Condividi

RSS

Piu’ articoli…

• Cos’è la Cyber Security? Definizione e proposte
• Tecniche spammer: come sfruttano la posta elettronica?
• La minaccia del ransomware DDoS
• Analisi di sicurezza procedurale – Grazie per averci contattato!
• Zombie phishing: attenzione alle email, potrebbero essere zombie
• Ingegneria sociale: come gli hacker truffano le loro vittime
• Cos’è il phishing? Capire e individuare attacchi di ingegneria sociale
• Evitare il Ransomware: ecco perché è meglio non correre alcun rischio

Categorie …

• Backup as a Service (3)
  • Acronis Cloud Backup (17)
  • Veeam Cloud Connect (3)
• Cloud CRM (1)
• Cloud Server/VPS (22)
• Conferenza Cloud (4)
• Log Management (2)
• Monitoraggio ICT (4)
• Novita' (12)
• ownCloud (7)
• Privacy (7)
• Secure Online Desktop (14)
• Security (6)
  • Ethical Phishing (3)
  • SOCaaS (12)
    • SIEM (3)
    • UEBA (3)
  • Vulnerabilita' (82)
• Web Hosting (14)

Tags

CSIRT

• Sfruttate vulnerabilità 0-day su Exchange Server (AL01/210303/CSIRT-ITA) Marzo 3, 2021
  Lo sfruttamento concatenato di 4 vulnerabilità 0-day (per cui sono ora disponibili le patch) consentirebbe di accedere, esfiltrare i dati e ottenere la persistenza su server Microsoft Exchange.
• Campagna sLoad veicolata tramite PEC (AL01/210302/CSIRT-ITA) Marzo 2, 2021
  A partire dalla mattinata del 1° marzo, è stata rilevata una massiccia campagna di email PEC malevole finalizzate a veicolare una variante del malware sLoad.
• La Settimana Cibernetica del 28 febbraio 2021 Marzo 1, 2021
  Il riepilogo delle notizie pubblicate dallo CSIRT italiano dal 22 al 28 febbraio 2021.
• Vulnerabilità critiche su prodotti Cisco (AL01/210226/CSIRT-ITA) Febbraio 26, 2021
  Cisco ha rilasciato avvisi di sicurezza relativi a vulnerabilità con impatto critico, alto e medio su diversi prodotti.
• Vulnerabilità su prodotti VMware (AL03/210224/CSIRT-ITA) Febbraio 24, 2021
  Sono state recentemente individuate 3 vulnerabilità nei prodotti VMware, una delle quali di livello critico.
• Campagna phishing con riferimenti INPS (AL02/210224/CSIRT-ITA) Febbraio 24, 2021
  Recentemente è stata osservata una campagna malevola a tema rimborso fiscale finalizzata a sottrarre dati personali e bancari.
• Piattaforma Google sfruttata per esfiltrare dati bancari (AL01/210224/CSIRT-ITA) Febbraio 24, 2021
  La piattaforma Google Apps Script sarebbe stata utilizzata dal malware Magecart per favorire l’esfiltrazione di dati bancari.
• Campagna malspam diffonde Snake Keylogger (BL01/210222/CSIRT-ITA) Febbraio 22, 2021
  Recentemente è stata rilevata una campagna malspam indirizzata a soggetti italiani e finalizzata a veicolare il malware Snake Keylogger.
• La Settimana Cibernetica del 21 febbraio 2021 Febbraio 22, 2021
  Il riepilogo delle notizie pubblicate dallo CSIRT italiano dal 15 al 21 febbraio 2021.
• Phishing a tema “Cessazione account di posta” (AL01/210218/CSIRT-ITA) Febbraio 18, 2021
  Individuata una campagna phishing finalizzata al furto di credenziali che sfrutta finte pagine di verifica della propria casella di posta.

Dark Reading:

• How SolarWinds Busted Up Our Assumptions About Code Signing Marzo 3, 2021
  With so much automation in code writing process, results are rarely double-checked, which opens the door to vulnerabilities and downright danger.
• Design, Security, Tech Is the New Stack You Should Be Building Marzo 3, 2021
  Instead of different departments managing information systems, Ally Financial has combined data, digitization, security, and design into a single "stack" of human resources.
• Policy Group Calls for Public-Private Cyber-Defense Program Marzo 2, 2021
  The proposed National Cyber Response Network would link federal agencies, companies, and local governments, allowing collaboration during a cyberattack.
• Microsoft Ignite Brings Security & Compliance Updates Marzo 2, 2021
  Microsoft announces support for data loss prevention in Google Chrome, co-authoring of protected files, and more at Ignite 2021.
• 'ObliqueRAT' Now Hides Behind Images on Compromised Websites Marzo 2, 2021
  'Transparent Tribe' has switched its tactics for distributing the remote access Trojan, researchers found.
• Microsoft Fixes Exchange Server Zero-Days Exploited in Active Attacks Marzo 2, 2021
  Microsoft fixes multiple Exchange Server vulnerabilities being weaponized in attacks from a group it believes operates out of China.
• Thycotic and Centrify to Merge In $1.4B Deal Marzo 2, 2021
  TPG Capital will combine privileged access management providers into one company.
• Google Partners With Insurers to Create Risk Protection Program Marzo 2, 2021
  Google Cloud, Allianz, and Munich Re teamed up to build a program that aims to reduce risk and potentially cut costs for customers.
• 4 Ways Health Centers Can Stop the Spread of Cyberattacks Marzo 2, 2021
  Health centers must shift the perception of cyberattacks from potential risk to real threat in order to take the first step toward a safer, healthier security posture.
• Name That Edge Toon: In Hot Water Marzo 2, 2021
  Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.

