@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
February 14, 2013=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 07
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 2/5/2013 - 2/12/2013
============================================================TOP VULNERABILITY THIS WEEK: A pair of recent Adobe patches have closed off vulnerabilities that were being exploited in the wild as targeted 0-days, with payloads that used a new technique to evade operating-system level mitigations of ASLR and DEP.
============================================================TRAINING UPDATE
- --SANS 2013 Orlando, FL March 8-March 15, 2013
46 courses. Bonus evening presentations include Why Our Defenses Are
Failing Us: One Click Is All It Takes ...; Human Nature and Information
Security: Irrational and Extraneous Factors That Matter; and
Over-Zealous Social Media Investigations: Beware the Privacy Monster.
http://www.sans.org/event/sans-2013
- --North American Industrial Controls Systems and SCADA Summit 2013
Lake Buena Vista, FL February 6-13, 2013
The only technical security and training program in ICS security - for
program managers, control systems engineers, IT security professionals
and critical infrastructure protection specialists from asset owning and
operating organizations along with control systems and security vendors
who have innovative solutions for improving security. Every attendee
leaves with new tools and techniques they can put to work immediately.
8 courses. Bonus evening presentation: The SANS SCADA Dinner Theater
Players Present: From Exposure to Closure - Act III.
http://www.sans.org/event/north-american-scada-2013
- --SANS Secure Singapore 2013 February 25-March 2, 2013
6 courses. Bonus evening presentations include APT: It is Time to Act;
and Security of National eID (smartcard-based) Web Applications.
http://www.sans.org/event/singapore-2013
- --SANS Monterey 2013 Monterey, CA March 22-March 27, 2013
8 courses. Bonus evening presentations include Base64 Can Get You
Pwned!; The 13 Absolute Truths of Security; and Look Ma, No Packets! -
The Recon-ng Framework.
http://www.sans.org/event/monterey-2013
- --Secure Canberra 2013 Canberra, Australia March 18 - March 23, 2013
Featuring Network Penetration Testing and Ethical Hacking and Computer
Forensic Investigations - Windows In-Depth.
https://www.sans.org/event/secure-canberra-2013
- --SANS Northern Virginia 2013 Reston, VA April 8-April 13, 2013
7 courses. Bonus evening presentations include Infosec Rock Star: How
to be a More Effective Security Professional; Pentesting Web Apps with
Python; and Practical, Efficient Unix Auditing: With Scripts.
http://www.sans.org/event/northern-virginia-2013
- --SANS Cyber Guardian 2013 Baltimore, MD April 15-April 20, 2013
9 courses. Bonus evening presentations include Windows Exploratory
Surgery with Process Hacker; Offensive Countermeasures, Active Defenses,
and Internet Tough Guys; and Tactical SecOps: A Guide to Precision
Security Operations.
http://www.sans.org/event/cyber-guardian-2013
- --Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at http://www.sans.org/ondemand/specials
Plus Scottsdale, Brussels, Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************* Sponsored Links: *********************1) Java Web Security By Example - Featuring: Frank Kim and Andy Chou
Tuesday, February 19, 2013 at 4:00 PM EST (2100 UTC/GMT)
http://www.sans.org/info/124142
2) Take the SANS Survey on Help Desk Security! Enter to win an iPad 4!
http://www.sans.org/info/124147
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Recently Patched Flash Vulnerabilities Actively Exploited In The Wild
Description: A pair of Adobe Flash vulnerabilities were patched last
week, closing holes that were being exploited in the wild at the time
of the patches. The attack payloads included creative new ways around
common operating system level mitigations such as ASLR and DEP, making
them particularly problematic for defenders. While attacks appear to
have been limited in scope, particularly compared to last month's Java
0-day issues, high value targets in particular are urged to patch
immediately.
Reference:
https://krebsonsecurity.com/tag/cve-2013-0633/
http://www.securelist.com/en/blog/208194112/Adobe_Flash_Player_0_day_and_HackingTeam_s_Remote_Control_System
http://labs.alienvault.com/labs/index.php/2013/adobe-patches-two-vulnerabilities-being-exploited-in-the-wild/
https://sites.google.com/site/zerodayresearch/smashing_the_heap_with_vector_Li.pdf
Snort SID: 25676 - 25683
ClamAV: BC.Exploit.CVE_2013_0633, SWF.Exploit.CVE_2013_0634
Title: Huge Microsoft Tuesday Includes Low-Level TCP/IP DoS
Description: Microsoft this week issued a huge set of patches, closing
off 57 distinct CVEs in a total of 11 security notices. While many of
these vulnerabilities will likely prove difficult to exploit in the
wild, the VML memory corruption attack (CVE-2013-0030) is already being
used for information disclosure in targeted attacks. Most likely to
wreak havoc is the TCP/IP "Finshake" denial of service (CVE-2013-0075)
- - discussed on underground forums as Microsoft having "nick'd up the
stack" - which requires minimal attacker bandwidth and applies to any
Microsoft operating system, regardless of which services are made
available to the Internet. Administrators are urged to test and patch
their systems as rapidly as feasible, given the size of this release.
Reference:
http://technet.microsoft.com/en-us/security/bulletin/ms13-018
https://isc.sans.edu/diary/Microsoft+February+2013+Black+Tuesday+Update+-+Overview/15142
Snort SID: 25774
ClamAV: N/A
Title: Microsoft, Symantec Take Down Bamital Botnet
Description: Continuing its winning streak in US federal courts,
Microsoft's Digital Crimes Unit - in conjunction with security provider
Symantec - executed a takedown of the massive Bamital botnet, which was
responsible for major advertising fraud activities across the globe and
distribution of copious amounts of peripheral malware. Infected users
are now getting messages with cleanup instructions; unlike previous
takedowns, such as DNSChanger, currently-infected systems are, however,
can still be used on the Internet generally.
Reference:
http://blogs.technet.com/b/microsoft_blog/archive/2013/02/06/microsoft-and-symantec-take-down-bamital-botnet-that-hijacks-online-searches.aspx
http://www.microsoft.com/en-us/news/download/blogs/2013/02-06MicrosoftBamitalComplaint.pdf
http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/trojan_bamital.pdf
Snort SID: 25684 - 25763
ClamAV: W32.Trojan.Bamital, WIN.Ransom.Lockscreen
Title: Security Firm Bit9 Compromised
Description: After failing to install its own application whitelisting
product on all of its internal systems, security firm Bit9 revealed last
week that it had been compromised, and that intruders had used its
digital signing certificates to push malicious applications as if they
were trusted code. While the firm has responded promptly and is working
with all potentially impacted parties on cleanup, the compromise
reiterates the necessity of following internal security policy in all
circumstances, not just those where doing so is easy. Note that users
of Sourcefire's FireAMP technology are protected from these malicious
binaries through certificate revocation technology.
Reference:
https://blog.bit9.com/2013/02/08/bit9-and-our-customers-security/
Snort SID: N/A
ClamAV: N/A
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Set your keylogger to report by email? Bad idea! (The case of Ardamax):
http://labs.alienvault.com/labs/index.php/2013/set-up-your-keylogger-to-report-by-email-bad-idea-the-case-of-ardamax/
Anatomy of a bug: how Mac OS X chokes if you say "file:///":
http://nakedsecurity.sophos.com/2013/02/06/anatomy-of-a-bug-how-mac-os-x-chokes-if-you-type-file/
Amtel "secure" crypto co-processor series microprocessors leaking keys, plus bonus DESFire hack:
http://seclists.org/fulldisclosure/2013/Feb/42
Java 0-day offered on Russian dark market for $100K:
http://www.techweekeurope.co.uk/news/java-zero-day-russian-forum-sale-100000-106906
Forgotten watering hole attacks on space foundation and RSF Chinese:
http://eromang.zataz.com/2013/01/06/forgotten-watering-hole-attacks-on-space-foundation-and-rsf-chinese/
Hacker exposes George H W Bush emails:
http://www.bbc.co.uk/news/world-us-canada-21380393
Passwords found in the wild for January 2013:
http://blog.passwordresearch.com/2013/02/passwords-found-in-wild-for-january-2013.html
Is everything we know about password stealing wrong?
http://research.microsoft.com/pubs/161829/EverythingWeKnow.pdf
Excel cell injection:
http://blog.7elements.co.uk/2013/01/cell-injection.html
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2013-0422
Title: Oracle Java SE Security Bypass Vulnerability
Vendor: Oracle
Description: Multiple vulnerabilities in Oracle Java 7 before Update 11
allow remote attackers to execute arbitrary code by (1) using the public
getMBeanInstantiator method in the JmxMBeanServer class to obtain a
reference to a private MBeanInstantiator object, then retrieving
arbitrary Class references using the findClass method, and (2) using the
Reflection API with recursion in a way that bypasses a security check
by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method
due to the inability of the sun.reflect.Reflection.getCallerClass method
to skip frames related to the new reflection API, as exploited in the
wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and
a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE:
some parties have mapped the recursive Reflection API issue to
CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose
details are not public as of 20130114. CVE-2013-0422 covers both the
JMX/MBean and Reflection API issues. NOTE: it was originally reported
that Java 6 was also vulnerable, but the reporter has retracted this
claim, stating that Java 6 is not exploitable because the relevant code
is called in a way that does not bypass security checks. NOTE: as of
20130114, a reliable third party has claimed that the
findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update
11. If there is still a vulnerable condition, then a separate CVE
identifier might be created for the unfixed issue.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-5088
Title: Java Applet Method Handle Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote
attackers to affect confidentiality, integrity, and availability via
unknown vectors related to Libraries.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-5076
Title: Java Applet AverageRangeStatisticImpl Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote
attackers to affect confidentiality, integrity, and availability,
related to JAX-WS.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-5958
Title: Portable UPnP SDK unique_service_name() Remote Code Execution
Vendor: libupnp.org
Description: Stack-based buffer overflow in the unique_service_name
function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK
for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices)
before 1.6.18 allows remote attackers to execute arbitrary code via a
UDP packet with a crafted string that is not properly handled after a
certain pointer subtraction.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-3569
Title: VMWare OVF Tools Format String Vulnerability
Vendor: VMWare
Description: Format string vulnerability in VMware OVF Tool 2.1 on
Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player
4.x before 4.0.5, and other products, allows user-assisted remote
attackers to execute arbitrary code via a crafted OVF file.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
MOST POPULAR MALWARE FILES 2/5/2013 - 2/12/2013:
COMPILED BY SOURCEFIRE
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/aa0bbaecb678868e1e7f57c7ca9d61b608b3d788be490790eb1d148beadf4615/analysis/
Typical Filename: avz00001.dta
Claimed Product: -
Claimed Publisher: -
SHA 256: B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96
MD5: 573b6cc513e1b7cd9e35b491eacc38f3
VirusTotal: https://www.virustotal.com/file/B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96/analysis/
Typical Filename: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Product: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Publisher: 573b6cc513e1b7cd9e35b491eacc38f3
SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal: https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/
Typical Filename: Keygen.exe
Claimed Product: Keygen.exe
Claimed Publisher: Keygen.exe
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: File_0_2.ok
Claimed Product: -
Claimed Publisher: -
SHA 256: A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03
MD5: e010f298c086c2e1d7265fd18aea2dfbaa9dcd35
VirusTotal: https://www.virustotal.com/file/A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03/analysis/
Typical Filename: lpkjnn.sys
Claimed Product: -
Claimed Publisher: -
(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
