Week in review Archives - Page 31 of 39

Week in review

AUSCERT Week in Review for 22nd December 2017

Learn more

Week in review

AUSCERT Week in Review for 15th December 2017

AUSCERT Week in Review for 15th December 2017 Greetings, We’ve had a “big” week in a few ways: A huge credential dump aggregating previous dumps has hit the limelight. The defendants in the Mirai case, 2016’s largest botnet, have pleaded guilty. Also, a 19-year-old RSA vulnerability has returned as the ROBOT attack, affecting many notable networking vendors. The AUSCERT Conference’s Call for Proposals is open. Important Dates for submission——————————13 Nov 2017 – (Monday) – Call for Presentations submissions open19 Jan 2018 – (Friday) – Call for Presentations submission deadline19 Feb 2018 – (Monday) – Notifications from Program Committee Conference Date—————29 May 2018 – 01 Jun 2018 | AUSCERT2018 Conference As for more news, here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: How a Dorm Room Minecraft Scam Brought Down the Internethttps://www.wired.com/story/mirai-botnet-minecraft-scam-brought-down-the-internetDate: December 13 2017Author: Garrett M. Graff Excerpt: Until then, a large DDoS attack was often considered to be 10 to 20 gigibits per second; vDOS had been overwhelming targets with attacks in the range of 50 Gbps. A follow-on Mirai attack against OVH hit around 901 Gbps. BrickerBot Author Retires Claiming to Have Bricked over 10 Million IoT Deviceshttps://www.bleepingcomputer.com/news/security/brickerbot-author-retires-claiming-to-have-bricked-over-10-million-iot-devices/Date: December 11 2017Author: Catalin Cimpanu Excerpt: In an email sent today to Bleeping Computer, The Janit0r announced his sudden retirement and explained why he reached this decision. I believe that the project has been a technical success, but I am now starting to worry that it is also having a deleterious effect on the public’s perception of the overall IoT threat. Researchers keep issuing high profile warnings about genuinely dangerous new botnets, and a few weeks or even days later they are all but gone. Sooner or later people are going to start questioning the credibility of the research and the seriousness of the situation. Extended Validation is Brokenhttps://stripe.ian.shDate: December 12 2017Author: Ian Carroll Excerpt: One question may be how practical this attack is for a real attacker who desires to phish someone. First, from incorporation to issuance of the EV certificate, I spent less than an hour of my time and about $177. $100 of this was to incorporate the company, and $77 was for the certificate. It took about 48 hours from incorporation to the issuance of the certificate. Game-changing attack on critical infrastructure site causes outagehttps://arstechnica.com/information-technology/2017/12/game-changing-attack-on-critical-infrastructure-site-causes-outage/Date: