SysAdmin 24x7

The Death Metal Suite [...]Death Metal is a toolkit designed to exploit AMT’s legitimate features[...] [...] Advice for the Blue Team The best advice I have at reducing the risks inherent to AMT is to buy systems without it enabled. If that is not possible, provision your systems before someone malicious does, change the password, and disable everything you can.[...] https://www.coalfire.com/The-Coalfire-Blog/April-2019/The-Death-Metal-Suite

Verizon Patches Trio of Vulnerabilities in Home Router https://www.darkreading.com/vulnerabilities---threats/verizon-patches-trio-of-vulnerabilities-in-home-router/d/d-id/1334385

Samba CVE-2019-3870 Local Insecure File Permissions Vulnerability https://www.securityfocus.com/bid/107798/info

Mailman: Multiple vulnerabilities — GLSA201904-10 Multiple vulnerabilities have been found in Mailman, the worst of which could result in the arbitrary execution of code. https://security.gentoo.org/glsa/201904-10

Cyber Attack Shuts Down Hoya Corp's Thailand Plant for Three Days https://www.bleepingcomputer.com/news/security/cyber-attack-shuts-down-hoya-corps-thailand-plant-for-three-days/

RSAC 2019: Why attackers need domain fronting https://www.kaspersky.com/blog/domain-fronting-rsa2019/26352/

Microsoft Releases April 2019 Security Updates — Two Flaws Under Active Attack https://thehackernews.com/2019/04/microsoft-patch-updates.html

"Adobe Releases Security Patches for Flash, Acrobat Reader, Other Products" https://thehackernews.com/2019/04/adobe-security-updates.html

Security researchers discover iOS version of Exodus Android spyware Exodus iOS spyware used against Italian and Turkmenistan users. https://www.zdnet.com/article/security-researchers-discover-ios-version-of-exodus-android-spyware/

Red Hat Security Advisory Synopsis: Important: python security update Advisory ID: RHSA-2019:0710-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:0710 Issue date: 2019-04-08 CVE Names: CVE-2019-9636

Samba Releases Security Updates The Samba Team has released security updates to address vulnerabilities in Samba. An attacker could exploit some of these vulnerabilities to take control of an affected system. https://www.us-cert.gov/ncas/current-activity/2019/04/08/Samba-Releases-Security-Updates

Un Exploit que permite escapar del Sandbox de safari con una sola línea de código https://www.seguridadapple.com/2019/04/un-exploit-que-permite-escapar-del.html

MUS CTF DFIR – MOBILE (Nivel 1) https://www.securityartwork.es/2019/04/08/mus-ctf-dfir-mobile-nivel-1/

Múltiples vulnerabilidades en productos de IBM Fecha de publicación: 08/04/2019 Importancia: 5 - Crítica Recursos afectados:  IBM QRadar SIEM 7.3.2 GA - 7.3.2 GA Interim Fix 1 IBM API Connect versión 2018.1-2018.4.1.3 Descripción:  IBM ha publicado dos vulnerabilidades en dos de sus productos. La explotación exitosa de alguna de ellas podría permitir una evasión de la autenticación o un escalado de privilegios. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-productos-ibm-5

Elevación de privilegios en Módulo Fibre Channel de 16 Gb HPE Virtual Connect SE para Synergy Fecha de publicación: 08/04/2019 Importancia: 5 - Crítica Recursos afectados:  Módulo Fibre Channel de 16 Gb HPE Virtual Connect SE para Synergy con firmware 5.00.50 Descripción:  Una vulnerabilidad en el módulo Fibre Channel de 16 Gb HPE Virtual Connect SE para Synergy podría permitir la elevación no autorizada de privilegios local o remota. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/elevacion-privilegios-modulo-fibre-channel-16-gb-hpe-virtual

PowerShellArsenal A PowerShell Module Dedicated To Reverse Engineering https://www.kitploit.com/2019/04/powershellarsenal-powershell-module.html

Part 1 : A Journey into the UEFI Land : https://erfur.github.io/down_the_rabbit_hole_pt1/ Part 2 : Analyzing an EFI Application with Radare2 : https://erfur.github.io/down_the_rabbit_hole_pt2/ Down the Rabbit Hole (Part 3) : Patching the Whitelist : https://erfur.github.io/down_the_rabbit_hole_pt3/

Hackeados miles de routers D-Link para comprometer sus DNS https://hipertextual.com/2019/04/routers-dns-dlink

Shiina permite esconder un ejecutable en una imagen y luego convertirlo de vuelta en ejecutable interesante para usarlo en un downloader y ocultar el payload de soluciones de seguridad. https://github.com/Fmk0/scripts Vía @dragonjar

Multiple Vulnerabilities in Android’s Download Provider (CVE-2018-9468, CVE-2018-9493, CVE-2018-9546) Android’s Download Provider is a component of the Android framework and is designed to handle external downloads for other applications, such as web browsers (including Google Chrome), email clients (including Gmail), and the Google Play Store, among many others. https://ioactive.com/multiple-vulnerabilities-in-androids-download-provider-cve-2018-9468-cve-2018-9493-cve-2018-9546/