Condividi

RSS

Piu’ articoli…

• Cos’è veramente un cyber threat
• SNYPR: Big Data al servizio della ricerca delle minacce
• Hadoop Open Data Model: raccolta dati “open”
• Pass the Ticket: come mitigarlo con un SOCaaS
• Cos’è il Vishing e come funziona
• UBA e UEBA: le differenze
• Database Activity Monitoring: cos’è e come metterlo in pratica
• SOAR e l’automazione della sicurezza informatica

Categorie …

• Backup as a Service (3)
  • Acronis Cloud Backup (18)
  • Veeam Cloud Connect (3)
• Cloud CRM (1)
• Cloud Server/VPS (22)
• Conferenza Cloud (4)
• Log Management (2)
• Monitoraggio ICT (4)
• Novita' (13)
• ownCloud (7)
• Privacy (8)
• Secure Online Desktop (14)
• Security (9)
  • Cyber Threat Intelligence (CTI) (3)
  • Ethical Phishing (8)
  • SOCaaS (23)
    • SIEM (10)
    • UEBA (8)
  • Vulnerabilita' (84)
• Web Hosting (15)

Tags

CSIRT

• Disponibili aggiornamenti per alcuni prodotti CISCO (AL01/210902/CSIRT-ITA) Settembre 2, 2021
  Aggiornamenti di sicurezza Cisco del 30 agosto e del 1 settembre 2021 sanano molteplici vulnerabilità su diversi prodotti, di cui una con gravità “critica”.
• Nuova versione di Google Chrome (AL02/210901/CSIRT-ITA) Settembre 1, 2021
  Il nuovo aggiornamento di Google Chrome per Windows, Mac e Linux corregge 27 vulnerabilità di sicurezza, di cui 5 con gravità “alta”.
• Rilasciati i dettagli relativi alla vulnerabilità ProxyToken che interessa Microsoft Exchange (AL01/210901/CSIRT-ITA) Settembre 1, 2021
  Rilasciati i dettagli tecnici relativi alla vulnerabilità denominata ProxyToken che interessa i server Microsoft Exchange, già sanata dal vendor nel mese di luglio.
• La Settimana Cibernetica del 29 agosto 2021 Settembre 1, 2021
  Scarica il riepilogo delle notizie pubblicate dallo CSIRT italiano dal 23 al 29 agosto 2021.
• Disponibili aggiornamenti di prodotti CISCO (AL01/210827/CSIRT-ITA) Agosto 27, 2021
  Aggiornamenti di sicurezza Cisco sanano molteplici vulnerabilità, di cui 1 con gravità “critica” e 6 con gravità “alta”.
• Sanate molteplici vulnerabilità di F5 BIG-IP (AL01/210826/CSIRT-ITA) Agosto 26, 2021
  Sanate vulnerabilità in diversi prodotti F5 BIG-IP, tra cui una di livello critico che interessa Advanced WAF (Web Application Firewall) e Application Security Manager (ASM), in particolare l'interfaccia utente di gestione del traffico (TMUI).
• Aggiornamenti di sicurezza VMware (AL03/210825/CSIRT-ITA) Agosto 25, 2021
  Vengono corrette 6 vulnerabilità presenti in diversi prodotti VMware.
• Vulnerabilità multiple in OpenSSL (AL02/210825/CSIRT-ITA) Agosto 25, 2021
  OpenSSL ha rilasciato aggiornamenti che risolvono due vulnerabilità, una delle quali potrebbe consentire a un attaccante di eseguire codice arbitrario portando a una compromissione totale del sistema.
• Rilevata vulnerabilità BIND (AL01/210825/CSIRT-ITA) Agosto 25, 2021
  La CVE-2021-25218 permetterebbe a un attaccante remoto di causare un Denial of Service.
• Approfondimento su vulnerabilità ProxyShell di Exchange sfruttate per diffondere ransomware (AL01/210824/CSIRT-ITA) Agosto 24, 2021
  Ad integrazione di quanto riportato nell’alert AL01/210822/CSIRT-ITA circa lo sfruttamento delle vulnerabilità ProxyShell di Microsoft Exchange per diffondere ransomware, si riportano dettagliate azioni di mitigazione e relativi Indicatori di Compromissione.

Dark Reading:

• FragAttacks Foil 2 Decades of Wireless Security Agosto 6, 2021
  Wireless security protocols have improved, but product vendors continue to make implementation errors that allow a variety of attacks.
• Researchers Call for 'CVE' Approach for Cloud Vulnerabilities Agosto 6, 2021
  New research suggests isolation among cloud customer accounts may not be a given -- and the researchers behind the findings issue a call to action for cloud security.
• HTTP/2 Implementation Errors Exposing Websites to Serious Risks Agosto 6, 2021
  Organizations that don't implement end-to-end HTTP/2 are vulnerable to attacks that redirect users to malicious sites and other threats, security researcher reveals at Black Hat USA.
• CISA Launches JCDC, the Joint Cyber Defense Collaborative Agosto 6, 2021
  "We can't do this alone," the new CISA director told attendees in a keynote at Black Hat USA today.
• Incident Responders Explore Microsoft 365 Attacks in the Wild Agosto 5, 2021
  Mandiant experts discuss the novel techniques used to evade detection, automate data theft, and achieve persistent access.
• Researchers Find Significant Vulnerabilities in macOS Privacy Protections Agosto 5, 2021
  Attacks require executing code on a system but foil Apple's approach to protecting private data and systems files.
• A New Approach to Securing Authentication Systems' Core Secrets Agosto 5, 2021
  Researchers at Black Hat USA explain issues around defending "Golden Secrets" and present an approach to solving the problem.
• Organizations Still Struggle to Hire & Retain Infosec Employees: Report Agosto 5, 2021
  Security leaders are challenged to fill application security and cloud computing jobs in particular, survey data shows.
• Why Supply Chain Attacks Are Destined to Escalate Agosto 5, 2021
  In his keynote address at Black Hat USA on Wednesday, Matt Tait, chief operating officer at Corellium, called for software platform vendors and security researchers to do their part to thwart the fallout of software supply chain compromises.
• New Normal Demands New Security Leadership Structure Agosto 2, 2021
  At the inaugural Omdia Analyst Summit, experts discuss where the past year has created gaps in traditional security strategy and how organizations can fill them.

Full Disclosure

• APPLE-SA-2021-09-13-5 Safari 14.1.2 Settembre 17, 2021
  Posted by Apple Product Security via Fulldisclosure on Sep 17APPLE-SA-2021-09-13-5 Safari 14.1.2 Safari 14.1.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212808. WebKit Available for: macOS Catalina and macOS Mojave Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that […]
• APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina Settembre 17, 2021
  Posted by Apple Product Security via Fulldisclosure on Sep 17APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina Security Update 2021-005 Catalina addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212805. CoreGraphics Available for: macOS Catalina Impact: Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report […]
• APPLE-SA-2021-09-13-3 macOS Big Sur 11.6 Settembre 17, 2021
  Posted by Apple Product Security via Fulldisclosure on Sep 17APPLE-SA-2021-09-13-3 macOS Big Sur 11.6 macOS Big Sur 11.6 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212804. CoreGraphics Available for: macOS Big Sur Impact: Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a […]
• APPLE-SA-2021-09-13-2 watchOS 7.6.2 Settembre 17, 2021
  Posted by Apple Product Security via Fulldisclosure on Sep 17APPLE-SA-2021-09-13-2 watchOS 7.6.2 watchOS 7.6.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212806. CoreGraphics Available for: Apple Watch Series 3 and later Impact: Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report […]
• APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8 Settembre 17, 2021
  Posted by Apple Product Security via Fulldisclosure on Sep 17APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8 iOS 14.8 and iPadOS 14.8 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212807. CoreGraphics Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, […]
• AMD Chipset Driver Information Disclosure Vulnerability [CVE-2021-26333] Settembre 17, 2021
  Posted by disclosure on Sep 17We recently discovered a critical information disclosure vulnerability that affected the AMD Platform Security Processor (PSP) chipset driver for multiple CPU architectures. The vulnerability allowed non-privileged users to read uninitialised physical memory pages, where the original data was either moved or paged out. https://zeroperil.co.uk/cve-2021-26333/ Regards, Kyriakos Economou | Co-Founder kye […]
• Microsoft Windows Command-line Interpreter "cmd.exe" / Stack Buffer Overflow Settembre 17, 2021
  Posted by hyp3rlinx on Sep 17[+] Credits: John Page (aka hyp3rlinx, malvuln) [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-CMD.EXE-STACK-BUFFER-OVERFLOW.txt [+] twitter.com/hyp3rlinx [+] ISR: ApparitionSec [Vendor] www.microsoft.com [Product] cmd.exe is the default command-line interpreter for the OS/2, eComStation, ArcaOS, Microsoft Windows (Windows NT family and Windows CE family), and ReactOS operating...
• Backdoor.Win32.WinterLove.i / Hardcoded Weak Password Settembre 14, 2021
  Posted by malvuln on Sep 14Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/c6c81e8ba0a7b9da6216a78dfeccec8d.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.WinterLove.i Vulnerability: Hardcoded Weak Password Description: The WinterLove malware requires authentication for remote user access. However, the password "plunix" is weak and hardcoded in plaintext within the...
• Backdoor.Win32.Wollf.h / Unauthenticated Remote Command Execution Settembre 14, 2021
  Posted by malvuln on Sep 14Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/d0fd60516d53b2ad602c460351dbaa85.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.Wollf.h Vulnerability: Unauthenticated Remote Command Execution Description: The malware listens on TCP port 7614 installs a service named WRM. Third-party attackers who can reach the system can get a shell with […]
• Backdoor.Win32.VB.awm / Authentication Bypass - Information Leakage Settembre 14, 2021
  Posted by malvuln on Sep 14Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/2271d942a23a89d7adea524d4ac3c13f.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Threat: Backdoor.Win32.VB.awm Vulnerability: Authentication Bypass - Information Leakage Description: The "Cryptech Heat" malware listens on TCP port 3786 and has an option to set an remote access password. The malware also runs […]