[CERT-daily] Tageszusammenfassung - 31.07.2017

Mon Jul 31 18:12:02 CEST 2017

=====================
= End-of-Day report =
=====================

Timeframe:   Freitag 28-07-2017 18:00 − Montag 31-07-2017 18:00
Handler:     Robert Waldner
Co-Handler:  

=====================
=        News       =
=====================

∗∗∗ Ein paar Thesen zu aktuellen Gesetzentwürfen ∗∗∗
---------------------------------------------
Ein paar Thesen zu aktuellen Gesetzentwürfen31. Juli 2017Das Thema "LE going dark in the age of encrytion" kocht mal wieder hoch, und noch schnell vor den Neuwahlen wurden entsprechende Gesetzesentwürfe eingebracht. Ich will hier aus technischer Sicht ein paar Argumente in die Diskussion einwerfen, beschränke mich hier aber rein auf den Aspekt Überwachung trotz Verschlüsselung.
---------------------------------------------
http://www.cert.at/services/blog/20170731130131-2076.html


∗∗∗ Reverse Engineering a JavaScript Obfuscated Dropper ∗∗∗
---------------------------------------------
1. Introduction Nowadays one of the techniques most used to spread malware on windows systems is using a JavaScript (js) dropper. A js dropper represents, in most attack scenarios, the first stage of a malware infection. It happens because Windows systems allow the execution of various scripting language using the Windows Script Host (WScript). This […]The post Reverse Engineering a JavaScript Obfuscated Dropper appeared first on InfoSec Resources.
---------------------------------------------
http://resources.infosecinstitute.com/reverse-engineering-javascript-obfuscated-dropper/


∗∗∗ A new era in mobile banking Trojans ∗∗∗
---------------------------------------------
In mid-July 2017, we found a new modification of the well-known mobile banking malware family Svpeng – Trojan-Banker.AndroidOS.Svpeng.ae. In this modification, the cybercriminals have added new functionality: it now also works as a keylogger, stealing entered text through the use of accessibility services.
---------------------------------------------
http://securelist.com/a-new-era-in-mobile-banking-trojans/79198/


∗∗∗ LeakerLocker Mobile Ransomware Threatens to Expose User Information ∗∗∗
---------------------------------------------
While mobile ransomware such as the recent SLocker focuses on encrypting files on the victim’s devices, a new mobile ransomware named LeakerLocker taps into its victims worst fears by allegedly threatening to send personal data on a remote server and expose its contents to everyone on their contact lists.
---------------------------------------------
http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/tDsXJe6LJ0g/


∗∗∗ Das Millionengeschäft mit Softwarefehlern ∗∗∗
---------------------------------------------
Softwarefehler können enormen Schaden anrichten, wie zuletzt die großangelegte Cyberattacke mit der Schadsoftware „NotPetya“ gezeigt hat. Das Aufspüren solcher Schwachstellen ist die Aufgabe von Bug-Kopfgeldjägern, die damit oft gut verdienen. Interesse an den Diensten der Hacker gibt es dabei nicht nur vonseiten der Hersteller.
---------------------------------------------
http://orf.at/stories/2397792/2397793/


∗∗∗ Container security: The seven biggest mistakes companies are making ∗∗∗
---------------------------------------------
As enterprises increase adoption of containers, they also risk increasing the number of mistakes they make with the technology. Given that many companies are still wrapping their heads around the potential of container technology and how to best leverage it, that stands to reason. With that said, however, companies must ensure that they are establishing a solid foundation for security as they continue to identify strategies and workloads that make sense on a container platform. … More
---------------------------------------------
https://www.helpnetsecurity.com/2017/07/31/container-security-seven-biggest-mistakes-companies-making/


=====================
=    Advisories     =
=====================

∗∗∗ CAN Bus Standard Vulnerability ∗∗∗
---------------------------------------------
NCCIC/ICS-CERT is aware of a public report of a vulnerability in the Controller Area Network (CAN) Bus standard with proof-of-concept (PoC) exploit code affecting CAN Bus, a broadcast based network standard.
---------------------------------------------
https://ics-cert.us-cert.gov/alerts/ICS-ALERT-17-209-01


∗∗∗ Security flaw shows 3G, 4G LTE networks are just as prone to stingray phone tracking ∗∗∗
---------------------------------------------
Security researchers have revealed a recently discovered vulnerability in modern, high-speed cell networks, which they say can allow low-cost phone surveillance and location tracking.
---------------------------------------------
http://www.zdnet.com/article/stingray-security-flaw-cell-networks-phone-tracking-surveillance/


∗∗∗ Cloud-Antivirensoftware hilft beim Datenklau aus luftdichten Netzwerken ∗∗∗
---------------------------------------------
Mindestens vier Virenscanner, die verdächtige Daten zur Analyse in die Cloud hochladen, helfen beim Datenklau von ansonsten in ihrer Kommunikationsfähigkeit beschränkten PCs. Auch Virustotal ist betroffen.
---------------------------------------------
https://heise.de/-3786507


∗∗∗ Attacking industrial pumps by adjusting valves to create bubbles in the pipes.  ∗∗∗
---------------------------------------------
https://twitter.com/KraftCERT/status/891929915200856064


∗∗∗ DFN-CERT-2017-1309/">FreeRDP: Mehrere Schwachstellen ermöglichen u.a. das Ausführen beliebigen Programmcodes ∗∗∗
---------------------------------------------
https://portal.cert.dfn.de/adv/DFN-CERT-2017-1309/


∗∗∗ [webapps] GitHub Enterprise < 2.8.7 - Remote Code Execution ∗∗∗
---------------------------------------------
https://www.exploit-db.com/exploits/42392/?rss


∗∗∗ IBM Security Bulletin: CVE-2017-3167, CVE-2017-3169, CVE-2017-7659, CVE-2017-7668 and CVE-2017-7679 in IBM i HTTP Server ∗∗∗
---------------------------------------------
http://www.ibm.com/support/docview.wss?uid=nas8N1022204


∗∗∗ IBM Security Bulletin: 10x vulnerability in IBM Control Center could allow an outside user to obtain the ID (CVE-2017-1152) ∗∗∗
---------------------------------------------
http://www-01.ibm.com/support/docview.wss?uid=swg22006361


∗∗∗ IBM Security Bulletin: Non-configured connections could cause denial of service in IBM WebSphere MQ Internet Pass-Thru (CVE-2017-1118 ) ∗∗∗
---------------------------------------------
http://www-01.ibm.com/support/docview.wss?uid=swg22006580


∗∗∗ IBM Security Bulletin: A vulnerability in Java runtime from IBM affects IBM WebSphere MQ ∗∗∗
---------------------------------------------
http://www-01.ibm.com/support/docview.wss?uid=swg22005123


∗∗∗ Fortinet FortiOS Input Validation Flaws Lets Remote Users Conduct Cross-Site Scripting Attacks ∗∗∗
---------------------------------------------
http://www.securitytracker.com/id/1039020

-- 
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily