@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
July 4, 2019=============================================================
@RISK: The Consensus Security Vulnerability Alert
July 04, 2019 - Vol. 19, Num. 27
Providing a reliable, weekly summary of newly discovered attack vectors,
vulnerabilities with active exploits, and explanations of how recent
attacks worked
Archived issues may be found at http://www.sans.org/newsletters/at-risk
=============================================================
CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES June 27 - July 4
============================================================
TOP VULNERABILITY THIS WEEK: New exploit kit Spelevo uses old tricks
************** Sponsored By AWS Marketplace ***************
JumpStart Guide for Cloud-Based Firewalls in AWS Learn how to assess business and operational needs against advanced prevention capabilities in AWS Marketplace firewall and threat prevention offerings, such as advanced threat prevention, IDS/IPS, anti-malware, logging, alerting, correlation and intelligence. July 17, 2 PM ET. http://www.sans.org/info/213410
============================================================
TRAINING UPDATE
-- SANS Network Security 2019 | Las Vegas, NV | September 9-16 | https://www.sans.org/event/network-security-2019
-- SANS Rocky Mountain 2019 | Denver, CO | July 15-20 | https://www.sans.org/event/rocky-mountain-2019
-- SANS San Francisco Summer 2019 | July 22-27 | https://www.sans.org/event/san-francisco-summer-2019
-- Pen Test Hackfest Europe 2019 | Berlin, DE | July 22-28 | https://www.sans.org/event/pentest-hackfest-eu-july-2019
-- DFIR Summit & Training 2019 | Austin, TX | July 25-August 1 | https://www.sans.org/event/digital-forensics-summit-2019
-- Supply Chain Cybersecurity Summit 2019 | Arlington, VA | August 12-19 | https://www.sans.org/event/supply-chain-cybersecurity-summit-2019
-- SANS London September 2019 | September 23-28 | https://www.sans.org/event/london-september-2019
-- SANS Tokyo Autumn 2019 | September 30-October 12 | https://www.sans.org/event/tokyo-autumn-2019
-- SANS October Singapore 2019 | October 7-26 | https://www.sans.org/event/october-singapore-2019
-- SANS OnDemand and vLive Training
Get an iPad Mini, Surface Go, or Take $300 Off through July 10 with OnDemand or vLive training.
https://www.sans.org/online-security-training/specials/
-- Can't travel? SANS offers online instruction for maximum flexibility
-- Live Daytime training with Simulcast - https://www.sans.org/simulcast
-- Evening training 2x per week for 6 weeks with vLive | https://www.sans.org/vlive
-- Anywhere, Anytime access for 4 months with OnDemand format | https://www.sans.org/ondemand/
-- Single Course Training
SANS Mentor | https://www.sans.org/mentor/about
Community SANS | https://www.sans.org/community/
-- View the full SANS course catalog and Cyber Security Skills Roadmap
https://www.sans.org/cyber-security-skills-roadmap
********************** Sponsored Links: ********************
1) Take the SANS 2019 Threat Hunting Survey--and enter to win a $400 Amazon gift card! http://www.sans.org/info/213560
2) ICYMI "Malicious Bots: How they became #1 New Threat and How to Stop Them" Register to see the archive: http://www.sans.org/info/213565
3) Keynotes announced for the inaugural SANS Supply Chain Cybersecurity Summit in Washington, DC! Summit agenda: http://www.sans.org/info/213570
============================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Spelevo exploit kit pops up to deliver banking trojans
Description: Researchers at Cisco Talos discovered a new exploit kit known as "Spelevo." While exploit kit activity has quieted down over the past few years, this new campaign uses some old tricks -- such as exploiting Adobe Flash Player vulnerabilities -- to infect victims. It then delivers various payloads, but mainly banking trojans such as IcedID and Dridex. The actors behind Spelevo seem to be strictly financially motivated.
Reference: https://blog.talosintelligence.com/2019/06/spelevo-exploit-kit.html
Snort SIDs: 50509 - 50511
Title: Firefox patches critical zero-day used to target Macs
Description: Firefox patched a series of bugs in its latest update, but most notably fixed a vulnerability that attackers exploited to install cryptocurrency miners. Last week, the web browser released a fix for a code-execution vulnerability in a JavaScript programming method known as "Array.pop," and then a sandbox breakout bug the next day. Two new Snort rules from Talos protect against the Array vulnerability.
Snort SIDs: 50518, 50519
============================================================
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
Several members of the U.S. Security Council are reportedly considering pushing for a bill to outlaw tech companies from using encryption that law enforcement officials cannot break.
https://www.politico.com/story/2019/06/27/trump-officials-weigh-encryption-crackdown-1385306
While Apple is touting the security benefits of its soon-to-be-released credit card, some security experts say relying solely on hardware could mean long (or impossible) security updates.
https://www.cisomag.com/deconstructing-apple-card-a-hackers-perspective/
Google's new API standards will begin phasing out some third-party sites from using Google logins as of July 15.
