Aggregator

A vulnerability was found in Siemens SINEC NMS up to 2.x. It has been classified as very critical. Affected is an unknown function. The manipulation leads to incorrect authorization. This vulnerability is traded as CVE-2024-41939. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Siemens SINEC NMS up to 2.x and classified as problematic. This issue affects some unknown processing of the component Setting Handler. The manipulation leads to incorrect authorization. The identification of this vulnerability is CVE-2024-41941. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Siemens SINEC Traffic Analyzer up to 1.x and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improper restriction of excessive authentication attempts. This vulnerability was named CVE-2024-41904. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in Siemens SINEC Traffic Analyzer up to 1.x. This affects an unknown part. The manipulation leads to improper privilege management. This vulnerability is uniquely identified as CVE-2024-41903. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Siemens Location Intelligence family up to 4.3. Affected by this issue is some unknown functionality. The manipulation leads to weak password requirements. This vulnerability is handled as CVE-2024-41683. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

 美国联邦调查局克利夫兰分部已通过摧毁勒索软件团伙 Radar(又名Dispossessor） 的各个服务器和域名，彻底瓦解该团伙的势力。 美国联邦调查局发布声明称，2024年8月12日，以网名“布莱恩”为首的犯罪团伙被捣毁。执法部门拆除了三台美国服务器、三台英国服务器、十八台德国服务器、八个美国犯罪域名和一个德国犯罪域名，这些均属于 Radar。 联邦调查局发布声明，确认以“布莱恩”为首的犯罪团伙已被彻底捣毁。该组织自2023年8月起开始活动，并迅速发展成为具有国际影响力的勒索软件集团，专门针对中小型企业和组织实施攻击。 Radar 针对多个行业进行攻击，包括制造业、开发、教育、医疗保健、金融服务及交通运输等。尽管该组织最初主要针对美国的目标，联邦调查局发现其已涉及13个不同国家的43家企业。 调查还发现，许多网站与布莱恩及其网络犯罪团队有关。与其他勒索软件变种类似，Radar 勒索软件采用双重勒索模式，即不仅加密受害者系统，还窃取数据以勒索赎金。 勒索软件是一种恶意软件，通过加密用户数据使其无法访问，受害者需支付赎金以恢复数据。Radar通过识别使用弱密码或未启用多因素身份验证的易受攻击系统来实施攻击。 “一旦犯罪分子获得系统访问权限，他们就会获得管理员权限并轻松访问文件，然后实际的勒索软件会用于加密。”FBI 表示。 如果受害者没有先支付赎金，Radar的成员就会主动通过电子邮件或电话联系受害者公司内部的人员，发送链接展示被盗文件的视频，迫使受害者付款。最终，犯罪团伙会将窃取的数据发布到泄密页面，并设置倒计时，如果未支付赎金，数据将被公开发布到公共论坛上。   消息来源：cybernews，译者：YY；   本文由 HackerNews.cc 翻译整理，封面来源于网络；   转载请注明“转自 HackerNews.cc”并附上原文

新闻速览 •超七成国产软件系统中存在超危级安全漏洞 •勒索攻击防护新模式？对勒索组织的基础设施进行反渗透 •两 […]

CERT-UA warned that Russia-linked actor is impersonating the Security Service of Ukraine (SSU) in a new phishing campaign to distribute malware. The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new phishing campaign targeting organizations in the country, including government entities. The campaign, tracked as UAC-0198, has been active since July. Threat actors sent out […]

A vulnerability classified as problematic was found in Siemens Location Intelligence family up to 4.3. Affected by this vulnerability is an unknown functionality. The manipulation leads to improper restriction of excessive authentication attempts. This vulnerability is known as CVE-2024-41682. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A Sinkclose vulnerability, which has been detected in AMD processors for decades, lets hackers obtain access to some of the most privileged areas of a computer. It allows malware to infiltrate a computer’s memory so deeply that, in many situations, it could be quicker to destroy the device than disinfect it. The vulnerability allows hackers […]

The post AMD Sinkclose Vulnerability Lets Attackers Most Privileged Portions Of a Computer appeared first on Cyber Security News.

A vulnerability classified as critical has been found in Siemens RUGGEDCOM RM1224 LTE(4G) EU, RUGGEDCOM RM1224 LTE(4G) NAM, SCALANCE M804PB, SCALANCE M812-1 ADSL-Router family, SCALANCE M816-1 ADSL-Router family, SCALANCE M826-2 SHDSL-Router, SCALANCE M874-2, SCALANCE M874-3, SCALANCE M874-3 3G-Router (CN), SCALANCE M876-3, SCALANCE M876-3 (ROK), SCALANCE M876-4, SCALANCE M876-4 (EU), SCALANCE M876-4 (NAM), SCALANCE MUM853-1 (A1), SCALANCE MUM853-1 (B1), SCALANCE MUM853-1 (EU), SCALANCE MUM856-1 (A1), SCALANCE MUM856-1 (B1), SCALANCE MUM856-1 (CN), SCALANCE MUM856-1 (EU), SCALANCE MUM856-1 (RoW), SCALANCE S615 EEC LAN-Router and SCALANCE S615 LAN-Router up to 8.0. Affected is an unknown function of the component User Session Handler. The manipulation leads to exposure of data element to wrong session. This vulnerability is traded as CVE-2024-41977. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

В чем выигрывает бизнес, который не боится нового?

ACD 2.0 aims to build the next generation of services in partnership with industry and academia.

