@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.
October 8, 2020=============================================================
@RISK: The Consensus Security Vulnerability Alert
October 8, 2020 - Vol. 20, Num. 41
Providing a reliable, weekly summary of newly discovered attack vectors,
vulnerabilities with active exploits, and explanations of how recent
attacks worked
Archived issues may be found at http://www.sans.org/newsletters/at-risk
=============================================================
CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES Oct. 1 - 8
============================================================
TOP VULNERABILITY THIS WEEK: Attackers being PoetRAT keep targeting Azerbaijan public and private sectors
**************** Sponsored By AWS Marketplace *****************
Webcast | How to Create a Scalable and Automated Edge Strategy in the AWS Cloud. Join SANS and AWS as they explore how to redefine and approach defense at the security perimeter. This webinar will also provide practical guidance on how you can scale and automate your security solutions at the edge through real-world use cases | Thursday, October 15th at 2PM ET.
| http://www.sans.org/info/217830
============================================================
TRAINING UPDATE
SEC588: Cloud Penetration Testing
- https://www.sans.org/ondemand/course/cloud-penetration-testing
SEC401: Security Essentials Bootcamp Style
- https://www.sans.org/ondemand/course/security-essentials-bootcamp-style
View all courses
- https://www.sans.org/cyber-security-courses/?focus-area=&training-format=ondemand
Live Online Training Events and Summits
SANS DFIRCON 2020 - Live Online
Nov 2-7 EST | 9 DFIR Courses | Virtual DFIR NetWars
- https://www.sans.org/event/dfircon-2020-live-online
Pen Test HackFest - Live Online
Nov 16-21 EST | 15 Courses | Summit @Night Bonus Sessions
- https://www.sans.org/event/pen-test-hackfest-2020-live-online
View complete event schedule
- https://www.sans.org/cyber-security-training-events/north-america
Free Resources
Tools, Posters, and more.
OnDemand Training Special Offer: Get an iPad (32 G), Galaxy Tab S5e, or Take $250 Off with qualified OnDemand courses through October 14.
- https://www.sans.org/ondemand/specials
********************** Sponsored Links: ********************
1) DTEX Insider Threat Kill Chain: Learn the 5 Steps Present in Almost all Insider Attacks| Get the whitepaper now!
| http://www.sans.org/info/217835
2) Webcast | Join us for an upcoming webcast hosted by Microsoft titled, "Stop attacks and reduce security operations workload with automated cross-domain (XDR) security" | October 15 @ 1:00 PM EDT
| http://www.sans.org/info/217840
3) Webcast | Join SANS director, John Pescatore as he takes part in our upcoming webcast, "Modernizing Detection and Response with XDR in the Cloud Computing Era" | October 21 @ 3:30 PM EDT
| http://www.sans.org/info/217845
============================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: PoetRAT malware evolves to be slimmer, faster and harder to detect
Description: Cisco Talos is tracking the behavior of the attackers behind the PoetRAT threat, who continue to target public and private entities in Azerbaijan. They observed multiple new campaigns indicating a change in the actor's capabilities and showing their maturity toward better operational security. This actor continues to use spear-phishing attacks to lure a user to download a malicious document from temporary hosting providers. The malware comes from malicious URLs included in the email, resulting in the user clicking and downloading a malicious document. Previous versions of PoetRAT deployed a Python interpreter to execute the included source code which resulted in a much larger file size compared to the latest version's switch to Lua script.
References: https://blog.talosintelligence.com/2020/10/poetrat-update.html
Snort SIDs: 53689 - 53691
Title: Emotet now using poltiically charged emails
Description: The infamous Emotet botnet is now using lure documents that disguise themselves as being from the Democratic National Committee. Attackers sent emails to numerous American organizations last week with the title "Team Blue Take Action." If the user opens the attachment, it asks them to enable macros. Once enabled, the file then downloads Emotet and a few other malicious tools. Emotet went quiet in early 2020, but has since reemerged and changed up its tactics since the summer.
References: https://www.darkreading.com/threat-intelligence/emotet-spoofs-dnc-in-new-attack-campaign/d/d-id/1339075
Snort SIDs: 55870 - 55874
============================================================
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
The U.S. Cybersecurity and Infrastructure Security Agency released an alert last week that it expects distributed denial-of-service attacks to disrupt websites that post election results, but will not affect voting.
https://www.ic3.gov/media/2020/200930.aspx
A group of American citizens living outside the U.S. are suing election officials in seven states, arguing that they should have the ability to return their absentee ballots electronically.
https://www.theguardian.com/us-news/2020/oct/02/us-voting-electronic-lawsuit-voters-living-abroad
Visa says networks belonging to two hospitality merchants were attacked in May and June with point-of-sale malware that attempted to skim credit card information.
https://www.zdnet.com/article/two-north-american-hospitality-merchants-hacked-in-may-and-june/
A British service that helps organizations raise money says a data breach may have led to the theft of donors' bank account information and passwords for the site.
https://www.bbc.com/news/technology-54370568
Facebook says it shut down several accounts that Chinese threat actors hijacked to host malicious ads, spending $4 million of victims' money on ads for diet pills, fake designer handbags and more.
https://wired.com/story/facebook-shut-down-malware-that-hijacked-accounts-to-run-ads/
Hospital chain Universal Health Services says it's made "substantial progress" in restoring its services after an apparent cyber attack last week.
The United Nations' agency for international shipping had to curtail some of its services late last week after a cyber attack after the organization had originally reported "technical issues" on Sept. 30.
https://www.infosecurity-magazine.com/news/un-shipping-agency-offline/
A cellular service provider's website has reportedly become infected with credit card-skimming malware that sends data back to a server controlled by the criminals.
GitHub released new code-scanning functionality that allows developers to detect potential vulnerabilities in their projects before making them public.
https://venturebeat.com/2020/09/30/github-launches-code-scanning-to-unearth-vulnerabilities-early/
=========================================================
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM
This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.
ID: CVE-2020-1350
Title: Microsoft Windows DNS Server Remote Code Execution Vulnerability
Vendor: Microsoft
Description: A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account. Windows servers that are configured as DNS servers are at risk from this vulnerability.
CVSS v3 Base Score: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
ID: CVE-2020-1472
Title: Microsoft Netlogon Elevation of Privilege Vulnerability
Vendor: Microsoft
Description: An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access.
CVSS v3 Base Score: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
ID: CVE-2020-0688
Title: Microsoft Exchange Validation Key Remote Code Execution Vulnerability
Vendor: Microsoft
Description: A remote code execution vulnerability exists in Microsoft Exchange Server when the server fails to properly create unique keys at install time. Knowledge of a the validation key allows an authenticated user with a mailbox to pass arbitrary objects to be deserialized by the web application, which runs as SYSTEM.
CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
ID: CVE-2020-3566
Title: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities
Vendor: Cisco
Description: A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes.
CVSS v3 Base Score: 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
ID: CVE-2020-0618
Title: Microsoft SQL Server Remote Code Execution Vulnerability
Vendor: Microsoft
Description: A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests. An attacker who successfully exploited this vulnerability could execute code in the context of the Report Server service account.
To exploit the vulnerability, an authenticated attacker would need to submit a specially crafted page request to an affected Reporting Services instance.
CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
ID: CVE-2020-15675
Title: Mozilla Firefox User-After-Free Vulnerability
Vendor: Mozilla
Description: A user-after-free vulnerability exists in WebCGL in Mozilla Firefox. When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash.
CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
ID: CVE-2020-8243
Title: Pulse Connect Secure Arbitrary Code Execution Vulnerability
Vendor: PulseSecure
Description: A vulnerability exists in the Pulse Connect Secure admin web interface that could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
CVSS v3 Base Score: 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
=========================================================
MOST PREVALENT MALWARE FILES Oct. 1 - 8:
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: 1eef72aa566ba6c76b33f9d430d7233e358392382bfb3db81ca4f28d74f415a5
MD5: 01a607b4d69c549629e6f0dfd3983956
VirusTotal: https://www.virustotal.com/gui/file/1eef72aa566ba6c76b33f9d430d7233e358392382bfb3db81ca4f28d74f415a5/details
Typical Filename: wupxarch.exe
Claimed Product: N/A
Detection Name: W32.Auto:1eef72aa56.in03.Talos
SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
MD5: 8c80dd97c37525927c1e549cb59bcbf3
VirusTotal: https://www.virustotal.com/gui/file/85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5/details
Typical Filename: Eter.exe
Claimed Product: N/A
Detection Name: Win.Exploit.Shadowbrokers::5A5226262.auto.talos
SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: https://www.virustotal.com/gui/file/15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b/details
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: Win.Downloader.Generic::1201
SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: https://www.virustotal.com/gui/file/c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f/details
Typical Filename: Tempmf582901854.exe
Claimed Product: N/A
Detection Name: Win.Dropper.Agentwdcr::1201
SHA 256: 1a8a17b615799f504d1e801b7b7f15476ee94d242affc103a4359c4eb5d9ad7f
MD5: 88781be104a4dcb13846189a2b1ea055
VirusTotal: https://www.virustotal.com/gui/file/1a8a17b615799f504d1e801b7b7f15476ee94d242affc103a4359c4eb5d9ad7f/details
Typical Filename: UltraSearchApp
Claimed Product: N/A
Detection Name: Win.Trojan.Generic::sso.talos
=============================================================
(c) 2020. All rights reserved. The information contained in this
newsletter, including any external links, is provided "AS IS," with no
express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but
no posting is allowed on web sites. For a free subscription, (and for
free posters) or to update a current subscription, visit
SANS Institute, 8120 Woodmont Ave., Suite 310, Bethesda, MD 20814-2743
