@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
August 18, 2016=============================================================
@RISK: The Consensus Security Vulnerability Alert
Vol. 16, Num. 33
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked
Archived issues may be found at http://www.sans.org/newsletters/at-risk
=============================================================CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 2016-08-09 - 2016-08-16
============================================================TOP VULNERABILITY THIS WEEK: Researchers at USENIX Security Symposium Disclose Flaw in Automotive Remote Keyless Entry Systems
******************* Sponsored By Great Bay Software *******************Air Academy Federal Credit Union detected WiFi Pineapple Attacks in seconds with Network Access Control from Great Bay Software. Register for the WhatWorks webcast to find out how: Tuesday, August 23rd, 2016 at 11:00 AM Eastern with John Pescatore and Jeremy Taylor. - details: http://www.sans.org/info/188017
============================================================TRAINING UPDATE
- --SANS Alaska | August 22-27, 2016 | Anchorage, AK | Take SEC504: Hacker Tools, Techniques, Exploits and Incident Handling or ICS410: ICS/SCADA Security Essentials and attend SANS@Night bonus sessions delivered by the SANS ICS team. http://www.sans.org/u/iHo
--SANS Virginia Beach | Virginia Beach, VA | August 22-September 2 | Choose from two week of cybersecurity training with 16 courses offered, ranging from introductory level to advanced. NetWars tournaments, evening talks, and networking with like-minded security professionals. http://www.sans.org/u/jC8
--SANS Brussels Autumn 2016 | Brussels, Belgium | September 5-10 | http://www.sans.org/u/iZW
--Northern Virginia-Crystal City | Arlington, VA | September 6-11 | Seven training courses in IT Security, Windows forensics, security management and ethical hacking. Plus multiple bonus evening talk. http://www.sans.org/u/jCd
--Network Security 2016 | Las Vegas, NV | September 10-19 | Our largest information security training event of the year. 45+ courses, bonus evening presentations, solutions expo, extraordinary networking opportunities, 2 nights of NetWars, industry receptions, and more! http://www.sans.org/u/jCi
--SANS London Autumn 2016 | London, UK | September 19-24 | http://www.sans.org/u/jL0
--Security Leadership Summit & Training | September 27 - October 4, 2016 | Dallas, TX | For CISOs of Today and Tomorrow! Two days of in-depth Summit talks, exclusive networking opportunities, and five SANS courses. http://www.sans.org/u/i2Ia>
--SANS Seattle 2016 | October 3-8, 2016 | Seattle, WA | http://www.sans.org/u/jLa
--SANS DFIR Prague 2016 | October 3-15, 2016 | Prague, Czech Republic | http://www.sans.org/u/jLf
--SANS Baltimore 2016 | October 10-15, 2016 | Baltimore, MD | https://www.sans.org/event/baltimore-2016 http://www.sans.org/u/jLk
- - --Can't travel? SANS offers LIVE online instruction.
Day (Simulcast - http://www.sans.org/u/WK) and Evening (vLive -
http://www.sans.org/u/WZ) courses available!
- -- Multi-week Live SANS training
Mentor -http://www.sans.org/u/X9
Contact mentor@sans.org
- -- Looking for training in your own community?
Community -http://www.sans.org/u/Xo
- -- SANS OnDemand lets you train anytime, anywhere with four months of online access to your course. Learn more: http://www.sans.org/u/XD
Plus Bangalore, Oslo, Tokyo, Munich, and San Diego all in the next 90 days. For a list of all upcoming events, on-line and live: http://www.sans.org/u/XN
********************** Sponsored Links: ********************
1) Avanan has identified the most common threats plaguing millions of Office 365 users every day. Wednesday, August 31st, 2016 at 1:00 PM (13:00:00 EDT/US Eastern) http://www.sans.org/info/188022
2) Hunting 101 - Back to Basics: Implementing a Proactive Cyber Hunting Approach Thursday, September 8th, 2016 with at 1:00 PM (13:00:00 EDT/US Eastern)Brad Mecha and Dave Shackleford. http://www.sans.org/info/188027
3) Help SANS determine how organizations conduct CONTINUOUS VULNERABILITY ASSESSMENT and remediation related to the CIS Critical Security Controls http://www.sans.org/info/187750
============================================================NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Researchers at USENIX Security Symposium Disclose Flaw in Automotive Remote Keyless Entry Systems Description: Researchers at the USENIX Security Symposium unveiled new research into the security of remote keyless entry systems for automobiles. In the presentation, researchers disclosed that "most VW Group vehicles manufactured between 1995 and today [rely] on a few, global master keys" for keyless entry. Additionally, the Hitag2 rolling code scheme used by a variety of other manufacturers was identified, enabling researchers to conduct "correlation-based attack[s] on Hitag2." This could lead to an attacker recovering the cryptographic key and gaining the ability to clone the "remote control with four to eight rolling codes and a few minutes of computation on a laptop." Reference: https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_garcia.pdf
Title: Undocumented SNMP Credential Flaw Identified in Rockwell Automation MicroLogix 1400 PLCs
Description: Researchers at Cisco Talos have identified an undocumented SNMP credential vulnerability in Rockwell Automation MicroLogix 1400 Programmable Logic Controllers (PLCs). The flaw "is due to the presence of an undocumented SNMP community string that could be leveraged by an attacker to gain full control of affected devices." However, due to "the nature of this product's firmware update process," the flaw cannot be patched. Rockwell has instead released mitigation guidelines to reduce the risk of compromise for affected devices.
Reference:
//ics-cert.us-cert.gov/advisories/ICSA-16-224-01
http://blog.talosintel.com/2016/08/rockwell-snmp-vuln.html
Snort SID: 39876-39877
Title: Cisco IOS XR Software for Cisco ASR 9001 Aggregation Services Routers Fragmented Packet Denial of Service Vulnerability Description: Cisco has released a security advisory for a fragmented packet denial-of-service vulnerability within Cisco IOS XR Software. This flaw manifests in Cisco ASR 9001 Aggregation Services Routers and could be exploited by a remote, unauthenticated attacker. Exploitation of this vulnerability could "cause a memory leak on the route processor (RP) of an affected device, which could cause the device to drop all control-plane protocols and lead to a denial of service." Cisco has released a software update to address the flaw along with mitigations. Reference: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160810-iosxr
============================================================INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
Further simplifying servicing models for Windows 7 and Windows 8.1
https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/further-simplifying-servicing-model-for-windows-7-and-windows-8-1/
The World Series of Hacking -- without humans http://arstechnica.com/information-technology/2016/08/the-world-series-of-hacking-without-humans/
"Fileless" UAC Bypass Using Eventvwr.exe and Registry Hijacking https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
Abusing Kerberos to NTLM fallback to defeat BitLocker FDE https://blog.ahmednabeel.com/abusing-kerberos-to-ntlm-fallback-to-defeat-windows-authentication/
There are really only two effectively distinct settings for the UAC slider https://blogs.msdn.microsoft.com/oldnewthing/20160816-00/?p=94105
=========================================================RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: CVE-2016-1017
Title: Adobe Flash Code Execution Vulnerability (APSA16-03)
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.242
and earlier allows remote attackers to execute arbitrary code via
unknown vectors, as exploited in the wild in June 2016.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2016-4171
Title: Adobe Flash Code Execution Vulnerability
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2016-4117
Title: Adobe Flash Player Integer Overflow Code Execution Vulnerability (APSA16-02)
Vendor: Adobe
Description: Adobe Flash Player 21.0.0.226 and earlier allows remote
attackers to execute arbitrary code via unspecified vectors, as
exploited in the wild in May 2016.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2016-0185
Title: Microsoft Windows Media Center Input Validation Remote Code Execution Vulneraiblity (MS16-059)
Vendor: Microsoft
Description: Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka "Windows Media Center Remote Code Execution Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: CVE-2016-4117
Title: Adobe Flash Player Integer Overflow Code Execution Vulnerability
Vendor: Adobe
Description: Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2016-0189
Title: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
Vendor: Microsoft
Description: The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.
