@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
September 20, 2012=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 38
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 9/11/2012 - 9/18/2012
============================================================TOP VULNERABILITY THIS WEEK: A zero-day vulnerability in Internet Explorer 6, 7, 8 and 9 allows remote attackers to execute arbitrary code in the context of the current user. This impacts a large number of systems spanning from Windows XP to Windows 7. There are indications that exploits are already being used by criminals in the wild.
============================================================TRAINING UPDATE
**Featured Conference 1: National Cybersecurity Innovation Conference,
Oct 3-5, Baltimore
- featuring briefings by and exhibits all the vendors
that have tools for automating the 20 critical controls and for
continuous monitoring.
www.sans.org/ncic-2012
**Featured Conference 2: The IT Security Automation Conference (ITSAC)
Oct 3-5, Baltimore
- featuring DHS and other government leaders
providing a clear picture of the changes coming in federal cybersecurity
- - especially in cloud and continuous monitoring. Not to miss. We try
never to promote conferences where SANS doesn't control the program, but
is an exception because the DHS and NIST folks have done a great job!
https://itsac.g2planet.com/itsac2012/
--SANS Capital Region Fall 2012
http://www.sans.org/capital-region-fall-2012/
--SANS Baltimore 2012 October 15-20, 2012
6 courses. Bonus evening presentations include Infosec Rock Star: How
to be a More Effective Security Professional.
http://www.sans.org/baltimore-2012/
--SANS Network Security 2012, Las Vegas, NV September 16-24, 2012
43 courses. Bonus evening presentations include Evolving Threats; New
Legal Methods for Collecting and Authenticating Cyber Investigation
Evidence; and Intrusion Detection is Dead.
http://www.sans.org/network-security-2012/
--SANS Forensics Prague 2012 Prague, Czech Republic October 7-13, 2012
6 courses. Bonus evening presentations include Big Brother Forensics:
Location-based Artifacts.
http://www.sans.org/forensics-prague-2012/
--SANS Singapore 2012 Singapore, Singapore October 8-20, 2012
5 courses, including the new Virtualization and Private Cloud Security
course, and Advanced Forensics and Incident Response.
Don't miss this opportunity to upgrade your IT skills, work toward your
GIAC security certification, and network with other top information
security professionals.
http://www.sans.org/singapore-sos-2012/
--SANS Seattle 2012 Seattle, WA October 14-19, 2012
5 courses. Bonus evening presentations include What's New in Windows 8
and Server 2012?; Assessing Deception; and Linux Forensics for Non-Linux Folks.
http://www.sans.org/seattle-2012/
--SANS Chicago 2012 Chicago, IL October 27-November 5, 2012
9 courses. Bonus evening presentations include Securing the Kids and Securing the Human.
http://www.sans.org/chicago-2012/
--SANS London 2012 London, UK November 26-December 3, 2012
16 courses.
http://www.sans.org/london-2012/
--SANS Cyber Defense Initiative ® 2012 Washington, DC December 7-16, 2012
28 courses. Bonus evening presentations include Gamification: Hacking
Your Brain for Better Learning; Building a Portable Private Cloud; and
Tactical SecOps: A Guide to precision Security Operations.
http://www.sans.org/event/cyber-defense-initiative-2012
--Looking for training in your own community?
http://www.sans.org/community/
--Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus Dubai, San Diego, Johannesburg, Seoul, Tokyo, and Barcelona all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
============================================================NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Internet Explorer use-after-free 0-day vulnerability
Description: A new vulnerability has been discovered that affects
Internet Explorer 6, 7, 8 and 9 on Windows XP, Vista, 7, Windows Server
2003 and 2008 and is being actively exploited in the wild. The
vulnerability is a "use-after-free" and allows remote attackers to
execute arbitrary code in the context of the current user. As
information related to this vulnerability is widely available, and given
that a module has been released for the Metasploit framework, we
encourage users to use Microsoft's Enhanced Mitagation Experience
Toolkit or even better, consider not using Internet Explorer (or
applications that make use of Internet Explorer) on the affected
platforms until a patch is released.
Reference: http://technet.microsoft.com/en-us/security/advisory/2757760
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4969
http://vrt-blog.snort.org/2012/09/internet-explorer-use-after-free-0-day.html
Snort SID: 24210, 24212
ClamAV: JS.Exploit.CVE_2012_4969
Title: CVE-2012-4681 - Java vulnerability still actively exploited in the wild
Description: While this vulnerability has been disclosed a few weeks ago
and has been patched more recently, we want to still bring attention to
this vulnerability as it is a given that not all installations of Java
have been patched. The vulnerability has been ported to Metasploit, and
rolled into the popular Blackhole exploit kit. The Sourcefire VRT has
observed active in-the-wild exploitation and the nature of the bug will
make it a low hanging fruit for cybercriminals looking to target
unpatched machines. Users are urged to patch immediately.
Reference: http://schierlm.users.sourceforge.net/CVE-2012-1723.html
http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html
Snort SID: 24018-24028, 24036-24038
ClamAV: Java.Exploit.Agent, Java.Exploit.Agent-[1-2], WIN.Trojan.Agent-131
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
New Metasploit module: Internet Explorer use-after-free vulnerability CVE-2012-4969
http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/ie_execcommand_uaf.rb
Analyzing malware through the Atom Tables with Volatility
http://volatility-labs.blogspot.com/2012/09/movp-21-atoms-new-mutex-classes-and-dll.html
Intel SMEP overview and partial bypass on Windows 8
http://www.ptsecurity.com/download/SMEP_overview_and_partial_bypass_on_Windows_8.pdf
Full Analysis of Flame's C&C servers
http://www.securelist.com/en/blog/750/Full_Analysis_of_Flame_s_Command_Control_servers
Tutorial on Anti-Debugging Techniques
http://thelegendofrandom.com/blog/sample-page
Possible Update to the Blackhole Exploit Kit
http://blog.fireeye.com/research/2012/09/new-evasions-and-blackhole-20.html
Modified Enfal Variants Compromise 874 systems
http://blog.trendmicro.com/modified-enfal-variants-compromised-874-systems/
Dancing Penguins - A Case of Organized Android Pay Per Install
http://blog.eset.com/2012/09/12/dancing-penguins-a-case-of-organized-android-pay-per-install
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: : US-CERT VU#480095
Title: Microsoft Internet Explorer 7/8/9 contain a use-after-free vulnerability
Vendor: Microsoft
Description: Microsoft Internet Explorer versions 7, 8, and 9 are
susceptible to a use-after-free vulnerability that may result in remote
code execution.
CVSS v2 Base Score: 9.7 (AV:N/AC:L/Au:N/C:C/I:C/A:P)
ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Vendor: Oracle
Description: Oracle Java 7 Update 6, and possibly other versions, allows
remote attackers to execute arbitrary code via a crafted applet, as
exploited in the wild in August 2012 using Gondzz.class and
Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
ID: : CVE-2012-1535
Title: Adobe Flash Player 11.3 Font Parsing Code Execution
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Flash Player before
11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux
allows remote attackers to execute arbitrary code or cause a denial of
service (application crash) via crafted SWF content, as exploited in the
wild in August 2012 with SWF content in a Word document.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-3579
Title: Symantec Messaging Gateway SSH Default Password Security Bypass Vulnerability
Vendor: Symantec
Description: Symantec Messaging Gateway before 10.0 has a default
password for an unspecified account, which makes it easier for remote
attackers to obtain privileged access via an SSH session.
CVSS v2 Base Score: 7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-4577
Title: Korenix Jetport 5600 Series Default Credentials Authentication Bypass Vulnerability
Vendor: Korenix
Description: The Linux firmware image on (1) Korenix Jetport 5600 series
serial-device servers and (2) ORing Industrial DIN-Rail serial-device
servers has a hardcoded password of "password" for the root account,
which allows remote attackers to obtain administrative access via an SSH
session.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
MOST POPULAR MALWARE FILES 9/11/2012 - 9/18/2012:
COMPILED BY SOURCEFIRE
SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Typical Filename: winhsebb.exe
Claimed Product: winhsebb.exe
Claimed Publisher: winhsebb.exe
SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal: https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/
Typical Filename: activator.exe.xxx
Claimed Product: activator.exe.xxx
Claimed Publisher: activator.exe.xxx
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: 123
Claimed Product: 123
Claimed Publisher: 123
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
