@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
August 16, 2012=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 33
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 8/8/2012 - 8/14/2012
============================================================TOP VULNERABILITY THIS WEEK: A potentially state-sponsored, targeted banking trojan platform named Gauss was discovered by Kaspersky Labs late last week. The payload of this malware has yet to be decoded, though C&C servers around the world have been sinkholed to prevent further damage. While limited in scope, comparisons to Flame have people around the world concerned.
******************** Sponsored By SANS ********************Analyst Webcast: When Breaches Happen: 5 Questions to Prepare For,
featuring Senior SANS Analyst Dave Shackleford, Wednesday, August 29 at
a special time of Noon EDT.
http://www.sans.org/info/111999
TRAINING UPDATE
- --SCADA Security Advanced Training 2012, The Woodlands, TX August 20-24, 2012
http://www.sans.org/scada-sec-training-2012/
- --SANS Virginia Beach 2012 Virginia Beach, VA August 20-31, 2012
10 courses. Bonus evening presentations include Information Assurance
Metrics: Practical Steps to Measurement; and Who's Watching the Watchers?
http://www.sans.org/virginia-beach-2012/
- --SANS Capital Region Fall 2012 September 6-11 and October 15-20, 2012
http://www.sans.org/capital-region-fall-2012/
- --SANS Crystal City 2012 Arlington, VA September 6-11, 2012
4 courses. Bonus evening presentations include SIFT Workstation: The Art
of Incident Response.
http://www.sans.org/crystal-city-2012/
- --SANS Baltimore 2012 October 15-20, 2012
6 courses. Bonus evening presentations include Infosec Rock Star: How
to be a More Effective Security Professional.
http://www.sans.org/baltimore-2012/
- --SANS Network Security 2012, Las Vegas, NV September 16-24, 2012
44 courses. Bonus evening presentations include Evolving Threats; New
Legal Methods for Collecting and Authenticating Cyber Investigation
Evidence; and Intrusion Detection is Dead.
http://www.sans.org/network-security-2012/
- --SANS Forensics Prague 2012 Prague, Czech Republic October 7-13, 2012
7 courses. Bonus evening presentations include Big Brother Forensics:
Location-based Artifacts.
http://www.sans.org/forensics-prague-2012/
- --SANS Singapore 2012 Singapore, Singapore October 8-20, 2012
5 courses, including the new Virtualization and Private Cloud Security
course, and Advanced Forensics and Incident Response.
Don't miss this opportunity to upgrade your IT skills, work toward your
GIAC security certification, and network with other top information
security professionals.
http://www.sans.org/singapore-sos-2012/
- --SANS Seattle 2012 Seattle, WA October 14-19, 2012
6 courses. Bonus evening presentations include What's New in Windows 8
and Server 2012?; Assessing Deception; and Linux Forensics for Non-Linux Folks.
http://www.sans.org/seattle-2012/
- --SANS Chicago 2012 Chicago, IL October 27-November 5, 2012
10 courses. Bonus evening presentations include Securing the Kids and
Securing the Human.
http://www.sans.org/chicago-2012/
- --Looking for training in your own community?
http://www.sans.org/community/
- - - --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus Melbourne, Dubai, San Diego, and Johannesburg all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Link: *********************1) Secure Configuration Management Demystified, sponsored by Tripwire
Tuesday, August 28 at 1 PM EDT.
http://www.sans.org/info/112004
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Gauss Malware Platform Discovered in Lebanon
Description: Kaspersky Labs published a report late last week about a
new malware platform they've dubbed Gauss, which targets users in
Lebanon and other parts of the Middle East and attempts to steal
credentials for a variety of instant messaging, email, social
networking, and banking systems. Gauss was similar to Flame in many
ways, and as such is being attributed to nation-state actors. On
Tuesday, Kaspersky appealed to cryptographers worldwide for help in
decrypting its payload, which could prove very interesting if it
contains links to SCADA systems or other Flame-related targets.
Reference: http://vrt-blog.snort.org/2012/08/gauss-finfisher-latest-targeted-malware.html
http://www.securelist.com/en/blog/208193767/Gauss_Nation_state_cyber_surveillance_meets_banking_Trojan
http://www.securelist.com/en/blog/208193781/The_Mystery_of_the_Encrypted_Gauss_Payload
Snort SID: 23799 - 23804, 23824
ClamAV: W32.Trojan.Gauss-[1-15]
Title: FinFisher Lawful Intercept Malware Used Outside of Law Enforcement
Description: German company Gamma International produces surveillance
software named FinFisher, and has targeted it to governments and law
enforcement for lawful intercept purposes. The software recently
appeared in phishing attacks against activists in Bahrain, despite
ardent claims by its manufacturer that it had not been sold there. While
the scope of the attack is limited, it sets a disturbing precedent of
powerful surveillance software falling into the wrong hands.
