(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

The FBI has been lobbying hard to get unfettered access to the messages passed by encrypted messaging services. But it apparently didn't need that level of access to WhatsApp messages sent between members of an alleged Chechen jihadist group operating in Belgium. According to a report by Bloomberg, a pair of men were arrested and warrants were issued for three others for allegedly preparing for a terrorist attack in Belgium.

The arrests followed raids in which 16 people were detained, which Belgian law enforcement officials said was the result of "working with U.S. authorities to monitor suspects’ communications on WhatsApp Inc.’s messaging service," Bloomberg's Gaspard Sebag reported.

The BBC reports that the men tied to the al-Nusra Front in Syria and the Islamic Caucasus Emirate. One man detained had recently returned to Belgium wounded in combat in Syria while fighting with al-Nusra. There were two groups raided—one in Ostend on Belgium's coast, and the other inland at Louvain. The Louvain group was said to be plotting a terrorist attack in Belgium. BBC also cited Belgian officials as saying WhatsApp messages intercepted by the US government were used to trace the group.

Read 5 remaining paragraphs | Comments

[security bulletin] HPSBMU03349 rev.1- HP Helion CloudSystem, Local Denial of Service (DoS), Arbitrary Code Execution
[security bulletin] HPSBST03346 rev.1 - HP P6000 Command View Software running Jetty, Remote Denial of Service (DoS)
NEW VMSA-2015-0004 - VMware Workstation, Fusion and Horizon View Client updates address critical security issues
CFP The 2nd International Conference on Information Systems Security and Privacy ICISSP 2016

Overview of the June 2015 Microsoft Patches and their status.

# Affected Contra Indications - KB Known Exploits Microsoft rating(**) ISC rating(*)
clients servers
MS15-056 Cumulative Security Update for Internet Explorer (Replaces MS15-043 )
Internet Explorer
KB 3058515 CVE-2015-1765 publicly disclosed. Severity:Critical
Exploitability: 1
Critical Important
MS15-057 Remote Code Execution Vulnerability in Windows Media Player (Replaces MS10-082 )
Windows Media Player
KB 3033890 no. Severity:Critical
Exploitability: 2
Critical Important
MS15-058 No Bulletin Published for MS15-058
MS15-059 Remote Code Execution Vulnerabilities in Microsoft Office (Replaces MS13-091 )
Microsoft Office
KB 3064949 no. Severity:Important
Exploitability: 1
Critical Important
MS15-060 Remote Code Execution Vulnerability in Microsoft Common Controls (Replaces MS15-043 )
Windows Common Controls (IE Developer Tools)
KB 3059317 publicly disclosed. Severity:Important
Exploitability: 2
Important Important
MS15-061 Privilege Elevation Vulnerability in Windows Kernel-Mode Drivers (Replaces MS15-023 )
Kernel-Mode Drivers
KB 3057839 no. Severity:Important
Exploitability: 1
Important Important
MS15-062 XSS Vulnerablity in Active Directory Federation Services (Replaces MS14-077 )
Active Directory Federation Services
KB 3062577 no, but looks like bulletin includes a PoC. Severity:Important
Exploitability: 2
N/A Important
MS15-063 Elevation of Privilege Vulnerability in Windows Kernel (Replaces MS14-019 )
Windows Kernel
KB 3063858 no. Severity:Important
Exploitability: 2
Important Important
MS15-064 Elevation of Privilege Vulnerabilities in Microsoft Exchange
Microsoft Exchange Web Applications
KB 3062157 no. Severity:Important
Exploitability: 2
N/A Important
er;">We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become interesting">Less Urt practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
    • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat.

Johannes B. Ullrich, Ph.D.

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Most of the time, if a web application gets compromised, we hear about vulnerabilities like cross site scripting or SQL injection being used to gain access. However, many high profile web application defacements dont need tools like sqlmap or BeEF. Instead, the attacker just logs in as an administrator. The log in may not necessarily use the web application at all, but it may affect the infrastructure the application relies on:

Operating System

It may be as easy as a default login to the system. A weak password, or a password collected via phishing. Your best defence in this case is to limit how many individuals have access to the system, to use non-password based authentication schemes (two-factor... ), and to restrict logins to trusted networks. Nobody should be able to log in to your server via ssh using nothing but a password from anywhere in the world. A missing patch apparently lead to the large OPM breach.

Cloud Admin Consoles (private or public)

Same as above. But sadly, also often overlooked. Many cloud providers will offer two factor authentication. And your backups should certainly not be hosted in the same cloud as the live systems. Private cloud admin interfaces are usually a bit easier to secure and isolate. But that doesnt mean it is actually done. I do see many papers about the latest Virtual Machine Escape technique. But the technique I see used in the wild the most is far less advanced: Log in to the admin console and download the server you are interested in compromising. Secure code hosting company Code Spaces no longer exists as a result of a breach of its Amazon cloud accounts.

Content Delivery Networks (CDNs)

Most large sites use CDNs to deal with traffic spikes, and to defend against common denial of service attacks. What else does an attacker need but credentials to log into the CDNs admin console to alter your site at will. Did I mention two-factor authentication already? The Army.mil account has been attributed to a compromise of a CDN admin account.

Domain Name Registrars

This may be the most common route used to deface large, otherwise secure, web applications. But a defacement isnt what you should be scared about most. What about someone adding MX records and intercepting your e-mail? What about someone adding a record for login.example.com to use in a very plausible phishing attack? A lot has been written about DNS spoofing and cache poisoning. But why use a difficult technique like this if all you need to do is logging in. The list of recent attacks using this technique is rather long and includes household names like Craigslist, NY Times, Twitter and more.

Johannes B. Ullrich, Ph.D.

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
SilverStripe CMS Unvalidated Redirect & XSS vulnerabilities
SilverStripe CMS Unvalidated Redirect & XSS vulnerabilities
Symphony CMS XSS Vulnerability [Corrected Post]
Internet Storm Center Infocon Status