/ How to Detect Malicious OAuth Device Code Phishing
Here’s a quick TL;DR of the attack – in short, an attacker generates a user code and sends it to a victim in a phishing email. The user is then tricked into inputting the code into a Microsoft owned verification link. Upon success, the attacker can fetch both the user’s refresh and access token. This allows the attacker access to the user account:
https://www.inversecos.com/2022/12/how-to-detect-malicious-oauth-device.html
Here’s a quick TL;DR of the attack – in short, an attacker generates a user code and sends it to a victim in a phishing email. The user is then tricked into inputting the code into a Microsoft owned verification link. Upon success, the attacker can fetch both the user’s refresh and access token. This allows the attacker access to the user account:
https://www.inversecos.com/2022/12/how-to-detect-malicious-oauth-device.html
Inversecos
How to Detect Malicious OAuth Device Code Phishing
/ MCCrash: Cross-platform DDoS botnet targets private Minecraft servers
Attackers update malware to target additional operating systems, ranging from PCs to IoT devices, growing their infrastructure rapidly..🤗
https://www.microsoft.com/en-us/security/blog/2022/12/15/mccrash-cross-platform-ddos-botnet-targets-private-minecraft-servers/
Attackers update malware to target additional operating systems, ranging from PCs to IoT devices, growing their infrastructure rapidly..🤗
https://www.microsoft.com/en-us/security/blog/2022/12/15/mccrash-cross-platform-ddos-botnet-targets-private-minecraft-servers/
Microsoft News
MCCrash: Cross-platform DDoS botnet targets private Minecraft servers
The Microsoft Defender for IoT research team analyzed a cross-platform botnet that infects both Windows and Linux systems from PCs to IoT devices, to launch distributed denial of service (DDoS) attacks against private Minecraft servers.
/ Backdoor Targets FreePBX Asterisk Management Portal
https://blog.sucuri.net/2022/12/backdoor-targets-freepbx-asterisk-management-portal.html
https://blog.sucuri.net/2022/12/backdoor-targets-freepbx-asterisk-management-portal.html
Sucuri Blog
Backdoor Targets FreePBX Asterisk Management Portal
Learn about a simple piece of malware targeting FreePBX Asterisk Management portal which allows attackers to backdoor a site and modify the website’s .htaccess file
/ Leaked a secret? Check your GitHub alerts…for free
https://github.blog/2022-12-15-leaked-a-secret-check-your-github-alerts-for-free/
https://github.blog/2022-12-15-leaked-a-secret-check-your-github-alerts-for-free/
The GitHub Blog
Leaked a secret? Check your GitHub alerts...for free
GitHub now allows you to track any leaked secrets in your public repository, for free. With secret scanning alerts, you can track and action on leaked secrets directly within GitHub.
/ Veeam Backup & Replication allow executing malicious code remotely without authentication. This may lead to gaining control over the target system
https://www.veeam.com/kb4288
https://www.veeam.com/kb4288
Veeam Software
KB4288: CVE-2022-26500 | CVE-2022-26501
Multiple vulnerabilities (CVE-2022-26500, CVE-2022-26501) in Veeam Backup & Replication allow executing malicious code remotely without authentication. This may lead to gaining control over the target system.
/ New Samba security release available
This is the latest stable release of the Samba 4.17 release series.
It also contains security changes in order to address the following defects:
https://www.samba.org/samba/history/samba-4.17.4.html
This is the latest stable release of the Samba 4.17 release series.
It also contains security changes in order to address the following defects:
https://www.samba.org/samba/history/samba-4.17.4.html
/ VMware ESXi, Workstation, and Fusion updates address a heap out-of-bounds write vulnerability (CVE-2022-31705)
https://www.vmware.com/security/advisories/VMSA-2022-0033.html
https://www.vmware.com/security/advisories/VMSA-2022-0033.html
Open BLD DNS Service: December/End of the year 2022. Update News.
Open BLD DNS Service - it is a free DoH / DoT / DNS project for blocking trackers, telemetry, advertising, malware with support TLS v1.2/v1.3.
🌱 New Services Added
❇ Adaptive Open BLD Service - A-BLD
❇ A-BLD service can be convenient for most Open BLD users
❇ New donation service added
🧘 Infra Improvements/Updates/Fixes
❇ New BLD build released and deployed
❇ Updated HTTP header for BLD serves to: Open BLD Server
❇ Added HTTPS root redirect from BLD to LAB site
❇ Updated & Optimized BLD caching infrastructure mechanisms
❇ Optimized on-line stability & balancing
❇ Now in most maintenance cases it is not affect endpoint BLD service users
❇ Optimized automation deplyment routines
❇ Fixed Firefox OCSP STAPLE issue/Fixed caching break issues
🧩 New Open BLD Project micro-tools
❇ Check-reboot, Get-Log, Bld-agregator, Alertmanager installer, Timestamp converter
❇ Updated: https://github.com/m0zgen/dns-tester
❇ Updated: https://github.com/m0zgen/check-dns-servers
🤝 The Open BLD DoH service is mentioned
❇ Curl project (https://github.com/curl/curl/wiki/DNS-over-HTTPS) (thx for contribute ✌️)
❇ AlternativeTo (https://alternativeto.net/software/open-bld-dns/)
🏂 Setup/How to use Open BLD DNS
❇ How to setup Open BLD DNS in Browses, OSs and etc: https://lab.sys-adm.in
❇ Donation service: https://donorbox.org/open-bld-dns-donation
Open BLD DNS Service - it is a free DoH / DoT / DNS project for blocking trackers, telemetry, advertising, malware with support TLS v1.2/v1.3.
🌱 New Services Added
❇ Adaptive Open BLD Service - A-BLD
❇ A-BLD service can be convenient for most Open BLD users
❇ New donation service added
🧘 Infra Improvements/Updates/Fixes
❇ New BLD build released and deployed
❇ Updated HTTP header for BLD serves to: Open BLD Server
❇ Added HTTPS root redirect from BLD to LAB site
❇ Updated & Optimized BLD caching infrastructure mechanisms
❇ Optimized on-line stability & balancing
❇ Now in most maintenance cases it is not affect endpoint BLD service users
❇ Optimized automation deplyment routines
❇ Fixed Firefox OCSP STAPLE issue/Fixed caching break issues
🧩 New Open BLD Project micro-tools
❇ Check-reboot, Get-Log, Bld-agregator, Alertmanager installer, Timestamp converter
❇ Updated: https://github.com/m0zgen/dns-tester
❇ Updated: https://github.com/m0zgen/check-dns-servers
🤝 The Open BLD DoH service is mentioned
❇ Curl project (https://github.com/curl/curl/wiki/DNS-over-HTTPS) (thx for contribute ✌️)
❇ AlternativeTo (https://alternativeto.net/software/open-bld-dns/)
🏂 Setup/How to use Open BLD DNS
❇ How to setup Open BLD DNS in Browses, OSs and etc: https://lab.sys-adm.in
❇ Donation service: https://donorbox.org/open-bld-dns-donation
/ Gatekeeper’s Achilles heel: Unearthing a macOS vulnerability
https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/
https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/
Microsoft News
Gatekeeper’s Achilles heel: Unearthing a macOS vulnerability
Microsoft discovered a vulnerability in macOS, referred to as “Achilles”, allowing attackers to bypass application execution restrictions enforced by the Gatekeeper security mechanism.
/ Basic Authentication Deprecation in Exchange Online
https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-deprecation-in-exchange-online-time-s-up/ba-p/3695312
https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-deprecation-in-exchange-online-time-s-up/ba-p/3695312
TECHCOMMUNITY.MICROSOFT.COM
Basic Authentication Deprecation in Exchange Online – Time’s Up | Microsoft Community Hub
In early January 2023, we will permanently turn off Basic auth for multiple protocols for many Exchange Online tenants.
/ Critical Vulnerability – Hikvision Wireless Bridge
…An attacker can exploit the vulnerability by sending crafted messages to the affected devices..:
https://www.redinent.com/blog/critical-vulnerability-hikvision-wireless-bridge/
…An attacker can exploit the vulnerability by sending crafted messages to the affected devices..:
https://www.redinent.com/blog/critical-vulnerability-hikvision-wireless-bridge/
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Domain Name System (DNS) Parameters
Last Updated 2022-12-06
https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml
Last Updated 2022-12-06
https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml
Открытый практикум DevOps by Rebrain: IT-Quiz
Программа:
• квизы на разбор проблем в Kubernetes кластере
• решение в онлайн-формате
• призы победителям
• 27 Декабря (Вторник) в 19:00 по МСК. Детали
• Василий Озеров - Co-Founder REBRAIN. Более 8 лет Devops практик.