The U.S. Food and Drug Association issued a recall of a line of small, portable insulin pumps due to cybersecurity concerns.
https://www.infosecurity-magazine.com/news/medtronic-insulin-pumps-recalled-1/
Facebook says it shut down more than 30 accounts associated with spreading malware since 2014, hitting thousands of users with remote access trojans.
https://threatpost.com/facebook-malware-laced-links/146149/
A campaign downloading remote access trojans and information stealers is utilizing the well-known "Heaven's Gate" exploit.
https://blog.talosintelligence.com/2019/07/rats-and-stealers-rush-through-heavens.html
Hackers breached cloud solutions provider PCM Inc. and accessed email and file-sharing systems for some of the company's clients.
https://krebsonsecurity.com/2019/06/breach-at-cloud-solution-provider-pcm-inc/
=========================================================
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM
This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.
ID: CVE-2019-7226
Title: ABB PB610 Multiple Security Vulnerabilities
Vendor: ABB
Description: ABB PB610 Panel Builder 600 is exposed to an authentication bypass vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the affected application. The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to privileged functions. Specifically, /cgi/loginDefaultUser creates a session in an authenticated state and returns the session ID along with what may be the username and cleartext password of the user. An attacker can then supply an IDALToken value in a cookie, which will allow them to perform privileged operations such as restarting the service with /cgi/restart. A GET request to /cgi/loginDefaultUser may result in "1 #S_OK IDALToken=532c8632b86694f0232a68a0897a145c admin admin" or a similar response.
CVSS v2 Base Score: 5.8 (AV:A/AC:L/Au:N/C:P/I:P/A:P)
ID: CVE-2019-12817
Title: Linux kernel Local Privilege Escalation Vulnerability
Vendor: Linux
Description: Linux Kernel is exposed to a local privilege escalation vulnerability. A local attacker can exploit this issue to gain elevated privileges. arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel for powerpc has a bug where unrelated processes may be able to read/write to one another's virtual memory under certain conditions via an mmap above 512 TB.
CVSS v2 Base Score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2019-12974
Title: ImageMagick Multiple Security Vulnerabilities
Vendor: ImageMagick
Description: A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage in coders/vid.c in ImageMagick allows remote attackers to cause a denial of service via a crafted image. Successfully exploiting these issues may allow an attacker to gain access to sensitive information, bypass certain security restrictions and to perform unauthorized actions or cause a denial of service condition. This may aid in launching further attacks.
CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
ID: CVE-2019-12972
Title: GNU Binutils Heap Based Buffer Overflow Vulnerability
Vendor: GNU
Description: GNU Binutils is exposed to a heap based buffer overflow vulnerability. An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), where a heap based buffer over read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing ' ' character. Attackers can exploit this issue to cause a denial of service condition, denying service to legitimate users.
CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
ID: CVE-2019-3961
Title: Nessus Cross Site Scripting Vulnerability
Vendor: Nessus
Description: Nessus is exposed to a cross site scripting vulnerability because it fails to properly sanitize user supplied input. An unauthenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a users browser session. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie based authentication credentials and launch other attacks.
CVSS v2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
ID: CVE-2019-12939
Title: LiveZilla Server SQL Injection Vulnerability
Vendor: LiveZilla
Description: LiveZilla Server is exposed to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker may leverage this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: CVE-2019-11707
Title: Mozilla Firefox and Firefox ESR Denial of Service Vulnerability
Vendor: Mozilla
Description: Mozilla Firefox and Firefox ESR are exposed to a denial of service vulnerability. Attackers can exploit these issues to crash the application, denying service to legitimate users. A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
=========================================================
MOST PREVALENT MALWARE FILES June 27 - July 4:
COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: 440944ab47cc3140207179f5449ddacb32883a74a9cff11141fdf494eaf21592
MD5: dd77416ab164d3423b00f33380cf06ca
VirusTotal: https://www.virustotal.com/gui/file/440944ab47cc3140207179f5449ddacb32883a74a9cff11141fdf494eaf21592/details
Typical Filename: SafeInstaller
Claimed Product: SafeInstaller
Detection Name: PUA.Win.Downloader.Installiq::tpd
SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: https://www.virustotal.com/#/file/3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3/details
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos
SHA 256: 64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8ddaa01ec8b
MD5: 42143a53581e0304b08f61c2ef8032d7
VirusTotal: https://www.virustotal.com/gui/file/64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8ddaa01ec8b/details
Typical Filename: N/A
Claimed Product: JPMorganChase Instructions SMG 82749206.pdf
Detection Name: Pdf.Phishing.Phishing::malicious.tht.talos
SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: https://www.virustotal.com/#/file/c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f/details
Typical Filename: Tempmf582901854.exe
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201
SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: https://www.virustotal.com/#/file/15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b/details
Typical Filename: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b.bin
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201
=============================================================
(c) 2019. All rights reserved. The information contained in this
newsletter, including any external links, is provided "AS IS," with no
express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but
no posting is allowed on web sites. For a free subscription, (and for
free posters) or to update a current subscription, visit
SANS Institute, 8120 Woodmont Ave., Suite 310, Bethesda, MD 20814-2743
