Sys-Admin & InfoSec Channel

Инцидент со спамом Canonical после установки Ubuntu в облаке Azure

opennet.ru/opennews/art.shtml?num=54591

www.opennet.ru

Инцидент со спамом Canonical после установки Ubuntu в облаке Azure

Один из клиентов облака Microsoft Azure возмутился наплевательским отношением к конфиденциальности и персональным данным в Microsoft и Canonical. Спустя три часа после установки Ubuntu в облаке Azure в социальной сети LinkedIn пришло сообщение от отдела продаж…

3.6K views01:29

Sys-Admin & InfoSec Channel

https://blog.checkpoint.com/2017/03/15/check-point-discloses-vulnerability-whatsapp-telegram/

Check Point Software

Check Point Discloses Vulnerability that Potentially Allows Hackers to Take over Hundreds of Millions of WhatsApp & Telegram Accounts…

One of the most concerning revelations arising from the recent WikiLeaks publication is the possibility that government organizations can compromise

3.5K views06:03

Sys-Admin & InfoSec Channel

Checkov

Prevent cloud misconfigurations during build-time for Terraform, Cloudformation, Kubernetes, Serverless framework and other infrastructure-as-code-languages

https://github.com/bridgecrewio/checkov

GitHub

bridgecrewio/checkov

Prevent cloud misconfigurations during build-time for Terraform, Cloudformation, Kubernetes, Serverless framework and other infrastructure-as-code-languages with Checkov by Bridgecrew. - bridgecrew...

3.2K views02:32

Sys-Admin & InfoSec Channel

Malvertiser “ScamClub” Bypasses Iframe Sandboxing With postMessage() Shenanigans [CVE-2021–1801]

В статье рассказывается о механизме обхода изолированной среды iframe :

https://blog.confiant.com/malvertiser-scamclub-bypasses-iframe-sandboxing-with-postmessage-shenanigans-cve-2021-1801-1c998378bfba

Medium

Malvertiser “ScamClub” Bypasses Iframe Sandboxing With postMessage() Shenanigans [CVE-2021–1801]

This blog post is about the mechanics of a long tail iframe sandbox bypass found in a payload belonging to the persistent malvertising…

3.2K viewsedited 02:35

Sys-Admin & InfoSec Channel

SHAREit Flaw Could Lead to Remote Code Execution

Удалённое выполнение кода в одном из популярных приложений для шаринга файлов - SHAREit

PoC

https://www.trendmicro.com/en_us/research/21/b/shareit-flaw-could-lead-to-remote-code-execution.html

Trend Micro

SHAREit Flaw Could Lead to Remote Code Execution

We discovered vulnerabilities in the SHAREit application. These vulnerabilities can be abused to leak a user’s sensitive data, execute arbitrary code, and possibly lead to remote code execution. The app has over 1 billion downloads.

3.3K viewsedited 02:38

Sys-Admin & InfoSec Channel

OpenSSL Security Advisory [16 February 2021]

Доступны новые патчи OpenSSL

https://www.openssl.org/news/secadv/20210216.txt

Информация по CVE

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23841

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23839

cve.mitre.org

CVE -
CVE-2021-23841

CVE® is a list of records — each containing an identification number, a description, and at least one public reference — for publicly known cybersecurity vulnerabilities. The mission of the CVE Program is to identify, define, and catalog publicly disclosed…

3.3K viewsedited 09:43

Sys-Admin & InfoSec Channel

Chrome релиз закрывает несколько опасных уязвимостей

https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_16.html

Chrome Releases

Stable Channel Update for Desktop

The Stable channel has been updated to 88.0.4324.182 for Windows, Mac and Linux which will roll out over the coming days/weeks. A full lis...

3.4K views12:47

Sys-Admin & InfoSec Channel

Как сделать easy-fix в Linux kernel

Рассказ от первого лица:

https://forum.sys-adm.in/t/kak-sdelat-easy-fix-v-linux-kernel/7541

Большое спасибо автору за шаринг уникальных знаний - Sabyrzhan @novitoll Tasbolatov. Security Researcher in Spectre Security Group, spectre.kz

Sys-Admin Forum

Как сделать easy-fix в Linux kernel

Sabyrzhan “novitoll” Tasbolatov Security Researcher in Spectre Security Group, https://spectre.kz Как я фикшу easy-fix в Linux: Сизбот находит багу. В данном случае WARNING когда iov_iter_count() возвращает 0 и в iov_iter_revert(from, size-ret) передается…

3.9K views15:02

Sys-Admin & InfoSec Channel

From Docker Compose to Kubernetes with Podman

Use Podman 3.0 to convert Docker Compose YAML to a format Podman recognizes.

https://www.redhat.com/sysadmin/compose-kubernetes-podman

Enable Sysadmin

From Docker Compose to Kubernetes with Podman

Use Podman 3.0 to convert Docker Compose YAML to a format Podman recognizes.

3.4K views01:42

Sys-Admin & InfoSec Channel

New BIND releases are available: 9.11.28, 9.16.12, and 9.17.10

In addition to bug fixes and feature improvements, these particular maintenance releases also contain the fix for a vulnerability, CVE-2020-8625

https://www.mail-archive.com/[email protected]/msg00595.html

CVE Info

https://kb.isc.org/docs/cve-2020-8625

DoH в BIND 9

https://www.isc.org/blogs/bind-implements-doh-2021/

kb.isc.org

CVE-2020-8625: A vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack - Security…

3.5K viewsedited 07:34

Sys-Admin & InfoSec Channel

ApoMacroSploit: апокалиптическая гонка FUD

FUD - full none-detection. Некоторое время назад Check Point Research обнаружила новый компоновщик вредоносных программ для Office под названием APOMacroSploit, который был замешан в нескольких фишинговых компаниях.

В ходе расследования CP обнаружили, что этот инструмент включает функции, позволяющие избежать обнаружения Защитником Windows, и ежедневно обновляется (чтобы обеспечить низкие показатели обнаружения). В этой статье авторы раскрывают злонамеренные намерения злоумышленников и раскрывают настоящую личность одного злоумышленника...

Здесь целый набор PoC + OSINT

https://research.checkpoint.com/2021/apomacrosploit-apocalyptical-fud-race/

Check Point Research

ApoMacroSploit : Apocalyptical FUD race - Check Point Research

1.1 Introduction At the end of November, Check Point Research detected a new Office malware builder called APOMacroSploit, which was implicated in multiple malicious emails to more than 80 customers worldwide. In our investigation, we found that this…

3.4K views12:30

Sys-Admin & InfoSec Channel

Apple-Platform-Security-Guides

https://github.com/0xmachos/Apple-Platform-Security-Guides

iOS-Security-Guides

https://github.com/0xmachos/iOS-Security-Guides

Additional links:
https://support.apple.com/guide/security/welcome/web
https://developer.apple.com/programs/security-research-device/
https://www.apple.com/mac/m1/

Arm'd & Dangerous
malicious code, now native on apple silicon

https://objective-see.com/blog/blog_0x62.html

GitHub

0xmachos/Apple-Platform-Security-Guides

Every Apple Platform Security Guide. Contribute to 0xmachos/Apple-Platform-Security-Guides development by creating an account on GitHub.

3.3K viewsedited 06:03

Sys-Admin & InfoSec Channel

Free Mac Security Tools

https://objective-see.com/products.html

3.2K views06:09

Sys-Admin & InfoSec Channel

Remotely Exploitable 0day in Internet Explorer Gets a Free Micropatch

https://blog.0patch.com/2021/02/remotely-exploitable-0day-in-internet.html

3.2K views09:45

Sys-Admin & InfoSec Channel

Docker Desktop for Apple M1

https://docs.docker.com/docker-for-mac/apple-m1/

Docker Documentation

Apple Silicon Tech Preview

3.5K views14:49

Sys-Admin & InfoSec Channel

Masslogger campaigns exfiltrates user credentials

PoC

https://blog.talosintelligence.com/2021/02/masslogger-cred-exfil.html?m=1

Talosintelligence

Masslogger campaigns exfiltrates user credentials

A blog from the world class Intelligence Group, Talos, Cisco's Intelligence Group

3.7K views14:51

Sys-Admin & InfoSec Channel

The next Windows 10 Long Term Servicing Channel (LTSC) release

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-next-windows-10-long-term-servicing-channel-ltsc-release/ba-p/2147232

TECHCOMMUNITY.MICROSOFT.COM

The next Windows 10 Long Term Servicing Channel (LTSC) release

Windows 10 introduced Windows as a service, a method of continually providing new features and capabilities through regular feature updates. Semi-Annual Channel versions of Windows, such as version 1909, version 2004, and version 20H2, are released twice…

4.1K views14:58

Sys-Admin & InfoSec Channel

Обход методов зашиты при помощи сервисов Google с целью хищения данных платежных карт

Несмотря на прошлогоднюю дату, метод все ещё имеет право на жизнь

PoC

https://sansec.io/research/skimming-google-defeats-csp

Sansec

Digital skimmer runs entirely on Google, defeats CSP

3.3K viewsedited 05:12

Sys-Admin & InfoSec Channel

New Phishing Attack Identified: Malformed URL Prefixes

Новая фишинговая атака.

Атака не предполагает изменения букв URL-адреса в фишинговых сообщениях, фактически в url адресах ничего не меняется, что позволяет максимально эффективно обходить методы защиты, вместо этого изменяется префикс URL

Все о новом виде фишинговой атаки:

https://www.greathorn.com/blog-new-phishing-attack-identified-malformed-url-prefixes/

GreatHorn

New Phishing Attack Identified: Malformed URL Prefixes - GreatHorn

The GreatHorn Threat Intelligence Team has identified a new email attack trend, where cybercriminals are able to bypass traditional URL defenses to attack end users. Read how phishing attackers are using http:/\ in their URL prefix.

3.5K viewsedited 07:33

Sys-Admin & InfoSec Channel

Clipping Silver Sparrow’s wings: Outing macOS malware before it takes flight

https://redcanary.com/blog/clipping-silver-sparrows-wings/

Red Canary

Silver Sparrow macOS malware with M1 compatibility

Silver Sparrow includes a binary compiled to run on Apple’s new M1 chips but lacks one very important feature: a payload

3.3K viewsedited 13:20

Sys-Admin & InfoSec Channel

HTTP/2 Test

https://tools.keycdn.com/http2-test