@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.September 27, 2012
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 39
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.=============================================================
TOP VULNERABILITY THIS WEEK: American financial institutions are being targeted for DDoS attacks, with Bank of America having been knocked offline briefly last week. The perpetrators are unknown, with suggestions ranging from political activists to the Iranian government, but data about the attacks is all over PasteBin, from pre-announcements of attacks to the tool being used by the attackers.******************** Sponsored By SANS *********************
Take the SANS Survey on Application Security Policies in Enterprises!
Help shape the industry and be entered to win a $300 American Express
**Featured Conference 1: National Cybersecurity Innovation Conference,
Oct 3-5, Baltimore - featuring briefings by and exhibits all the vendors
that have tools for automating the 20 critical controls and for
continuous monitoring. www.sans.org/ncic-2012
**Featured Conference 2: The IT Security Automation Conference (ITSAC)
Oct 3-5, Baltimore - featuring DHS and other government leaders
providing a clear picture of the changes coming in federal cybersecurity
- - - especially in cloud and continuous monitoring. Not to miss. We try
never to promote conferences where SANS doesn't control the program, but
is an exception because the DHS and NIST folks have done a great job!
- --SANS Forensics Prague 2012 Prague, Czech Republic October 7-13, 2012
6 courses. Bonus evening presentations include Big Brother Forensics:
Location-based Artifacts. http://www.sans.org/forensics-prague-2012/
- --SANS Singapore 2012 Singapore, Singapore October 8-20, 2012
5 courses, including the new Virtualization and Private Cloud Security course, and Advanced Forensics and Incident Response.
Don't miss this opportunity to upgrade your IT skills, work toward your GIAC security certification, and network with other top information security professionals.
- --SANS Seattle 2012 Seattle, WA October 14-19, 2012
5 courses. Bonus evening presentations include What's New in Windows 8 and Server 2012?; Assessing Deception; and Linux Forensics for Non-Linux Folks.
- --SANS Baltimore 2012 Baltimore, MD October 15-20, 2012
6 courses. Bonus evening presentations include Infosec Rock Star: How to be a More Effective Security Professional.
- --SANS Chicago 2012 Chicago, IL October 27-November 5, 2012
9 courses. Bonus evening presentations include Securing the Kids and Securing the Human.
- --SANS Sydney 2012 Sydney, Australia November 12-20, 2012
- --SANS San Diego 2012 San Diego, CA November 12-17, 2012
7 courses. Bonus evening presentations include Cloud Computing and the 20 Critical Security Controls; and Practical, Efficient Unix Auditing (with Scripts).
- --SANS London 2012 London November 26-December 3, 2012
- --SANS Cyber Defense Initiative 2012 Washington, DC December 7-16, 2012
28 courses. Bonus evening presentations include Gamification: Hacking Your Brain for Better Learning; Building a Portable Private Cloud; and Tactical SecOps: A Guide to precision Security Operations.
- --Looking for training in your own community?
- --Save on On-Demand training (30 full courses) - See samples at
Plus Dubai, Bangalore, Johannesburg, Seoul, Tokyo, and Barcelona all
in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Operation Ababil DDoS Campaign
Description: A DDoS campaign against US financial institutions dubbed "Operation Ababil" has been going on since last week, with new attacks announced on PasteBin as of Tuesday. While a group called "Cyber fighters of Izz ad-din Al qassam" has claimed credit, citing outrage over the same controversial film that has caused riots throughout the Arab world, US officials including Senator Joe Lieberman have insinuated that Iran is actually sponsoring the attacks, questioning the ability of a group of activists to take down major corporations such as Bank of America and Chase. The Sourcefire VRT has intelligence indicating that the attacks, wherever their origin, are using a script dubbed "itsoknoproblembro" (so called because of a status message it displays), which originally surfaced on PasteBin in January of this year.
Snort SID: Rate-based preprocessor
Title: Symantec Norton Utilities 2006 source leaked on PirateBay
Description: Actors under the banner of Anonymous posted what they claim to be source code for the Symantec Norton Utilities 2006 security suite on PasteBin this week, along with a message deriding the quality of the code that asked Symantec to quit writing "shitty" software. This is the second time this year that Symantec source code has been leaked; in February, code for pcAnywhere was posted after a failed attempt to extort $50,000 from the company.
