[CERT-daily] Tageszusammenfassung - Donnerstag 20-03-2014

[Daily end-of-shift report]

=======================
= End-of-Shift report =
=======================

Timeframe:   Mittwoch 19-03-2014 18:00 − Donnerstag 20-03-2014 18:00
Handler:     Alexander Riepl
Co-Handler:  Stephan Richter




*** ZBOT Adds Clickbot Routine To Arsenal ***
---------------------------------------------
The ZeuS/ZBOT malware family is probably one of the most well-known malware families today . It is normally known for stealing credentials associated with online banking accounts. However, ZBOT is no one-trick pony. Some ZBOT variants perform other routines like downloading or dropping other threats like ransomware. We recently came across one variant detected as TROJ_ZCLICK.A,...
---------------------------------------------
http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/rrelQiGbzao/




*** New BlackOS Software Package Sold In Underground Forums ***
---------------------------------------------
We recently came across this particular post in an underground forum: Figure 1. Underground forum post This particular post in Russian was advertising a new product, known as "BlackOS". Contrary to the name, it is not an operating system. However, it is definitely "black", or malicious: it is used to manage and redirect Internet traffic...
---------------------------------------------
http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/mA8O58qz-TQ/




*** Phishing: Gehackter EA-Server hostet falsche Apple-Webseite ***
---------------------------------------------
Kriminelle Hacker haben auf Servern des Spieleherstellers Electronic Arts eine gefälschte Webseite untergebracht, die Apple-IDs samt Passwörtern und Kreditkarteninformationen verlangt. Wie viele Nutzer ihre Daten dort eingegeben haben, ist nicht bekannt.
---------------------------------------------
http://www.golem.de/news/phishing-gehackter-ea-server-hostet-falsche-apple-webseite-1403-105266-rss.html




*** "goto fail": Apple drängt Nutzer zum Update ***
---------------------------------------------
Der Mac-Hersteller fordert inzwischen dazu auf, das Update auf OS X 10.9.2 alsbald möglich zu installieren - falls noch nicht geschehen. Ältere Versionen von OS X Mavericks und iOS weisen eine gravierende SSL-Schwachstelle auf.
---------------------------------------------
http://www.heise.de/security/meldung/goto-fail-Apple-draengt-Nutzer-zum-Update-2150885.html




*** Android: Sicherheitslücken wegen fehlender Updates bleiben Problem ***
---------------------------------------------
70 Prozent aller Android-Geräte weltweit besitzen eine Browser-Lücke, glaubt ein Forscher. Der simple Aufruf einer Website reicht, um sie auszunutzen.
---------------------------------------------
http://www.heise.de/newsticker/meldung/Android-Sicherheitsluecken-wegen-fehlender-Updates-bleiben-Problem-2139700.html/from/rss09?wt_mc=rss.ho.beitrag.rdf




*** Analysis: Spam report: February 2014 ***
---------------------------------------------
The share of spam in global email traffic decreased by 7.6 percentage points and averaged 65.7% in January. As forecasted, the drop in the share of spam was due to a lull early in January when there is less business activity and a large number of botnets are turned off.
---------------------------------------------
http://www.securelist.com/en/analysis/204792328/Spam_report_February_2014




*** Protokollanalyse: Mogeln im Quizduell ***
---------------------------------------------
Entwickler verlassen sich zu sehr auf HTTPS und verzichten auf grundlegende Sicherheitsmaßnahmen. Über eine Man-in-the-Middle-Attacke konnten Security-Forscher in den Datenverkehr zwischen App-Server und Apps hineinsehen - und entdeckten Sonderbares.
---------------------------------------------
http://www.golem.de/news/protokollanalyse-mogeln-im-quizduell-1403-105276-rss.html




*** Cisco IronPort AsyncOS Software for ESA and SMA File Validation Flaw Lets Remote Authenticated Users Execute Arbitrary Code ***
---------------------------------------------
http://www.securitytracker.com/id/1029937




*** SA-CONTRIB-2014-033 - Nivo Slider - Cross Site Scripting ***
---------------------------------------------
Advisory ID: DRUPAL-SA-CONTRIB-2014-033Project: Nivo Slider (third-party module)Version: 7.xDate: 2014-March-19Security risk: Moderately criticalExploitable from: RemoteVulnerability: Cross Site ScriptingDescriptionNivo Slider provides a way to showcase featured content. Nivo Slider gives administrators a simple method of adding slides to the slideshow, an administration interface to configure slideshow settings, and simple slider positioning using the Drupal block system.The module doesnt...
---------------------------------------------
https://drupal.org/node/2221481