@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
February 21, 2013=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 13, Num. 08
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 2/12/2013 - 2/19/2013
============================================================TOP VULNERABILITY THIS WEEK: Tensions between the United States and China are running high after security firm Mandiant released a detailed technical support claiming that the Chinese government has been actively attacking American interests for at least the past 6 years.
============================================================TRAINING UPDATE
- -- SANS Monterey 2013 Monterey, CA March 22-March 27, 2013
8 courses. Bonus evening presentations include Base64 Can Get You
Pwned!; The 13 Absolute Truths of Security; and Look Ma, No Packets! -
The Recon-ng Framework.
http://www.sans.org/event/monterey-2013
- --SANS Northern Virginia 2013 Reston, VA April 8-April 13, 2013
7 courses. Bonus evening presentations include Infosec Rock Star: How
to be a More Effective Security Professional; Pentesting Web Apps with
Python; and Practical, Efficient Unix Auditing: With Scripts.
http://www.sans.org/event/northern-virginia-2013
- --SANS Cyber Guardian 2013 Baltimore, MD April 15-April 20, 2013
9 courses. Bonus evening presentations include Windows Exploratory
Surgery with Process Hacker; Offensive Countermeasures, Active Defenses,
and Internet Tough Guys; and Tactical SecOps: A Guide to Precision Security Operations.
http://www.sans.org/event/cyber-guardian-2013
- --SANS Security West 2013 San Diego, CA May 7-May 16, 2013
32 courses. Bonus evening sessions include Gone in 60 Minutes; The
Ancient Art of Falconry; and You Can Panic Now. Host Protection is
(Mostly) Dead.
http://www.sans.org/event/security-west-2013
- --SANS Secure Singapore 2013 February 25-March 2, 2013
6 courses. Bonus evening presentations include APT: It is Time to Act;
and Security of National eID (smartcard-based) Web Applications.
http://www.sans.org/event/singapore-2013
- --Secure Canberra 2013 Canberra, Australia March 18 - March 23, 2013
Featuring Network Penetration Testing and Ethical Hacking and Computer
Forensic Investigations - Windows In-Depth.
https://www.sans.org/event/secure-canberra-2013
- --Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at http://www.sans.org/ondemand/specials
Plus Scottsdale, Brussels, Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Link: *********************1) Take the Mobile Application security Survey! Enter to Win an iPad!
http://www.sans.org/info/124912
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Mandiant Releases Report On Chinese "APT1" Group
Description: Incident response specialist company Mandiant released on
Tuesday a groundbreaking report, citing highly detailed evidence to
support a claim that the Chinese government, through Unit 61398 of the
People's Liberation Army, has been engaging in systematic attacks on
American interests, as well as those of other English-speaking nations
around the globe, over the course of the past 6 years. The report, which
included domain names, IP addresses, SSL certificates, and MD5sums of
malicious binaries, has already caused a major political stir, with the
Obama administration set to impose trade penalties for cybertheft, with
the Chinese government denying any involvement.
Reference:
http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf
http://www.washingtonpost.com/business/claims-of-cyberstealing-by-china-prompt-administration-to-develop-more-aggressive-responses/2013/02/20/527cdc84-7b34-11e2-9c27-fdd594ea6286_story.html
Snort SID: 25836 - 25848
ClamAV: Trojan.Downbot-1 Trojan.Downbot-2 Trojan.Downbot-5
Trojan.Downloader-133181 Trojan.Downloader-134278
Trojan.Downloader-16819 Trojan.Downloader-74679
Trojan.Downloader-81796 Trojan.Downloader-83571 Trojan.Gloox
Trojan.Lithium.Capture Trojan.Onlinegames-2021 Trojan.Scar-992
Trojan.Small-10047 W32.Trojan.Downloader-579 Win.Trojan.Agent-108327
Win.Trojan.Agent-137590 Win.Trojan.Agent-138969
Win.Trojan.Agent-140739 Win.Trojan.Agent-142593
Win.Trojan.Agent-143322 Win.Trojan.Agent-149295
Win.Trojan.Agent-149699 Win.Trojan.Agent-154735
Win.Trojan.Agent-168098 Win.Trojan.Agent-23705 Win.Trojan.Agent-27353
Win.Trojan.Agent-35654 Win.Trojan.Agent-63410 Win.Trojan.Agent-65195
Win.Trojan.Agent-82578 Win.Trojan.Agent-8646 Win.Trojan.Agent-8648
Win.Trojan.Agent-8790 Win.Trojan.Agent-96394 Win.Trojan.Agent-96509
Win.Trojan.Cossta-4 Win.Trojan.Downloader-1837 Win.Trojan.Small-913
Title:Schneider Electric IGSS Buffer Overflow
Description: Independent researcher Aaron Portnoy recently discovered a
set of vulnerabilities in the widely used Schneider Electric IGSS
protocol, which could be remotely exploited for full administrative
privileges on target systems. The vendor has since issued a patch, and
users of these systems are strongly encouraged to both apply the patch
and to ensure that all electrical infrastructure is appropriately
firewalled from the Internet.
Reference: http://ics-cert.us-cert.gov/pdf/ICSA-13-018-01.pdf
Snort SID: 25849 - 25852
ClamAV: N/A
Title: PDF 0-day Being Exploited In The Wild
Description: Adobe confirmed last week that a pair of new exploits
targeting Acrobat Reader were being exploited in the wild; as of the
time of writing, no patches had yet been released. The exploits were
particularly nefarious, in that they used a brand-new ROP-based
technique to escape Reader's sandboxing technology, which was designed
by Adobe to mitigate the impact of vulnerabilities such as these. Users
are urged to be extremely cautious when opening PDF documents from any
source.
Reference:
http://vrt-blog.snort.org/2013/02/more-targeted-pdf-0-day.html
http://www.adobe.com/support/security/advisories/apsa13-02.html
https://blogs.mcafee.com/mcafee-labs/analyzing-the-first-rop-only-sandbox-escaping-pdf-exploit
Snort SID: 25818, 25819
ClamAV: PDF.Exploit.CVE_2013_0640
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
Detailed analysis for MS12-081:
http://blog.ptsecurity.com/2013/02/surprise-for-network-resources-from.html
TeamViewer authentication protocol:
http://blog.accuvantlabs.com/blog/bthomas/teamviewer-authentication-protocol
iOS 6.1 hack allows lock screen bypass:
http://thehackernews.com/2013/02/ios-61-hack-allows-iphone-lock-screen.html
FROST: Forensic Recovery of Scrambled Telephones:
https://www1.informatik.uni-erlangen.de/frost
Cyber attacks against Uighur Mac OS X users intensify:
https://www.securelist.com/en/blog/208194116/Cyber_Attacks_Against_Uyghur_Mac_OS_X_Users_Intensify
Practical identification of SQL injection vulnerabilities:
https://www.us-cert.gov/reading_room/Practical-SQLi-Identification.pdf
Targeted 'phone ring flooding' as a service going mainstream:
http://blog.webroot.com/2013/02/13/targeted-phone-ring-flooding-attacks-as-a-service-going-mainstream/
DDoS attack on bank hid $900,000 cyberheist:
http://krebsonsecurity.com/2013/02/ddos-attack-on-bank-hid-900000-cyberheist/
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2013-0640, CVE-2013-0641
Title: Adobe Reader and Acrobat Unspecified Code Execution Vulnerability
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Reader and Acrobat 9.x
through 9.5.3, 10.x through 10.1.5, and 11.x through 11.0.1 allows
remote attackers to execute arbitrary code via a crafted PDF document,
as exploited in the wild in February 2013.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2013-0025
Title: Microsoft Internet Explorer SLayoutRun Use-After-Free (MS13-009)
Vendor: Microsoft
Description: Use-after-free vulnerability in Microsoft Internet Explorer
8 allows remote attackers to execute arbitrary code via a crafted web
site that triggers access to a deleted object, aka "Internet Explorer
SLayoutRun Use After Free Vulnerability."
ID: CVE-2012-5088
Title: Java Applet Method Handle Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote
attackers to affect confidentiality, integrity, and availability via
unknown vectors related to Libraries.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-5076
Title: Java Applet AverageRangeStatisticImpl Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote
attackers to affect confidentiality, integrity, and availability,
related to JAX-WS.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-3569
Title: VMWare OVF Tools Format String Vulnerability
Vendor: VMWare
Description: Format string vulnerability in VMware OVF Tool 2.1 on
Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player
4.x before 4.0.5, and other products, allows user-assisted remote
attackers to execute arbitrary code via a crafted OVF file.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
MOST POPULAR MALWARE FILES 2/12/2013 - 2/19/2013:
COMPILED BY SOURCEFIRE
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/aa0bbaecb678868e1e7f57c7ca9d61b608b3d788be490790eb1d148beadf4615/analysis/
Typical Filename: avz00001.dta
Claimed Product: -
Claimed Publisher: -
SHA 256: B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96
MD5: 573b6cc513e1b7cd9e35b491eacc38f3
VirusTotal: https://www.virustotal.com/file/B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96/analysis/
Typical Filename: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Product: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Publisher: 573b6cc513e1b7cd9e35b491eacc38f3
SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal: https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/
Typical Filename: Keygen.exe
