- rwth-security - lists.rwth-aachen.de

LogonTracer - nvestigate malicious logon by visualizing and analyzing
by Bernd Kohler 24 Aug '22

24 Aug '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Microsoft Exchange servers worldwide backdoored with new malware" VG Bernd [0] https://github.com/JPCERTCC/LogonTracer -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

JSSLoader: the shellcode edition
by Bernd Kohler 24 Aug '22

24 Aug '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "JSSLoader: the shellcode edition" VG Bernd [0] https://www.malwarebytes.com/blog/threat-intelligence/2022/08/jssloader-the… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Software Updates Strategies: a Quantitative Evaluation against
by Bernd Kohler 24 Aug '22

24 Aug '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Software Updates Strategies: a Quantitative Evaluation against Advanced Persistent Threats" VG Bernd [0] https://arxiv.org/pdf/2205.07759.pdf -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

CVE-2013-5211: NTP amplification attacks - NTP daemon (NTPd vor
by Bernd Kohler 23 Aug '22

23 Aug '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "UDP-based amplification — the dangerous DDoS attack vector" VG Bernd [0] https://blog.apnic.net/2022/08/19/udp-based-amplification-the-dangerous-ddo… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Vulnerability in Linux containers – investigation and mitigation
by Bernd Kohler 22 Aug '22

22 Aug '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Vulnerability in Linux containers – investigation and mitigation" VG Bernd [0] https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-i… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

35 Malware Android Apps With over 2 million Installation Found on the
by Bernd Kohler 19 Aug '22

19 Aug '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "35 Malware Android Apps With over 2 million Installation Found on the Google Play Store" VG Bernd [0] https://gbhackers.com/35-malware-android-apps/ -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de https://www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

DirtyCred - kernel exploitation concept
by Bernd Kohler 19 Aug '22

19 Aug '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] und [1] FYI "DirtyCred" "... is a kernel exploitation concept that swaps unprivileged kernel credentials with privileged ones to escalate privilege... " VG Bernd [0] https://github.com/markakd/dirtycred -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

iOS Privacy: Announcing InAppBrowser.com - see what JavaScript
by Bernd Kohler 19 Aug '22

19 Aug '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "iOS Privacy: Announcing InAppBrowser.com - see what JavaScript commands get injected through an in-app browser" VG Bernd [0] https://krausefx.com/blog/announcing-inappbrowsercom-see-what-javascript-co… -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

RFC 9288 - Recommendations on the Filtering of IPv6 Packets
by Bernd Kohler 19 Aug '22

19 Aug '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] und [1] FYI "RFC 9288" - Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers (siehe dazu auch RFC 9098 [1] -Operational Implications of IPv6 Packets with Extension Headers) VG Bernd [0] https://www.rfc-editor.org/rfc/rfc9288.txt [1] https://www.rfc-editor.org/rfc/rfc9098.txt -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0

Strelka Web UI (browser / API based file submission)
by Bernd Kohler 18 Aug '22

18 Aug '22

Hallo zusammen, sofern nicht selber schon gesehen/-lesen hier [0] FYI "Strelka Web UI is a browser / API based file submission" VG Bernd [0] https://github.com/target/strelka-ui -- Bernd Kohler IT Center Abteilung: Netze RWTH Aachen University Wendlingweg 10 52074 Aachen Tel: +49 241 80-29793 Fax: +49 241 80-22666 kohler(a)itc.rwth-aachen.de www.itc.rwth-aachen.de Social Media Kanäle des IT Centers: https://blog.rwth-aachen.de/itc/ https://www.facebook.com/itcenterrwth https://www.linkedin.com/company/itcenterrwth https://twitter.com/ITCenterRWTH https://www.youtube.com/channel/UCKKDJJukeRwO0LP-ac8x8rQ

1 0