Condividi

RSS

Piu’ articoli…

• Unificare la piattaforma per la threat detection
• L’importanza del monitoring ICT
• I benefici SOAR: semplificare indagine e risposta
• Security Code Review: come funziona il servizio
• Automated Response Integration: le automazioni nel SOCaaS
• Coordinazione tra CTI e SOC: come alzare ulteriormente le difese
• Novità Cloud Server: internet ridondata
• Certificato di qualità per il SOCaaS di SOD

Categorie …

• Backup as a Service (24)
  • Acronis Cloud Backup (18)
  • Veeam Cloud Connect (3)
• Cloud CRM (1)
• Cloud Server/VPS (23)
• Conferenza Cloud (4)
• Log Management (2)
• Monitoraggio ICT (4)
• Novita' (15)
• ownCloud (7)
• Privacy (8)
• Secure Online Desktop (15)
• Security (157)
  • Cyber Threat Intelligence (CTI) (5)
  • Ethical Phishing (8)
  • SOCaaS (49)
    • SIEM (12)
    • SOAR (4)
    • UEBA (9)
  • Vulnerabilita' (84)
• Web Hosting (15)

Tags

CSIRT

• Rilevata vulnerabilità in Sophos Firewall (AL01/220926/CSIRT-ITA) Settembre 26, 2022
  Rilasciati aggiornamenti di sicurezza che sanano una vulnerabilità critica presente nella console Web Admin e nello User Portal di Sophos Firewall.
• La Settimana Cibernetica del 25 settembre 2022 Settembre 26, 2022
  Scarica il riepilogo delle notizie pubblicate dallo CSIRT Italia dal 19 al 25 settembre 2022.
• Rilasciati aggiornamenti di sicurezza per Jenkins Core (AL02/220923/CSIRT-ITA) Settembre 23, 2022
  Rilasciato il Jenkins Security Advisory del 21 settembre che risolve una vulnerabilità in Jenkins (Core) weekly.
• Rilevato sfruttamento in rete della CVE-2022-35405 in prodotti Zoho (AL01/220923/CSIRT-ITA) Settembre 23, 2022
  Rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2022-35405 – già sanata dal vendor – presente nei prodotti Zoho ManageEngine Password Manager Pro, PAM360 e Access Manager Plus.
• Sfruttamento in rete della CVE-2022-26134 in Atlassian Confluence (BL01/220922/CSIRT-ITA) Settembre 22, 2022
  Prosegue lo sfruttamento attivo in rete della vulnerabilità CVE-2022-26134 – già sanata dal vendor – presente nel prodotto Atlassian Confluence Server e Data Center.
• Aggiornamenti per ISC BIND (AL01/220922/CSIRT-ITA) Settembre 22, 2022
  Aggiornamenti di sicurezza ISC sanano 6 vulnerabilità, di cui 4 con gravità “alta”, nel prodotto BIND che potrebbero comportare la compromissione della disponibilità del servizio.
• Aggiornamento per Microsoft Endpoint Configuration Manager (AL03/220921/CSIRT-ITA) Settembre 21, 2022
  Disponibile un nuovo aggiornamento di sicurezza Microsoft che risolve una vulnerabilità, con gravità “alta”, nel prodotto Endpoint Configuration Manager.
• Vulnerabilità in Moodle (AL02/220921/CSIRT-ITA) Settembre 21, 2022
  Rilevate vulnerabilità – di cui 2 con gravità “alta” - nel noto CMS open source Moodle, utilizzato tipicamente per la realizzazione di piattaforme di e-learning.
• Aggiornamenti di sicurezza per prodotti Mozilla (AL01/220921/CSIRT-ITA) - Aggiornamento Settembre 21, 2022
  Mozilla ha rilasciato aggiornamenti di sicurezza per sanare alcune vulnerabilità nei prodotti Firefox e Firefox ESR, di cui 3 con gravità “alta”.
• Analisi: modalità di evasione del TAG MOTW (BL01/220920/CSIRT-ITA) Settembre 20, 2022
  Il Multi State Information Sharing and Analysis Center MS-ISAC ha recentemente rilasciato un report volto ad evidenziare nuove modalità di attacco - utilizzate dai principali threat actor - a seguito del blocco da parte di Microsoft delle macro all’interno di documenti provenienti da risorse web.

