cyberveille.decio.ch

cyberveille.decio.ch

5334 bookmarks
Custom sorting
MAR-10400779-1.v1 – Zimbra 1
MAR-10400779-1.v1 – Zimbra 1
CISA received seven files for analysis. Six Java Server Pages (JSP) webshells and a Bourne Again SHell (bash) file. Five JSP webshell files are designed to parse inbound requests for commands for execution, download files, and upload files. One JSP webshell file contains a form with input fields that prompts the attacker to enter the command in the input box and click "run" to execute. The command output will be displayed in a JSP page. The bash file is designed to perform ldapsearch queries and store the output into a newly created directory.
#uscert#csirt#cert#EN#2022#Malware#Analysis#Report#AR22-270A#Zimbra
·cisa.gov·
MAR-10400779-1.v1 – Zimbra 1
Microsoft Issues Out-of-Band Patch for Flaw Allowing Lateral Movement, Ransomware Attacks
Microsoft Issues Out-of-Band Patch for Flaw Allowing Lateral Movement, Ransomware Attacks
Microsoft this week released an out-of-band security update for its Endpoint Configuration Manager solution to patch a vulnerability that could be useful to malicious actors for moving around in a targeted organization’s network. The vulnerability is tracked as CVE-2022-37972 and it has been described by Microsoft as a medium-severity spoofing issue. The tech giant has credited Brandon Colley of Trimarc Security for reporting the flaw.
#Microsoft#EN#2022#CVE-2022-37972#Endpoint-Configuration-Manager#patch#vulnerability
·securityweek.com·
Microsoft Issues Out-of-Band Patch for Flaw Allowing Lateral Movement, Ransomware Attacks
Tarfile: Exploiting the World With a 15-Year-Old Vulnerability
Tarfile: Exploiting the World With a 15-Year-Old Vulnerability
Trellix Advanced Research Center stumbled across a vulnerability in Python’s tarfile module. As we dug into the issue, we realized this was in fact CVE-2007-4559. The vulnerability is a path traversal attack in the extract and extractall functions in the tarfile module that allow an attacker to overwrite arbitrary files by adding the “..” sequence to filenames in a TAR archive. Over the course of our research into the impact of this vulnerability we discovered that hundreds of thousands of repositories were vulnerable to this vulnerability. While the vulnerability was originally only marked as a 6.8, we were able to confirm that in most cases an attacker can gain code execution from the file write.
#trellix#EN#2022#CVE-2007-4559#tarfile#Python#vulnerability
·trellix.com·
Tarfile: Exploiting the World With a 15-Year-Old Vulnerability
Iranian State Actors Conduct Cyber Operations Against the Government of Albania
Iranian State Actors Conduct Cyber Operations Against the Government of Albania
The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory to provide information on recent cyber operations against the Government of Albania in July and September. This advisory provides a timeline of activity observed, from initial access to execution of encryption and wiper attacks. Additional information concerning files used by the actors during their exploitation of and cyber attack against the victim organization is provided in Appendices A and B.
#cisa#EN#2022#uscert#csirt#cert#US#Iran#Albania#attribution#IoCs#FBI
·cisa.gov·
Iranian State Actors Conduct Cyber Operations Against the Government of Albania
Revealed: US Military Bought Mass Monitoring Tool That Includes Internet Browsing, Email Data
Revealed: US Military Bought Mass Monitoring Tool That Includes Internet Browsing, Email Data
The “Augury” platform includes highly sensitive network data that Team Cymru, a private company, is selling to the military. “It’s everything. There’s nothing else to capture except the smell of electricity,” one cybersecurity expert said.
#vice#EN#2022#Augury#Cymru#U.S.#military#NCIS#privacy
·vice.com·
Revealed: US Military Bought Mass Monitoring Tool That Includes Internet Browsing, Email Data
Chromium Blog: Announcing the Launch of the Chrome Root Program
Chromium Blog: Announcing the Launch of the Chrome Root Program
In 2020, we announced we were in the early phases of establishing the Chrome Root Program and launching the Chrome Root Store. The Chrome Root Program ultimately determines which website certificates are trusted by default in Chrome, and enables more consistent and reliable website certificate validation across platforms. This post shares an update on our progress and how these changes help us better protect Chrome’s users.
#chromium#EN#2022#root#store#certificates#trust
·blog.chromium.org·
Chromium Blog: Announcing the Launch of the Chrome Root Program
Record 25.3 Billion Request Multiplexing Attack Mitigated by Imperva
Record 25.3 Billion Request Multiplexing Attack Mitigated by Imperva
On June 27, 2022, Imperva mitigated a single attack with over 25.3 billion requests, setting a new record for Imperva’s application DDoS mitigation solution. While attacks with over one million requests per second (RPS) aren’t new, we’ve previously only seen them last for several seconds to a few minutes. On June 27, Imperva successfully mitigated a strong attack that lasted more than four hours and peaked at 3.9 million RPS.
#imperva#EN#2022#DDoS#RPS#attack
·imperva.com·
Record 25.3 Billion Request Multiplexing Attack Mitigated by Imperva
Affaire Pegasus: l'Union européenne se penche sur le dossier suisse - rts.ch - Monde
Affaire Pegasus: l'Union européenne se penche sur le dossier suisse - rts.ch - Monde
Le Haut Commissariat aux droits de l’homme des Nations unies a publié vendredi un nouveau rapport extrêmement alarmant sur les menaces des nouvelles technologies de surveillance quant au respect de la vie privée et des droits humains. Les usages dénoncés font largement écho à la situation en Suisse.
#rts#CH#FR#2022#Pegasus#Suisse#Fanti#EU
·rts.ch·
Affaire Pegasus: l'Union européenne se penche sur le dossier suisse - rts.ch - Monde