Condividi

RSS

Piu’ articoli…

• Zero-Day attack: cosa sono e come difendersi con SOCaaS
• Sistema di monitoraggio, una panoramica
• Data Exfiltration: difesa dal furto di dati
• Installare un certificato Let’s Encrypt su macchina Debian based
• WastedLocker: Ransomware di ultima generazione
• Proteggere un sito in WordPress: pacchetto sicurezza
• Ransomware critici: esempi di attacchi andati a segno
• Iniziative sociali di Secure Online Desktop

Categorie …

• Backup as a Service (3)
  • Acronis Cloud Backup (16)
  • Veeam Cloud Connect (3)
• Cloud CRM (1)
• Cloud Server/VPS (22)
• Conferenza Cloud (4)
• Log Management (2)
• Monitoraggio ICT (4)
• Novita' (11)
• ownCloud (7)
• Privacy (7)
• Secure Online Desktop (14)
• Security (5)
  • SOCaaS (9)
    • SIEM (3)
    • UEBA (3)
  • Vulnerabilita' (82)
• Web Hosting (13)

Tags

CSIRT

• Campagna di phishing Outlook “Voice App” (AL01/210119/CSIRT-ITA) Gennaio 19, 2021
  La campagna phishing sfrutta una finta email di trasmissione di una nota vocale per sottrarre alle vittime le credenziali dei servizi Microsoft Office.
• Sito malevolo riproduce il portale di Immuni (AL01/210118/CSIRT-ITA) Gennaio 18, 2021
  È stato individuato un sito che, imitando l'indirizzo web e il layout del portale ufficiale di Immuni, diffonderebbe un’applicazione malevola.
• La Settimana Cibernetica del 17 gennaio 2021 Gennaio 18, 2021
  Il riepilogo delle notizie pubblicate dallo CSIRT italiano dall'11 al 17 gennaio 2021.
• Attacchi verso servizi Cloud (BL01/210115/CSIRT-ITA) Gennaio 15, 2021
  Rilevati attacchi verso piattaforme cloud afferenti a varie organizzazioni in tutto il mondo.
• SQL Injection su prodotti Fortinet (AL02/210115/CSIRT-ITA) Gennaio 15, 2021
  Identificata una vulnerabilità su prodotti Fortinet che potrebbe consentire a un attaccante remoto l’esecuzione di comandi arbitrari.
• Vulnerabilità su prodotti Cisco (AL01/210115/CSIRT-ITA) Gennaio 15, 2021
  Cisco ha rilasciato di recente degli avvisi di sicurezza relativi a vulnerabilità con impatto medio e alto su diversi prodotti.
• Tecniche utilizzate dagli spammer per identificare account email attivi (BL01/210114/CSIRT-ITA) Gennaio 14, 2021
  Per rendere maggiormente efficaci le campagne di spam e/o di phishing, gli attaccanti hanno necessità di confermare l’effettiva esistenza e l’utilizzo delle caselle email obiettivo. Il presente bollettino descrive due delle tecniche più comuni, fra l’altro inizialmente concepite per scopi leciti.
• Aggiornamenti Mensili Microsoft (AL01/210114/CSIRT-ITA) Gennaio 14, 2021
  Microsoft ha rilasciato gli aggiornamenti di sicurezza mensili che risolvono un totale di 83 vulnerabilità, 10 delle quali di livello critico.
• Nuovo malware Android Rougue RAT (AL01/210113/CSIRT-ITA) Gennaio 13, 2021
  In vendita sul dark-web, a prezzi popolari, un nuovo tipo di malware Android denominato Rougue RAT.
• Nuova campagna mondiale di phishing/smishing (AL01/210112/CSIRT-ITA) Gennaio 12, 2021
  Rilevata una campagna di smishing/phishing che simula comunicazioni provenienti da fornitori di servizi tra i quali Gmail, Yahoo e Outlook.

Dark Reading:

• 4 Intriguing Email Attacks Detected by AI in 2020 Gennaio 19, 2021
  Here's to the sneakiest of the sneaky. These clever phishing messages -- that standard validation measures often missed -- deserve proper dishonor.
• The Most Pressing Concerns Facing CISOs Today Gennaio 19, 2021
  Building security into the software development life cycle creates more visibility, but CISOs still need stay on top of any serious threats on the horizon, even if they are largely unknown.
• A Security Practitioner's Guide to Encrypted DNS Gennaio 19, 2021
  Best practices for a shifting visibility landscape.
• NSA Appoints Rob Joyce as Cyber Director Gennaio 15, 2021
  Joyce has long worked in US cybersecurity leadership, most recently serving as the NSA's top representative in the UK.
• Successful Malware Incidents Rise as Attackers Shift Tactics Gennaio 15, 2021
  As employees moved to working from home and on mobile devices, attackers followed them and focused on weekend attacks, a security firm says.
• How to Achieve Collaboration Tool Compliance Gennaio 15, 2021
  Organizations must fully understand the regulatory guidance on collaboration security and privacy so they can continue to implement and expand their use of tools such as Zoom and Teams.
• Name That Toon: Before I Go ... Gennaio 15, 2021
  Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.
• These Kids Are All Right Gennaio 15, 2021
  Faculty and students at the William E. Doar School for the Performing Arts in Washington, D.C. created "Cyberspace," a rap song about online safety as part of the NSA's national STOP. THINK. CONNECT. campaign back in 2012. Wonder how many went into security.
• Shifting Privacy Landscape, Disruptive Technologies Will Test Businesses Gennaio 14, 2021
  A new machine learning tool aims to mine privacy policies on behalf of users.
• 'Chimera' Threat Group Abuses Microsoft & Google Cloud Services Gennaio 14, 2021
  Researchers detail a new threat group targeting cloud services to achieve goals aligning with Chinese interests.

