One More Day to Get a MacBook Air, Surface Pro 7, or $350 Off with OnDemand Training

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure

@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

December 31, 2012

@RISK: The Consensus Security Vulnerability Alert

Vol. 12, Num. 53

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.



MOST POPULAR MALWARE FILES 12/27/2012 - 1/2/2013

TOP VULNERABILITY THIS WEEK: A major new Internet Explorer 0-day attack was released last week, with live exploits occurring heavily in the wild. Microsoft has not yet issued guidance on whether it will move forward with an out-of-band patch; impacted users are advised to deploy ancillary protection such as IDS or AV in the meantime.



- --SANS Security East 2013 New Orleans, LA January 16-23, 2013
11 courses. Bonus evening presentations include The Next Wave - Data Center Consolidation; Top Threats to Cloud for 2013; and Hacking Your Friends and Neighbors for Fun. Special Event: NetWars Tournament of Champions.

- --North American Industrial Controls Systems and SCADA Summit 2013
Lake Buena Vista, FL February 6-13, 2013
The only technical security and training program in ICS security - for program managers, control systems engineers, IT security professionals and critical infrastructure protection specialists from asset owning and operating organizations along with control systems and security vendors who have innovative solutions for improving security. Every attendee leaves with new tools and techniques they can put to work immediately. 8 courses. Bonus evening presentation: The SANS SCADA Dinner Theater Players Present: From Exposure to Closure - Act III.

- --SANS Secure Singapore 2013 February 25-March 2, 2013
6 courses. Bonus evening presentation: Security of National eID (smartcard-based) Web Applications.

- --SANS 2013 Orlando, FL March 8-March 15, 2013
46 courses. Bonus evening presentations include Why Our Defenses Are Failing Us: One Click Is All It Takes ...; Human Nature and Information Security: Irrational and Extraneous Factors That Matter; and Over-Zealous Social Media Investigations: Beware the Privacy Monster.

- --SANS Monterey 2013 Monterey, CA March 22-March 27, 2013
7 courses. Bonus evening presentations include Base64 Can Get You Pwned!; and The 13 Absolute Truths of Security.

- --Looking for training in your own community?

- --Save on On-Demand training (30 full courses) - See samples at

Plus Anaheim, New Delhi, Scottsdale, Brussels, Johannesburg, and Canberra all in the next 90 days.

For a list of all upcoming events, on-line and live:

********************** Sponsored Links: ********************

1) NEW paper in the SANS reading room: SANS Survey on Application Security Policies in Enterprises

Associated webcast featuring SANS Analyst Frank Kim:


Title: Internet Explorer 0-day released
Description: A new Internet Explorer remote code execution vulnerability was discovered last week after the Council on Foreign Relations' web site was shown to be compromised and serving up malicious code. Many live exploit campaigns are currently operating in the wild using this attack, which has a great deal of proof-of-concept code available, including a Metasploit module. Microsoft is investigating whether it will issue an out-of-band patch or wait until the January 8 patch cycle to release an update resolving this vulnerability. Impacted users are urged to deploy all other available protections in the interim.
Snort SID: 25124 - 25134
ClamAV: JS.Exploit.CVE_2012_4792

Title: GPU-accelerated Gauss encryption cracker released
Description: State-sponsored malware Gauss, which caused serious waves in the information security community in 2012, included an encrypted payload, which no one has yet publicly cracked. However, a new tool is available to take advantage of GPU hardware when attempting to break the encryption, dramatically increasing the speed at which people can attempt to crack it. A breakthrough here could have major implications for defenders and attackers alike in 2013.
Snort SID: N/A
ClamAV: N/A

Title: Activist group MalwareMustDie starts new takedown project
Description: A relatively new analyst group known as "Malware Must Die", who have published a series of in-depth articles on current threats in the wild on their web site since they organized in August, have started a new domain takedown project, in which they work with legal authorities to destroy malicious domain names they find in the course of their work. This project, similar to others in the sphere, differs primarily in that the group is for now giving away a list of domains they are killing, as indicators organizations can use to find and clean infections. Those who might be able to assist them are urged to contact them directly.
Snort SID: 15168, 25141 - 25223
ClamAV: N/A


Running code from a non-elevated account at any time:

Username anarchy: version 2 released:

Outmaneuvered at their own game, antivirus makers struggle to adapt:

Getting terminal access to a Cisco Linksys E-100:

Controlling Cuckoo Sandbox from C#:

How I got a $3,500 USD Facebook bug bounty:

Hello Mach-O:

Malware analysis #1 protip:


This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: : CVE-2012-4792
Title: Microsoft Internet Explorer CDwnBindInfo Object Use-After-Free Vulnerability
Vendor: Microsoft
Description: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-2176
Title: IBM Lotus Quickr 8.2 ActiveX Control Buffer Overflow Vulnerability
Vendor: IBM
Description: Multiple stack-based buffer overflows in a certain ActiveX control in in IBM Lotus Quickr 8.2 before for Domino allow remote attackers to execute arbitrary code via a long argument to the (1) Attachment_Times or (2) Import_Times method.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-2175
Title: IBM Lotus iNotes "Attachment_Times" ActiveX Buffer Overflow Vulnerability
Vendor: IBM
Description: Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a long argument.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-2174
Title: IBM Lotus Notes URL Handler Design Error Vulnerability
Vendor: IBM
Description: The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-4959
Title: Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability
Vendor: Novell
Description: Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to upload and execute files via a 130 /FSF/CMD request with a .. (dot dot) in a FILE element of an FSFUI record.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-5975
Title: SSH Tectia Authentication Bypass Remote
Vendor: SSH Communications
Description: A remote authentication bypass vulnerability was disclosed which affects the current Unix/Linux versions of Tectia SSH Server. The vulnerability exploits a bug in the SSH USERAUTH CHANGE REQUEST function.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

MOST POPULAR MALWARE FILES 12/27/2012 - 1/2/2013:

SHA 256: 1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442
MD5: bb74024a1d4e4808562c090980151653

Typical Filename: bb74024a1d4e4808562c090980151653
Claimed Product: My Web Search Bar
Claimed Publisher:

SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae

Typical Filename: uliig.exe
Claimed Product: uliig.exe
Claimed Publisher: uliig.exe

SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff

Typical Filename: 7961a56c11ba303f20f6a59a506693ff
Claimed Product: My Web Search Bar for Internet Explorer and FireFox
Claimed Publisher:

SHA 256: 358289754D01E20D564E39D79124AFA9BED4D35B3BC22F4E09210EC75E6461B2
MD5: b94b0c0efb6f33bddd2f16907a3a9cd1

Typical Filename: virus-2010-10-18-id0018936109
Claimed Product: Firefox
Claimed Publisher: Mozilla

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508

Typical Filename: File_0_2.ok
Claimed Product: File_0_2.ok
Claimed Publisher: File_0_2.ok


(c) 2012. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit