smbdoor

The proof-of-concept smbdoor.sys driver is a silent remote backdoor that does not bind new sockets or perform function modification hooking. Instead it abuses undocumented APIs in srvnet.sys to register itself as a valid SMB handler.

https://github.com/zerosum0x0/smbdoor

Rootpipe Reborn Part I: CVE-2019–8513 TimeMachine root command injection

https://medium.com/0xcc/rootpipe-reborn-part-i-cve-2019-8513-timemachine-root-command-injection-47e056b3cb43

Apache Tomcat Patches Important Remote Code Execution Flaw

Affected Tomcat Versions
Apache Tomcat 9.0.0.M1 to 9.0.17
Apache Tomcat 8.5.0 to 8.5.39
Apache Tomcat 7.0.0 to 7.0.93


https://thehackernews.com/2019/04/apache-tomcat-security-flaw.html

Patched Windows Zero-Day Provided Full Control Over Vulnerable Systems

https://www.bleepingcomputer.com/news/security/patched-windows-zero-day-provided-full-control-over-vulnerable-systems/

Herramienta para implementar y detectar el uso de honeytokens en Active Directory.

https://www.gurudelainformatica.es/2019/03/herramienta-para-implementar-y-detectar.html

DCEPT

DCEPT (Domain Controller Enticing Password Tripwire) is a honeytoken-based tripwire for Microsoft's Active Directory.

https://github.com/secureworks/dcept

New Details Emerge on Windows Zero Day

https://www.darkreading.com/vulnerabilities---threats/new-details-emerge-on-windows-zero-day/d/d-id/1334422

European Commission: No Evidence of Issues With Kaspersky Products

https://www.securityweek.com/european-commission-no-evidence-issues-kaspersky-products

Actualizaciones críticas en Oracle (abril 2019)

Fecha de publicación: 17/04/2019
Importancia: 5 - Crítica

Descripción: 
Oracle ha publicado una actualización crítica con parches para corregir vulnerabilidades que afectan a múltiples productos.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizaciones-criticas-oracle-abril-2019

Malvertising Campaign Abused Chrome to Hijack 500 Million iOS User Sessions

https://www.bleepingcomputer.com/news/security/malvertising-campaign-abused-chrome-to-hijack-500-million-ios-user-sessions/

DNS Hijacking Abuses Trust In Core Internet Service

https://blog.talosintelligence.com/2019/04/seaturtle.html

Facebook uploaded 1.5 million people’s email contacts without permission

https://thenextweb.com/facebook/2019/04/18/facebook-uploaded-1-5-million-peoples-email-contacts-without-permission/amp/

New Variant of HawkEye Sold on Hacking Forums and Distributed via Excel and DOC Files

https://gbhackers.com/hawkeye-distributed-excel

Drupal Releases Security Updates

Drupal has released security updates to address multiple vulnerabilities in Drupal Core. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

https://www.us-cert.gov/ncas/current-activity/2019/04/17/Drupal-Releases-Security-Updates

Cisco IOS XR 64-Bit Software for Cisco ASR 9000 Series Aggregation Services Routers Network Isolation Vulnerability

Vulnerable Products

This vulnerability affects Cisco ASR 9000 Series Aggregation Services Routers that are running an affected version of Cisco IOS XR 64-bit Software and have the secondary management interface (physically MGT LAN 1 on the route switch processor (RSP)) connected and configured.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-asr9k-exr

Cisco IOS and IOS XE Software Cluster Management Protocol Remote Code Execution Vulnerability

Cisco devices running a vulnerable Cisco IOS XE release are affected by this vulnerability when the following conditions are met:

The CMP subsystem is present on the Cisco IOS XE software image running on the device, and
The device is configured to accept incoming Telnet connections.

Details
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.
The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp

SNMP Remote Code Execution Vulnerabilities in Cisco IOS and IOS XE Software

To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system.

To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp

Lateral Movement — SCM and Dll Hijacking Primer

https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992

Scranos: Descubierto nuevo spyware con capacidades de rootkit

https://unaaldia.hispasec.com/2019/04/scranos-descubierto-nuevo-spyware-con-capacidades-de-rootkit.html

Google Bans Embedded Browser Logins In Brutal War Against Phishing Attacks


https://www.hothardware.com/news/google-bans-embedded-browser-logins-war-phishing-attacks

Some internet outages predicted for the coming month as '768k Day' approaches

768k Day expected within the month, reminiscent of 512k Day when AT&T, BT, Comcast, Sprint, and Verizon all went down.

https://www.zdnet.com/article/some-internet-outages-predicted-for-the-coming-month-as-768k-day-approaches/