[CERT-daily] Tageszusammenfassung - Montag 5-09-2016

Mon Sep 5 18:04:33 CEST 2016

=======================
= End-of-Shift report =
=======================

Timeframe:   Freitag 02-09-2016 18:00 − Montag 05-09-2016 18:00
Handler:     Stephan Richter
Co-Handler:  Alexander Riepl


*** DNS tunneling threat drills into nearly half of networks tested ***
---------------------------------------------
InfoBloxs new report showed nearly half of all networks tested to show signs of DNS tunnelling
---------------------------------------------
http://www.scmagazine.com/dns-tunneling-threat-drills-into-nearly-half-of-networks-tested/article/520394/


*** Android Patch Fixes Nexus 5X Critical Vulnerability ***
---------------------------------------------
Google patched an undocumented vulnerability that allowed attackers to bypass Nexus 5X devices lock screen via a forced memory dump that exposed the device owners password.
---------------------------------------------
http://threatpost.com/android-patch-fixes-nexus-5x-critical-vulnerability/120346/


*** Cisco IOS Software Point-to-Point Tunneling Protocol Server Information Disclosure Vulnerability ***
---------------------------------------------
A vulnerability in the implementation of Point-to-Point Tunneling Protocol (PPTP) server functionality in Cisco IOS Software could allow an unauthenticated, remote attacker to access data from a packet buffer that was previously ..
---------------------------------------------
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160902-ios


*** Sundown EK – Stealing Its Way to the Top ***
---------------------------------------------
Sundown is one of the newest Exploit Kits on the market these days, and like many up-and-coming exploit kits before it, this means that it is in under constant development. With ..
---------------------------------------------
https://www.trustwave.com/Resources/SpiderLabs-Blog/Sundown-EK-%e2%80%93-Stealing-Its-Way-to-the-Top/


*** Mailman Access Control Flaw in User Options Page Lets Remote Users Conduct Cross-Site Request Forgery Attacks ***
---------------------------------------------
Mailman Access Control Flaw in User Options Page Lets Remote Users Conduct Cross-Site Request Forgery Attacks
---------------------------------------------
http://www.securitytracker.com/id/1036728


*** ‘Flash Hijacks’ Add New Twist to Muggings ***
---------------------------------------------
A frequent crime in Brazil is a scheme in which thieves kidnap people as theyre leaving a bank, and free them only after theyve visited a number of ATMs to withdraw ..
---------------------------------------------
http://krebsonsecurity.com/2016/09/flash-hijacks-add-new-twist-to-muggings/


*** Telnet is not dead – at least not on ‘smart’ devices ***
---------------------------------------------
Depending on your age, you either might or might not have used Telnet to connect to remote computers in the past. But ..
---------------------------------------------
http://en.blog.nic.cz/2016/09/01/telnet-is-not-dead-at-least-not-on-smart-devices/


*** "Wenn Ihre Daten in der Cloud sind, hat sie auch die NSA" ***
---------------------------------------------
Der Kryptologe Bart Preneel im futurezone-Interview über Verschlüsselung in der Nach-Snowden-Ära, Hintertüren und Quantenkryptographie.
---------------------------------------------
https://futurezone.at/science/wenn-ihre-daten-in-der-cloud-sind-hat-sie-auch-die-nsa/219.100.024


*** Microsoft thought of the children and decided to ban some browsers ***
---------------------------------------------
Redmonds Family Settings now block browsers-without-filters by default, but which ones? Microsoft has updated its family filters to block some rival ..
---------------------------------------------
www.theregister.co.uk/2016/09/05/microsoft_thought_of_the_children_and_decided_they_must_only_use_edge/


*** Hintergrund: Analysiert: Ransomware meets Info-Stealer - RAA und das diebische Pony, Teil II ***
---------------------------------------------
Wie diese Analysiert:-Folge enthüllt, weist die scheinbar perfekte Verschlüsselung des RAA-Trojaners doch Lücken auf. Auch der von RAA gestartete Passwort-Dieb kann sich mit seinen Anti-Debugging-Tricks der Analyse nicht entziehen.
---------------------------------------------
http://heise.de/-3303401


*** Fake attacks by insiders to fool companies ***
---------------------------------------------
Famous cybercrime groups and hacktivists “brands” may be a smokescreen to cover sophisticated insider attacks.
---------------------------------------------
https://www.htbridge.com/blog/fake-attacks-by-insiders-to-fool-companies.html


*** Security Advisory - Information Leak Vulnerability in Huawei eSpace IAD ***
---------------------------------------------
http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160905-01-espace-en


*** Security Advisory - Multiple Security Vulnerabilities in Huawei HiSuite ***
---------------------------------------------
http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160905-01-hisuite-en


*** BKA geht mit SOKO Clavis gegen Ransomware vor ***
---------------------------------------------
Nachdem sich in den vergangenen Wochen die Fälle häufen, will das Bundeskriminalamt nun gezielt gegen Ransomware vorgehen. Eine SOKO soll die Täter ausfindig machen.
---------------------------------------------
https://futurezone.at/netzpolitik/bka-geht-mit-soko-clavis-gegen-ransomware-vor/219.597.730


*** Sophos Windows users face black screens after false positive snafu ***
---------------------------------------------
Black is the new BSOD Users of Sophos’s security software were confronted with a black screen on starting up ..
---------------------------------------------
www.theregister.co.uk/2016/09/05/sophos_black_screen_snafu/


*** Vuln: Inspircd SSL Certificate Spoofing Vulnerability ***
---------------------------------------------
http://www.securityfocus.com/bid/92737


*** Totgesagte leben länger: Adobe poliert NPAPI-Flash auf Linux auf ***
---------------------------------------------
Entgegen so manch einem Meinungsartikel ist Flash noch lange nicht am Ende. Das muss wohl auch Adobe einsehen und frischt nun die veraltete NPAPI-Version unter Linux auf.
---------------------------------------------
http://heise.de/-3314084


*** 800.000 Klartext-Passwörter der Pornoseite Brazzers veröffentlicht ***
---------------------------------------------
Wieder ist ein großer Hack mit kopierten Nutzerdaten bekannt geworden und wieder scheint der Einbruch in die Server 2012 stattgefunden zu haben.
---------------------------------------------
http://heise.de/-3314087


*** Malware Delivered via .pub Files ***
---------------------------------------------
While searching for new scenarios to deliver their malwares[1][2], attackers launched a campaignto deliver malicious code embedded in Microsoft Publisher[3] (.pub) files. The ..
---------------------------------------------
https://isc.sans.edu/diary.html?storyid=21443


*** Pokémon-themed Umbreon Linux Rootkit Hits x86, ARM Systems ***
---------------------------------------------
The Trend Micro Forward Looking Threat Research team recently obtained samples of a new rootkit family from one of our trusted partners. We are providing a ..
---------------------------------------------
http://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems/