Condividi

RSS

Piu’ articoli…

• Unificare la piattaforma per la threat detection
• L’importanza del monitoring ICT
• I benefici SOAR: semplificare indagine e risposta
• Security Code Review: come funziona il servizio
• Automated Response Integration: le automazioni nel SOCaaS
• Coordinazione tra CTI e SOC: come alzare ulteriormente le difese
• Novità Cloud Server: internet ridondata
• Certificato di qualità per il SOCaaS di SOD

Categorie …

• Backup as a Service (24)
  • Acronis Cloud Backup (18)
  • Veeam Cloud Connect (3)
• Cloud CRM (1)
• Cloud Server/VPS (23)
• Conferenza Cloud (4)
• Log Management (2)
• Monitoraggio ICT (4)
• Novita' (15)
• ownCloud (7)
• Privacy (8)
• Secure Online Desktop (15)
• Security (157)
  • Cyber Threat Intelligence (CTI) (5)
  • Ethical Phishing (8)
  • SOCaaS (49)
    • SIEM (12)
    • SOAR (4)
    • UEBA (9)
  • Vulnerabilita' (84)
• Web Hosting (15)

Tags

CSIRT

• Vulnerabilità 0-day in Exchange Server (AL03/220930/CSIRT-ITA) - Aggiornamento Settembre 30, 2022
  Rilevato lo sfruttamento attivo in rete di 2 vulnerabilità di tipo “0-day” presenti nel prodotto Microsoft Exchange server.
• Sanate vulnerabilità su GitLab CE/EE (AL02/220930/CSIRT-ITA) Settembre 30, 2022
  Rilasciati aggiornamenti di sicurezza che risolvono alcune vulnerabilità, di cui 3 con gravità “alta”, in GitLab Community Edition (CE) e Enterprise Edition (EE).
• Rilevata la diffusione del malware Chaos (AL01/220930/CSIRT-ITA) Settembre 30, 2022
  Ricercatori di sicurezza hanno recentemente rilevato la distribuzione di un nuovo malware, denominato Chaos, volto a compromettere i server Windows e Linux al fine di inserirli in una botnet per future attività di post-exploitation.
• Vulnerabilità in Solarwinds Orion Platform (AL03/220929/CSIRT-ITA) Settembre 29, 2022
  Rilevate 2 vulnerabilità di sicurezza nel prodotto Orion Platform di Solarwinds che, qualora sfruttatate, potrebbero permettere attacchi di tipo “cross-site scripting” (XSS) e/o “SQL-Injection”.
• Aggiornamenti DRUPAL (AL02/220929/CSIRT-ITA) Settembre 29, 2022
  Aggiornamenti di sicurezza risolvono una vulnerabilità in Drupal Core.
• Aggiornamenti per prodotti CISCO (AL01/220929/CSIRT-ITA) Settembre 29, 2022
  Aggiornamenti di sicurezza Cisco sanano molteplici vulnerabilità, di cui 13 con gravità “alta”, presenti in vari prodotti.
• Nuova versione di Google Chrome (AL01/220928/CSIRT-ITA) Settembre 28, 2022
  Nuovo aggiornamento di Google Chrome per Windows, Mac e Linux corregge 20 vulnerabilità di sicurezza, di cui 5 con gravità “alta”.
• Aggiornamenti per prodotti Zyxel (AL01/220927/CSIRT-ITA) Settembre 27, 2022
  Zyxel rilascia aggiornamenti di sicurezza per sanare una vulnerabilità nei propri Router/Access Point.
• Rilevata vulnerabilità in Sophos Firewall (AL01/220926/CSIRT-ITA) Settembre 26, 2022
  Rilasciati aggiornamenti di sicurezza che sanano una vulnerabilità critica presente nella console Web Admin e nello User Portal di Sophos Firewall.
• La Settimana Cibernetica del 25 settembre 2022 Settembre 26, 2022
  Scarica il riepilogo delle notizie pubblicate dallo CSIRT Italia dal 19 al 25 settembre 2022.

Dark Reading

• Worried About the Exchange Zero-Day? Here's What to Do Settembre 30, 2022
  While organizations wait for an official patch for the two zero-day flaws in Microsoft Exchange, they should scan their networks for signs of exploitation and apply these mitigations.
• LA School District Ransomware Attackers Now Threaten to Leak Stolen Data Settembre 30, 2022
  Weeks after it breached the Los Angeles Unified School District, the Vice Society ransomware group is threatening to leak the stolen data, unless they get paid.
• Reshaping the Threat Landscape: Deepfake Cyberattacks Are Here Settembre 30, 2022
  It's time to dispel notions of deepfakes as an emergent threat. All the pieces for widespread attacks are in place and readily available to cybercriminals, even unsophisticated ones.
• Cybercriminals See Allure in BEC Attacks Over Ransomware Settembre 30, 2022
  While ransomware seems stalled, business email compromise (BEC) attacks continue to make profits from the ProxyShell and Log4j vulnerabilities, nearly doubling in the latest quarter.
• Trojanized, Signed Comm100 Chat Installer Anchors Supply Chain Attack Settembre 30, 2022
  Malicious Comm100 files have been found scattered throughout North America, and across sectors including tech, healthcare, manufacturing, telecom, insurance, and others.
• Microsoft Confirms Pair of Blindsiding Exchange Zero-Days, No Patch Yet Settembre 30, 2022
  The "ProxyNotShell" security vulnerabilities can be chained for remote code execution and total takeover of corporate email platforms.
• SolarMarker Attack Leverages Weak WordPress Sites, Fake Chrome Browser Updates Settembre 30, 2022
  The SolarMarker group is exploiting a vulnerable WordPress-run website to encourage victims to download fake Chrome browser updates, part of a new tactic in its watering-hole attacks.
• With the Software Supply Chain, You Can't Secure What You Don't Measure Settembre 30, 2022
  Reports to the National Vulnerability Database jumped in 2022, but we should pay just as much attention to the flaws that are not being reported to NVD, including those affecting the software supply chain.
• Onyxia Raises $5M to Help Companies Proactively Manage Cybersecurity Risks Using AI Settembre 30, 2022
  Onyxia, an AI-powered cybersecurity strategy and performance platform providing a centralized way for security teams to monitor and manage cybersecurity efforts in real time, has raised $5 million in seed fundraising led by World Trade Ventures with participation by Silvertech Ventures and angel investors.
• Cyera Survey Finds One in Three Respondents Want to Minimize Cloud Data Risk Settembre 30, 2022
  Multiple providers say 'cloud data sprawl' makes managing cloud data risk a priority initiative within the next 12 months.