最近，我在与多位白帽子接触后发现，漏洞挖掘可以更简单。

近日，FortiGuard 实验室的网络安全研究人员发现了一种复杂的网络钓鱼活动，该活动利用多阶段执行流程和各种规避技术来传播包括远程访问木马（RAT）PureHVNC在内的多种恶意软件。 攻击流程 该活动专门针对企业员工，以一封精心制作的电子邮件为诱饵，伪装成来自客户的服务查询，而邮件中包含一个恶意 HTML 附件。邮件使用紧急语气，诱使收件人打开恶意 HTML 附件，从而触发一系列导致多种恶意软件部署的事件。 具体来讲，钓鱼邮件附件中的 HTML 文件利用 “search-ms “功能查询远程共享的恶意 LNK 文件。该 LNK 文件在 Windows 资源管理器中伪装成一个无害的 PDF 图标，其中包含一条命令，该命令使用 conhost.exe 作为进程运行远程批处理文件，这是一种利用合法的 Windows 进程逃避检测的技术。 名为 new.bat 的批处理文件经过深度混淆，以躲避安全检测。它使用编码技巧和字符串混淆，使得脚本看起来像是使用 UTF-16 编码并包含中文字符，这进一步增加了分析难度。脚本在打开一个假 PDF 文件的同时，通过 PowerShell 悄悄下载包含 Python 环境和恶意 Python 程序的两个ZIP文件，并将它们解压缩隐藏在用户的配置文件目录中。 最后阶段是依次运行 Python 程序，每个程序都会加载并执行 shellcode，以绕过检测机制并部署主要有效载荷PureHVNC。 活动中的每个 Python 文件都使用 GitHub 上名为 “Kramer “的 Python 混淆器进行了精心混淆。Kramer 使用随机生成的密钥对源代码进行加密，为逆向工程增加了一层保护。shellcode 由名为 “donut “的工具生成，旨在解密并执行下一阶段的有效载荷，同时绕过 AMSI 和 WLDP 等 Windows 安全功能。 Python混淆器“Kramer” 攻击的第二阶段引入了 shellcode 加载器 “laZzzy”，它伪装成合法的 Microsoft 管理控制台 (MMC) 应用程序。该加载器使用先进的注入技术在 notepad.exe 这个看起来无害的进程中执行最终有效载荷，从而避免被检测到。 在这场活动中部署的恶意软件中，PureHVNC 因其复杂的功能脱颖而出。作为一个 .NET 应用程序，PureHVNC 使用 .NET Reactor 进行了大量混淆处理，使其难以分析。它的主要功能是使用 AES 加密解密有效载荷，然后使用 Gzip 解压缩，提取 DLL 有效载荷并加载到内存中。 一旦激活，PureHVNC 就会执行一系列旨在保持持久性和收集情报的操作。它会使用 PowerShell 设置注册表运行键值或阻止系统休眠，确保恶意软件保持激活状态。然后，它会与命令与控制（C2）服务器通信，上报系统信息，包括已安装杀毒产品的详细信息、系统规格和用户信息。 PureHVNC 专门针对加密货币钱包、密码管理器和双因素身份验证 (2FA) 应用程序等高价值资产。它扫描这些应用的关联路径，并检查注册表中的安装软件，重点窃取敏感数据。 攻击并不仅限于 PureHVNC，C2 服务器还可以部署扩展恶意软件功能的其他插件。这场活动中发现的两个值得注意的插件是： 插件 1：PluginRemoteDesktop 该插件可远程控制受害者的系统。它与 C2 服务器通信以执行命令，允许攻击者操纵受害者的桌面环境、捕获屏幕截图、控制鼠标等。 插件 2：PluginExecuting 该插件用于执行附加文件、更新恶意软件，甚至卸载恶意软件以掩盖踪迹。它支持多种命令，包括下载和执行新恶意软件的命令，利用进程挖空技术将恶意代码注入合法进程中。 FortiGuard 实验室的网络安全研究人员敦促组织对此类威胁保持警惕，确保员工了解网络钓鱼电子邮件的危险性，并采取强有力的安全措施来检测和缓解多阶段攻击。正如此次活动所表明的，即使是最看似无害的电子邮件，也可能成为破坏性漏洞的起点。   转自Freebuf，原文链接：https://www.freebuf.com/news/408455.html 封面来源于网络，如有侵权请联系删除

Law enforcement has been attacking cyber threat actors for quite some time now. The FBI has taken down several servers belonging to multiple threat actors to disrupt their malicious operations. However, the FBI announced the Shutdown of a Ransomware group named “Radar/Dispossessor”. This ransomware group was reportedly run by a person who goes by the […]

The post FBI Shuts Down Dispossessor Ransomware Operations, Domains Dismantled appeared first on Cyber Security News.

PALO ALTO, Calif. – August 13, 2024 – TuxCare, a global innovator in cybersecurity for Linux, today announced the launch of its TuxCare Oracle Linux 7 Extended Lifecycle Support (ELS) that enables enterprises to confidently maintain the security of their systems for up to four years following Oracle Linux 7’s end of life that is […]

The post TuxCare Offers Four Years of Precision-Engineered Security Updates for Oracle Linux 7 appeared first on TuxCare.

The post TuxCare Offers Four Years of Precision-Engineered Security Updates for Oracle Linux 7 appeared first on Security Boulevard.

近日，乌克兰计算机应急响应小组(CERT-UA)发现了大量携带恶意软件的电子邮件，冒充国家安全局(SSU)。

Борьба между конкурентами достигла национальной безопасности.