December 15 2017Author: Dan Goodin Excerpt: The accidental outage was likely the result of the Triconex SIS, or “safety instrumented system.” The SIS shut down operations when it experienced an error that occurred as the hackers were performing reconnaissance on the facility. Although the hackers were likely seeking the ability to cause physical damage inside the facility, the November shutdown was likely not deliberate. Variation of 19-Year-Old Cryptographic Attack Affects Facebook, PayPal, Othershttps://www.bleepingcomputer.com/news/security/variation-of-19-year-old-cryptographic-attack-affects-facebook-paypal-others/Date: 12 December 2017Author: Catalin Cimpanu Excerpt: The ROBOT research team say that despite this being a variation for a 19-year-old attack, 27 of the Alexa Top 100 websites are vulnerable to the ROBOT attack. Vulnerable sites include Facebook and PayPal. The ROBOT attack scientific paper includes a case study how the research team decrypted Facebook traffic. 1.4 Billion Clear Text Credentials Discovered in a Single Databasehttps://medium.com/4iqdelvedeep/1-4-billion-clear-text-credentials-discovered-in-a-single-database-3131d0a1ae14Date: December 9 2017Author: Julio Casal Excerpt: The 41GB dump was found on 5th December 2017 in an underground community forum. The database was recently updated with the last set of data inserted on 11/29/2017. The total amount of credentials (usernames/clear text password pairs) is 1,400,553,869. And lastly, here are this week’s most noteworthy security bulletins: 1. ASB-2017.0217 – Remote code execution patched in Palo Alto firewallshttps://portal.auscert.org.au/bulletins/56182 Through the exploitation of a combination of unrelated vulnerabilities, and via the management interface of the device, an attacker could remotely execute code on PAN-OS in the context of the highest privileged user. 2. ESB-2017.3160 – Thunderbird security updatehttps://portal.auscert.org.au/bulletins/55970 Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code or denial of service. 3. ESB-2017.3200 – Jenkins patches race conditions during setuphttps://portal.auscert.org.au/bulletins/56154 On Jenkins 2.81 and newer, including LTS 2.89.1, this could in rare cases (we estimate less than 20% of new instances) result in failure to initialize the setup wizard on the first startup. Affected instances need to be configured to restrict access. 4. ESB-2017.3182.2 – TLS vulnerability discovered in Cisco products (ROBOT)https://portal.auscert.org.au/bulletins/56082 An attacker could iteratively query a server running a vulnerable TLS stack implementation to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions. [Note that Cisco does not intend to fix this in all affected products, e.g.the ACE 4710 and ACE30.] Wishing you all the best from AUSCERT and see you next week,David