Программа:
• квизы на разбор проблем в Kubernetes кластере
• решение в онлайн-формате
• призы победителям
• 27 Декабря (Вторник) в 19:00 по МСК. Детали
• Василий Озеров - Co-Founder REBRAIN. Более 8 лет Devops практик.
/ LastPass Data Breach December Update
...We recently notified you that an unauthorized party gained access to a third-party cloud-based storage service, which LastPass uses to store archived backups of our production data. In keeping with our commitment to transparency, we want to provide you with an update regarding our ongoing investigation.
What We’ve Learned..:
https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/
...We recently notified you that an unauthorized party gained access to a third-party cloud-based storage service, which LastPass uses to store archived backups of our production data. In keeping with our commitment to transparency, we want to provide you with an update regarding our ongoing investigation.
What We’ve Learned..:
https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/
Lastpass
Security Incident December 2022 Update - LastPass - The LastPass Blog
Please refer to the latest article for updated information.nbs[..]
/ Detecting Azure AD Account Takeover Attacks
Cloud account takeover(ATO) is an attack where attackers gain access to cloud identities by using methods like social engineering, device code phishing, etc. Detecting these attacks can sometimes be difficult. In this blog, I’ll explain how we can develop a generic detection that covers almost any, if not all, methods for Azure AD (Well, the method can be applied to other identity providers, too)..:
— https://posts.bluraven.io/detecting-azure-ad-account-takeover-attacks-b2652bb65a4c
Cloud account takeover(ATO) is an attack where attackers gain access to cloud identities by using methods like social engineering, device code phishing, etc. Detecting these attacks can sometimes be difficult. In this blog, I’ll explain how we can develop a generic detection that covers almost any, if not all, methods for Azure AD (Well, the method can be applied to other identity providers, too)..:
— https://posts.bluraven.io/detecting-azure-ad-account-takeover-attacks-b2652bb65a4c
Medium
Detecting Azure AD Account Takeover Attacks
An easy and generic approach for detecting cloud account takeover attacks using KQL
Sys-Admin InfoSec pinned «Open BLD DNS Service: December/End of the year 2022. Update News. Open BLD DNS Service - it is a free DoH / DoT / DNS project for blocking trackers, telemetry, advertising, malware with support TLS v1.2/v1.3. 🌱 New Services Added ❇ Adaptive Open BLD…»
/ ACSESSED: Cross-tenant network bypass in Azure Cognitive Search
https://www.mnemonic.io/resources/blog/acsessed-cross-tenant-network-bypass-in-azure-cognitive-search/
https://www.mnemonic.io/resources/blog/acsessed-cross-tenant-network-bypass-in-azure-cognitive-search/
Mnemonic
ACSESSED: Cross-tenant network bypass in Azure Cognitive Search
How enabling a single vulnerable feature removed the entire network and identity perimeter around internet-isolated Azure Cognitive Search instances.
/ Check Point response to CVE-2021-26414 - "Windows DCOM Server Security Feature Bypass"
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk176148&t=1672019191897
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk176148&t=1672019191897
Checkpoint
sk176148 - Check Point response to CVE-2021-26414 - "Windows DCOM Server Security Feature Bypass"
Applies to: Identity Awareness, Multi-Domain Security Management, Quantum Security Management, Quantum Spark Appliances
/ ZyXEL LTE3301-M209 - "Backdoor" credentials
https://resolverblog.blogspot.com/2022/12/cve-2022-40602-zyxel-lte3301-m209.html
https://resolverblog.blogspot.com/2022/12/cve-2022-40602-zyxel-lte3301-m209.html
Blogspot
[ CVE-2022-40602 ] ZyXEL LTE3301-M209 - "Backdoor" credentials
Hi Folks, as a continuation from the previous post, we're going to take a look at ZyXEL LTE3301-M209. [!] Togheter with Zyxel PSIRT, we deci...