@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
December 19, 2019=============================================================
@RISK: The Consensus Security Vulnerability Alert
December 19, 2019 - Vol. 19, Num. 51
Providing a reliable, weekly summary of newly discovered attack vectors,
vulnerabilities with active exploits, and explanations of how recent
attacks worked
Archived issues may be found at http://www.sans.org/newsletters/at-risk
=============================================================
CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES Dec. 12 - 19
============================================================
TOP VULNERABILITY THIS WEEK: Zeppelin ransomware spreads to U.S., Europe
****************** Sponsored By ZeroNorth ******************
This is How Rapid AppSec Fills the Security Gap. Gaps in your application security program may exist--and filling these gaps takes time. With the ZeroNorth Solution for Rapid AppSec, open source security scanning tools are embedded within the ZeroNorth platform. You can quickly fill gaps while a longer-term strategy--likely centered on commercial scanning tools--moves forward. Learn more or request a demo. http://www.sans.org/info/215060
============================================================
TRAINING UPDATE
-- SANS Security East 2020 | New Orleans, LA | February 1-8 | https://www.sans.org/event/security-east-2020
-- SANS Miami 2020 | January 13-18 | https://www.sans.org/event/miami-2020
-- SANS Threat Hunting & IR Summit & Training | London, UK | January 13-19, 2020 | https://www.sans.org/event/threat-hunting-europe-2020
-- SANS Tokyo January 2020 | January 20-25 | https://www.sans.org/event/tokyo-january-2020
-- SANS Amsterdam January 2020 | January 20-25 | https://www.sans.org/event/amsterdam-january-2020
-- Cyber Threat Intelligence Summit & Training | Arlington, VA | January 20-27 | https://www.sans.org/event/cyber-threat-intelligence-summit-2020
-- SANS Scottsdale 2020 | February 17-22 | https://www.sans.org/event/scottsdale-2020
-- Open-Source Intelligence Summit & Training 2020 | Alexandria, VA | February 18-24 | https://www.sans.org/event/osint-summit-2020
-- SANS Secure Singapore 2020 | 16-28 March | https://www.sans.org/event/secure-singapore-2020
-- SANS OnDemand and vLive Training
Get a Free GIAC Certification Attempt or Take $350 Off through December 25 with OnDemand or vLive training.
https://www.sans.org/online-security-training/specials/
-- Can't travel? SANS offers online instruction for maximum flexibility
-- Live Daytime training with Simulcast - https://www.sans.org/simulcast
-- Evening training 2x per week for 6 weeks with vLive | https://www.sans.org/vlive
-- Anywhere, Anytime access for 4 months with OnDemand format | https://www.sans.org/ondemand/
-- Single Course Training
SANS Mentor | https://www.sans.org/mentor/about
Community SANS | https://www.sans.org/community/
-- View the full SANS course catalog and Cyber Security Skills Roadmap
https://www.sans.org/cyber-security-skills-roadmap
********************** Sponsored Links: ********************
1) Think you're a shared responsibility expert? Test your cloud security savvy and find out! http://www.sans.org/info/215065
2) ICYMI Webcast: Effectively Addressing Advanced Threats with SANS Matt Bromiley. View here: http://www.sans.org/info/215070
3) Join us at the SANS ICS Security Summit & Training Summit 2020 | Orlando, FL | March 2-9. http://www.sans.org/info/215075
============================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: New malware-as-a-service family targets tech, health care companies
Description: The new Zeppelin malware is targeting health care and tech companies in the U.S. and Europe. Researchers believe Zeppelin is a variant of the ransomware-as-a-service family known as Vega. While Vega started out earlier this year targeting Russian-speaking victims, researchers believe the malware could be in a new adversaries' hands now that they are targeting users elsewhere. Zeppelin is highly configurable and can be deployed as an EXE, DLL, or wrapped in a PowerShell loader.
Snort SIDs: 52451 - 52453 (By Nicholas Mavis)
Title: Gamaredon attacks spread to Ukrainian journalists, law enforcement agencies
Description: A well-known APT is expanding its pool of targets, now going after journalists and law enforcement agencies in Ukraine. The group, which is believed to have Russian ties based on the language used in their malware, previously went after Ukrainian military and government agencies. There are also new TTPs associated with this group, including the use template injection in their malware.
Snort SIDs: 52445 - 52448 (By Joanne Kim)
============================================================
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
GSuite users will soon no longer be able to use apps Google considers "less secure," and only apps with OAuth Tokens will be allowed.
https://ww.9to5google.com/2019/12/17/g-suite-less-secure-apps/
Congress is close to approving $425 million in spending to improve America's election security, the largest influx of money to the U.S.'s voting systems since the 2016 presidential election.
https://www.cnn.com/2019/12/16/politics/congress-425-million-election-security-2019/index.html
Iran says it thwarted a major cyber attack last week, but if its claims are true, it would establish the country as a major cyber warfare threat.
Twitter users who followed the National Epilepsy Foundation were targeted with a cyber attack that sent the users flashing lights, likely an attempt to cause harmful seizures.
https://www.nytimes.com/2019/12/16/us/strobe-attack-epilepsy.html
The city of Pensacola, Florida still does not know the full extent of a recent ransomware attack and has brought in an outside firm to perform an audit on the city's network.
