@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
June 27, 2013=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 26
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 6/18/2013 - 6/25/2013
============================================================TOP VULNERABILITY THIS WEEK: A massive dump of malware source code hit the Internet this week, with well-known banker trojan Carberp having it source disclosed for the first time ever. The disclosure is likely to spawn a series of derivative pieces of malware, even as it allows security researchers to improve detection for existing strains.
******************** Sponsored By SANS *********************
NEW paper in the SANS Reading Room: "Implementing Hardware Roots of
Trust," includes real case studies, best practices and standards on how
to implement hardware security that is ubiquitous in most of today's
organizations.
http://www.sans.org/info/133627
Listen to the associated webcast: http://www.sans.org/info/133632
TRAINING UPDATE
- -- Industrial Control System (ICS) Security Training In-depth, hands-on technical courses taught by top SCADA experts. Gain the most current information regarding SCADA and Control System threats and learn how to best prepare to defend against them. Leave the event with solutions that you can immediately put to use in your organization.
--Washington, DC (August 12-August 16)
http://www.sans.org/event/ics-security-training-washington-dc
- -- SANS Rocky Mountain 2013 Denver, CO July 14-20, 2013
10 courses. Bonus evening sessions include OODA - The Secret to
Effective Security in Any Environment; and APT: It is Not Time to Pray,
It is Time to Act.
http://www.sans.org/event/rocky-mountain-2013
- -- SANS San Francisco 2013 San Francisco, CA July 29-August 3, 2013
7 courses. Bonus evening sessions include Offensive Digital Forensics;
and Base64 Can Get You Pwned!
http://www.sans.org/event/san-francisco-2013
- -- SANS Boston 2013 Boston, MA August 5-10, 2013
9 courses. Bonus evening sessions include Cloud R and Forensics; and You
Can Panic Now. Host Protection is (Mostly) Dead.
http://www.sans.org/event/boston-2013
- -- SANS Virginia Beach 2013 Virginia Beach, VA August 19-30, 2013
10 courses. Bonus evening presentations include Thanks for Recovering
... Now I Can Hack You!; Everything I Know is Wrong!; and APT: It is
Time to Act.
http://www.sans.org/event/virginia-beach-2013
- -- SANS Capital City 2013 Washington, DC September 3-8, 2013
6 courses. Bonus evening presentations include Look Ma, No Exploits! -
The Recon-ng Framework; and How the West was Pwned.
Keynote address: Who's Watching the Watchers?
http://www.sans.org/event/sans-capital-city-2013
- -- SANS Network Security 2013 Las Vegas, NV September 14-23, 2013
50 courses. Bonus evening presentations include The Security Impact of
IPv6; Unleashing the Dogs of (cyber) War; and InfoSec Vertigo: Small
Medical Lab Wages War Against InfoSec Vendor, US Government, and Big DC
Law Firm.
http://www.sans.org/event/network-security-2013
- -- SANS London Summer 2013 London, UK July 9-July 16, 2013
4 courses. SANS has added a new London date to the security-training
calendar, giving security professionals the opportunity to take one of
four of SANS' most popular 6-day courses and the excellent 2 day
Securing The Human course.
http://www.sans.org/event/london-summer-2013
- -- SANS Mumbai 2013 Mumbai, India July 22-27, 2013
Our two most popular security courses that will get you started on your
security career - SEC 401 Security Essentials Bootcamp Style and
SEC504: Hacker Techniques, Exploits & Incident Handling.
http://www.sans.org/event/mumbai-2013
- -- SANS Forensics Prague 2013Prague, Czech RepublicOctober 6-13 2013
SANS's European forensics summit and dedicated forensics training event.
Four of SANS's most important forensics training courses and
opportunities to network with leading digital forensics experts.
http://www.sans.org/event/forensics-prague-2013
- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013
SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach.
http://www.sans.org/event/dubai-2013
- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- -- Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) NEW paper in the SANS Reading Room: Results of the SANS Critical
Security Controls Survey, featuring John Pescatore
http://www.sans.org/info/133637
Listen to the associated Webcast: http://www.sans.org/info/133642
2) Digital Forensics Survey Results released during a July 18 webcast at 1 PM EDT. Register for the webcast and automatically sign up for a copy of the associated report. http://www.sans.org/info/133647
3) Another New Paper in the SANS reading room: SANS survey on Mobile
Application Security: http://www.sans.org/info/133652
Associated webcast: http://www.sans.org/info/133657
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Carberp, other malware sources leaked
Description: For the first time ever, the notorious banker trojan
Carberp has had its source code publicly leaked, after it had been on
sale in underground forums for as much as $50,000. The dissemination of
the source code means that many more variants are likely to begin
appearing soon, as the barrier to entry for creating derivatives of the
trojan has been substantially lowered. Defensive companies are currently
poring through the source, looking for improved ways to detect existing
variants of Carberp and other included malware families.
Reference:
http://touchmymalware.blogspot.ru/2013/06/carberp-source-code-now-leaked.html
http://www.kernelmode.info/forum/viewtopic.php?p=19792#p19792
http://www.xylibox.com/2013/06/carberp-archive.html
Snort SID: 18098 18099 19368 19369 19370 19041
ClamAV: Win.Trojan.Carberp-*
Title: Microsoft launches bug bounty program, paying up to $100,000 per
exploit
Description: In a major policy shift, Microsoft announced its first ever
bug bounty program, in which it will pay researchers who discover
vulnerabilities in Microsoft software. The program is multi-tiered, with
additional cash being given for functional exploits, and $50,000 being
available for those who can present mitigations for the bugs they
discover.
Reference:
http://blogs.technet.com/b/srd/archive/2013/06/17/new-bounty-program-details.aspx
http://www.wired.com/threatlevel/2013/06/microsoft-bug-bounty-program/
Snort SID: N/A
ClamAV: N/A
Title: Fake BlackBerry Messenger app on Google Play market downloaded
100,000 times
Description: Playing on a public announcement of an official BlackBerry
Messenger app to be released June 27, a rogue app appeared this week on
the Google Play store, claiming to be this new application and declaring
a creator name of "RIM" (despite Resarch in Motion's recent name change
to BlackBerry). While the app was quickly pulled by Google, and damage
appears at this point in time to have been limited to nonexistent, it
highlights how rapidly problems can spread through mobile ecosystems,
even in the context of official markets.
Reference:
http://androidcommunity.com/blackberry-messenger-app-fake-tricks-thousands-before-being-pulled-20130624/
Snort SID: N/A
ClamAV: N/A
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Malicious ads infect 65 web sites, drop ZeroAccess:
https://threatpost.com/malicious-ads-infect-65-websites-drop-zeroaccess-trojan/
GitHub hacking for fun and...sensitive data search!
http://blog.conviso.com.br/2013/06/github-hacking-for-fun-and-sensitive.html
Post-PC attack site: only interested in smartphones/tablets:
http://www.f-secure.com/weblog/archives/00002569.html
New boutique iframe crypting service spotted in the wild:
http://blog.webroot.com/2013/06/18/new-boutique-iframe-crypting-service-spotted-in-the-wild/
Metasploit: man in the middle through PPTP tunnel:
http://www.shelliscoming.com/2013/06/metasploit-man-in-middle-through-pptp.html
Malware monetization scheme through parked domains:
http://ddanchev.blogspot.jp/2013/06/bogus-shocking-video-content-at-scribd.html
Remoting Android applications for fun and profit:
http://kaiyou.fr/files/2013/06/main.pdf
Cracking IPMI passwords remotely:
http://fish2.com/ipmi/remote-pw-cracking.html
Cracking iPhone hotspot passwords in 50 seconds:
http://thehackernews.com/2013/06/cracking-iphone-hotspot-passwords-in-50.html
Adobe XFA exploits for all:
http://immunityproducts.blogspot.com/2013/06/adobe-xfa-exploits-for-all-first-part.html
Metasploit forensics: recovering deleted files (NTFS):
http://www.shelliscoming.com/2013/05/metasploit-forensics-recovery-deleted.html
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2013-3576
Title: HP System Management Homepage JustGetSNMPQueue Command Injection
Vendor: HP
Description: ginkgosnmp.inc in HP System Management Homepage (SMH)
allows remote authenticated users to execute arbitrary commands via
shell metacharacters in the PATH_INFO to smhutil/snmpchp.php.en.
CVSS v2 Base Score: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
ID: CVE-2013-2551
Title: Microsoft Internet Explorer COALineDashStyleArray Integer
Overflow (MS13-009)
Vendor: Microsoft
Description: Use-after-free vulnerability in Microsoft Internet Explorer
6 through 10 allows remote attackers to execute arbitrary code via a
crafted web site that triggers access to a deleted object, as
demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013,
aka "Internet Explorer Use After Free Vulnerability," a different
vulnerability than CVE-2013-1308 and CVE-2013-1309.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-1533
Title: Java Web Start Double Quote Injection Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update
35 and earlier, allows remote attackers to affect confidentiality,
integrity, and availability via unknown vectors related to Deployment.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-1311
Title: Microsoft Internet Explorer textNode Use-After-Free
Vendor: Microsoft
Description: Use-after-free vulnerability in Microsoft Internet Explorer
8 allows remote attackers to execute arbitrary code via a crafted web
site that triggers access to a deleted object, aka "Internet Explorer
Use After Free Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-1559
Title: Oracle WebCenter Content CheckOutAndOpen.dll ActiveX Remote Code
Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Oracle WebCenter Content
component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows
remote authenticated users to affect availability via unknown vectors
related to Content Server.
CVSS v2 Base Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
ID: CVE-2013-2423
Title: Java Applet Reflection Type Confusion Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK
7, allows remote attackers to affect integrity via unknown vectors
related to HotSpot. NOTE: the previous information is from the April
2013 CPU. Oracle has not commented on claims from the original
researcher that this vulnerability allows remote attackers to bypass
permission checks by the MethodHandles method and modify arbitrary
public final fields using reflection and type confusion, as demonstrated
using integer and double fields to disable the security manager.
CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
MOST PREVALENT MALWARE FILES 6/18/2013 - 6/25/2013
COMPILED BY SOURCEFIRE
SHA 256: B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96
MD5: 573b6cc513e1b7cd9e35b491eacc38f3
VirusTotal:
https://www.virustotal.com/file/B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96/analysis/
Typical Filename: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Product: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Publisher: 573b6cc513e1b7cd9e35b491eacc38f3
SHA 256: 9267AAD92DEA47A6A8B2F734037239AB3376E47F969F8B97B64192A820B2A86F
MD5: 3ff52cee72b936c56b4fbb9f970ece74
VirusTotal:
https://www.virustotal.com/file/9267AAD92DEA47A6A8B2F734037239AB3376E47F969F8B97B64192A820B2A86F/analysis/
Typical Filename: wintdiyx.exe
Claimed Product: wintdiyx.exe
Claimed Publisher: wintdiyx.exe
SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal:
https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/
Typical Filename: Keygen.exe
Claimed Product: Keygen.exe
Claimed Publisher: Keygen.exe
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
