Bunch of News
Exclusive: Resecurity discovered 0-day vulnerability in TP-Link Wi-Fi 6 devices
https://securityaffairs.co/wordpress/125016/hacking/0-day-tp-link-wi-fi-6.html
IKEA email systems hit by ongoing cyberattack
https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/
Panasonic India's Data Released in Extortion Plot
https://www.bankinfosecurity.com/panasonic-india-held-to-500k-ransom-data-released-a-15573
Zoom vulnerability. This can potentially allow a malicious actor to crash the service or application, or leverage this vulnerability to execute arbitrary code.
https://nvd.nist.gov/vuln/detail/CVE-2021-34423
CronRAT malware hides behind February 31st
https://sansec.io/research/cronrat
https://gist.github.com/gwillem/fbe3e6b98e2e10d7f1f271ca4b6e813f
GitHub is back online after a two-hour outage
https://www.theverge.com/2021/11/27/22805076/github-down-outage-service-issues
Exclusive: Resecurity discovered 0-day vulnerability in TP-Link Wi-Fi 6 devices
https://securityaffairs.co/wordpress/125016/hacking/0-day-tp-link-wi-fi-6.html
IKEA email systems hit by ongoing cyberattack
https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/
Panasonic India's Data Released in Extortion Plot
https://www.bankinfosecurity.com/panasonic-india-held-to-500k-ransom-data-released-a-15573
Zoom vulnerability. This can potentially allow a malicious actor to crash the service or application, or leverage this vulnerability to execute arbitrary code.
https://nvd.nist.gov/vuln/detail/CVE-2021-34423
CronRAT malware hides behind February 31st
https://sansec.io/research/cronrat
https://gist.github.com/gwillem/fbe3e6b98e2e10d7f1f271ca4b6e813f
GitHub is back online after a two-hour outage
https://www.theverge.com/2021/11/27/22805076/github-down-outage-service-issues
Security Affairs
Resecurity discovered 0-day vulnerability in TP-Link Wi-Fi 6 devices
Resecurity researchers found a zero-day vulnerability in the TP-Link enterprise device with model number TL-XVR1800L.
Blocky Listener Daemon (BLD) Service Update Announcement
BLD is a free DoT/DoH/DNS service that prevents tracking, telemetry collection, advertising, malicious content, etc., to improve privacy and distraction-free experience
What's new in this update:
• Got rid of NGINX proxy to reduce overhead. Now all requests are handled by BLD service itself
• Migrated from Let's Encrypt to ACME Cloudflare
• Added / Updated prevention from Clickbait, Coinhive, Malware
• New project logo
• Added info on how to report blocking issues in dns-hole repo
See also:
• "What is BLD?" presentation (RU)
How to use:
• https://lab.sys-adm.in
P.S. Previouse announce
#bld #announce
BLD is a free DoT/DoH/DNS service that prevents tracking, telemetry collection, advertising, malicious content, etc., to improve privacy and distraction-free experience
What's new in this update:
• Got rid of NGINX proxy to reduce overhead. Now all requests are handled by BLD service itself
• Migrated from Let's Encrypt to ACME Cloudflare
• Added / Updated prevention from Clickbait, Coinhive, Malware
• New project logo
• Added info on how to report blocking issues in dns-hole repo
See also:
• "What is BLD?" presentation (RU)
How to use:
• https://lab.sys-adm.in
P.S. Previouse announce
#bld #announce
lab.sys-adm.in
Sys-Admin Laboratory
Open Sys-Admin BLD DNS - Focus on information for free with adblocking and implicit cybersecurity threat prevention.
Sys-Admin InfoSec pinned «Blocky Listener Daemon (BLD) Service Update Announcement BLD is a free DoT/DoH/DNS service that prevents tracking, telemetry collection, advertising, malicious content, etc., to improve privacy and distraction-free experience What's new in this update: …»
Bunch of News
DNA Data Security Incident
DNA Diagnostics Center, Inc. (DDC) detected potential unauthorized access to its network, during which there was unauthorized access and acquisition of an archived database
https://dnacenter.com/data-security-incident-information-center/
Printing Shellz
This paper will walk you through the steps of our journey, from how we discovered the vulnerabilities, how we lovingly crafted the exploits and provides mitigation advice also. The vulnerabilities that were discovered affect more than 150 HP multi-function printers (MFPs).
