@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
September 13, 2013=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 37
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 9/3/2013 - 9/10/2013
============================================================TOP VULNERABILITY THIS WEEK: A Metasploit module emerged this week for a vulnerability silently patched by Microsoft in their July bulletin set. While the vulnerability is restricted to Internet Explorer 8, the publication of a simple exploit ensures that it will be used in the wild immediately.
******************** Sponsored By Bit9 *********************
47% of surveyed organizations have suffered a cyber-attack in the past year with a frightening 13% saying they do not even know if they have been attacked. These are among the results of the 2013 Cyber Security Study. Gain insight into the latest cyber security trends and download the report today
http://www.sans.org/info/139035
============================================================TRAINING UPDATE
- -- Securing the Internet of Things Summit (October 17-22, 2013) San Francisco, CA
The Internet of Things summit focuses on new solutions, demonstrates
security technology that already works and provides a force multiplier
to make the Internet of Things more secure.
http://www.sans.org/event/internet-of-things-summit
- -- Health Care Cyber Security Summit (October 17-24, 2013) San Francisco, CA
Meet leaders from the top health care organizations and see what really
works in securing and succeeding in the new health care environment -
balance security, compliance, and innovation.
http://www.sans.org/event/healthcare-summit
- -- SANS Network Security 2013 Las Vegas, NV September 14-23, 2013
50 courses. Bonus evening presentations include The Security Impact of
IPv6; Unleashing the Dogs of (cyber) War; and InfoSec Vertigo: Small
Medical Lab Wages War Against InfoSec Vendor, US Government, and Big DC
Law Firm.
http://www.sans.org/event/network-security-2013
-- SANS Seattle 2013 Seattle, WA October 7-14, 2013
8 courses. Bonus evening presentations include "So What?" The Most
Important Question in Information Security; Why Our Defenses are Failing
Us. One Click is All it Takes ...; and Sick Anti-Analysis Mechanisms in
the Wild.
http://www.sans.org/event/seattle-2013
- -- SANS Baltimore 2013 Baltimore, MD October 14-19, 2013
9 courses. Bonus evening presentations include An Introduction to
PowerShell for Security Assessments; The Security Impact of IPv6; and
Tales from the Crypt: TrueCrypt Analysis.
http://www.sans.org/event/baltimore-2013
- -- SANS Forensics Prague 2013Prague, Czech RepublicOctober 6-13 2013
SANS's European forensics summit and dedicated forensics training event.
Four of SANS's most important forensics training courses and
opportunities to network with leading digital forensics experts.
http://www.sans.org/event/forensics-prague-2013
- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013
SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach.
http://www.sans.org/event/dubai-2013
- -- SANS London 2013 London, UKNovember 16-25, 2013
17 courses.
http://www.sans.org/event/london-2013
- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- -- Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) Analyst Webcast: John Pescatore Analyst Webcast - Actionable Tools for Convincing Management to Fund Application Security. Thursday, September 19, 2013 at 1:00 PM EDT. http://www.sans.org/info/139040
2) Securing the Internet of Things Summit (October 17-22, 2013) San
Francisco, CA The Internet of Things summit focuses on new solutions,
demonstrates security technology that already works and provides a force
multiplier to make the Internet of Things more secure.
http://www.sans.org/info/139045
3) SANS Oracle Security Expert Tanya Baccam Reviews Oracle's new
combined Firewall/Audit Vault Product Thursday, Sept. 12, 1 PM EDT.
http://www.sans.org/info/139050
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Microsoft releases huge pile of patches
Description: Microsoft's monthly patch release this week contained a
whopping 47 CVEs, spread across 13 total bulletins. Only a single one
of the vulnerabilities was listed as having been previously disclosed,
with no note on in-the-wild exploitation on any of the bugs. The
patches, which run the gamut from privilege escalation to remote code
execution, are certain to present fertile ground for attackers going
forward, with exploits likely to emerge for at least some of the bugs
in the near future.
Reference:
http://technet.microsoft.com/en-us/security/bulletin/ms13-sep
http://vrt-blog.snort.org/2013/09/microsoft-update-tuesday-september-2013.html
Snort SID: 27818-27846, 27850-27860
ClamAV: HTML.Exploit.CVE_2013_3205, DOC.Exploit.CVE_2013_3852,
HTML.Exploit.CVE_2013_3204, HTML.Exploit.CVE_2013_3205,
BC.Exploit.CVE_2013_3206, XML.Exploit.CVE_2013_3137,
Xls.Exploit.CVE_2013_3158-1, HTML.Exploit.CVE_2013_3209,
Html.Exploit.CVE_2013_3845, Xls.Exploit.CVE_2013_1315,
Win.Exploit.CVE_2013_0810
Title: Silently patched Internet Explorer 8 exploit now has Metasploit
module
Description: After being discovered by security researcher Orange Tsai
earlier this year, and discussed at Hitcon 2013, a bug in Internet
Explorer version 8 is gaining new life this week, with a fully
functional Metasploit module for the attack being made public. Though
the issue was silently patched in Microsoft bulletin MS13-055 this July,
the widespread availability of a working attack makes it considerably
more likely that exploitation will occur in the wild in the near future.
Reference:
https://github.com/rapid7/metasploit-framework/commit/c3db41334bc510cf03cb99abdcfc6e4c8a11d8d6
https://speakerd.s3.amazonaws.com/presentations/0df98910d26c0130e8927e81ab71b214/for-share.pdf
Snort SID: 26666, 27908, 27909
ClamAV:
Title: Dropbox presents ASLR bypass for other programs when installed
Description: An independent security researcher this week made public a
surprising consequence of running the popular Dropbox file-sharing
software: doing so, at least on 32-bit systems, presents an ASLR-free
zone for exploiting other high-risk applications, such as web browsers
or file sharing clients. Specifically, Dropbox injects itself in DLL
form into open windows, and as such can be used by exploits targeting
the injected processes for code execution techniques that are typically
mitigated by ASLR. Mitigation includes using EMET to force ASLR on all
processes system-wide.
Reference:
http://codeinsecurity.wordpress.com/2013/09/09/installing-dropbox-prepare-to-lose-aslr/
Snort SID: N/A
ClamAV: N/A
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
How to crack Cobalt Strike and backdoor it:
http://blog.strategiccyber.com/2013/09/05/how-to-crack-cobalt-strike-and-backdoor-it/
Polishing Chrome for fun and profit:
https://labs.mwrinfosecurity.com/system/assets/538/original/mwri_polishing-chrome-slides-nsc_2013-09-06.pdf
Obad.a now being distributed via mobile botnets:
http://www.securelist.com/en/blog/8131/Obad_a_Trojan_now_being_distributed_via_mobile_botnets
Fun with VMware Utilities: vmware_mount exploit (CVE-2013-1662):
https://community.rapid7.com/community/metasploit/blog/2013/09/04/cve-2013-1662-vmware-mount-exploit
Large botnet cause of recent Tor network overload:
http://blog.fox-it.com/2013/09/05/large-botnet-cause-of-recent-tor-network-overload/
Users get routed: traffic correlation on Tor by realistic adversaries:
http://www.ohmygodel.com/publications/usersrouted-ccs13.pdf
Cross-site web socket hijacking:
http://www.christian-schneider.net/CrossSiteWebSocketHijacking.html
Scammers pop up in Android's calendar app:
http://www.christian-schneider.net/CrossSiteWebSocketHijacking.html
MIPS Linux routers use dummy get_cycles() implementation, weakening randomness:
https://lists.openwrt.org/pipermail/openwrt-devel/2013-September/021318.html
Allowing low-privileged users to create directories in "C:":
http://labs.portcullis.co.uk/blog/allowing-low-privileged-users-to-create-directories-in-c/
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2013-2367
Title: HP SiteScope Remote Code Execution
Vendor: HP
Description: Multiple unspecified vulnerabilities in HP SiteScope 11.20
and 11.21, when SOAP is used, allow remote attackers to execute
arbitrary code via unknown vectors, aka ZDI-CAN-1678.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-3184
Title: Microsoft Internet Explorer CFlatMarkupPointer Use-After-Free (MS13-059)
Vendor: Microsoft
Description: Microsoft Internet Explorer 7 through 10 allows remote
attackers to execute arbitrary code or cause a denial of service (memory
corruption) via a crafted web site, aka "Internet Explorer Memory
Corruption Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2370
Title: HP LoadRunner Remote Code Execution
Vendor: HP
Description: Unspecified vulnerability in HP LoadRunner before 11.52
allows remote attackers to execute arbitrary code via unknown vectors,
aka ZDI-CAN-1671.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: Not Available
Title: Joomla! Unauthorised Uploads
Vendor: Joomla!
Description: Inadequate filtering leads to the ability to bypass file
type upload restrictions.
Affects Joomla! version 2.5.13 and earlier 2.5.x versions; and version
3.1.4 and earlier 3.x versions.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers
to execute arbitrary OGNL expressions via a parameter with a crafted (1)
action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
MOST PREVALENT MALWARE FILES 9/3/2013 - 9/10/2013
COMPILED BY SOURCEFIRE
SHA 256: CB6873925C7ABF41B494B722D6FA350938800B9BD877A251DE7767E391200F65
MD5: 2c2c06dedc3a3b089d6e8813b2d49b04
VirusTotal:
https://www.virustotal.com/file/CB6873925C7ABF41B494B722D6FA350938800B9BD877A251DE7767E391200F65/analysis/
Typical Filename: NirCmd
Claimed Product: NirCmd
Claimed Publisher: NirCmd
SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal:
https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Typical Filename: m3SrchMn
Claimed Product: m3SrchMn
Claimed Publisher: m3SrchMn
SHA 256: D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503
MD5: 68b7f7a26b76805432e3d50009d2ab1f
VirusTotal:
https://www.virustotal.com/file/D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503/analysis/
Typical Filename: fcjdnu.exe
Claimed Product: fcjdnu.exe
Claimed Publisher: fcjdnu.exe
SHA 256: E83A61AE6CFED6861AFDFA73CA41B0000BFCFD4FF710B8C0067805024286CD07
MD5: 8bc3498a39fb2d290a8975fd5419eb55
VirusTotal:
https://www.virustotal.com/file/E83A61AE6CFED6861AFDFA73CA41B0000BFCFD4FF710B8C0067805024286CD07/analysis/
Typical Filename: 8bc3498a39fb2d290a8975fd5419eb55
Claimed Product: 8bc3498a39fb2d290a8975fd5419eb55
Claimed Publisher: 8bc3498a39fb2d290a8975fd5419eb55
SHA 256: 6DDD0C3C4CC0A59E91964177139E979EF2D47C6C4645AADAC6A7A99A0DB16D12
MD5: e6daf677556826186b78b03d035be182
VirusTotal:
https://www.virustotal.com/file/6DDD0C3C4CC0A59E91964177139E979EF2D47C6C4645AADAC6A7A99A0DB16D12/analysis/
Typical Filename: e6daf677556826186b78b03d035be182
Claimed Product: e6daf677556826186b78b03d035be182
Claimed Publisher: e6daf677556826186b78b03d035be182
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
