@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
August 29, 2013=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 35
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 8/20/2013 - 8/27/2013
============================================================TOP VULNERABILITY THIS WEEK: The .cn TLD was hit by what Chinese authorities described as the country's "largest-ever" DDoS attack over the weekend, disrupting service there for approximately four hours. The attack, whose source is so far unknown, highlights the vulnerability of the modern Internet to flooding attacks, which have been a growing scourge for financial institutions, governments, and others in the last few years.
******************** Sponsored By WhiteHat Security *********************
Analyst Webcast - Actionable Tools for Convincing Management to Fund
Application Security
Featuring: John Pescatore and Jeremiah Grossman. Join us in exploring
how to advance the state of application security across the industry.
Thursday, September 19, 2013 at 1:00 PM EDT.
http://www.sans.org/info/138192
============================================================TRAINING UPDATE
- -- SANS Capital City 2013 Washington, DC September 3-8, 2013
6 courses. Bonus evening presentations include Look Ma, No Exploits! -
The Recon-ng Framework; and How the West was Pwned.
Keynote address: Who's Watching the Watchers?
http://www.sans.org/event/sans-capital-city-2013
- -- SANS Network Security 2013 Las Vegas, NV September 14-23, 2013
50 courses. Bonus evening presentations include The Security Impact of
IPv6; Unleashing the Dogs of (cyber) War; and InfoSec Vertigo: Small
Medical Lab Wages War Against InfoSec Vendor, US Government, and Big DC
Law Firm.
http://www.sans.org/event/network-security-2013
-- SANS Seattle 2013 Seattle, WA October 7-14, 2013
8 courses. Bonus evening presentations include "So What?" The Most
Important Question in Information Security; Why Our Defenses are Failing
Us. One Click is All it Takes ...; and Sick Anti-Analysis Mechanisms in
the Wild.
http://www.sans.org/event/seattle-2013
- -- SANS Baltimore 2013 Baltimore, MD October 14-19, 2013
9 courses. Bonus evening presentations include An Introduction to
PowerShell for Security Assessments; The Security Impact of IPv6; and
Tales from the Crypt: TrueCrypt Analysis.
http://www.sans.org/event/baltimore-2013
- -- SANS Forensics Prague 2013Prague, Czech RepublicOctober 6-13 2013
SANS's European forensics summit and dedicated forensics training event.
Four of SANS's most important forensics training courses and
opportunities to network with leading digital forensics experts.
http://www.sans.org/event/forensics-prague-2013
- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013
SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach.
http://www.sans.org/event/dubai-2013
- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- -- Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) Wanted: Healthcare InfoSec Professionals to Take our Survey & Enter
to Win an iPad!!
http://www.sans.org/info/138197
2) Join John Pescatore and Tony Sager as they moderate a panel
discussion on the upcoming SANS webcast titled, "Using the DHS
Continuous Diagnostics and Mitigation Contract to Make Real Security
Advances?. Tuesday, September 10, 2013 at 10:00 AM EDT.
http://www.sans.org/info/138202
3) Analyst Webcast: How to Fight the Real DDoS Threat Thursday, September 05, 2013 at 12:30 PM EDT.Featuring: John Pescatore and Rakesh Shah. http://www.sans.org/info/138207
============================================================NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: China suffers "largest-ever" DDoS attack
Description: An attack on the .cn registry and associated DNS services
hit at midnight Sunday local time this weekend, taking out service for a
large swath of the Chinese portion of the Internet. The outage, which
prompted an official apology from the state-run China Internet Network
Information Center, was described as the biggest attack to ever hit the
country's core infrastructure. The source of the attacks is unclear at
this point, with some arguing that even a single unknown individual may
have been responsible.
Reference:
http://www.voanews.com/content/china-hit-by-largest-ever-hack-attack/1737132.html
http://threatpost.com/service-restored-to-cn-domain-after-large-ddos-attack
http://www.cnnic.net.cn/gjymaqzx/aqgg/aqggaqsj/201308/t20130826_41325.htm
Snort SID: N/A
ClamAV: N/A
Title: New Android malware sample uses SMTP to send mail
Description: While most Android malware uses some combination of SMS,
HTTP, and/or a custom binary protocol to communicate with the outside
world, a recently discovered sample from China uses SMTP to send stolen
data to its controllers. This novel technique illustrates the growing
complexity of Android malware, which continues to thrive in third-party
markets, particularly in Asia.
Reference:
http://www.f-secure.com/weblog/archives/00002594.html
Snort SID: 27725
ClamAV: ANDR.Trojan.SMSAgent-1
Title: New version of DirtJumper malware adds anti-DDoS tool features
Description: In an excellent illustration of the ongoing cat-and-mouse
game between malware creators and network defenders, a new version of
the popular DirtJumper DDoS software was recently released which
intelligently probes for the presence of certain types of network
defense tools. While security vendors are responding by updating their
detection mechanisms, such measures are reactive at best, and will
necessarily suffer from coverage gaps when further updates to the
toolset are released.
Reference:
http://www.crn.com/news/security/240160429/dirt-jumper-ddos-toolkit-gets-security-evasion-functionality.htm
Snort SID: 25903 - 25927
ClamAV: DoS.DirtJumper
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Trafficking fraudulent accounts: the role of the underground market in
Twitter spam and abuse:
https://www.usenix.org/system/files/conference/usenixsecurity13/sec13-paper_thomas.pdf
Using MySQL locally for testing SQL injection techniques and syntaxes: http://www.chokepoint.net/2013/08/using-mysql-locally-for-testing-sql.html
Security analysis of PRNGs with input: /dev/random is not robust:
http://eprint.iacr.org/2013/338
OpenSSL PRNG is not (really) fork-safe:
http://emboss.github.io/blog/2013/08/21/openssl-prng-is-not-really-fork-safe/
Responding to attacks on Apache Struts 2:
https://www.mandiant.com/blog/responding-attacks-apache-struts2/
Parsing SVN entries files with PowerShell:
https://www.netspi.com/blog/entryid/193/parsing-svn-entries-files-with-powershell
Cybercrooks use DDoS attacks to mask theft of banks' millions:
http://news.cnet.com/8301-1009_3-57599646-83/cybercrooks-use-ddos-attacks-to-mask-theft-of-banks-millions/
Who wrote the Pincer Android trojan?
http://krebsonsecurity.com/2013/08/who-wrote-the-pincer-android-trojan/
SIMET box firmware analysis: embedded device hacking and forensics:
http://w00tsec.blogspot.com/2013/08/simet-box-firmware-analysis-embedded.html
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2013-3763
Title: Oracle Endeca Server Remote Command Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Oracle Endeca Server
component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote
authenticated users to affect confidentiality and integrity via unknown
vectors, a different vulnerability than CVE-2013-3764.
CVSS v2 Base Score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
ID: Not Available
Title: Joomla! Unauthorised Uploads
Vendor: Joomla!
Description: Inadequate filtering leads to the ability to bypass file
type upload restrictions.
Affects Joomla! version 2.5.13 and earlier 2.5.x versions; and version
3.1.4 and earlier 3.x versions
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2465
Title: Java storeImageArray() Invalid Array Indexing Vulnerability
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45
and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote
attackers to affect confidentiality, integrity, and availability via
unknown vectors related to 2D. NOTE: the previous information is from
the June 2013 CPU. Oracle has not commented on claims from another
vendor that this issue allows remote attackers to bypass the Java
sandbox via vectors related to "Incorrect image channel verification" in
2D.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-1690
Title: Mozilla Firefox JavaScript Runtime Vulnerability
Vendor: Mozilla
Description: Mozilla Firefox before 22.0, Firefox ESR 17.x before
17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
17.0.7 do not properly handle onreadystatechange events in conjunction
with page reloading, which allows remote attackers to cause a denial of
service (application crash) or possibly execute arbitrary code via a
crafted web site that triggers an attempt to execute data at an unmapped
memory location.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers
to execute arbitrary OGNL expressions via a parameter with a crafted (1)
action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2460
Title: Java Applet ProviderSkeleton Insecure Invoke Method
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK
7, allows remote attackers to affect confidentiality, integrity, and
availability via unknown vectors related to Serviceability. NOTE: the
previous information is from the June 2013 CPU. Oracle has not commented
on claims from another vendor that this issue allows remote attackers to
bypass the Java sandbox via vectors related to "insufficient access
checks" in the tracing component.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
MOST PREVALENT MALWARE FILES 8/20/2013 - 8/27/2013
COMPILED BY SOURCEFIRE
SHA 256: CB6873925C7ABF41B494B722D6FA350938800B9BD877A251DE7767E391200F65
MD5: 2c2c06dedc3a3b089d6e8813b2d49b04
VirusTotal: https://www.virustotal.com/file/CB6873925C7ABF41B494B722D6FA350938800B9BD877A251DE7767E391200F65/analysis/
Typical Filename: NirCmd
Claimed Product: NirCmd
Claimed Publisher: NirCmd
SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Typical Filename: m3SrchMn
Claimed Product: m3SrchMn
Claimed Publisher: m3SrchMn
SHA 256: D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503
MD5: 68b7f7a26b76805432e3d50009d2ab1f
VirusTotal: https://www.virustotal.com/file/D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503/analysis/
Typical Filename: winnltxq.exe1
Claimed Product: winnltxq.exe1
Claimed Publisher: winnltxq.exe1
SHA 256: E83A61AE6CFED6861AFDFA73CA41B0000BFCFD4FF710B8C0067805024286CD07
MD5: 8bc3498a39fb2d290a8975fd5419eb55
VirusTotal: https://www.virustotal.com/file/E83A61AE6CFED6861AFDFA73CA41B0000BFCFD4FF710B8C0067805024286CD07/analysis/
Typical Filename: 8bc3498a39fb2d290a8975fd5419eb55
Claimed Product: 8bc3498a39fb2d290a8975fd5419eb55
Claimed Publisher: 8bc3498a39fb2d290a8975fd5419eb55
SHA 256: 6DDD0C3C4CC0A59E91964177139E979EF2D47C6C4645AADAC6A7A99A0DB16D12
MD5: e6daf677556826186b78b03d035be182
VirusTotal: https://www.virustotal.com/file/6DDD0C3C4CC0A59E91964177139E979EF2D47C6C4645AADAC6A7A99A0DB16D12/analysis/
Typical Filename: e6daf677556826186b78b03d035be182
Claimed Product: e6daf677556826186b78b03d035be182
Claimed Publisher: e6daf677556826186b78b03d035be182
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
