Snort Ethernet Frame Decoder Denial of Service Vulnerability
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-ethernet-dos-HGXgJH8n
Multiple Cisco products are affected by a vulnerability in the Ethernet Frame Decoder of the Snort detection engine that could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition.https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-ethernet-dos-HGXgJH8n
Cisco
Cisco Security Advisory: Multiple Cisco Products Snort Ethernet Frame Decoder Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Ethernet Frame Decoder of the Snort detection engine that could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition.
The vulnerability is due to improper handling…
The vulnerability is due to improper handling…
Newly Identified Dependency Confusion Packages Target Amazon, Zillow, and Slack
https://blog.sonatype.com/malicious-dependency-confusion-copycats-exfiltrate-bash-history-and-etc-shadow-files
https://blog.sonatype.com/malicious-dependency-confusion-copycats-exfiltrate-bash-history-and-etc-shadow-files
Sonatype
Newly identified dependency confusion packages target Amazon, Zillow, and Slack; Go beyond just bug bounties
Malicious npm dependency confusion packages exfiltrate your bash_history and /etc/shadow files
Quickstart: Set up an Azure Kubernetes Service host on Azure Stack HCI using PowerShell
https://docs.microsoft.com/en-us/azure-stack/aks-hci/setup-powershell
https://docs.microsoft.com/en-us/azure-stack/aks-hci/setup-powershell
Docs
Use PowerShell to set up Kubernetes on Windows Server clusters - AKS enabled by Azure Arc
Learn how to set up an AKS host and create Kubernetes clusters using Windows PowerShell.
MsQuic
https://github.com/microsoft/msquic
MsQuic is a Microsoft implementation of the IETF QUIC protocol. It is cross platform, written in C and designed to be a general purpose QUIC library.https://github.com/microsoft/msquic
GitHub
GitHub - microsoft/msquic: Cross-platform, C implementation of the IETF QUIC protocol, exposed to C, C++, C# and Rust.
Cross-platform, C implementation of the IETF QUIC protocol, exposed to C, C++, C# and Rust. - microsoft/msquic
Supermicro и поставщик решений для безопасного доступа Pulse Secure выпустили рекомендации, информирующие пользователей о том, что некоторые из их продуктов уязвимы для Trickboot
Supermicro упоминает, что в TrickBoot есть новая функциональность (в наборе вредоносных программ TrickBot), которая способная обнаруживать уязвимости в микропрограммном ПО, что позволяет злоумышленникам читать/записывать/стирать BIOS устройства
Supermicro’s response to Trickboot vulnerability, March 2021
https://www.supermicro.com/en/support/security/Trickbot
Pulse Secure response to BIOS Trickboot Vulnerability
https://kb.pulsesecure.net/pkb_mobile#article/l:en_US/SA44712/s
Supermicro упоминает, что в TrickBoot есть новая функциональность (в наборе вредоносных программ TrickBot), которая способная обнаруживать уязвимости в микропрограммном ПО, что позволяет злоумышленникам читать/записывать/стирать BIOS устройства
Supermicro’s response to Trickboot vulnerability, March 2021
https://www.supermicro.com/en/support/security/Trickbot
Pulse Secure response to BIOS Trickboot Vulnerability
https://kb.pulsesecure.net/pkb_mobile#article/l:en_US/SA44712/s
Supermicro
Supermicro’s response to Trickboot vulnerability, March 2021 | Supermicro
Supermicro is aware of the Trickboot issue which is observed only with a subset of the X10 UP motherboards. Supermicro will be providing a mitigation for this vulnerability. TrickBoot is a new functionality within the TrickBot malware toolset capable of discovering…
Protecting against recently disclosed Microsoft Exchange Server vulnerabilities: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065
https://blog.cloudflare.com/protecting-against-microsoft-exchange-server-cves/
https://blog.cloudflare.com/protecting-against-microsoft-exchange-server-cves/
The Cloudflare Blog
Protecting against recently disclosed Microsoft Exchange Server vulnerabilities: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858…
Cloudflare has deployed managed rules protecting customers against a series of remotely exploitable vulnerabilities that were recently found in Microsoft Exchange Server.
Microsoft-Themed Phishing Attack | Zscaler ThreatLabZ
https://www.zscaler.com/blogs/security-research/microsoft-themed-phishing-attack-targets-executives-using-fake-google
https://www.zscaler.com/blogs/security-research/microsoft-themed-phishing-attack-targets-executives-using-fake-google
Zscaler
Microsoft-Themed Phishing Attack | Zscaler ThreatLabZ
ThreatLabZ has discovered a targeted phishing attack aimed at senior-level business leaders, utilizing fake Google reCAPTCHA and Microsoft login screens.
Небезопасные облачные конфигурации предоставляют информацию в тысячах мобильных приложений
Разработчикам нужно уметь не только разрабатывать, но и как минимум смотреть в сторону безопасности, как кода, так и настроек используемых платформ:
https://blog.zimperium.com/unsecured-cloud-configurations-exposing-information-in-thousands-of-mobile-apps/
Разработчикам нужно уметь не только разрабатывать, но и как минимум смотреть в сторону безопасности, как кода, так и настроек используемых платформ:
https://blog.zimperium.com/unsecured-cloud-configurations-exposing-information-in-thousands-of-mobile-apps/
Zimperium
Unsecured Cloud Configurations Exposing Information in Thousands of Mobile Apps - Zimperium
Abstract When approaching the development of a mobile application, one of the key design decisions revolves around the server side aspect of the
Патчи Exchange от Microsoft (обновление 8 марта)
https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/
Официальные рекомендации и скрипты по снижению Exchange угроз
https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/
Смягчающие меры от CISA
https://us-cert.cisa.gov/ncas/current-activity/2021/03/05/microsoft-releases-alternative-mitigations-exchange-server
Еще ссылки по теме:
- https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/
- https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901
- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
- https://msrc.microsoft.com/update-guide/releaseNote/2021-Mar
Ссылки на уязвимости:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065
OWA tergets news:
- https://www.channelfutures.com/security/microsoft-exchange-server-zero-day-exploit-could-have-thousands-of-victims
- https://www.wired.com/story/china-microsoft-exchange-server-hack-victims/
#уязвимый #exchange #vuln
https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/
Официальные рекомендации и скрипты по снижению Exchange угроз
https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/
Смягчающие меры от CISA
https://us-cert.cisa.gov/ncas/current-activity/2021/03/05/microsoft-releases-alternative-mitigations-exchange-server
Еще ссылки по теме:
- https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/
- https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901
- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
- https://msrc.microsoft.com/update-guide/releaseNote/2021-Mar
Ссылки на уязвимости:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065
OWA tergets news:
- https://www.channelfutures.com/security/microsoft-exchange-server-zero-day-exploit-could-have-thousands-of-victims
- https://www.wired.com/story/china-microsoft-exchange-server-hack-victims/
#уязвимый #exchange #vuln
Safari 14.0.3* Security Update
CVE-2021-1844
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Denoscription: A memory corruption issue was addressed with improved validation.
https://support.apple.com/en-us/HT212223
CVE-2021-1844
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Denoscription: A memory corruption issue was addressed with improved validation.
https://support.apple.com/en-us/HT212223
Apple Support
About the security content of Safari 14.0.3
This document describes the security content of Safari 14.0.3.
Lord of the Ring(s): Side Channel Attacks on the CPU On-Chip Ring Interconnect Are Practical
https://arxiv.org/abs/2103.03443
https://arxiv.org/abs/2103.03443
apple_location_tracking_system.pdf
2.4 MB
Who Can Find My Devices?
Security and Privacy of Apple’s Crowd-Sourced
Bluetooth Location Tracking System
Security and Privacy of Apple’s Crowd-Sourced
Bluetooth Location Tracking System
GitHub security update: A bug related to handling of authenticated sessions
https://github.blog/2021-03-08-github-security-update-a-bug-related-to-handling-of-authenticated-sessions/
https://github.blog/2021-03-08-github-security-update-a-bug-related-to-handling-of-authenticated-sessions/
The GitHub Blog
GitHub security update: A bug related to handling of authenticated sessions
On the evening of March 8, we invalidated all authenticated sessions on GitHub.com created prior to 12:03 UTC on March 8 out of an abundance of caution.
WordPress - Critical 0-day in The Plus Addons for Elementor Allows Site Takeover
https://www.wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover/
https://www.wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover/
Wordfence
Critical 0-day in The Plus Addons for Elementor Allows Site Takeover
UPDATE 2: As of late March 9th, 2021, the vulnerabilities have been fully patched in version 4.1.7. We highly recommend updating to this version immediately to keep your sites secure. Special thanks to the plugin developers for working as quickly as possible…
Technical Advisory – Multiple Vulnerabilities in Netgear ProSAFE Plus JGS516PE / GS116Ev2 Switches
https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
Nccgroup
Cyber Security Research
Cutting-edge cyber security research from NCC Group. Find public reports, technical advisories, analyses, & other novel insights from our global experts.
Latest Windows 10 update is causing BSOD crashes
https://www.techspot.com/news/88881-latest-windows-10-update-causing-bsod-crashes.html
https://www.techspot.com/news/88881-latest-windows-10-update-causing-bsod-crashes.html
TechSpot
Latest Windows 10 update is causing BSOD crashes
As reported by Windows Latest, Windows 10 KB5000802 (March 2021) is an automatic security update, meaning some users didn't have a choice whether to download/install it and...
OVH пожар в ДЦ Страсбурга
OVH одна из немногих недорогих хостинг-компаний, да что говорить, часть Sys-Admin сервисов крутится там (благо эти ДЦ не пострадали).
Новость на официальном сайте компании:
https://www.ovh.com/fr/news/presse/cpl1785.in cendie-notre-site-strasbourg
OVH одна из немногих недорогих хостинг-компаний, да что говорить, часть Sys-Admin сервисов крутится там (благо эти ДЦ не пострадали).
Новость на официальном сайте компании:
https://www.ovh.com/fr/news/presse/cpl1785.in cendie-notre-site-strasbourg
OVHcloud
Dernières informations sur notre site de Strasbourg
Datacentre de Strasbourg : Etat de la situation au 23 avril
Hackers Breach Thousands of Security Cameras, Exposing Tesla, Jails, Hospitals
Сюда же и Cloudflare..:
https://www.bloomberg.com/news/articles/2021-03-09/hackers-expose-tesla-jails-in-breach-of-150-000-security-cams
Сюда же и Cloudflare..:
https://www.bloomberg.com/news/articles/2021-03-09/hackers-expose-tesla-jails-in-breach-of-150-000-security-cams
Bloomberg.com
Hackers Breach Thousands of Security Cameras, Exposing Tesla, Jails, Hospitals
A group of hackers say they breached a massive trove of security-camera data collected by Silicon Valley startup Verkada Inc., gaining access to live feeds of 150,000 surveillance cameras inside hospitals, companies, police departments, prisons and schools.
MS Exchange PoC
В последние недели Microsoft отметился уязвимостями нулевого дня. ProxyLogon - это наименование уязвимости, данное CVE-2021-26855 (уязвимости Microsoft Exchange Server), которая позволяет злоумышленнику обходить аутентификацию и выдавать себя за легитимных пользователей. Эта уязвимость использовалась в атаках для доступа к локальным серверам Exchange, что позволяло в итоге получить доступ к внутренним учетным записям электронной почты, и в том числе устанавливать дополнительное вредоносное ПО для обеспечения долгосрочного доступа к внутренним средам жертв...
https://www.praetorian.com/blog/reproducing-proxylogon-exploit/
Еще по теме
Microsoft Exchange Server Vulnerabilities Mitigations – updated March 9, 2021
- https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/
Security checking powershell noscripts
- https://github.com/microsoft/CSS-Exchange/tree/main/Security
Подборка ссылок по сабжу
- https://news.1rj.ru/str/sysadm_in_channel/2840
Полный набор мартовских патчей
March 2021 Security Updates
https://msrc.microsoft.com/update-guide/releaseNote/2021-Mar
В последние недели Microsoft отметился уязвимостями нулевого дня. ProxyLogon - это наименование уязвимости, данное CVE-2021-26855 (уязвимости Microsoft Exchange Server), которая позволяет злоумышленнику обходить аутентификацию и выдавать себя за легитимных пользователей. Эта уязвимость использовалась в атаках для доступа к локальным серверам Exchange, что позволяло в итоге получить доступ к внутренним учетным записям электронной почты, и в том числе устанавливать дополнительное вредоносное ПО для обеспечения долгосрочного доступа к внутренним средам жертв...
https://www.praetorian.com/blog/reproducing-proxylogon-exploit/
Еще по теме
Microsoft Exchange Server Vulnerabilities Mitigations – updated March 9, 2021
- https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/
Security checking powershell noscripts
- https://github.com/microsoft/CSS-Exchange/tree/main/Security
Подборка ссылок по сабжу
- https://news.1rj.ru/str/sysadm_in_channel/2840
Полный набор мартовских патчей
March 2021 Security Updates
https://msrc.microsoft.com/update-guide/releaseNote/2021-Mar
Praetorian
Reproducing the Microsoft Exchange Proxylogon Exploit Chain
Introduction In recent weeks, Microsoft has detected multiple 0-day exploits being used to attack on-premises versions of Microsoft Exchange Server in a ubiquitous global attack. ProxyLogon is the name given to CVE-2021-26855, a vulnerability on Microsoft…
New Linux Backdoor RedXOR Likely Operated by Chinese Nation-State Actor
https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/
https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/
Intezer
New Linux Backdoor Likely Operated by Chinese Nation-State
Backdoor masquerades itself as polkit daemon.