AWS WorkSpaces Remote Code Execution
https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/
https://rhinosecuritylabs.com/aws/cve-2021-38112-aws-workspaces-rce/
Rhino Security Labs
CVE-2021-38112: AWS WorkSpaces Remote Code Execution
This blog post details a vulnerability Rhino Security Labs found in AWS WorkSpaces desktop client, tracked as CVE-2021-38112
Analyzing a large-scale phishing-as-a-service operation
https://www.microsoft.com/security/blog/2021/09/21/catching-the-big-fish-analyzing-a-large-scale-phishing-as-a-service-operation/
https://www.microsoft.com/security/blog/2021/09/21/catching-the-big-fish-analyzing-a-large-scale-phishing-as-a-service-operation/
Microsoft News
Catching the big fish: Analyzing a large-scale phishing-as-a-service operation
With over 100 available phishing templates that mimic known brands and services, the BulletProofLink operation is responsible for many of the phishing campaigns that impact enterprises today. We are sharing these findings so the broader community can build…
Mama Always Told Me Not to Trust Strangers without Certificates
https://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html
Netgear Security Advisory for Remote Code Execution on Some Routers, PSV-2021-0204
https://kb.netgear.com/000064039/Security-Advisory-for-Remote-Code-Execution-on-Some-Routers-PSV-2021-0204
https://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html
Netgear Security Advisory for Remote Code Execution on Some Routers, PSV-2021-0204
https://kb.netgear.com/000064039/Security-Advisory-for-Remote-Code-Execution-on-Some-Routers-PSV-2021-0204
Cisco Event Response: September 2021 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication
https://tools.cisco.com/security/center/viewErp.x?alertId=ERP-74581
https://tools.cisco.com/security/center/viewErp.x?alertId=ERP-74581
About the security content of iOS 12.5.5 - Apple Support
https://support.apple.com/en-us/HT212824
https://support.apple.com/en-us/HT212824
Apple Support
About the security content of iOS 12.5.5
This document describes the security content of iOS 12.5.5.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Как одновременно ловить логи с разных серверов
Если кратко, есть задача - задача мониторить или собрать логи с малейшими телодвижениями (без SIEM, SYSLOG, доп. сервера(ов) и т.п), желательно встроенными средствами или устанавливаемыми утилитами на конечную машину, где эти логи собственно будут просматриваться или собираться.
Первоочередная задача - в режиме реального времени отловить лог приложения, которое крутится на разных серверах. В рамках данного примера это будет банально /var/log/messages.
https://sys-adm.in/systadm/966-kak-odnovremenno-monitorit-logi-s-raznykh-serverov-bez-shuma-i-pyli.html
Если кратко, есть задача - задача мониторить или собрать логи с малейшими телодвижениями (без SIEM, SYSLOG, доп. сервера(ов) и т.п), желательно встроенными средствами или устанавливаемыми утилитами на конечную машину, где эти логи собственно будут просматриваться или собираться.
Первоочередная задача - в режиме реального времени отловить лог приложения, которое крутится на разных серверах. В рамках данного примера это будет банально /var/log/messages.
https://sys-adm.in/systadm/966-kak-odnovremenno-monitorit-logi-s-raznykh-serverov-bez-shuma-i-pyli.html
lab.sys-adm.in
Sys-Admin Laboratory
Open Sys-Admin BLD DNS - Focus on information for free with adblocking and implicit cybersecurity threat prevention.
Everyone Gets a Rootkit
Исследовательская группа Eclypsium выявила слабое место в возможностях WPBT Microsoft, которое может позволить злоумышленнику запустить вредоносный код с привилегиями ядра при загрузке устройства.
https://eclypsium.com/2021/09/20/everyone-gets-a-rootkit/
Add link:
https://techcommunity.microsoft.com/t5/itops-talk-blog/introduction-to-secured-core-computing/ba-p/2701672
Исследовательская группа Eclypsium выявила слабое место в возможностях WPBT Microsoft, которое может позволить злоумышленнику запустить вредоносный код с привилегиями ядра при загрузке устройства.
https://eclypsium.com/2021/09/20/everyone-gets-a-rootkit/
Add link:
https://techcommunity.microsoft.com/t5/itops-talk-blog/introduction-to-secured-core-computing/ba-p/2701672
Eclypsium | Supply Chain Security for the Modern Enterprise
Everyone Gets a Rootkit - Eclypsium | Supply Chain Security for the Modern Enterprise
In a connected, digitally transformed age, the term “no good deed goes unpunished” could perhaps be rephrased as “no good feature goes unexploited”. And so it is with ACPI, Microsoft WPBT, and every version of Windows since Windows 8.
