@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
December 31, 2012=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 53
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 12/27/2012 - 1/2/2013
============================================================TOP VULNERABILITY THIS WEEK: A major new Internet Explorer 0-day attack was released last week, with live exploits occurring heavily in the wild. Microsoft has not yet issued guidance on whether it will move forward with an out-of-band patch; impacted users are advised to deploy ancillary protection such as IDS or AV in the meantime.
============================================================TRAINING UPDATE
- --SANS Security East 2013 New Orleans, LA January 16-23, 2013
11 courses. Bonus evening presentations include The Next Wave - Data
Center Consolidation; Top Threats to Cloud for 2013; and Hacking Your
Friends and Neighbors for Fun. Special Event: NetWars Tournament of
Champions.
http://www.sans.org/event/security-east-2013
- --North American Industrial Controls Systems and SCADA Summit 2013
Lake Buena Vista, FL February 6-13, 2013
The only technical security and training program in ICS security - for
program managers, control systems engineers, IT security professionals
and critical infrastructure protection specialists from asset owning and
operating organizations along with control systems and security vendors
who have innovative solutions for improving security. Every attendee
leaves with new tools and techniques they can put to work immediately.
8 courses. Bonus evening presentation: The SANS SCADA Dinner Theater
Players Present: From Exposure to Closure - Act III.
http://www.sans.org/event/north-american-scada-2013
- --SANS Secure Singapore 2013 February 25-March 2, 2013
6 courses. Bonus evening presentation: Security of National eID
(smartcard-based) Web Applications.
http://www.sans.org/event/singapore-2013
- --SANS 2013 Orlando, FL March 8-March 15, 2013
46 courses. Bonus evening presentations include Why Our Defenses Are
Failing Us: One Click Is All It Takes ...; Human Nature and Information
Security: Irrational and Extraneous Factors That Matter; and
Over-Zealous Social Media Investigations: Beware the Privacy Monster.
http://www.sans.org/event/sans-2013
- --SANS Monterey 2013 Monterey, CA March 22-March 27, 2013
7 courses. Bonus evening presentations include Base64 Can Get You
Pwned!; and The 13 Absolute Truths of Security.
http://www.sans.org/event/monterey-2013
- --Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus Anaheim, New Delhi, Scottsdale, Brussels, Johannesburg, and Canberra all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) NEW paper in the SANS reading room: SANS Survey on Application Security Policies in Enterprises http://www.sans.org/info/120170
Associated webcast featuring SANS Analyst Frank Kim:
http://www.sans.org/info/120175
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Internet Explorer 0-day released
Description: A new Internet Explorer remote code execution vulnerability
was discovered last week after the Council on Foreign Relations' web
site was shown to be compromised and serving up malicious code. Many
live exploit campaigns are currently operating in the wild using this
attack, which has a great deal of proof-of-concept code available,
including a Metasploit module. Microsoft is investigating whether it
will issue an out-of-band patch or wait until the January 8 patch cycle
to release an update resolving this vulnerability. Impacted users are
urged to deploy all other available protections in the interim.
Reference:
http://technet.microsoft.com/en-us/security/advisory/2794220
https://community.rapid7.com/community/metasploit/blog/2012/12/29/microsoft-internet-explorer-0-day-marks-the-end-of-2012
http://stopmalvertising.com/malware-reports/cve-2012-4792-analysis-of-today.swf.html
http://labs.alienvault.com/labs/index.php/2012/just-another-water-hole-campaign-using-an-internet-explorer-0day/
Snort SID: 25124 - 25134
ClamAV: JS.Exploit.CVE_2012_4792
Title: GPU-accelerated Gauss encryption cracker released
Description: State-sponsored malware Gauss, which caused serious waves
in the information security community in 2012, included an encrypted
payload, which no one has yet publicly cracked. However, a new tool is
available to take advantage of GPU hardware when attempting to break the
encryption, dramatically increasing the speed at which people can
attempt to crack it. A breakthrough here could have major implications
for defenders and attackers alike in 2013.
Reference:
https://hashcat.net/oclGaussCrack/
https://www.securelist.com/en/blog?weblogid=208194061
Snort SID: N/A
ClamAV: N/A
Title: Activist group MalwareMustDie starts new takedown project
Description: A relatively new analyst group known as "Malware Must Die",
who have published a series of in-depth articles on current threats in
the wild on their web site since they organized in August, have started
a new domain takedown project, in which they work with legal authorities
to destroy malicious domain names they find in the course of their work.
This project, similar to others in the sphere, differs primarily in that
the group is for now giving away a list of domains they are killing, as
indicators organizations can use to find and clean infections. Those who
might be able to assist them are urged to contact them directly.
