@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
October 18, 2012=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 42
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 10/11/2012 - 10/18/12
============================================================TOP VULNERABILITY THIS WEEK:
The bank DDoS attacks being generated by the ?itsoknoproblembro?
script have continued apace over the last week, with rumors that
defense contractors and others outside the banking industry are to
be targeted soon.
TRAINING UPDATE
- - --SANS Chicago 2012 Chicago, IL October 27-November 5, 2012
9 courses. Bonus evening presentations include Securing the Kids and
Securing the Human.
http://www.sans.org/chicago-2012/
- - --SANS Sydney 2012 Sydney, Australia November 12-20, 2012
5 courses.
http://www.sans.org/event/sydney-2012
- - --SANS San Diego 2012 San Diego, CA November 12-17, 2012
7 courses. Bonus evening presentations include Cloud Computing and the
20 Critical Security Controls; and Practical, Efficient Unix Auditing
(with Scripts).
http://www.sans.org/event/san-diego-2012
- - --SANS London 2012 London November 26-December 3, 2012
16 courses.
http://www.sans.org/london-2012/
- - --SANS Cyber Defense Initiative ® 2012 Washington, DC December 7-16, 2012
28 courses. Bonus evening presentations include Gamification: Hacking
Your Brain for Better Learning; Building a Portable Private Cloud;
and Tactical SecOps: A Guide to precision Security Operations.
http://www.sans.org/event/cyber-defense-initiative-2012
- - --SANS Security East 2013 New Orleans, LA January 16-23, 2013
11 courses. Bonus evening presentations include The Next Wave - Data
Center Consolidation; Top Threats to Cloud for 2013; and Hacking Your
Friends and Neighbors for Fun.
http://www.sans.org/event/security-east-2013
- - --NA SCADA and Process Control Summit 2013 Lake Buena Vista, FL February 6-13, 2013
The Summit brings together the program managers, control systems
engineers, IT security professionals and critical infrastructure
protection specialists from asset owning and operating organizations
along with control systems and security vendors who have innovative
solutions for improving security. The Security Summit is an action
conference designed so that every attendee leaves with new tools and
techniques they can put to work immediately when they return to their
office. The Summit is the place to come and interact with top SCADA
experts, key government personnel, researchers and asset owners at
the multiple special networking events.
http://www.sans.org/event/north-american-scada-2013
- - --Looking for training in your own community?
http://www.sans.org/community/
- - --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus Bangalore, Johannesburg, Seoul, Tokyo, Barcelona, and Cairo all in
the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
1) SANS Webcast: Blind as a Bat? Or Eagle Vision Into Encrypted Packets? With
Dave Shackleford & Tony Zirnoon. Nov 5, 2012.
https://www.sans.org/info/115567
2) SANS Webcast: Why Deception Matters in Today's Web Attacks. With John
Bumgarner & David Koretz. Nov 8, 2012.
https://www.sans.org/info/115572
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: miniFlame cyberespionage malware
Description: A new piece of malware likely used for cyberespionage
has been discovered during an analysis of the Flame command and
control servers. It is called ?miniFlame? due the fact that
it exhibits strong similarities to Flame, another piece of spying
malware discovered earlier in 2012. Flame, along with another piece
of malware called Gauss, have already infected over 10,000 computers
worldwide. While minFlame was found on machines that were already
infected with Flame and Gauss, it has been detected on only a dozen
computers, primarily in the Middle East. This leads us to believe that
miniFlame is part of a targeted attack rather than a broad campaign.
Reference:
https://www.securelist.com/en/analysis/204792247/miniFlame_aka_SPE_Elvis_and_his_friends
http://vrt-blog.snort.org/2012/05/flame-malware-targeted-attacks-and-you.html
http://vrt-blog.snort.org/2012/08/gauss-finfisher-latest-targeted-malware.html
Snort SID: 23019 through 23038, 23824
ClamAV: Worm.Flame.* , W32.Trojan.Gauss.*, WIN.Trojan.MiniFlame.*
Title: ?itsoknoproblembro? and Recent DDoS Attacks
Description: The bank DDoS attacks being generated by the
?itsoknoproblembro? script have continued apace over the last
week, with rumors that defense contractors and others outside the
banking industry are to be targeted soon. As the attacks have worn on,
additional details have come to light about the mechanisms being used,
which are allowing potential targets to better protect themselves.
Specifically, the script in question has been observed in the wild
on compromised web servers with high-bandwidth links, and some of
the patterns being used in the DDoS attacks have come to light as well.
Reference:
http://vrt-blog.snort.org/2012/10/itsoknoproblembro-vrt-has-you-covered.html
Snort SID: 24388 - 24396
ClamAV: PHP.Trojan.itsoknoproblembro*
Title: Multiple Remote Attacks in Steam Browser URIs
Description: A report was released on Monday by a pair of respected
researchers detailing multiple vulnerabilities in the Steam game URI
handler, including potential remote code execution, the ability to
write files to the victim host directly, etc. The researchers strongly
suggest disabling this URI handler until a patch has been issued by
Steam. While attacks have yet to be directly observed in the wild,
the trivial nature of certain types of exploitation all but ensures
that it will be abused soon. Network administrators should consider
Snort SID 24397, which simply blocks all Steam URIs on a given network.
Reference:
http://revuln.com/files/ReVuln_Steam_Browser_Protocol_Insecurity.pdf
Snort SID: 24397
ClamAV: N/A
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
mDNS - Telling the world about you (and your device):
http://blog.spiderlabs.com/2012/10/still-writing-mdns-telling-the-world-about-you-and-your-device.html
Phishing for Apple IDs:
http://community.websense.com/blogs/securitylabs/archive/2012/10/08/my-apple-id-has-been-suspended.aspx
iOS 6 kernel security: a hacker's guide:
http://conference.hackinthebox.org/hitbsecconf2012kul/materials/D1T2%20-%20Mark%20Dowd%20&%20Tarjei%20Mandt%20-%20iOS6%20Security.pdf
Hacking Huawei:
http://conference.hackinthebox.org/hitbsecconf2012kul/materials/D2T3%20-%20Felix%20FX%20Lindner%20-%20Hacking%20Huawei%20VRP.pdf
Spear phishing in action:
http://blog.fireeye.com/research/2012/10/spear-phishing-in-action.html
By fixing a security vulnerability, Facebook created a new one:
http://0xfeedface.org/blog/lattera/2012-10-15/facebook-removes-reverse-phone-lookup-numbers-registered-two-factor
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: : CVE-2012-0507
Title: Oracle Java SE Remote Java Runtime Environment Code Execution
Vulnerability
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30
and earlier, and 5.0 Update 33 and earlier allows remote attackers
to affect confidentiality, integrity, and availability via unknown
vectors related to Concurrency.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-4969
Title: Microsoft Internet Explorer 7/8/9 contain a use-after-free
vulnerability
Vendor: Microsoft
Description: Microsoft Internet Explorer versions 7, 8, and 9 are
susceptible to a use-after-free vulnerability that may result in
remote code execution.
CVSS v2 Base Score: 9.7 (AV:N/AC:L/Au:N/C:C/I:C/A:P)
ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Vendor: Oracle
Description: Oracle Java 7 Update 6, and possibly other versions,
allows remote attackers to execute arbitrary code via a crafted
applet, as exploited in the wild in August 2012 using Gondzz.class
and Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
ID: : CVE-2012-1535
Title: Adobe Flash Player 11.3 Font Parsing Code Execution
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Flash Player before
11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux
allows remote attackers to execute arbitrary code or cause a denial
of service (application crash) via crafted SWF content, as exploited
in the wild in August 2012 with SWF content in a Word document.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-2516
Title: GE INTELLIGENT PLATFORMS PROFICY HTML HELP VULNERABILITIES
Vendor: GE
Description: An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp
Module (aka the HTML Help component), as used in GE Intelligent
Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA
iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6;
SI7 I/O Driver 7.20 through 7.42; and other products, allows remote
attackers to execute arbitrary commands via crafted input, related to a
"command injection vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
MOST POPULAR MALWARE FILES 10/11/2012 - 10/18/12::
COMPILED BY SOURCEFIRE
SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal:
https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/
Typical Filename: activator.exe.xxx
Claimed Product: activator.exe.xxx
Claimed Publisher: activator.exe.xxx
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal:
https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename:
smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product:
smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher:
smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal:
https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Typical Filename: winhsebb.exe
Claimed Product: winhsebb.exe
Claimed Publisher: winhsebb.exe
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal:
https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: 123
Claimed Product: 123
Claimed Publisher: 123
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