New Orleans was also a victim of a cyberattack, with ransomware bringing down the city's computer systems for several days. The city says recovery will take a week or longer.
https://www.nola.com/news/politics/article_0a132564-2061-11ea-8d52-53848745f381.html
Ring cameras have been in the headlines for a series of hacks on the smart devices, but Amazon, the company that owns ring, chalks up the breaches to customers reusing common passwords that are easy for attackers to guess.
https://www.inc.com/minda-zetlin/ring-camera-hacked-hackers-bitcoin-ransom-security.html
Credit card company VISA released a warning on a series of point-of-sale malware at gas stations across the U.S., saying the company's security division has investigated five incidents of the sort over the past two months.
https://www.zdnet.com/article/visa-warns-of-pos-malware-incidents-at-gas-pumps-across-north-america/
=========================================================
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM
This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.
ID: CVE-2019-19726
Title: OpenBSD Dynamic Loader Privilege Escalation Vulnerability
Vendor: OpenBSD
Description: A local privilege escalation vulnerability exisys in OpenBSD's dynamic loader. This vulnerability is exploitable in the default installation (via the set-user-ID executable chpass or passwd) and could allow local users or malicious software to gain full root privileges.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: CVE-2019-6192
Title: Lenovo Power Management Driver Denial of Service Vulnerability
Vendor: Lenovo
Description: A vulnerability in pmdrvs.sys driver exists in Lenovo Power Management Driver. The vulnerability exists due to insuffiecient input buffer validation when the driver processes IOCTL codes. Attackers can exploit this issue to cause a denial of service or possibly execute arbitrary code in kernel space.
CVSS v2 Base Score: 4.6 (AV:L/AC:L/Au:S/C:N/I:N/A:C)
ID: CVE-2019-17554
Title: Apache Olingo OData XML External Entity Injection Vulnerability
Vendor: Apache
Description: The XML content type entity deserializer in Apache Olingo is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks. XML data is parsed by insecurley configured software components, which can be abused for XML External Entity Attacks
Base Score: 4.3 MEDIUMVector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)
ID: CVE-2019-16451
Title: Adobe Acrobat Reader Heap Based Memory Corruption Vulnerability
Vendor: Adobe
Description: A heap based memory corruption vulnerability exists in Adobe Acrobat Reader. This vulnerability in Acrobat Reader for Windows, allows access violation exception when opening a malformed PDF file. Successful exploitation could lead to arbitrary code execution.
Base Score: 7.5 HIGHVector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: CVE-2019-16451
Title: AppXSvc Arbitrary File Overwrite Denial of Service Vulnerability
Vendor: Microsoft
Description: An elevation of privilege vulnerability exists when the AppX Deployment Server (AppXSvc) improperly handles file hard links. AppXSvc can be forced to overwrite an arbitrary file by deleting all registry data files before creating the file hard link. A low privileged user could exploit this vulnerability to cause denial of service by overwriting critical system files.
Base Score: 7.2 HIGHVector: (AV:L/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2019-15627
Title: Trend Micro Deep Security Agent 11 Arbitrary File Overwrite Vulnerability
Vendor: Trend Micro
Description: Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to availability impact. Local OS access is required. The vulnerability allows an unprivileged local attacker to delete any file on the filesystem, or overwrite it with abritrary data hosted elsewhere.
Base Score: 6.6 MEDIUMVector: (AV:L/AC:L/Au:N/C:N/I:C/A:C)
=========================================================
MOST PREVALENT MALWARE FILES Dec. 12 - 19:
COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: d73ea76f6f07f96b337335213418b58e3fbc7e4b519fec0ef3fbd19c1d335d81
MD5: 5142c721e7182065b299951a54d4fe80
VirusTotal: https://www.virustotal.com/gui/file/d73ea76f6f07f96b337335213418b58e3fbc7e4b519fec0ef3fbd19c1d335d81/details
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA.Win.Adware.Flashserv::1201
SHA 256: 0cdd2a671195915d9ffb5c9533337db935e0cc2f4d7563864ea75c21ead3f94
MD5: 7c38a43d2ed9af80932749f6e80fea6f
VirusTotal: https://www.virustotal.com/gui/file/c0cdd2a671195915d9ffb5c9533337db935e0cc2f4d7563864ea75c21ead3f94/details
Typical Filename: xme64-520.exe
Claimed Product: N/A
Detection Name: PUA.Win.File.Coinminer::1201
SHA 256: 1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871
MD5: c2406fc0fce67ae79e625013325e2a68
VirusTotal: https://www.virustotal.com/gui/file/1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871/details
Typical Filename: SegurazoIC.exe
Claimed Product: Digital Communications Inc.
Detection Name: PUA.Win.Adware.Ursu::95.sbx.tg
SHA 256: f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc
MD5: c5608e40f6f47ad84e2985804957c342
VirusTotal: https://www.virustotal.com/gui/file/f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc/details
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA:2144FlashPlayer-tpd
SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: https://www.virustotal.com/gui/file/15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b/details
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201
=============================================================
(c) 2019. All rights reserved. The information contained in this
newsletter, including any external links, is provided "AS IS," with no
express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but
no posting is allowed on web sites. For a free subscription, (and for
free posters) or to update a current subscription, visit
SANS Institute, 8120 Woodmont Ave., Suite 310, Bethesda, MD 20814-2743
