SecLists.Org Security Mailing List Archive

Nmap Development — Unmoderated technical development forum for debating ideas, patches, and suggestions regarding proposed changes to Nmap and related projects. Subscribe to nmap-dev here.

• Previous Quarter
• Archived Posts
• RSS Feed
• About List
• nmap-devLatest Posts

Wierd issue: nmap/nping misses (some) icmp replies John Robson via dev (Dec 14)
Hi all,

I'm running into a weird issue that I can't quite get my head around.
As part of monitoring devices we use nmap to issue icmp echo requests
to a list of target devices, and obviously the lack of a reply is
worthy of generating an event/alert/alarm.

I am currently seeing sporadic events from a variety of target
devices, which clear on the next polling cycle (i.e. we miss one
response but get the following one sixty seconds...

Re: dev Digest, Vol 220, Issue 1 Anthony Dibella (Nov 28)
Hi thank you for looking into this yes I had no idea what these files are I
don't know what is going on all I know is I have a Target on my back
because of my wife she's broken a lot of laws she doesn't want to go to
jail she's brought on drugs home from her job she does anesthesia she's
hitting me she's not going to jail you name it we've had a horrible
relationship I file for divorce February last year 13th 2...

Nmap error message Snake YUNA (Nov 28)
Error occurred when opening “Profile → Edit Selected Profile”、“New Profile or Command”

Version： Windows 10 Professional
Version number： 22H2
====================================================================

Version: 7.94
Traceback (most recent call last):
File "D:\Program Files (x86)\Nmap\zenmap\lib\python3.10\site-packages\zenmapGUI\ScriptInterface.py", line 261, in
script_list_timer_callback
callback(True,...

unexpected error Алёна Трунова (Nov 28)
Hello! When I'm trying to compare two files, after adding the second file
the error occurs:

Version: 7.94
Traceback (most recent call last):
File "C:\Program Files
(x86)\Nmap\zenmap\lib\python3.10\site-packages\zenmapGUI\DiffCompare.py",
line 379, in check_ndiff_process
stderr = self.ndiff_process.stderr.read()
AttributeError: 'NoneType' object has no attribute 'read'

Pr #2334 Jonathan P (Nov 27)
https://github.com/nmap/nmap/pull/2334
This script detects the existence of a  vulnerable sage X3 service. Related to CVE-2020-7387 and CVE-2020-7388.

Re: Pull request - Service probe for MSMQ (Microsoft Message Queuing) Gonçalo via dev (Nov 27)
Hello Nmap Team,

Have you had the opportunity to check this pull request? Do you need any help with it?

Regards,
Gonçalo Ribeiro 

18/10/2023, 08:22 por goncalor () tutanota com:

Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at https://seclists.org/nmap-dev/

Crash Report guanbo via dev (Oct 29)
When I click on Profile Editor, Crash Report pop up.

Version: 7.94

Traceback (most recent call last):

  File "D:\Software\Nmap\zenmap\lib\python3.10\site-packages\zenmapGUI\ScriptInterface.py", line 261, in
script_list_timer_callback

    callback(True, process)

  File "D:\Software\Nmap\zenmap\lib\python3.10\site-packages\zenmapGUI\ScriptInterface.py", line 270, in...

Crash report vgp (Oct 29)
Hello,
I tried to compare scans, I wasn't done when I got the crash message as
noted below. As notified, I am forwarding the message.
Have a nice day !
Version: 7.94
Traceback (most recent call last):
File "C:\Program Files
(x86)\Nmap\zenmap\lib\python3.10\site-packages\zenmapGUI\DiffCompare.py",
line 379, in check_ndiff_process
stderr = self.ndiff_process.stderr.read()
AttributeError: 'NoneType' object has no...

Zenmap crash ?????? via dev (Oct 29)
When open profile editor , crash happened.

Version: 7.94
Traceback (most recent call last):
  File "C:\Program Files (x86)\Nmap\zenmap\lib\python3.10\site-packages\zenmapGUI\ScriptInterface.py", line 261,
in script_list_timer_callback
    callback(True, process)
  File "C:\Program Files (x86)\Nmap\zenmap\lib\python3.10\site-packages\zenmapGUI\ScriptInterface.py", line 270,
in...

Re: nmap to use with sudo (but prevent privilege escalation vectors) Robin Wood (Oct 29)
Hi
What about if you put nmap in a docker container and after each scan
threw the container away and built a new one for the next scan.

That way you could lock down as far as you can, but if the user
manages to read the shadow file or overwrite something important, they
would only destroy their instance and not affect the rest of the
system.

I will add though, my docker skills are very limited, so this is just
a vague idea that may be a load of...

Pullrequest #2720 Florian Schmitt via dev (Oct 29)
Hello nmap developers,

I added a pullrequest to the git repository #2720 concerning the version
name of zenmap.
see: https://github.com/nmap/nmap/pull/2720
The version name 7.94SVN in the current repository leads to an invalid
version error in dist-packages of debian 12, so I changed it to 7.94+svn
which dist-packages accepts. This is the first pull request to an open
source project so feel free to correct me or give me information how to...

New Addition Assistance In Nmap Script: http-extensive-domxss Haroon Ahmad Awan (Oct 29)
Dear Nmap Dev Team,

I would like to introduce you to the http-extensive-domxss script, which
offers advanced features for detecting DOM-based Cross-Site Scripting (XSS)
vulnerabilities. Below are the key features and improvements this script
can detect:

- Detection of DOM-based XSS vulnerabilities in HTML forms.
- Detection of DOM-based XSS in JavaScript code.
- Detection of DOM-based XSS in Java applets.
- Detection of DOM-based XSS in anchor...

I have a problem about comparing two different test results Skylar Note (Oct 29)
Version: 7.94

Traceback (most recent call last): File "C:\Program Files
(x86)\Nmap\zenmap\lib\python3.10\site- packages\zenmapGUNDiffCompare.py",
line 379, in check_ndiff_process stderr= self.ndiff_process.stderr.read()

AttributeError: 'None Type' object has no attribute 'read'

some zenmap bugs jack aa (Oct 29)
When I startup the zenmap gui,it noticed:
Version: 7.94
Traceback (most recent call last):
File "<string>", line 1, in <module>
File "D:\Nmap\zenmap\lib\python3.10\site-packages\zenmapGUI\App.py", line 281, in run
window = new_window()
File "D:\Nmap\zenmap\lib\python3.10\site-packages\zenmapGUI\App.py", line 124, in new_window
from zenmapGUI.MainWindow import ScanWindow
File...

