@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
September 5, 2013=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 36
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 8/27/2013 - 9/3/2013
============================================================TOP VULNERABILITY THIS WEEK: A pre-authentication bug in the SSH daemon on Mikrotik-branded routers was announced this week by noted security researcher "kingcope", who included a simple Perl one-liner that would cause a crash and detailed information on system state for another bug that could lead to remote code execution. Over a quarter-million Internet-facing systems appear to be vulnerable at this time, and no patch is currently available from the manufacturer.
******************** Sponsored By Bit9 *********************
LIVE Webinar: Learn why traditional antivirus techniques are losing the battle against today's increasingly sophisticated malware. Register today for this live event and see how next-generation security solutions can work together to build your best defense against today's advanced threats and malware.
http://www.sans.org/info/138485
============================================================TRAINING UPDATE
- -- SANS Network Security 2013 Las Vegas, NV September 14-23, 2013
50 courses. Bonus evening presentations include The Security Impact of
IPv6; Unleashing the Dogs of (cyber) War; and InfoSec Vertigo: Small
Medical Lab Wages War Against InfoSec Vendor, US Government, and Big DC
Law Firm.
http://www.sans.org/event/network-security-2013
-- SANS Seattle 2013 Seattle, WA October 7-14, 2013
8 courses. Bonus evening presentations include "So What?" The Most
Important Question in Information Security; Why Our Defenses are Failing
Us. One Click is All it Takes ...; and Sick Anti-Analysis Mechanisms in
the Wild.
http://www.sans.org/event/seattle-2013
- -- SANS Baltimore 2013 Baltimore, MD October 14-19, 2013
9 courses. Bonus evening presentations include An Introduction to
PowerShell for Security Assessments; The Security Impact of IPv6; and
Tales from the Crypt: TrueCrypt Analysis.
http://www.sans.org/event/baltimore-2013
- -- SANS Forensics Prague 2013Prague, Czech RepublicOctober 6-13 2013
SANS's European forensics summit and dedicated forensics training event.
Four of SANS's most important forensics training courses and
opportunities to network with leading digital forensics experts.
http://www.sans.org/event/forensics-prague-2013
- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013
SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach.
http://www.sans.org/event/dubai-2013
- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- -- Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) Join John Pescatore and Tony Sager as they moderate a panel discussion on the upcoming SANS webcast titled, "Using the DHS Continuous Diagnostics and Mitigation Contract to Make Real Security Advances". Tuesday, September 10, 2013 at 10:00 AM EDT. http://www.sans.org/info/138235
2) Ad: Satisfied with your IPS? Tell us! Take our Survey and enter to win an iPad! http://www.sans.org/info/138495
3) Wanted: Healthcare InfoSec Professionals to Take our Survey & Enter to Win an iPad!! http://www.sans.org/info/138500
============================================================NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Intel microcode update fixes potential DoS for huge array of
processors
Description: An update to the software that helps translate assembler
instructions into hardware operations on CPUs was released by Intel to
little fanfare last month, but is now raising eyebrows after a message
posted to the Debian-User and Debian-Security lists this week, which
stated that the update fixes a potential crash across a huge swath of
modern Intel processors. While no details are publicly available at this
time about what is required to trigger such a crash - Intel describes
the cause as "a complex sequence of internal processor
micro-architectural events" in its official Erratum AAK167 - the
emergence of an exploit for this issue has the potential to cause an
unprecedented worldwide denial of service, given the range of impacted
processors. Concerned administrators of Debian stable systems have
instructions on how to apply the update now, and will have it
automatically at the next point release; users of other Linux
distributions can get the patch from Intel directly or look for it in
their OS' update mechanism. Windows users should look to their hardware
manufacturer for BIOS updates.
Reference:
http://lists.debian.org/debian-user/2013/09/msg00126.html
https://downloadcenter.intel.com/Detail_Desc.aspx?DwnldID=23082
http://www.intel.com/content/dam/www/public/us/en/documents/specification-updates/xeon-5500-specification-update.pdf
Snort SID: N/A
ClamAV: N/A
Title: Remotely exploitable, pre-authentication vulnerability announced
in Mikrotik routers
Description: Well-known security researcher "kingcope" posted an
announcement this week of a trivially-triggered, pre-authentication heap
corruption vulnerability in the custom SSH daemon shipping with
Mikrotik-branded routers, which have thrived as a low-cost alternative
to better-known router brands. Systems can be crashed with a single line
of Perl provided in the post; remote command execution is not provided
at this time, but is likely in the future as other researchers take note
of the bug. As no updates are available from the manufacturer at this
time, users of impacted devices - which number over 290,000 according
to popular device search engine Shodan - are urged to monitor their logs
for any signs of suspicious activity, particularly since the fact that
the attack occurs after the SSH stream has gone encrypted means that
network-based detection will be limited at best.
Reference:
http://kingcope.wordpress.com/2013/09/02/mikrotik-routeros-5-and-6-sshd-remote-preauth-heap-corruption/
http://www.shodanhq.com/search?q=ROSSSH+port%3A22
Snort SID: N/A
ClamAV: N/A
Title: Malware authors capitalize on PRISM concerns
Description: In a move that many would consider surprising only in that
it took so long to happen, malware authors have recently begun
distributing "ransomware" - malware that promises to unlock a victim's
system only they have paid the specified ransom - claiming that the
infected user has been detected committing a computer crime by the NSA's
PRISM apparatus. While current-event flavored malware is nothing new,
this particular strain appears to be the among the first to capitalize
on government surveillance concerns raised recently by Edward Snowden's
document-leaking campaign.
Reference:
http://malware.dontneedcoffee.com/2013/08/prism-themed-ransomware.html
Snort SID: 27801 - 27804
ClamAV: Win.Trojan.PRISM
Title: Sophisticated Linux malware spotted in the wild
Description: A new backdoor for Linux systems, capable of data theft,
update blocking, and with a full-featured command execution interface,
has recently been spotted in the wild. While discovery is a
straightforward process for system administrators searching for
appropriate processes, infected systems have the potential to stay that
way for longer than their Windows counterparts, as many Linux users do
not expect to find malware on their desktops.
Reference:
http://blog.avast.com/2013/08/27/linux-trojan-hand-of-thief-ungloved/
Snort SID: 27746
ClamAV: Unix.Trojan.Hanthie
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Shady paths: Leveraging surfing crowds to detect malicious web pages:
http://cs.ucsb.edu/~gianluca/papers/redirections-ccs2013.pdf
Deobfuscating the CK exploit kit:
http://www.kahusecurity.com/2013/deobfuscating-the-ck-exploit-kit/
Anatomy of a dropped call - how to jam a city with 11 customized mobile phones:
http://nakedsecurity.sophos.com/2013/08/29/anatomy-of-a-dropped-call-how-to-jam-a-city-with-11-customised-mobile-phones/
Building a multiplatform shellcode header:
http://www.chokepoint.net/2013/09/building-multiplatform-shellcode-header.html
Heap spraying browsers using Adobe Flash's ActionScript:
http://www.greyhathacker.net/?p=717
Cybercrime-friendly underground traffic exchanges:
http://blog.webroot.com/2013/08/29/cybercrime-friendly-underground-traffic-exchanges-help-facilitate-fraudulent-and-malicious-activity-part-two/
Compiling payloads on the fly for PostgreSQL:
https://community.rapid7.com/community/metasploit/blog/2013/01/08/compiling-payloads-on-the-fly-for-postgresql
PE runtime structures:
http://uncomputable.blogspot.com/2013/08/pe-runtime-data-structures-v1.html
Visualization of a DDoS attack:
http://www.youtube.com/watch?v=hNjdBSoIa8k
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2013-2370
Title: HP LoadRunner Remote Code Execution
Vendor: HP
Description: Unspecified vulnerability in HP LoadRunner before 11.52
allows remote attackers to execute arbitrary code via unknown vectors,
aka ZDI-CAN-1671.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: CVE-2013-3763
Title: Oracle Endeca Server Remote Command Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Oracle Endeca Server
component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote
authenticated users to affect confidentiality and integrity via unknown
vectors, a different vulnerability than CVE-2013-3764.
CVSS v2 Base Score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
ID: Not Available
Title: Joomla! Unauthorised Uploads
Vendor: Joomla!
Description: Inadequate filtering leads to the ability to bypass file
type upload restrictions. Affects Joomla! version 2.5.13 and earlier
2.5.x versions; and version 3.1.4 and earlier 3.x versions.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2465
Title: Java storeImageArray() Invalid Array Indexing Vulnerability
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45
and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote
attackers to affect confidentiality, integrity, and availability via
unknown vectors related to 2D. NOTE: the previous information is from
the June 2013 CPU. Oracle has not commented on claims from another
vendor that this issue allows remote attackers to bypass the Java
sandbox via vectors related to "Incorrect image channel verification"
in 2D.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers
to execute arbitrary OGNL expressions via a parameter with a crafted (1)
action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2460
Title: Java Applet ProviderSkeleton Insecure Invoke Method
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK
7, allows remote attackers to affect confidentiality, integrity, and
availability via unknown vectors related to Serviceability. NOTE: the
previous information is from the June 2013 CPU. Oracle has not commented
on claims from another vendor that this issue allows remote attackers
to bypass the Java sandbox via vectors related to "insufficient access
checks" in the tracing component.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
MOST PREVALENT MALWARE FILES 8/27/2013 - 9/3/2013
COMPILED BY SOURCEFIRE
SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Typical Filename: m3SrchMn
Claimed Product: m3SrchMn
Claimed Publisher: m3SrchMn
SHA 256: D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503
MD5: 68b7f7a26b76805432e3d50009d2ab1f
VirusTotal: https://www.virustotal.com/file/D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503/analysis/
Typical Filename: winmjtas.exe
Claimed Product: winmjtas.exe
Claimed Publisher: winmjtas.exe
SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Typical Filename: mhjsm.sys
Claimed Product: mhjsm.sys
Claimed Publisher: mhjsm.sys
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: 02.tmp
Claimed Product: 02.tmp
Claimed Publisher: 02.tmp
SHA 256: 144A9D9A35A2210FDAC2CA23660671C7C9A2905EA5A7EC9220ADC336A84BAF93
MD5: d2a67ee9141d02336760a11919891038
VirusTotal: https://www.virustotal.com/file/144A9D9A35A2210FDAC2CA23660671C7C9A2905EA5A7EC9220ADC336A84BAF93/analysis/
Typical Filename: BrowserDefender.dll
Claimed Product: BrowserDefender.dll
Claimed Publisher: BrowserDefender.dll
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
