@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
November 28, 2012=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 46
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
LATEST IN THE NEWS
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 11/8/2012 - 11/15/2012
============================================================TOP VULNERABILITY THIS WEEK: Microsoft released six bulletins as part of their monthly "Patch Tuesday" release. Some of these are rated critical and all should be patched immediately if possible.
********************* Sponsored By SANS ********************Analyst Webcast: Security Intelligence in Action: LogRhythm's Advanced Analysis Features by SANS Analyst Dave Shackleford, Wed. Nov.28, 1PM EST. http://www.sans.org/info/116842
============================================================TRAINING UPDATE
- --SANS London 2012, London November 26-December 3, 2012
16 courses.
http://www.sans.org/london-2012/
- --SANS Cyber Defense Initiative ® 2012 Washington, DC December 7-16, 2012
27 courses. Bonus evening presentations include Gamification: Hacking
Your Brain for Better Learning; Building a Portable Private Cloud; and
Tactical SecOps: A Guide to Precision Security Operations.
http://www.sans.org/event/cyber-defense-initiative-2012
- --SANS Security East 2013 New Orleans, LA January 16-23, 2013
11 courses. Bonus evening presentations include The Next Wave - Data
Center Consolidation; Top Threats to Cloud for 2013; and Hacking Your
Friends and Neighbors for Fun. Special Event: NetWars Tournament of
Champions.
http://www.sans.org/event/security-east-2013
- --North American SCADA and Process Control Summit 2013 Lake Buena Vista, FL February 6-13, 2013
The Summit brings together the program managers, control systems
engineers, IT security professionals and critical infrastructure
protection specialists from asset owning and operating organizations
along with control systems and security vendors who have innovative
solutions for improving security. The Security Summit is an action
conference designed so that every attendee leaves with new tools and
techniques they can put to work immediately when they return to their
office. The Summit is the place to come and interact with top SCADA
experts, key government personnel, researchers and asset owners at the
multiple special networking events.
8 courses. Bonus evening presentation: The SANS SCADA Dinner Theater
Players Present: From Exposure to Closure - Act III.
http://www.sans.org/event/north-american-scada-2013
- --Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus San Antonio, Barcelona, Cairo, Anaheim, and New Delhi all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) Take the SANS Survey on the Security Practices of SCADA System
Operators and register to win an iPad! http://www.sans.org/info/116847
2) Webcast: APT: It is Not Time to Pray, It is Time to Act Featuring:
Dr. Eric Cole. http://www.sans.org/info/116852
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Microsoft Patch Tuesday
Description: Six Microsoft Security Bulletins covering 19 CVE and
Operating Systems from Windows Server 2003 to the brand new Microsoft
Windows 8 and Windows RT. This patch release contains vulnerability
patches for Microsoft IIS, Internet Explorer, .NET, Microsoft Office
Excel, as well as vulnerabilities in the Windows OS itself.
Reference:
https://isc.sans.edu/diary/Microsoft+November+2012+Black+Tuesday+Update+-+Overview/14503
http://blog.snort.org/2012/11/sourcefire-vrt-certified-snort-rules_14.html
Snort SID:
24653,24654,24660,24661,24662,24663,24652,24671,24655,2565,25664,24665,24649,24650,24657,24658,24659,24673,24674,24666,16654
ClamAV: HTML.Exploit.CVE_2012_1538, BC.Exploit.CVE_2012_1539,
PUA.Script.CVE_2012_4776, Win.Exploit.CVE_2012_2519,
Win.Exploit.CVE_2012_1895, Win.Exploit.CVE_2012_2897,
BC.Exploit.CVE_2012-1886,BC.Exploit.CVE_2012-1885,Win.Exploit.CVE_2012_1887,BC.Exploit.CVE_2012-2543,
Title: Blackhole Exploit Kit changes structure
Description: In the constant fight against Exploit Kits, the Blackhole
exploit kit seems to be the one that evolves the most rapidly. The
Sourcefire Vulnerability Research Team keeps a close on this and other
exploits kits in order to provide the best detection possible. When
detection is published for these exploit kits, we place it in the
"Exploit-Kit" category. The Blackhole exploit kit, aside from recently
evolving into "Version 2", can be in almost any delivery method, email,
drive-by web contact, pdf, java, etc. It's highly recommended that the
latest Java, Flash, Adobe Reader, and Microsoft be applied, and even go
so far as to disable these plugins where possible.
Snort SID: Recent additions: 24636, 24637, 24638
ClamAV: HTML.Trojan.Blackhole*, Java.Trojan.Blackhole*, Win.Trojan.Blackhole*
Title: KaiXin Exploit pack is back
Description: Much like the Blackhole exploit kit, the KaiXin exploit
pack can be seen in nearly any delivery method. Heavily obfuscated
javascript, Java delivery and attack methods, Flash delivery and attack
are hallmarks of this exploit kit. Pay particular attention to this
attack method and read the references below.
Reference:
http://ondailybasis.com/blog/?p=1610
http://www.kahusecurity.com/2012/new-chinese-exploit-pack/
Snort SID: 24667,24668,24669,24670
ClamAV: Win.Exploit.KaiXin, Win.Exploit.KaiXin-1
Title: New Skype Advisory
Description: '....We have had reports of a new security vulnerability
issue. As a precautionary step we have temporarily disabled password
reset as we continue to investigate the issue further. We apologize for
the inconvenience but user experience and safety is our first
priority.....'
Reference:
http://heartbeat.skype.com/2012/11/security_issue.html
Snort SID: N/A
ClamAV: N/A
LATEST IN THE NEWS
Infamous Hacker Heading Chinese Antivirus Firm?:
https://krebsonsecurity.com/2012/11/infamous-hacker-heading-chinese-antivirus-firm/
Mac Trojan Targeting Tibet Sympathizers Discovered:
http://www.theepochtimes.com/n2/china-news/mac-trojan-targeting-tibet-sympathizers-discovered-314082.html
Yes, the FBI and CIA can read your email. Here's how:
http://www.zdnet.com/yes-the-fbi-and-cia-can-read-your-email-heres-how-7000007319/
Federal agencies, private firms fiercely compete in hiring cyber experts:
http://www.washingtonpost.com/world/national-security/federal-agencies-private-firms-fiercely-compete-in-hiring-cyber-experts/2012/11/12/a1fb1806-2504-11e2-ba29-238a6ac36a08_story.html
Adobe investigates alleged customer data breach:
http://www.pcadvisor.co.uk/news/security/3410815/adobe-investigates-alleged-customer-data-breach/
Websense 2013 Security Predictions report:
https://www.websense.com/content/2013-security-predictions-report.aspx?
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: : CVE-2012-0507
Title: Oracle Java SE Remote Java Runtime Environment Code Execution Vulnerability
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30
and earlier, and 5.0 Update 33 and earlier allows remote attackers to
affect confidentiality, integrity, and availability via unknown vectors
related to Concurrency.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Vendor: Oracle
Description: Oracle Java 7 Update 6, and possibly other versions, allows
remote attackers to execute arbitrary code via a crafted applet, as
exploited in the wild in August 2012 using Gondzz.class and
Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
ID: : CVE-2012-4501
Title: Citrix CloudStack and CloudPlatform Default Credentials Design Error Vulnerability
Vendor: Citrix
Description: Citrix Cloud.com CloudStack, and Apache CloudStack
pre-release, allows remote attackers to make arbitrary API calls by
leveraging the system user account, as demonstrated by API calls to
delete VMs.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-5076
Title: Java Applet JAX-WS Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote
attackers to affect confidentiality, integrity, and availability,
related to JAX-WS.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-5692
Title: Invision Power Board "unserialize()" PHP Code Execution Vulnerability
Vendor: Invision Power Services
Description: Unspecified vulnerability in admin/sources/base/core.php
in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has
unknown impact and remote attack vectors.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
MOST PREVALENT MALWARE FILES 11/8/2012 - 11/15/2012
COMPILED BY SOURCEFIRE
SHA 256: B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96
MD5: 573b6cc513e1b7cd9e35b491eacc38f3
VirusTotal: https://www.virustotal.com/file/B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96/analysis/
Typical Filename: winhblmdx.exe
Claimed Product: winhblmdx.exe
Claimed Publisher: winhblmdx.exe
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: 01.tmp
Claimed Product: 01.tmp
Claimed Publisher: 01.tmp
SHA 256: 358289754D01E20D564E39D79124AFA9BED4D35B3BC22F4E09210EC75E6461B2
MD5: b94b0c0efb6f33bddd2f16907a3a9cd1
VirusTotal: https://www.virustotal.com/file/358289754D01E20D564E39D79124AFA9BED4D35B3BC22F4E09210EC75E6461B2/analysis/
Typical Filename: unp151145116.tmp
Claimed Product: 7zS.sfx.exe
Claimed Publisher: Mozilla
SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal: https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/
Typical Filename: test.exe
Claimed Product: none
Claimed Publisher: none
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