Crash report - mbcs issue , on windows 10 and 2008R2 (zh-cn) 孔南 (Oct 29)
Version: 7.94
Traceback (most recent call last):
File "C:\Program Files
(x86)\Nmap\zenmap\lib\python3.10\site-packages\zenmapGUI\ScriptInterface.py",
line 261, in script_list_timer_callback
callback(True, process)
File "C:\Program Files
(x86)\Nmap\zenmap\lib\python3.10\site-packages\zenmapGUI\ScriptInterface.py",
line 270, in initial_script_list_cb
if status and self.handle_initial_script_list_output(process):...

Nmap Announce — Moderated list for the most important new releases and announcements regarding the Nmap Security Scanner and related projects. We recommend that all Nmap users subscribe to stay informed.

• Previous Year
• Archived Posts
• RSS Feed
• About List
• nmap-announceLatest Posts

Npcap Celebrates its 10th Anniversary In Space! Gordon Fyodor Lyon (Oct 05)
Dear Nmap community,

Last month we celebrated Nmap's 26th birthday and today I'm happy to share
another big milestone: Our Npcap driver for capturing and sending raw
packets on Windows turned 10 this year! From humble beginnings as a
security and modernization patch for the discontinued WinPcap project,
Npcap has become an indispensable component for both Nmap and Wireshark.
And it's used by hundreds of other software products and...

Nmap 26th Birthday Announcement: Version 7.94 Gordon Fyodor Lyon (Sep 01)
Dear Nmap community,

Today is Nmap’s 26th birthday, which reminded me that I hadn’t yet
announced our Nmap 7.94 release from May. And it’s a great one! The biggest
improvement was the Zenmap and Ndiff upgrades from the obsolete Python 2
language to Python 3 on all platforms. Big thanks to Daniel Miller, Jakub
Kulík, Brian Quigley, Sam James, Eli Schwartz, Romain Leonard, Varunram
Ganesh, Pavel Zhukov, Carey Balboa, and Hasan Aliyev for...

Nmap 7.93 - 25th Anniversary Release! Gordon Fyodor Lyon (Sep 01)
Dear Nmap community,

Twenty five years ago today, I released the first version of Nmap in a
Phrack article named The Art of Port Scanning (https://nmap.org/p51-11.html).
I never thought I'd still be at it a quarter of a century later, but that's
because I also didn't anticipate such a wonderful community of users and
contributors spanning those decades. You've helped Nmap blossom from a
fairly simple port scanner to a...

Npcap Versions 1.70 and 1.71 improve Windows packet capturing performance, stability, security, and compatibility Gordon Fyodor Lyon (Sep 01)
Hello folks. While the Nmap Project has been quiet lately (this is my
first post of the year), I'm happy to share some great progress on both
Nmap and Npcap development. Starting with our Npcap Windows packet
capturing/sending library, I'm happy to report that we quietly released
Version 1.70 in June and then 1.71 on August 19. They include many key
improvements:

* Performance: A major overhaul of Packet.dll sped up routines that...

Full Disclosure — A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.

• Current Month
• Archived Posts
• RSS Feed
• About List
• fulldisclosureLatest Posts

APPLE-SA-02-02-2024-1 visionOS 1.0.2 Apple Product Security via Fulldisclosure (Feb 04)
APPLE-SA-02-02-2024-1 visionOS 1.0.2

visionOS 1.0.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT214070.

Apple maintains a Security Releases page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

WebKit
Available for: Apple Vision Pro
Impact: Processing maliciously crafted web content may lead to
arbitrary code...

Out-of-bounds read & write in the glibc's qsort() Qualys Security Advisory via Fulldisclosure (Feb 04)
Qualys Security Advisory

For the algorithm lovers: Nontransitive comparison functions lead to
out-of-bounds read & write in glibc's qsort()

========================================================================
Contents
========================================================================

Summary
Background
Experiments
Analysis
Patch
Discussion
Acknowledgments
Timeline

CUT MY LIST IN TWO PIECES
THAT'S HOW YOU START...

CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog() Qualys Security Advisory via Fulldisclosure (Feb 04)
Qualys Security Advisory

CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()

========================================================================
Contents
========================================================================

Summary
Analysis
Proof of concept
Exploitation
Acknowledgments
Timeline

========================================================================
Summary...

Research about usage & possible issues of the NVD Andreas Hammer (Feb 04)
Hello there!

The University of Erlangen-Nuremberg (Germany) is conducting a research
study to investigate the usage and possible issues of the NVD (National
Vulnerability Database). If you are using the NVD regularly, we would
greatly appreciate your participation which contributes to the
improvement of vulnerability management. You can read more about the
survey here:

https://www.cs1.tf.fau.de/2024/01/29/survey-on-usage-of-nvd/

The...

TROJAN.WIN32 BANKSHOT / Remote Stack Buffer Overflow (SEH) malvuln (Feb 04)
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024
Original source:
https://malvuln.com/advisory/f2fd6a7b400782bb43499e722fb62cf4.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan.Win32 BankShot
Vulnerability: Remote Stack Buffer Overflow (SEH)
Description: The malware listens on TCP port 1978 and creates a local
Windows service running with SYSTEM integrity. Third-party adversaries who
can reach the...

[KIS-2024-01] XenForo <= 2.2.13 (ArchiveImport.php) Zip Slip Vulnerability Egidio Romano (Feb 04)
------------------------------------------------------------
XenForo <= 2.2.13 (ArchiveImport.php) Zip Slip Vulnerability
------------------------------------------------------------

[-] Software Link:

https://xenforo.com

[-] Affected Versions:

Version 2.2.13 and prior versions.

[-] Vulnerability Description:

The vulnerability is located in the
/src/XF/Service/Style/ArchiveImport.php script. Specifically, into the...

NULL pointer dereference in the function handle_viminfo_register() of vim Christian Brabandt (Feb 04)
Meng Ruijie wrote:

Meng,

This particular problem was fixed in Vim v9.0.1740
https://github.com/vim/vim/commit/0a0764684591c7c6a5d722b628f11dc96208e853

I have no idea, why this issue is worth a CVE, because if an attacker
can modify your .viminfo file to make Vim crash, he already has the
possibilities to do much more harm directly. So I don't think this is
particular useful CVE. I'd also like to dispute this.

Thanks,
Christian

Re: Buffer Overflow in graphviz via via a crafted config6a file Matthew Fernandez (Jan 27)
More specifically, this issue is an out-of-bounds read.

AFAICT the issue was actually introduced in Graphviz 2.36. It was fixed
in commit a95f977f5d809915ec4b14836d2b5b7f5e74881e (essentially
reverting cf95714837f06f684929b54659523c2c9b1fc19f that introduced the
issue), but there has been no release yet since then. The next release
will be 10.0.0. So affected versions would be [2.36, 10.0.0).

To exploit this issue, you need to modify a...

CVEs based on commit messages Mark Esler (Jan 27)
Dear Meng Rujie,

In regards to your recent FD posts, are you requesting CVEs based on the
presence of strings in commit messages such as "null pointer dereference"?

Are you reaching out to each upstream project before assigning a CVE? Do
you believe that every null pointer bug is a vulnerability? What impact
are you hoping to achieve?

Please reconsider how you are requesting CVEs.

CVE assignment based on commit message allows...

Re: null pointer deference in nano via read_the_list() Mark Esler (Jan 27)
Hi Meng,

In your recent mass posts to FD, are you reporting vulnerabilities or
bug reports which have words like "segfault" in the title? What benefit
do you see this having? Have you spoken to each upstream project before
requesting a CVE be assigned?

Thank you,
Mark Esler

Re: NULL pointer dereference in freedesktop Mesa via check_xshm() Dan Cross (Jan 27)
I find it very difficult to believe that every NULL pointer error in
existence is a security vulnerability.

- Dan C.

Re: Null pointer dereference in Xedit Alan Coopersmith (Jan 27)
I will be asking that this CVE be withdrawn on behalf of the X.Org security team.

While it is a low-priority bug, we did not see any security exposure
when this bug was first brought to our attention because there is no
way for an attacker to change the contents of the lisp.lsp file or to
cause a *.lsp file to be loaded for another user.

The bug report states "replace /usr/local/lib/X11/xedit/lisp/lisp.lsp with
the attached version,"...

Buffer overflow in Sane Meng Ruijie (Jan 26)
[Vulnerability description]
A buffer overflow existed in Sane v.1.2.1 via a crafted config file to the init_options() function.

[Vulnerability Type]
Buffer Overflow

[Vendor of Product]
sane

[Affected Product Code Base]
sane - 1.2.1

[Reference]
https://gitlab.com/sane-project/backends/-/issues/709

[CVE Reference]
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2023-46052 to this
vulnerability.

null pointer deference in tex-live Meng Ruijie (Jan 26)
[Vulnerability description]
A null pointer deference existed in tex-live v.944e257 via a crafted file to the texk/web2c/pdftexdir/tounicode.c
function.

[VulnerabilityType Other]
null pointer deference

[Vendor of Product]
tex-live

[Affected Product Code Base]
tex-live - 944e257

[Reference]
https://tug.org/pipermail/tex-live/2023-August/049406.html

[CVE Reference]
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned...

null pointer deference in MiniZinc via a crafted Preferences.json file Meng Ruijie (Jan 26)
[Vulnerability description]
A null pointer deference existed in MiniZinc v.2.7.6 via a crafted Preferences.json file.

[VulnerabilityType Other]
null pointer deference

[Vendor of Product]
MiniZinc

[Affected Product Code Base]
MiniZinc - 2.7.6

[Reference]
https://github.com/MiniZinc/libminizinc/issues/729

[CVE Reference]
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2023-46050 to this...

Bugtraq — The premier general security mailing list. Vulnerabilities are often announced here first, so check frequently!

• Archived Posts
• RSS Feed
• About List

Security Basics — A high-volume list which permits people to ask "stupid questions" without being derided as "n00bs". I recommend this list to network security newbies, but be sure to read Bugtraq and other lists as well.

• Archived Posts
• RSS Feed
• About List

Penetration Testing — While this list is intended for "professionals", participants frequenly disclose techniques and strategies that would be useful to anyone with a practical interest in security and network auditing.

• Archived Posts
• RSS Feed
• About List

Info Security News — Carries news items (generally from mainstream sources) that relate to security.

• Archived Posts
• RSS Feed
• About List

Firewall Wizards — Tips and tricks for firewall administrators

• Archived Posts
• RSS Feed
• About List

IDS Focus — Technical discussion about Intrusion Detection Systems. You can also read the archives of a previous IDS list

• Archived Posts
• RSS Feed
• About List

Web App Security — Provides insights on the unique challenges which make web applications notoriously hard to secure, as well as attack methods including SQL injection, cross-site scripting (XSS), cross-site request forgery, and more.

• Archived Posts
• RSS Feed
• About List

Daily Dave — This technical discussion list covers vulnerability research, exploit development, and security events/gossip. It was started by ImmunitySec founder Dave Aitel and many security luminaries participate. Many posts simply advertise Immunity products, but you can't really fault Dave for being self-promotional on a list named DailyDave.

• Current Quarter
• Archived Posts
• RSS Feed
• About List
• dailydaveLatest Posts

Re: 0xC15A: Secure By Design and Secure by Default Christian Heinrich via Dailydave (Jan 26)
Telsh,

The CISA responded to their draft deliverable on 29 November 2023
(Page 15) and have agreed to implement its recommendations by 31
October 2024, 30 May 2025 (Page 12) and 30 September 2025 (Page 13)

The page numbers above of
https://www.oig.dhs.gov/sites/default/files/assets/2024-01/OIG-24-09-Jan24.pdf

Secure By Default Part 2 Dave Aitel via Dailydave (Jan 19)
So I wrote a little draft essay on Secure By Default and opened it for
comment. I think one thing that we maybe forget in our community is that
some of the more fundamental basises of what we do never make it up to
policy-world. Langsec being the primary example. But also there's a huge
body of work in TAOSSA, Shellcoders, every offensive conference talk, etc.
that never gets put into context anywhere but in our clique.

Obviously feel free...

Re: 0xC15A: Secure By Design and Secure by Default telsh via Dailydave (Jan 19)
Hey everybody,

Please note the last sentence on page 3:
"The scope of our audit was efforts during fiscal years 2019 through 2022"

Not being a fanboy of CISA, I see that quite a lot of (positive) things
have happened in the last 2 years there.

And publishing a report for that timeframe in January 2024 puts the OIG
in a questionable light regarding agility and speed.

Just my 0.02 €...
telsh

Re: 0xC15A: Secure By Design and Secure by Default Christian Heinrich via Dailydave (Jan 19)
Dave,

https://www.oig.dhs.gov/sites/default/files/assets/2024-01/OIG-24-09-Jan24.pdf
reached a different conclusion.

0xC15A: Secure By Design and Secure by Default Dave Aitel via Dailydave (Jan 12)
So I have a ton of thoughts on the CISA Secure by Design and Secure by
Default push that is ongoing, as I am sure many of you do. And the first
thought is: This is not a bad way to go about business as a government
agency in general. I think it's easy to ignore how fast the USG has changed
its business practices, showing an agility that few large organizations can
match. In particular using Secure By Design as a case example.

1. Massive...

Re: Leverage Jason Syversen via Dailydave (Dec 27)
I’m in! I’ve spent a bunch of time on this topic, from the mechanical (donor advised funds, supporting organizations,
tax law, etc.), theoretical (“effective altruism”, 80,000 hours, books on giving strategy, etc.) and practical (served
at probably a dozen charities now in various roles, donor strategies, measuring impact, etc.) AMA!

It’s fun as a hacker to use that mindset to effect a different kind of system change. And much more...

Leverage Dave Aitel via Dailydave (Dec 27)
So we know a lot of people who've gone into Big Corpo or sold a company or
just worked hard and gotten lucky and happen to be richer than the average
bear. And while a lot of those people put their money into nice things,
nothing wrong with that, a lot of them also try to use that money to change
the world, and then they find out it's harder to change the world with
money than it is with an exploit. And I know a lot of people who say...

A holiday reflection on: Training. Dave Aitel via Dailydave (Dec 19)
I think one thing this community does really well, better than almost any
other community I've found, is training. It's amazing, in a way,
because this is a community of professional secret holders. And yet
everywhere you look, a hacker is putting their heart and soul into
iterating on lab exercises for their class in whatever sub-field they are
an expert in.

And giving training is hard. It's hard in the way consulting is hard,...

t2'24: Call For Papers 2024 (Helsinki, Finland) Tomi Tuominen via Dailydave (Dec 19)
Call for Papers 2024

t2 infosec has been pushing the boundaries of security research for two decades and it don't stop. We're back April
18-19, 2024 - Helsinki, Finland.

CFP and registration are both open.

This is an event for newcomers, established merchants of dual use computer code, beginners of vulndev, cyber vagabonds,
retired or redacted, and hackers of all sorts.

If you have new original security research targeting old,...

what is reasoning? Dave Aitel via Dailydave (Oct 05)
There's not a huge paper I can find on the history of all the big bug
classes. I mean, there's probably not even a real definition of "bug class"
that would survive a drunken conversation between two CTF teams. But like,
screw it, "format strings" are a bug class. "Deserialization bugs" are a
bug class. "strcpy and friends" is a bug class. You know what I mean if
you're the type of person who...

PaulDotCom — General discussion of security news, research, vulnerabilities, and the PaulDotCom Security Weekly podcast.

• Archived Posts
• RSS Feed
• About List

Honeypots — Discussions about tracking attackers by setting up decoy honeypots or entire honeynet networks.

• Archived Posts
• RSS Feed
• About List

Microsoft Sec Notification — Beware that MS often uses these security bulletins as marketing propaganda to downplay serious vulnerabilities in their products—note how most have a prominent and often-misleading "mitigating factors" section.

• Archived Posts
• RSS Feed
• About List

Funsec — While most security lists ban off-topic discussion, Funsec is a haven for free community discussion and enjoyment of the lighter, more humorous side of the security community

• Archived Posts
• RSS Feed
• About List

CERT Advisories — The Computer Emergency Response Team has been responding to security incidents and sharing vulnerability information since the Morris Worm hit in 1986. This archive combines their technical security alerts, tips, and current activity lists.

• Previous Year
• Archived Posts
• RSS Feed
• About List
• certLatest Posts

Apple Releases Security Updates for Multiple Products CISA (Mar 28)
Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated and is now available.

Apple Releases Security Updates for Multiple Products [
https://www.cisa.gov/news-events/alerts/2023/03/28/apple-releases-security-updates-multiple-products ] 03/28/2023 01:00
PM EDT

Apple...

CISA Releases Six Industrial Control Systems Advisories CISA (Mar 23)
Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA Releases Six Industrial Control Systems Advisories [
https://www.cisa.gov/news-events/alerts/2023/03/23/cisa-releases-six-industrial-control-systems-advisories ] 03/23/2023
08:00 AM EDT...

CISA Releases Eight Industrial Control Systems Advisories CISA (Mar 21)
Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA Releases Eight Industrial Control Systems Advisories [
https://www.cisa.gov/news-events/alerts/2023/03/21/cisa-releases-eight-industrial-control-systems-advisories ]
03/21/2023 08:00 AM...

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management CISA (Mar 21)
Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management [...

Open Source Security — Discussion of security flaws, concepts, and practices in the Open Source community

• Current Quarter
• Archived Posts
• RSS Feed
• About List
• oss-secLatest Posts

The GNU C Library has been authorized by the CVE Program as a CVE Numbering Authority (CNA) Carlos O'Donell (Feb 07)
The GNU C Library (glibc) is a key part of the trusted foundation
in a secure and high-quality software supply chain and is used
by the GNU Toolchain, the GNU system, and many of the GNU/Linux
systems today.

In an ongoing effort to improve security, the project has been
authorized by the CVE Program as a CVE Numbering Authority (CNA):
https://www.cve.org/Media/News/item/news/2024/02/06/GNU-C-Library-Added-as-CNA

As a CNA the glibc security team...

CVE-2023-39196: Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints István Fajth (Feb 07)
Severity: moderate

Affected versions:

- Apache Ozone 1.2.0 through 1.3.0

Description:

Improper Authentication vulnerability in Apache Ozone.

The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without
proper authentication.
The attacker is not allowed to do any modification within the Ozone Storage Container Manager service using this
vulnerability.
The accessible metadata does not...

CVE-2023-51437: Apache Pulsar: Timing attack in SASL token signature verification Michael Marshall (Feb 07)
Affected versions:

- Apache Pulsar through 2.10.5
- Apache Pulsar 2.11.0 through 2.11.2
- Apache Pulsar 3.0.0 through 3.0.1
- Apache Pulsar 3.1.0

Description:

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to
forge a SASL Role Token that will pass signature verification.
Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also...

CVE-2024-1048: grub2-set-bootflag may be abused to fill up /boot, bypass RLIMIT_NPROC Solar Designer (Feb 06)
Hi,

Summary:

This message is about issues in grub-set-bootflag.c commonly installed
as grub2-set-bootflag, which is Red Hat's addition (not part of upstream
GRUB project) used at least in Fedora and RHEL and its downstreams. It
is a SUID root program. I think its latest development source code is
currently located in this branch:

https://github.com/rhboot/grub2/tree/fedora-40

On non-OSTree distros, this program's purpose appears...

Django CVE-2024-24680: Potential denial-of-service in intcomma template filter Natalia Bidart (Feb 06)
From: https://www.djangoproject.com/weblog/2024/feb/06/security-releases/

In accordance with `our security release policy
<https://docs.djangoproject.com/en/dev/internals/security/>`_, the Django
team
is issuing
`Django 5.0.2 <https://docs.djangoproject.com/en/dev/releases/5.0.2/>`_,
`Django 4.2.10 <https://docs.djangoproject.com/en/dev/releases/4.2.10/>`_,
and
`Django 3.2.24 <...

CVE-2024-23673: Apache Sling Servlets Resolver: Malicious code execution via path traversal Carsten Ziegeler (Feb 06)
Affected versions:

- Apache Sling Servlets Resolver before 2.11.0

Description:

Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue
affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this
attack depends on the exact configuration of the system.
If the system is vulnerable, a user with write access to the repository...

WebKitGTK and WPE WebKit Security Advisory WSA-2024-0001 Adrian Perez de Castro (Feb 05)
------------------------------------------------------------------------
WebKitGTK and WPE WebKit Security Advisory WSA-2024-0001
------------------------------------------------------------------------

Date reported : February 05, 2024
Advisory ID : WSA-2024-0001
WebKitGTK Advisory URL : https://webkitgtk.org/security/WSA-2024-0001.html
WPE WebKit Advisory URL :...

Re: Out-of-bounds read & write in the glibc's qsort() Adhemerval Zanella Netto (Feb 05)
Thanks for heads up, I will see if I can take some time to improve
the current qsort coverage to test both mergesort and the heapsort
fallback for all tests.

The way we usually test internal interfaces (such as the heapsort
fallback) is to create 'internal' tests that are essentially
static linked ones that call the internal glibc interfaces.

I think they would be a better alternative, specially because some test
do require malloc...

Re: Out-of-bounds read & write in the glibc's qsort() Solar Designer (Feb 05)
Oh, I should have spent a bit more time looking at the latest glibc
before posting. I just did. So it indeed did not reintroduce this same
issue. That's great.

Regarding the tests, I now see that one of them explicitly calls
heapsort_r(), so it tests that fallback code in this way, however the
rest simply call qsort() or qsort_r(), so they only test non-fallback
code. It'd improve code coverage of these tests if they first do what...

Re: Out-of-bounds read & write in the glibc's qsort() Qualys Security Advisory (Feb 05)
Hi Solar, all,

The "tmp_ptr != base_ptr" bounds check was originally added to the
_quicksort() function, but is not needed anymore in glibc 2.39 because
the old fallback to quick sort (the _quicksort() function) has been
completely removed and replaced by a fallback to heap sort.

Note, just in case: we have not reviewed the implementation of this new
fallback to heap sort.

Thank you very much for your kind words!

With best regards,

Re: systemd and other system services (in)compatibility with Linux procfs hidepid (was: darkhttpd: timing attack and local leak of HTTP basic auth credentials) Matthias Gerstner (Feb 05)
Hello,

thanks a lot for the recognition!

In the face of the codebase of a complete Linux distribution there are
limits to what our team can do, but we try to invest our resources
efficiently and hope to contribute back to the community this way.
Getting feedback like this for sure motivates us to continue on this
path.

Best Regards

Matthias

Re: Out-of-bounds read & write in the glibc's qsort() Alexander E. Patrakov (Feb 05)
Upon investigation, I have to add: the segmentation faults come from
code that runs before main(), so they do not indicate a problem in
qsort().

Re: Out-of-bounds read & write in the glibc's qsort() Alexander E. Patrakov (Feb 05)
Sorry, I should have followed the instructions.

[aep@aep-haswell tmp]$ while true; do n=$((RANDOM*64+RANDOM+1));
prlimit --as=$((n*4/2*3)) ./a.out $n; done

This results in a mix of these outputs:

PASSED
./a.out: error while loading shared libraries: libc.so.6: failed to
map segment from shared object
Segmentation fault

Re: Out-of-bounds read & write in the glibc's qsort() Alexander E. Patrakov (Feb 05)
Here you go: no output on Arch Linux.

[aep@aep-haswell tmp]$ gcc ./glibc-qualys-rocky-qsort-test.c
[aep@aep-haswell tmp]$ ./a.out
[aep@aep-haswell tmp]$ /lib64/libc.so.6
GNU C Library (GNU libc) stable release version 2.39.
Copyright (C) 2024 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC...

Re: Out-of-bounds read & write in the glibc's qsort() Solar Designer (Feb 04)
Hi,

Great findings and excellent quality write-up from Qualys, as usual.

I've attached an enhanced version of the above program to this message.

While we have to do it externally with "prlimit" or such when attacking
an existing program, for our own testing we can instead set RLIMIT_AS
right from the test program. This eliminates the need for choosing a
value for RLIMIT_AS that's barely sufficient for the program to work,...

Secure Coding — The Secure Coding list (SC-L) is an open forum for the discussion on developing secure applications. It is moderated by the authors of Secure Coding: Principles and Practices.

• Archived Posts
• RSS Feed
• About List

Educause Security Discussion — Securing networks and computers in an academic environment.

• Archived Posts
• RSS Feed
• About List

NANOG — The North American Network Operators' Group discusses fundamental Internet infrastructure issues such as routing, IP address allocation, and containing malicious activity.

• Current Month
• Archived Posts
• RSS Feed
• About List
• nanogLatest Posts

Re: Federal subsidy boosting internet affordability set to expire unless Congress acts | PBS NewsHour Josh Luthman (Feb 07)
ACP does not expire tomorrow. Today is the last day to enroll.

The funds are expected to run out in April or May - this is the last month
providers will be reimbursed.

https://docs.fcc.gov/public/attachments/DA-24-23A1.pdf

Federal subsidy boosting internet affordability set to expire unless Congress acts | PBS NewsHour Sean Donelan (Feb 07)
The Affordable Connectivity Program will expire tomorrow unless renewed by Congress

It won’t have an immediate impact but FCC will stop accepting new applications. Current applications will continue
until existing funds run out.

https://www.pbs.org/newshour/politics/federal-subsidy-boosting-internet-affordability-set-to-expire-unless-congress-acts

Re: ru tld down? Töma Gavrichenkov (Feb 07)
Peace,

TWIMC: the .ru TLD has issued a post mortem. A tl;dr version:

After a new key was crafted during an ordinary key update process, its key
tag hash-collided with some other key, and due to a violation of the MUST
NOT clause in the RFC 4034, Appendix B, the wrong key was deployed to the
system.

Instagram - Anyone here who can contact me off-list? Norman Jester (Feb 05)
We have some issues with instagram and normal abuse channels are not
responding.
If you can contact me off-list it would be great.

Thanks.

Norman Jester
MIE

Re: Chile Romain Fontugne via NANOG (Feb 05)
Hi,

I cannot confirm if this due to the fires but there's some usual changes
in BGP for Chilean networks.

- One of the two 'telefonica movil de chile' (AS27680) temporarily lost
global reachability around 19:00 UTC on feb 2nd:
https://ihr.iijlab.net/ihr/en-us/networks/AS27680?rov_tb=routes&af=4&last=3&date=2024-02-03

Later around 20:45 UTC:

- AS263816 (Chamber of Deputies?) and AS264839 lost global reachability...

