@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
October 25, 2012=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 43
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 10/18/2012 - 10/25/2012
============================================================TOP VULNERABILITY THIS WEEK: Oracle announced that it would not be patching the recently discovered Java sandbox breakout vulnerability until February 2013. While exploits are not known to be circulating in the wild at this point, as researcher Adam Gowdiak has kept a tight lid on the technique, enough details are available that users should consider the likelihood of future exploitation very high. Researchers around the globe are urging Java users to disable it in their browser if at all possible, and to at least ensure that other Critical Patch Updates from Oracle are being installed in the interim.
********************* Sponsored By SANS ********************Take the SANS Survey on Application Security Policies in Enterprises!
Help shape the industry and be entered to win a $300 American Express
Card.
http://www.sans.org/info/115742
TRAINING UPDATE
- --SANS Chicago 2012 Chicago, IL October 27-November 5, 2012
9 courses. Bonus evening presentations include Securing the Kids and
Securing the Human.
http://www.sans.org/chicago-2012/
- --SANS Sydney 2012 Sydney, Australia November 12-20, 2012
5 courses.
http://www.sans.org/event/sydney-2012
- --SANS San Diego 2012 San Diego, CA November 12-17, 2012
7 courses. Bonus evening presentations include Cloud Computing and the
20 Critical Security Controls; and Practical, Efficient Unix Auditing
(with Scripts).
http://www.sans.org/event/san-diego-2012
- --SANS London 2012 London November 26-December 3, 2012
16 courses.
http://www.sans.org/london-2012/
- --SANS Cyber Defense Initiative ® 2012 Washington, DC December 7-16, 2012
27 courses. Bonus evening presentations include Gamification: Hacking
Your Brain for Better Learning; Building a Portable Private Cloud;
and Tactical SecOps: A Guide to precision Security Operations.
http://www.sans.org/event/cyber-defense-initiative-2012
- --SANS Security East 2013 New Orleans, LA January 16-23, 2013
11 courses. Bonus evening presentations include The Next Wave - Data
Center Consolidation; Top Threats to Cloud for 2013; and Hacking Your
Friends and Neighbors for Fun.
http://www.sans.org/event/security-east-2013
- --North American SCADA and Process Control Summit 2013 Lake Buena Vista, FL February 6-13, 2013
The Summit brings together the program managers, control systems
engineers, IT security professionals and critical infrastructure
protection specialists from asset owning and operating organizations
along with control systems and security vendors who have innovative
solutions for improving security. The Security Summit is an action
conference designed so that every attendee leaves with new tools and
techniques they can put to work immediately when they return to their
office. The Summit is the place to come and interact with top SCADA
experts, key government personnel, researchers and asset owners at
the multiple special networking events.
http://www.sans.org/event/north-american-scada-2013
- --Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus Bangalore, Johannesburg, Seoul, Tokyo, Barcelona, and Cairo all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************* Sponsored Links: *********************1) SANS Webcast: Blind as a Bat? Or Eagle Vision Into Encrypted Packets?
With Dave Shackleford & Tony Zirnoon. Nov 5, 2012.
http://www.sans.org/info/115747
2) SANS Webcast: Why Deception Matters in Today's Web Attacks. With
John Bumgarner & David Koretz. Nov 8, 2012.
http://www.sans.org/info/115752
3) Take the SANS Survey on the Security Practices of SCADA System
Operators and register to win an iPad!
http://www.sans.org/info/115757
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Oracle announces Java 0-day to remain unpatched until February
Description: A Java sandbox escape vulnerability discovered by Polish
researcher Adam Gowdiak in September will not be fixed until the
February 2012 Oracle Critical Patch Update, according to the firm. While
Oracle claims that this is due to extensive testing of a complex fix,
Gowdiak counters that he was able to fix the bug in under a half an hour
in the open-source version of Java. While no details of the
vulnerability have been released publicly, and no indication of
exploitation in the wild has surfaced to date, the considerable delay
in an official patch leaves users at what many would consider undue risk
of attack. The Sourcefire VRT strongly recommends that users disable
Java in their browsers in the interim.
Reference:
http://threatpost.com/en_us/blogs/oracle-leaves-fix-java-se-zero-day-until-february-patch-update-101712
http://seclists.org/fulldisclosure/2012/Oct/155
Snort SID: N/A
ClamAV: N/A
Title: Novell ZENWorks default admin credentials
Description: Version 7.5 of Novell's ZENWorks Asset Management system
contains hard-coded administrative credentials in a pair of
web-accessible functions. Attackers can use a web browser to leverage
these functions into the ability to read arbitrary files on the impacted
system and retrieve the plaintext credentials for the service itself. A
Metasploit module exploiting this weakness also exists. Users should
patch their systems immediately, as this vulnerability represents a
trivial entry point into a network.
Reference:
http://www.kb.cert.org/vuls/id/332412
https://community.rapid7.com/community/metasploit/blog/2012/10/15/cve-2012-4933-novell-zenworks
Snort SID: 24435, 24436
ClamAV: N/A
Title: New heap spray technique released
Description: Researchers with Core Labs have released proof-of-concept
code for a new heap spray technique targeting the HTML 5 framework.
Functional against most modern browsers, this technique is also
effective against smartphones, media centers, and other devices which
render HTML 5. Attacks in the wild are presumed to exist at this time,
given the relative ease of plugging the PoC code into existing
exploitation frameworks.
Reference:
http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=publication&name=HTML5_Heap_Sprays_Pwn_All_The_Things
Snort SID: 24432, 24433
ClamAV: HTML.Exploit.Heap, HTML.Exploit.Heap-1
Title: Anonymous publishes 1.35 GB of data from Italian State Police
Description: A massive collection of sensitive files from Italian State
Police servers, including details of wiretaps, security system
internals, etc., was released by Anonymous on Tuesday. Potentially much
more destructive than recent DDoS attacks, the impact from this
disclosure could last well into the future, causing political and/or
operational damage for the Italian government and possibly others.
Reference:
http://www.par-anoia.net/releases.html#poliziadistato
Snort SID: N/A
ClamAV: N/A
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
An empirical study of zero-day attacks in the real world:
http://users.ece.cmu.edu/~tdumitra/public_documents/bilge12_zero_day.pdf
Two year old PDF exploit returns to popularity
http://blogs.avg.com/news-threats/years-pdf-exploit-hitting-tops-stats/
Olmasco bootkit: next circle of TDL4 evolution (or not?)
http://blog.eset.com/2012/10/18/olmasco-bootkit-next-circle-of-tdl4-evolution-or-not
How To Fight "Socware" - Malware On Facebook And Other Social Networks
http://www.readwriteweb.com/archives/how-to-fight-socware-malware-on-facebook-and-other-social-networks.php
Russian cybercriminals release new DIY DDoS malware loader:
http://blog.webroot.com/2012/10/22/russian-cybercriminals-release-new-diy-ddos-malware-loader/
Service sells access to Fortune 500 firms:
http://krebsonsecurity.com/2012/10/service-sells-access-to-fortune-500-firms/
Old habits die hard: XSS in Dropbox & Google Drive mobile apps:
http://blog.watchfire.com/wfblog/2012/10/old-habits-die-hard.html
Google Drive opens backdoor to Google accounts
http://www.h-online.com/security/news/item/Google-Drive-opens-backdoor-to-Google-accounts-1735069.html
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: : CVE-2012-0507
Title: Oracle Java SE Remote Java Runtime Environment Code Execution Vulnerability
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30
and earlier, and 5.0 Update 33 and earlier allows remote attackers to
affect confidentiality, integrity, and availability via unknown vectors
related to Concurrency.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-4969
Title: Microsoft Internet Explorer 7/8/9 contain a use-after-free vulnerability
Vendor: Microsoft
Description: Microsoft Internet Explorer versions 7, 8, and 9 are
susceptible to a use-after-free vulnerability that may result in remote
code execution.
CVSS v2 Base Score: 9.7 (AV:N/AC:L/Au:N/C:C/I:C/A:P)
ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Vendor: Oracle
Description: Oracle Java 7 Update 6, and possibly other versions, allows
remote attackers to execute arbitrary code via a crafted applet, as
exploited in the wild in August 2012 using Gondzz.class and
Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
ID: : CVE-2012-1535
Title: Adobe Flash Player 11.3 Font Parsing Code Execution
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Flash Player before
11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux
allows remote attackers to execute arbitrary code or cause a denial of
service (application crash) via crafted SWF content, as exploited in the
wild in August 2012 with SWF content in a Word document.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-3137
Title: Oracle Database Password Information Disclosure Vulnerability
Vendor: Oracle
Description: The authentication protocol in Oracle Database Server
10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows
remote attackers to obtain the session key and salt for arbitrary users,
which leaks information about the cryptographic hash and makes it easier
to conduct brute force password guessing attacks, aka "stealth password
cracking vulnerability."
CVSS v2 Base Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
MOST POPULAR MALWARE FILES 10/11/2012 - 10/18/12::
COMPILED BY SOURCEFIRE
SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Typical Filename: C8A787C22000AE378610003396E67500D587FA4E.exe
Claimed Product: My Web Search Bar for Internet Explorer and FireFox
Claimed Publisher: MyWebSearch.com
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename:
smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product:
smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher:
smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: avz00001.dta
Claimed Product: avz00001.dta
Claimed Publisher: avz00001.dta
SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Typical Filename: winoaox.exe
Claimed Product: winoaox.exe
Claimed Publisher: winoaox.exe
SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Typical Filename: bf31a8d79f704f488e3dbcb6eea3b3e3
Claimed Product: bf31a8d79f704f488e3dbcb6eea3b3e3
Claimed Publisher: bf31a8d79f704f488e3dbcb6eea3b3e3
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
