@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
August 8, 2013=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 32
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 7/30/2013 - 8/6/2013
============================================================TOP VULNERABILITY THIS WEEK: Attacks against the version of Firefox distributed in the Tor Browser Bundle were discovered in the wild this week, with a payload that sent users' MAC addresses to an IP address presumed to be controlled by the federal government. The announcement comes as a major blow to Tor, previously presumed to be the most secure way to preserve anonymity on the Internet.
******************** Sponsored By SANS *********************
The Critical Security Controls Summit strives to bring you the most up-todate thinking on the hottest topics. Jane Lute former Deputy Secretary of the DHS to keynote! Register today http://www.sans.org/info/136992
============================================================TRAINING UPDATE
- -- Industrial Control System (ICS) Security Training In-depth, hands-on technical courses taught by top SCADA experts. Gain the most current information regarding SCADA and Control System threats and learn how to best prepare to defend against them. Leave the event with solutions that you can immediately put to use in your organization.
--Washington, DC (August 12-August 16)
http://www.sans.org/event/ics-security-training-washington-dc
- -- SANS Virginia Beach 2013 Virginia Beach, VA August 19-30, 2013
10 courses. Bonus evening presentations include Thanks for Recovering
... Now I Can Hack You!; Everything I Know is Wrong!; and APT: It is
Time to Act.
http://www.sans.org/event/virginia-beach-2013
- -- SANS Capital City 2013 Washington, DC September 3-8, 2013
6 courses. Bonus evening presentations include Look Ma, No Exploits! -
The Recon-ng Framework; and How the West was Pwned.
Keynote address: Who's Watching the Watchers?
http://www.sans.org/event/sans-capital-city-2013
- -- SANS Network Security 2013 Las Vegas, NV September 14-23, 2013
50 courses. Bonus evening presentations include The Security Impact of
IPv6; Unleashing the Dogs of (cyber) War; and InfoSec Vertigo: Small
Medical Lab Wages War Against InfoSec Vendor, US Government, and Big DC
Law Firm.
http://www.sans.org/event/network-security-2013
-- SANS Seattle 2013 Seattle, WA October 7-14, 2013
8 courses. Bonus evening presentations include "So What?" The Most
Important Question in Information Security; Why Our Defenses are Failing
Us. One Click is All it Takes ...; and Sick Anti-Analysis Mechanisms in
the Wild.
http://www.sans.org/event/seattle-2013
- -- SANS Baltimore 2013 Baltimore, MD October 14-19, 2013
9 courses. Bonus evening presentations include An Introduction to
PowerShell for Security Assessments; The Security Impact of IPv6; and
Tales from the Crypt: TrueCrypt Analysis.
http://www.sans.org/event/baltimore-2013
- -- SANS Forensics Prague 2013Prague, Czech RepublicOctober 6-13 2013
SANS's European forensics summit and dedicated forensics training event.
Four of SANS's most important forensics training courses and
opportunities to network with leading digital forensics experts.
http://www.sans.org/event/forensics-prague-2013
- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013
SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach.
http://www.sans.org/event/dubai-2013
- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- -- Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) August 21 Webcast! Managing Identities in the Cloud Without
Sacrificing Corporate Control: A Review of McAfees Web-Focused Identity
Tools, featuring Dave Shackleford
http://www.sans.org/info/136997
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Firefox 17 bug exploited to de-anonymize Tor users
Description: A Javascript bug in Firefox version 17.0.7, the version
released as part of the Tor Browser Bundle, has been observed being
exploited in the wild with a payload that de-anonymizes the infected
user. Tracking information collected by this malware was then sent to a
hard-coded IP address in northern Virginia; speculation has run rampant
among the security community about the ultimate owner of the address,
with signs pointing towards the federal government. While a fix for the
bug enabling the attack is available, the issue highlights the
difficulty of ensuring anonymity on the Internet, even when using
supposedly secure services such as Tor.
Reference:
http://arstechnica.com/security/2013/08/attackers-wield-firefox-exploit-to-uncloak-anonymous-tor-users/
https://lists.torproject.org/pipermail/tor-announce/2013-August/000089.html
https://blog.torproject.org/blog/hidden-services-current-events-and-freedom-hosting
http://tsyrklevich.net/tbb_payload.txt
Snort SID: 27568
ClamAV: N/A
Title: OpenX server packages backdoored since November 2012
Description: An announcement this week from the OpenX ad server team
noted that a backdoor had recently been discovered in their official
source code distributions, and that the backdoor has been present since
November 2012. While packages have since been cleaned, exploitation is
occurring in the wild, with attacks consisting of simple POST requests
to a specific file that allow for remote code execution on the infected
server. Users are urged to follow simple instructions being provided by
the community for checking their servers, and cleaning any that are
infected immediately.
Reference:
http://blog.openx.org/08/important-update-for-openx-source-2-8-10-users/
https://isc.sans.edu/diary/OpenX+Ad+Server+Backdoor/16303
Snort SID: 27578
ClamAV: Backdoor.OpenX.CVE_2013_4211
Title: APT1/Comment Crew discovered breaking into a honeypot of a water plant
Description: A security researcher at Trend Micro detailed last week at
Black Hat how the now-notorious Chinese hacking group known alternately
as APT1 or the Comment Crew was discovered this past December breaking
into a decoy water plant, which they were able to gain complete control
over. The other attacks against industrial honeypots showed the ease
with which attackers can compromise such systems, and raises the very
real possibility that municipalities around the world are already
compromised by live attackers.
Reference:
http://www.technologyreview.com/news/517786/chinese-hacking-team-caught-taking-over-decoy-water-plant/
Snort SID: N/A
ClamAV: N/A
Title: Android weblogin shown to be vulnerable to trivial social
engineering attacks
Description: Researcher Craig Young of Tripwire demonstrated last week
at Defcon how Android applications which request permissions to
interface with the Google applications suite can take tokens which grant
access to one service, such as YouTube, and then use them throughout the
Google ecosystem, granting attackers the ability to change passwords,
alter domain services, access email and calendars, etc. While Google has
already made some fixes that require additional authentication beyond
weblogin tokens for sensitive operations, many issues remain;
additionally, the app used to demonstrate the problem was deployed
successfully on the Google Play store, demonstrating how easy it would
be for a malicious application to exploit this ecosystem weakness.
Reference:
http://secur3.us/DC21Slides.pdf
Snort SID: N/A
ClamAV: N/A
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Blackhat 2013 presentation materials available:
https://www.blackhat.com/us-13/archives.html
Trusteer Rapport memory selfcheck bypass:
http://seclists.org/fulldisclosure/2013/Aug/45
Master key Android bug used to trojanize banking app in South Korea:
http://blog.trendmicro.com/trendlabs-security-intelligence/master-key-android-vulnerability-used-to-trojanize-banking-app/
"Private Exploit Pack" now featuring CVE-2013-1347:
http://malware.dontneedcoffee.com/2013/07/pep-new-bep.html
Towards illuminating a censorship monitor's model to facilitate evasion:
http://www.icir.org/vern/papers/censorship-model.foci13.pdf
Japanese toilet users vulnerable to Bluetooth bidet attacks:
http://www.theverge.com/2013/8/3/4584980/inax-satis-bluetooth-toilet-android-app-vulnerability
Car hacking: the content:
http://blog.ioactive.com/2013/08/car-hacking-content.html
BSides Las Vegas videos:
http://www.irongeek.com/i.php?page=videos%2Fbsideslasvegas2013%2Fmainlist
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2013-1690
Title: Mozilla Firefox JavaScript Runtime Vulnerability
Vendor: Mozilla
Description: Mozilla Firefox before 22.0, Firefox ESR 17.x before
17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
17.0.7 do not properly handle onreadystatechange events in conjunction
with page reloading, which allows remote attackers to cause a denial of
service (application crash) or possibly execute arbitrary code via a
crafted web site that triggers an attempt to execute data at an unmapped
memory location.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2011-0922
Title: HP Data Protector CMD Install Service Vulnerability
Vendor: HP
Description: The client in HP Data Protector allows remote attackers to
execute arbitrary programs via an EXEC_SETUP command that references a
UNC share pathname.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-3174
Title: Microsoft DirectShow GIF Parsing Memory Corruption Vulnerability
Vendor: Microsoft
Description: DirectShow in Microsoft Windows XP SP2 and SP3, Windows
Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,
Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote
attackers to execute arbitrary code via a crafted GIF file, aka
"DirectShow Arbitrary Memory Overwrite Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers
to execute arbitrary OGNL expressions via a parameter with a crafted (1)
action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-3163
Title: Microsoft Internet Explorer CBlockElement Use-after-Free Vulnerability
Vendor: Microsoft
Description: Microsoft Internet Explorer 8 through 10 allows remote
attackers to execute arbitrary code or cause a denial of service (memory
corruption) via a crafted web site, aka "Internet Explorer Memory
Corruption Vulnerability," a different vulnerability than CVE-2013-3144
and CVE-2013-3151.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2460
Title: Java Applet ProviderSkeleton Insecure Invoke Method
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK
7, allows remote attackers to affect confidentiality, integrity, and
availability via unknown vectors related to Serviceability. NOTE: the
previous information is from the June 2013 CPU. Oracle has not commented
on claims from another vendor that this issue allows remote attackers
to bypass the Java sandbox via vectors related to "insufficient access
checks" in the tracing component.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
MOST PREVALENT MALWARE FILES 7/30/2013 - 8/6/2013
COMPILED BY SOURCEFIRE
SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Typical Filename: C8A787C22000AE378610003396E67500D587FA4E.exe
Claimed Product: My Web Search Bar for Internet Explorer and FireFox
Claimed Publisher: MyWebSearch.com
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename:
smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product:
smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher:
smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: avz00001.dta
Claimed Product: avz00001.dta
Claimed Publisher: avz00001.dta
SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Typical Filename: winoaox.exe
Claimed Product: winoaox.exe
Claimed Publisher: winoaox.exe
SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Typical Filename: bf31a8d79f704f488e3dbcb6eea3b3e3
Claimed Product: bf31a8d79f704f488e3dbcb6eea3b3e3
Claimed Publisher: bf31a8d79f704f488e3dbcb6eea3b3e3
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