Re: Chile Andrew Latham (Feb 04)
It was 40C this AM in the area of Quilpué where the fires have destroyed
many things including the vast amount of fiber running inland. The smoke is
limiting work as breathing is difficult at best. I noticed the tools like a
wildfire tracker incorrectly reported fires in the Valparaíso harbor at one
point. A good resource is https://web.senapred.cl to show the vast number
of fires in many regions from an exceptionally dry and hot summer.

I...

Re: Chile Andrew Latham (Feb 03)
Yes there are fires, many of them. Having dealt with the fires in Valpariso
area I can imagine the impact to power, gas and hanging fiber. I did not
see any news that would mention Internet or communications specifically.

Chile Mehmet (Feb 03)
Hello

There are big wildfires going on in Chile, Valparaiso region where
submarine cables mainly land. Are there any major outages reported so far ?
We had many outages in region last 24 hours and with reason of metro fiber
burning.

Sorry if this is slightly out of topic here. Could not find any news
anywhere related internet impact

Thanks

Re: If I announce 192.0.2.0/24, do I need a discard route? (Looking for a reference…) Tom Beecher (Feb 02)
I had to go into the weeds of the datatracker, but this thread discusses
the wording and meaning.

https://mailarchive.ietf.org/arch/msg/idr/JDPRPNUB0YhcZ5SqGHlg3jH8xGE/

Specifically this specific :
https://mailarchive.ietf.org/arch/msg/idr/1RglrwAgw5VIZSMxai-3fQRogzE/

The clause is saying 'A BGP route can validly be in Adj-RIB-Out, even if
it's not actually being used for forwarding.' (Personally I think they
chose one of the...

Weekly Global IPv4 Routing Table Report Routing Table Analysis Role Account (Feb 02)
This is an automated weekly mailing describing the state of the Global
IPv4 Routing Table as seen from APNIC's router in Japan.

The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG
UKNOF, TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG.

Daily listings are sent to bgp-stats () lists apnic net.

For historical data, please see https://thyme.apnic.net.

If you have any comments please contact Philip Smith...

Re: If I announce 192.0.2.0/24, do I need a discard route? (Looking for a reference…) Warren Kumari (Feb 01)
Yah, agreed…. This seems "obvious", but is there actually anything that
states this? I'm not really sure where I think that I'd find something
authoritative *to* state something.

Even though we claim to be network **engineers**, there isn't really very
much documentation of correct behavior — there are things like the MANRS
docs, and the short-lived BCOPS series, but much of the rest of the
understanding of what is...

NANOG 90 Keynote: Abstract Ponderings - A Ten-Year Retrospective with Google's Rob Shakir + More Nanog News (Feb 01)
*NANOG 90 Keynote: Abstract Ponderings**A Ten-Year Retrospective with
Google's Rob Shakir*

Rob Shakir, a senior staff software engineer for Google, will be a keynote
speaker at NANOG's upcoming 90th community-wide conference.

"We've got various internal company systems that use Open Config. It's now
the time to step back and ask, 'Are we doing this right, and what did we do
wrong?'" he said.

*READ NOW...

Re: NANOG Digest, Vol 193, Issue 1 Jakob Heitz (jheitz) via NANOG (Feb 01)
Wow!
The reason it’s called generative AI is because it totally made that up.

Kind Regards,
Jakob

Date: Wed, 31 Jan 2024 18:27:24 +0000
From: "Compton, Rich" <RICH_COMPTON () comcast com>
To: Mohammad Khalil <eng.mssk () gmail com>, NANOG list <nanog () nanog org>
Subject: Re: SOVC - BGp RPKI
Message-ID:
<SN7PR11MB6900EC6CF08C1CA9D8D4ABA8FA7C2 () SN7PR11MB6900 namprd11 prod outlook com>

Content-Type:...

Re: SOVC - BGp RPKI Jakob Heitz (jheitz) via NANOG (Feb 01)
In bgp_sovc.h, at the top, it says:
BGP Secure Origin Validation Code
Further down in the file, it says:
BGP Secured Origin Validate Cache – SOVC

Basically, the router downloads the VRPs from the RPKI server, using RFC 6810.
Then it uses the downloaded VRPs to validate received routes using RFC 6811.
SOVC refers to the code that does that.

Kind Regards,
Jakob

Date: Wed, 31 Jan 2024 16:16:15 +0300
From: Mohammad Khalil <eng.mssk () gmail...

Re: route: 0.0.0.0/32 in LEVEL3 IRR Tom Beecher (Feb 01)
Yes, absolutely. That's part of the technical risk that you take if you
decide to do such things.

If it's a "good" choice or not is entirely situational. Some organizations
are fine with kicking that tech debt down the road, others like to double
down and create a house of cards.

Interesting People — David Farber moderates this list for discussion involving internet governance, infrastructure, and any other topics he finds fascinating

• Archived Posts
• RSS Feed
• About List

The RISKS Forum — Peter G. Neumann moderates this regular digest of current events which demonstrate risks to the public in computers and related systems. Security risks are often discussed.

• Current Quarter
• Archived Posts
• RSS Feed
• About List
• risksLatest Posts

Risks Digest 34.05 RISKS List Owner (Jan 31)
RISKS-LIST: Risks-Forum Digest Wednesday 31 January 2024 Volume 34 : Issue 05

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.05>
The current issue can also be found at
<...

Risks Digest 34.04 RISKS List Owner (Jan 20)
RISKS-LIST: Risks-Forum Digest Saturday 20 January 2024 Volume 34 : Issue 04

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.04>
The current issue can also be found at
<...

Risks Digest 34.03 RISKS List Owner (Jan 13)
RISKS-LIST: Risks-Forum Digest Saturday 13 January 2024 Volume 34 : Issue 03

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.03>
The current issue can also be found at
<...

Risks Digest 34.02 RISKS List Owner (Jan 06)
RISKS-LIST: Risks-Forum Digest Saturday 6 December 2023 Volume 34 : Issue 02

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.02>
The current issue can also be found at
<...

Risks Digest 34.01 RISKS List Owner (Dec 30)
RISKS-LIST: Risks-Forum Digest Saturday 30 December 2023 Volume 34 : Issue 01

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.01>
The current issue can also be found at
<...

Risks Digest 33.97 RISKS List Owner (Dec 17)
RISKS-LIST: Risks-Forum Digest Sunday 17 December 2023 Volume 33 : Issue 97

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/33.97>
The current issue can also be found at
<...

Risks Digest 33.96 RISKS List Owner (Dec 09)
RISKS-LIST: Risks-Forum Digest Saturday 9 December 2023 Volume 33 : Issue 96

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/33.96>
The current issue can also be found at
<...

Risks Digest 33.95 RISKS List Owner (Dec 02)
RISKS-LIST: Risks-Forum Digest Saturday 2 December 2023 Volume 33 : Issue 95

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/33.95>
The current issue can also be found at
<...

