Newsletters: @RISK

@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

August 23, 2012
=============================================================

@RISK: The Consensus Security Vulnerability Alert

Vol. 12, Num. 34

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.

=============================================================

CONTENTS:

NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 8/15/2012 - 8/21/2012
============================================================

TOP VULNERABILITY THIS WEEK: The newly discovered W32/DistTrack malware emerged as one of the most destructive pieces of malicious code in years, spreading via SMB and intentionally killing machines within four hours of infection. Although targeted at the energy sector for the time being, any adaptation of this malware or code that emulated its behavior could cause major disruptions for any company infected with it. Security analysts and operations teams are urged to follow its progress closely and deploy all available detection methods against it immediately.

********************* Sponsored By SANS ********************

Special Webcast: Conducting a Legal Investigation in Social Media: How to Do; How Not to Do It - Featuring Benjamin Wright. Thursday, September 13, 2012 at 1:00 PM EDT.
http://www.sans.org/info/112224

============================================================

TRAINING UPDATE

**Featured Conference 1: National Cybersecurity Innovation Conference, Oct 3-5, Baltimore - featuring briefings by and exhibits all the vendors that have tools for automating the 20 critical controls and for continuous monitoring.
www.sans.org/ncic-2012

**Featured Conference 2: The IT Security Automation Conference (ITSAC)
Oct 3-5, Baltimore - featuring DHS and other government leaders providing a clear picture of the changes coming in federal cybersecurity - especially in cloud and continuous monitoring. Not to miss. We try never to promote conferences where SANS doesn't control the program, but is an exception because the DHS and NIST folks have done a great job!
https://itsac.g2planet.com/itsac2012/

- --SCADA Security Advanced Training 2012, The Woodlands, TX August 20-24, 2012
http://www.sans.org/scada-sec-training-2012/

- --SANS Virginia Beach 2012 Virginia Beach, VA August 20-31, 2012
10 courses. Bonus evening presentations include Information Assurance Metrics: Practical Steps to Measurement; and Who's Watching the Watchers?
http://www.sans.org/virginia-beach-2012/

- --SANS Capital Region Fall 2012 September 6-11 and October 15-20, 2012
http://www.sans.org/capital-region-fall-2012/

- --SANS Crystal City 2012 Arlington, VA September 6-11, 2012
4 courses. Bonus evening presentations include SIFT Workstation: The Art of Incident Response.
http://www.sans.org/crystal-city-2012/

- --SANS Baltimore 2012 October 15-20, 2012
6 courses. Bonus evening presentations include Infosec Rock Star: How to be a More Effective Security Professional.
http://www.sans.org/baltimore-2012/

- --SANS Network Security 2012, Las Vegas, NV September 16-24, 2012
44 courses. Bonus evening presentations include Evolving Threats; New Legal Methods for Collecting and Authenticating Cyber Investigation Evidence; and Intrusion Detection is Dead.
http://www.sans.org/network-security-2012/

- --SANS Forensics Prague 2012 Prague, Czech Republic October 7-13, 2012
7 courses. Bonus evening presentations include Big Brother Forensics: Location-based Artifacts.
http://www.sans.org/forensics-prague-2012/

- --SANS Singapore 2012 Singapore, Singapore October 8-20, 2012
5 courses, including the new Virtualization and Private Cloud Security course, and Advanced Forensics and Incident Response.
Don't miss this opportunity to upgrade your IT skills, work toward your GIAC security certification, and network with other top information security professionals.
http://www.sans.org/singapore-sos-2012/

- --SANS Seattle 2012 Seattle, WA October 14-19, 2012
6 courses. Bonus evening presentations include What's New in Windows 8 and Server 2012?; Assessing Deception; and Linux Forensics for Non-Linux Folks.
http://www.sans.org/seattle-2012/

- --SANS Chicago 2012 Chicago, IL October 27-November 5, 2012 10 courses. Bonus evening presentations include Securing the Kids and Securing the Human.
http://www.sans.org/chicago-2012/

- --Looking for training in your own community?
http://www.sans.org/community/

- --Save on On-Demand training (30 full courses) - See samples at http://www.sans.org/ondemand/discounts.php#current

Plus Melbourne, Dubai, San Diego, Johannesburg, Seoul, and Tokyo all in the next 90 days.

For a list of all upcoming events, on-line and live: www.sans.org

********************** Sponsored Link: *********************

1) Analyst Webcast! A Review of McAfee's Solutions for Securing Physical and Virtualized Servers in the Data Center
http://www.sans.org/info/112229

============================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: W32/DistTrack: destructive malware targeted against energy sector
Description: McAfee discovered last week an extremely destructive new piece of malware that they dubbed DistTrack. Within four hours of infection, the malware has not only overwritten critical system files with a portion of a JPEG image, it overwrites the Master Boot Record with zeroes and forces a reboot, effectively killing the machine, and requiring users to use forensics tools to recover data. The Sourcefire VRT has confirmed that this malware is in the wild, and is targeted towards energy companies specifically. While attacks thus far have been extremely targeted in nature, detection is very straightforward, and users are urged to stay vigilant, as the consequences of a successful attack would be devastating.
Reference: http://vrt-blog.snort.org/2012/08/new-threat-disttrack.html
https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/23000/PD23936/en_US/McAfee_Labs_Threat_Advisory-W32-DistTrack.pdf
Snort SID: 23893, 23903, 23905 - 23933
ClamAV: Win.Trojan.DistTrack, Win.Trojan.DistTrack-[1-3]

