SANSFIRE is right around the corner June 13-20 - Live Online, Register today!

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure

@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

November 28, 2012

@RISK: The Consensus Security Vulnerability Alert

Vol. 12, Num. 46

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.



MOST POPULAR MALWARE FILES 11/8/2012 - 11/15/2012

TOP VULNERABILITY THIS WEEK: Microsoft released six bulletins as part of their monthly "Patch Tuesday" release. Some of these are rated critical and all should be patched immediately if possible.

********************* Sponsored By SANS ********************

Analyst Webcast: Security Intelligence in Action: LogRhythm's Advanced Analysis Features by SANS Analyst Dave Shackleford, Wed. Nov.28, 1PM EST.



- --SANS London 2012, London November 26-December 3, 2012
16 courses.

- --SANS Cyber Defense Initiative ® 2012 Washington, DC December 7-16, 2012
27 courses. Bonus evening presentations include Gamification: Hacking Your Brain for Better Learning; Building a Portable Private Cloud; and Tactical SecOps: A Guide to Precision Security Operations.

- --SANS Security East 2013 New Orleans, LA January 16-23, 2013
11 courses. Bonus evening presentations include The Next Wave - Data Center Consolidation; Top Threats to Cloud for 2013; and Hacking Your Friends and Neighbors for Fun. Special Event: NetWars Tournament of Champions.

- --North American SCADA and Process Control Summit 2013 Lake Buena Vista, FL February 6-13, 2013
The Summit brings together the program managers, control systems engineers, IT security professionals and critical infrastructure protection specialists from asset owning and operating organizations along with control systems and security vendors who have innovative solutions for improving security. The Security Summit is an action conference designed so that every attendee leaves with new tools and techniques they can put to work immediately when they return to their office. The Summit is the place to come and interact with top SCADA experts, key government personnel, researchers and asset owners at the multiple special networking events.
8 courses. Bonus evening presentation: The SANS SCADA Dinner Theater Players Present: From Exposure to Closure - Act III.

- --Looking for training in your own community?

- --Save on On-Demand training (30 full courses) - See samples at

Plus San Antonio, Barcelona, Cairo, Anaheim, and New Delhi all in the next 90 days.

For a list of all upcoming events, on-line and live:

********************** Sponsored Links: ********************

1) Take the SANS Survey on the Security Practices of SCADA System
Operators and register to win an iPad!

2) Webcast: APT: It is Not Time to Pray, It is Time to Act Featuring:
Dr. Eric Cole.


Title: Microsoft Patch Tuesday
Description: Six Microsoft Security Bulletins covering 19 CVE and Operating Systems from Windows Server 2003 to the brand new Microsoft Windows 8 and Windows RT. This patch release contains vulnerability patches for Microsoft IIS, Internet Explorer, .NET, Microsoft Office Excel, as well as vulnerabilities in the Windows OS itself.
Snort SID:
ClamAV: HTML.Exploit.CVE_2012_1538, BC.Exploit.CVE_2012_1539,
PUA.Script.CVE_2012_4776, Win.Exploit.CVE_2012_2519,
Win.Exploit.CVE_2012_1895, Win.Exploit.CVE_2012_2897,

Title: Blackhole Exploit Kit changes structure
Description: In the constant fight against Exploit Kits, the Blackhole exploit kit seems to be the one that evolves the most rapidly. The Sourcefire Vulnerability Research Team keeps a close on this and other exploits kits in order to provide the best detection possible. When detection is published for these exploit kits, we place it in the "Exploit-Kit" category. The Blackhole exploit kit, aside from recently evolving into "Version 2", can be in almost any delivery method, email, drive-by web contact, pdf, java, etc. It's highly recommended that the latest Java, Flash, Adobe Reader, and Microsoft be applied, and even go so far as to disable these plugins where possible.
Snort SID: Recent additions: 24636, 24637, 24638
ClamAV: HTML.Trojan.Blackhole*, Java.Trojan.Blackhole*, Win.Trojan.Blackhole*

Title: KaiXin Exploit pack is back
Description: Much like the Blackhole exploit kit, the KaiXin exploit pack can be seen in nearly any delivery method. Heavily obfuscated javascript, Java delivery and attack methods, Flash delivery and attack are hallmarks of this exploit kit. Pay particular attention to this attack method and read the references below.
Snort SID: 24667,24668,24669,24670
ClamAV: Win.Exploit.KaiXin, Win.Exploit.KaiXin-1

Title: New Skype Advisory
Description: '....We have had reports of a new security vulnerability issue. As a precautionary step we have temporarily disabled password reset as we continue to investigate the issue further. We apologize for the inconvenience but user experience and safety is our first priority.....'
Snort SID: N/A
ClamAV: N/A


Infamous Hacker Heading Chinese Antivirus Firm?:

Mac Trojan Targeting Tibet Sympathizers Discovered:

Yes, the FBI and CIA can read your email. Here's how:

Federal agencies, private firms fiercely compete in hiring cyber experts:

Adobe investigates alleged customer data breach:

Websense 2013 Security Predictions report:


This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: : CVE-2012-0507
Title: Oracle Java SE Remote Java Runtime Environment Code Execution Vulnerability
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Vendor: Oracle
Description: Oracle Java 7 Update 6, and possibly other versions, allows remote attackers to execute arbitrary code via a crafted applet, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

ID: : CVE-2012-4501
Title: Citrix CloudStack and CloudPlatform Default Credentials Design Error Vulnerability
Vendor: Citrix
Description: Citrix CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-5076
Title: Java Applet JAX-WS Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-5692
Title: Invision Power Board "unserialize()" PHP Code Execution Vulnerability
Vendor: Invision Power Services
Description: Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 11/8/2012 - 11/15/2012

SHA 256: B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96
MD5: 573b6cc513e1b7cd9e35b491eacc38f3
Typical Filename: winhblmdx.exe
Claimed Product: winhblmdx.exe
Claimed Publisher: winhblmdx.exe

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db VirusTotal:
Typical Filename: 01.tmp
Claimed Product: 01.tmp
Claimed Publisher: 01.tmp

SHA 256: 358289754D01E20D564E39D79124AFA9BED4D35B3BC22F4E09210EC75E6461B2
MD5: b94b0c0efb6f33bddd2f16907a3a9cd1
Typical Filename: unp151145116.tmp
Claimed Product: 7zS.sfx.exe
Claimed Publisher: Mozilla

SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
Typical Filename: test.exe
Claimed Product: none
Claimed Publisher: none


(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit