Learn practical cyber security skills during SANS 2021 - Live Online. Choose from 30+ courses and three types of NetWars!

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure

@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

August 30, 2012

@RISK: The Consensus Security Vulnerability Alert

Vol. 12, Num. 35

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.



MOST POPULAR MALWARE FILES 8/22/2012 - 8/29/2012

TOP VULNERABILITY THIS WEEK: A trivially exploitable 0-day vulnerability in the current version of Java was released late on Sunday night, and is already being actively used in the field. No patch is currently available, and is not scheduled until October 16; concerned security researchers have released unofficial patches in the interim.

******************* Sponsored By SonicWall ******************

Ask The Expert Webcast: Windows Kernel Exploitation and Command & Control Malware, featuring Stephen Sims. Tuesday, September 11, 2012 at 11:00 AM EDT. In this presentation Stephen will discuss the basics of Kernel exploitation on the Windows Operating System, as well as the use of command and control malware as a payload. We will also take a look at some examples of exploit mitigation controls being added to protect the Windows Kernel from being exploitable when a vulnerability exists.



**Featured Conference 1: National Cybersecurity Innovation Conference, Oct 3-5, Baltimore - featuring briefings by and exhibits all the vendors that have tools for automating the 20 critical controls and for continuous monitoring. www.sans.org/ncic-2012

**Featured Conference 2: The IT Security Automation Conference (ITSAC) Oct 3-5, Baltimore - featuring DHS and other government leaders providing a clear picture of the changes coming in federal cybersecurity - - especially in cloud and continuous monitoring. Not to miss. We try never to promote conferences where SANS doesn't control the program, but is an exception because the DHS and NIST folks have done a great job!

--SANS Capital Region Fall 2012 September 6-11 and October 15-20, 2012

--SANS Crystal City 2012 Arlington, VA September 6-11, 2012
4 courses. Bonus evening presentations include SIFT Workstation: The Art of Incident Response.

--SANS Baltimore 2012 October 15-20, 2012
6 courses. Bonus evening presentations include Infosec Rock Star: How to be a More Effective Security Professional.

--SANS Network Security 2012, Las Vegas, NV September 16-24, 2012
44 courses. Bonus evening presentations include Evolving Threats; New Legal Methods for Collecting and Authenticating Cyber Investigation Evidence; and Intrusion Detection is Dead.

--SANS Forensics Prague 2012 Prague, Czech Republic October 7-13, 2012
7 courses. Bonus evening presentations include Big Brother Forensics: Location-based Artifacts.

--SANS Singapore 2012 Singapore, Singapore October 8-20, 2012
5 courses, including the new Virtualization and Private Cloud Security course, and Advanced Forensics and Incident Response.
Don't miss this opportunity to upgrade your IT skills, work toward your GIAC security certification, and network with other top information security professionals.

--SANS Seattle 2012 Seattle, WA October 14-19, 2012
5 courses. Bonus evening presentations include What's New in Windows 8 and Server 2012?; Assessing Deception; and Linux Forensics for Non-Linux Folks.

--SANS Chicago 2012 Chicago, IL October 27-November 5, 2012
10 courses. Bonus evening presentations include Securing the Kids and Securing the Human.

--SANS London 2012 London, UK November 26-zdecember 3, 2012
17 courses.

--Looking for training in your own community?

--Save on On-Demand training (30 full courses) - See samples at

Plus Melbourne, Dubai, San Diego, Johannesburg, Seoul, and Tokyo all in the next 90 days.

For a list of all upcoming events, on-line and live: www.sans.org

********************** Sponsored Links: *********************

1) Time is Running Out to take the SANS 2nd Survey on BYOD Security Policy and WIN Cash Prizes!

2) Sign up for the associated part I and part II webcasts and be among the first to receive the results of the survey during a live broadcast with the writer and survey sponsors!
http://www.sans.org/info/112589 and http://www.sans.org/info/112594


Title: CVE-2012-4681 - Java 0-day with no patch being actively exploited in the wild
Description: A new Java vulnerability that allows for remote code execution was released late Sunday night by security researchers, including well-documented, easily modified proof-of-concept code. The vulnerability has since been ported to Metasploit, and trusted sources indicate that it will be rolled into the popular Blackhole exploit kit immediately. The Sourcefire VRT has observed active in-the-wild exploitation already; the nature of the bug makes it trivial to modify the proof-of-concept code to add any weaponized payload of the attacker's choice. No official patch is currently available, and the next scheduled Java patch release is October 16, nearly two months away; an unofficial patch from a security researcher is now available for those who are willing to apply it. Users are urged to disable Java in all untrusted locations wherever possible until the release of an official patch.
Reference: http://vrt-blog.snort.org/2012/08/cve-2012-4681-bypassing-built-in-java.html
Snort SID: 24018-24028, 24036-24038
ClamAV: Java.Exploit.Agent, Java.Exploit.Agent-[1-2], WIN.Trojan.Agent-131

Title: CVE-2012-2109 - HP Operations Agent stack overflow
Description: A remote unauthenticated buffer overflow exists in the HP Operations Agent, a widely deployed cross-platform system for monitoring system health. While no public attacks exist, the Sourcefire VRT has information indicating that private attacks exist and may be deployed in targeted attacks. Users are urged to patch their systems immediately.
Reference: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03397769
Snort SID: 23958 - 23961
ClamAV: N/A

Title: Rebots malware injection campaign
Description: A large injection campaign dubbed "Rebots" after the remote file being included has been active in the wild over the last several weeks, targeting primarily WordPress blogs and other systems that can easily have JavaScript code dropped into them. The campaign has dropped a variety of payloads over time, and is likely to continue cycling through distinct payloads as it evolves.
Reference: http://stopmalvertising.com/malware-reports/rebots.php-malware-robots.txt-executes-malicious-javascript.html
Snort SID: 24017
ClamAV: PHP.Trojan.Rebots

Title: New variants of Zbot emerging in the wild
Description: The Zbot/Zeus banking trojan family has been a popular choice for criminals and fraudsters across the globe since 2010. Its popularity is due in part to the professional support given to purchasers by its developers, who are constantly working to avoid new AV detection techniques. Recent updates to the kit have begun to emerge in the wild across a number of exploits, and users are cautioned to ensure that their AV and IDS solutions are up-to-date to handle this latest variant.
Reference: http://www.symantec.com/security_response/writeup.jsp?docid=2012-082121-3431-99
Snort SID: 23972
ClamAV: Trojan.Zbot-23436


How I cracked my neighbor's WiFi password without breaking a sweat:

All your PostgreSQL databases are belong to us:

Phising by data URI:

Ghosts in the ROM:

DHS investigating Siemens 'flaw' in power plant security:

Cracking passwords from the Phillips hack - an important lesson:

Hotel lock firm's fix for security flaw requires hardware changes for millions of locks:


This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Vendor: Oracle
Description: Oracle Java 7 Update 6, and possibly other versions, allows remote attackers to execute arbitrary code via a crafted applet, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

ID: : CVE-2012-1535
Title: Adobe Flash Player 11.3 Font Parsing Code Execution
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document. CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2011-1255
Title: IE Time Element Memory Corruption Exploit (MS11-050)
Vendor: Microsoft
Description: The Timed Interactive Multimedia Extensions (aka HTML+TIME) implementation in Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Time Element Memory Corruption Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2001-0198
Title: Apple Quicktime plugin - Windows 4.1.2 (Japanese) Remote
Overflow Vulnerability
Vendor: Apple
Description: Buffer overflow in QuickTime Player plugin 4.1.2 (Japanese) allows remote attackers to execute arbitrary commands via a long HREF parameter in an EMBED tag.
CVSS v2 Base Score: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C) (legend)

ID: : CVE-2012-3951
Title: Scrutinizer NetFlow and sFlow Analyzer 9 Default MySQL Credential
Vendor: Plixer
Description: The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

MOST POPULAR MALWARE FILES 8/22/2012 - 8/29/2012:

SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Malwr: http://malwr.com/analysis/923c4d13bee966654f4fe4a8945af0ae
Typical Filename: oeee.exe
Claimed Product: oeee.exe
Claimed Publisher: oeee.exe

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Malwr: http://malwr.com/analysis/25aa9bb549ecc7bb6100f8d179452508
Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Malwr: http://malwr.com/analysis/3291e1603715c47a23b60a8bf2ca73db
Typical Filename: avz00001.dta
Claimed Product: avz00001.dta
Claimed Publisher: avz00001.dta

SHA 256: 02DB0F24CF8461FB903C65FAB7A1B5668BB6D912AFD8414D4AE872E97FCAD090
MD5: 64645e81435058738c137a67df84a5c5
VirusTotal: https://www.virustotal.com/file/02DB0F24CF8461FB903C65FAB7A1B5668BB6D912AFD8414D4AE872E97FCAD090/analysis/
Malwr: http://malwr.com/analysis/64645e81435058738c137a67df84a5c5
Typical Filename: 00008.@
Claimed Product: Bitcoin Miner
Claimed Publisher: Ufasoft

SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Malwr: http://malwr.com/analysis/bf31a8d79f704f488e3dbcb6eea3b3e3
Typical Filename: test.sys
Claimed Product: test.sys
Claimed Publisher: test.sys


(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account