Аддоны по блокировке рекламы обещают прикрыть в последующих релизах Chrome
Согласно информации по ссылке ниже, менеджеры из команды разработчиков Google Chrome сообщили, что расширения, работающие на Manifest v2, перестанут приниматься в Chrome Web Store уже с 17 января 2022 года. А в январе 2023 года поддержка полноценных блокировщиков рекламы станет невозможной, потому что поддержку расширений Manifest v2 из Chrome полностью удалят.
• https://www.ferra.ru/news/apps/google-zapretit-rabotu-blokirovshikov-reklamy-v-brauzere-chrome-26-09-2021.htm
Тут уж только или BLD или что-то похожее..
www.ferra.ru
Google запретит работу блокировщиков рекламы в браузере Chrome
Компания Google готовится перейти на новую платформу для разработчиков – Manifest v3. Это повлечёт за собой изменения в политиках компании в отношении рекламы в браузере Google Chrome и сторонних блокировщиков рекламы.
Disclosure of three 0-day iOS vulnerabilities and critique of Apple Security Bounty program
https://habr.com/en/post/579714/
https://habr.com/en/post/579714/
VMware vCenter Server Vulnerability CVE-2021-22005 Under Active Exploit
https://us-cert.cisa.gov/ncas/current-activity/2021/09/24/vmware-vcenter-server-vulnerability-cve-2021-22005-under-active
https://us-cert.cisa.gov/ncas/current-activity/2021/09/24/vmware-vcenter-server-vulnerability-cve-2021-22005-under-active
FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor
https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/
P.S. Thx for the link to @Thatskriptkid
https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/
P.S. Thx for the link to @Thatskriptkid
Microsoft News
FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor
In-depth analysis of newly detected NOBELIUM malware: a post-exploitation backdoor that Microsoft Threat Intelligence Center (MSTIC) refers to as FoggyWeb. NOBELIUM uses FoggyWeb to remotely exfiltrate the configuration database of compromised AD FS servers…
fail2ban – Remote Code Execution
https://research.securitum.com/fail2ban-remote-code-execution/
P.S. thx for the link dear subsciber 🤟
https://research.securitum.com/fail2ban-remote-code-execution/
P.S. thx for the link dear subsciber 🤟
research.securitum.com
fail2ban - Remote Code Execution - research.securitum.com
This article is about the recently published security advisory for a pretty popular software, fail2ban (CVE-2021-32749). It is about a bug that may lead to Remote Code Execution.
CSI_SELECTING-HARDENING-REMOTE-ACCESS-VPNS-20210928.PDF
413.9 KB
Selecting and Hardening Remote Access VPN
Recommendations from NSA*
Recommendations from NSA*
New Azure Active Directory password brute-forcing flaw has no fix
https://arstechnica.com/information-technology/2021/09/new-azure-active-directory-password-brute-forcing-flaw-has-no-fix/
https://arstechnica.com/information-technology/2021/09/new-azure-active-directory-password-brute-forcing-flaw-has-no-fix/
Ars Technica
New Azure Active Directory password brute-forcing flaw has no fix
Microsoft says AD authentication responses are working as intended.
Expert found RCE in Visual Studio Code Remote Development ExtensionSecurity Affairs
https://securityaffairs.co/wordpress/122638/hacking/rce-visual-studio-code-remote-development-extension.html
https://securityaffairs.co/wordpress/122638/hacking/rce-visual-studio-code-remote-development-extension.html
Security Affairs
Expert found RCE in Visual Studio Code Remote Development Extension
Researchers from cybersecurity firm Shielder found a remote code execution vulnerability in Visual Studio Code Remote Development Extension.
Tomiris backdoor and its connection to Sunshuttle and Kazuar
DNS hijacking in government zones*
https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/
DNS hijacking in government zones*
https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/
Securelist
Tomiris backdoor and its connection to Sunshuttle and Kazuar
We discovered a campaign delivering the Tomiris backdoor that shows a number of similarities with the Sunshuttle malware distributed by DarkHalo APT and target overlaps with Kazuar.
GriftHorse Android Trojan Steals Millions from Over 10 Million Victims Globally
https://blog.zimperium.com/grifthorse-android-trojan-steals-millions-from-over-10-million-victims-globally/
https://blog.zimperium.com/grifthorse-android-trojan-steals-millions-from-over-10-million-victims-globally/
BluStealer: from SpyEx to ThunderFox - Avast Threat Labs
https://decoded.avast.io/anhho/blustealer/
https://decoded.avast.io/anhho/blustealer/
Avast Threat Labs
BluStealer: from SpyEx to ThunderFox - Avast Threat Labs
BluStealer (a310logger) is is a crypto stealer, keylogger, and document uploader written in Visual Basic that loads C#.NET hack tools to steal credentials.