Online Training Special Offer: iPad Air w/ Smart KB, Surface Go, or $300 Off

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure

@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

July 18, 2013

@RISK: The Consensus Security Vulnerability Alert

Vol. 13, Num. 29

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.




TOP VULNERABILITY THIS WEEK: For the second week in a row, a fundamental flaw has been found across versions of the Android operating system that would allow for malicious code to be inserted into an APK without disturbing the file's cryptographic signature during verification. While this new bug is somewhat more limited in scope, due to size constraints on the malicious code imposed by the nature of the bug, it still poses a serious threat to users obtaining apps from outside of known-clean marketplaces. Google has pushed a patch to the field already, though OEMs at this time are not yet distributing it to their customers.

******************** Sponsored By SANS *********************

Closing the Mac Security Gap in your Enterprise. Mac laptops and desktops are more widely deployed in enterprises than ever before. This growth, combined with the recent surge of attacks targeting Macs and the insufficient security solutions available on the market, has left organizations with a giant enterprise security gap. Attend this webcast and learn more



- -- Industrial Control System (ICS) Security Training In-depth, hands-on technical courses taught by top SCADA experts. Gain the most current information regarding SCADA and Control System threats and learn how to best prepare to defend against them. Leave the event with solutions that you can immediately put to use in your organization.

--Washington, DC (August 12-August 16)

- -- SANS Rocky Mountain 2013 Denver, CO July 14-20, 2013 10 courses. Bonus evening sessions include OODA - The Secret to Effective Security in Any Environment; and APT: It is Not Time to Pray, It is Time to Act.

- -- SANS San Francisco 2013 San Francisco, CA July 29-August 3, 2013
7 courses. Bonus evening sessions include Offensive Digital Forensics; and Base64 Can Get You Pwned!

- -- SANS Boston 2013 Boston, MA August 5-10, 2013
9 courses. Bonus evening sessions include Cloud R and Forensics; and You Can Panic Now. Host Protection is (Mostly) Dead.

- -- SANS Virginia Beach 2013 Virginia Beach, VA August 19-30, 2013
10 courses. Bonus evening presentations include Thanks for Recovering ... Now I Can Hack You!; Everything I Know is Wrong!; and APT: It is Time to Act.

- -- SANS Capital City 2013 Washington, DC September 3-8, 2013
6 courses. Bonus evening presentations include Look Ma, No Exploits! - The Recon-ng Framework; and How the West was Pwned. Keynote address: Who's Watching the Watchers?

- -- SANS Network Security 2013 Las Vegas, NV September 14-23, 2013
50 courses. Bonus evening presentations include The Security Impact of IPv6; Unleashing the Dogs of (cyber) War; and InfoSec Vertigo: Small Medical Lab Wages War Against InfoSec Vendor, US Government, and Big DC Law Firm.

- -- SANS London Summer 2013 London, UK July 9-July 16, 2013
4 courses. SANS has added a new London date to the security-training calendar, giving security professionals the opportunity to take one of four of SANS' most popular 6-day courses and the excellent 2 day Securing The Human course.

- -- SANS Mumbai 2013 Mumbai, India July 22-27, 2013
Our two most popular security courses that will get you started on your security career - SEC 401 Security Essentials Bootcamp Style and SEC504: Hacker Techniques, Exploits & Incident Handling.

- -- SANS Forensics Prague 2013Prague, Czech RepublicOctober 6-13 2013
SANS's European forensics summit and dedicated forensics training event. Four of SANS's most important forensics training courses and opportunities to network with leading digital forensics experts.

- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013
SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach.

- -- Multi-week Live SANS training

- -- Looking for training in your own community?

- --Save on On-Demand training (30 full courses) - See samples at

Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live:

********************** Sponsored Links: ********************

Tool Talk Webcast: Security Visibility in Under An Hour with AlienVault USM - featuring Christopher Meile - Thursday, July 25, 2013 at 1:00 PM EDT.