Dark Reading

• App Developers Increasingly Targeted via Slack, DevOps Tools Settembre 23, 2022
  Slack, Docker, Kubernetes, and other applications that allow developers to collaborate have become the latest vector for software supply chain attacks.
• Malicious Apps With Millions of Downloads Found in Apple App Store, Google Play Settembre 23, 2022
  The ongoing ad fraud campaign can be traced back to 2019, but recently expanded into the iOS ecosystem, researchers say.
• CISA: Zoho ManageEngine RCE Bug Is Under Active Exploit Settembre 23, 2022
  The bug allows unauthenticated code execution on the company's firewall products, and CISA says it poses "significant risk" to federal government.
• Cyberattackers Compromise Microsoft Exchange Servers via Malicious OAuth Apps Settembre 23, 2022
  Cybercriminals took control of enterprise Exchange Servers to spread large amounts of spam aimed at signing people up for bogus subscriptions.
• How Europe Is Using Regulations to Harden Medical Devices Against Attack Settembre 23, 2022
  Manufacturers need to document a medical device's intended use and operational environment, as well as plan for misuse, such as a cyberattack.
• Neglecting Open Source Developers Puts the Internet at Risk Settembre 23, 2022
  From creating a software bill of materials for applications your company uses to supporting open source projects and maintainers, businesses need to step up their efforts to help reduce risks.
• Microsoft Looks to Enable Practical Zero-Trust Security With Windows 11 Settembre 23, 2022
  With the update, Microsoft adds features to allow easier deployment of zero-trust capabilities. Considering the 1.3 billion global Windows users, the support could make a difference.
• Mitigating Risk and Communicating Value in Multicloud Environments Settembre 23, 2022
  Protecting against risk is a shared responsibility that only gets more complex as you mix the different approaches of common cloud services.
• Researchers Uncover Mysterious 'Metador' Cyber-Espionage Group Settembre 23, 2022
  Researchers from SentinelLabs laid out what they know about the attackers and implored the researcher community for help in learning more about the shadowy group.
• Developer Leaks LockBit 3.0 Ransomware-Builder Code Settembre 22, 2022
  Code could allow other attackers to develop copycat versions of the malware, but it could help researchers understand the threat better as well.

Full Disclosure

• Backdoor.Win32.Hellza.120 / Authentication Bypass Settembre 20, 2022
  Posted by malvuln on Sep 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/2cbd0fcf4d5fd5fb6c8014390efb0b21_B.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Hellza.120 Vulnerability: Authentication Bypass Description: The malware listens on TCP ports 12122, 21. Third-party adversarys who can reach infected systems can logon using any username/password combination....
• Backdoor.Win32.Hellza.120 / Unauthorized Remote Command Execution Settembre 20, 2022
  Posted by malvuln on Sep 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/2cbd0fcf4d5fd5fb6c8014390efb0b21.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Hellza.120 Vulnerability: Unauthorized Remote Command Execution Description: The malware listens on TCP ports 12122, 21. Third-party adversarys who can reach infected systems can issue commands made available by the...
• Trojan.Ransom.Ryuk.A / Arbitrary Code Execution Settembre 20, 2022
  Posted by malvuln on Sep 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/5ac0f050f93f86e69026faea1fbb4450.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan.Ransom.Ryuk.A Vulnerability: Arbitrary Code Execution Description: The ransomware looks for and executes DLLs in its current directory. Therefore, we can potentially hijack a vuln DLL execute our own code, […]
• Trojan-Dropper.Win32.Corty.10 / Insecure Credential Storage Settembre 20, 2022
  Posted by malvuln on Sep 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/f72138e574743640bdcdb9f102dff0a5.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Trojan-Dropper.Win32.Corty.10 Vulnerability: Insecure Credential Storage Description: The malware stores its credentials in cleartext within the Windows registry. Family: Corty Type: PE32 MD5: f72138e574743640bdcdb9f102dff0a5 Vuln ID:...
• Re: over 2000 packages depend on abort()ing libgmp Settembre 20, 2022
  Posted by Matthew Fernandez on Sep 19What is the security boundary being violated here? As a maintainer of some of the packages implicated here, I’m unsure what my actionable tasks are. The threat model(s) for my packages does not consider crashes to be a security violation. On the other side, things like crypto code frequently […]
• SEC Consult SA-20220915-0 :: Local Privilege Escalation im SAP® SAPControl Web Service Interface (sapuxuserchk) Settembre 16, 2022
  Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 15SEC Consult Vulnerability Lab Security Advisory < 20220915-0 > ======================================================================= title: Local privilege escalation product: SAP® SAPControl Web Service Interface (sapuxuserchk) vulnerable version: see section "Vulnerable / tested versions" fixed version: see SAP security note 3158619 CVE number: CVE-2022-29614...
• SEC Consult SA-20220914-0 :: Improper Access Control in SAP® SAProuter Settembre 16, 2022
  Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 15SEC Consult Vulnerability Lab Security Advisory < 20220914-0 > ======================================================================= title: Improper Access Control product: SAP® SAProuter vulnerable version: see section "Vulnerable / tested versions" fixed version: see SAP security note 3158375 CVE number: CVE-2022-27668 impact: high homepage:...
• over 2000 packages depend on abort()ing libgmp Settembre 16, 2022
  Posted by Georgi Guninski on Sep 15ping world libgmp is library about big numbers. it is not a library for very big numbers, because if libgmp meets a very big number, it calls abort() and coredumps. 2442 packages depend on libgmp on ubuntu20. [email protected]:~/prim$ apt-cache rdepends libgmp10 | wc -l 2442 gawk crash: [email protected]:~/prim$ gawk […]
• APPLE-SA-2022-09-12-5 Safari 16 Settembre 12, 2022
  Posted by Apple Product Security via Fulldisclosure on Sep 12APPLE-SA-2022-09-12-5 Safari 16 Safari 16 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213442. Safari Extensions Available for: macOS Big Sur and macOS Monterey Impact: A website may be able to track users through Safari web extensions Description: A logic issue […]
• APPLE-SA-2022-09-12-4 macOS Monterey 12.6 Settembre 12, 2022
  Posted by Apple Product Security via Fulldisclosure on Sep 12APPLE-SA-2022-09-12-4 macOS Monterey 12.6 macOS Monterey 12.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT213444. ATS Available for: macOS Monterey Impact: An app may be able to bypass Privacy preferences Description: A logic issue was addressed with improved state management. […]