Risks Digest 33.94 RISKS List Owner (Nov 18)
RISKS-LIST: Risks-Forum Digest Saturday 18 November 2023 Volume 33 : Issue 94

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/33.94>
The current issue can also be found at
<...

Risks Digest 33.93 RISKS List Owner (Nov 11)
RISKS-LIST: Risks-Forum Digest Saturday 11 November 2023 Volume 33 : Issue 93

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/33.93>
The current issue can also be found at
<...

Risks Digest 33.91 RISKS List Owner (Oct 22)
RISKS-LIST: Risks-Forum Digest Sunday 22 October 2023 Volume 33 : Issue 91

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/33.91>
The current issue can also be found at
<...

Risks Digest 33.90 RISKS List Owner (Oct 19)
RISKS-LIST: Risks-Forum Digest Thursday 19 October 2023 Volume 33 : Issue 90

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/33.90>
The current issue can also be found at
<...

Risks Digest 33.89 RISKS List Owner (Oct 11)
RISKS-LIST: Risks-Forum Digest Wednesday 11 October 2023 Volume 33 : Issue 89

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/33.89>
The current issue can also be found at
<...

Risks Digest 33.88 RISKS List Owner (Oct 07)
RISKS-LIST: Risks-Forum Digest Saturday 7 October 2023 Volume 33 : Issue 88

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/33.88>
The current issue can also be found at
<...

BreachExchange — BreachExchange focuses on all things data breach. Topics include actual data breaches, cyber insurance, risk management, metrics and more. This archive includes its predecessor, the Data Loss news and discussion lists.

• Archived Posts
• RSS Feed
• About List
• datalossLatest Posts

Healthcare organizations face rising ransomware attacks – and are paying up Matthew Wheeler (Jun 03)
https://www.theregister.com/2022/06/03/healthcare-ransomware-pay-sophos/

Healthcare organizations, already an attractive target for ransomware given
the highly sensitive data they hold, saw such attacks almost double between
2020 and 2021, according to a survey released this week by Sophos.

The outfit's team also found that while polled healthcare orgs are quite
likely to pay ransoms, they rarely get all of their data returned if they
do...

A digital conflict between Russia and Ukraine rages on behind the scenes of war Matthew Wheeler (Jun 03)
https://wskg.org/npr_story_post/a-digital-conflict-between-russia-and-ukraine-rages-on-behind-the-scenes-of-war/

SEATTLE — On the sidelines of a conference in Estonia on Wednesday, a
senior U.S. intelligence official told British outlet Sky News that the
U.S. is running offensive cyber operations in support of Ukraine.

“My job is to provide a series of options to the secretary of defense and
the president, and so that’s what I do,” said...

Researchers Uncover Malware Controlling Thousands of Sites in Parrot TDS Network Matthew Wheeler (Jun 03)
https://thehackernews.com/2022/06/researchers-uncover-malware-controlling.html

The Parrot traffic direction system (TDS) that came to light earlier this
year has had a larger impact than previously thought, according to new
research.

Sucuri, which has been tracking the same campaign since February 2019 under
the name "NDSW/NDSX," said that "the malware was one of the top infections"
detected in 2021, accounting for more than...

FBI, CISA: Don't get caught in Karakurt's extortion web Matthew Wheeler (Jun 03)
https://www.theregister.com/2022/06/03/fbi_cisa_warn_karakurt_extortion/

The Feds have warned organizations about a lesser-known extortion gang
Karakurt, which demands ransoms as high as $13 million and, some
cybersecurity folks say, may be linked to the notorious Conti crew.

In a joint advisory [PDF] this week, the FBI, CISA and US Treasury
Department outlined technical details about how Karakurt operates, along
with actions to take,...

DOJ Seizes 3 Web Domains Used to Sell Stolen Data and DDoS Services Matthew Wheeler (Jun 02)
https://thehackernews.com/2022/06/doj-seizes-3-web-domains-used-to-sell.html

The U.S. Department of Justice (DoJ) on Wednesday announced the seizure of
three domains used by cybercriminals to trade stolen personal information
and facilitate distributed denial-of-service (DDoS) attacks for hire.

This includes weleakinfo[.]to, ipstress[.]in, and ovh-booter[.]com, the
former of which allowed its users to traffic hacked personal data and
offered a...

Chinese Hackers Begin Exploiting Latest Microsoft Office Zero-Day Vulnerability Matthew Wheeler (Jun 02)
https://thehackernews.com/2022/05/chinese-hackers-begin-exploiting-latest.html

An advanced persistent threat (APT) actor aligned with Chinese state
interests has been observed weaponizing the new zero-day flaw in Microsoft
Office to achieve code execution on affected systems.

"TA413 CN APT spotted [in-the-wild] exploiting the Follina zero-day using
URLs to deliver ZIP archives which contain Word Documents that use the
technique,"...

US military hackers conducting offensive operations in support of Ukraine, says head of Cyber Command Matthew Wheeler (Jun 02)
https://www.three.fm/news/world-news/us-military-hackers-conducting-offensive-operations-in-support-of-ukraine-says-head-of-cyber-command/

US military hackers have conducted offensive operations in support of
Ukraine, the head of US Cyber Command has told Sky News.

In an exclusive interview, General Paul Nakasone also explained how "hunt
forward" operations were allowing the United States to search out foreign
hackers and identify...

SideWinder Hackers Launched Over a 1, 000 Cyber Attacks Over the Past 2 Years Matthew Wheeler (May 31)
https://thehackernews.com/2022/05/sidewinder-hackers-launched-over-1000.html

An "aggressive" advanced persistent threat (APT) group known as SideWinder
has been linked to over 1,000 new attacks since April 2020.

"Some of the main characteristics of this threat actor that make it stand
out among the others, are the sheer number, high frequency and persistence
of their attacks and the large collection of encrypted and obfuscated...

Hackers are Selling US University Credentials Online, FBI Says Matthew Wheeler (May 31)
https://tech.co/news/hackers-are-selling-us-university-credentials-online-fbi-says

The Federal Bureau of Investigation has warned US universities and colleges
that it has found banks of login credentials and other data relating to VPN
access circulating on cybercriminals forums.

The fear is that such data will be sold and subsequently used by malicious
actors to orchestrate attacks on other accounts owned by the same students,
in the hope...

Interpol Nabs 3 Nigerian Scammers Behind Malware-based Attacks Matthew Wheeler (May 31)
https://thehackernews.com/2022/05/interpol-nabs-3-nigerian-scammers.html

Interpol on Monday announced the arrest of three suspected global scammers
in Nigeria for using remote access trojans (RATs) such as Agent Tesla to
facilitate malware-enabled cyber fraud.

