Condividi

RSS

Piu’ articoli…

• Cos’è veramente un cyber threat
• SNYPR: Big Data al servizio della ricerca delle minacce
• Hadoop Open Data Model: raccolta dati “open”
• Pass the Ticket: come mitigarlo con un SOCaaS
• Cos’è il Vishing e come funziona
• UBA e UEBA: le differenze
• Database Activity Monitoring: cos’è e come metterlo in pratica
• SOAR e l’automazione della sicurezza informatica

Categorie …

• Backup as a Service (3)
  • Acronis Cloud Backup (18)
  • Veeam Cloud Connect (3)
• Cloud CRM (1)
• Cloud Server/VPS (22)
• Conferenza Cloud (4)
• Log Management (2)
• Monitoraggio ICT (4)
• Novita' (13)
• ownCloud (7)
• Privacy (8)
• Secure Online Desktop (14)
• Security (9)
  • Cyber Threat Intelligence (CTI) (3)
  • Ethical Phishing (8)
  • SOCaaS (23)
    • SIEM (10)
    • UEBA (8)
  • Vulnerabilita' (84)
• Web Hosting (15)

Tags

CSIRT

• Aggiornamenti di sicurezza per prodotti Juniper Networks (AL01/211015/CSIRT-ITA) Ottobre 15, 2021
  Juniper Networks rilascia aggiornamenti di sicurezza per sanare molteplici vulnerabilità su più prodotti, di cui una con gravità “critica”.
• Security Patch Day per i prodotti SAP (AL02/211014/CSIRT-ITA) Ottobre 14, 2021
  SAP rilascia il Security Patch Day di ottobre per i propri prodotti che risolve 14 vulnerabilità, di cui 3 con gravità “critica”.
• Palo Alto Networks rilascia aggiornamenti per GlobalProtect (AL01/211014/CSIRT-ITA) Ottobre 14, 2021
  Aggiornamenti di sicurezza per il prodotto GlobalProtect sanano una vulnerabilità con gravità “alta”.
• Sanata vulnerabilità nella libreria keypair (BL01/211013/CSIRT-ITA) Ottobre 13, 2021
  Rilevata una vulnerabilità nella libreria javascript keypair che potrebbe compromettere la confidenzialità e l’integrità dei messaggi criptati per mezzo della stessa.
• Bug presente nel demone GPSd (AL03/211013/CSIRT-ITA) Ottobre 13, 2021
  Un bug nella funzione gpsd_gpstime_resolv() del demone GPSd potrebbe comportare dei problemi di corretto rilevamento della data a partire dal 23 ottobre 2021.
• Adobe rilascia aggiornamenti per sanare diverse vulnerabilità (AL02/211013/CSIRT-ITA) Ottobre 13, 2021
  Adobe corregge 10 vulnerabilità in diversi prodotti.
• Aggiornamenti Mensili Microsoft (AL01/211013/CSIRT-ITA) Ottobre 13, 2021
  Microsoft ha rilasciato gli aggiornamenti di sicurezza mensili che risolvono un totale di 76 vulnerabilità, di cui 3 con gravità “critica” e 4 di tipo 0-day.
• Sanata vulnerabilità 0-day in iOS 15 e iPadOS 15 (AL01/211012/CSIRT-ITA) Ottobre 12, 2021
  Apple ha rilasciato nuove versioni di iOS e iPadOS che includono aggiornamenti di sicurezza volti a sanare una vulnerabilità 0-day con gravità “alta”, causata da un integer-overflow nella componente IOMobileFrameBuffer.
• Rilevate vulnerabilità in alcuni dispositivi Dahua (AL01/211011/CSIRT-ITA) Ottobre 11, 2021
  Dahua ha rilasciato aggiornamenti software che sanano 2 vulnerabilità con gravità “critica”.
• La Settimana Cibernetica del 10 ottobre 2021 Ottobre 11, 2021
  Scarica il riepilogo delle notizie pubblicate dallo CSIRT Italia dal 4 al 10 ottobre 2021.

Dark Reading

• China's Hackers Crack Devices at Tianfu Cup for $1.5M in Prizes Ottobre 15, 2021
  China's premier hackers will target web browsers, operating systems, mobile devices, and even a car at Tianfu Cup.
• Cisco Duo Trusted Access Report: More Than 50% of Companies Plan Passwordless Move Ottobre 15, 2021
  Multifactor authentications soar as enterprises move away from passwords to secure hybrid workers.
• How Attackers Hack Humans Ottobre 15, 2021
  Inside their motivations, how they go about it -- and what businesses can do about it, according to Counterintelligence Institute founder Peter Warmka.
• 'Clumsy' BlackByte Malware Reuses Crypto Keys, Worms Into Networks Ottobre 15, 2021
  Discovered during a recent incident response engagement, the malware avoids Russian computers and uses a single symmetric key for encrypting every compromised system.
• Evolution Equity Partners Close $400M for Cybersecurity Investments Ottobre 15, 2021
  The firm expands capital base, team, and platform addressing a rapidly growing cybersecurity investment opportunity.
• From Help Desk to Head of SOC: Building a Cybersecurity Career on Empathy and Candor Ottobre 15, 2021
  Why a passion for helping people is key to delivering effective cybersecurity solutions.
• How AI Can Stop Zero-Day Ransomware Ottobre 15, 2021
  Ransomware attacks are unpredictable. AI is better at figuring out what looks malicious and abnormal than humans will ever be.
• Enterprise Data Storage Environments Riddled With Vulnerabilities Ottobre 14, 2021
  Many organizations are not properly protecting their storage and backup systems from compromise, new study finds.
• Increased Security Spending to Support Distributed Workforce Ottobre 14, 2021
  Security leaders are deploying or actively considering cloud security, threat intel, and XDR technologies.
• Deepfence Announces Open Source Availability of ThreatMapper Ottobre 14, 2021
  Cloud native security observability platform seamlessly scans, maps, and ranks application vulnerabilities from development through critical production stage.

