@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
August 9, 2012=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 32
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 8/1/2012 - 8/7/2012
============================================================TOP VULNERABILITY THIS WEEK: New variants of the popular Gozi keylogging trojan, a favorite of cybercriminals intent on stealing banking credentials and other sensitive data since 2005, have been observed in the wild over the past week. The trojan has been successful over the years by continually morphing in an effort to evade IDS and AV systems, and the latest variant does exactly that.
******************** Sponsored By SANS ********************Special Webcast: A Look at Exploiting Windows 7 and Windows 8. Tuesday, August 14, 2012 at 1:00 PM EDT featuring Stephen Sims. In this one hour presentation we will take a look at the various exploit mitigation controls added to the Windows 7 and Windows 8 operating systems, and the techniques used to deal with these controls as a penetration tester.
http://www.sans.org/info/111239
TRAINING UPDATE
- --SANS Boston 2012 Boston, MA August 6-11, 2012
8 courses. Bonus evening presentations include SIFT Workstation: The Art
of Incident Response; and Everything I Know is Wrong! How to Lead a
Security Team in a Time of Unprecedented Change and Challenge.
http://www.sans.org/boston-2012/
- --SCADA Security Advanced Training 2012, The Woodlands, TX August 20-24, 2012
http://www.sans.org/scada-sec-training-2012/
- --SANS Virginia Beach 2012 Virginia Beach, VA August 20-31, 2012
10 courses. Bonus evening presentations include Information Assurance
Metrics: Practical Steps to Measurement; and Who's Watching the Watchers?
http://www.sans.org/virginia-beach-2012/
- --SANS Capital Region Fall 2012 September 6-11 and October 15-20, 2012
http://www.sans.org/capital-region-fall-2012/
- --SANS Crystal City 2012 Arlington, VA September 6-11, 2012
6 courses. Bonus evening presentations include SIFT Workstation: The Art of Incident Response.
http://www.sans.org/crystal-city-2012/
- --SANS Baltimore 2012 October 15-20, 2012
6 courses. Bonus evening presentations include Infosec Rock Star: How to be a More Effective Security Professional.
http://www.sans.org/baltimore-2012/
- --SANS Network Security 2012, Las Vegas, NV September 16-24, 2012
45 courses. Bonus evening presentations include Evolving Threats; New Legal Methods for Collecting and Authenticating Cyber Investigation Evidence; and Intrusion Detection is Dead.
http://www.sans.org/network-security-2012/
- --SANS Singapore 2012 Singapore, Singapore October 8-20, 2012
5 courses, including the new Virtualization and Private Cloud Security course, and Advanced Forensics and Incident Response.
Don't miss this opportunity to upgrade your IT skills, work toward your GIAC security certification, and network with other top information security professionals.
http://www.sans.org/singapore-sos-2012/
- --SANS Seattle 2012 Seattle, WA October 14-19, 2012
6 courses. Bonus evening presentations include What's New in Windows 8 and Server 2012?; Assessing Deception; and Linux Forensics for Non-Linux Folks.
http://www.sans.org/seattle-2012/
- --SANS Chicago 2012 Chicago, IL October 27-November 5, 2012
10 courses. Bonus evening presentations include Securing the Kids and Securing the Human.
http://www.sans.org/chicago-2012/
- --Looking for training in your own community?
http://www.sans.org/community/
- - - --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus San Antonio, Melbourne, Prague, Dubai, and Johannesburg all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Link: *********************1) Take the SANS 2nd Survey on BYOD Security Policy and WIN Cash Prizes!
http://www.sans.org/info/111244
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Malvertising Campaign Uses Novel iframe Hiding Technique
Description: Hidden HTML iframes are a common hallmark of malicious web
content. The Sourcefire VRT recently observed a widespread malvertising
campaign in the wild which was employing a novel method for hiding its
malicious iframe, which was designed to evade existing IDS and AV techniques.
Reference: http://vrt-blog.snort.org/2012/08/stupid-css-tricks.html
Snort SID: 23618
ClamAV: N/A
Title: Gozi Trojan Continues To Spread In The Wild
Description: The Sourcefire VRT has observed new variants of the Gozi
keylogging trojan spreading in the wild this week. This trojan, which
has been stealing banking credentials and other valuable user data since
2005, has continued to prove effective in the field due to its
constantly shifting behavior and intelligent evasion methods. The
iteration currently being observed in the field has subtle differences
from the most recent variants, but is different enough to warrant
updated coverage by many IDS and AV tools.
Reference: http://www.virustotal.com/file/a6b6642b2cc6386d71c90c0a6bb27f873e13fa940f8bd568515515471f74b152/analysis/
http://en.wikipedia.org/wiki/Gozi_(Trojan_horse)
Snort SID: 23635
ClamAV: Trojan.Agent-303654
Title: Apache Struts Java Framework Remote Code Executin
Description: The Apache Struts framework, a popular plugin for deploying
Java-based web applications, is vulnerable to a remote code execution
attack. Specifically, the ExceptionDelegator component, when handling
certain input values, can be fooled into simply executing arbitrary Java
code. Public exploit code exists, and the Sourcefire VRT has seen signs
of the bug being exploited in the wild. Administrators are urged to
patch their systems promptly.