"The men are thought to have used the RAT to reroute financial
transactions, stealing confidential online connection details from
corporate organizations, including oil and gas...

U.S. Warns Against North Korean Hackers Posing as IT Freelancers Matthew Wheeler (May 18)
https://thehackernews.com/2022/05/us-warns-against-north-korean-hackers.html

Highly skilled software and mobile app developers from the Democratic
People's Republic of Korea (DPRK) are posing as "non-DPRK nationals" in
hopes of landing freelance employment in an attempt to enable the regime's
malicious cyber intrusions.

That's according to a joint advisory from the U.S. Department of State, the
Department of the...

FBI and NSA say: Stop doing these 10 things that let the hackers in Matthew Wheeler (May 18)
https://www.zdnet.com/article/fbi-and-nsa-say-stop-doing-these-10-things-that-let-the-hackers-in/

Cyber attackers regularly exploit unpatched software vulnerabilities, but
they "routinely" target security misconfigurations for initial access, so
the US Cybersecurity and Infrastructure Security Agency (CISA) and its
peers have created a to-do list for defenders in today's heightened threat
environment.

CISA, the FBI and National...

Fifth of Businesses Say Cyber-Attack Nearly Broke Them Matthew Wheeler (May 18)
https://www.infosecurity-magazine.com/news/fifth-of-businesses-cyber-attack/

A fifth of US and European businesses have warned that a serious
cyber-attack nearly rendered them insolvent, with most (87%) viewing
compromise as a bigger threat than an economic downturn, according to
Hiscox.

The insurer polled over 5000 businesses in the US, UK, Ireland, France,
Spain, Germany, the Netherlands and Belgium to compile its annual Hiscox
Cyber...

Hacker And Ransomware Designer Charged For Use And Sale Of Ransomware, And Profit Sharing Arrangements With Cybercriminals Matthew Wheeler (May 18)
https://www.shorenewsnetwork.com/2022/05/16/hacker-and-ransomware-designer-charged-for-use-and-sale-of-ransomware-and-profit-sharing-arrangements-with-cybercriminals/

A criminal complaint was unsealed today in federal court in Brooklyn, New
York, charging Moises Luis Zagala Gonzalez (Zagala), also known as
“Nosophoros,” “Aesculapius” and “Nebuchadnezzar,” a citizen of France and
Venezuela who resides in Venezuela, with attempted...

State of Ransomware shows huge growth in threat and impacts Matthew Wheeler (May 04)
https://www.continuitycentral.com/index.php/news/technology/7275-state-of-ransomware-shows-huge-growth-in-threat-and-impacts

Sophos has released its annual survey and review of real-world ransomware
experiences in its ‘State of Ransomware 2022’ report. This shows that 66
percent of organizations surveyed were hit with ransomware in 2021, up from
37 percent in 2020.

The average ransom paid by organizations that had data encrypted in their...

Metasploit — Development discussion for Metasploit, the premier open source remote exploitation tool

• Archived Posts
• RSS Feed
• About List

Wireshark — Discussion of the free and open source Wireshark network sniffer. No other sniffer (commercial or otherwise) comes close. This archive combines the Wireshark announcement, users, and developers mailing lists.

• Archived Posts
• RSS Feed
• About List

Snort — Everyone's favorite open source IDS, Snort. This archive combines the snort-announce, snort-devel, snort-users, and snort-sigs lists.

• Current Quarter
• Archived Posts
• RSS Feed
• About List
• snortLatest Posts

Snort Subscriber Rules Update 2024-02-05 Research (Feb 05)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos is releasing detection for CVE-2024-21893, an Ivanti Connect
Secure server side request forgery vulnerability.

Talos has added and modified multiple rules in the file-other,
os-windows and server-webapp rule sets to provide coverage for emerging
threats from these technologies.

For a complete list of new and modified rules...

Snort Subscriber Rules Update 2024-02-01 Research (Feb 01)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the file-other,
indicator-compromise and server-other rule sets to provide coverage for
emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2024-01-30 Research (Jan 30)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the browser-ie,
file-other, malware-cnc and server-webapp rule sets to provide coverage
for emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2024-01-26 Research (Jan 26)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the and server-webapp
rule sets to provide coverage for emerging threats from these
technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2024-01-25 Research (Jan 25)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the and malware-other
rule sets to provide coverage for emerging threats from these
technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2024-01-23 Research (Jan 23)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the browser-chrome,
file-other and server-webapp rule sets to provide coverage for emerging
threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Re: snort_ddos.rules and snort_dos.rules Jonathan Lee via Snort-sigs (Jan 22)
What we really need is a way to detect invasive containers and BSDjails and have them part of appID. Some containers
are sitting and data marshaling the Network cards. I saw one a year ago that when I got access to the container and
could see it the thing self deleted.
________________________________
From: Snort-sigs <snort-sigs-bounces () lists snort org> on behalf of Joel Esler via Snort-sigs <snort-sigs () lists
snort org>...

Re: snort_ddos.rules and snort_dos.rules Jonathan Lee via Snort-sigs (Jan 22)
Yeah you can check this out… pf can do os detect and it can spot a docker container with bleeding edge Kali running
inside of it.

os detect it with pf



Re: snort_ddos.rules and snort_dos.rules Joel Esler via Snort-sigs (Jan 19)
AppID is open source, detection can be written for it.

Re: snort_ddos.rules and snort_dos.rules Joel Esler via Snort-sigs (Jan 19)
Not sure that’s something you could detect with a network product?

Re: snort_ddos.rules and snort_dos.rules Joel Esler via Snort-sigs (Jan 18)
Yes. In fact, I depreciated them when I was still at Sourcefire (before we were purchased by Cisco!). There hasn't
been anything in those categories for years. If you want DDOS/DOS rules, you need to look at the classification in the
rules for denial-of-service.

https://blog.snort.org/2012/03/rule-category-reorganization.html
https://blog.snort.org/2012/08/rule-category-reorganization-phase-2.html

Snort Subscriber Rules Update 2024-01-18 Research (Jan 18)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the file-office,
file-pdf and os-windows rule sets to provide coverage for emerging
threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

snort_ddos.rules and snort_dos.rules Patrick Ambühl via Snort-sigs (Jan 18)
Are these two rules deprecated ? I see them as options if Snort/PFSense but when enabled no rules are displayed (active
or disabled). I also checked the snortrules-snapshot-31470.tar.gz and could not find these rules either.

Thank you

Patrick

Snort Subscriber Rules Update 2024-01-16 Research (Jan 16)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the os-windows and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories

Snort Subscriber Rules Update 2024-01-11 Research (Jan 11)
Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the and server-webapp
rule sets to provide coverage for emerging threats from these
technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories