot malware, creating massive bot armies, poised to steal and inflict maximum damage when triggered by their Bot Commander. There are several botnets each comprising millions of compromised PCs, such as Zeus, Conficker, Mariposa, ZeroAccess and BredoLab, waiting for the next command from their Bot Commander, so that they can spring into action and obediently carry out their strike orders like a well-disciplined and
---------------------------------------------
http://dwaterson.com/2013/01/02/invasion-of-the-botnets/


*** Cloud security to be most disruptive technology of 2013 ***
---------------------------------------------
"The Security for Business Innovation Council, comprised of IT security professionals from 19 companies worldwide, called cloud computing the main disruptive force for 2013. In its report, "Information Security Shake-Up," the group said it was evident many organizations are preparing to move more business processes to the cloud. This year, it will even be "mission-critical apps and regulated data" consigned to the cloud...."
---------------------------------------------
http://www.networkworld.com/news/2013/010313-cloud-security-265437.html


*** Facebook-Lücke erlaubte unbemerkte Webcam-Aufnahmen ***
---------------------------------------------
Rund vier Monate nachdem zwei Sicherheitsforscher eine Schwachstelle in Facebooks Video-Upload-Funktion meldeten, soll de Lücke geschlossen worden sein. Die Entdecker sind überrascht über die Höhe der von Facebook gezahlten Belohnung.
---------------------------------------------
http://rss.feedsportal.com/c/32407/f/463925/s/2729d37e/l/0L0Sheise0Bde0Cmeldung0CFacebook0ELuecke0Eerlaubte0Eunbemerkte0EWebcam0EAufnahmen0E17763390Bhtml0Cfrom0Crss0A9/story01.htm