Weekly IT Security News Bulletin, 2018-W19 7 May – 13 May 2018
Total Page:16
File Type:pdf, Size:1020Kb
Weekly IT Security News Bulletin, 2018-W19 7 May – 13 May 2018 Headlines The rise of security orchestration, automation and response Security professionals face increasing challenges in monitoring, responding to and remediating security events as a result of rapidly evolving threat landscape. Security orchestration, automation and response (SOAR) technologies emerge to accelerate the tasks associated with monitoring and responding to security threats through some automation. A research shows that 84 percent of the enterprise organisations surveyed have adopted or are planning to implement security operations automation and orchestration technologies. SOAR products are designed to integrate with different security tools. Organisations could define their workflows with multilevel automation in SOAR, while human decisions could also be involved if required. SOAR could also help to prioritise operations activities based on the threat intelligence from different sources and enforce remediation workflows. SOAR could improve the efficiency and efficacy of security operations. For example, when a suspicious email is received, the SOAR platform will automatically examine the email and its attached links and files with different security products. Once it confirms that the email is malicious, it will trigger an automated workflow to quarantine all similar emails and report the event to the IT security team. Advice Stay tuned with the evolution of SOAR technologies for leveraging them to simplify and speed up security operations. Test the SOAR platform integration with applicable security tools in your organisations with relevant use cases. Sources Gartner IBM CSO GovCERT.HK Weekly IT Security News Bulletin 2018-W19 1 "Safe Links" bypassed by split URLs A cloud security company found that attackers could bypass the built-in security of Microsoft Office 365 to deliver known phishing URLs to email users. The bypass was enabled by an attack method called baseStriker, which splits a malicious URL with the HTML base URL tab. Office 365 will normally block malicious URLs in emails by checking them against its list of known bad links and for those customers who purchased Microsoft’s Advanced Threat Protection, the malicious URLs will be replaced by its Safelink URLs to redirect users to read an alert message instead of going to the phishing site. The baseStriker attack divides a malicious URL into a base tag and a regular href tag. Office 365 only checks the domain at the base tag but ignores the rest of the URL at the href tag, thus failing to identify the bad URL as a whole. Though the vulnerability was observed being used by phishing attacks only so far, it could also be exploited to distribute ransomware, malware and other malicious content. Advice Office 365 users should note and follow up relevant advice from the service provider once the fix is available. End users should stay alert of the risk of phishing attacks and be vigilant when clicking on URLs from Office 365. Users should also adopt additional layers of protection against phishing, malware and account take-over, such as DNS filtering, endpoint security, sandboxing, etc. Sources Avanan The Hacker News GovCERT.HK Weekly IT Security News Bulletin 2018-W19 2 Product Vulnerability Notes & Security Updates 1. Adobe Products https://helpx.adobe.com/security/products/connect/apsb18-18.html https://helpx.adobe.com/security/products/creative-cloud/apsb18-12.html https://helpx.adobe.com/security/products/flash-player/apsb18-16.html https://www.hkcert.org/my_url/en/alert/18050902 2. Apple Swift https://support.apple.com/kb/HT208804 3. CentOS https://lists.centos.org/pipermail/centos-announce/2018-May/022822.html https://lists.centos.org/pipermail/centos-announce/2018-May/022827.html 4. Debian https://www.debian.org/security/2018/dsa-4192 https://www.debian.org/security/2018/dsa-4193 https://www.debian.org/security/2018/dsa-4194 https://www.debian.org/security/2018/dsa-4195 https://www.debian.org/security/2018/dsa-4196 https://www.debian.org/security/2018/dsa-4197 https://www.debian.org/security/2018/dsa-4198 5. F5 Products https://support.f5.com/csp/article/K01294982 https://support.f5.com/csp/article/K05441360 https://support.f5.com/csp/article/K15526101 https://support.f5.com/csp/article/K24593421 https://support.f5.com/csp/article/K35135935 https://support.f5.com/csp/article/K35513527 https://support.f5.com/csp/article/K44923228 https://support.f5.com/csp/article/K71021401 6. FreeBSD https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.asc 7. Gentoo Linux https://security.gentoo.org/glsa/201805-04 8. Google Chrome https://chromereleases.googleblog.com/2018/05/stable-channel-update-for-desktop.html GovCERT.HK Weekly IT Security News Bulletin 2018-W19 3 9. IBM Products https://www-01.ibm.com/support/docview.wss?uid=swg22015254 https://www-01.ibm.com/support/docview.wss?uid=swg22015944 https://www-01.ibm.com/support/docview.wss?uid=swg22016212 10. Microsoft Products https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/a82328f9-1f26- e811-a968-000d3a33a34d https://support.microsoft.com/en-us/help/20180508/security-update-deployment-information- may-08-2018 https://www.hkcert.org/my_url/en/alert/18050901 11. Mozilla Firefox https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-12/ 12. openSUSE https://lists.opensuse.org/opensuse-security-announce/2018-05/msg00009.html https://lists.opensuse.org/opensuse-security-announce/2018-05/msg00016.html https://lists.opensuse.org/opensuse-security-announce/2018-05/msg00017.html 13. Oracle Linux https://linux.oracle.com/errata/ELSA-2018-1318.html https://linux.oracle.com/errata/ELSA-2018-1319.html https://linux.oracle.com/errata/ELSA-2018-1364.html https://linux.oracle.com/errata/ELSA-2018-4096.html https://linux.oracle.com/errata/ELSA-2018-4097.html https://linux.oracle.com/errata/ELSA-2018-4098.html 14. Red Hat https://access.redhat.com/errata/RHSA-2018:1318 https://access.redhat.com/errata/RHSA-2018:1319 https://access.redhat.com/errata/RHSA-2018:1323 https://access.redhat.com/errata/RHSA-2018:1328 https://access.redhat.com/errata/RHSA-2018:1345 https://access.redhat.com/errata/RHSA-2018:1346 https://access.redhat.com/errata/RHSA-2018:1347 https://access.redhat.com/errata/RHSA-2018:1348 https://access.redhat.com/errata/RHSA-2018:1349 https://access.redhat.com/errata/RHSA-2018:1350 https://access.redhat.com/errata/RHSA-2018:1351 https://access.redhat.com/errata/RHSA-2018:1352 https://access.redhat.com/errata/RHSA-2018:1353 https://access.redhat.com/errata/RHSA-2018:1354 https://access.redhat.com/errata/RHSA-2018:1355 https://access.redhat.com/errata/RHSA-2018:1364 GovCERT.HK Weekly IT Security News Bulletin 2018-W19 4 https://access.redhat.com/errata/RHSA-2018:1367 https://access.redhat.com/errata/RHSA-2018:1369 15. Rockwell Automation Factory Talk https://ics-cert.us-cert.gov/advisories/ICSA-18-102-02 16. Slackware https://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware- security.359893 https://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware- security.395402 https://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware- security.419343 https://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware- security.470394 https://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware- security.533566 17. SUSE https://www.suse.com/support/update/announcement/2018/suse-su-20181161-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181162-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181163-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181171-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181172-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181173-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181174-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181176-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181177-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181178-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181179-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181180-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181181-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181183-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181184-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181191-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181194-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181195-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181196-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181202-1/ https://www.suse.com/support/update/announcement/2018/suse-su-20181203-1/ GovCERT.HK Weekly IT Security News Bulletin 2018-W19 5 18. Ubuntu https://usn.ubuntu.com/3638-1/ https://usn.ubuntu.com/3639-1/ https://usn.ubuntu.com/3640-1/ https://usn.ubuntu.com/3641-1/ https://usn.ubuntu.com/3641-2/ https://usn.ubuntu.com/3642-1/ https://usn.ubuntu.com/3643-1/ https://usn.ubuntu.com/3643-2/ 19. Xen https://xenbits.xen.org/xsa/advisory-260.html https://xenbits.xen.org/xsa/advisory-261.html https://xenbits.xen.org/xsa/advisory-262.html Sources of product vulnerability information: Apple Adobe CentOS Debian F5 FreeBSD Gentoo Linux Google Chrome HKCERT IBM ICS-CERT Microsoft Mozilla Firefox openSUSE Oracle Linux Red Hat Slackware SUSE Ubuntu Xen Contacts: [email protected] GovCERT.HK Weekly IT Security News Bulletin 2018-W19 6 .