Title: SMSZombie Android trojan hits 500,000 users in China
Description: A major Android malware outbreak was spotted over the weekend in China by security firm TrustGo. The malicious app, dubbed SMSZombie, steals information from the impacted user and forwards it via SMS to the creators of the malware; it also dials premium SMS numbers. The malware is distinct from previous apps in that generates no TCP/IP traffic to communicate with C&Cs, which hampers detection at the network level. Signatures for downloads of the malicious files are available, and mobile AV products should be used to spot and remediate infections as appropriate.
Reference: http://vrt-blog.snort.org/2012/08/smszombie-new-twist-on-c.html
http://blog.trustgo.com/SMSZombie/
Snort SID: 23954
ClamAV: Andr.Trojan.SMSZombie

Title: Briba trojan spreading by way of CVE-2012-1535
Description: Last week's Flash 0-day attacks, which were patched by Adobe as CVE-2012-1535, are continuing to spread in the wild. Live command and control servers have been spotted by researchers around the world, and targets outside of the initial military-industrial scope of the 0-day attacks have been confirmed hit by the Sourcefire VRT. Users are urged to patch their Flash installations to the most current release immediately, as this attack is likely to continue spreading over time, and will almost certainly make its way into exploit kits worldwide within the next several weeks.
Reference: http://labs.alienvault.com/labs/index.php/2012/cve-2012-1535-adobe-flash-being-exploited-in-the-wild/
http://anubis.iseclab.org/?action=result&task_id=1fbaec06ba83c7f2481fcb8badf31001a
Snort SID: 23853, 23854, 23904, 23942
ClamAV: BC.CVE_2012-1535

Title: Oracle FlashTunnelSvc Remote Code Execution
Description: Exploit code exists for a major, trivially exploitable vulnerability against the Oracle FlashTunnelService. By hitting a directory traversal bug and making use of the built-in writeToFile function, users can drop arbitrary files on impacted systems, and then call a URL in order to execute code in those files. The entire process can be completed with no authentication. The Sourcefire VRT has observed exploitation in the field, which can be fully automated with ease. Users of Oracle systems are urged to patch immediately.
Reference: http://www.securityfocus.com/archive/1/523800
http://www.exploit-db.com/exploits/20318/
Snort SID: 23939, 23940
ClamAV: N/A

============================================================
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

Inside the Grum botnet:
http://krebsonsecurity.com/2012/08/inside-the-grum-botnet/

White hats publish DDoS hijacking manual, turn tables on attackers:
http://arstechnica.com/security/2012/08/ddos-take-down-manual/

Windows 8 heap internals:
http://illmatics.com/Windows%208%20Heap%20Internals.pdf

Leaky web sites provide trail of clues about corporate executives:
http://www.itworld.com/it-managementstrategy/289519/leaky-web-sites-provide-trail-clues-about-corporate-executives

Microsoft's free security tools - BinScope binary analyzer:
http://blogs.technet.com/b/security/archive/2012/08/15/microsoft-s-free-security-tools-binscope-binary-analyzer.aspx

VPN credentials of international airport employees stolen by trojan:
http://news.softpedia.com/news/VPN-Credentials-of-International-Airport-Employees-Stolen-by-Trojan-286449.shtml

Leaking information using timing attacks on hash tables, part 2:
http://gdtr.wordpress.com/2012/08/14/leaking-information-using-timing-attacks-on-hash-tables-part-2/

=========================================================
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: : CVE-2012-1856
Title: Vulnerability in Windows Common Controls Could Allow Remote Code
Execution (MS12-060)
Vendor: Microsoft
Description: Microsoft Windows Common Controls are ActiveX controls contained in the MSCOMCTL.OCX file. Windows Common Controls is prone to a remote code execution vulnerability.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-1535
Title: Adobe Flash Player 11.3 Font Parsing Code Execution
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2011-1255
Title: IE Time Element Memory Corruption Exploit (MS11-050)
Vendor: Microsoft
Description: The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Time Element Memory Corruption Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2001-0198
Title: Apple Quicktime plugin - Windows 4.1.2 (Japanese) Remote Overflow Vulnerability
Vendor: Apple
Description: Buffer overflow in QuickTime Player plugin 4.1.2 (Japanese) allows remote attackers to execute arbitrary commands via a long HREF parameter in an EMBED tag.
CVSS v2 Base Score: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C) (legend)

ID: : CVE-2012-3951
Title: Scrutinizer NetFlow and sFlow Analyzer 9 Default MySQL Credential
Vendor: Plixer
Description: The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

=========================================================
MOST POPULAR MALWARE FILES 8/15/2012 - 8/21/2012:
COMPILED BY SOURCEFIRE

SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Malwr: http://malwr.com/analysis/923c4d13bee966654f4fe4a8945af0ae
Typical Filename: winsjji.exe
Claimed Product: winsjji.exe
Claimed Publisher: winsjji.exe

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Malwr: http://malwr.com/analysis/25aa9bb549ecc7bb6100f8d179452508
Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin

SHA 256: 02DB0F24CF8461FB903C65FAB7A1B5668BB6D912AFD8414D4AE872E97FCAD090
MD5: 64645e81435058738c137a67df84a5c5
VirusTotal: https://www.virustotal.com/file/02DB0F24CF8461FB903C65FAB7A1B5668BB6D912AFD8414D4AE872E97FCAD090/analysis/
Malwr: http://malwr.com/analysis/64645e81435058738c137a67df84a5c5
Typical Filename: 00008.@
Claimed Product: Bitcoin Miner
Claimed Publisher: Ufasoft

SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Malwr: http://malwr.com/analysis/bf31a8d79f704f488e3dbcb6eea3b3e3
Typical Filename: test.sys
Claimed Product: test.sys
Claimed Publisher: test.sys

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Malwr: http://malwr.com/analysis/3291e1603715c47a23b60a8bf2ca73db
Typical Filename: avz00001.dta
Claimed Product: avz00001.dta
Claimed Publisher: avz00001.dta

=============================================================

(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account