@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
September 26, 2013=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 39
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 9/17/2013 - 9/24/2013
============================================================TOP VULNERABILITY THIS WEEK: Active exploitation of last week's Internet Explorer 0-day is continuing in the wild this week, with live exploit code beginning to appear on security research sites as of Tuesday. Since the public availability of exploit code generally leads to mass exploitation of broad-based vulnerabilities such as this one, administrators should assume that exploit kits and the like will incorporate the bug this week, and ensure that they have applied Microsoft's official FixIt while awaiting a full patch.
******************** Sponsored By EiQnetworks *********************
Concerned about security but don't have the time or resources to handle it?
How would you like to have:
- - Assistance implementing and measuring Critical Security Controls as
recommended by SANS
- - Continuous monitoring of significant events and potential impacts
together with remediation guidance
- - Support with compliance needs around PCI DSS, HIPAA, etc.
Get started today:
http://www.sans.org/info/139895
TRAINING UPDATE
- -- Securing the Internet of Things Summit (October 17-22, 2013) San Francisco, CA
The Internet of Things summit focuses on new solutions, demonstrates
security technology that already works and provides a force multiplier
to make the Internet of Things more secure.
http://www.sans.org/event/internet-of-things-summit
- -- Health Care Cyber Security Summit (October 17-24, 2013) San Francisco, CA
Meet leaders from the top health care organizations and see what really
works in securing and succeeding in the new health care environment -
balance security, compliance, and innovation.
http://www.sans.org/event/healthcare-summit
-- SANS Seattle 2013 Seattle, WA October 7-14, 2013
8 courses. Bonus evening presentations include "So What?" The Most
Important Question in Information Security; Why Our Defenses are Failing
Us. One Click is All it Takes ...; and Sick Anti-Analysis Mechanisms in
the Wild.
http://www.sans.org/event/seattle-2013
- -- SANS Baltimore 2013 Baltimore, MD October 14-19, 2013
9 courses. Bonus evening presentations include An Introduction to
PowerShell for Security Assessments; The Security Impact of IPv6; and
Tales from the Crypt: TrueCrypt Analysis.
http://www.sans.org/event/baltimore-2013
--SANS Chicago 2013 Chicago, ILOctober 28-November 2, 2013
7 courses. Bonus evening presentations include SANS 8 Mobile Device
Security Steps; and Privileged Domain Account Protection: How to Limit
Credentials Exposure.
http://www.sans.org/event/chicago-2013
- -- SANS Forensics Prague 2013Prague, Czech RepublicOctober 6-13 2013
SANS's European forensics summit and dedicated forensics training event.
Four of SANS's most important forensics training courses and
opportunities to network with leading digital forensics experts.
http://www.sans.org/event/forensics-prague-2013
- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013
SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach.
http://www.sans.org/event/dubai-2013
- -- SANS London 2013 London, UKNovember 16-25, 2013
17 courses. Bonus evening presentations include Real World Risk - What
Incident Responders Can Leverage From IT Operations; Information
Assurance Metrics: Practical Steps to Measurement; and APT: It Is Time
To Act.
http://www.sans.org/event/london-2013
- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- -- Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) Two new Analyst Papers in the SANS Reading room developed by John
Pescatore -
Application Security: Tools for Getting Support and Funding
http://www.sans.org/info/139900
How DDoS Detection and Mitigation can Fight Against Advanced Targeted
Attacks http://www.sans.org/info/139905
2) Seeking Security Pros: Join your peers to learn advancements in IR
and techniques to expose the threats that evade perimeter defenses.
Free seminar in Chicago, NYC & Atlanta.
http://www.sans.org/info/139910
3) Health Care Cyber Security Summit (October 17-24, 2013) San Francisco, CA
Meet leaders from the top health care organizations and see what really
works in securing and succeeding in the new health care environment -
balance security, compliance, and innovation.
http://www.sans.org/info/139915
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Attacks against Internet Explorer 0-day continuing in the wild
Description: Despite a major wave of publicity following the discovery
last week of a 0-day remote code execution flaw in Internet Explorer,
and the release of a workaround by Microsoft, in-the-wild exploitation
of the flaw (CVE-2013-3893) is continuing to take place, with security
vendor FireEye releasing an in-depth report about attacks occurring
specifically in Japan. Live exploit code began appearing on public
security research sites by Tuesday of this week, and worldwide
exploitation by exploit kits and other large-scale vectors is likely to
begin occurring well before the October 8 release of Microsoft's
standard patch cycle. System administrators are urged to ensure that
Microsoft's temporary fix has been applied immediately.
