@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
November 29, 2012=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 47
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 11/15/2012 - 11/21/2012
============================================================TOP VULNERABILITY THIS WEEK: A new zero-day attack for Adobe Acrobat Reader X has been discovered, according to Russian firm Group-IB. While attacks to date appear to be limited, due to the need for user interaction before exploitation can take place, it can be assumed that underground researchers are working on a mechanism to automate the exploit, so that it can be used in drive-by downloads and exploit kits.
============================================================TRAINING UPDATE
- --SANS London 2012 London November 26-December 3, 2012
16 courses. Bonus evening presentations include Why to Organizations Get
Compromised; Dissecting Smart Meters; and 10 Things Security Teams Need
to Know About Cloud Security.
http://www.sans.org/london-2012/
- --SANS Cyber Defense Initiative ® 2012 Washington, DC December 7-16, 2012
27 courses. Bonus evening presentations include Gamification: Hacking
Your Brain for Better Learning; Building a Portable Private Cloud; and
Tactical SecOps: A Guide to Precision Security Operations.
http://www.sans.org/event/cyber-defense-initiative-2012
- --SANS Security East 2013 New Orleans, LA January 16-23, 2013
11 courses. Bonus evening presentations include The Next Wave - Data
Center Consolidation; Top Threats to Cloud for 2013; and Hacking Your
Friends and Neighbors for Fun. Special Event: NetWars Tournament of
Champions.
http://www.sans.org/event/security-east-2013
- --North American SCADA and Process Control Summit 2013 Lake Buena Vista, FL February 6-13, 2013
The Summit brings together the program managers, control systems
engineers, IT security professionals and critical infrastructure
protection specialists from asset owning and operating organizations
along with control systems and security vendors who have innovative
solutions for improving security. The Security Summit is an action
conference designed so that every attendee leaves with new tools and
techniques they can put to work immediately when they return to their
office. The Summit is the place to come and interact with top SCADA
experts, key government personnel, researchers and asset owners at the
multiple special networking events.
8 courses. Bonus evening presentation: The SANS SCADA Dinner Theater
Players Present: From Exposure to Closure - Act III.
http://www.sans.org/event/north-american-scada-2013
- - --Looking for training in your own community?
http://www.sans.org/community/
- - --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus San Antonio, Barcelona, Cairo, Anaheim, and New Delhi all in the next 90 days. For a list of all upcoming events, on-line and live: www.sans.org
********************* Sponsored Links: *********************1) Take the SANS Survey on the Security Practices of SCADA System
Operators and register to win an iPad! http://www.sans.org/info/117947
2) Analyst Webcast: Secure Content Management in a Mobile Age Tuesday,
Dec. 4, 2012 at 1:00PM EST. http://www.sans.org/info/117952
3) Supporting Packet Decryption for Security Scanning by Dave
Shackleford http://www.sans.org/info/117957
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Adobe Flash 0-Day
Description: A new Adobe Acrobat Reader X memory corruption
vulnerability was recently announced by Group-IB, a Russian
cybersecurity firm. While initial reports were that it was to be added
to the Blackhole Exploit Kit immediately, researchers soon noted that
exploiting the bug required manual user interaction - specifically, the
malicious file would have to be closed like a normal document - which
would make it unsuitable for Blackhole and other automated exploitation
systems. Exploits have been limited in the wild thus far, but given the
difficulty of bypassing Adobe's recently added sandboxing and other
security features, cybercriminals are likely working on ways to automate
exploitation already. As no patch currently exists, potentially
vulnerable users should exercise caution when opening potentially
suspicious PDF documents.
Reference:
http://group-ib.com/index.php/7-novosti/672-group-ib-us-zero-day-vulnerability-found-in-adobe-x
Snort SID: 24721, 24722
ClamAV: N/A
Title: 64-bit Linux Rootkit Uses Novel Techniques
Description: A new type of 64-bit Linux rootkit was discovered in the
wild last week, after an infected user posted details from an infected
server on the Full-Disclosure mailing list. The rootkit was found
injecting malicious iframes into all HTTP responses served up by the
victim's nginx web server, a popular open-source, lightweight system
programmed by Russian-based company Nginx, Inc. This technique, which
can easily be used to assist in drive-by downloads and other exploit kit
style behavior, is a fascinating new twist on cybercriminals' efforts
to continue infecting large swaths of the public for use in worldwide
botnets.
Reference:
http://blog.crowdstrike.com/2012/11/http-iframe-injecting-linux-rootkit.html
http://seclists.org/fulldisclosure/2012/Nov/94
Snort SID: N/A
ClamAV: UNIX.Trojan.Snakso
Title: Novell File Reporter 0-Day Exploits Available in Metasploit
Description: Multiple remote file retrieval vulnerabilities plus a
remote code execution bug were announced last week in Novell's File
Reporter software, used for coordinating data storage across multiple
filesystems and/or storage solutions. The vulnerabilities have already
been added to Metasploit, and as no patch currently exists, exploits are
presumed to be occurring in the wild. Potentially impacted customers are
urged to firewall off their devices appropriately until a patch is
released.
Reference:
http://www.kb.cert.org/vuls/id/273371
https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
Snort SID: 24765 - 24767
ClamAV: N/A
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Dissecting a Blackhole 2 PDF (mostly) With Peepdf:
https://integriography.wordpress.com/2012/11/19/dissecting-a-blackhole-2-pdf-mostly-with-peepdf/
Beware Card and Cash Trapping At The ATM:
http://krebsonsecurity.com/2012/11/beware-card-and-cash-trapping-at-the-atm/
Pen Test Privilege Escalation Through Suspended Virtual Machines:
http://pen-testing.sans.org/blog/2012/08/03/pen-test-privilege-escalation-through-suspended-virtual-machines
Windows Kernel Reference Count Vulnerabilities - Case Study:
http://j00ru.vexillium.org/dump/zn_slides.pdf
Reverse Engineering Firmware Primer:
http://pauldotcom.com/wiki/index.php/Episode308#Tech_Segement:_Reverse_Engineering_Firmware_Primer
FreeBSD Servers Shut After SSH Key Breach:
http://nakedsecurity.sophos.com/2012/11/18/freebsd-shutters-some-servers-after-ssh-key-breach/
DigiNotar Hack Made Possible As 30 Software Updates Ignored:
http://www.dutchnews.nl/news/archives/2012/11/diginotar_hack_made_possible_a.php
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: : CVE-2012-4956
Title: Novell File Reporter Vulnerabilities
Vendor: Novell
Description: Heap-based buffer overflow in NFRAgent.exe in Novell File
Reporter 1.0.2 allows remote attackers to execute arbitrary code via a
large number of VOL elements in an SRS record.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-2897
Title: Microsoft Windows Kernel TrueType Font Integer Underflow Vulnerability
Vendor: Microsoft
Description: The kernel-mode drivers in Microsoft Windows XP SP2 and
SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008
SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server
2012, and Windows RT, as used by Google Chrome before 22.0.1229.79 and
other programs, do not properly handle objects in memory, which allows
remote attackers to execute arbitrary code via a crafted TrueType font
file, aka "Windows Font Parsing Vulnerability" or "TrueType Font Parsing
Vulnerability."
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-0507
Title: Oracle Java SE Remote Java Runtime Environment Code Execution Vulnerability
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30
and earlier, and 5.0 Update 33 and earlier allows remote attackers to
affect confidentiality, integrity, and availability via unknown vectors
related to Concurrency.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Vendor: Oracle
Description: Oracle Java 7 Update 6, and possibly other versions, allows
remote attackers to execute arbitrary code via a crafted applet, as
exploited in the wild in August 2012 using Gondzz.class and
Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
ID: : CVE-2012-5076
Title: Java Applet JAX-WS Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote
attackers to affect confidentiality, integrity, and availability,
related to JAX-WS.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
MOST PREVALENT MALWARE FILES DDDD:
COMPILED BY SOURCEFIRE
SHA 256: B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96
MD5: 573b6cc513e1b7cd9e35b491eacc38f3
VirusTotal: https://www.virustotal.com/file/B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96/analysis/
Typical Filename: winkgts.exe
Claimed Product: winkgts.exe
Claimed Publisher: winkgts.exe
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: 3291e1603715c47a23b60a8bf2ca73db
Claimed Product: 3291e1603715c47a23b60a8bf2ca73db
Claimed Publisher: 3291e1603715c47a23b60a8bf2ca73db
SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Typical Filename: lmlkl.sys
Claimed Product: lmlkl.sys
Claimed Publisher: lmlkl.sys
SHA 256: 9267AAD92DEA47A6A8B2F734037239AB3376E47F969F8B97B64192A820B2A86F
MD5: 3ff52cee72b936c56b4fbb9f970ece74
VirusTotal: https://www.virustotal.com/file/9267AAD92DEA47A6A8B2F734037239AB3376E47F969F8B97B64192A820B2A86F/analysis/
Typical Filename: wintdiyx.exe
Claimed Product: wintdiyx.exe
Claimed Publisher: wintdiyx.exe
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