https://labs.f-secure.com/publications/printing-shellz
Illicit coin mining, ransomware, APTs target cloud users in first Google Cybersecurity Action Team Threat Horizons report
https://cloud.google.com/blog/products/identity-security/coin-mining-ransomware-apts-target-cloud-gcat-report
DNA Data Security Incident
DNA Diagnostics Center, Inc. (DDC) detected potential unauthorized access to its network, during which there was unauthorized access and acquisition of an archived database
https://dnacenter.com/data-security-incident-information-center/
Printing Shellz
This paper will walk you through the steps of our journey, from how we discovered the vulnerabilities, how we lovingly crafted the exploits and provides mitigation advice also. The vulnerabilities that were discovered affect more than 150 HP multi-function printers (MFPs).
https://labs.f-secure.com/publications/printing-shellz
Illicit coin mining, ransomware, APTs target cloud users in first Google Cybersecurity Action Team Threat Horizons report
https://cloud.google.com/blog/products/identity-security/coin-mining-ransomware-apts-target-cloud-gcat-report
How to Install Brew on Ubuntu and Other Linux
i'm not sure need it or not, but it is can be interesting..:
https://itsfoss.com/homebrew-linux/
i'm not sure need it or not, but it is can be interesting..:
https://itsfoss.com/homebrew-linux/
It's FOSS
How to Install Homebrew on Ubuntu and Other Linux
Homebrew is a popular command line based package manager for macOS. It can also be installed and used on Linux. Here's why and how.
Hackers all over the world are targeting Tasmania’s emergency services | Malwarebytes Labs
https://blog.malwarebytes.com/hacking-2/2021/11/hack-tasmania/
https://blog.malwarebytes.com/hacking-2/2021/11/hack-tasmania/
Malwarebytes
Hackers all over the world are targeting Tasmania’s emergency services
The Island state of Tasmania in Australia continues to be subjected to multiple cyberattacks on its emergency services from all around the globe.
Smishing Botnets Going Viral in Iran
Интересно не где, а как...
https://research.checkpoint.com/2021/smishing-botnets-going-viral-in-iran/
Интересно не где, а как...
https://research.checkpoint.com/2021/smishing-botnets-going-viral-in-iran/
Check Point Research
Smishing Botnets Going Viral in Iran - Check Point Research
Research by: Shmuel Cohen Introduction In the last few months, multiple Iranian media and social networks have published warnings about ongoing SMS phishing campaigns impersonating Iranian government services. The story is as old as time: victims click on…
Производители умных ТВ зарабатывают на слежке за пользователями больше, чем на самих телевизорах
https://habr.com/ru/company/globalsign/blog/592407/
https://habr.com/ru/company/globalsign/blog/592407/
Хабр
Производители умных ТВ зарабатывают на слежке за пользователями больше, чем на самих телевизорах
Сетевая активность телевизора в программе IoT Inspector . Скриншот: Geoffrey Fowler/The Washington Post В 2019 году мы рассказывали, что умные телевизоры Samsung, LG, Vizio и TCL ежесекундно снимают...
l0ggg/VMware_vCenter: VMware vCenter 7.0.2.00100 unauth Arbitrary File Read + SSRF + Reflected XSS
PoC
https://github.com/l0ggg/VMware_vCenter
BPF-Based Linux Firewall "bpfilter" Shows Impressive Performance Potential
https://www.phoronix.com/scan.php?page=news_item&px=BPFILTER-2021
P.S. thx for the links dear subscriber ✌️
PoC
https://github.com/l0ggg/VMware_vCenter
BPF-Based Linux Firewall "bpfilter" Shows Impressive Performance Potential
https://www.phoronix.com/scan.php?page=news_item&px=BPFILTER-2021
P.S. thx for the links dear subscriber ✌️
GitHub
GitHub - l0ggg/VMware_vCenter: VMware vCenter 7.0.2.00100 unauth Arbitrary File Read + SSRF + Reflected XSS
VMware vCenter 7.0.2.00100 unauth Arbitrary File Read + SSRF + Reflected XSS - l0ggg/VMware_vCenter
NginRAT - A stealth malware targets e-store hiding on Nginx serversSecurity Affairs
https://securityaffairs.co/wordpress/125216/malware/nginrat-magecart-attack.html
https://securityaffairs.co/wordpress/125216/malware/nginrat-magecart-attack.html
Security Affairs
NginRAT - A stealth malware targets e-store hiding on Nginx servers
Threat actors are targeting e-stores with remote access malware that hides on Nginx servers bypassing security solutions.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Алматы, 11 декабря, сбор на тему бинарщины (update)
В прошлый раз я писал о грядущей встрече, тему бинарщины и не только, осталось менее 10 дней до этой движухи.
В виду чего высылаю почти окончательный вариант тем:
1. Мошенничество OLX: Итоги расследования (morty)
2. Attacking Software Developers. Часть 1 (thatskriptkid)
3. Почему вы этого не делаете? (novitoll)
4. Attacking Software Developers. Часть 2 (thatskriptkid)
5. Эксплоитить Линукс ядро стало сложнее, но нас не остановить (novitoll)
6. Бофаем винду сокетами (undefi)
- Формат: оффлайн и только (будет бесплатное пиво (в разумных количествах) + доклады :))
- Дата: 11 декабря (следующая суббота), начало в 18:00 по местному времени
- Место: Lenore Pub, проспект Абая, 124, https://go.2gis.com/jozza
В прошлый раз я писал о грядущей встрече, тему бинарщины и не только, осталось менее 10 дней до этой движухи.
В виду чего высылаю почти окончательный вариант тем:
1. Мошенничество OLX: Итоги расследования (morty)
2. Attacking Software Developers. Часть 1 (thatskriptkid)
3. Почему вы этого не делаете? (novitoll)
4. Attacking Software Developers. Часть 2 (thatskriptkid)
5. Эксплоитить Линукс ядро стало сложнее, но нас не остановить (novitoll)
6. Бофаем винду сокетами (undefi)
- Формат: оффлайн и только (будет бесплатное пиво (в разумных количествах) + доклады :))
- Дата: 11 декабря (следующая суббота), начало в 18:00 по местному времени
- Место: Lenore Pub, проспект Абая, 124, https://go.2gis.com/jozza
Telegram
Sys-Admin InfoSec
Алматы, 11 декабря, сбор на тему реверса/малвари/фаззинга/эсплоитов
И + любая бинарщина - будет на очередном, открытом митапе r0crewKZ, с бесплатным пивом (в разумных пределах) и конечно же докладами)
Глубокое погружение в темы:
• Мошенничество OLX:…
NVD - CVE-2018-14847
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
https://nvd.nist.gov/vuln/detail/CVE-2018-14847
CVE-2021-40438 Detail
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
https://nvd.nist.gov/vuln/detail/CVE-2021-40438
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
https://nvd.nist.gov/vuln/detail/CVE-2018-14847
CVE-2021-40438 Detail
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
https://nvd.nist.gov/vuln/detail/CVE-2021-40438
Magnat campaigns use malvertising to deliver information stealer, backdoor and malicious Chrome extension
https://blog.talosintelligence.com/2021/12/magnat-campaigns-use-malvertising-to.html
https://blog.talosintelligence.com/2021/12/magnat-campaigns-use-malvertising-to.html
Cisco Talos Blog
Magnat campaigns use malvertising to deliver information stealer, backdoor and malicious Chrome extension
By Tiago Pereira.
* Talos recently observed a malicious campaign offering fake installers of popular software as bait to get users to execute malware on their systems.
* This campaign includes a set of malware distribution campaigns that started in late…
* Talos recently observed a malicious campaign offering fake installers of popular software as bait to get users to execute malware on their systems.
* This campaign includes a set of malware distribution campaigns that started in late…
Scammers Mimic Microsoft with ‘Spam Notification’ Phishing Email
https://www.mailguard.com.au/blog/scammers-mimic-microsoft-with-spam-notification-phishing-email
https://www.mailguard.com.au/blog/scammers-mimic-microsoft-with-spam-notification-phishing-email
www.mailguard.com.au
Scammers Mimic Microsoft with ‘Spam Notification’ Phishing Email
Microsoft customers are being targeted with a fraudulent ‘Spam Notification’ email advising them that a message has been quarantined by the ‘Security and Compliance Center’. In fact, this is a bid by cybercriminals to lure unsuspecting victims into providing…
Invisible rat: how Sentry, Datadog, and others used by XSS and JavaScript malware
https://lab.wallarm.com/invisible-rat-how-sentry-datadog-and-others-used-by-xss-and-javanoscript-malware/
P.S. Thx for the link ✌️
https://lab.wallarm.com/invisible-rat-how-sentry-datadog-and-others-used-by-xss-and-javanoscript-malware/
P.S. Thx for the link ✌️
Wallarm
Invisible rat: how Sentry, Datadog, and others used by XSS and JavaScript malware — API Security
This article will explain how it could happen and what to do to catch and prevent such kinds of exploits.
Introducing CentOS Stream 9
https://blog.centos.org/2021/12/introducing-centos-stream-9/
P.S. CentOS 9 Released
CentOS Linux 8 will reach End Of Life (EOL) on December 31st, 2021:
https://www.centos.org/centos-linux-eol/
EPEL 9 is now available
https://communityblog.fedoraproject.org/epel-9-is-now-available/
https://github.com/m0zgen/centos8-to-stream
https://blog.centos.org/2021/12/introducing-centos-stream-9/
P.S. CentOS 9 Released
CentOS Linux 8 will reach End Of Life (EOL) on December 31st, 2021:
https://www.centos.org/centos-linux-eol/
EPEL 9 is now available
https://communityblog.fedoraproject.org/epel-9-is-now-available/
⚙ Simple noscript for converting CentOS 8 to CentOS 8 Streamhttps://github.com/m0zgen/centos8-to-stream
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Публикация Go релизов в GitHub
Недавно написал небольшую утилиту на Go - BENCH-DNS для нагрузочного тестирования DNS серверов, логика проста - создается файл или загружается файл (лист) с доменными именами и в многопоточном режиме в несколько итераций посылаются запросы на резольвинг имен, где в этот момент на самом DNS сервере отлавливаем нагрузку, смотрим кэш и тп. Так вот, собственно утилита есть, теперь нужно сделать автоматически публикуемые и собираемые релизы к этому делу. Для этого решил использовать GORELEASER, далее расскажу на примере репозитория BENCH-DNS как я создавал релизы.
https://sys-adm.in/systadm/969-publikatsiya-go-relizov-v-github.html
P.S. Чуть позже выложу мануал / описание как работает bench-dns
Недавно написал небольшую утилиту на Go - BENCH-DNS для нагрузочного тестирования DNS серверов, логика проста - создается файл или загружается файл (лист) с доменными именами и в многопоточном режиме в несколько итераций посылаются запросы на резольвинг имен, где в этот момент на самом DNS сервере отлавливаем нагрузку, смотрим кэш и тп. Так вот, собственно утилита есть, теперь нужно сделать автоматически публикуемые и собираемые релизы к этому делу. Для этого решил использовать GORELEASER, далее расскажу на примере репозитория BENCH-DNS как я создавал релизы.
https://sys-adm.in/systadm/969-publikatsiya-go-relizov-v-github.html
P.S. Чуть позже выложу мануал / описание как работает bench-dns
GitHub
GitHub - m0zgen/bench-dns: Simple noscript fro DNS upload testing. Written in Go.
Simple noscript fro DNS upload testing. Written in Go. - m0zgen/bench-dns
indicator_of_cuba_ramsomware.pdf
1.4 MB
Indicators of Compromise Associated with Cuba
Ransomware. Warn from FBI.
Ransomware. Warn from FBI.
Vulnerability in Cisco Security Devices is Dangerous For Business Processes of Large Companies
https://www.ptsecurity.com/ww-en/about/news/vulnerability-in-cisco-security-devices-is-dangerous-for-business-processes-of-large-companies/
https://www.ptsecurity.com/ww-en/about/news/vulnerability-in-cisco-security-devices-is-dangerous-for-business-processes-of-large-companies/
CoinHelper Research | Avast
https://blog.avast.com/coinhelper-research-avast
https://blog.avast.com/coinhelper-research-avast
Avast
CoinHelper hides in repackaged installers of software, Windows 11, games, and antivirus
Fortunately, there’s an easy way to protect yourself from CoinHelper: don’t download illegal, cracked, unauthorized, repackaged copies of games, cheats, applications, security software, and operating systems.