[CERT-daily] Tageszusammenfassung - 13.11.2017

Mon Nov 13 18:43:55 CET 2017

=====================
= End-of-Day report =
=====================

Timeframe:   Freitag 10-11-2017 18:00 − Montag 13-11-2017 18:00
Handler:     Stephan Richter
Co-Handler:  Nina Bieringer

=====================
=       News        =
=====================

∗∗∗ Detecting reflective DLL loading with Windows Defender ATP ∗∗∗
---------------------------------------------
Todays attacks put emphasis on leaving little, if any, forensic evidence to maintain stealth and achieve persistence. Attackers use methods that allow exploits to stay resident within an exploited process or migrate to a long-lived process without ever creating or relying on a file on disk. In recent blogs we described how attackers use basic...
---------------------------------------------
https://blogs.technet.microsoft.com/mmpc/2017/11/13/detecting-reflective-dll-loading-with-windows-defender-atp/


∗∗∗ Keep An Eye on your Root Certificates, (Sat, Nov 11th) ∗∗∗
---------------------------------------------
A few times a year, we can read in the news that a rogue root certificate was installed without the user consent. The latest story that pops up in my mind is the Savitech audio drivers which silently installs a root certificate[1]. The risks associated with this kind of behaviour are multiple, the most important remains performing MitM attacks. New root certificates are not always the result of an attack or infection by a malware. Corporate end-points might also get new root certificates.
---------------------------------------------
https://isc.sans.edu/diary/rss/23030


∗∗∗ Sicherheitsupdate: VMware AirWatch Launcher for Android als Sprungbrett für Angreifer ∗∗∗
---------------------------------------------
VMware schließt mehrere Sicherheitslücken in AirWatch Launcher und AirWatch Console for Android. Davon gilt keine als kritisch.
---------------------------------------------
https://heise.de/-3888725


∗∗∗ Hintergrund: Cardiac Scan: Herzbewegung als biometrisches Authentifizierungsmerkmal ∗∗∗
---------------------------------------------
Zu den gängigen biometrischen Identifikationsmerkmalen wie Fingerabdrücken, Iris-Scans oder Gesichtserkennung könnte sich bald auch das menschliche Herz gesellen. Denn keines bewegt sich wie das andere.
---------------------------------------------
https://heise.de/-3842874


∗∗∗ Ordinypt: Vermeintlicher Erpressungstrojaner-Ausbruch in Deutschland gibt Rätsel auf ∗∗∗
---------------------------------------------
Die vor kurzem aufgetauchte Ransomware Ordinypt löscht Dateien, statt sie zu verschlüsseln und hat es mit Fake-PDF-Dateien auf deutsche Personalabteilungen abgesehen. Allerdings gibt es bisher kaum Anzeichen auf Infektionen in freier Wildbahn.
---------------------------------------------
https://heise.de/-3889143


∗∗∗ Keine Bank Austria-Kundendaten aktualisieren ∗∗∗
---------------------------------------------
Kriminelle versenden eine gefälschte Bank Austria-Nachricht. Darin fordern sie Empfänger/innen dazu auf, dass sie eine Website aufrufen und auf dieser ihre persönlichen Kund/innendaten aktualisieren. Wer der Aufforderung nachkommt, übermittelt OnlineBanking-Zugangsdaten an Verbrecher/innen.
---------------------------------------------
https://www.watchlist-internet.at/phishing/keine-bank-austria-kundendaten-aktualisieren/


∗∗∗ Fighting persistent malware with a UEFI scanner, or ‘What’s it all about UEFI?” ∗∗∗
---------------------------------------------
The biggest news in malware so far this year has been WannaCryptor a.k.a. WannaCry, and one reason that particular ransomware spread so fast was because it used a "top secret" exploit developed by the NSA, an agency known to have dabbled in UEFI compromise.
---------------------------------------------
https://www.welivesecurity.com/2017/11/10/uefi-scanner-fighting-persistent-malware/


=====================
=  Vulnerabilities  =
=====================

∗∗∗ Vulnerability Spotlight: Multiple Vulnerabilities in Foscam C1 Indoor HD Cameras ∗∗∗
---------------------------------------------
These vulnerabilities were discovered by Claudio Bozzato of Cisco Talos.Executive SummaryThe Foscam C1 Indoor HD Camera is a network-based camera that is marketed for use in a variety of applications, including use as a home security monitoring device. Talos recently identified several vulnerabilities present in these devices, and worked with Foscam to develop fixes for them, which we published the details for in a blog post here.
---------------------------------------------
http://blog.talosintelligence.com/2017/11/foscam-multiple-vulns.html


∗∗∗ DSA-4031 ruby2.3 - security update ∗∗∗
---------------------------------------------
https://www.debian.org/security/2017/dsa-4031


∗∗∗ DSA-4032 imagemagick - security update ∗∗∗
---------------------------------------------
https://www.debian.org/security/2017/dsa-4032


∗∗∗ Vuln: ManageEngine ServiceDesk CVE-2017-11511 Arbitrary File Download Vulnerability ∗∗∗
---------------------------------------------
http://www.securityfocus.com/bid/101788


∗∗∗ WP Support Plus Responsive Ticket System <= 8.0.7 - Remote Code Execution (RCE) ∗∗∗
---------------------------------------------
https://wpvulndb.com/vulnerabilities/8949


∗∗∗ IBM Security Bulletins ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/

-- 
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily