[CERT-daily] Tageszusammenfassung - 23.03.2023

Daily end-of-shift report team at cert.at
Thu Mar 23 18:10:17 CET 2023 

=====================
= End-of-Day report =
=====================

Timeframe:   Mittwoch 22-03-2023 18:00 − Donnerstag 23-03-2023 18:00
Handler:     Robert Waldner
Co-Handler:  n/a

=====================
=       News        =
=====================

∗∗∗ Developing an incident response playbook ∗∗∗
---------------------------------------------
Incident response playbooks help optimize the SOC processes, and are a major step forward to SOC maturity, but can be challenging for a company to develop. In this article, I want to share some insights on how to create the (almost) perfect playbook.
---------------------------------------------
https://securelist.com/developing-an-incident-response-playbook/109145/


∗∗∗ Cropping and Redacting Images Safely, (Thu, Mar 23rd) ∗∗∗
---------------------------------------------
The recent "acropalypse" vulnerabilities in Android and Windows 11 showed yet again the dangers of relying on image processing tools to redact images. [..] Here are some approaches to make image redaction safer. But please use them with caution.
---------------------------------------------
https://isc.sans.edu/diary/rss/29666


∗∗∗ German and South Korean Agencies Warn of Kimsukys Expanding Cyber Attack Tactics ∗∗∗
---------------------------------------------
German and South Korean government agencies have warned about cyber attacks mounted by a threat actor tracked as Kimsuky using rogue browser extensions to steal users Gmail inboxes.
---------------------------------------------
https://thehackernews.com/2023/03/german-and-south-korean-agencies-warn.html


∗∗∗ AIIPot: Adaptive Intelligent-Interaction Honeypot for IoT Devices ∗∗∗
---------------------------------------------
In this paper, we propose a honeypot for IoT devices that uses machine learning techniques to learn and interact with attackers automatically. The evaluation of the proposed model indicates that our system can improve the session length with attackers and capture more attacks on the IoT network.
---------------------------------------------
https://arxiv.org/abs/2303.12367


∗∗∗ Memory Forensics R&D Illustrated: Detecting Hidden Windows Services ∗∗∗
---------------------------------------------
To begin the series, this post discusses a new detection technique for hidden services on Windows 7 through 11. Since not all readers will be familiar with hidden services and the danger they pose on live systems, we will start with some brief background.
---------------------------------------------
https://volatility-labs.blogspot.com/2023/03/memory-forensics-r-d-illustrated-detecting-hidden-windows-services.html


∗∗∗ Malicious Actors Use Unicode Support in Python to Evade Detection ∗∗∗
---------------------------------------------
Phylum’s automated platform recently detected the onyxproxy package on PyPI, a malicious package that harvests and exfiltrates credentials and other sensitive data. In many ways, this package typifies other token stealers that we have found prevalent in PyPI. However, one feature of this particular package caught our eye: an obfuscation technique that was foreseen in 2007 during a discussion about Python’s support for Unicode [..]
---------------------------------------------
https://blog.phylum.io/malicious-actors-use-unicode-support-in-python-to-evade-detection


∗∗∗ Joomla! CVE-2023-23752 to Code Execution ∗∗∗
---------------------------------------------
On February 16, 2023, Joomla! published a security advisory for CVE-2023-23752. [..] disclosure was followed by a stream of exploits hitting GitHub, and multiple indicators of exploitation in the wild. The public exploits focus on leaking the victim’s MySQL database credentials – an unexciting prospect (we thought), because exposing the database to the internet is a dangerous misconfiguration. Nonetheless, attackers seemed interested in the vulnerability, so we sought to find out why.
---------------------------------------------
https://vulncheck.com/blog/joomla-for-rce


∗∗∗ Fehlalarm: Microsoft-Defender-Warnung vor deaktiviertem Schutz führt in die Irre ∗∗∗
---------------------------------------------
Unter Windows 11 zeigt Microsoft Defender auf vielen Systemen einen deaktivieren Schutz durch "die lokalen Sicherheitsautorität". Das ist ein Fehlalarm.
---------------------------------------------
https://heise.de/-7659972


∗∗∗ Technische Richtlinie zu Public Key Infrastrukturen für Technische Sicherheitseinrichtungen veröffentlicht ∗∗∗
---------------------------------------------
Das BSI hat am 23. März 2023 die neue Technische Richtlinie BSI TR-03145-5 für den sicheren Betrieb einer Public Key Infrastruktur für Technische Sicherheitseinrichtungen veröffentlicht.
---------------------------------------------
https://www.bsi.bund.de/DE/Service-Navi/Presse/Alle-Meldungen-News/Meldungen/BSI_TR_03145-5_230323.html


∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (Mar 13, 2023 to Mar 19, 2023) ∗∗∗
---------------------------------------------
Last week, there were 92 vulnerabilities disclosed in 76 WordPress Plugins and 7 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database [..]
---------------------------------------------
https://www.wordfence.com/blog/2023/03/wordfence-intelligence-weekly-wordpress-vulnerability-report-mar-13-2023-to-mar-19-2023/


∗∗∗ Pack it Secretly: Earth Preta’s Updated Stealthy Strategies ∗∗∗
---------------------------------------------
After months of investigation, we found that several undisclosed malware and interesting tools used for exfiltration purposes were being used by Earth Preta. We also observed that the threat actors were actively changing their tools, tactics, and procedures (TTPs) to bypass security solutions. In this blog entry, we will introduce and analyze the other tools and malware used by the threat actor.
---------------------------------------------
https://www.trendmicro.com/en_us/research/23/c/earth-preta-updated-stealthy-strategies.html



=====================
=  Vulnerabilities  =
=====================

∗∗∗ Virenschutz: Malwarebytes ermöglicht Rechteausweitung ∗∗∗
---------------------------------------------
Der Virenschutz von Malwarebytes ermöglicht Angreifern, beliebige Dateien zu löschen oder ihre Rechte im System auszuweiten. Ein Update schließt die Lücke.
---------------------------------------------
https://heise.de/-7674565


∗∗∗ Sicherheitslücke: Angreifer könnten Switches von Aruba kompromittieren (CVE-2023-1168) ∗∗∗
---------------------------------------------
Aufgrund einer Schwachstelle sind bestimmte Switches von Aruba verwundbar. Admins sollten Geräte jetzt absichern.
Die Lücke betrifft die Network Analytics Engine. Dort könnte ein authentifizierter Angreifer für eine Schadcode-Attacke ansetzen, um Geräte vollständig zu kompromittieren. Wie eine Attacke ablaufen könnte, ist bislang nicht bekannt.
---------------------------------------------
https://heise.de/-7658264


∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by CentOS (firefox, nss, and openssl), Fedora (firefox, liferea, python-cairosvg, and tar), Oracle (openssl and thunderbird), Scientific Linux (firefox, nss, and openssl), SUSE (container-suseconnect, grub2, libplist, and qemu), and Ubuntu (amanda, apache2, node-object-path, and python-git).
---------------------------------------------
https://lwn.net/Articles/926972/


∗∗∗ VARTA: Multiple devices prone to hard-coded credentials (CVE-2022-22512) ∗∗∗
---------------------------------------------
VARTA energy storage systems have a web user interface via which users and installers can access live data measurements and configure the system to their needs. It has been discovered that the corresponding credentials are hard-coded within the frontend and thus potentially exploitable.
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-061/


∗∗∗ Warning for Asset Management Program (TCO!Stream) Vulnerability and Update Recommendation ∗∗∗
---------------------------------------------
Solution: Users must check their program version by following the steps below and update their program to the latest version (versions 8.0.23.215 or above).
– Service operator: Replace with the latest version through MLsoft
– Service user: Updated automatically when the operator switches to the latest version
---------------------------------------------
https://asec.ahnlab.com/en/50213/


∗∗∗ SAUTER EY-modulo 5 Building Automation Stations ∗∗∗
---------------------------------------------
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-03


∗∗∗ RoboDK ∗∗∗
---------------------------------------------
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-01


∗∗∗ Schneider Electric IGSS ∗∗∗
---------------------------------------------
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-04


∗∗∗ CP Plus KVMS Pro ∗∗∗
---------------------------------------------
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-02


∗∗∗ ABB Pulsar Plus Controller ∗∗∗
---------------------------------------------
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-05


∗∗∗ ProPump and Controls Osprey Pump Controller ∗∗∗
---------------------------------------------
https://www.cisa.gov/news-events/ics-advisories/icsa-23-082-06


∗∗∗ IBM Integration Bus is vulnerable to a remote attack & denial of service due to Apache Thrift & Apache Commons Codec (CVE-2018-1320, CVE-2019-0205, IBM X-Force ID: 177835) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6965298


∗∗∗ IBM Watson CloudPak for Data Data Stores are vulnerable to web pages stored locally which can be read by another user on the system ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6965446


∗∗∗ IBM Watson CloudPak for Data Data Stores is vulnerable to allowing a user with physical access and specific knowledge of the system to modify files or data on the system.(CVE-2023-26282) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6965452


∗∗∗ IBM Watson CloudPak for Data Data Stores is vulnerable to an attacker with specific knowledge about the system to manipulate data due to improper input validation(CVE-2023-28512) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6965456


∗∗∗ Security Bulletin: Watson CP4D Data Stores for Cloud Pak for Data does not encypt sensitive information before storage or transmission (CVE-2023-27291) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6965458


∗∗∗ IBM API Connect is impacted by an improper access control vulnerability (CVE-2023-28522) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6965612


∗∗∗ Vulnerabilities found within Java collectors used by IBM Tivoli Network Manager (ITNM) IP Edition. ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6965698


∗∗∗ WebSphere Application Server traditional is vulnerable to a remote code execution vulnerability ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6965702


∗∗∗ A vulnerability has been identified in IBM Spectrum Scale Data Access Services (DAS) which can cause denial of service. ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6964532


∗∗∗ A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2023-26283) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6965732


∗∗∗ Vulnerabilites in OpenSSL may affect IBM Spectrum Protect Backup-Archive Client NetApp Services (CVE-2022-4304, CVE-2023-0215, CVE-2023-0286) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6963786


∗∗∗ Stored cross-site vulnerability when performing a document upload using Responsive Document Explorer affect IBM Business Automation Workflow - CVE-2023-24957 ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6965776

-- 
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

More information about the Daily mailing list