@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
July 2, 2020=============================================================
@RISK: The Consensus Security Vulnerability Alert
July, 02 2020 - Vol. 20, Num. 27
Providing a reliable, weekly summary of newly discovered attack vectors,
vulnerabilities with active exploits, and explanations of how recent
attacks worked
Archived issues may be found at http://www.sans.org/newsletters/at-risk
=============================================================
CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES June 25 - July 2
============================================================
TOP VULNERABILITY THIS WEEK: Adversaries behind Zeus trojan use job lures, new malware in the wild
******************** Sponsored By SANS *********************
Free Virtual Event | 4 CPE Credits | July 24, 2020 at 10:30 AM EDT | Jake Williams, one of the worlds foremost experts in Malware, is chairing the SANS Malware & Ransomware Solutions Forum. Join Jake and experts from top suppliers CISCO, MalwareBytes, CyberInc, VMRay & Akamai as they provide specific technical advice from support engineers fighting on the front lines every day.
| http://www.sans.org/info/216900
============================================================
TRAINING UPDATE
SANS Training now offers THREE ways to complete a course:
OnDemand | Live Online | In-Person:
OnDemand | Live Online
- https://www.sans.org/ondemand/
- https://www.sans.org/live-online
- https://www.sans.org/cyber-security-training-events/in-person/north-america
Keep your skills sharp with SANS Training:
. The world's top cybersecurity courses
. Taught by real world practitioners
. Ideal preparation for more than 30 GIAC Certifications
OnDemand Training Special Offer
Flexible Offer with Flexible Training
Choose an iPad Air, an iPad with Smart Keyboard, a Surface Go, or Take $300 Off with OnDemand Training through July 8.
- https://www.sans.org/ondemand/specials
Live Online Training Special Offer
Get a Free GIAC Certification Attempt or Take $350 Off with Live Online Training through July 4.
- https://www.sans.org/live-online/specials
Top OnDemand Courses
SEC401: Security Essentials Bootcamp Style
- https://www.sans.org/ondemand/course/security-essentials-bootcamp-style
SEC504: Hacker Tools, Techniques, Exploits, and Incident Handling
- https://www.sans.org/ondemand/course/hacker-techniques-exploits-incident-handling
SEC560: Network Penetration Testing and Ethical Hacking
- https://www.sans.org/ondemand/course/network-penetration-testing-ethical-hacking
______________________
Upcoming In-Person and Live Online Events:
DFIR Summit & Training (Free Summit) | July 16-25 | Live Online
- https://www.sans.org/event/digital-forensics-summit-2020
SANS Rocky Mountain Summer 2020 | Jul 20-25 | Live Online
- https://www.sans.org/event/rocky-mountain-summer-2020
SANS Reboot - NOVA 2020 | August 10-15 | Arlington, VA or Live Online
- https://www.sans.org/event/reboot-nova-2020
SANS Network Security 2020 | September 20-25 | Las Vegas, NV or Live Online
- https://www.sans.org/event/network-security-2020
______________________
Test drive a course: https://www.sans.org/course-preview
View the full SANS course catalog and skills roadmap.
- https://www.sans.org/cyber-security-courses
- https://www.sans.org/cyber-security-skills-roadmap
********************** Sponsored Links: ********************
1) Webcast | Join SANS Senior Instructor, Chris Crowley as he hosts "Preventing Runtime Exploits: The SANS Implementation Guide for RunSafe Security's Alkemist " | July 15 @ 2:00 PM EDT
| http://www.sans.org/info/216905
2) Webcast | Join this webinar "The System Is People: Designing Security for Real-World Users" with SANS Analyst Dave Shackleford and Zoe Lindsey, Security Strategist at Duo Security, for a discussion on security strategy that puts people first and keeps your users safer, inside and outside the office. | July 9 @ 1:00PM EDT
| http://www.sans.org/info/216915
3) Webcast | Join Almog Apirion, CEO and co-founder of Cyolo as well as SANS Instructor, Chris Dale as they discuss "Everything you need to know before trusting a zero-trust provider" | July 14 @ 2:00PM EDT
| http://www.sans.org/info/216920
============================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Evil Corp rolls out new ransomware, variant of Zeus trojan
Description: Evil Corp, known for the creation of the infamous Zeus trojan, is actively attacking large corporations using fake documents disguised as job applications and resumes. The phishing emails claim to be someone looking for employment after losing their job due to the COVID-19 pandemic. The adversaries also recently released a new ransomware called "WastedLocker," which is believed to be a replacement for the BitPaymer ransomware strain the group used previously.
Reference: https://www.computerweekly.com/news/252485331/Evil-Corps-latest-ransomware-project-spreading-fast
Snort SIDs: 54407, 54408
Title: Valak plugin goes after Microsoft Exchange users
Description: The Valak information-stealing malware now has new capabilities to specifically target Microsoft Exchange servers and steal users' email logins. Researchers have discovered at least 30 variants of Valak over the past six months, showing the adversaries are quickly adapting. The newest strain uses what's known as "reply-chain attacks," where the malware injects a malicious phishing email into an otherwise harmless email chain the user previously replied to.
Snort SIDs: 54401 - 54404
============================================================
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
The threat actor behind StrongPity is not deterred, despite being exposed multiple times over the past four years.
https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html
A recent study found that Amazon's facial recognition service often misidentifies people and does so at a higher rate for non-white people.
Republicans in Congress introduced a new bill that would roll back encryption standards and force software and hardware makers to include "lawful access" mechanisms.
https://slate.com/technology/2020/06/lawful-access-encrypted-data-act.html
Starbucks, Ford and Hershey are among the big-name brands pausing advertisement on social media platforms, as major companies push Facebook and Twitter to better crack down on hate speech.
https://www.theverge.com/2020/6/28/21306065/starbucks-advertising-social-media-july-facebook-twitter
A group known as DDoSecrets may be setting themselves up as the next WikiLeaks after the group uncovered thousands of police documents and posted them for free online.
https://www.wired.com/story/ddosecrets-blueleaks-wikileaks/
Rice University is working with a non-profit to release open-source technology before November aimed at helping states better prepare for mail-in voting, which is likely to become popular due to the COVID-19 pandemic.
https://news.rice.edu/2020/06/29/rice-researchers-helping-to-ready-vote-by-mail-system-for-november/
The University of California, San Francisco says it paid a $1.14 million ransom to adversaries who infected a limited number of their servers. Researchers at the school have been investigating the efficacy of certain drugs in treating COVID-19.
https://www.cyberscoop.com/ucsf-ransomware-payment-coronavirus/
Google is warning users of its G Suite apps that they need to update their software prior to Aug. 12 or they may stop working.
=========================================================
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM
This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.
ID: CVE-2020-2021
Title: Palo Alto Networks PAN-OS Authentication Bypass in SAML Authentication Vulnerability
Vendor: Palo Alto Networks
Description: When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability.
CVSS v3 Base Score: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
ID: CVE-2020-1299
Title: Microsoft LNK Remote Code Execution Vulnerability
Vendor: Microsoft
Description: A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. The attacker could present to the user a removable drive, or remote share, that contains a malicious .LNK file and an associated malicious binary. When the user opens this drive(or remote share) in Windows Explorer, or any other application that parses the .LNK file, the malicious binary will execute code of the attacker's choice, on the target system.
CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
ID: CVE-2020-10665
Title: Docker Desktop Privilege Escalation Vulnerability
Vendor: Docker
Description: Docker Desktop allows local privilege escalation to NT AUTHORITYSYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes.
CVSS v3 Base Score: 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
ID: CVE-2020-9484
Title: Apache Tomcat Remote Code Execution Vulnerability
Vendor: Apache
Description: When using Apache Tomcat versions if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
CVSS v3 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
ID: CVE-2020-1206
Title: Microsoft Windows SMBv3 Client/Server Remote Code Execution Vulnerability
Vendor: Microsoft
Description: An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could obtain information to further compromise the usera[euro](TM)s system. To exploit the vulnerability against a server, an unauthenticated attacker could send a specially crafted packet to a target.
CVSS v3 Base Score: 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
ID: CVE-2020-5825
Title: Symantec Endpoint Protection Arbitrary file Write Vulnerability
Vendor: Symantec
Description: Symantec Endpoint Protection may be susceptible to an arbitrary file write vulnerability, which is a type of issue whereby an attacker is able to overwrite existing files on the resident system without proper privileges.
CVSS v3 Base Score: 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
ID: CVE-2020-1170
Title: Microsoft Windows Defender Elevation of Privilege Vulnerability
Vendor: Microsoft
Description: An elevation of privilege vulnerability exists in Windows Defender that leads arbitrary file deletion on the system. To exploit the vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.
CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
=========================================================
MOST PREVALENT MALWARE FILES June 25 - July 2:
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: e3eeaee0af4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd
MD5: 8193b63313019b614d5be721c538486b
VirusTotal: https://www.virustotal.com/gui/file/e3eeaee0af4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd/details
Typical Filename: SAntivirusService.exe
Claimed Product: SAService
Detection Name: PUA.Win.Dropper.Segurazo::95.sbx.tg
SHA 256: 094d4da0ae3ded8b936428bb7393c77aaedd5efb5957116afd4263bd7edc2188
MD5: a10a6d9dfc0328a391a3fdb1a9fb18db
VirusTotal: https://www.virustotal.com/gui/file/094d4da0ae3ded8b936428bb7393c77aaedd5efb5957116afd4263bd7edc2188/details
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA.Win.Adware.Flashserv::100.sbx.vioc
SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
MD5: 8c80dd97c37525927c1e549cb59bcbf3
VirusTotal: https://www.virustotal.com/gui/file/85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5/details
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Services
Detection Name: Win.Exploit.Shadowbrokers::5A5226262.auto.talos
SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: https://www.virustotal.com/gui/file/3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3/details
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::95.sbx.tg
SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: Win.Dropper.Agentwdcr::1201
=============================================================
(c) 2020. All rights reserved. The information contained in this
newsletter, including any external links, is provided "AS IS," with no
express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but
no posting is allowed on web sites. For a free subscription, (and for
free posters) or to update a current subscription, visit
SANS Institute, 8120 Woodmont Ave., Suite 310, Bethesda, MD 20814-2743
