/ Multiple Vulnerabilities in Schneider Electric APC Smart-UPS Could Allow for Remote Code Execution
https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-schneider-electric-apc-smart-ups-could-allow-for-remote-code-execution_2022-035
https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-schneider-electric-apc-smart-ups-could-allow-for-remote-code-execution_2022-035
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Breaking down the Jupyter Notebook ransomware attack
https://blog.aquasec.com/python-ransomware-jupyter-notebook
https://blog.aquasec.com/python-ransomware-jupyter-notebook
Aqua
Threat Alert: First Python Ransomware Attack Targeting Jupyter Notebooks
Team Nautilus uncovered and analyzed the first Python-based ransomware attack that targets misconfigured Jupyter Notebooks in the wild and encrypts files.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Praetorian
Spring Core on JDK9+ is vulnerable to remote code execution
Update: March 31, 2022 A patch has officially been released. https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement https://tanzu.vmware.com/security/cve-2022-22965 Overview Spring Core on JDK9+ is vulnerable to remote code execution due…
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
CVE-2022-0778
The discovered vulnerability triggers an infinite loop in the function BN_mod_sqrt() of OpenSSL while parsing an elliptic curve key. This means that a maliciously crafted X.509 certificate can DoS any unpatched server.
PoC
https://github.com/drago-96/CVE-2022-0778
The discovered vulnerability triggers an infinite loop in the function BN_mod_sqrt() of OpenSSL while parsing an elliptic curve key. This means that a maliciously crafted X.509 certificate can DoS any unpatched server.
PoC
https://github.com/drago-96/CVE-2022-0778
GitHub
GitHub - drago-96/CVE-2022-0778: Proof of concept for CVE-2022-0778, which triggers an infinite loop in parsing X.509 certificates…
Proof of concept for CVE-2022-0778, which triggers an infinite loop in parsing X.509 certificates due to a bug in BN_mod_sqrt - drago-96/CVE-2022-0778
/ About the security content of iOS 15.4.1 and iPadOS 15.4.1
Impact: An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited
https://support.apple.com/en-gb/HT213219
Impact: An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited
https://support.apple.com/en-gb/HT213219
Apple Support
About the security content of iOS 15.4.1 and iPadOS 15.4.1
This document describes the security content of iOS 15.4.1 and iPadOS 15.4.1.
/ GitLab Accounts Hijacking
Critical Security Release: 14.9.2, 14.8.5, and 14.7.7
We strongly recommend that all GitLab installations be upgraded to one of these versions immediately
https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/
Critical Security Release: 14.9.2, 14.8.5, and 14.7.7
We strongly recommend that all GitLab installations be upgraded to one of these versions immediately
https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/
GitLab
GitLab Critical Security Release: 14.9.2, 14.8.5, and 14.7.7
Learn more about GitLab Critical Security Release: 14.9.2, 14.8.5, and 14.7.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).
/ Detecting Rogue RDP
This post examines signals generated by the attack, outlines detection opportunities, and discusses required sysmon configuration changes.
https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
This post examines signals generated by the attack, outlines detection opportunities, and discusses required sysmon configuration changes.
https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
BLD DNS: What's new and useful added in the project ecosystem / Что нового и полезного появилось в экосистеме проекта
~~~RU
Экосистема постоянно обновляется, допиливается, усовершенствуется, сам проект обрастает дополнительными инструментами (pat 1), сегодня хочу представить еще ряд тулз, которые могут быть полезны и вам:
- Blinker - асинхронно пингует сервера, резольвит IP адреса, проверяет скорость ответа (в будущем планируется развить до автоматических уведомлений, например в телеграм)
- BLD-Server - конфигурируемый апдейтер BLD серверов (как правило используется для вспомогательных downstream cерверов), качает указанные в конфиге листы, вычищает их от комментов и тп, объединяет, сортирует и публикует, как итог - один лист для каждой категории, меньше размера, меньше файлов)
- Simple Log Color - NPM пакет. Раскрашиватель аутпут лога в консоль
- Fix Appstream - Фиксит ошибку CentOS 8 (Error: Failed to download metadata for repo 'appstream’). Ошибка блокирует нормальный апедйт серверов.
- Fix Locales - Фиксит ошибку баш консоли в Debian в отношении локали (LCALL: cannot change locale (enUS.UTF-8)
- Apt Automatic - Настраивает автоапдейтинг Debian при помощи unattended-upgrades
- Install Node Exporter - Ставит последнию версию экспортера в Debian
~~~EN
BLD DNS ecosystem is constantly updated, completed, improved, the project itself is overgrown with additional tools (pat 1), today I want to present a few number of tools that may be useful to you:
- Blinker - asynchronously pings servers, resolves IP addresses, checks response speed (in the future it is planned to develop to automatic notifications, for example, in telegrams)
- BLD-Server - configurable BLD server updater (usually used for auxiliary downstream servers), downloads the lists specified in the config, cleans them from comments, etc., merges, sorts and publishes, as a result - one sheet for each category, smaller size, fewer files)
- Simple Log Color - NPM package. Colorizer output log to console
- Fix Appstream - Fixes CentOS 8 error (Error: Failed to download metadata for repo 'appstream'). Error blocking normal server update.
- Fix Locales - Fixes bash console error in Debian (LCALL: cannot change locale (enUS.UTF-8)
- Apt Automatic - Configures Debian autoupgrade with unattended-upgrades
- Install Node Exporter - Install latest Node Exporter in to Debian
~~~RU
Экосистема постоянно обновляется, допиливается, усовершенствуется, сам проект обрастает дополнительными инструментами (pat 1), сегодня хочу представить еще ряд тулз, которые могут быть полезны и вам:
- Blinker - асинхронно пингует сервера, резольвит IP адреса, проверяет скорость ответа (в будущем планируется развить до автоматических уведомлений, например в телеграм)
- BLD-Server - конфигурируемый апдейтер BLD серверов (как правило используется для вспомогательных downstream cерверов), качает указанные в конфиге листы, вычищает их от комментов и тп, объединяет, сортирует и публикует, как итог - один лист для каждой категории, меньше размера, меньше файлов)
- Simple Log Color - NPM пакет. Раскрашиватель аутпут лога в консоль
- Fix Appstream - Фиксит ошибку CentOS 8 (Error: Failed to download metadata for repo 'appstream’). Ошибка блокирует нормальный апедйт серверов.
- Fix Locales - Фиксит ошибку баш консоли в Debian в отношении локали (LCALL: cannot change locale (enUS.UTF-8)
- Apt Automatic - Настраивает автоапдейтинг Debian при помощи unattended-upgrades
- Install Node Exporter - Ставит последнию версию экспортера в Debian
~~~EN
BLD DNS ecosystem is constantly updated, completed, improved, the project itself is overgrown with additional tools (pat 1), today I want to present a few number of tools that may be useful to you:
- Blinker - asynchronously pings servers, resolves IP addresses, checks response speed (in the future it is planned to develop to automatic notifications, for example, in telegrams)
- BLD-Server - configurable BLD server updater (usually used for auxiliary downstream servers), downloads the lists specified in the config, cleans them from comments, etc., merges, sorts and publishes, as a result - one sheet for each category, smaller size, fewer files)
- Simple Log Color - NPM package. Colorizer output log to console
- Fix Appstream - Fixes CentOS 8 error (Error: Failed to download metadata for repo 'appstream'). Error blocking normal server update.