Reference:
http://www.fireeye.com/blog/technical/cyber-exploits/2013/09/operation-deputydog-zero-day-cve-2013-3893-attack-against-japanese-targets.html
http://community.websense.com/blogs/securitylabs/archive/2013/09/18/up-to-70-of-pcs-vulnerable-to-zero-day-cve-2013-3893.aspx
https://community.rapid7.com/community/infosec/blog/2013/09/24/ie-0-day-exploit-code-is-now-widely-available-cve-2013-3893
Snort SID: 27943, 27944
ClamAV: BC.Exploit.CVE_2013_3893
Title: Apple iPhone TouchID broken
Description: The Chaos Computer Club - one of the planet's oldest
hacking organizations - was declared the official winner of a bounty
program that sprung up over the weekend to crack the new touch ID
authentication system in new iPhone 5 hardware, after the group
successfully lifted a print, replicated it with commonly available
technology, and gained access to a phone protected by the system. The
contest featured its share of hacker drama, after a pledge of $10,000
to the crowd-funded bounty was made by a venture capitalist who later
reneged on his promise, after having received considerable media
coverage for the pledge.
Reference:
http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid
http://www.zdnet.com/charlatan-hijacks-iphone-5s-fingerprint-hack-contest-fools-press-7000020978/
Snort SID: N/A
ClamAV: N/A
Title: Fake iMessage for Android surfaces, sends data to China
Description: An unofficial Apple iMessage client appeared in Google's
Android market this week, with tens of thousands of downloads before
being pulled by Google. Several security researchers independently noted
that the application sent copies of all of the user's data to an IP
address in China without any warning to the end user. While the
developer of the app insisted that the data being sent was for
legitimate purposes, the episode shows how easy it is for rogue apps to
harvest huge amounts of data from unsuspecting users even in relatively
well-policed markets such as Google Play.
Reference:
https://plus.google.com/u/0/116098411511850876544/posts/UkgaXa1oa6M
http://www.engadget.com/2013/09/24/imessage-for-android-app-risk/
Snort SID: 28046
ClamAV: Andr.Trojan.FakeiMessage
Title: Java reflection attack allows remote code execution on Android < 4.2
Description: Security research firm MWR InfoSecurity released an
advisory this week detailing a reflection attack against the
addJavaScriptInterface functionality offered by the Android operating
system's WebKit component, which allows developers to define methods
which can be called by JavaScript. Although the original intent of the
functionality was to expose only clearly defined methods, a trivial
sequence of calls could allow full command execution by malicious web
pages if any methods are exported at all through this interface. While
the issue has been fixed in Android 4.2, MWR's research shows a wide
array of popular apps and ad networks still vulnerable to attacks.
Reference:
http://labs.mwrinfosecurity.com/blog/2013/09/24/webview-addjavascriptinterface-remote-code-execution/
Snort SID: 28043
ClamAV: Andr.Exploit.JavaReflect
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
F-Secure 1H13 threat report:
http://www.f-secure.com/static/doc/labs_global/Research/Threat_Report_H1_2013.pdf
Format string exploitation tutorial:
http://packetstorm.igor.onlinedirect.bg/papers/attack/formatstring-tutorial.pdf
Cracking WatchGuard passwords:
http://funoverip.net/2013/09/cracking-watchguard-passwords/
Data exfiltration in targeted attacks:
http://blog.trendmicro.com/trendlabs-security-intelligence/data-exfiltration-in-targeted-attacks/
Account hijacking with third-party login:
https://lightraft.com/blog/account-hijacking-with-third-party-login/
Building OS X trojans with AppleScript, homoglyphs, and iTunes:
http://www.tripwire.com/state-of-security/vulnerability-management/trojan-mac-building-os-x-trojans-applescript-homoglyphs-itunes/
Shylock financial malware back, targeting 2 dozen major banks:
http://threatpost.com/shylock-financial-malware-back-and-targeting-two-dozen-major-banks/102343#.Ujq5wFAkf2k.twitte
Global phishing survey: trends and domain name use, 1H2013:
http://docs.apwg.org/reports/APWG_GlobalPhishingSurvey_1H2013.pdf
Affiliate network for mobile malware impersonates Google Play:
http://www.webroot.com/blog/2013/09/18/affiliate-network-mobile-malware-impersonates-google-play-tricks-users-installing-premium-rate-sms-sending-rogue-apps/
Apple ships OS X 10.8.5 security update, fixes sudo bug at last:
http://nakedsecurity.sophos.com/2013/09/13/apple-ships-os-x-10-8-5-security-update-fixes-sudo-bug-at-last/
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2013-3205
Title: Microsoft Internet Explorer CCaret Use-After-Free (MS13-069)
Vendor: Microsoft
Description: Microsoft Internet Explorer 6 through 8 allows remote
attackers to execute arbitrary code or cause a denial of service (memory
corruption) via a crafted web site, aka "Internet Explorer Memory
Corruption Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-0810
Title: Microsoft Windows Theme File Handling Arbitrary Code Execution (MS13-071)
Vendor: Microsoft
Description: Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2,
Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers
to execute arbitrary code via a crafted screensaver in a theme file, aka
"Windows Theme File Remote Code Execution Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-4983
Title: Sophos Web Protection Appliance sblistpack Arbitrary Command Execution
Vendor: Sophos
Description: The get_referers function in /opt/ws/bin/sblistpack in
Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote
attackers to execute arbitrary commands via shell metacharacters in the
domain parameter to end-user/index.php.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-4811
Title: HP ProCurve Manager SNAC UpdateDomainControllerServlet File Upload
Vendor: HP
Description: UpdateDomainControllerServlet in the SNAC registration
server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and
Identity Driven Manager (IDM) 4.0 does not properly validate the adCert
argument, which allows remote attackers to upload .jsp files and
consequently execute arbitrary code via unspecified vectors, aka
ZDI-CAN-1743.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: Not Available
Title: Joomla! Unauthorised Uploads
Vendor: Joomla!
Description: Inadequate filtering leads to the ability to bypass file
type upload restrictions.
Affects Joomla! version 2.5.13 and earlier 2.5.x versions; and version
3.1.4 and earlier 3.x versions
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers
to execute arbitrary OGNL expressions via a parameter with a crafted (1)
action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
MOST PREVALENT MALWARE FILES 9/17/2013 - 9/24/2013
COMPILED BY SOURCEFIRE
SHA 256: D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503
MD5: 68b7f7a26b76805432e3d50009d2ab1f
VirusTotal: https://www.virustotal.com/file/D14B66BD4C4C8F66A6EDF2820FD4162D09B326BEAF6A42014596571E81A1A503/analysis/
Typical Filename: winidrg.exe
Claimed Product: winidrg.exe
Claimed Publisher: winidrg.exe
SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Typical Filename: m3SrchMn
Claimed Product: m3SrchMn
Claimed Publisher: m3SrchMn
SHA 256: 055788EB475E7AC5EA2E03383D3F95BCC88D62F06E4456A5F5DD6B9E78506AB5
MD5: 12336775941d49ce6a4d6f391cb5e02f
VirusTotal: https://www.virustotal.com/file/055788EB475E7AC5EA2E03383D3F95BCC88D62F06E4456A5F5DD6B9E78506AB5/analysis/
Typical Filename: WebCakeDesktop.exe
Claimed Product: WebCakeDesktop.exe
Claimed Publisher: WebCakeDesktop.exe
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: 02.tmp
Claimed Product: 02.tmp
Claimed Publisher: 02.tmp
SHA 256: 775B9D835E899CB8E68902F263FFD10933A361D6E61028CF6B8A3A8A05604308
MD5: 17f6d044c752f5fc46325cee933dd1f6
VirusTotal: https://www.virustotal.com/file/775B9D835E899CB8E68902F263FFD10933A361D6E61028CF6B8A3A8A05604308/analysis/
Typical Filename: BitGuard.dll
Claimed Product: BitGuard.dll
Claimed Publisher: BitGuard.dll
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
