- rwth-security - lists.rwth-aachen.de

IceKube: Finding complex attack paths in Kubernetes clusters
by Bernd Kohler 08 Dec '23

08 Dec '23

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "IceKube: Finding complex attack paths in Kubernetes clusters" --> das GIT repo findet sich auf [1] VG Bernd [0] https://labs.withsecure.com/tools/icekube--finding-complex-attack-paths-in-… [1] https://github.com/WithSecureLabs/IceKube -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Firefox 120 - "imports TLS trust anchors (e.g., certificates) from
by Bernd Kohler 08 Dec '23

08 Dec '23

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Firefox Beta Release Notes" VG Bernd [0] https://www.mozilla.org/en-US/firefox/120.0beta/releasenotes/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

LogoFAIL - Research,UEFI flaws allow bootkits to pwn potentially
by Bernd Kohler 08 Dec '23

08 Dec '23

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "UEFI flaws allow bootkits to pwn potentially hundreds of devices using images" --> siehe dazu auch [1] --> "All three of the major independent BIOS vendors – AMI, Insyde, and Phoenix – are affected by the issues, as well as devices from Intel, Acer, and Lenovo ." VG Bernd [0] https://www.theregister.com/2023/12/01/uefi_image_parser_flaws/ [1] https://www.bleepingcomputer.com/news/security/logofail-attack-can-install-… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 1

New SLAM attack steals sensitive data from AMD, future Intel CPUs
by Bernd Kohler 07 Dec '23

07 Dec '23

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "New SLAM attack steals sensitive data from AMD, future Intel CPUs" VG Bernd [0] https://www.bleepingcomputer.com/news/security/new-slam-attack-steals-sensi… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Spoofing DNS Records by Abusing DHCP DNS Dynamic Updates
by Bernd Kohler 07 Dec '23

07 Dec '23

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Spoofing DNS Records by Abusing DHCP DNS Dynamic Updates" "... new set of attacks against Active Directory domains that use Microsoft Dynamic Host Configuration Protocol (DHCP) servers. ..." VG Bernd [0] https://www.akamai.com/blog/security-research/spoofing-dns-by-abusing-dhcp -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

RMML - Remote Management and Monitoring (tool) List
by Bernd Kohler 29 Nov '23

29 Nov '23

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "RMML" - "... RMM tools with associated metadata that aims to be useful for IT and Security teams. ..." - "... team who wants to monitor their environment for RMMs that aren't supposed to be there (or for all of them) ..." VG Bernd [0] https://github.com/LivingInSyn/RMML -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Experts Uncover Passive Method to Extract Private RSA Keys from SSH
by Bernd Kohler 27 Nov '23

27 Nov '23

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Experts Uncover Passive Method to Extract Private RSA Keys from SSH Connections" (siehe dazu [1]) VG Bernd [0] https://thehackernews.com/2023/11/experts-uncover-passive-method-to.html [1] https://eprint.iacr.org/2023/1711 -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/c/ITCenterRWTHAachen

2 1

Microsoft ICS Forensics Framework
by Bernd Kohler 24 Nov '23

24 Nov '23

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Microsoft ICS Forensics Framework" --> "... open source forensic framework for analyzing Industrial PLC metadata and project files ..." VG Bernd [0] https://github.com/microsoft/ics-forensics-tools -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/c/ITCenterRWTHAachen

1 0

The Marvin Attack
by Bernd Kohler 23 Nov '23

23 Nov '23

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "The Marvin Attack" --> "... return of a 25 year old vulnerability that allows performing RSA decryption and signing operations as an attacker with the ability to observe only the time of the decryption operation performed with the private key ..." VG Bernd [0] https://people.redhat.com/~hkario/marvin/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Google confirms they will disable uBlock Origin in Chrome in 2024
by Bernd Kohler 17 Nov '23

17 Nov '23

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Google confirms they will disable uBlock Origin in Chrome in 2024" VG Bernd [0] https://www.reddit.com/r/uBlockOrigin/comments/17wu2gz/google_confirms_they… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/c/ITCenterRWTHAachen

1 0