- Fix Locales - Fixes bash console error in Debian (LCALL: cannot change locale (enUS.UTF-8)
- Apt Automatic - Configures Debian autoupgrade with unattended-upgrades
- Install Node Exporter - Install latest Node Exporter in to Debian
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
/ Deep Dive Analysis – Borat RAT
Remote Access Trojan Capable Of Conducting Ransomware & DDOS Activities
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Remote Access Trojan Capable Of Conducting Ransomware & DDOS Activities
https://blog.cyble.com/2022/03/31/deep-dive-analysis-borat-rat/
Cyble
Deep Dive Analysis – Borat RAT | Cyble
Cyble Research Labs analyzes Borat , a sophisticated RAT variant that boasts a combination of Remote Access Trojan, Spyware, Ransomware and DDoS capabilities.
/ How to create dynamic inventory files in Ansible
https://www.redhat.com/sysadmin/ansible-dynamic-inventories
https://www.redhat.com/sysadmin/ansible-dynamic-inventories
Redhat
How to create dynamic inventory files in Ansible
If you use Ansible, you know the inventory is one of its fundamental pieces. The inventory is just a list of machines and possible variables where you c...
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
/ Malware Specifically Targeting AWS Lambda
https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/
P.S. Malware domains already blocked in BLD DNS https://lab.sys-adm.in
https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/
P.S. Malware domains already blocked in BLD DNS https://lab.sys-adm.in
Darktrace
Solve Cloud Forensics at Scale
Darktrace has acquired Cado security, a cyber investigation and response solution provider and leader in cloud data capture and forensics.
/ BlackCat RaaS (ransomware as a service)
BlackCat is a recent and growing ransomware-as-a-service (RaaS) group that targeted several organizations worldwide over the past few months:
https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html
BlackCat is a recent and growing ransomware-as-a-service (RaaS) group that targeted several organizations worldwide over the past few months:
https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html
Cisco Talos Blog
From BlackMatter to BlackCat: Analyzing two attacks from one affiliate
* BlackCat is a recent and growing ransomware-as-a-service (RaaS) group that targeted several organizations worldwide over the past few months.
* There are rumors of a relationship between BlackCat and the BlackMatter/DarkSide ransomware groups, infamous…
* There are rumors of a relationship between BlackCat and the BlackMatter/DarkSide ransomware groups, infamous…
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Unmanaged Code Execution With .net Dynamic Pinvoke
In this post, .NET loosely refers to modern versions of the .NET Framework (4+). Other versions of .NET runtimes (e.g. Core) may be relevant.
DInvoke is an API for dynamically calling the Windows API, using syscalls, and evading endpoint security controls through powerful primitives and other advanced features such as module overloading and manual mapping.
https://bohops.com/2022/04/02/unmanaged-code-execution-with-net-dynamic-pinvoke/
In this post, .NET loosely refers to modern versions of the .NET Framework (4+). Other versions of .NET runtimes (e.g. Core) may be relevant.
DInvoke is an API for dynamically calling the Windows API, using syscalls, and evading endpoint security controls through powerful primitives and other advanced features such as module overloading and manual mapping.
