Condividi

RSS

Piu’ articoli…

• Air-Fi: attaccare computer scollegati e senza hardware di rete è possibile
• Esempi di phishing: le ultime campagne menzionate dal CSIRT
• Event Overload? Il nostro SOCaaS può aiutare!
• Schemi di business email compromise (BEC)
• XDR come approccio alla sicurezza
• Cos’è la threat intelligence?
• Data Loss Prevention: definizione e utilizzi
• Prevenire il shoulder surfing e il furto di credenziali aziendali

Categorie …

• Backup as a Service (3)
  • Acronis Cloud Backup (18)
  • Veeam Cloud Connect (3)
• Cloud CRM (1)
• Cloud Server/VPS (22)
• Conferenza Cloud (4)
• Log Management (2)
• Monitoraggio ICT (4)
• Novita' (12)
• ownCloud (7)
• Privacy (7)
• Secure Online Desktop (14)
• Security (8)
  • Ethical Phishing (5)
  • SOCaaS (16)
    • SIEM (7)
    • UEBA (5)
  • Vulnerabilita' (82)
• Web Hosting (15)

Tags

CSIRT

• La Settimana Cibernetica del 16 maggio 2021 Maggio 17, 2021
  Scarica il riepilogo delle notizie pubblicate dallo CSIRT italiano dal 10 al 16 maggio 2021.
• Vulnerabilità “FragAttacks” nei dispositivi WiFi (AL02/210513/CSIRT-ITA) Maggio 13, 2021
  Individuate 12 vulnerabilità che interessano i dispositivi WiFi (standard 802.11) e potrebbero consentire a un attaccante di esfiltrare dati sensibili falsificando i frame crittografati.
• Variante di Lemon Duck diffonde miner XMRig su Server Microsoft Exchange vulnerabili (AL01/210513/CSIRT-ITA) Maggio 13, 2021
  Gli attaccanti sfrutterebbero la CVE-2021-27065 (cd ProxyLogon) utilizzando varianti della webshell China Chopper.
• Vulnerabilità critiche in Adobe Acrobat (AL01/210512/CSIRT-ITA) Maggio 12, 2021
  L’aggiornamento corregge 10 vulnerabilità critiche e 4 importanti in diverse versioni di Adobe Acrobat.
• TsuNAME: attacchi DDoS tramite DNS Circular Dependencies (BL01/210510/CSIRT-ITA) Maggio 10, 2021
  Identificata nuova modalità di attacco, nota come TsuNAME, che sfrutta il traffico generato da alcuni “DNS recursive server” per effettuare DDoS contro authoritative server.
• La Settimana Cibernetica del 9 maggio 2021 Maggio 10, 2021
  Scarica il riepilogo delle notizie pubblicate dallo CSIRT italiano dal 3 al 9 maggio 2021.
• Rilevata vulnerabilità in un plugin Wordpress (AL01/210507/CSIRT-ITA) Maggio 7, 2021
  Disponibile l’aggiornamento del plugin Wordpress “Spam protection, AntiSpam, FireWall” di CleanTalk per la CVE-2021-24295.
• Vulnerabilità nei modem Qualcomm utilizzati nei dispositivi Android (AL02/210507/CSIRT-ITA) Maggio 7, 2021
  La CVE-2020-11292, che risiede nell'interfaccia QMI (Qualcomm MSM Interface), sarebbe sfruttabile solo localmente e avrebbe impatto su circa il 30% dei dispositivi mobili nel mondo.
• Aggiornati prodotti Cisco (AL02/210506/CSIRT-ITA) Maggio 6, 2021
  Cisco ha rilasciato diversi aggiornamenti di sicurezza per risolvere alcune vulnerabilità relative ai propri prodotti.
• Risolta vulnerabilità in VMware vRealize Business (AL01/210506/CSIRT-ITA) Maggio 6, 2021
  VMware ha rilasciato aggiornamenti di sicurezza per sanare una vulnerabilità in vRealize Business for Cloud.

Dark Reading:

• Latest Security News From RSAC 2021 Maggio 17, 2021
  Check out Dark Reading's updated, exclusive coverage of the news and security themes that are dominating RSA Conference 2021.
• DarkSide Ransomware Variant Targets Disk Partitions Maggio 17, 2021
  A newly discovered DarkSide ransomware variant can detect and compromise partitioned hard drives, researchers report.
• 47% of Criminals Buying Exploits Target Microsoft Products Maggio 17, 2021
  Researchers examine English- and Russian-language underground exploits to track how exploits are advertised and sold.
• DDoS Attacks Up 31% in Q1 2021: Report Maggio 17, 2021
  If pace continues, DDoS attack activity could surpass last year's 10-million attack threshold.
• Rapid7 Is the Latest Victim of a Software Supply Chain Breach Maggio 17, 2021
  Security vendor says attackers accessed some of its source code using a previously compromised Bash Uploader script from Codecov.
• RSAC 2021: What Will SolarWinds' CEO Reveal? Maggio 17, 2021
  In a keynote conversation with Forrester analyst Laura Koetzle, Sudhakar Ramakrishna will get candid about the historic breach.
• Agility Broke AppSec. Now It's Going to Fix It. Maggio 17, 2021
  Outnumbered 100 to 1 by developers, AppSec needs a new model of agility to catch up and protect everything that needs to be secured.
• Name That Toon: Road Trip Maggio 17, 2021
  Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.
• Rapid7 Source Code Accessed in Supply Chain Attack Maggio 14, 2021
  An investigation of the Codecov attack revealed intruders accessed Rapid7 source code repositories containing internal credentials and alert-related data.
• How Faster COVID-19 Research Is Being Made Possible by Secure Silicon Maggio 14, 2021
  When Intel and Leidos set up a "trusted execution environment" to enable a widespread group of researchers to securely share and confidentially compute real-world data, it was no small achievement.

