October 2024 - rwth-security - lists.rwth-aachen.de

Critical Zero-Day Automotive Systems Vulnerabilities Exposed
by Bernd Kohler 08 Oct '24

08 Oct '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Critical Zero-Day Automotive Systems Vulnerabilities Exposed" --> "... everal zero-day exploits, vulnerabilities that are unknown to the software developers, in various Electronic Control Units (ECUs) within vehicles ..." --> Vortragsfolien [1] "Tales from a Penetration Testing Team" VG Bernd [0] https://securityonline.info/critical-zero-day-automotive-systems-vulnerabil… [1] https://sos.asrg.io/wp-content/uploads/2024/09/Amit-Geynis_Presentation-Sli… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Thousands of Linux systems infected by stealthy malware since 2021
by Jochem Ippers 07 Oct '24

07 Oct '24

Halo zusammen, hatten wir das hier schon? Thousands of Linux systems infected by stealthy malware since 2021: https://arstechnica.com/security/2024/10/persistent-stealthy-linux-malware-… Viele Grüße Jochem -- _____________________________________________________ Jochem Ippers Institut für Kraftfahrzeuge - RWTH Aachen University EDV, Netzwerk / IT-Department Steinbachstr. 7 - 52074 Aachen - Germany Tel +49 241 80 25628 - Fax +49 241 80 22147 ippers(a)ika.rwth-aachen.de www.ika.rwth-aachen.de _____________________________________________________

1 0

Mamba 2FA: A new contender in the AiTM phishing ecosystem
by Bernd Kohler 07 Oct '24

07 Oct '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Mamba 2FA: A new contender in the AiTM phishing ecosystem" --> "As of October 2024, the URLs of Mamba 2FA phishing pages have the following structure:" https://{domain}/{m,n,o}/?{Base64 string} VG Bernd [0] https://blog.sekoia.io/mamba-2fa-a-new-contender-in-the-aitm-phishing-ecosy… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Redis Patches for Multi Flaws, Including Potential RCE
by Bernd Kohler 07 Oct '24

07 Oct '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Redis Patches for Multi Flaws, Including Potential RCE (CVE-2024-31449)" VG Bernd [0] https://securityonline.info/redis-patches-for-multi-flaws-including-potenti… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Severe Unauthenticated RCE Flaw (CVSS 9.9) in GNU/Linux Systems
by Bernd Kohler 07 Oct '24

07 Oct '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Severe Unauthenticated RCE Flaw (CVSS 9.9) in GNU/Linux Systems Awaiting Full Disclosure" --> "... October 6: Full public disclosure of the vulnerability details ..." --> "was there for more than a decade" [1] --> OS-Updates sollten aber eh immer asap eingespielt werden ;) VG Bernd [0] https://securityonline.info/severe-unauthenticated-rce-flaw-cvss-9-9-in-gnu… [1] https://x.com/evilsocket/status/1838169889330135132 -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 7

Two-factor Authentication (TFA) - Critical - Access bypass -
by Bernd Kohler 04 Oct '24

04 Oct '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043" --> bypass von 2FA, es werden aber valide Credentials für den Angriff benötigt VG Bernd [0] https://www.drupal.org/sa-contrib-2024-043 -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

PAM module may allow accessing with the credentials of another user
by Bernd Kohler 04 Oct '24

04 Oct '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "PAM module may allow accessing with the credentials of another user" --> "... up to version 0.3.4 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as the ..." VG Bernd [0] https://github.com/ubuntu/authd/security/advisories/GHSA-x5q3-c8rm-w787 -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

BSI: German-French recommendations for the use of AI programming
by Bernd Kohler 04 Oct '24

04 Oct '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "German-French recommendations for the use of AI programming assistants" VG Bernd [0] https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/KI/ANSSI_BSI_AI_Coding_… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Android 14 - Google Adds New Pixel Security Features to Block 2G
by Bernd Kohler 04 Oct '24

04 Oct '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Google Adds New Pixel Security Features to Block 2G Exploits and Baseband Attacks" --> originaler Blog-Beitrag [1] VG Bernd [0] https://thehackernews.com/2024/10/android-14-adds-new-security-features.html [1] https://security.googleblog.com/2024/10/pixel-proactive-security-cellular-m… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

CVE-2024-5102: Avast Antivirus Flaw Could Allow Hackers to Delete
by Bernd Kohler 04 Oct '24

04 Oct '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "CVE-2024-5102: Avast Antivirus Flaw Could Allow Hackers to Delete Files and Run Code as SYSTEM" --> "... Avast has addressed this vulnerability in version 24.2 and later of their antivirus software ... prioritize updating to the latest version ..." VG Bernd [0] https://securityonline.info/cve-2024-5102-avast-antivirus-flaw-could-allow-… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0