https://bohops.com/2022/04/02/unmanaged-code-execution-with-net-dynamic-pinvoke/
bohops
Unmanaged Code Execution with .NET Dynamic PInvoke
Yes, you read that correctly – “Dynamic Pinvoke” as in “Dynamic Platform Invoke” Background Recently, I was browsing through Microsoft documentation and other blogs to…
/ Parrot TDS takes over web servers and threatens millions
A new Traffic Direction System (TDS) calling as Parrot TDS, using tens of thousands of compromised websites, has emerged in recent months and is reaching users from around the world. The TDS has infected various web servers hosting more than 16,500 websites, ranging from adult content sites, personal websites, university sites, and local government sites:
https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/
A new Traffic Direction System (TDS) calling as Parrot TDS, using tens of thousands of compromised websites, has emerged in recent months and is reaching users from around the world. The TDS has infected various web servers hosting more than 16,500 websites, ranging from adult content sites, personal websites, university sites, and local government sites:
https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/
Gendigital
Parrot TDS takes over web servers and threatens millions
Web Server Takeover Threat
/ CISA advises D-Link users to take vulnerable routers offline
https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/04/cisa-advises-d-link-users-to-take-vulnerable-routers-offline/
https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/04/cisa-advises-d-link-users-to-take-vulnerable-routers-offline/
Malwarebytes
CISA advises D-Link users to take vulnerable routers offline
CISA advises users to retire certain D-Link routers since vulnerabilities are know to be actively exploited and the models have reached EOL
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Information/Analysis about of few new info stealer malware’s - BlackGuard, META
/ Analysis of BlackGuard - A New Info Stealer Malware
https://www.zscaler.com/blogs/security-research/analysis-blackguard-new-info-stealer-malware-being-sold-russian-hacking
/ New Meta information stealer distributed in malspam campaign
https://www.bleepingcomputer.com/news/security/new-meta-information-stealer-distributed-in-malspam-campaign/
/ Analysis of BlackGuard - A New Info Stealer Malware
https://www.zscaler.com/blogs/security-research/analysis-blackguard-new-info-stealer-malware-being-sold-russian-hacking
/ New Meta information stealer distributed in malspam campaign
https://www.bleepingcomputer.com/news/security/new-meta-information-stealer-distributed-in-malspam-campaign/
Zscaler
Analysis of BlackGuard - Info Stealer Malware | Zscaler Blog
In this blog, ThreatLabz analyzes BlackGuard, an emerging an info stealer malware being sold as a service on a Russian hacking forum.
/ Performing / Modernization Bleeding Bear techniques
The articles analysis of Bleeding Bear tactics, techniques and procedures left me with a couple of thoughts. The first was, “hey, I can probably perform some of these techniques!” and the second was, “how can I improve on them?
It is a interesting practice article:
https://labs.nettitude.com/blog/repurposing-real-ttps-for-use-on-red-team-engagements/
The articles analysis of Bleeding Bear tactics, techniques and procedures left me with a couple of thoughts. The first was, “hey, I can probably perform some of these techniques!” and the second was, “how can I improve on them?
It is a interesting practice article:
https://labs.nettitude.com/blog/repurposing-real-ttps-for-use-on-red-team-engagements/
LRQA
Repurposing Real TTPs for use on Red Team Engagements
I recently read an interesting article by Elastic. It provides new analysis of a sophisticated, targeted campaign against several organizations. This has been labelled ‘Bleeding Bear’. The articles analysis of Bleeding Bear tactics, techniques and procedures…
/ Amazon RDS PostgreSQL issue
A security researcher recently reported an issue with Aurora PostgreSQL. Using this issue, they were able to gain access to internal credentials that were specific to their Aurora cluster:
https://aws.amazon.com/security/security-bulletins/AWS-2022-004/
A security researcher recently reported an issue with Aurora PostgreSQL. Using this issue, they were able to gain access to internal credentials that were specific to their Aurora cluster:
https://aws.amazon.com/security/security-bulletins/AWS-2022-004/
Amazon
Reported Amazon RDS PostgreSQL issue
/ Microsoft patches seuously security vulnerabilities - Elevation privilege escalation and RCE
Windows Common Log File System Driver Elevation of Privilege Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24521
Remote Procedure Call Runtime Remote Code Execution Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809
Windows Common Log File System Driver Elevation of Privilege Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24521
Remote Procedure Call Runtime Remote Code Execution Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809
Addressing Security Weaknesses in the NGINX LDAP Reference Implementation
Mitigation recommendations:
https://www.nginx.com/blog/addressing-security-weaknesses-nginx-ldap-reference-implementation/
Mitigation recommendations:
https://www.nginx.com/blog/addressing-security-weaknesses-nginx-ldap-reference-implementation/
F5, Inc.
Addressing Security Weaknesses in the NGINX LDAP Reference Implementation
We describe security vulnerabilities recently discovered in the NGINX LDAP reference implementation, and how to mitigate them. NGINX Open Source and NGINX Plus are not affected, and no corrective action is required if you do not use the reference implementation.