Full Disclosure

• [RT-SA-2021-001] Cross-Site Scripting in myfactory.FMS Ottobre 13, 2021
  Posted by RedTeam Pentesting GmbH on Oct 13Advisory: Cross-Site Scripting in myfactory.FMS During a penetration test, a reflected cross-site scripting vulnerability (XSS) was found in the myfactory.FMS login form. If a user opens an attacker-prepared link to the application, attackers can run arbitrary JavaScript code in the user's browser. Details ======= Product: myfactory.FMS Affected Versions:
• [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045) Ottobre 6, 2021
  Posted by bashis on Oct 05[STX] Subject: [Update]: Dahua Authentication bypass (CVE-2021-33044, CVE-2021-33045) Attack vector: Remote Authentication: Anonymous (no credentials needed) Researcher: bashis (2021) Limited Disclosure: September 6, 2021 Full Disclosure: October 6, 2021 PoC: https://github.com/mcw0/DahuaConsole -=[Dahua]=- Advisory: https://www.dahuasecurity.com/support/cybersecurity/details/957 Firmware:...
• Backdoor.Win32.Prorat.lkt / Port Bounce Scan (MITM) Ottobre 6, 2021
  Posted by malvuln on Oct 05Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/dec8f9042986d64e29d62effb482290b_B.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Prorat.lkt Vulnerability: Port Bounce Scan (MITM) Description: The ProSpy Server V1.9 malware runs an FTP component that listens on TCP port 2121. Third-party attackers who successfully logon can abuse the backdoor […]
• Backdoor.Win32.Prorat.lkt / Weak Hardcoded Password Ottobre 6, 2021
  Posted by malvuln on Oct 05Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/dec8f9042986d64e29d62effb482290b.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Prorat.lkt Vulnerability: Weak Hardcoded Password Description: The ProSpy Server V1.9 malware runs an FTP component that listens on TCP port 2121. The FTP server requires authentication for remote user access. However, […]
• HackTool.Win32.Agent.gi / Local Stack Buffer Overflow (SEH) Ottobre 6, 2021
  Posted by malvuln on Oct 05Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/e60606d19a36789662ba97b4bb5c4ccf.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: HackTool.Win32.Agent.gi Vulnerability: Local Stack Buffer Overflow (SEH) Description: The Hack Office 2000 malware doesnt check bounds when loading textfiles for the wordlist to perform website URL cracking. Loading a specially crafted […]
• Trojan-PSW.Win32.PdPinch.gen / Remote Denial of Service Ottobre 6, 2021
  Posted by malvuln on Oct 05Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/0e4fbfeb6f7a98e437a497013b285ffc.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-PSW.Win32.PdPinch.gen Vulnerability: Remote Denial of Service Description: The malware listens on TCP port 1212. Third-party attackers who can reach infected systems can send a specially crafted junk HTTP request to trigger […]
• Backdoor.Win32.Hupigon.gy / Unauthenticated Open Proxy Ottobre 6, 2021
  Posted by malvuln on Oct 05Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/be74cbb86c007309d8004d910f5270f7.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Hupigon.gy Vulnerability: Unauthenticated Open Proxy Description: The malware listens on TCP ports 8080, 1080. Third-party attackers who can connect to the infected system can relay requests from the original connection to […]
• Backdoor.Win32.Bifrose.ahyg / Insecure Permissions Ottobre 6, 2021
  Posted by malvuln on Oct 05Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/d6aff119c03ff378d386b30b36b07a69.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Bifrose.ahyg Vulnerability: Insecure Permissions Description: The malware creates an dir with insecure permissions under c:\ drive granting change (C) permissions to the authenticated user group. Standard users can rename the...
• HEUR.Trojan.Win32.Generic / Insecure Service Path Ottobre 6, 2021
  Posted by malvuln on Oct 05Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/2e4b6c5bd907995f6fd40c5eeab5c6e9.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: HEUR.Trojan.Win32.Generic Vulnerability: Insecure Service Path Description: The malware creates a service with an unquoted path. Third party attackers who can place an arbitrary executable under c:\ drive can potentially undermine the […]
• Backdoor.Win32.Yoddos.an / Insecure Service Path Ottobre 6, 2021
  Posted by malvuln on Oct 05Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/bf2417bf23a3b7ae2e44676882b4b9dd.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Yoddos.an Vulnerability: Insecure Service Path Description: The malware creates a service with an unquoted path. Third party attackers who can place an arbitrary executable under c:\ drive can potentially undermine the […]