SysAdmin 24x7

PSHunt: Powershell Threat Hunting Module https://securityonline.info/pshunt-powershell-threat-hunting-module/

ESET describes new Mosquito backdoor used by infamous Turla APT group https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/

Notification of Urgent Security Updates to DrayTek routers https://www.draytek.com/en/about/news/2018/notification-of-urgent-security-updates-to-draytek-routers

DrayTek router user? Patch now to keep the crooks out… https://nakedsecurity.sophos.com/2018/05/22/draytek-router-user-patch-now-to-keep-the-crooks-out/

Google Family Link Ya disponible en España https://families.google.com/intl/es-419/familylink/

Miles de Apple ID expuestos en Internet por un fallo de TeenSafe http://www.seguridadapple.com/2018/05/miles-de-apple-id-expuestos-en-internet.html

Another case of remote car compromise (GSM to CAN bus RCE): Security Assessment of BMW https://keenlab.tencent.com/en/Experimental_Security_Assessment_of_BMW_Cars_by_KeenLab.pdf

Múltiples vulnerabilidades en Citrix XenMobile Fecha de publicación: 22/05/2018 Importancia: 4 - Alta Recursos afectados:  XenMobile 10.7 XenMobile 10.8 Descripción:  Citrix ha publicado un boletín de seguridad en el que se describen siete vulnerabilidades, siendo una de ellas de severidad alta, cuatro de severidad media y el resto baja. https://www.certsi.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-citrix-xenmobile

Some fun with a miner https://fumik0.com/2018/05/21/some-fun-with-a-miner/

How and Why to Secure Your Linux System with VPN and Firejail https://www.linux.com/blog/learn/2018/5/how-and-why-secure-your-linux-system-vpn-and-firejail

III Jornadas de Ciberdefensa del Mando Conjunto de Ciberdefensa. Panel de Estrategia de Ciberseguridad Nacional en directo en #jornadasCD18 https://jornadasciberdefensa.es/streaming https://jornadasciberdefensa.es

Publicado el informe de ciberamenazas y tendencias del CCN-CERT https://unaaldia.hispasec.com/2018/05/publicado-el-informe-de-ciberamenazas-y.html

Vulnerability Note VU#180049 CPU hardware utilizing speculative execution may be vulnerable to cache side-channel attacks https://www.kb.cert.org/vuls/id/180049

speculative execution, variant 4: speculative store bypass https://bugs.chromium.org/p/project-zero/issues/detail?id=1528

GPON Routers Attacked With New Zero-Day https://www.bleepingcomputer.com/news/security/gpon-routers-attacked-with-new-zero-day/

AD ACL Scanner AD ACL Scanner is a tool completly written in PowerShell with GUI used to create reports of access control lists (DACLs) and system access control lists (SACLs) in Active Directory. https://n0where.net/ad-acl-scanner

Alert (TA18-141A) Side-Channel Vulnerability Variants 3a and 4 Systems Affected CPU hardware implementations Overview On May 21, 2018, new variants—known as Spectre 3A and 4—of the side-channel central processing unit (CPU) hardware vulnerability were publically disclosed. These variants can allow an attacker to obtain access to sensitive information on affected systems. https://www.us-cert.gov/ncas/alerts/TA18-141A

Extracting SSH Private Keys from Windows 10 ssh-agent https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/

Malicious Debian Package Generator: kimi https://n0where.net/malicious-debian-package-generator-kimi