Condividi

RSS

Piu’ articoli…

• Cos’è la Cyber Security? Definizione e proposte
• Tecniche spammer: come sfruttano la posta elettronica?
• La minaccia del ransomware DDoS
• Analisi di sicurezza procedurale – Grazie per averci contattato!
• Zombie phishing: attenzione alle email, potrebbero essere zombie
• Ingegneria sociale: come gli hacker truffano le loro vittime
• Cos’è il phishing? Capire e individuare attacchi di ingegneria sociale
• Evitare il Ransomware: ecco perché è meglio non correre alcun rischio

Categorie …

• Backup as a Service (3)
  • Acronis Cloud Backup (17)
  • Veeam Cloud Connect (3)
• Cloud CRM (1)
• Cloud Server/VPS (22)
• Conferenza Cloud (4)
• Log Management (2)
• Monitoraggio ICT (4)
• Novita' (12)
• ownCloud (7)
• Privacy (7)
• Secure Online Desktop (14)
• Security (6)
  • Ethical Phishing (3)
  • SOCaaS (12)
    • SIEM (3)
    • UEBA (3)
  • Vulnerabilita' (82)
• Web Hosting (14)

Tags

CSIRT

• Vulnerabilità su VMware View Planner (AL01/210305/CSIRT-ITA) Marzo 5, 2021
  Rilevata una vulnerabilità di gravità “alta” su VMware View Planner che potrebbe consentire l’esecuzione di codice da remoto.
• Aggiornamento Google Chrome sana vulnerabilità 0-day (AL01/210304/CSIRT-ITA) Marzo 4, 2021
  Google ha rilasciato una nuova versione del browser Chrome per sanare 47 vulnerabilità di cui una di tipo 0-day attivamente sfruttata in rete.
• Campagna phishing sfrutta ambienti di Rapid Web Development (AL02/210303/CSIRT-ITA) Marzo 3, 2021
  La campagna è ideata per sottrarre agli utenti credenziali di servizi aziendali.
• Sfruttate vulnerabilità 0-day su Exchange Server (AL01/210303/CSIRT-ITA) Marzo 3, 2021
  Lo sfruttamento concatenato di 4 vulnerabilità 0-day (per cui sono ora disponibili le patch) consentirebbe di accedere, esfiltrare i dati e ottenere la persistenza su server Microsoft Exchange.
• Campagna sLoad veicolata tramite PEC (AL01/210302/CSIRT-ITA) Marzo 2, 2021
  A partire dalla mattinata del 1° marzo, è stata rilevata una massiccia campagna di email PEC malevole finalizzate a veicolare una variante del malware sLoad.
• La Settimana Cibernetica del 28 febbraio 2021 Marzo 1, 2021
  Il riepilogo delle notizie pubblicate dallo CSIRT italiano dal 22 al 28 febbraio 2021.
• Vulnerabilità critiche su prodotti Cisco (AL01/210226/CSIRT-ITA) Febbraio 26, 2021
  Cisco ha rilasciato avvisi di sicurezza relativi a vulnerabilità con impatto critico, alto e medio su diversi prodotti.
• Vulnerabilità su prodotti VMware (AL03/210224/CSIRT-ITA) Febbraio 24, 2021
  Sono state recentemente individuate 3 vulnerabilità nei prodotti VMware, una delle quali di livello critico.
• Campagna phishing con riferimenti INPS (AL02/210224/CSIRT-ITA) Febbraio 24, 2021
  Recentemente è stata osservata una campagna malevola a tema rimborso fiscale finalizzata a sottrarre dati personali e bancari.
• Piattaforma Google sfruttata per esfiltrare dati bancari (AL01/210224/CSIRT-ITA) Febbraio 24, 2021
  La piattaforma Google Apps Script sarebbe stata utilizzata dal malware Magecart per favorire l’esfiltrazione di dati bancari.

Dark Reading:

• Business Apps Spoofed in 45% of Impersonation Attacks Marzo 4, 2021
  Business-related applications like those from Microsoft, Zoom, and DocuSign are most often impersonated in brand phishing attacks.
• Healthcare Still Seeing High Level of Attacker Activity Marzo 4, 2021
  Interest in vaccines is driving all sorts of activity, reports say, from vaccine-specific phishing to growing bot traffic on healthcare sites.
• Microsoft, FireEye Uncover More Malware Used in the SolarWinds Campaign Marzo 4, 2021
  Newly discovered tools were designed for late-stage use after the attackers had already established a relatively firm presence on a breached network, vendors say.
• Secure Laptops & the Enterprise of the Future Marzo 4, 2021
  The enterprise of the future will depend upon organizations' ability to extend the company firewall to everywhere people are working.
• New Social Security Scam Spoofs Government Badges Marzo 4, 2021
  Criminals text or email photos of fake government identification badges to trick people into sending money.
• Qualys Is the Latest Victim of Accellion Data Breach Marzo 4, 2021
  Security vendor confirms attackers exploited a previously disclosed vulnerability in the enterprise firewall technology to breach its network.
• Why We Need More Blue Team Voices at the Table Marzo 4, 2021
  The red team draws attention, but the blue team has the expertise to keep networks secure day in and day out.
• More Details Emerge on the Microsoft Exchange Server Attacks Marzo 3, 2021
  The attacks seem more widespread than initially reported, researchers say, and a look at why the Microsoft Exchange Server zero-days patched this week are so dangerous.
• Intel: More Than 90% of Our Vulnerabilities Found via Research Marzo 3, 2021
  Internal research and external bug-bounty programs combined to discover the vast majority of reported security issues in the company's software.
• Okta to Buy Rival Auth0 Marzo 3, 2021
  The deal, valued at $6.5 billion, will bring together competitors in the identity management space.

Full Disclosure

• AST-2021-006: Crash when negotiating T.38 with a zero port Marzo 4, 2021
  Posted by Asterisk Security Team on Mar 04 Asterisk Project Security Advisory - AST-2021-006 Product Asterisk Summary Crash when negotiating T.38 with a zero port Nature of Advisory Remote Crash Susceptibility Remote Authenticated Sessions Severity Minor...
• Trojan-Spy.Win32.Stealer.osh / Insecure Permissions Marzo 2, 2021
  Posted by malvuln on Mar 02Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/d58b1c2f540268bd9dd920455568d45f.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-Spy.Win32.Stealer.osh Vulnerability: Insecure Permissions Description: The malware creates an insecure dir named "DESKTOP-2C3IQHO" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users...
• Backdoor.Win32.RemoteManipulator.fdo / Insecure Permissions Marzo 2, 2021
  Posted by malvuln on Mar 02Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/66ef21e8d1cf30dce6e084a9e306c18f.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.RemoteManipulator.fdo Vulnerability: Insecure Permissions Description: The backdoor creates an insecure randomly named hidden dir with a .tmp ext E.g. 8RK86.tmp and grants change (C) permissions to the authenticated user group....
• Multiple Vulnerabilities in jpeg-xl (CVE-2021-27804) Marzo 2, 2021
  Posted by Marc on Mar 02Multiple Vulnerabilities in jpeg-xl =================================== CVE: CVE-2021-27804 Highest Severity Rating: High Confirmed Affected Versions: jpeg-xl v0.3.1 and earlier Vendor: Joint Photographic Experts Group (JPEG) Vendor URL: https://gitlab.com/wg1/jpeg-xl Summary and Impact ------------------ jpeg-xl is the reference implementation by the Joint Photographic Experts Group (JPEG) of the new JPEG XL standard. Multiple […]
• SEC Consult SA-20210301-0 :: Authentication bypass vulnerability in Genua GenuGate High Resistance Firewall Marzo 1, 2021
  Posted by SEC Consult Vulnerability Lab on Mar 01seems we had some newline issues before, sorry for the inconvenience. Here is our advisory again: SEC Consult Vulnerability Lab Security Advisory < 20210301-0 > ======================================================================= title: Authentication bypass vulnerability product: Genua GenuGate High Resistance Firewall vulnerable version: GenuGate
• SEC Consult SA-20210301-0 :: Authentication bypass vulnerability in Genua GenuGate High Resistance Firewall Marzo 1, 2021
  Posted by SEC Consult Vulnerability Lab on Mar 01SEC Consult Vulnerability Lab Security Advisory < 20210301-0 > =======================================================================              title: Authentication bypass vulnerability            product: Genua GenuGate High Resistance Firewall vulnerable version: GenuGate
• Trojan-Proxy.Win32.Delf.ai / Remote SEH Buffer Overflow Febbraio 26, 2021
  Posted by malvuln on Feb 26Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/1dd6eb39a388f4c8a3eaf248d86aaabc.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-Proxy.Win32.Delf.ai Vulnerability: Remote SEH Buffer Overflow Description: The malware listens on TCP port 1089. Attackers who can reach the infected system can send a specially crafted HTTP TRACE request to trigger […]
• Trojan.Win32.Hotkeychick.am / Insecure Permissions Febbraio 26, 2021
  Posted by malvuln on Feb 26Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/5ea9840970e78188f73eb1763363eeac.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan.Win32.Hotkeychick.am Vulnerability: Insecure Permissions Description: The trojan creates an insecure dir named "Korektor_MPiPS-01" under c:\ drive, granting change (C) permissions to the authenticated user group. Standard users...
• Backdoor.Win32.Azbreg.amw / Insecure Permissions Febbraio 26, 2021
  Posted by malvuln on Feb 26Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/5eb58198721d4ded363e41e243e685cc.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Azbreg.amw Vulnerability: Insecure Permissions Description: The backdoor creates an insecure hidden dir named "MSDCSC" granting change (C) permissions to the authenticated user group. Standard users can rename the malware...
• Trojan-Spy.Win32.SpyEyes.elr / Insecure Permissions Febbraio 26, 2021
  Posted by malvuln on Feb 26Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/025d07f4610605031e501e6745d663aa.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-Spy.Win32.SpyEyes.elr Vulnerability: Insecure Permissions Description: The malware creates an insecure hidden dir named "40404504504" under c:\ drive, granting change (C) permissions to the authenticated user group. Standard users...