Snort SID: N/A
Title: Crimeboss Exploit Kit
Description: A relatively new exploit kit dubbed Crimeboss has recently been observed circulating in the wild, exploiting Java vulnerabilities such as the recently patched 0-day CVE-2012-4681. The kit, which is not particularly novel in terms of obfuscation or deployment, is interesting in that it both gives you the opportunity to install Java if you have not done so already, and also delivers an applet which does not attempt to exploit a vulnerability, but merely asks you to run it instead. In addition, the payloads it drops are disguised as image files, bypassing many web filtering techniques for executables in an attempt to boost its success rates.
Snort SID: 24231 - 24234
Title: CrimeTLS Attack
Description: Security researchers Juliano Rizzo and Thai Duong presented a new way of determining parts of the content of an encrypted message without the need to fully decrypt the message last week at the Ekoparty Security Conference, dubbed the Crime TLS attack. The technique relies on compressed TLS-encrypted data, and revolves around the fact that an attacker who can control a portion of a request will notice a size difference in the compressed data when they have successfully matched their portion of the request with the data that they wish to disclose in the TLS request. While the vulnerability is serious in theory, and has been demonstrated on live systems including Twitter, it can easily be worked around by disabling TLS compression on the client or server side, and as noted by the researchers, only works on around 40% of systems in the wild even without mitigating steps.
Snort SID: N/A
Backdoored PHPMyAdmin distributed on SourceForge:
Mobile Pwn2Own: iPhone 4S hacked by Dutch team
Blackhole 2.0 Hits the Net with New Exploits
Twitter Video Facebook App: Rogue DMs, Fake Flash Umbra Loaders
Bypassing Intel SMEP on Windows 8 x64 Using Return-oriented Programming
Hotmail: Your password was too long, so we fixed it for you
Malware discovered developed with Google's "Go" language:
More samples of recent IE 0-Day appearing in the wild:
How to launch a 65Gbps DDoS, and how to stop one:
Protecting from DoS attacks using web referral architectures for privileged service:
Defeating PatchGuard - bypassing kernel security patch protection in MS Windows:
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: : CVE-2012-4969
Title: Microsoft Internet Explorer 7/8/9 contain a use-after-free vulnerability
Description: Microsoft Internet Explorer versions 7, 8, and 9 are susceptible to a use-after-free vulnerability that may result in remote code execution.
CVSS v2 Base Score: 9.7 (AV:N/AC:L/Au:N/C:C/I:C/A:P)
ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Description: Oracle Java 7 Update 6, and possibly other versions, allows remote attackers to execute arbitrary code via a crafted applet, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
ID: : CVE-2012-1535
Title: Adobe Flash Player 11.3 Font Parsing Code Execution
Description: Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 18.104.22.168 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-3579
Title: Symantec Messaging Gateway SSH Default Password Security Bypass Vulnerability
Description: Symantec Messaging Gateway before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session.
CVSS v2 Base Score: 7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-4577
Title: Korenix Jetport 5600 Series Default Credentials Authentication Bypass Vulnerability
Description: The Linux firmware image on (1) Korenix Jetport 5600 series serial-device servers and (2) ORing Industrial DIN-Rail serial-device servers has a hardcoded password of "password" for the root account, which allows remote attackers to obtain administrative access via an SSH session.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
Typical Filename: file-4435098_exe
Claimed Product: My Web Search Bar for Internet Explorer and FireFox
Claimed Publisher: MyWebSearch.com
SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
Typical Filename: winvbokexe
Claimed Product: winvbokexe
Claimed Publisher: winvbokexe
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
Typical Filename: avz00001.dta
Claimed Product: avz00001.dta
Claimed Publisher: avz00001.dta
SHA 256: 1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442
Typical Filename: MWSSVC.EXE
Claimed Product: My Web Search Bar
Claimed Publisher: MyWebSearch.com
SHA 256: 02DB0F24CF8461FB903C65FAB7A1B5668BB6D912AFD8414D4AE872E97FCAD090
Typical Filename: 00008.@
Claimed Product: Bitcoin Miner
Claimed Publisher: Ufasoft
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account