iPad Air 2, Samsung Galaxy Tab A, or $350 Off with SANS Online Training Right Now!

Newsletters: @RISK


@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

November 1, 2012
=============================================================

@RISK: The Consensus Security Vulnerability Alert

Vol. 12, Num. 44

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.

=============================================================

CONTENTS:

NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST POPULAR MALWARE FILES 10/25/2012 - 11/1/2012
============================================================

TOP VULNERABILITY THIS WEEK: Yahoo released a formal policy statement this week rebuffing Microsoft's choice to enable Do Not Track by default in Internet Explorer 10. The move, which they said was due to standardization problems and a need to customize their users' experience on their web properties, is certain to have important ramifications for privacy on the Internet going forward.

****************** Sponsored By UPPER SANS ******************

Take the SANS Survey on Application Security Policies in Enterprises! Help shape the industry and be entered to win a $300 American Express Card.
http://www.sans.org/info/116242

============================================================

TRAINING UPDATE

--SANS Sydney 2012 Sydney, Australia November 12-20, 2012
5 courses. Special Event evening bonus session: I've Been Geo-Stalked! Now What?
http://www.sans.org/event/sydney-2012

--SANS San Diego 2012 San Diego, CA November 12-17, 2012
7 courses. Bonus evening presentations include Cloud Computing and the 20 Critical Security Controls; and Practical, Efficient Unix Auditing (with Scripts).
http://www.sans.org/event/san-diego-2012

--SANS London 2012 London November 26-December 3, 2012
16 courses.
http://www.sans.org/london-2012/

--SANS Cyber Defense Initiative 2012 Washington, DC December 7-16, 2012
27 courses. Bonus evening presentations include Gamification: Hacking Your Brain for Better Learning; Building a Portable Private Cloud; and Tactical SecOps: A Guide to precision Security Operations.
http://www.sans.org/event/cyber-defense-initiative-2012

--SANS Security East 2013 New Orleans, LA January 16-23, 2013
11 courses. Bonus evening presentations include The Next Wave - Data Center Consolidation; Top Threats to Cloud for 2013; and Hacking Your Friends and Neighbors for Fun.
http://www.sans.org/event/security-east-2013

--North American SCADA and Process Control Summit 2013 Lake Buena Vista, FL February 6-13, 2013
The Summit brings together the program managers, control systems engineers, IT security professionals and critical infrastructure protection specialists from asset owning and operating organizations along with control systems and security vendors who have innovative solutions for improving security. The Security Summit is an action conference designed so that every attendee leaves with new tools and techniques they can put to work immediately when they return to their office. The Summit is the place to come and interact with top SCADA experts, key government personnel, researchers and asset owners at the multiple special networking events.
http://www.sans.org/event/north-american-scada-2013

- - --Looking for training in your own community?
http://www.sans.org/community/

- - --Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus Seoul, Tokyo, Barcelona, and Cairo all in the next 90 days.
For a list of all upcoming events, on-line and live: www.sans.org

********************* Sponsored Links: *********************

1) SANS Webcast: Blind as a Bat? Or Eagle Vision Into Encrypted Packets?
With Dave Shackleford & Tony Zirnoon. Nov 5, 2012.
http://www.sans.org/info/116247

2) SANS Webcast: Why Deception Matters in Today's Web Attacks. With John Bumgarner & David Koretz. Nov 8, 2012.
http://www.sans.org/info/116252

3) Take the SANS Survey on the Security Practices of SCADA System Operators and register to win an iPad!
http://www.sans.org/info/116257

============================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Yahoo, Microsoft spar over default Do Not Track
Description: In an effort to boost privacy on the web, Microsoft has enabled Do Not Track features by default in Internet Explorer 10, the browser it recently released as part of Windows 8. Citing a need to customize the user experience and a lack of standardization, however, Yahoo - still one of the largest properties on the Web, despite recently declining market share - announced this week that it will not honor that setting. Privacy advocates are abuzz discussing the implications of the decision, which is certain to spark an impassioned discussion of the balance between privacy and user experience on the modern Internet.
Reference:
http://www.ypolicyblog.com/policyblog/2012/10/26/dnt/
http://windows.microsoft.com/is-IS/internet-explorer/ie10-consumer-preview-privacy-statement
Snort SID: N/A
ClamAV: N/A

Title: Samsung Kies device remote code execution
Description: The Samsung Kies - a new tablet device hailed as a unified digital media center - is prone to multiple remote code execution vulnerabilities, which can be exploited simply by executing portions of its native API; attacks are presumed to exist in the wild, as Samsung's own documentation shows how to run arbitrary files from untrusted sources on the Internet. This vulnerability serves as an excellent reminder of the difficulty of securing environments with BYOD policies, as many mobile devices barely even attempt security as an afterthought.
Reference: http://www.securityfocus.com/archive/1/524434
Snort SID: 24525 - 24528
ClamAV: N/A

Title: Avaya IP Office Call Center arbitrary command execution
Description: The Avaya IP Office Call Center's wallboard application allows unauthenticated attackers to upload arbitrary files, and then execute them with the permissions of the web server with a call to a single URL. Attacks are presumed to exist in the wild due to the trivial nature of exploitation.
Reference: https://downloads.avaya.com/css/P8/documents/100164021
Snort SID: 24520
ClamAV: N/A

============================================================
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

Deep inside a DNS amplification DDoS attack:
http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack

Unpacking dymanically allocated code:
http://blog.crowdstrike.com/2012/10/unpacking-dynamically-allocated-code.html

Ghost in the drone:
http://www.f-secure.com/weblog/archives/00002448.html

Introducing the USB stick of death:
http://j00ru.vexillium.org/?p=1272

Hacker steals over 75% of South Carolina's Social Security numbers:
http://rt.com/usa/news/hacker-south-carolina-social-security-credit-400/

Demystifying Dot NET Reverse-Engineering:
http://resources.infosecinstitute.com/demystifying-dot-net-reverse-engineering-part-1-big-introduction/

New Blackhole Exploit Kit 2 actor spreads Zbot and P2P sets:
http://malwaremustdie.blogspot.jp/2012/10/the-crusaders-note-new-bhek2-actor.html

=========================================================
RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM.

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: : CVE-2012-0507
Title: Oracle Java SE Remote Java Runtime Environment Code Execution Vulnerability
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-4969
Title: Microsoft Internet Explorer 7/8/9 contain a use-after-free vulnerability
Vendor: Microsoft
Description: Microsoft Internet Explorer versions 7, 8, and 9 are susceptible to a use-after-free vulnerability that may result in remote code execution.
CVSS v2 Base Score: 9.7 (AV:N/AC:L/Au:N/C:C/I:C/A:P)

ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Vendor: Oracle
Description: Oracle Java 7 Update 6, and possibly other versions, allows remote attackers to execute arbitrary code via a crafted applet, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

ID: : CVE-2012-3137
Title: Oracle Database Password Information Disclosure Vulnerability
Vendor: Oracle
Description: The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability."
CVSS v2 Base Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)

ID: : CVE-2012-2019
Title: HP Operations Agent Opcode coda.exe 0x34 Buffer Overflow
Vendor: HP
Description: Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1325.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

=========================================================
MOST POPULAR MALWARE FILES 10/25/2012 - 11/1/2012:
COMPILED BY SOURCEFIRE

SHA 256: B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96
MD5: 573b6cc513e1b7cd9e35b491eacc38f3
VirusTotal: https://www.virustotal.com/file/B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96/analysis/
Typical Filename: winugbwf.exe
Claimed Product: winugbwf.exe
Claimed Publisher: winugbwf.exe

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: