New OpenVpn Relase with some vulnerability fixes
The OpenVPN community project team is proud to release OpenVPN 2.5.6. This is mostly a bugfix release including one security fix ("Disallow multiple deferred authentication plug-ins.", CVE: 2022-0547):
https://openvpn.net/community-downloads/
The OpenVPN community project team is proud to release OpenVPN 2.5.6. This is mostly a bugfix release including one security fix ("Disallow multiple deferred authentication plug-ins.", CVE: 2022-0547):
https://openvpn.net/community-downloads/
OpenVPN
Open Source Community | OpenVPN
OpenVPN has many developers and contributors from OpenVPN Inc. and from the broader OpenVPN community.
Открытые практикумы DevOps и Linux by Rebrain (22 и 23 Марта)
Docker-compose и как работает сеть в докере
• Наводим порядок в работе с контейнерами
• Как могут взаимодействовать контейнеры между собой и как нам здесь поможет сеть?
• Сажаем контейнеры на бочку с порохом и смотрим как это взлетит
• 22 Марта 19.00 МСК. Детали
• Амир Гайфуллин - 12 лет в IT и 3 года в DevOps.
Linux by Rebrain: RAID-массивы
• RAID-массивы: виды, особенности.
• Как подобрать тип RAID-массива?
• Актуальны ли сегодня аппаратные RAID-контроллеры?
• Работа с mdadm.
• 23 Марта 20.00 МСК. Детали
• Андрей Буранов - Специалист по UNIX-системам в компании Mail.Ru Group.
#free #webinar #dnt #ru
/ New Ransomware Family Identified: LokiLocker RaaS Targets Windows Systems
Technical review:
https://blogs.blackberry.com/en/2022/03/lokilocker-ransomware
Technical review:
https://blogs.blackberry.com/en/2022/03/lokilocker-ransomware
BlackBerry
New Ransomware Family Identified: LokiLocker RaaS Targets Windows Systems
BlackBerry Threat Intelligence has identified a new Ransomware-as-a-Service (Raas) family, and tracked its lineage to its probable beta stage release.
/ Increase In Malware Sightings on GoDaddy Managed Hosting
https://www.wordfence.com/blog/2022/03/increase-in-malware-sightings-on-godaddy-managed-hosting/
https://www.wordfence.com/blog/2022/03/increase-in-malware-sightings-on-godaddy-managed-hosting/
Wordfence
Increase In Malware Sightings on GoDaddy Managed Hosting
Today, March 15, 2022, The Wordfence Incident Response team alerted our Threat Intelligence team to an increase in infected websites hosted on GoDaddy’s Managed WordPress service, which includes MediaTemple, tsoHost, 123Reg, Domain Factory, Heart Internet…
/ Have Your Cake and Eat it Too? An Overview of UNC2891
The Mandiant Advanced Practices team previously published a threat research blog post that provided an overview of UNC1945 operations where the actor compromised managed services providers to gain access to targets in the financial and professional consulting industries.
Since that time, Mandiant has investigated and attributed several intrusions to a threat cluster we believe has a nexus to this actor, currently being tracked as UNC2891. Through these investigations, Mandiant has discovered additional techniques, malware, and utilities being used by UNC2891 alongside those previously observed in use by UNC1945…
Tecnical review
https://www.mandiant.com/resources/unc2891-overview
The Mandiant Advanced Practices team previously published a threat research blog post that provided an overview of UNC1945 operations where the actor compromised managed services providers to gain access to targets in the financial and professional consulting industries.
Since that time, Mandiant has investigated and attributed several intrusions to a threat cluster we believe has a nexus to this actor, currently being tracked as UNC2891. Through these investigations, Mandiant has discovered additional techniques, malware, and utilities being used by UNC2891 alongside those previously observed in use by UNC1945…
Tecnical review
https://www.mandiant.com/resources/unc2891-overview
Google Cloud Blog
Live off the Land? How About Bringing Your Own Island? An Overview of UNC1945 | Mandiant | Google Cloud Blog
/ Use dynamic IP addresses through Cloudflare
Some hosting providers dynamically update their customer’s IP addresses. These customers must then update the new origin server IPs in their Cloudflare DNS
https://developers.cloudflare.com/dns/manage-dns-records/how-to/managing-dynamic-ip-addresses/
Some hosting providers dynamically update their customer’s IP addresses. These customers must then update the new origin server IPs in their Cloudflare DNS
https://developers.cloudflare.com/dns/manage-dns-records/how-to/managing-dynamic-ip-addresses/
/ Gh0stCringe RAT Being Distributed to Vulnerable Database Servers
The ASEC analysis team is constantly monitoring malware distributed to vulnerable database servers (MS-SQL, MySQL servers). This blog will explain the RAT malware named Gh0stCringe:
https://asec.ahnlab.com/en/32572/
The ASEC analysis team is constantly monitoring malware distributed to vulnerable database servers (MS-SQL, MySQL servers). This blog will explain the RAT malware named Gh0stCringe:
https://asec.ahnlab.com/en/32572/
ASEC
Gh0stCringe RAT Being Distributed to Vulnerable Database Servers - ASEC
Gh0stCringe RAT Being Distributed to Vulnerable Database Servers ASEC
Note: DNS Proxy Mechanism updated on BLD DNS
Maybe as you know BLD DNS works on few ports in DoH mode - 443, 8443
You can use any of these ports in your browsers or devices, but I want to note you about how these modes work:
- 443 it is a native BLD service
- 8443 is is a reverse proxy (nginx or can be another service/mechanism)
⚡️ if you notice that some mode is not working properly, immediately as possible let me know about it - @sysadminkz
Example: How to setup Customised DNS your browser.
Settings > Privacy and security > Security > Use secure DNS > Customised:
-
or
-
See details here (Firefox, Chrome, Brave, Edge):
- https://github.com/m0zgen/blocky-listener-daemon/wiki
Maybe as you know BLD DNS works on few ports in DoH mode - 443, 8443
You can use any of these ports in your browsers or devices, but I want to note you about how these modes work:
- 443 it is a native BLD service
- 8443 is is a reverse proxy (nginx or can be another service/mechanism)
⚡️ if you notice that some mode is not working properly, immediately as possible let me know about it - @sysadminkz
Example: How to setup Customised DNS your browser.
Settings > Privacy and security > Security > Use secure DNS > Customised:
-
https://bld.sys-adm.in/dns-queryor
-
https://bld.sys-adm.in:8443/dns-querySee details here (Firefox, Chrome, Brave, Edge):
- https://github.com/m0zgen/blocky-listener-daemon/wiki
lab.sys-adm.in
Sys-Admin Laboratory
Open Sys-Admin BLD DNS - Focus on information for free with adblocking and implicit cybersecurity threat prevention.
/ dompdf security alert: RCE vulnerability found in popular PHP PDF library
https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/
https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/
Snyk
dompdf security alert: RCE vulnerability found in popular PHP PDF library | Snyk
A major RCE vulnerability has been identified in PHP library dompdf. Code can be loaded into an application and then remotely executed whilst a PDF is being generated.
/ Cyclops Blink Sets Sights on Asus Routers
https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
Trend Micro
Cyclops Blink Sets Sights on Asus Routers
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
RouterOS Scanner
Forensics tool for Mikrotik devices. Search for suspicious properties and weak security points that need to be fixed on the router:
https://github.com/microsoft/routeros-scanner
Forensics tool for Mikrotik devices. Search for suspicious properties and weak security points that need to be fixed on the router:
https://github.com/microsoft/routeros-scanner
GitHub
GitHub - microsoft/routeros-scanner: Tool to scan for RouterOS (Mikrotik) forensic artifacts and vulnerabilities.
Tool to scan for RouterOS (Mikrotik) forensic artifacts and vulnerabilities. - microsoft/routeros-scanner
/ Serpent, No Swiping! New Backdoor Targets French Entities with Unique Attack Chain
https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain
https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain
Proofpoint
Serpent, No Swiping! New Backdoor Targets French Entities with Unique Attack Chain | Proofpoint US
Key Findings Proofpoint identified a targeted attack leveraging an open-source package installer Chocolatey to deliver a backdoor. The attack targeted French entities in the construction,
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
How to use the Emsisoft Decryptor for Diavol
https://www.emsisoft.com/ransomware-decryption-tools/howtos/emsisoft_howto_diavol.pdf
https://www.emsisoft.com/ransomware-decryption-tools/howtos/emsisoft_howto_diavol.pdf
BLD DNS: One more server received as a gift from X-rdp.co
Hey, several days ago I published post (En denoscription) about the new server that was added to the BLD DNS infrastructure.
Today, I glad to present to you new server provided for BLD DNS from X-RDP.CO, located in Canada, I am really very happy, now I tested this server and want to present to you some information about of him:
- Speedtest - Download 940Mbps / Upload 236Mbps
- Storage IO - Write 1.1GB/s / Read7.1 GB/s
- CPU - AMD EPYC, 2395 MHz, KVM (AMD-V), 5 CPU Cores, 2 GB RAM
This server provided minimum on one year, I hope this service will bring a lot of benefits to the users of the service.
And I have another news - I requested from x-rdp.co discount coupon code and now I glad to present yo you
- Code: SYS10
- Discoint: 10%
I want to express my gratitude to the hosting, thank you, success to you and prosperity!
Take you care and safety. PEACE ✌️
P.S. BLD DNS Project site: https://lab.sys-adm.in
#bld #dns #thanks
/ Spyware dubbed Facestealer infects 100,000+ Google Play users
https://blog.pradeo.com/spyware-facestealer-google-play
https://blog.pradeo.com/spyware-facestealer-google-play
Pradeo
Spyware dubbed Facestealer infects 100,000+ Google Play users
Pradeo has detected a malicious mobile application currently distributed on Google Play and installed by 100,000+ users.
/ Certain HP Print Products, Digital Sending Products – Potential remote code execution and buffer overflow
https://support.hp.com/us-en/document/ish_5948778-5949142-16/hpsbpi03780
https://support.hp.com/us-en/document/ish_5948778-5949142-16/hpsbpi03780
/ Deadbolt Ransomware is Back
QNAP uder attack:
https://censys.wpengine.com/deadbolt-ransomware-is-back/
QNAP uder attack:
https://censys.wpengine.com/deadbolt-ransomware-is-back/
/ Repeatable Failures: AMI UsbRt - Six Years Later, Firmware Attack Vector Still Affect Millions Of Enterprise Devices
Binarly Research Team Coordinates Patching of Dell BIOS Code Execution Vulnerabilities
https://binarly.io/posts/AMI_UsbRt_Repeatable_Failures_A_6_year_old_attack_vector_still_affecting_millions_of_enterprise_devices/index.html
Binarly Research Team Coordinates Patching of Dell BIOS Code Execution Vulnerabilities
https://binarly.io/posts/AMI_UsbRt_Repeatable_Failures_A_6_year_old_attack_vector_still_affecting_millions_of_enterprise_devices/index.html
Sys-Admin InfoSec pinned « BLD DNS: One more server received as a gift from X-rdp.co Hey, several days ago I published post (En denoscription) about the new server that was added to the BLD DNS infrastructure. Today, I glad to present to you new server provided for BLD DNS from X…»
/ Storm Cloud on the Horizon: GIMMICK Malware Strikes at macOS
https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/
https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/
Volexity
Storm Cloud on the Horizon: GIMMICK Malware Strikes at macOS
In late 2021, Volexity discovered an intrusion in an environment monitored as part of its Network Security Monitoring service. Volexity detected a system running frp, otherwise known as fast reverse […]