[CERT-daily] Tageszusammenfassung - 02.02.2024

Daily end-of-shift report team at cert.at
Fri Feb 2 18:09:15 CET 2024 

=====================
= End-of-Day report =
=====================

Timeframe:   Donnerstag 01-02-2024 18:00 − Freitag 02-02-2024 18:00
Handler:     Thomas Pribitzer
Co-Handler:  n/a

=====================
=       News        =
=====================

∗∗∗ Abschaltbefehl: US-Behörden müssen Ivanti-Geräte vom Netz nehmen ∗∗∗
---------------------------------------------
In einer Notfallanordnung trägt die US-Cybersicherheitsbehörde betroffenen Stellen auf, in den nächsten Stunden zu handeln. Ivanti-Geräte sollen vom Netz.
---------------------------------------------
https://www.heise.de/news/Abschaltbefehl-US-Behoerden-muessen-Ivanti-Geraete-vom-Netz-nehmen-9616260.html


∗∗∗ Bericht: Wie Angreifer in das Netzwerk von Cloudflare eingedrungen sind ∗∗∗
---------------------------------------------
Nach Abschluss der Untersuchungen eines IT-Sicherheitsvorfalls schildert der CDN-Betreiber Cloudflare, wie die Attacke abgelaufen ist.
---------------------------------------------
https://www.heise.de/news/Bericht-Wie-Angreifer-in-das-Netzwerk-von-Cloudflare-eingedrungen-sind-9616250.html


∗∗∗ VajraSpy: Ein Patchwork-Sammelsurium voller Spionage-Apps ∗∗∗
---------------------------------------------
ESET-Forscher entdeckten mehrere Android-Apps, die VajraSpy beinhalten, ein RAT, der von der Patchwork APT-Gruppe verwendet wird.
---------------------------------------------
https://www.welivesecurity.com/fr/cybersecurite/vajraspy-ein-patchwork-sammelsurium-voller-spionage-apps/


∗∗∗ Scheinbar harmloser PDF-Viewer leert Bankkonten ahnungsloser Android-Nutzer:innen ∗∗∗
---------------------------------------------
Derzeit ist eine neue Welle von Schadsoftware im Umlauf, die bereits in der Vergangenheit zahlreiche Bankkonten leergeräumt hat. Es handelt sich dabei um den Banking-Trojaner Anatsa, der über die Installation von Apps wie PDF Viewer oder PDF Reader über den Google Play Store verbreitet wird.
---------------------------------------------
https://www.watchlist-internet.at/news/scheinbar-harmloser-pdf-viewer-leert-bankkonten-ahnungsloser-android-nutzerinnen/


∗∗∗ Exploring the Latest Mispadu Stealer Variant ∗∗∗
---------------------------------------------
Evaluation of a new variant of Mispadu, a banking Trojan, highlights how infostealers evolve over time and can be hard to pin to past campaigns.
---------------------------------------------
https://unit42.paloaltonetworks.com/mispadu-infostealer-variant/


∗∗∗ How Memory Forensics Revealed Exploitation of Ivanti Connect Secure VPN Zero-Day Vulnerabilities ∗∗∗
---------------------------------------------
As outlined in the previous blog series, while Volexity leveraged network packet captures and disk images to reconstruct parts of the attack, it was ultimately a memory sample that allowed Volexity to confirm exploitation.
---------------------------------------------
https://www.volexity.com/blog/2024/02/01/how-memory-forensics-revealed-exploitation-of-ivanti-connect-secure-vpn-zero-day-vulnerabilities/


∗∗∗ Threat Actors Installing Linux Backdoor Accounts ∗∗∗
---------------------------------------------
Threat actors install malware by launching brute force and dictionary attacks against Linux systems that are poorly managed, such as using default settings or having a simple password.
---------------------------------------------
https://asec.ahnlab.com/en/61185/


∗∗∗ How We Were Able to Infiltrate Attacker Telegram Bots ∗∗∗
---------------------------------------------
It is not uncommon for attackers to publish malicious packages that exfiltrate victims’ data to them using Telegram bots. However, what if we could eavesdrop on what the attacker sees?
---------------------------------------------
https://checkmarx.com/blog/how-we-were-able-to-infiltrate-attacker-telegram-bots/


∗∗∗ Jenkins Vulnerability Estimated to Affect 43% of Cloud Environments ∗∗∗
---------------------------------------------
>From our scans on the Orca Cloud Security Platform, we found that 43% of organizations operate at least one unmanaged Jenkins server in their environment.
---------------------------------------------
https://orca.security/resources/blog/jenkins-arbitrary-file-read-vulnerability/



=====================
=  Vulnerabilities  =
=====================

∗∗∗ CISA-Warnung: Alte iPhone-Schwachstelle wird aktiv ausgenutzt ∗∗∗
---------------------------------------------
Eine von Apple gestopfte Kernel-Lücke wird der US-Sicherheitsbehörde zufolge für Angriffe aktiv genutzt. Für ältere iPhones scheint es keinen Patch zu geben.
---------------------------------------------
https://www.heise.de/news/CISA-Warnung-Alte-iPhone-Schwachstelle-wird-aktiv-ausgenutzt-9616020.html


∗∗∗ Sicherheitsupdate: IBM-Sicherheitslösung QRadar SIEM unter Linux angreifbar ∗∗∗
---------------------------------------------
Mehrere Komponenten eines Add ons von IBMs Security Information and Event Management-System QRadar sind verwundbar.
---------------------------------------------
https://www.heise.de/news/Sicherheitsupdate-IBM-Sicherheitsloesung-QRadar-SIEM-unter-Linux-angreifbar-9616532.html


∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (chromium, man-db, and openjdk-17), Fedora (chromium, indent, jupyterlab, kernel, and python-notebook), Gentoo (glibc), Oracle (firefox, thunderbird, and tigervnc), Red Hat (rpm), SUSE (cpio, gdb, gstreamer, openconnect, slurm, slurm_18_08, slurm_20_02, slurm_20_11, slurm_22_05, slurm_23_02, squid, webkit2gtk3, and xerces-c), and Ubuntu (imagemagick and xorg-server, xwayland).
---------------------------------------------
https://lwn.net/Articles/960604/


∗∗∗ IBM Security Bulletins ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/bulletin/


∗∗∗ QNAP Security Advisories ∗∗∗
---------------------------------------------
https://www.qnap.com/en-us/security-advisories/


∗∗∗ Moby and Open Container Initiative Release Critical Updates for Multiple Vulnerabilities Affecting Docker-related Components ∗∗∗
---------------------------------------------
https://www.cisa.gov/news-events/alerts/2024/02/01/moby-and-open-container-initiative-release-critical-updates-multiple-vulnerabilities-affecting

-- 
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

More information about the Daily mailing list