- rwth-security - lists.rwth-aachen.de

New Issuance Requirements Improve HTTPS Certificate Validation
by Bernd Kohler 28 Mar '25

28 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "New Issuance Requirements Improve HTTPS Certificate Validation" --> "... To improve domain control validation, Multi-Perspective Issuance Corroboration (MPIC) was added to the baseline requirements, as it proved to be effective against real-world BGP hijacks. ..." VG Bernd [0] https://www.securityweek.com/new-issuance-requirements-improve-https-certif… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

CVE-2025-2857: New Firefox Sandbox Escape Emerges Following Active Exploitation of CVE-2025-2783
by Bernd Kohler 27 Mar '25

27 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "CVE-2025-2857: New Firefox Sandbox Escape Emerges Following Active Exploitation of CVE-2025-2783" --> "... has now been addressed with the release of Firefox 136.0.4, Firefox ESR 115.21.1, and ESR 128.8.1. ..." VG Bernd [0] https://securityonline.info/cve-2025-2857-new-firefox-sandbox-escape-emerge… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Kereva LLM Code Scanner
by Bernd Kohler 27 Mar '25

27 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Kereva LLM Code Scanner" --> Static analysis for LLM-powered Python applications VG Bernd [0] https://github.com/kereva-dev/kereva-scanner -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

The Firewall Project (Application Security with Enterprise features) is now open-source
by Bernd Kohler 27 Mar '25

27 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "The Firewall Project (Application Security with Enterprise features) is now open-source" VG Bernd [0] https://www.reddit.com/r/cybersecurity/comments/1jis711/the_firewall_projec… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

A Linux Binary Runtime Crypter - in BASH!
by Bernd Kohler 27 Mar '25

27 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "A Linux Binary Runtime Crypter - in BASH!" --> Erkennung ?!? - nur die ausführbare Datei wird verschlüsselt, nicht der Prozess ;) - file scanning mit YARA (bspw. via THOR liet [1]) - aufgrund der schlechten Kompression einer verschlüsselten Datei, kann einfach die Dateigröße mit gzip behandelten Version der Datei verglichen werden, Größe sollte nahezu gleich sein - ss/sar/lsof/netstat/.. sollten Infos dem laufenden Prozess liefern, z.B: lsof -p ${PID} ss -tulpen sar -n ${EDEV} - ls -l /proc/${PID} kann im Anschluß weitere Infos liefern file descriptors: ls -l /proc/${PID}/fd network: ls -l /proc/${PID}/stack - cp /proc/${PID}/exe /tmp/malicious.bin --> VirusTotal etc. - cd /proc/${PID}/fd && file -L ${NUMMBER_OF_DESCRIPTOR} - entropy-detection, bspw. mit [2] --> gut gegen Erkennung im Zustand der einfachen Speicherung, wenn aber einmal ausgeführt ... VG Bernd [0] https://github.com/hackerschoice/bincrypter [1] https://www.nextron-systems.com/thor-lite/ [2] https://github.com/sandflysecurity/sandfly-entropyscan -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

GitLab Alert: Patch Now! XSS & Privilege Escalation Risks
by Bernd Kohler 26 Mar '25

26 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "GitLab Alert: Patch Now! XSS & Privilege Escalation Risks" --> "... latest versions: 17.10.1, 17.9.3, or 17.8.6 ..." VG Bernd [0] https://securityonline.info/gitlab-alert-patch-now-xss-privilege-escalation… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

this MP3 file is malware
by Bernd Kohler 26 Mar '25

26 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "this MP3 file is malware" VG Bernd [0] https://www.youtube.com/watch?v=25NvCdFSkA4 -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

CVE-2025-26633: Water Gamayun Exploits Windows MMC in Active Zero-Day Campaign
by Bernd Kohler 25 Mar '25

25 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "CVE-2025-26633: Water Gamayun Exploits Windows MMC in Active Zero-Day Campaign" VG Bernd [0] https://securityonline.info/cve-2025-26633-water-gamayun-exploits-windows-m… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

VMware Patches Authentication Bypass Flaw in Windows Tools Suite
by Bernd Kohler 25 Mar '25

25 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "VMware Patches Authentication Bypass Flaw in Windows Tools Suite" VG Bernd [0] https://www.securityweek.com/vmware-patches-authentication-bypass-flaw-in-w… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0

Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH
by Bernd Kohler 25 Mar '25

25 Mar '25

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH" --> "... easy to SSH with single sign-on technologies like OpenID Connect, thereby removing the need to manually manage and configure SSH keys. It does this without adding a trusted party other than your identity provider (IdP) ..." VG Bernd [0] https://blog.cloudflare.com/open-sourcing-openpubkey-ssh-opkssh-integrating… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 E-Mail: kohler(a)itc.rwth-aachen.de Web: https://www.itc.rwth-aachen.de Social-Media-Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.instagram.com/itcenterrwthaachen/ https://www.linkedin.com/company/itcenterrwth https://www.youtube.com/c/ITCenterRWTHAachen

1 0