Tageszusammenfassung - 16.11.2021

End-of-Day report

Timeframe: Montag 15-11-2021 18:00 - Dienstag 16-11-2021 18:00 Handler: Dimitri Robl Co-Handler: Wolfgang Menezes


Malware: Emotet ist zurück

Sicherheitsforscher haben eine neue Variante von Emotet entdeckt. Noch wird der Schädling von einer anderen Malware nachgeladen.


Windows Sonder-Updates gegen DC-Authentifizierungsprobleme und Druckprobleme

Die Sicherheitsupdates vom November für Windows verursachen teils Authentifizierungsprobleme bei Domain Controllern sowie Druckprobleme. Microsoft patcht nach.


Fake Ransomware Infection Spooks Website Owners

Starting this past Friday we have seen a number of websites showing a fake ransomware infection. Google search results for -FOR RESTORE SEND 0.1 BITCOIN- were sitting at 6 last week and increased to 291 at the time of writing this.


GitHub Confirms Another Major NPM Security Defect

Microsoft-owned GitHub is again flagging major security problems in the npm registry, warning that a pair of newly discovered vulnerabilities continue to expose the soft underbelly of the open-source software supply chain.


Black Friday: Vorsicht vor Fake-Angeboten

Am 26. November 2021 ist Black Friday. Und darauf folgt am 29. November schon der Cyber Monday - für Schnäppchenjäger wahre Shopping-Feiertage. Wir raten aber zur Vorsicht: Nicht nur seriöse Anbieter locken mit günstigen Preisen und Rabatten, auch Fake-Shops werben mit Black Friday Angeboten.


An update on the state of the NIS2 draft

This is a TLP:WHITE summary of my presentation at the 15th CSIRTs Network meeting in Ljubljana on November 11th. This is not a complete review of the current state of the NIS2 discussions.


New Federal Government Cybersecurity Incident and Vulnerability Response Playbooks

[...] today, CISA published the Federal Government Cybersecurity Incident and Vulnerability Response Playbooks. The playbooks provide federal civilian executive branch (FCEB) agencies with operational procedures for planning and conducting cybersecurity incident and vulnerability response activities. The playbooks provide illustrated decision trees and detail each step for both incident and vulnerability response.


A new Android banking trojan named SharkBot is makings its presence felt

Security researchers have discovered a new Android banking trojan capable of hijacking users smartphones and emptying out e-banking and cryptocurrency accounts.


New Type of Supply Chain Attack Could Put Popular Admin Tools at Risk

Research between Intezer and Checkmarx describes ChainJacking, a type of software supply chain attack that could be potentially exploited by threat actors and puts common admin tools at risk. We have identified a number of open-source Go packages that are susceptible to ChainJacking given that some of these vulnerable packages are embedded in popular admin [...]


Kernel Karnage - Part 3 (Challenge Accepted)

[...] The past weeks I mostly experimented with existing tooling and got acquainted with the basics of kernel driver development. I managed to get a quick win versus $vendor1 but that didn-t impress our blue team, so I received a challenge to bypass $vendor2. I have to admit, after trying all week to get around the protections, $vendor2 is definitely a bigger beast to tame.



Security updates for Tuesday

Security updates have been issued by Debian (libxml-security-java), Fedora (botan2), openSUSE (drbd-utils, kernel, and samba), Red Hat (kernel and webkit2gtk3), SUSE (drbd-utils and samba), and Ubuntu (vim).


Synology-SA-21:28 Mail Station

A vulnerability allows remote authenticated users to execute arbitrary commands via a susceptible version of Mail Station.


AMD Windows 10-Grafiktreiber mit Schwachstellen (Nov. 2021)

Nutzer mit AMD-Grafikkarten und Windows 10 sollten sich mit dem Thema Aktualisierung von AMD-Grafiktreibern befassten. Der Hersteller hat eingestanden, dass seine Windows 10-Grafiktreiber zahlreiche Sicherheitslücken aufweisen. Einige Schwachstellen (z.B. im Grafiktreiber) werden als sicherheitstechnisch Hoch eingestuft.


WAGO: Denial of Service Vulnerability in CODESYS Runtime 2.3


WAGO: Multiple devices affected by Vulnerabilities in NUCLEUS TCP Stack.


WAGO: Multiple Vulnerabilities in CODESYS Runtime 2.3 and WebVisualisation


Grafana: Schwachstelle ermöglicht Privilegieneskalation


Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen ermöglichen Denial of Service


ZDI-21-1312: Open Design Alliance (ODA) ODAViewer DWG File Parsing Use-After-Free Remote Code Execution Vulnerability


ZDI-21-1311: Open Design Alliance (ODA) ODAViewer U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability


ZDI-21-1310: Open Design Alliance (ODA) ODAViewer U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability


Security Bulletin: A vulnerability in filesystem audit logging affects IBM Spectrum Scale.


Security Bulletin: Vulnerability in IBM SDK Java affects IBM Cloud Pak System (CVE-2020-27221)


Security Bulletin: IBM MQ for HP NonStop Server is affected by OpenSSL vulnerability CVE-2021-3711


Security Bulletin: IBM MQ is vulnerable to an issue in Eclipse Jetty (CVE-2021-28165)


Security Bulletin: IBM WebSphere MQ for HP NonStop Server is affected by OpenSSL vulnerability CVE-2021-3711


Security Bulletin: IBM MQ is vulnerable to an issue in Eclipse (CVE-2020-27225)


Security Bulletin: IBM MQ can inadvertently display cleartext credentials via diagnostic logs (CVE-2021-38949)