Full Disclosure

• Backdoor.Win32.NetBull.11.a / Remote Buffer Overflow Gennaio 19, 2021
  Posted by malvuln on Jan 19Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/80e98fdf726a3e727f3414bdbf2e86bb.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.NetBull.11.a Vulnerability: Remote Buffer Overflow Description: Netbull listens on both TCP ports 23444 and 23445, sending a large string of junk chars causes stack corruption overwriting EDX register. Type: PE32 MD5:...
• Email-Worm.Win32.Agent.gi / Remote Stack Buffer Overflow - (UDP Datagram) Gennaio 19, 2021
  Posted by malvuln on Jan 19Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/74e65773735f977185f6a09f1472ea46.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Email-Worm.Win32.Agent.gi Vulnerability: Remote Stack Buffer Overflow - (UDP Datagram) Description: Creates a service "Microsoft ASPI Manager" and listens on TCP ports 80, 81 and UDP 53. The service process is a […]
• Constructor.Win32.SMWG.c / Insecure Permissions Gennaio 19, 2021
  Posted by malvuln on Jan 19Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/47e819a6ce3d5e93819f4842cfbe23d6.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Constructor.Win32.SMWG.c Vulnerability: Insecure Permissions Description: Description: SMWG - P2P VBS.sucke.gen worm generator by sevenC / N0:7 outputs its malicious VBS script granting change (C) permissions to authenticated users group. Type:...
• Constructor.Win32.SMWG.a / Insecure Permissions Gennaio 19, 2021
  Posted by malvuln on Jan 19Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/07cd532823d6ab05d6e5e3a56f7afbfd.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Constructor.Win32.SMWG.a Vulnerability: Insecure Permissions Description: Win32.SMWG VBS.sucke.gen worm generator by sevenC / N0:7 outputs its malicious VBS script granting change (C) permissions to authenticated users group. Type: PE32 MD5:...
• Newfuture Trojan V.1.0 BETA 1 / Insecure Permissions Gennaio 19, 2021
  Posted by malvuln on Jan 19Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/4f9376824718ff23a6238c877f73ff73.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Newfuture Trojan V.1.0 BETA 1 Vulnerability: Insecure Permissions Description: Newfuture by Wider is a remote access client and has a (Fast_sms) server component, it is written in spanish. On installation it […]
• Backdoor.Win32.Mnets / Remote Stack Buffer Overflow - (UDP Datagram Proto) Gennaio 19, 2021
  Posted by malvuln on Jan 19Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/1e42493dcef54a62bc28e0a1338c1142.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Mnets Vulnerability: Remote Stack Buffer Overflow - (UDP Datagram Proto) Description: The backdoor listens for commands on UDP ports 2222 and 4444. Sending a mere 323 bytes we can overwrite the […]
• Backdoor.Win32.Whgrx / Remote Host Header Stack Buffer Overflow Gennaio 19, 2021
  Posted by malvuln on Jan 19Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/eb6fd418cd3b52132ffb029b52839edf.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Whgrx Vulnerability: Remote Host Header Stack Buffer Overflow Description: The specimen listens on datagram UDP port 65000, by sending a specially crafted HTTP PUT request and specifying a large string of […]
• Backdoor.Win32.Latinus.b / Remote Buffer Overflow Gennaio 19, 2021
  Posted by malvuln on Jan 19Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/9adffcc98cd658a7f9c5419480013f72.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Latinus.b Vulnerability: Remote Buffer Overflow Description: Malware listens on both TCP ports 11831 and 29559, by sending an HTTP OPTIONS request with about 8945 bytes we trigger buffer overflow and overwriting […]
• Backdoor.Win32.Nucleroot.t - MaskPE 1.6 / File Based Buffer Overflow Gennaio 19, 2021
  Posted by malvuln on Jan 19Discovery / credits: Malvuln - malvuln.com (c) 20211 Original source: https://malvuln.com/advisory/170d3ccf9f036c552aef6690bf419b2e.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Nucleroot.t - MaskPE 1.6 Vulnerability: File Based Buffer Overflow Description: Description: MaskPE by yzkzero is a tool for implanting backdoors in existing PE files. The Backdoor tool doesnt properly check the […]
• Backdoor.Win32.Nucleroot.bi - MaskPE 2.0 / File Based Buffer Overflow Gennaio 19, 2021
  Posted by malvuln on Jan 19Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/25e0570cc803cd77abc2268b41237937.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Nucleroot.bi - MaskPE 2.0 Vulnerability: File Based Buffer Overflow Description: MaskPE by yzkzero is a tool for implanting backdoors in existing PE files. The Backdoor tool doesnt properly check the files […]