Full Disclosure

• Trojan-Spy.Win32.Stealer.osh / Insecure Permissions Marzo 2, 2021
  Posted by malvuln on Mar 02Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/d58b1c2f540268bd9dd920455568d45f.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-Spy.Win32.Stealer.osh Vulnerability: Insecure Permissions Description: The malware creates an insecure dir named "DESKTOP-2C3IQHO" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users...
• Backdoor.Win32.RemoteManipulator.fdo / Insecure Permissions Marzo 2, 2021
  Posted by malvuln on Mar 02Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/66ef21e8d1cf30dce6e084a9e306c18f.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.RemoteManipulator.fdo Vulnerability: Insecure Permissions Description: The backdoor creates an insecure randomly named hidden dir with a .tmp ext E.g. 8RK86.tmp and grants change (C) permissions to the authenticated user group....
• Multiple Vulnerabilities in jpeg-xl (CVE-2021-27804) Marzo 2, 2021
  Posted by Marc on Mar 02Multiple Vulnerabilities in jpeg-xl =================================== CVE: CVE-2021-27804 Highest Severity Rating: High Confirmed Affected Versions: jpeg-xl v0.3.1 and earlier Vendor: Joint Photographic Experts Group (JPEG) Vendor URL: https://gitlab.com/wg1/jpeg-xl Summary and Impact ------------------ jpeg-xl is the reference implementation by the Joint Photographic Experts Group (JPEG) of the new JPEG XL standard. Multiple […]
• SEC Consult SA-20210301-0 :: Authentication bypass vulnerability in Genua GenuGate High Resistance Firewall Marzo 1, 2021
  Posted by SEC Consult Vulnerability Lab on Mar 01seems we had some newline issues before, sorry for the inconvenience. Here is our advisory again: SEC Consult Vulnerability Lab Security Advisory < 20210301-0 > ======================================================================= title: Authentication bypass vulnerability product: Genua GenuGate High Resistance Firewall vulnerable version: GenuGate
• SEC Consult SA-20210301-0 :: Authentication bypass vulnerability in Genua GenuGate High Resistance Firewall Marzo 1, 2021
  Posted by SEC Consult Vulnerability Lab on Mar 01SEC Consult Vulnerability Lab Security Advisory < 20210301-0 > =======================================================================              title: Authentication bypass vulnerability            product: Genua GenuGate High Resistance Firewall vulnerable version: GenuGate
• Trojan-Proxy.Win32.Delf.ai / Remote SEH Buffer Overflow Febbraio 26, 2021
  Posted by malvuln on Feb 26Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/1dd6eb39a388f4c8a3eaf248d86aaabc.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-Proxy.Win32.Delf.ai Vulnerability: Remote SEH Buffer Overflow Description: The malware listens on TCP port 1089. Attackers who can reach the infected system can send a specially crafted HTTP TRACE request to trigger […]
• Trojan.Win32.Hotkeychick.am / Insecure Permissions Febbraio 26, 2021
  Posted by malvuln on Feb 26Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/5ea9840970e78188f73eb1763363eeac.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan.Win32.Hotkeychick.am Vulnerability: Insecure Permissions Description: The trojan creates an insecure dir named "Korektor_MPiPS-01" under c:\ drive, granting change (C) permissions to the authenticated user group. Standard users...
• Backdoor.Win32.Azbreg.amw / Insecure Permissions Febbraio 26, 2021
  Posted by malvuln on Feb 26Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/5eb58198721d4ded363e41e243e685cc.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Azbreg.amw Vulnerability: Insecure Permissions Description: The backdoor creates an insecure hidden dir named "MSDCSC" granting change (C) permissions to the authenticated user group. Standard users can rename the malware...
• Trojan-Spy.Win32.SpyEyes.elr / Insecure Permissions Febbraio 26, 2021
  Posted by malvuln on Feb 26Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/025d07f4610605031e501e6745d663aa.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-Spy.Win32.SpyEyes.elr Vulnerability: Insecure Permissions Description: The malware creates an insecure hidden dir named "40404504504" under c:\ drive, granting change (C) permissions to the authenticated user group. Standard users...
• Trojan-Dropper.Win32.Daws.etlm / Remote Unauthenticated System Reboot Febbraio 26, 2021
  Posted by malvuln on Feb 26Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/a0479e18283ed46e8908767dd0b40f8f.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-Dropper.Win32.Daws.etlm Vulnerability: Remote Unauthenticated System Reboot Description: Daws.etlm drops an executable named "MSWDM.EXE" under Windows dir and listens on UDP port 139. Unauthenticated third-party attackers can send...