Reference: https://community.rapid7.com/community/infosec/blog/2012/08/08/finfisher
Snort SID: 23825, 23826
ClamAV: Trojan.FinFisher
Title: Non-Alphanumeric JavaScript Packer
Description: A tool was recently released to encode JavaScript using
only the following characters: "()[]{}!+". While it has yet to be
observed in the wild, advances in JavaScript evasion technologies
invariably find their way into the hands of malicious actors, and there
is no reason that this tool or a variation thereof will be an exception.
The Sourcefire VRT will be closely monitoring samples of obfuscated
JavaScript in the wild, looking for signs that this technique is being
incorporated into exploit kits or the like.
Reference: http://patriciopalladino.com/blog/2012/08/09/non-alphanumeric-javascript.html
Snort SIDs: 23831, 23832
ClamAV: N/A
Title: Microsoft Windows Common Control Tabstrip ActiveX Remote Code Execution
Description: A memory corruption vulnerability exists in the Microsoft
Windows Tabstrip ActiveX control, which is part of the Windows Common
Control set (and is thus built into Windows by default). According to
Microsoft, targeted attacks have been observed in the wild, though to
date no exploit code or proof-of-concept has been made public. As
ActiveX vulnerabilities are typically very straightforward to exploit,
extensive exploitation in the field is likely in the near term.
Reference: http://technet.microsoft.com/en-us/security/bulletin/ms12-060
Snort SIDs: 23844,23845
ClamAV: Win.Exploit.CVE_2012_1856
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Microsoft defense that fetched $50,000 bypassed in just 2 weeks:
http://arstechnica.com/security/2012/08/microsoft-defense-bypassed-in-2-weeks/
The race against risk #3: malware hosting:
http://blog.sourcefire.com/2012/08/the-race-against-risk-3-malware-hosting.html
Emulating C&C servers for machine identification and eradication:
http://blog.accuvantlabs.com/blog/gnewman/emulating-cc-servers-machine-identification-eradication
Video: hardening Windows processes:
http://blog.didierstevens.com/2012/08/08/video-hardening-windows-processes/
How Apple and Amazon security flaws led to my epic hacking:
http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/
Seeing through walls with a wireless router:
http://zen-haven.dk/seeing-through-walls-with-a-wireless-router/
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: : CVE-2012-1856
Title: Vulnerability in Windows Common Controls Could Allow Remote Code Execution (MS12-060)
Vendor: Microsoft
Description: Microsoft Windows Common Controls are ActiveX controls
contained in the MSCOMCTL.OCX file. Windows Common Controls is prone to
a remote code execution vulnerability.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-1535
Title: Vulnerability in Adobe Flash Player Allows Remote Code Execition (APSB12-18)
Vendor: Adobe
Description: Adobe has released security updates for Adobe Flash Player
11.3.300.270 and earlier versions for Windows, Macintosh and Linux which
address a vulnerability (CVE-2012-1535) that could cause the application
to crash and potentially allow an attacker to take control of the
affected system. There are reports that the vulnerability is being
exploited in the wild in limited targeted attacks, distributed through
a malicious Word document.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-3951
Title: Scrutinizer NetFlow and sFlow Analyzer 9 Default MySQL Credential
Vendor: Plixer
Description: The MySQL component in Plixer Scrutinizer (aka Dell
SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password
of admin for the (1) scrutinizer and (2) scrutremote accounts, which
allows remote attackers to execute arbitrary SQL commands via a TCP
session.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: : CVE-2009-1730
Title: NetDecision 4.2 TFTP Writable Directory Traversal Execution
Vendor: NetMechanica
Description: Multiple directory traversal vulnerabilities in
NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read
or modify arbitrary files via directory traversal sequences in the (1)
GET or (2) PUT command.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) (legend)
ID: : CVE-2012-3020
Title: Siemens Synco OZW Insecure Default Password Vulnerability
Vendor: Siemens
Description: The Siemens Synco OZW Web Server devices OZW672.*, OZW772.*, and OZW775 with firmware before 4 have an unspecified default password, which makes it easier for remote attackers to obtain administrative access via a network session.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: : CVE-2012-0549
Title: Oracle AutoVue ActiveX Control SetMarkupMode Buffer Overflow
Vendor: Oracle
Description: Unspecified vulnerability in the Oracle AutoVue Office
component in Oracle Supply Chain Products Suite 20.0.2 allows remote
attackers to affect confidentiality, integrity, and availability,
related to Desktop API.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
MOST POPULAR MALWARE FILES 8/8/2012 - 8/14/2012:
COMPILED BY SOURCEFIRE
SHA 256: 1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442
MD5: bb74024a1d4e4808562c090980151653
VirusTotal: https://www.virustotal.com/file/1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442/analysis/
Typical Filename: MWSSVC.EXE
Claimed Product: My Web Search Bar
Claimed Publisher: MyWebSearch.com
SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Typical Filename: winapuwf.exe
Claimed Product: winapuwf.exe
Claimed Publisher: winapuwf.exe
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: avz00001.dta
Claimed Product: avz00001.dta
Claimed Publisher: avz00001.dta
SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Typical Filename: lnjoi.sys
Claimed Product: lnjoi.sys
Claimed Publisher: lnjoi.sys
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