Learn more

Week in review

AUSCERT Week in Review for 8th December 2017

Learn more

Week in review

AUSCERT Week in Review for 1st December 2017

Learn more

Week in review

AUSCERT Week in Review for 24th November 2017

Learn more

Week in review

AUSCERT Week in Review for 17th November 2017

AUSCERT Week in Review for 17th November 2017 AUSCERT Week in Review17 November 2017 Greetings, As Friday 17 November closes, Cisco have announced and addressed a bug with certain upgrade paths in their appliances which left a root user wide open. The world’s most mainstream security target, Apple’s latest iPhone, has been fooled by researchers with an affordable mask. JavaScript cryptocurrency miners have also hit the news, with implementations available for all sorts of currencies, becoming a new XSS favourite. As for more news, here’s a summary of some of the more interesting stories we’ve seen this week: Title: Microsoft November Patch Tuesday Fixes 53 Security IssuesURL: https://www.bleepingcomputer.com/news/microsoft/microsoft-november-patch-tuesday-fixes-53-security-issues/Date: 14 November 2017Author: Catalin Cimpanu Excerpt:“No zero-days this monthDetails about four vulnerabilities were published online before today’spatches, but fortunately, none were exploited in real-world attacks.” ——– Title: APCERT 2017 AGM and Conference: A Window into the CERT communityURL: https://wordpress-admin.auscert.org.au/blog/2017-11-17-apcert-2017-agm-and-conference-window-c/Date: 17 November 2017Author: Anthony Vaccaro (of AUSCERT!) Excerpt:“Additionally, some external speakers were invited to give talks at the conference. Some highlights included a talk by Akamai representative Amol Mathur on attacks that target API services directly, bypassing many of the protections that are built into front-end applications, and an overview on using machine learning to analyse malware samples by Rajesh Nikam of Quick Heal. As malware campaigns grow in both size and number, we need to move away from manual analysis in order to process as many samples as possible, making use of technologies such as machine learning to automate the process.” ——– Title: 2,500+ Websites Are Now “Cryptojacking” To Use Your CPU Power And Mine CryptocurrencyURL: https://fossbytes.com/2500-websites-are-now-cryptojacking-to-use-your-cpu-power-and-mine-cryptocurrency/Date: 10 November 2017Author: Adarsh Verma Excerpt:“Most of these websites are using a JavaScript-based miner from the website Coinhive. By simply pasting a code snippet on the website, any webmaster can start mining. They just need to share a small cut with Coinhive.”——– Title: Researchers Fool iPhone X’s Face ID with $150 3D Printed FaceURL: https://www.cso.com.au/article/629951/researchers-fool-iphone-x-face-id-150-3d-printed-face/Date: 14 November 2017Author: Liam Tung Excerpt:“The company hasn’t revealed exactly how it tricked Face ID but says it was possible because they understood how Apple’s Face ID artificial intelligence worked. Face ID requires the user look directly at the camera by directing the direction of the user’s gaze, and then uses neural networks for matching and anti-spoofing.” ——– And lastly, here are this week’s noteworthy security bulletins (in noparticular order): 1. ESB-2017.2953 – [Win][UNIX/Linux] OpenSAML2 metadata filter bypasshttps://portal.auscert.org.au/bulletins/55102 CVE-2017-16853: A filtering engine omits to run checks, leading to metadata exposure in a major SAML library. Expect to hear more on this. 2. ESB-2017.2931 – [Cisco] Known Root Credentials Enabled After Some Upgradeshttps://portal.auscert.org.au/bulletins/55010 The vulnerability occurs when a refresh upgrade or Prime Collaboration Deployment (PCD) migration is performed on an affected device. When a refresh upgrade or PCD migration is completed successfully, an engineering flag remains enabled and could allow root access to the device with a known password. Subsequent upgrades disable this flag. 3. ESB-2017.2913 – [Debian] mediawiki: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/54938 Cross-site scripting, revealing account existence and a set of HTML mangling attacks. 4. ASB-2017.0194 – [Win] Microsoft Edge: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/54822 In seeking to speed up its Edge browser, Microsoft is producing and flattening RCEs. Wishing you the best from AUSCERT and hope to see you next week,David