Full Disclosure

• Backdoor.Win32.Delf.zho / Authentication Bypass RCE Maggio 14, 2021
  Posted by malvuln on May 13Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/6b9f5a0512af3ab33c26eaa4bdf94f1f.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Delf.zho Vulnerability: Authentication Bypass RCE Description: The malware listens on TCP port 21 and TCP ports 14920 to 14923. Third-party attackers who can reach the system can logon using any username/password […]
• [CFP]: 2nd Joint Workshop on CPS&IoT Security and Privacy (CPSIoTSec 2021) Maggio 14, 2021
  Posted by Call For Papers CPSIOTSEC21 on May 13--------------------------------------------------------------------------------------------------------------- C a l l F o r P a p e r s 2nd Joint Workshop on CPS&IoT Security and Privacy (CPSIoTSec 2021) Seoul, South Korea, November 15 (Monday), 2021 URL: https://cpsiotsec.github.io co-located with the ACM Conference on Computer and Communications Security (ACM CCS 2021)...
• Trovent Security Advisory 2103-02 / Multiple XSS vulnerabilities in ERPNext 13.0.0/12.18.0 Maggio 11, 2021
  Posted by Stefan Pietsch on May 11# Trovent Security Advisory 2103-02 # ##################################### Multiple XSS vulnerabilities in ERPNext 13.0.0/12.18.0 ###################################################### Overview ######## Advisory ID: TRSA-2103-02 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2103-02 Affected product: ERPNext Tested versions: 12.18.0 and 13.0.0 beta Vendor: Frappé Technologies...
• Trovent Security Advisory 2103-01 / Authenticated SQL injection in ERPNext 13.0.0/12.18.0 Maggio 11, 2021
  Posted by Stefan Pietsch on May 11# Trovent Security Advisory 2103-01 # ##################################### Authenticated SQL injection in ERPNext 13.0.0/12.18.0 ##################################################### Overview ######## Advisory ID: TRSA-2103-01 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2103-01 Affected product: ERPNext Tested versions: 12.18.0 and 13.0.0 beta Vendor: Frappé Technologies https://frappe.io...
• CVE-2021-32051 Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter. Maggio 11, 2021
  Posted by Marcel Keiffenheim on May 11
• Backdoor.Win32.Antilam.13.a / Unauthenticated Remote Command Execution Maggio 11, 2021
  Posted by malvuln on May 11Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/1ef711b34cc278449f1997e4ed06334a.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Antilam.13.a Vulnerability: Unauthenticated Remote Command Execution Description: The malware drops an executable named "scandisk.exe" that listens on TCP ports 47891 and 29559. Third party attackers who can reach infected...
• Backdoor.Win32.MotivFTP.12 / Authentication Bypass RCE Maggio 11, 2021
  Posted by malvuln on May 11Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/88785a093b8fa00893214dd220ac255d.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.MotivFTP.12 Vulnerability: Authentication Bypass RCE Description: The malware listens on TCP port 21. Third-party attackers who can reach the system can logon using any username/password combination. Attackers may then upload...
• Re: Three vulnerabilities found in MikroTik's RouterOS Maggio 11, 2021
  Posted by Gynvael Coldwind on May 11Got it! Thank you for the explanation!
• Four vulnerabilities found in MikroTik's RouterOS Maggio 11, 2021
  Posted by Q C on May 11Advisory: four vulnerabilities found in MikroTik's RouterOS Details ======= Product: MikroTik's RouterOS Vendor URL: https://mikrotik.com/ Vendor Status: only CVE-2020-20227 is fixed CVE: CVE-2020-20220, CVE-2020-20227, CVE-2020-20245, CVE-2020-20246 Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team Product Description ================== RouterOS is the operating system used on the MikroTik's devices, such as […]
• Re: Three vulnerabilities found in MikroTik's RouterOS Maggio 11, 2021
  Posted by Q C on May 11Hi, In Mikrotik RouterOs, each user is assigned to a user group, which denotes the rights of this user. A group policy is a combination of individual policy items, and provides a convenient way to assign different permissions and access rights to different user classes. (Reference: https://help.mikrotik.com/docs/display/ROS/User) Some common […]