CVSS v2 Base Score: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)
ID: CVE-2016-1287
Title: Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow Vulnerability
Vendor: Cisco
Description: Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9.2 before 9.2(4.5), 9.3 before 9.3(3.7), 9.4 before 9.4(2.4), and 9.5 before 9.5(2.2) on ASA 5500 devices, ASA 5500-X devices, ASA Services Module for Cisco Catalyst 6500 and Cisco 7600 devices, ASA 1000V devices, Adaptive Security Virtual Appliance (aka ASAv), Firepower 9300 ASA Security Module, and ISA 3000 devices allows remote attackers to execute arbitrary code or cause a denial of service (device reload) via crafted UDP packets, aka Bug IDs CSCux29978 and CSCux42019.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: CVE-2016-3081
Title: Apache Struts Input Validation Remote Code Execution Vulnerability
Vendor: Apache Structs
Description: Apache Struts 2.x before 2.3.20.2, 2.3.24.x before
2.3.24.2, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation
is enabled, allow remote attackers to execute arbitrary code via method:
prefix, related to chained expressions.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
MOST PREVALENT MALWARE FILES 2016-08-02 - 2016-08-09: COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: BCFFDA040C93B743BCA1A67128EC1F60595DC0B14655AFD7949B6C779E0E997F MD5: 2dbf779808d2ec3f5121891be9f4b1cf VirusTotal: https://www.virustotal.com/file/BCFFDA040C93B743BCA1A67128EC1F60595DC0B14655AFD7949B6C779E0E997F/analysis/#additional-info Typical Filename: helperamc Claimed Product: (none) Detection Name: OSX.Variant:AMCZ.19if.1201
SHA 256: 5698B51686F47133E584B0B07B38933B70B05CCF9D3ABD195FDF1C533D8D102C MD5: 0260613f570ec46bb5c4629a5cc4705c VirusTotal: https://www.virustotal.com/file/5698B51686F47133E584B0B07B38933B70B05CCF9D3ABD195FDF1C533D8D102C/analysis/#additional-info Typical Filename: contract_019459.doc Claimed Product: (none) Detection Name: W32.5698B51686-100.SBX.TG
SHA 256: 699590CFD11C8306DDADA9F9F5C33FF02210D1896457CA004D3571929AC91CC4 MD5: be7dd3e4363902530ac608936068f850 VirusTotal: https://www.virustotal.com/file/699590CFD11C8306DDADA9F9F5C33FF02210D1896457CA004D3571929AC91CC4/analysis/#additional-info Typical Filename: seupdater.dll Claimed Product: N/A Detection Name: W32.699590CFD1-100.SBX.VIOC
SHA 256: 20B9DE2D98B5A93F09CBAE55589A281153AE1B73BD04AF89BEA060E803A4E124 MD5: da63295955daa1e356031e5af09e9ce6 VirusTotal: https://www.virustotal.com/file/20B9DE2D98B5A93F09CBAE55589A281153AE1B73BD04AF89BEA060E803A4E124/analysis/#additional-info Typical Filename: business_deal_855048.doc Claimed Product: N/A Detection Name: W32.20B9DE2D98-100.SBX.TG
SHA 256: 4760FB5F0A5095FF612287EDDBD2B8E64314A48AB097BC9B9A640A222F909475 MD5: af8049cd7848e55ea164ecefc43f29e6 VirusTotal: https://www.virustotal.com/file/4760FB5F0A5095FF612287EDDBD2B8E64314A48AB097BC9B9A640A222F909475/analysis/#additional-info Typical Filename: radb35dc.tmp.exe Claimed Product: (none) Detection Name: GenericKD:ZPACK-tpd
=============================================================(c) 2016. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account
SANS Institute, 11200 Rockville Pike, Suite 200, North Bethesda, MD 20852