Learn more

Week in review

AUSCERT Week in Review for 10th November 2017

AUSCERT Week in Review for 10th November 2017 AUSCERT Week in Review10 November 2017 Greetings, As Friday 10th of November closes, DDE, a twenty four (24) year old feature in the Office suite, has taken the limelight in the method of executing code on victim’s computers. Although this method requires heavy user interaction, it was finally addressed for mitigation, published by the vendor and pushed out to members in an AUSCERT bulletin. So, applying the mitigation and applying an other round of user education notices may do well to protect your organisation. Another set of people that may need to be educated on the dangers of opening up fresh and untrusted code on the internet could be script kiddies, this being the lead to our top new story this week. As for more news, here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Title: Script Kiddie Nightmare: IoT Attack Code Embedded with BackdoorURL: https://blog.newskysecurity.com/script-kiddie-nightmare-iot-attack-code-embedded-with-backdoor-39ebcb92a4bbDate: November 8, 2017 Author: NewSky Security Excerpt:“The IoT threat landscape is proving to be the fastest to evolve, with attacks shifting from basic password guessing, to using a variety of exploits as seen recently in the IoTroop/Reaper botnet. Enter the script kiddie?—?amateurish hackers that copy/paste code for quick results. “ ——- Title: Windows Movie Maker Scam spreads massively due to high Google rankingURL: https://www.welivesecurity.com/2017/11/09/eset-detected-windows-movie-maker-scam-2017/Date: November 9, 2017 Author: Peter Stancik Excerpt:“Scammers have been surprisingly successful at distributing a modified version of Windows Movie Maker that aims to collect money from unaware users. The spread of the scam (which itself is far from new) has been boosted by search engine optimization of the crooks’ website, as well as continuing demand for Windows Movie Maker, Microsoft’s free video editing software, discontinued since January 2017.” ——- Title: Google Adds New Features in Chrome to Fight MalvertisingURL: https://www.bleepingcomputer.com/news/security/google-adds-new-features-in-chrome-to-fight-malvertising/Date: November 9, 2017 Author: Catalin Cimpanu Excerpt:“Google announced plans today for three new Chrome security features that will block websites from sneakily redirecting users to new URLs without the user or website owner’s consent. While all three additions are welcomed, one of these features has the potential to stop a few malvertising campaigns dead in their tracks, and could potentially disrupt the malware scene in the next few months.” ——- Title: Chinese Keyboard Developer Spies on User Through Built-in KeyloggerURL: https://www.hackread.com/chinese-keyboard-developer-spies-on-user-through-built-in-keylogger/Date: November 8, 2017Author: Waqas Excerpt:“A Chinese mechanical keyboard manufacturer MantisTek has been caught in the middle of a controversy in which it’s being blamed for spying on users through built-in keylogger in its GK2 model and sending the data to a server apparently hosted on Alibaba Cloud server.” ——- Title: Locky Ransomware Used to Target Hospitals EvolvesURL: http://www.zdnet.com/article/locky-ransomware-used-to-target-hospitals-evolves/Date: November 7, 2017Author: Charlie Osborne Excerpt:“According to new research released by Cylance, a relatively new Locky variant, dubbed Diablo6, includes a few tweaks which are making detection of the ransomware more difficult for traditional antivirus solutions as well as end users.In a blog post, the team said Diablo6 performs an attack in two stages. The first is a typical attack vector for ransomware — a spear phishing email which contains a .zip archive, but something new for the Locky variant.While masquerading as a legitimate email and attachment, the file actually contains a VBS file which, when decompressed and opened, attempts to connect to Locky’s command-and-control (C&C) server for instructions.” ——- And lastly, here are this week’s noteworthy security bulletins (in no particular order): 1. ASB-2017.0192 – [Win] Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fieldshttps://portal.auscert.org.au/bulletins/54686 An attacker could leverage the DDE protocol by sending a specially crafted file to the user and then convincing the user to open the file, typically by way of an enticement in an email. 2. ESB-2017.2807 – [SUSE] kernel: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/54466 CVE-2015-9004: kernel/events/core.c in the Linux kernel mishandled counter grouping, which allowed local users to gain privileges via a crafted application, related to the perf_pmu_register and perf_event_open functions 3. ESB-2017.2867 – [Appliance] IBM Security SiteProtector System: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/54726 CVE-2017-10116: An unspecified vulnerability related to the Java SE Security component could allow an unauthenticated attacker to take control of the system. 4. ESB-2017.2865 – [Win] Schnedier Electric InduSoft Web Studio and Schneider Electric InTouch Machine Edition : Execute arbitrary code/commands – Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/54718 CVE-2017-14024: The stack-based buffer overflow vulnerability has been identified, which may allow remote code execution with high privileges. 5. ESB-2017.2855 – [BlackBerry] BlackBerry: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/54670 CVE-2017-0862: Elevation of Privilege in Kernel — Wishing you the best from AUSCERT and hope to see you next week,Geoffroy