Title: Second Android flaw allows code modification without signature tampering
Description: Researchers in China have discovered a new bug in the processing of APK files, which allows attackers to store up to 65,533 bytes worth of uncompressed malicious DEX code inside of a package without altering its cryptographic signature. Specifically, the problem revolves around whether a given field in the APK structure is treated as signed or unsigned, with malicious packages using very large unsigned values to trick the verifier code used while loading the file. Google has already made patches available for the issue, but the time to distribution of the patch through OEMs could be significant based on past experience. Concerned users should, as usual, stick to official markets when installing applications.
Snort SID: N/A
ClamAV: BC.Exploit.Andr_Extra_Field

Title: Cryptocat warns users of message compromise
Description: The popular encrypted IM system Cryptocat warned its users recently of a compromise in their encryption algorithm, and is telling them to treat all conversations between October 17, 2011 and June 15, 2013 as having been conducted in cleartext. The compromise stemmed not from tampering with the source or any centralized intrusion, but instead from bugs that left encryption keys small enough as to render them easily crackable. Patched versions are now available, and users are encouraged to update their software immediately.
Snort SID: N/A ClamAV: N/A

Title: Mac malware signed with Apple Developer ID, uses RTL trick
Description: Coming on the heels of malware discovered earlier this year at the Oslo Freedom Forum, a new piece of Mac malware signed by a valid Apple Developer ID has been found in the wild by Finnish security firm F-Secure. This new treat, dubbed Janicab, also takes advantage of the Unicode Right-to-Left text marker in order to obfuscate the name of the file, in an attempt to social engineer its way onto user systems.
Snort SID: 27228
ClamAV: OSX.Trojan.Janicab

Title: ColdFusion bugs could result in DOS, remote code execution
Description: Adobe released patches last week for two new vulnerabilities in its popular ColdFusion web service software. While public information on the bugs is scarce, research conducted by Sourcefire indicates that both vulnerabilities are relatively simple to exploit, and system administrators should operate under the assumption that exploits will be emerging in the wild soon when weighing patching policies.
Snort SID: 27224, 27225
ClamAV: N/A


A look at point-of-sale RAM scraper and how it works:

Androrat - Android remote access tool:

Alice in Warningland: A large-scale field study of browser security warning effectiveness:

Researchers hack Verizon device, turn it into mobile spy station:

New FTP-based proxy application spotted in the wild:

The Carberp malware: an overview:

Hacking through a straw (pivoting over DNS):

Dealing with UPX packed executables:

Brute force attack Xbox 360 parental controls:


This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: CVE-2013-3163
Title: Microsoft Internet Explorer CBlockElement Use-after-Free Vulnerability
Vendor: Microsoft
Description: Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and CVE-2013-3151.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3660
Title: Microsoft Windows "win32k!EPATHOBJ::pprFlattenRec" Privilege Escalation Vulnerability
Description: The EPATHOBJ::pprFlattenRec function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls.
CVSS v2 Base Score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2688
Title: QNX Phrelay Buffer Overflow Vulnerability
Vendor: QNX Software Systems Ltd
Description: Remote exploitation of a buffer overflow vulnerability in QNX Software Systems Ltd.'s Phrelay could allow attackers to execute arbitrary code on the targeted host.
CVSS v2 Base Score: 5.4 (AV:N/AC:H/Au:N/C:N/I:N/A:C)

ID: CVE-2013-2687
Title: QNX Multiple Products "bpe_decompress" Stack-based Buffer
Overflow Vulnerability
Vendor: QNX Software Systems Ltd
Description: Remote exploitation of a buffer overflow vulnerability in QNX Software Systems Ltd.'s multiple products could allow attackers to execute arbitrary code on the targeted host.
CVSS v2 Base Score: 7.3 (AV:N/AC:L/Au:N/C:N/I:N/A:C)

ID: CVE-2013-2460
Title: Java Applet ProviderSkeleton Insecure Invoke Method
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tracing component.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2012-1533
Title: Java Web Start Double Quote Injection Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)


SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
Typical Filename: C8A787C22000AE378610003396E67500D587FA4E.exe
Claimed Product: My Web Search Bar for Internet Explorer and FireFox
Claimed Publisher:

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
Typical Filename:
Claimed Product:
Claimed Publisher:

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
Typical Filename: avz00001.dta
Claimed Product: avz00001.dta
Claimed Publisher: avz00001.dta

SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
Typical Filename: winoaox.exe
Claimed Product: winoaox.exe
Claimed Publisher: winoaox.exe

SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
Typical Filename: bf31a8d79f704f488e3dbcb6eea3b3e3
Claimed Product: bf31a8d79f704f488e3dbcb6eea3b3e3
Claimed Publisher: bf31a8d79f704f488e3dbcb6eea3b3e3


(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit