@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
July 17, 2014=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 14, Num. 28
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 7/9/2014 - 7/15/2014
============================================================TOP VULNERABILITY THIS WEEK: Oracle Critical Patch Update - July 2014 - 20 Java vulnerabilities patched
******************** Sponsored By Bit9 + Carbon Black *********************Do you know how to protect your enterprise? Arm your endpoints. Download
the eBook Endpoint Threat Detection, Response and Prevention for Dummies
and learn how to detect advanced attacks in real-time, get incident
response in seconds and prevent untrusted software with default-deny.
http://www.sans.org/info/164012
TRAINING UPDATE
- --SANS San Francisco 2014 San Francisco, CA July 14-19, 2014
7 courses. Bonus evening presentations include Aligning Your Defenses
with Today's Evolving Threats; and Malware Reloaded.
http://www.sans.org/event/san-francisco-2014
- --SANS Boston 2014 Boston, MAJuly 28-August 2, 2014
11 courses. Bonus evening presentations include APT: It is Time to Act;
Continuous Ownage: Why You Need Continuous Monitoring; and The Bot
Inside the Machine.
http://www.sans.org/event/boston-2014
- --SANS Virginia Beach 2014 Virginia Beach, VAAugust 18-29, 2014
10 courses. Bonus evening presentations include Closing the Door on Web
Shells and Gone in 60 Minutes: Have You patched Your System Today?
http://www.sans.org/event/virginia-beach-2014
- --SANS London Summer 2014 London, UKJuly 14-21, 2014
5 courses.
http://www.sans.org/event/london-summer-2014
- --Cyber Defense Summit | Nashville, TN | August 13-20, 2014
Join Dr. Eric Cole at this premier Cyber Defense-focused event and learn
how to implement best practices and proven techniques that will enable
you to stay on top of today's threats and ahead of tomorrow's.
Prevent --> Detect --> Respond... A Winning Formula for Cyber Defense! 7 courses.
http://www.sans.org/event/cyber-defense-summit
- --Security Awareness Summit | Dallas, TX | Sept 8-16, 2014
Come learn from your peers on how to build Next Generation Security
Awareness Programs. Hear from security awareness officers as they share
their lessons learned on how they took their awareness programs to the
next level and how they measured the impact. Plus 5 courses.
http://www.sans.org/event/security-awareness-summit-and-training-2014
- --Can't travel? SANS offers LIVE online instruction.
Day (www.sans.org/simulcast) and Evening courses (www.sans.org/vlive) available!
- -- Multi-week Live SANS training
http://www.sans.org/mentor/about
Contact mentor@sans.org
- -- Looking for training in your own community?
http://www.sans.org/community/
- --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/specials
Plus Houston, Nashville, Bangkok, and Tallinn all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
********************** Sponsored Links: ********************1) In case you missed it: It's not about the number of filters-it's how
effective they are.
Thursday, July 10 at 11:00 AM EDT (15:00:00 UTC)
Joanna Burkey and Dave Shackleford. http://www.sans.org/info/164017
2) The Modern Incident Responder: Detect, Respond and Recover from a
Data Breach
Tuesday, July 29 at 1:00 PM EDT (17:00:00 UTC)
Jeffrey (J.J.) Guy - Director of Operations.
http://www.sans.org/info/164022
3) Attend the SANS DHS Continuous Diagnostics & Mitigation Award
Workshop - PART II. August 1, 2014 in Washington, DC.
http://www.sans.org/info/159487
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Oracle Critical Patch Update - July 2014 - 20 Java vulnerabilities patched
Description: Oracle releases their Critical Patch Update for July,
multiple critical updates for Java that a high chance of remote
exploitation.
Reference: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
https://isc.sans.edu/diary/Oracle+Java%3A+20+new+vulnerabilities+patched/18395
Snort SID: Detection is pending.
ClamAV: Detection is pending.
Title: Hacking Password Managers
Description: Security Researchers to present at the USENIX conference
in August discovered multiple security vulnerabilities in password
manager applications, such as LastPass.
Reference:
http://www.darkreading.com/cloud/hacking-password-managers/d/d-id/1297250
http://devd.me/papers/pwdmgr-usenix14.pdf (PDF)
Title: "Rosetta Flash" tool, JSONP callback API vulnerability CVE-2014-4671
Description: Security Researcher Michele Spagnuolo released a Rosetta"
Flash" utility to convert SWF files to alphanumeric content that can be
embedded within a webpage to exploit CVE-2014-4671.
Reference: http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
Snort SID: 31392-31397, 31399-31401
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
Snort Blog: OpenAppId Detector Developer Guide has been posted!
http://sfi.re/oadguide
New Strategies and Features to Help Organizations Better Protect Against
Pass-the-Hash Attacks
blogs.technet.com/b/security/archive/2014/07/08/new-strategies-and-features-to-help-organizations-better-protect-against-pass-the-hash-attacks.aspx
Active Directory Vulnerability Disclosure: Weak encryption enables
attacker to change a victim's password without being logged
http://www.aorato.com/blog/active-directory-vulnerability-disclosure-weak-encryption-enables-attacker-change-victims-password-without-logged/
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2014-3936
Title: D-Link HNAP Request Remote Buffer Overflow
Vendor: D-Link
Description: Stack-based buffer overflow in the do_hnap function in
www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and
earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with
firmware 1.01 and earlier allows remote attackers to execute arbitrary
code via a long Content-Length header in a GetDeviceSettings action in
an HNAP request.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2014-2969
Title: Netgear GS105PE Prosafe Plus Switch Contains Hard-Coded Login
Credentials
Vendor: Netgear
Description: NETGEAR GS108PE Prosafe Plus switches with firmware 1.2.0.5
have a hardcoded password of debugpassword for the ntgruser account,
which allows remote attackers to upload firmware or read or modify
memory contents, and consequently execute arbitrary code, via a request
to (1) produce_burn.cgi, (2) register_debug.cgi, or (3)
bootcode_update.cgi.
CVSS v2 Base Score: 8.3 (AV:A/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2012-1876
Title: Microsoft Internet Explorer Col Element Memory Corruption Vulnerability
Vendor: Microsoft
Description: Microsoft Internet Explorer 6 through 9, and 10 Consumer
Preview, does not properly handle objects in memory, which allows remote
attackers to execute arbitrary code by attempting to access a
nonexistent object, leading to a heap-based buffer overflow, aka "Col
Element Remote Code Execution Vulnerability," as demonstrated by VUPEN
during a Pwn2Own competition at CanSecWest 2012.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: N/A
Title: Supermicro Server Motherboard Credential Disclosure Vulnerability
Vendor: Supermicro
Description: Supermicro motherboards store administrator passwords in
plain text, which is available to any attacker who can connect to TCP
port 49152.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/AU:N/C:C/I:C/A:C)
ID: CVE-2014-0160
Title: OpenSSL TLS Heartbeat Extension Buffer Oveflow Information
Disclosure Vulnerability (Heartbleed)
Vendor: OpenSSL Project
Description: The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1
before 1.0.1g do not properly handle Heartbeart Extension packets, which
allows remote attackers to obtain sensitive information from process
memory via crafted packets that trigger a buffer over-read, as
demonstrated by reading private keys, related to d1_both.c and t1_lib.c.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
MOST PREVALENT MALWARE FILES 7/9/2014 - 7/15/2014
COMPILED BY SOURCEFIRE
SHA 256: 1A84759D615916B53F8F41C9928C48FF005A970D6FA35893F9A7EC074DD77864
MD5: 738a57e0d8dd303b87220f209bd49024
VirusTotal:
https://www.virustotal.com/file/1A84759D615916B53F8F41C9928C48FF005A970D6FA35893F9A7EC074DD77864/analysis/#additional-info
Typical Filename: updater.exe
Claimed Product: Backup Software Limited
Detection Name: W32.1A84759D61-78.SBX.VIOC
SHA 256: 3CC8E2184D73E9B99592CD9399ECB294BEB1AECE3C21903C09F059DFAC44DAC6
MD5: a5d9e1fa931b1002c7a798448496e04c
VirusTotal:
https://www.virustotal.com/file/3CC8E2184D73E9B99592CD9399ECB294BEB1AECE3C21903C09F059DFAC44DAC6/analysis/#additional-info
Typical Filename: Service Start.exe
Claimed Product: Backup Software Limited
Detection Name: W32.3CC8E2184D-77.SBX.VIOC
SHA 256: DE79E5A4356CA0EFA56B69E6EDE21DD8E12FC16E2196B7B7366A0D76C65D3ED5
MD5: 11fcb6824b912480af7d54a8547dfcb8
VirusTotal:
https://www.virustotal.com/file/DE79E5A4356CA0EFA56B69E6EDE21DD8E12FC16E2196B7B7366A0D76C65D3ED5/analysis/#additional-info
Typical Filename: wajam_update.exe
Claimed Product: Wajam Internet Technologies Inc
Detection Name: W32.Application:Adwaregen.17ib.1201
SHA 256: 97667487392ACA1D94C0043FB725FE31855D5B65B1BDEBE58E0AC7E147D05BE4
MD5: 466af3fbfdd028b3d90238425c367b7e
VirusTotal:
https://www.virustotal.com/file/97667487392ACA1D94C0043FB725FE31855D5B65B1BDEBE58E0AC7E147D05BE4/analysis/#additional-info
Typical Filename: t8SrchMn.exe
Claimed Product: Mindspark Toolbar Platform SearchScope Monitor
Detection Name: W32.MindsparkA.17hd.1201
SHA 256: F8EA2EFA24813F1159ADCEF510EA33DCCEE50A5EF9F9C98EAE840AFAAB8DE8F8
MD5: 2c0a45683112082493b1fb3c09c60184
VirusTotal:
https://www.virustotal.com/file/F8EA2EFA24813F1159ADCEF510EA33DCCEE50A5EF9F9C98EAE840AFAAB8DE8F8/analysis/#additional-info
Typical Filename: 9tbrmon.exe
Claimed Product: Mindspark Toolbar Platform SearchScope Monitor
Detection Name: W32.MindsparkA.17hd.1201
(c) 2014. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