Learn more

Week in review

AUSCERT Week in Review for 3rd November 2017

AUSCERT Week in Review for 3rd November 2017 AUSCERT Week in Review03 November 2017 Greetings, As Friday 3rd of November closes, a tally of the root compromises is more than I have seen this past year. Let’s hope that the reason why we are indeed seeing an up tick in this type of vulnerability is only because security teams and their capabilities are indeed expanding. Well, at least this is the silver lining to be seen as this cloud of root compromise bulletins rolls over. As for news, here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Title: If your websites use WordPress, put down that coffee and upgrade to 4.8.3. Thank us laterURL: http://www.theregister.co.uk/2017/10/31/wordpress_security_fix_4_8_3/Date: 31st October 2017Author: Iain Thomson Excerpt:“The fix addresses a flaw that can be potentially exploited by hackers to hijack and take over WordPress-powered websites, by injecting malicious SQL database commands. The core installation of WordPress is not directly affected, we’re told, rather the bug is in a security function provided by the core to plugins and themes. In other words, a bug in the core leaves plugins and themes potentially at risk of being hacked, leading to whole sites being commandeered by miscreants.” ——- Title: Just one day after its release, iOS 11.1 hacked by security researchersURL: http://www.zdnet.com/article/ios-11-hacked-by-security-researchers-day-after-release/Date: 2nd November 2017Author: Zack Whittaker Excerpt:“A day after iOS 11.1 was released, security researchers have already broken the software. News of the exploits came from Trend Micro’s Mobile Pwn2Own contest in Tokyo, where security researchers found two vulnerabilities in Safari, the mobile operating system’s browser. “ ——- Title: AI will not solve your security analytics issuesURL: https://www.csoonline.com/article/3236025/artificial-intelligence/ai-will-not-solve-your-security-analytics-issues.htmlDate: 2nd November 2017Author: Alexander Poizner Excerpt:“Managing SOC is not pretty. Constant stress due to avalanche of tickets and vast amounts of data to analyze using often underpowered and sometimes outdated tools, combined with high turnover and low morale staff. It is understandable that in such environment everybody is looking for a miracle. Any new technology that has a capability to automate an analysis and detect anomalies gets attention of operations security. With an amount of hype surrounding AI, the temptation is great to jump into early adoption.” ——- Title: Security Think Tank: Three areas of web security challengesURL: http://www.computerweekly.com/opinion/Security-Think-Tank-Three-areas-of-web-security-challengesDate: 1st November 2017Author: Peter Wenham Excerpt:“Very few companies these days are without a website and those websites provide a portal from the internet that the bad people can exploit to attack a company’s infrastructure including the website itself. The security challenges posed by a web presence fall into the three broad categories of legal, technical and operational. On the legal side you need to have a privacy policy identifying what personal data is collected, how that data will be used and who that data might be shared with and why. The policy should be made compliant with the General Data Protection Regulation (GDPR) for which the compliance deadline is 25 May 2018, but this will require you to track GDPR guidance as it becomes available.” ——- Title: Facebook pledges to double its 10,000-person safety and security staff by end of 2018URL: https://www.cnbc.com/2017/10/31/facebook-senate-testimony-doubling-security-group-to-20000-in-2018.htmlDate: 31st October 2017Author: Anita Balakrishnan Excerpt:“Facebook, under intensifying pressure from legislators and consumers to clean up its site, is pledging to double the number of people it has working on issues related to safety and security. Colin Stretch, a vice president and general counsel at Facebook, testified before senators on Tuesday alongside executives from Twitter and Google. He told them that Facebook’s staff focused on sensitive security and community issues will grow to 20,000 by the end of next year.” ——- And lastly, here are this week’s noteworthy security bulletins (in no particular order): 1. ESB-2017.2778 – [OSX] Apple macOS: Multiple vulnerabilities https://portal.auscert.org.au/bulletins/54342 An application may be able to execute arbitrary code with system privileges. 2. ESB-2017.2766 – [Mobile] Apple Watch: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/54294 An application may be able to execute arbitrary code with kernel privileges. 3. ESB-2017.2763 – [Ubuntu] kernel: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/54282 A local attacker could exploit this vulnerability to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. 4. ESB-2017.2782 – [Cisco] Cisco Firepower 4100 Series Next-Generation Firewall (NGFW): Root compromise – Existing accounthttps://portal.auscert.org.au/bulletins/54358 An authenticated, remote attacker to inject arbitrary commands that could be executed with root privileges. 5. ESB-2017.2790 – [Appliance] F5 Products: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/54390 An authenticated attacker may be able to cause an escalation of privileges through a crafted application that uses the fork or close system call. — Wishing you the best from AUSCERT and hope to see you next week,Geoffroy

Learn more

Week in review

AUSCERT Week in Review for 27th October 2017

Learn more

Week in review

AUSCERT Week in Review for 20th October 2017

AUSCERT Week in Review for 20th October 2017 AUSCERT Week in Review20 October 2017Greetings,What a week for Information Security! With the new vulnerabilities revealedin WPA2 and the Infineon RSA algorithm, can we be certain that anythingis truly secure any more? All eyes are on vendors and their responses tothese potentially catastrophic security flaws. As we go forward, puttingmore of our trust and confidential data into computers, being able torespond to new vulnerabilities in a timely fashion is critical.Here’s a summary (including excerpts) of some of the more interestingstories we’ve seen this week:Title: Millions of high-security crypto keys crippled by newly discovered flawURL: https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/Date: 16th October, 2017Author: Dan GoodinExcerpt: “A crippling flaw in a widely used code library has fatallyundermined the security of millions of encryption keys used in some ofthe highest-stakes settings, including national identity cards, software-and application-signing, and trusted platform modules protecting governmentand corporate computers.”—Title: Necurs Botnet malspam pushes Locky using DDE attackURL: https://isc.sans.edu/forums/diary/Necurs+Botnet+malspam+pushes+Locky+using+DDE+attack/22946/Date: 19th October, 2017Author: Brad DuncanExcerpt: “I’ve seen Twitter traffic today about malspam from the NecursBotnet pushing Locky ransomware using Word documents as their attachments.These Word documents use the DDE attack technique, something I alreadywrote about in a previous diary covering Hancitor malspam on 2017-10-16.”—Title: Adobe rushes out fix for exploited Flash bugURL: https://www.itnews.com.au/news/adobe-rushes-out-fix-for-exploited-flash-bug-475535Date: 17th October, 2017Author: Staff WriterExcerpt: “The patch came after Kaspersky Lab said a group it was tracking,BlackOasis, used the previously unknown weakness on October 10 to plantFinSpy or FinFisher malware on computers before connecting them back toservers in Switzerland, Bulgaria and the Netherlands.”—Title: ACORN received almost 48k cyber-related reports in 2016-17URL: http://www.zdnet.com/article/acorn-received-almost-48k-cyber-related-reports-in-2016-17/Date: 20th October, 2017Author: Asha McLeanExcerpt: “As revealed in the Connect Discover Understand Respond 2016-17Annual Report from the Australian Criminal Intelligence Commission (ACIC),scams and online fraud were the highest reported incidents to ACORN,accounting for 51 percent of the 47,873 total.”—Title: Australian government details Govpass digital IDURL: http://www.zdnet.com/article/australian-government-details-govpass-digital-id/Date: 17th October, 2017Author: Asha McLeanExcerpt: “The federal government has detailed what its digital identificationsolution will look like, outlining how citizens can apply for an optionalGovpass in a video posted on YouTube.”And lastly, here are this week’s noteworthy security bulletins (in noparticular order):ESB-2017.2607 – ALERT [Appliance] Infineon RSA: Access privileged data – Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/53570A flaw in the Infineon RSA algorithm could result in keys that arefactorisable in months instead of centuries.—ESB-2017.2602 – ALERT [Win][Linux][OSX] Adobe Flash Player: Execute arbitrary code/commands – Remote with user interactionhttps://portal.auscert.org.au/bulletins/53546A newly-disclosed vulnerability in Adobe Flash affects all versions ofthe software, and has already been seen in the wild.—ESB-2017.2599 – ALERT [Win][UNIX/Linux][Appliance][Mobile] Wi-Fi Protected Access II (WPA2) devices: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/53534A flaw discovered in the WPA protocol itself could affect billions ofpeople, as the encryption protocol is used ubiquitously around the globefor WiFi networks. Wishing you the best from AUSCERT and hope to see you next week.Stay patched, stay safe.Anthony

Learn more

Week in review

AUSCERT Week in Review for 13th October 2017

AUSCERT Week in Review for 13th October 2017 AUSCERT Week in Review13 October 2017 Greetings, As Friday 13th of October closes, all eyes are in Kaspersky and how itwill manage? The above reflection came out of one of the news articles that have cappedoff a solid week in bulletins, and we have included a few more articlesof interest that have grabbed our attention. Here’s a summary (includingexcerpts) of some of the more interesting stories we’ve seen this week: Title: Kaspersky Lab and the AV Security HoleURL:https://www.darkreading.com/attacks-breaches/kaspersky-lab-and-the-av-security-hole/d/d-id/1330116Date: 10 October 2017Author: Jai Vijayan Excerpt: “It’s unclear what happened in the reported theft of NSA data byRussian spies, but an attacker would need little help to steal if he orshe had privileged access to an AV vendor’s network, security experts say.” ——- Title: Microsoft Patches Office Bug Actively Being ExploitedURL:https://threatpost.com/microsoft-patches-office-bug-actively-being-exploited/128367/Date: 10 October 2017Author: Tom Spring Excerpt: “Security experts are urging network administrators to patch aMicrosoft Office vulnerability that has been exploited in the wild.” ——- Title: Dumb bug of the week: Outlook staples your encrypted emails to,er, plaintext copies when sending messagesURL: https://www.theregister.co.uk/2017/10/11/outlook_smime_bug/Date: 11 October 2017Author: Iain Thomson Excerpt: “Attention anyone using Microsoft Outlook to encryptemails. Researchers at security outfit SEC Consult have found a bug inRedmond’s software that causes encrypted messages to be sent out withtheir unencrypted versions attached.” ——- Title: Equifax Website Caught Serving Malicious Ads to VisitorsURL:https://www.forbes.com/sites/leemathews/2017/10/12/equifax-website-caught-serving-malicious-ads-to-visitors/Date: 12 October 2017Author: Lee Mathews Excerpt: “It’s been just over a month since Equifax went public withnews of a massive server breach that affected roughly half of the adultpopulation of the United States and thousands more consumers in Canada andthe U.K. Now, a security researcher has spotted an ad campaign spreadingmalware from the company’s website.” ——- Title: Accentuate the negative: Accenture exposes data related to itsenterprise cloud platformURL:https://www.scmagazine.com/accentuate-the-negative-accenture-exposes-data-related-to-its-enterprise-cloud-platform/article/699636/ Date: 11 October 2017Author: Bradley Barth Excerpt: “Yet another company has mistakenly exposed its sensitiveinternal information after storing data on misconfigured cloud-basedservers from Amazon Web Services. The culprit in this case – the $32.9billion consulting and professional services company Accenture – wasfound to be insecurely storing data that, ironically, has to do with itsown cloud-based enterprise solution, the Accenture Cloud Platform.” ——- Title: Office 365 Adoption Picks Up Pace Amid Security ConcernsURL:https://www.infosecurity-magazine.com/news/office-265-adoption-picks-up-pace/Date: 12 October 2017Author: Tara Seals Excerpt: “Adoption rates for Microsoft’s cloud-based, hosted productivitysuite, Office 365, have increased significantly in the past 12 months;however, security concerns remain a barrier to adoption.” And lastly, here are this week’s noteworthy security bulletins (in noparticular order): 1. ASB-2017.0161 – ALERT [Win] Microsoft Windows: Multiplevulnerabilitieshttps://portal.auscert.org.au/bulletins/53282 Plenty to patch this Microsoft patch Tuesday. 2. ASB-2017.0159 – ALERT [Win] Microsoft Office: Multiplevulnerabilitieshttps://portal.auscert.org.au/bulletins/53274 MS Office and there is a exploit out now. 3. ESB-2017.2561 – [Debian] wordpress: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/53382 WordPress has vulnerabilities, that is a lot of websites. 4. ESB-2017.2562 – [RedHat] thunderbird: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/53386 Thunderbirds are go! 5. ESB-2017.2591 – [SUSE] git: Execute arbitrary code/commands –Existing accounthttps://portal.auscert.org.au/bulletins/53498 Should I git onto patching this? Wishing you the best from AUSCERT and hope to see you next week.Stay patched, stay safe.Peter

Learn more

Week in review

AUSCERT Week in Review for 6th October 2017

AUSCERT Week in Review for 6th October 2017 AUSCERT Week in Review06 October 2017 Greetings, As Friday 6th of October closes, the Equifax event highlights the need to have a patch management program in your organization. In that patch management program it is important to ensure that the risks of not patching gets transferred as high up as possible and as soon as possible. So, should you not have a patch management program in place at this moment, next Monday may be a good time to set one up. It may be better to point the finger at best practices and frameworks for patch management now, then have the finger pointed at your staff later. The above reflection came out of one of the news articles that have capped off a solid week in bulletins, and we have included a few more articles of interest that have grabbed our attention. Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Title: Sole Equifax security worker at fault for failed patch, says former CEOURL: http://www.theregister.co.uk/2017/10/04/sole_security_worker_at_fault_for_equifax_fail_says_former_ceo/Date: October 4, 2017Author: Simon Sharwood Excerpt:“Recently-and-forcibly-retired Equifax CEO Rick Smith has laid the blame for his credit-check biz’s IT security breach on a single member of the company’s security team.” ——- Title: Equifax failed to patch security vulnerability in March — testimonyURL: https://www.reuters.com/article/equifax-breach/equifax-failed-to-patch-security-vulnerability-in-march-testimony-idUSL2N1MD0UQDate: October 3, 2017Author: David Shepardson Excerpt:“Equifax Inc failed to patch a software security vulnerability after being alerted in March by the U.S. Homeland Security Department to the issue that led to hackers obtaining personal information from over 140 million Americans, the company’s former chief executive will tell Congress in written testimony made public Monday. “ ——- Title: Hey, IoT vendors. When a paediatric nurse tells you to fix security, you definitely screwed upURL: https://www.theregister.co.uk/2017/10/05/nurse_iot/Date: October 5, 2017Author: John Leyden Excerpt:“…Jelena Milosevic, who developed an interest in cybersecurity over the last three years, told attendees that the healthcare sector needs to work with infosec experts and manufacturers to sort out the emerging problem of the security risk posed by internet-connected medical kit.” ——- Title: So, Uh, That Billion-Account Yahoo Breach Was Actually 3 BillionURL: https://www.wired.com/story/yahoo-breach-three-billion-accounts/Date: October 3, 2017 Author: Lily Hay Newman Excerpt:“When Yahoo disclosed in December that a billion (yes, billion) of its users’ accounts had been compromised in an August 2013 breach, it came as a staggering revelation. Now, 10 months later, the company would like to make a correction: That incident actually exposed three billion accounts—every Yahoo account that existed at the time.” ——- Title: Google’s October Android patches have landed: There’s a big fix for dnsmasq bugURL: http://www.zdnet.com/article/googles-october-android-patches-have-landed-theres-a-big-fix-for-dnsmasq-bug/Date: October 3, 2017Author: Liam Tung Excerpt:“Google has published its October Android security bulletin and is rolling out the OTA update to Nexus and Pixel devices. It’s also introduced a new way of handling its security bulletins. As usual it’s publishing a monthly Android security bulletin with details about a partial patch level and complete patch level, But it’s now introduced a new ‘Pixel/Nexus bulletin’ that documents additional bugs fixed in these devices.” ——- Title: Apple issues update to patch password vulnerabilities in High Sierra operating softwareURL: https://siliconangle.com/blog/2017/10/05/apple-releases-high-sierra-security-update-patch-password-vulnerabilities/Date: October 5, 2017Author: Duncan Riley Excerpt:“Apple Inc. has issued a security update for macOS High Sierra that patches a severe vulnerability identified in September that allows unsigned apps to capture plain-text passwords from the Mac keychain. The High Sierra 10.13 Supplemental Update actually fixes two security issues, the previously discovered security issue in the Mac keychain as well as a newly identified vulnerability that allows passwords to be accessed via the Apple File System, also known as APFS.” And lastly, here are this week’s noteworthy security bulletins (in no particular order): 1. ASB-2017.0156 – [Android] Google Nexus devices: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/53034 Google Nexus devices were patched for remote code execution, elevation of privileges and accessing information from phones. 2. ESB-2017.2518 – [Appliance] Siemens 7KT PAC1200 Data Manager: Administrator compromise – Remote/unauthenticated https://portal.auscert.org.au/bulletins/53186Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and perform administrative functions. 3. ESB-2017.2523 – [Appliance] IBM Netezza Analytics: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/53206 OpenSSL and zlib were patched in the IBM Netezza Analytics product. 4. ESB-2017.2521 – [Mac] Apple StorageKit and Apple Security: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/53198A method existed for applications to bypass the keychain access prompt with a synthetic click as well as, if a hint was set in Disk Utility when creating an APFSencrypted volume, the password was stored as the hint. 5. ESB-2017.2520 – [Ubuntu] ruby: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/53194 ruby allowed remote unauthenticated attackers to execute arbitrary code, denial of service, overwrite arbitrary Files as well as access confidential data. Wishing you the best from AUSCERT and hope to see you next week. Stay patched, stay safe.Geoffroy

Learn more

Newer Posts 1 2 … 30 31 32 33 Older Posts