Full Disclosure

• ZKBioSecurity 3.0.5- Privilege Escalation to Admin (CVE-2022-36634) Ottobre 1, 2022
  Posted by Caio B on Sep 30#######################ADVISORY INFORMATION####################### Product: ZKSecurity BIO Vendor: ZKTeco Version Affected: 3.0.5.0_R CVE: CVE-2022-36634 Vulnerability: User privilege escalation #######################CREDIT####################### This vulnerability was discovered and researched by Caio Burgardt and Silton Santos. #######################INTRODUCTION####################### Based on the hybrid biometric technology and...
• ZKBiosecurity - Authenticated SQL Injection resulting in RCE (CVE-2022-36635) Ottobre 1, 2022
  Posted by Caio B on Sep 30#######################ADVISORY INFORMATION####################### Product: ZKSecurity BIO Vendor: ZKTeco ( https://www.zkteco.com/en/ZKBiosecurity/ZKBioSecurity_V5000_4.1.2) Version Affected: 4.1.2 CVE: CVE-2022-36635 Vulnerability: SQL Injection (with a plus: RCE) #######################CREDIT####################### This vulnerability was discovered and researched by Caio Burgardt and Silton Santos....
• Backdoor.Win32.Augudor.b / Remote File Write Code Execution Settembre 27, 2022
  Posted by malvuln on Sep 27Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/94ccd337cbdd4efbbcc0a6c888abb87d.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Augudor.b Vulnerability: Remote File Write Code Execution Description: The malware drops an empty file named "zy.exe" and listens on TCP port 810. Third-party adversaries who can reach the infected […]
• Backdoor.Win32.Psychward.b / Weak Hardcoded Credentials Settembre 27, 2022
  Posted by malvuln on Sep 27Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/0b8cf90ab9820cb3fcb7f1d1b45e4e57.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Psychward.b Vulnerability: Weak Hardcoded Credentials Description: The malware listens on TCP port 8888 and requires authentication. However, the password "4174" is weak and hardcoded in cleartext within the PE...
• Backdoor.Win32.Bingle.b / Weak Hardcoded Credentials Settembre 27, 2022
  Posted by malvuln on Sep 27Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/eacaa12336f50f1c395663fba92a4d32.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Bingle.b Vulnerability: Weak Hardcoded Credentials Description: The malware is packed using ASPack 2.11, listens on TCP port 22 and requires authentication. However, the password "let me in" is weak […]
• SEC Consult SA-20220923-0 :: Multiple Memory Corruption Vulnerabilities in COVESA (Connected Vehicle Systems Alliance) DLT daemon Settembre 27, 2022
  Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 27SEC Consult Vulnerability Lab Security Advisory < 20220923-0 > ======================================================================= title: Multiple Memory Corruption Vulnerabilities product: COVESA DLT daemon (Diagnostic Log and Trace) Connected Vehicle Systems Alliance (COVESA), formerly GENIVI vulnerable version:
• Backdoor.Win32.Hellza.120 / Authentication Bypass Settembre 20, 2022
  Posted by malvuln on Sep 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/2cbd0fcf4d5fd5fb6c8014390efb0b21_B.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Hellza.120 Vulnerability: Authentication Bypass Description: The malware listens on TCP ports 12122, 21. Third-party adversarys who can reach infected systems can logon using any username/password combination....
• Backdoor.Win32.Hellza.120 / Unauthorized Remote Command Execution Settembre 20, 2022
  Posted by malvuln on Sep 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/2cbd0fcf4d5fd5fb6c8014390efb0b21.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Hellza.120 Vulnerability: Unauthorized Remote Command Execution Description: The malware listens on TCP ports 12122, 21. Third-party adversarys who can reach infected systems can issue commands made available by the...
• Trojan.Ransom.Ryuk.A / Arbitrary Code Execution Settembre 20, 2022
  Posted by malvuln on Sep 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/5ac0f050f93f86e69026faea1fbb4450.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan.Ransom.Ryuk.A Vulnerability: Arbitrary Code Execution Description: The ransomware looks for and executes DLLs in its current directory. Therefore, we can potentially hijack a vuln DLL execute our own code, […]
• Trojan-Dropper.Win32.Corty.10 / Insecure Credential Storage Settembre 20, 2022
  Posted by malvuln on Sep 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/f72138e574743640bdcdb9f102dff0a5.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-Dropper.Win32.Corty.10 Vulnerability: Insecure Credential Storage Description: The malware stores its credentials in cleartext within the Windows registry. Family: Corty Type: PE32 MD5: f72138e574743640bdcdb9f102dff0a5 Vuln ID:...