November 2022 - rwth-security - lists.rwth-aachen.de

Bypassing LDAP Channel Binding with StartTLS (Active Directory)
by Bernd Kohler 08 Jan '24

08 Jan '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Bypassing LDAP Channel Binding with StartTLS" VG Bernd [0] https://offsec.almond.consulting/bypassing-ldap-channel-binding-with-startt… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 1

Cert-EU: Hardening Signal
by Bernd Kohler 20 Sep '23

20 Sep '23

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Hardening Signal" VG Bernd [0] https://media.cert.europa.eu/static/WhitePapers/TLP-WHITE-CERT-EU_Security_… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 1

Securing tomorrow today: Why Google now protects its internal
by Bernd Kohler 29 Nov '22

29 Nov '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Securing tomorrow today: Why Google now protects its internal communications from quantum threats" VG Bernd [0] https://cloud.google.com/blog/products/identity-security/why-google-now-use… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Windows - How to disable ISO mounting
by Bernd Kohler 23 Nov '22

23 Nov '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "How to disable ISO mounting" --> es geht um "... threat actors moving to an alternate technique, sending disk image (.ISO, .IMG) files, often inside a ZIP archive. ..." VG Bernd [0] https://support.huntress.io/hc/en-us/articles/11477430445587-How-to-disable… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

KmsdBot – A Malware Written in Golang Infects Via SSH To Perform DDoS Attack
by Bernd Kohler 16 Nov '22

16 Nov '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "KmsdBot – A Malware Written in Golang Infects Via SSH To Perform DDoS Attack" VG Bernd [0] https://gbhackers.com/kmsdbot-a-malware-written-in-golang-infects-via-ssh/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Beware! Massive YouTube Campaign Aimed to Steal Login Credentials
by Bernd Kohler 15 Nov '22

15 Nov '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Beware! Massive YouTube Campaign Aimed to Steal Login Credentials" VG Bernd [0] https://gbhackers.com/beware-of-massive-youtube-campaign/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Yamato Security's Ultimate Windows Event Log Configuration Guide For
by Bernd Kohler 10 Nov '22

10 Nov '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Yamato Security's Ultimate Windows Event Log Configuration Guide For DFIR And Threat Hunting" --> Tipps und Skripts VG Bernd [0] https://github.com/Yamato-Security/EnableWindowsLogSettings -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Windows Kerberos Updates
by Bernd Kohler 09 Nov '22

09 Nov '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0]/[1] FYI [0] KB5021131 - CVE-2022-37966 [1] KB5020805 - CVE-2022-37967 aus [0] "The Kerberos Key Distribution Center lacks strong keys for account: accountname. You must update the password of this account to prevent use of insecure cryptography. See https://go.microsoft.com/fwlink/?linkid=2210019 to learn more." VG Bernd [0] https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerbe… [1] https://support.microsoft.com/en-us/topic/kb5020805-how-to-manage-kerberos-… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0