New Details Emerge on Windows Zero Day

https://www.darkreading.com/vulnerabilities---threats/new-details-emerge-on-windows-zero-day/d/d-id/1334422

European Commission: No Evidence of Issues With Kaspersky Products

https://www.securityweek.com/european-commission-no-evidence-issues-kaspersky-products

Actualizaciones críticas en Oracle (abril 2019)

Fecha de publicación: 17/04/2019
Importancia: 5 - Crítica

Descripción: 
Oracle ha publicado una actualización crítica con parches para corregir vulnerabilidades que afectan a múltiples productos.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizaciones-criticas-oracle-abril-2019

Malvertising Campaign Abused Chrome to Hijack 500 Million iOS User Sessions

https://www.bleepingcomputer.com/news/security/malvertising-campaign-abused-chrome-to-hijack-500-million-ios-user-sessions/

DNS Hijacking Abuses Trust In Core Internet Service

https://blog.talosintelligence.com/2019/04/seaturtle.html

Facebook uploaded 1.5 million people’s email contacts without permission

https://thenextweb.com/facebook/2019/04/18/facebook-uploaded-1-5-million-peoples-email-contacts-without-permission/amp/

New Variant of HawkEye Sold on Hacking Forums and Distributed via Excel and DOC Files

https://gbhackers.com/hawkeye-distributed-excel

Drupal Releases Security Updates

Drupal has released security updates to address multiple vulnerabilities in Drupal Core. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

https://www.us-cert.gov/ncas/current-activity/2019/04/17/Drupal-Releases-Security-Updates

Cisco IOS XR 64-Bit Software for Cisco ASR 9000 Series Aggregation Services Routers Network Isolation Vulnerability

Vulnerable Products

This vulnerability affects Cisco ASR 9000 Series Aggregation Services Routers that are running an affected version of Cisco IOS XR 64-bit Software and have the secondary management interface (physically MGT LAN 1 on the route switch processor (RSP)) connected and configured.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-asr9k-exr

Cisco IOS and IOS XE Software Cluster Management Protocol Remote Code Execution Vulnerability

Cisco devices running a vulnerable Cisco IOS XE release are affected by this vulnerability when the following conditions are met:

The CMP subsystem is present on the Cisco IOS XE software image running on the device, and
The device is configured to accept incoming Telnet connections.

Details
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.
The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp

SNMP Remote Code Execution Vulnerabilities in Cisco IOS and IOS XE Software

To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system.

To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp

Lateral Movement — SCM and Dll Hijacking Primer

https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992

Scranos: Descubierto nuevo spyware con capacidades de rootkit

https://unaaldia.hispasec.com/2019/04/scranos-descubierto-nuevo-spyware-con-capacidades-de-rootkit.html

Google Bans Embedded Browser Logins In Brutal War Against Phishing Attacks


https://www.hothardware.com/news/google-bans-embedded-browser-logins-war-phishing-attacks

Some internet outages predicted for the coming month as '768k Day' approaches

768k Day expected within the month, reminiscent of 512k Day when AT&T, BT, Comcast, Sprint, and Verizon all went down.

https://www.zdnet.com/article/some-internet-outages-predicted-for-the-coming-month-as-768k-day-approaches/

PowerShell script creating a timeline of Active Directory changes with replication metadata

The ADTimeline script generates a timeline based on Active Directory replication metadata for objects considered of interest.
Replication metadata gives you the time at which each replicated attribute for a given object was last changed. As a result the timeline of modifications is partial. For each modification of a replicated attribute a version number is incremented.

https://github.com/ANSSI-FR/ADTimeline

Active Directory Control Paths

Control paths in Active Directory are an aggregation of "control relations" between entities of the domain (users, computers, groups, GPO, containers, etc.) which can be visualized as graphs (such as above) and whose purpose is to answer questions like "Who can get 'Domain Admins' privileges ?" or "What resources can a user control ?" and even "Who can read the CEO's emails ?".

https://github.com/ANSSI-FR/AD-control-paths

Hacker Group Exposes Iranian APT Operations and Members

Hackers have revealed details about the inner workings of a cyber-espionage group mostly known in the security community as OilRig, APT34, and HelixKitten, linked to the Iranian government.

https://www.bleepingcomputer.com/news/security/hacker-group-exposes-iranian-apt-operations-and-members/

Enlaces a Herramientas OSINT

https://ciberpatrulla.com/links/

How to extract forensic artifacts from pagefile.sys?

https://www.andreafortuna.org/2019/04/17/how-to-extract-forensic-artifacts-from-pagefile-sys/

@hackplayers

Exploring, Exploiting Active Directory Pen Test

http://blog.securelayer7.net/exploring-exploiting-active-directory-pen-test/