@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data
A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.October 11, 2012
@RISK: The Consensus Security Vulnerability Alert
Vol. 12, Num. 41
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.=============================================================
TOP VULNERABILITY THIS WEEK: The US House of Representatives Intelligence Commitee urged American companies on Monday to stop doing business with Huawei Technologies and ZTE Corp citing fears that China could use their equipment to engage in espionage.********************* Sponsored By SANS ********************
Take the SANS Survey on Application Security Policies in Enterprises!
Help shape the industry and be entered to win a $300 American Express
- --SANS Seattle 2012 Seattle, WA October 14-19, 2012
5 courses. Bonus evening presentations include What's New in Windows 8 and Server 2012?; Assessing Deception; and Linux Forensics for Non-Linux Folks.
- --SANS Baltimore 2012 Baltimore, MD October 15-20, 2012
6 courses. Bonus evening presentations include Infosec Rock Star: How to be a More Effective Security Professional.
- --SANS Chicago 2012 Chicago, IL October 27-November 5, 2012
9 courses. Bonus evening presentations include Securing the Kids and Securing the Human.
- --SANS Sydney 2012 Sydney, Australia November 12-20, 2012
- --SANS San Diego 2012 San Diego, CA November 12-17, 2012
7 courses. Bonus evening presentations include Cloud Computing and the 20 Critical Security Controls; and Practical, Efficient Unix Auditing (with Scripts).
- --SANS London 2012 London November 26-December 3, 2012
- --SANS Cyber Defense Initiative 2012 Washington, DC December 7-16, 2012
28 courses. Bonus evening presentations include Gamification: Hacking Your Brain for Better Learning; Building a Portable Private Cloud; and Tactical SecOps: A Guide to precision Security Operations.
- --Looking for training in your own community?
- --Save on On-Demand training (30 full courses) - See samples at
Plus Dubai, Bangalore, Johannesburg, Seoul, Tokyo, and Barcelona all
in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM
Title: Huawei and ZTE labeled cyberthreats by US House of
Representatives Intelligence Commitee
Description: The US House of Representatives' Intelligence Commitee urged American companies on Monday to stop doing business with Huawei Technologies and ZTE Corp citing fears that China could use their equipment to engage in espionage. China has called the accusations baseless and said that that the report "is merely based on subjective conjecture and untrue foundations."
Back in 2008, Huawei's attempt to buy a major stake in 3Com Corp. was blocked by the US government citing security concerns. Huawei is one of the largest telecom gear suppliers in the world.
Snort SID: N/A
Title: DDoS attacks against US banks
Description: Over the last two weeks, cyberattacks have disrupted the websites of U.S. banks, including Wells Fargo, U.S. Bank, PNC Bank, Bank of America and JPMorgan Chase. While a group called "Cyber fighters of Izz ad-din Al qassam" has claimed credit, citing outrage over the same controversial film that has caused riots throughout the Arab world, US officials including Senator Joe Lieberman have insinuated that Iran is actually sponsoring the attacks, questioning the ability of a group of activists to take down major corporations. The Sourcefire VRT has intelligence indicating that the attacks, wherever their origin, are using a script dubbed "itsoknoproblembro" (so called because of a status message it displays), which originally surfaced on PasteBin in January of this year.
Snort SID: Rate-based preprocessor
Title: Even more attacks against US banks
Description: According to security firm RSA and based on their analysis of "underground chatter", an international group of cybercriminals is plotting a campaign to steal money from online accounts of thousands of consumers at over 30 major U.S. banks. The gang is allegedly in process of recruiting 100 botmasters who would each be responsible for the control of bots similar to the Trojan "Gozi". Each botmasters will be financially backed by an investor in order to acquire the hardware and software necessary to conduct the attacks. This could end up being the largest coordinated attack on U.S. financial institutions to date.
Snort SID: -
Exploiting a MIPS stack based buffer overflow
Spear phishing in action
Virus Bulletin 2012 presentation slides
Metasploit and PowerShell payloads:
Dissecting "Operation Ababil"
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.
This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.
ID: : CVE-2012-0507
Title: Oracle Java SE Remote Java Runtime Environment Code Execution Vulnerability
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-4969
Title: Microsoft Internet Explorer 7/8/9 contain a use-after-free vulnerability
Description: Microsoft Internet Explorer versions 7, 8, and 9 are susceptible to a use-after-free vulnerability that may result in remote code execution.
CVSS v2 Base Score: 9.7 (AV:N/AC:L/Au:N/C:C/I:C/A:P)
ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Description: Oracle Java 7 Update 6, and possibly other versions, allows remote attackers to execute arbitrary code via a crafted applet, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
ID: : CVE-2012-1535
Title: Adobe Flash Player 11.3 Font Parsing Code Execution
Description: Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 184.108.40.206 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)
ID: : CVE-2012-3579
Title: Symantec Messaging Gateway SSH Default Password Security Bypass Vulnerability
Description: Symantec Messaging Gateway before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session.
CVSS v2 Base Score: 7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C)
SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
Typical Filename: activator.exe.xxx
Claimed Product: activator.exe.xxx
Claimed Publisher: activator.exe.xxx
SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
Typical Filename: winhsebb.exe
Claimed Product: winhsebb.exe
Claimed Publisher: winhsebb.exe
SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
Typical Filename: 123
Claimed Product: 123
Claimed Publisher: 123
(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit https://www.sans.org/account