@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
August 22, 2013=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 34
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 8/13/2013 - 8/20/2013
============================================================TOP VULNERABILITY THIS WEEK: Exploit code released for recently patched Java vulnerabilities was weaponized by exploit-kit authors within a matter of days over the past week, after publication by the PacketStorm bug bounty program. The vulnerabilities are now being hit in the wild by a variety of popular exploit kits; users are urged to verify that they have the latest patches applied immediately.
******************** Sponsored By Bit9 *********************
Think you're safe from the APT? 63% of security professionals think it is only a matter of time until their enterprise is targeted by an APT. Take this short assessment to learn how safe you really are. When you're done you'll receive a customized action plan to help you better protect your organization.
Start Here http://www.sans.org/info/137732
============================================================TRAINING UPDATE
- -- SANS Virginia Beach 2013 Virginia Beach, VA August 19-30, 2013
10 courses. Bonus evening presentations include Thanks for Recovering
... Now I Can Hack You!; Everything I Know is Wrong!; and APT: It is
Time to Act.
http://www.sans.org/event/virginia-beach-2013
- -- SANS Capital City 2013 Washington, DC September 3-8, 2013
6 courses. Bonus evening presentations include Look Ma, No Exploits! -
The Recon-ng Framework; and How the West was Pwned.
Keynote address: Who's Watching the Watchers?
http://www.sans.org/event/sans-capital-city-2013
- -- SANS Network Security 2013 Las Vegas, NV September 14-23, 2013
50 courses. Bonus evening presentations include The Security Impact of
IPv6; Unleashing the Dogs of (cyber) War; and InfoSec Vertigo: Small
Medical Lab Wages War Against InfoSec Vendor, US Government, and Big DC
Law Firm.
http://www.sans.org/event/network-security-2013
-- SANS Seattle 2013 Seattle, WA October 7-14, 2013
8 courses. Bonus evening presentations include "So What?" The Most
Important Question in Information Security; Why Our Defenses are Failing
Us. One Click is All it Takes ...; and Sick Anti-Analysis Mechanisms in
the Wild.
http://www.sans.org/event/seattle-2013
- -- SANS Baltimore 2013 Baltimore, MD October 14-19, 2013
9 courses. Bonus evening presentations include An Introduction to
PowerShell for Security Assessments; The Security Impact of IPv6; and
Tales from the Crypt: TrueCrypt Analysis.
http://www.sans.org/event/baltimore-2013
- -- SANS Forensics Prague 2013Prague, Czech RepublicOctober 6-13 2013
SANS's European forensics summit and dedicated forensics training event.
Four of SANS's most important forensics training courses and
opportunities to network with leading digital forensics experts.
http://www.sans.org/event/forensics-prague-2013
- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013
SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach.
http://www.sans.org/event/dubai-2013
- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- -- Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) Analyst Webcast: Tools for Convincing Management to Fund Application
Security
Thursday, September 19, 2013 at 1:00 PM EDT (1700 UTC/GMT)
Featuring: John Pescatore and Jeremiah Grossman
http://www.sans.org/info/137737
2) Wanted: Healthcare InfoSec Professionals to Take our Survey & Enter
to Win an iPad!!
http://www.sans.org/info/137742
3) Satisfied with your IPS? Tell us! Take our Survey and enter to win an
iPad!
http://www.sans.org/info/137747
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Recent Java exploits rapidly weaponizing in the wild
Description: Exploit code for a group of Java vulnerabilities patched in
Oracle's June 2013 patch release has been made public over the last two
weeks by the PacketStorm bug bounty program, and exploit kit authors and
other malicious actors have been quick to weaponize the code and begin
using it in the wild. Noted exploit kit researcher Kaffeine has already
confirmed the presence of one or both exploits in half a dozen distinct
kits, a particularly rapid uptake rate for an already-patched set of
bugs. As always, administrators are urged to ensure that all systems
under their control are properly patched.
Reference:
http://packetstormsecurity.com/files/122865/
http://packetstormsecurity.com/files/122806/
http://malware.dontneedcoffee.com/2013/08/cve-2013-2465-integrating-exploit-kits.html
Snort SID: 27621, 27622, 27672 - 27677, 27691 - 27694
ClamAV: Java.Exploit.CVE_2013_2465, Java.Exploit.CVE_2013_2459
Title: Denial of service in BIND in the wild
Description: A recently announced vulnerability in the popular BIND DNS
service is being exploited in the wild, according to notes in the ISC
vulnerability announcement included with their official patches. The
issue, which can be exploited with a single packet, impacts the entire
version 9 code base, and will hit default configurations there.
Administrators should patch immediately, or upgrade to BIND 10 if
possible, as several versions of the BIND 9 code base are past
end-of-life and will not be patched against this issue.
Reference:
https://kb.isc.org/article/AA-01015
Snort SID: 27666
ClamAV: N/A
Title: New attacks against security of TLS announced
Description: Researchers presenting at the 22nd annual USENIX security
symposium last week announced a pair of partial plaintext recovery
attacks against TLS. While the issues require rapidly repeated original
plaintext in order to work, the researchers showed practical cases where
necessary conditions would occur, though stopped short of providing any
proof-of-concept code. Given this and related attacks discovered over
the course of the last few years, such as the BEAST attack, developers
of web applications secured by TLS should consider adding randomization
to their plaintext messages as a proactive security measure against
further attacks in this vein.
Reference:
https://www.usenix.org/system/files/conference/usenixsecurity13/sec13-paper_alfardan.pdf
Snort SID: N/A
ClamAV: N/A
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Alice in Warningland: A large-scale field study of browser security
warning effectiveness:
http://static.googleusercontent.com/external_content/untrusted_dlcp/research.google.com/en/us/pubs/archive/41323.pdf
A study in bots: Bitbot:
http://cylance.com/techblog/A-Study-in-Bots-Bitbot.shtml
Vulnerabilities that just won't die: compression bombs:
http://blog.cyberis.co.uk/2013/08/vulnerabilities-that-just-wont-die.html
Bypassing AirWatch root restriction:
https://www.netspi.com/blog/entryid/192/bypassing-airwatch-root-restriction
A closer look: Perkle Android malware kit:
http://krebsonsecurity.com/2013/08/a-closer-look-perkele-android-malware-kit/
Using patched QEMU and IDA pro to debug bootroms:
http://www.droid-developers.org/wiki/QEMU
So you think your domain controller is secure?
http://scripthappens.azurewebsites.net/?p=1
UXSS: Internet Explorer EUC-JP parsing bug:
http://insert-script.blogspot.co.at/2013/08/uxss-internet-explorer-euc-jp-parsing.html
Hacker posts Facebook bug report on Zuckerberg's wall:
http://rt.com/news/facebook-post-exploit-hacker-zuckerberg-621/#.UhA62dulSpE.twitter
Jekyll on iOS: when benign apps become evil:
https://www.usenix.org/system/files/conference/usenixsecurity13/sec13-paper_wang_2.pdf
ByeBye shell and the targeting of Pakistan:
https://community.rapid7.com/community/infosec/blog/2013/08/19/byebye-and-the-targeting-of-pakistan
ZFS forensics - recovering files from a destroyed Zpool:
http://www.joyent.com/blog/zfs-forensics-recovering-files-from-a-destroyed-zpool
Mitigating the LdrHotPatchRoutine DEP/ASLR bypass with MS13-063:
http://blogs.technet.com/b/srd/archive/2013/08/12/mitigating-the-ldrhotpatchroutine-dep-aslr-bypass-with-ms13-063.aspx
Trust in computing survey, part 2: less than half of developers use a
security development process:
http://blogs.technet.com/b/security/archive/2013/07/12/trust-in-computing-survey-part-2-less-than-half-of-developers-use-a-security-development-process.aspx
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: Not Available
Title: Joomla! Unauthorised Uploads
Vendor: Joomla!
Description: Inadequate filtering leads to the ability to bypass file
type upload restrictions.
Affects Joomla! version 2.5.13 and earlier 2.5.x versions; and version
3.1.4 and earlier 3.x versions
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2465
Title: Java storeImageArray() Invalid Array Indexing Vulnerability
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45
and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote
attackers to affect confidentiality, integrity, and availability via
unknown vectors related to 2D. NOTE: the previous information is from
the June 2013 CPU. Oracle has not commented on claims from another
vendor that this issue allows remote attackers to bypass the Java
sandbox via vectors related to "Incorrect image channel verification" in
2D.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-1690
Title: Mozilla Firefox JavaScript Runtime Vulnerability
Vendor: Mozilla
Description: Mozilla Firefox before 22.0, Firefox ESR 17.x before
17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
17.0.7 do not properly handle onreadystatechange events in conjunction
with page reloading, which allows remote attackers to cause a denial of
service (application crash) or possibly execute arbitrary code via a
crafted web site that triggers an attempt to execute data at an unmapped
memory location.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers
to execute arbitrary OGNL expressions via a parameter with a crafted (1)
action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2460
Title: Java Applet ProviderSkeleton Insecure Invoke Method
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK
7, allows remote attackers to affect confidentiality, integrity, and
availability via unknown vectors related to Serviceability. NOTE: the
previous information is from the June 2013 CPU. Oracle has not commented
on claims from another vendor that this issue allows remote attackers to
bypass the Java sandbox via vectors related to "insufficient access
checks" in the tracing component.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
MOST PREVALENT MALWARE FILES 8/13/2013 - 8/20/2013
COMPILED BY SOURCEFIRE
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/aa0bbaecb678868e1e7f57c7ca9d61b608b3d788be490790eb1d148beadf4615/analysis/
Typical Filename: -
Claimed Product: -
Claimed Publisher: -
SHA 256: B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96
MD5: 573b6cc513e1b7cd9e35b491eacc38f3
VirusTotal: https://www.virustotal.com/file/B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96/analysis/
Typical Filename: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Product: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Publisher: 573b6cc513e1b7cd9e35b491eacc38f3
SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal: https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/
Typical Filename: Keygen.exe
Claimed Product: Keygen.exe
Claimed Publisher: Keygen.exe
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: File_0_2.ok
Claimed Product: -
Claimed Publisher: -
SHA 256: A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03
MD5: e010f298c086c2e1d7265fd18aea2dfbaa9dcd35
VirusTotal: https://www.virustotal.com/file/A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03/analysis/
Typical Filename: lpkjnn.sys
Claimed Product: -
Claimed Publisher: -
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
