[CERT-daily] Tageszusammenfassung - Mittwoch 23-01-2013

Wed Jan 23 18:06:40 CET 2013

=======================
= End-of-Shift report =
=======================
Timeframe:   Dienstag 22-01-2013 18:00 − Mittwoch 23-01-2013 18:00
Handler:     Matthias Fraidl
Co-Handler:  Christian Wojner


*** Have a Wi-Fi-Enabled Phone? Stores Are Tracking You ***
---------------------------------------------
jfruh writes "Call it Google Analytics for physical storefronts: if youve got a phone with wi-fi, stores can detect your MAC address and track your comings and goings, determining which aisles you go to and whether youre a repeat customer. The creator of one of the most popular tracking software packages says that the addresses are hashed and not personally identifiable, but it might make you think twice about leaving your phone on when you head to the mall."    Read more of this
---------------------------------------------
http://rss.slashdot.org/~r/Slashdot/slashdot/~3/RGkVUafw2-M/story01.htm


*** Skype becomes a malware minefield ***
---------------------------------------------
"Skype users should be careful when using the service these days. First CSIS researchers unearthed a campaign misusing Skype to replicate and spread the Shylock banking Trojan with a plugin called msg. gsm that, when it was first spotted five days ago, was detected by none of the AV solutions used by VirusTotal...."
---------------------------------------------
http://www.net-security.org/malware_news.php?id=2383


*** Red October spy ring also used "Rhino" Java exploit ***
---------------------------------------------
"A cyber espionage campaign that was recently unearthed by researchersused a now-patched vulnerability in Java software as another tool to exploit victims machines. Security firm Seculert published a blog post Tuesday saying that the "Red October" spy campaign, in addition to leveraging weaknesses in Microsoft Office, also spread malware by taking advantage of a Java flaw in the Rhino Script Engine, CVE-2011- 3544, fixed in October 2011. After investigating the
---------------------------------------------
http://cyberwarzone.com/red-october-spy-ring-also-used-rhino-java-exploit


*** Paypal.com Blind SQL Injection ***
---------------------------------------------
Topic: Paypal.com Blind SQL Injection Risk: Medium Text:Title: Paypal Bug Bounty #18 - Blind SQL Injection Vulnerability Date: == 2013-01-22 References: == http...
---------------------------------------------
http://feedproxy.google.com/~r/securityalert_database/~3/7mPYfOLfMHQ/WLB-2013010170


*** DDoS Attacks as Constitutional Problem: Germanys Experience ***
---------------------------------------------
"A distributed denial of service (DDoS) attack targets a computer systems resources by flooding it with requests beyond its capacity in hopes of negatively impacting its functionality. Does society consider DDoS attacks a legitimate form of protest? When an anonymously posted petition appeared on the White Houses We the People page and advocated the legalization of DDoS attacks most commentators didnt look to kindly at the idea...."
---------------------------------------------
http://blog.cyveillance.com/general-cyberintel/right-to-bear-low-orbit-ion-cannons?


*** SCADA Password-Cracking Tool For Siemens S7 PLCs Released ***
---------------------------------------------
FROM: Matthias Fraidl <fraidl at cert.at> 
http://www.darkreading.com/vulnerability-management/167901026/security/vulnerabilities/240146748/scada-password-cracking-tool-for-siemens-s7-plcs-released.html?utm_source=Darkreading&utm_medium=twitter
---------------------------------------------
/taranis/mod_assess/show_mail.pl?id=2361


*** Beware of fake Java updates ***
---------------------------------------------
"Following recent security vulnerabilities in Java, malware developers are taking a new approach to exploit the Java platform by issuing false updates that pose as legitimate updates for the runtime. The latest version of the Java runtime that fixes recent vulnerabilities is update 11, and Kaspersky labs is reporting that a new malware is out that poses as "Java Update 11." The malware is packaged in a Java archive file called "javaupdate11. jar" that contains two
---------------------------------------------
http://reviews.cnet.com/8301-13727_7-57565035-263/beware-of-fake-java-updates/


*** Twitter flaw gave private message access to third-party apps, researcher says ***
---------------------------------------------
"Users who signed into third-party Web or mobile applications using their Twitter accounts might have given those applications access to their Twitter private "direct" messages without knowing it, according to Cesar Cerrudo, the chief technology officer of security consultancy firm IOActive. The issue is the result of a flaw in Twitters API (application programming interface) that led to users not being properly informed about what permissions an application will have on their
---------------------------------------------
http://www.computerworld.com/s/article/9236024/Twitter_flaw_gave_private_message_access_to_third_party_apps_researcher_says


*** Multiple Vulnerabilities in Cisco Wireless LAN Controllers ***
---------------------------------------------
Please give us your feedback on Cisco Security Intelligence Operations. Thanks! The Cisco Wireless LAN Controller (Cisco WLC) product family is affected by the following four vulnerabilities:  Cisco Wireless LAN Controllers Wireless Intrusion Prevention System (wIPS) Denial of Service Vulnerability    Cisco Wireless LAN Controllers Session Initiation Protocol Denial of Service Vulnerability   Cisco Wireless LAN Controllers HTTP Profiling Remote Code Execution Vulnerability    Cisco Wireless LAN
---------------------------------------------
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130123-wlc?vs_f=Cisco Security Advisory&vs_cat=Security Intelligence&vs_type=RSS&vs_p=Multiple Vulnerabilities in Cisco Wireless LAN Controllers&vs_k=1


*** Three Men Charged in Connection with Gozi Trojan ***
---------------------------------------------
Federal investigators are expected to announce today criminal charges against three men alleged to be responsible for creating and distributing the Gozi Trojan, an extremely sophisticated strain of malicious software that was sold to cyber crooks and was tailor-made to attack specific financial institutions targeted by each buyer. According to charging documents filed in the U.S. [...]Related Posts:New Findings Lend Credence to Project BlitzkriegU.S. Charges 37 Alleged Money Mules19 Arrested in
---------------------------------------------
http://feedproxy.google.com/~r/KrebsOnSecurity/~3/2TTqn06NSJo/


*** Summary for January 2013 - Version: 3.0 ***
---------------------------------------------
With the release of the security bulletins for January 2013, this bulletin summary replaces the bulletin advance notification originally issued January 3, 2013 and the out-of-band advance notification issued January 13, 2013.
---------------------------------------------
http://technet.microsoft.com/en-us/security/bulletin/ms13-jan


*** Vuln: Oracle MySQL Server CVE-2013-0384 Remote Security Vulnerability ***
---------------------------------------------
Oracle MySQL Server CVE-2013-0384 Remote Security Vulnerability
---------------------------------------------
http://www.securityfocus.com/bid/57416