August 2024 - rwth-security - lists.rwth-aachen.de

Let's Encrypt - Intent to End OCSP Service
by Bernd Kohler 30 Dec '24

30 Dec '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Intent to End OCSP Service" --> "... our intent to end Online Certificate Status Protocol (OCSP) support in favor of Certificate Revocation Lists (CRLs) as soon as possible ..." --> "... As soon as the Microsoft Root Program also makes OCSP o ptional, which we are optimistic will happen within the next six to twelve months, Let’s Encrypt intends to announce a specific and rapid timeline for shutting down our OCSP services. ..." --> kein OSCP stapling? VG Bernd [0] https://letsencrypt.org/2024/07/23/replacing-ocsp-with-crls.html -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 1

GitHub comments abused to spread Lumma Stealer malware as fake fixes
by Bernd Kohler 31 Aug '24

31 Aug '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "GitHub comments abused to spread Lumma Stealer malware as fake fixes" VG Bernd [0] https://www.bleepingcomputer.com/news/security/github-comments-abused-to-sp… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Insecure Platform Key (PK) used in UEFI system firmware signature
by Bernd Kohler 30 Aug '24

30 Aug '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Insecure Platform Key (PK) used in UEFI system firmware signature" --> ergänzend zu [1] --> unter *nix (getestet Debian, siehe dazu [2]) sudo apt install fwupd # Liste alle erkannten Geräte fwupdmgr get-devices # Aktualisiert der lokalen DB über den Linux Vendor Firmware Service fwupdmgr refresh # verfügbarer Updates anzeigen fwupdmgr get-updates # Firmware herunterladen und Updates durchführen (erfordert reboot) fwupdmgr update VG Bernd [0] https://kb.cert.org/vuls/id/455367 [1] https://heise.de/-9814730 [2] https://wiki.ubuntuusers.de/fwupd/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Cyberattackers Exploit Google Sheets for Malware Control in Likely
by Bernd Kohler 30 Aug '24

30 Aug '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Cyberattackers Exploit Google Sheets for Malware Control in Likely Espionage Campaign" VG Bernd [0] https://thehackernews.com/2024/08/cyberattackers-exploit-google-sheets.html -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/c/ITCenterRWTHAachen

1 0

SANS Institute Unveils Critical Infrastructure Strategy Guide for
by Bernd Kohler 30 Aug '24

30 Aug '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "SANS Institute Unveils Critical Infrastructure Strategy Guide for 2024: A Call to Action for Securing ICS/OT Environments" --> Report [1]: "SANS Strategy Guide: ICS Is the Business" VG Bernd [0] https://thehackernews.com/2024/08/sans-institute-unveils-critical.html [1] https://www.sans.org/mlp/ics-business-guide-2024/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Recon 2024: Automating Malware Deobfuscation with Binary Ninja
by Bernd Kohler 28 Aug '24

28 Aug '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Automating Malware Deobfuscation with Binary Ninja" --> inkl. Code[0], Slides [1] und Workshop Manual [3] --> frei Version von BinaryNinja via [4] VG Bernd [0] https://cfp.recon.cx/recon2024/talk/review/TAX8LR3HBYDMJDGGXXVB8RLENWXETNX7 [1] https://github.com/Invoke-RE/workshops/tree/main/recon2024 [2] https://cfp.recon.cx/media/recon2024/submissions/DDHBFN/resources/Slides_-_… [3] https://cfp.recon.cx/media/recon2024/submissions/DDHBFN/resources/Automatin… [4] https://binary.ninja/free/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/c/ITCenterRWTHAachen

1 0

BlackByte Ransomware Exploits VMware ESXi Flaw in Latest Attack Wave
by Bernd Kohler 28 Aug '24

28 Aug '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "BlackByte Ransomware Exploits VMware ESXi Flaw in Latest Attack Wave" VG Bernd [0] https://thehackernews.com/2024/08/blackbyte-ransomware-exploits-vmware.html -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/c/ITCenterRWTHAachen

1 0

New QR Code Phishing Campaign Exploits Microsoft Sway to Steal
by Bernd Kohler 28 Aug '24

28 Aug '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "New QR Code Phishing Campaign Exploits Microsoft Sway to Steal Credentials" VG Bernd [0] https://thehackernews.com/2024/08/new-qr-code-phishing-campaign-exploits.ht… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Intel's Software Guard Extensions broken? Don't panic
by Bernd Kohler 28 Aug '24

28 Aug '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Intel's Software Guard Extensions broken? Don't panic" VG Bernd [0] https://www.theregister.com/2024/08/27/intel_root_key_xeons/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Attacks by malware abusing AppDomainManager Injection
by Bernd Kohler 27 Aug '24

27 Aug '24

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Attacks by malware abusing AppDomainManager Injection" VG Bernd [0] https://jp.security.ntt/tech_blog/appdomainmanager-injection-en -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/c/ITCenterRWTHAachen

1 0