Timeframe: Donnerstag 07-10-2021 18:00 - Freitag 08-10-2021 18:00
Handler: Dimitri Robl
Co-Handler: Thomas Pribitzer
Rapid RYUK Ransomware Attack Group Christened as FIN12
Prolific ransomware cybercrime groups approach underscores a complicated, layered model of cybercrime.
Sorting Things Out - Sorting Data by IP Address, (Fri, Oct 8th)
One thing that is huge in making sense of large volumes of data is sorting. Which makes having good sorting tools and methods a big deal when you are working through findings in a security assessment of pentest.
Free BrewDog beer, with a side order of shareholder PII?
BrewDog exposed the details of over 200,000 -Equity for Punks- shareholders for over 18 months plus many more customers.
FontOnLake: Previously unknown malware family targeting Linux
ESET researchers discover a malware family with tools that show signs they-re used in targeted attacks.
NSA Releases Guidance on Avoiding the Dangers of Wildcard TLS Certificates and ALPACA Techniques
The National Security Agency (NSA) has released a Cybersecurity Information (CSI) sheet with guidance to help secure the Department of Defense, National Security Systems, and Defense Industrial Base organizations from poorly implemented wildcard Transport Layer Security (TLS) certificates and the exploitation of Application Layer Protocols Allowing Cross-Protocol Attacks (ALPACA).
Microsoft to disable Excel 4.0 macros, one of the most abused Office features
Microsoft plans to disable a legacy feature known as Excel 4.0 macros, also XLM macros, for all Microsoft 365 users by the end of the year [...]
Malicious PowerPoint Files Constantly Being Distributed
On April 2021, the ASEC analysis team introduced the malware delivered via PowerPoint files attached to email in the ASEC blog. The team has found continuous malicious activities that use PPAM files in the form of PowerPoint and thus is sharing them.
Security updates for Friday
Security updates have been issued by Fedora (libssh), Mageia (firefox), Slackware (httpd), SUSE (xen), and Ubuntu (firefox and mysql-5.7).
Google Patches Four Severe Vulnerabilities in Chrome
Google this week announced the release of an updated Chrome version for Windows, Mac and Linux, to address a total of four high-severity vulnerabilities in the browser.
Apache Releases HTTP Server version 2.4.51 to Address Vulnerabilities Under Exploitation
On October 7, 2021, the Apache Software Foundation released Apache HTTP Server version 2.4.51 to address Path Traversal and Remote Code Execution vulnerabilities (CVE-2021-41773, CVE-2021-42013) in Apache HTTP Server 2.4.49 and 2.4.50. These vulnerabilities have been exploited in the wild.
Security Bulletin: IBM App Connect Enterprise Certified Container Designers may be vulnerable to arbitrary code execution via CVE-2021-23436
Security Bulletin: IBM App Connect Enterprise Certified Container could disclose sensitive information to a local user when it is configured to use an IBM Cloud API key to connect to cloud-based connectors (CVE-2021-29906)
Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to a symlink attack due to CVE-2021-39135
Security Bulletin: Access Control Vulnerability Affects the User Interface of IBM Sterling File Gateway (CVE-2020-4654)
Security Bulletin: Node.js as used by IBM Security QRadar Packet Capture contains multiple vulnerabilities (CVE-2020-8201, CVE-2020-8252, CVE-2020-8251, CVE-2020-8277)
Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to a symlink attack due to CVE-2021-39134
Security Bulletin: Multiple Apache PDFBox security vulnerabilities
Security Bulletin: IBM App Connect Enterprise Certified Container images may be vulnerable to Denial of Service attacks due to CVE-2021-23362 and CVE-2021-27290
Security Bulletin: IBM MQ Appliance is affected by a sensitive information disclosure vulnerability (CVE-2020-5008)
Security Bulletin: Multiple vulnerabilities in IBM HTTP Server affect IBM Netezza Performance Portal
Kyocera Drucker: Mehrere Schwachstellen
Johnson Controls exacqVision Server Bundle
Mobile Industrial Robots Vehicles and MiR Fleet Software
Johnson Controls exacqVision
Mitsubishi Electric MELSEC iQ-R Series C Controller Module
InHand Networks IR615 Router
FATEK Automation WinProladder
FATEK Automation Communication Server