@DTCERT-
Shining some light on the DarkGate loader
Analysis and Report by Fabian Marquardt (@marqufabi)
Recently, Telekom Security CTI was made aware via trust groups in which we are engaged about a new malware campaign that is distributed via phishing emails. The malspam campaign used stolen email threads to lure victim users into clicking the contained hyperlink, which downloaded the malware.
-
LibreOffice Calc Formula Parsing Vulnerability
A vulnerability in LibreOffice (CVE-2023-0950) allows to trigger an array index underflow that could be exploited by an attacker to execute arbitrary code. To trigger the vulnerability, a victim only needs to open a specially crafted Spreadsheet file. The vulnerability has been fixed in LibreOffice 7.4.6/7.5.2.
-
Mozilla Maintenance Service Write-lock bypass Vulnerability
A vulnerability in the Mozilla Maintenance Service (CVE-2023-29532) allows a local attacker to trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service to an update file on a malicious SMB server. This allows privilege escalation to the LocalSystem account. The vulnerability has been fixed in Firefox 112, Firefox ESR 102.10, and Thunderbird 102.10.
-
USD: One File Format, Many Vulnerabilities
This post covers my project of identifying a series of vulnerabilities (CVE-2020-9878, CVE-2020-9880, CVE-2020-9881, CVE-2020-9882, CVE-2020-9940, CVE-2020-9985) in the processing of USD (Universal Scene Description) files within Apple’s iOS operating system. It also covers the high-level approach to exploit one of these vulnerabilities.
-
T-Pot Version 22.04 released
We are proud to announce the release of T-Pot 22.04 with lots of new features i.e. new honeypots, a distributed installation option, arm64 support, live attack maps, Debian 11 base, ELK 8.x, and more. If you ever wanted to get started with honeypots (or take it to the next level), but with the ease of use of an appliance, now is the best time to get started.
-
Twitter Account of Deutsche Telekom's CERT Resumed
We are very pleased to announce that Deutsche Telekom’s CERT recently has resumed their twitter activity. Make sure to follow @DTCERT for technical tweets from CERT, CTI, and DFIR.
-
Enumerating and indexing SMB shares at scale
In order to improve and harden our group’s critical telco-infrastructure, Deutsche Telekom Security GmbH provides a red team to simulate real world attack scenarios. While our red team also offers its capabilities for external customers, our main focus is improving our internal security by simulating state of the art attacks.
-
Wire Secure Messenger Remote Format String Vulnerability
A Remote Format String Vulnerability in the Wire Secure Messenger (CVE-2020-27853) allows an attacker to cause a denial of service (application crash) or possibly execute arbitrary code via voice or video call. This affects Wire AVS (Audio, Video, and Signaling) 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, and the Wire Secure Messenger application before 3.61 for iOS.