@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
September 6, 2012=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 36
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 8/29/2012 - 9/5/201
============================================================TOP VULNERABILITY THIS WEEK: A posting from Anonymous, using old LulzSec imagery to evoke images of the latter group's rampage of high-profile break-ins last year, leaked 1 million Apple UDIDs - unique identifiers which, in many cases, can be tied in with personal details from social networks to pinpoint a specific person and their daily activities. The poster claimed that the UDIDs were part of a group of 12 million identifiers found in an insecure FBI database. Privacy advocates of all stripes are raising new concerns, from government tracking to inept use of UDIDs in games leading to massive information disclosure.
******************** Sponsored By Oracle ********************Simplifying Identity Management: SANS Product Review of Oracle Identity
Governance Solutions by Senior SANS Analyst, Dave Shackleford. Thursday,
September 27, 2012, 9 am Pacific/12 Noon Eastern
http://www.sans.org/info/112772
TRAINING UPDATE
**Featured Conference 1: National Cybersecurity Innovation Conference,
Oct 3-5, Baltimore - featuring briefings by and exhibits all the vendors
that have tools for automating the 20 critical controls and for
continuous monitoring.
http://www.sans.org/ncic-2012
**Featured Conference 2: The IT Security Automation Conference (ITSAC)
Oct 3-5, Baltimore - featuring DHS and other government leaders
providing a clear picture of the changes coming in federal cybersecurity
- - - especially in cloud and continuous monitoring. Not to miss. We try
never to promote conferences where SANS doesn't control the program, but
is an exception because the DHS and NIST folks have done a great job!
https://itsac.g2planet.com/itsac2012/
- --SANS Capital Region Fall 2012 September 6-11 and October 15-20, 2012
http://www.sans.org/capital-region-fall-2012/
- --SANS Crystal City 2012 Arlington, VA September 6-11, 2012
4 courses. Bonus evening presentations include SIFT Workstation: The Art of Incident Response.
http://www.sans.org/crystal-city-2012/
- --SANS Baltimore 2012 October 15-20, 2012
6 courses. Bonus evening presentations include Infosec Rock Star: How
to be a More Effective Security Professional.
http://www.sans.org/baltimore-2012/
- --SANS Network Security 2012, Las Vegas, NV September 16-24, 2012
44 courses. Bonus evening presentations include Evolving Threats; New
Legal Methods for Collecting and Authenticating Cyber Investigation
Evidence; and Intrusion Detection is Dead.
http://www.sans.org/network-security-2012/
- --SANS Forensics Prague 2012 Prague, Czech Republic October 7-13, 2012
7 courses. Bonus evening presentations include Big Brother Forensics:
Location-based Artifacts.
http://www.sans.org/forensics-prague-2012/
- --SANS Singapore 2012 Singapore, Singapore October 8-20, 2012
5 courses, including the new Virtualization and Private Cloud Security
course, and Advanced Forensics and Incident Response.
Don't miss this opportunity to upgrade your IT skills, work toward your
GIAC security certification, and network with other top information
security professionals.
http://www.sans.org/singapore-sos-2012/
- --SANS Seattle 2012 Seattle, WA October 14-19, 2012
5 courses. Bonus evening presentations include What's New in Windows 8
and Server 2012?; Assessing Deception; and Linux Forensics for Non-Linux Folks.
http://www.sans.org/seattle-2012/
- --SANS Chicago 2012 Chicago, IL October 27-November 5, 2012
10 courses. Bonus evening presentations include Securing the Kids and
Securing the Human.
http://www.sans.org/chicago-2012/
- --SANS London 2012 London, UK November 26-zdecember 3, 2012
16 courses.
http://www.sans.org/london-2012/
- --Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus Melbourne, Dubai, San Diego, Johannesburg, Seoul, and Tokyo all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************* Sponsored Links: *********************1) "New Analyst Paper in the SANS Reading Room! Secure Configuration
Management Demystified, by senior SANS Analyst Dave Shackleford"
http://www.sans.org/info/112782
2) SANS Analyst Webcast! Monitoring is Nothing without the Ability to
Respond: Using the Principles of Continuous Monitoring for Threat
Modeling and Response, Thursday, October 11, 1 PM EST, featuring SANS
executive leadership course instructor and federal expert, G. Mark Hardy
and Tiffany Jones, senior manager of products at Symantec.
http://www.sans.org/info/112787
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Anonymous Apple UDID Device Leak
Description: A posting from Anonymous, using old LulzSec imagery to
evoke images of the latter group's rampage of high-profile break-ins
last year, leaked 1 million Apple UDIDs - unique identifiers which, in
many cases, can be tied in with personal details from social networks
to pinpoint a specific person and their daily activities. The poster
claimed that the UDIDs were part of a group of 12 million identifiers
found in an insecure FBI database.
Reference: http://pastebin.com/nfVT7b0Z
http://thenextweb.com/apple/2012/09/04/heres-check-apple-device-udid-compromised-antisec-leak/
http://techcrunch.com/2012/09/04/apple-udid-leak-theres-no-proof-yet-of-fbi-involvement-but-heres-why-you-should-still-care/
Snort SID: N/A
ClamAV: N/A
Title: DistTrack/Shamoon attacks spreading
Description: The massively destructive targeted malware known either as
DistTrack or Shamoon, surmised by many to have been responsible for the
recent network disruption at oil giant Saudi Aramco, is being observed
at other sites in the field, according to security giant Symantec. While
rumors have been circulating of similar attacks within the information
security community, Symantec is the first to publicly announce the
existence of such attacks. Information available to date indicates that
energy companies need be most concerned about this type of an attack,
though for the time being is reach is exceptionally targeted.
Reference: http://www.symantec.com/connect/blogs/shamoon-attacks-continue
http://www.saudiaramco.com/en/home.html#news%257C%252Fen%252Fhome%252Fnews%252Flatest-news%252F2012%252Fsaudi-aramco-restores-network.baseajax.html
http://vrt-blog.snort.org/2012/08/new-threat-disttrack.html
23903, 23905 - 23933
ClamAV: Win.Trojan.DistTrack, Win.Trojan.DistTrack-[1-3]
Title: Bledoor - an interesting new bit of malware tunneling
Description: While analyzing a piece of malware known as Win32.Bledoor,
the Sourcefire VRT recently found an interesting form of IP tunneling,
which was being conducted entirely over DNS. While such tunnel types may
have existed in the past, they are not common, and make the malware in
question particularly noteworthy. If the technique were to become
widespread, IDS analysts would be faced with a unique challenge for
decoding and detecting covert channels.
Reference: http://vrt-blog.snort.org/2012/09/matryoshka-packets.html
Snort SID: 24087, 24088
ClamAV: Trojan.Win32.Bledoor
Title: Java 0-day being used in Blackhole
Description: The popular Blackhole Exploit kit introduced the recently
patched Java 0-day, CVE-2012-4681, to stunning success last week.
Security researchers showed screenshots of live Blackhole tracking pages
with exceptionally high success rates using the new vulnerability, and
reports from around the globe indicated that tens of thousands of new
machines were being compromised thanks in part due to the success rates
of exploitation of the Java bug. While there have been reports that the
patch - issued ahead of Oracle's scheduled patch release with minimal
fanfare - introduced a new vulnerability in the process, that new hole
is unconfirmed and lacks public proof-of-concept, keeping most users
safe, at least for the time being.
Reference: http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html
http://www.deependresearch.org/2012/08/java-7-0-day-vulnerability-information.html
http://1.bp.blogspot.com/-0Q9GWfFkYVc/UD4vWif62VI/AAAAAAAAACY/w6RBjX2VORo/s1600/BH-stats1.png
Snort SID: 24018-24028, 24036-24038, 24055-24058, 24063, 24064, 24065, 24066, 24084, 24085
ClamAV: Java.Exploit.Agent*, WIN.Trojan.Agent-131
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
What was that Wiper thing?
http://www.securelist.com/en/blog/208193808/What_was_that_Wiper_thing
The many faces of Gh0st RAT:
http://www.norman.com/about_norman/press_center/news_archive/2012/the_many_faces_of_gh0st_rat/en/
"First Ever" Mac OSX, Linux Only Password-Sniffing Trojan:
http://www.theregister.co.uk/2012/08/29/linux_mac_trojan/
Sample Blackhole statistics page show Java success:
http://1.bp.blogspot.com/-0Q9GWfFkYVc/UD4vWif62VI/AAAAAAAAACY/w6RBjX2VORo/s1600/BH-stats1.png
Screenshot of US Cyber Command center:
http://www.af.mil/shared/media/photodb/photos/100308-F-0672C-300.jpg
How I cracked over 122 million SHA1 and MD5 hashed passwords:
http://blog.thireus.com/cracking-story-how-i-cracked-over-122-million-sha1-and-md5-hashed-passwords
Android malware masquerading as Flash players:
http://news.techworld.com/security/3378127/cybercriminals-exploiting-android-flash-player-gap-on-google-play/
A novel way of detecting malicious PDF documents:
http://secdiary.com/article/novel-detection-malicious-pdf-javascript/
All your PostgreSQL databases are belong to us:
http://www.agarri.fr/kom/archives/2012/08/28/all_your_postgresql_databases_are_belong_to_us/index.html
How I cracked my neighbor's Wifi password without breaking a sweat:
http://arstechnica.com/security/2012/08/wireless-password-easily-cracked/
The smartphone who loved me: FinFisher goes mobile?
https://citizenlab.org/2012/08/the-smartphone-who-loved-me-finfisher-goes-mobile/
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Vendor: Oracle
Description: Oracle Java 7 Update 6, and possibly other versions, allows
remote attackers to execute arbitrary code via a crafted applet, as
exploited in the wild in August 2012 using Gondzz.class and
Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
ID: : CVE-2012-1535
Title: Adobe Flash Player 11.3 Font Parsing Code Execution
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Flash Player before
11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux
allows remote attackers to execute arbitrary code or cause a denial of
service (application crash) via crafted SWF content, as exploited in the
wild in August 2012 with SWF content in a Word document.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-3579
Title: Symantec Messaging Gateway SSH Default Password Security Bypass Vulnerability
Vendor: Symantec
Description: Symantec Messaging Gateway before 10.0 has a default
password for an unspecified account, which makes it easier for remote
attackers to obtain privileged access via an SSH session.
CVSS v2 Base Score: 7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-4577
Title: Korenix Jetport 5600 Series Default Credentials Authentication Bypass Vulnerability
Vendor: Korenix
Description: The Linux firmware image on (1) Korenix Jetport 5600 series
serial-device servers and (2) ORing Industrial DIN-Rail serial-device
servers has a hardcoded password of "password" for the root account,
which allows remote attackers to obtain administrative access via an SSH session.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-3951
Title: Scrutinizer NetFlow and sFlow Analyzer 9 Default MySQL Credential
Vendor: Plixer
Description: The MySQL component in Plixer Scrutinizer (aka Dell
SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password
of admin for the (1) scrutinizer and (2) scrutremote accounts, which
allows remote attackers to execute arbitrary SQL commands via a TCP
session.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
MOST POPULAR MALWARE FILES 8/29/2012 - 9/5/201:
COMPILED BY SOURCEFIRE
Typical Filename: MWSSVC.EXE
Claimed Product: My Web Search Bar
Claimed Publisher: MyWebSearch.com
SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Malwr: http://malwr.com/analysis/7961a56c11ba303f20f6a59a506693ff
Typical Filename: file-4435098_exe
Claimed Product: My Web Search Bar for Internet Explorer and FireFox
Claimed Publisher: MyWebSearch.com
SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Malwr: http://malwr.com/analysis/923c4d13bee966654f4fe4a8945af0ae
Typical Filename: winvbokexe
Claimed Product: winvbokexe
Claimed Publisher: winvbokexe
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Malwr: http://malwr.com/analysis/25aa9bb549ecc7bb6100f8d179452508
Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Malwr: http://malwr.com/analysis/bf31a8d79f704f488e3dbcb6eea3b3e3
Typical Filename: lmlkl.sys
Claimed Product: lmlkl.sys
Claimed Publisher: lmlkl.sys
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