Reference: http://issues.apache.org/jira/browse/WW-3668
http://www.exploit-db.com/exploits/18329/
Snort SIDs: 21072, 21073, 23631
ClamAV: N/A
Title: Blackhole Exploit Kit JavaScript Evasion Methods Evolving
Description: One of the reasons the Blackhole Exploit Kit is so popular
among cybercriminals is that it is constantly updated to evade
detection. The Sourcefire VRT has observed a recent update in the field,
which targets some of the keys previously used for IDS detection. While
old signatures are still useful, as many versions of the kit exist in
the wild, new signatures have been created to handle the latest
revision.
Reference: http://sophosnews.files.wordpress.com/2012/03/blackhole_paper_mar2012.pdf
http://en.wikipedia.org/wiki/Blackhole_exploit_kit
Snort SIDs: 23619, 23622, 23781, 23785, 23786
ClamAV: Trojan.Blackhole-507
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Harvesting data on the Xarvester Botmaster:
http://krebsonsecurity.com/2012/08/harvesting-data-on-the-xarvester-botmaster/
Android DNS poisoning: Randomness gone bad (CVE-2012-2808):
http://blog.watchfire.com/wfblog/2012/07/android-dns-poisoning-randomness-gone-bad-cve-2012-2808.html
NinjaTel, the hacker cellphone network
http://www.robotskirts.com/2012/08/02/ninjatel-the-hacker-cellphone-network/
File that is simultaneously a valid PE/PDF/HTML/JAR:
http://code.google.com/p/corkami/downloads/detail?name=CorkaMIX.zip
- From 0 permission app to INSTALL_PACKAGES on Samsung Galaxy S3:
http://sh4ka.fr/android/galaxys3/from_0perm_to_INSTALL_PACKAGES_on_galaxy_S3.html
Anatomy of a targeted attack:
http://blog.accuvantlabs.com/blog/jhorne/anatomy-targeted-attack
How malware employs anti-debugging, anti-disassembly, and anti-virtualization technologies:
https://community.qualys.com/blogs/securitylabs/2012/07/30/how-malware-employs-anti-debugging-anti-disassembly-and-anti-virtualization-technologies
Snort User Defined Language (UDL) in Notepad++
http://www.tropismgroup.org/2012/08/02/snort-user-defined-language-udl-in-notepad/
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2012-3020
Title: Siemens Synco OZW Insecure Default Password Vulnerability
Vendor: Siemens
Description: The Siemens Synco OZW Web Server devices OZW672.*,
OZW772.*, and OZW775 with firmware before 4 have an unspecified default
password, which makes it easier for remote attackers to obtain
administrative access via a network session.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: CVE-2012-0549
Title: Oracle AutoVue ActiveX Control SetMarkupMode Buffer Overflow
Vendor: Oracle
Description: Unspecified vulnerability in the Oracle AutoVue Office
component in Oracle Supply Chain Products Suite 20.0.2 allows remote
attackers to affect confidentiality, integrity, and availability,
related to Desktop API.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: CVE-2012-3951
Title: Scrutinizer Default Password Security Bypass Vulnerability
Vendor: Plixer
Description: The MySQL component in Plixer Scrutinizer (aka Dell
SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password
of admin for the (1) scrutinizer and (2) scrutremote accounts, which
allows remote attackers to execute arbitrary SQL commands via a TCP
session.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: CVE-2010-3964
Title: Microsoft Office SharePoint Server 2007 Remote Code Execution
Vendor: Microsoft
Description: Unrestricted file upload vulnerability in the Document
Conversions Launcher Service in Microsoft Office SharePoint Server 2007
SP2, when the Document Conversions Load Balancer Service is enabled,
allows remote attackers to execute arbitrary code via a crafted SOAP
request to TCP port 8082, aka "Malformed Request Code Execution
Vulnerability."
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: CVE-2012-1723
Title: Oracle Java SE Remote Code Execution Vulnerability / Blackhole Exploit Kit
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32
and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows
remote attackers to affect confidentiality, integrity, and availability
via unknown vectors related to Hotspot.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
MOST POPULAR MALWARE FILES 8/1/2012 - 8/7/2012:
COMPILED BY SOURCEFIRE
SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Typical Filename: C8A787C22000AE378610003396E67500D587FA4E.exe
Claimed Product: My Web Search Bar for Internet Explorer and FireFox
Claimed Publisher: MyWebSearch.com
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: avz00001.dta
Claimed Product: avz00001.dta
Claimed Publisher: avz00001.dta
SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Typical Filename: winoaox.exe
Claimed Product: winoaox.exe
Claimed Publisher: winoaox.exe
SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Typical Filename: bf31a8d79f704f488e3dbcb6eea3b3e3
Claimed Product: bf31a8d79f704f488e3dbcb6eea3b3e3
Claimed Publisher: bf31a8d79f704f488e3dbcb6eea3b3e3
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
