2020년 4월 8일 보안정보 스크래핑

4월 8일 보안정보 스크래핑 

==================================================================== 

+ 주요 취약점 - 특이사항 없음

==================================================================== 

+ 취약점 - Google Chrome 취약점

 1. Google Chrome 취약점
Google Chrome V8 code execution
CVE-2020-6448
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179206

Google Chrome security bypass
CVE-2020-6447
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179205

Google Chrome security bypass
CVE-2020-6446
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179204

Google Chrome security bypass
CVE-2020-6445
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179203

Google Chrome security bypass
CVE-2020-6444
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179202

Google Chrome security bypass
CVE-2020-6443
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179201

Google Chrome security bypass
CVE-2020-6442
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179200

Google Chrome security bypass
CVE-2020-6441
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179199

Google Chrome security bypass
CVE-2020-6440
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179198

Google Chrome security bypass
CVE-2020-6439
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179197

Google Chrome security bypass
CVE-2020-6438
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179196

Google Chrome security bypass
CVE-2020-6437
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179195

Google Chrome extensions code execution
CVE-2020-6436
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179194

Google Chrome security bypass
CVE-2020-6435
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179193

Google Chrome devtools code execution
CVE-2020-6434
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179192

Google Chrome security bypass
CVE-2020-6433
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179191

Google Chrome security bypass
CVE-2020-6432
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179190

Google Chrome security bypass
CVE-2020-6456
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179189

Google Chrome V8 code execution
CVE-2020-6430
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179188

Google Chrome WebSQL information disclosure
CVE-2020-6455
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179187

Google Chrome audio code execution
CVE-2020-6423
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179186

Google Chrome security bypass
CVE-2020-6431
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179184

Google Chrome extensions code execution
CVE-2020-6454
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179183 

==================================================================== 

+ 보안이슈 - 러시아 마트료시카 인형과 닮은 안드로이드 멀웨어 캠페인 발견돼 외 2건

 1. 러시아 마트료시카 인형과 닮은 안드로이드 멀웨어 캠페인 발견돼
드로퍼를 네 번 다운로드 받는 엑스헬퍼 캠페인이 최근 안드로이드 환경에서 나타남.
가장 마지막에 다운로드 되는 건 트리아다라는 멀웨어.
공장 초기화 해도 삭제되지 않아, 장비 리플래시를 하든가 펌웨어를 다른 것으로 대체해야 함.
출처: 보안뉴스 https://www.boannews.com/media/view.asp?idx=87472

 2. 2020년 1분기, 코로나 이슈 악용한 ‘랜섬웨어’ 공격 다수 포착
알약 2020년 1분기 랜섬웨어 차단 통계 공개… 총 18만 5,105건, 일평균 2,057건 공격 차단
‘코로나19’ 키워드 활용한 공격 다수 포착, 이외 기존 소디노키비·넴티 랜섬웨어 지속 유포 중
재택근무 확산에 따라 재택근무 단말기 OS, SW 보안 업데이트 점검, 임직원 대상 온라인 교육 병행 필요
출처: 보안뉴스 https://www.boannews.com/media/view.asp?idx=87454

 3. 인기 디지털 지갑 애플리케이션 키링, 수백만 사용자 정보 노출
인기 높은 디지털 지갑 프로그램 키링, 일찌감치 GDPR 때문에 유럽 시장 포기한 회사.
아니나 다를까, S3 버킷 설정 잘못해 각종 민감한 정보 대량으로 노출시키고 있었음.
그나마 조치를 취해 빠르게 닫긴 했지만, 최소 1달 반 이상은 열린 상태였음.
출처: 보안뉴스 https://www.boannews.com/media/view.asp?idx=87453

====================================================================