Reference:
http://malwaremustdie.blogspot.com/2012/12/announce-of-malware-multiple-domains.html
Snort SID: 15168, 25141 - 25223
ClamAV: N/A
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Running code from a non-elevated account at any time:
http://www.scriptjunkie.us/2013/01/running-code-from-a-non-elevated-account-at-any-time/
Username anarchy:
http://www.morningstarsecurity.com/research/username-anarchy
Mona.py version 2 released:
https://www.corelan.be/index.php/2012/12/31/jingle-bofs-jingle-rops-sploiting-all-the-things-with-mona-v2/
Outmaneuvered at their own game, antivirus makers struggle to adapt:
http://www.nytimes.com/2013/01/01/technology/antivirus-makers-work-on-software-to-catch-malware-more-effectively.html?_r=0
Getting terminal access to a Cisco Linksys E-100:
http://blog.spiderlabs.com/2012/12/getting-terminal-access-to-a-cisco-linksys-e-1000.html
Controlling Cuckoo Sandbox from C#:
http://volatile-minds.blogspot.com/2012/12/controlling-cuckoo-sandbox-from-c.html
How I got a $3,500 USD Facebook bug bounty:
http://blog.detectify.com/post/39209711597/how-i-got-a-3-500-usd-facebook-bug-bounty
Hello Mach-O:
http://seriot.ch/hello_macho.php
Malware analysis #1 protip:
http://jcsocal.blogspot.com/2012/12/malware-analysis-1-protip.html
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: : CVE-2012-4792
Title: Microsoft Internet Explorer CDwnBindInfo Object Use-After-Free Vulnerability
Vendor: Microsoft
Description: Use-after-free vulnerability in Microsoft Internet Explorer
6 through 8 allows remote attackers to execute arbitrary code via a
crafted web site that triggers access to an object that (1) was not
properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo
object, and exploited in the wild in December 2012.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-2176
Title: IBM Lotus Quickr 8.2 qp2.cab ActiveX Control Buffer Overflow Vulnerability
Vendor: IBM
Description: Multiple stack-based buffer overflows in a certain ActiveX
control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for
Domino allow remote attackers to execute arbitrary code via a long
argument to the (1) Attachment_Times or (2) Import_Times method.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-2175
Title: IBM Lotus iNotes "Attachment_Times" ActiveX Buffer Overflow Vulnerability
Vendor: IBM
Description: Buffer overflow in the Attachment_Times method in a certain
ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2
allows remote attackers to execute arbitrary code via a long argument.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-2174
Title: IBM Lotus Notes URL Handler Design Error Vulnerability
Vendor: IBM
Description: The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2
allows remote attackers to execute arbitrary code via a crafted notes:// URL.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-4959
Title: Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability
Vendor: Novell
Description: Directory traversal vulnerability in NFRAgent.exe in Novell
File Reporter 1.0.2 allows remote attackers to upload and execute files
via a 130 /FSF/CMD request with a .. (dot dot) in a FILE element of an
FSFUI record.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-5975
Title: SSH Tectia Authentication Bypass Remote
Vendor: SSH Communications
Description: A remote authentication bypass vulnerability was disclosed
which affects the current Unix/Linux versions of Tectia SSH Server. The
vulnerability exploits a bug in the SSH USERAUTH CHANGE REQUEST
function.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
MOST POPULAR MALWARE FILES 12/27/2012 - 1/2/2013:
COMPILED BY SOURCEFIRE
SHA 256: 1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442
MD5: bb74024a1d4e4808562c090980151653
VirusTotal: https://www.virustotal.com/file/1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442/analysis/
Typical Filename: bb74024a1d4e4808562c090980151653
Claimed Product: My Web Search Bar
Claimed Publisher: MyWebSearch.com
SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Typical Filename: uliig.exe
Claimed Product: uliig.exe
Claimed Publisher: uliig.exe
SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Typical Filename: 7961a56c11ba303f20f6a59a506693ff
Claimed Product: My Web Search Bar for Internet Explorer and FireFox
Claimed Publisher: MyWebSearch.com
SHA 256: 358289754D01E20D564E39D79124AFA9BED4D35B3BC22F4E09210EC75E6461B2
MD5: b94b0c0efb6f33bddd2f16907a3a9cd1
VirusTotal: https://www.virustotal.com/file/358289754D01E20D564E39D79124AFA9BED4D35B3BC22F4E09210EC75E6461B2/analysis/
Typical Filename: virus-2010-10-18-id0018936109
Claimed Product: Firefox
Claimed Publisher: Mozilla
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: File_0_2.ok
Claimed Product: File_0_2.ok
Claimed Publisher: File_0_2.ok
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
