Get an 11" iPad Pro, Surface Go 2, or $300 Off with OnDemand Training

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure

@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

October 3, 2013

@RISK: The Consensus Security Vulnerability Alert

Vol. 13, Num. 40

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.



MOST PREVALENT MALWARE FILES 9/24/2013 - 10/1/2013

TOP VULNERABILITY THIS WEEK: A serious, long-term intrusion into several large data brokers was unveiled this week by independent security reporter Brian Krebs, who identified these breaches as the source of data for identity theft service SSNDOB. The compromises, which are still being investigated, are likely to have led to the disclosure of personal information on millions of Americans.

******************** Sponsored By Bit9 *********************

WHITEPAPER: Despite the fact that today's IT security threats have advanced across a spectrum of sophistication and scale, defenses continue to fail with alarming consistency. The evolution of defense has produced fragmentation among security tools. The gap between network security technologies and defenses on endpoints and servers is a particularly pointed example. Learn More



- -- Securing the Internet of Things Summit (October 17-22, 2013) San Francisco, CA
The Internet of Things summit focuses on new solutions, demonstrates security technology that already works and provides a force multiplier to make the Internet of Things more secure.

- -- Health Care Cyber Security Summit (October 17-24, 2013) San Francisco, CA Meet leaders from the top health care organizations and see what really works in securing and succeeding in the new health care environment - balance security, compliance, and innovation.

-- SANS Seattle 2013 Seattle, WA October 7-14, 2013
8 courses. Bonus evening presentations include "So What?" The Most Important Question in Information Security; Why Our Defenses are Failing Us. One Click is All it Takes ...; and Sick Anti-Analysis Mechanisms in the Wild.

- -- SANS Baltimore 2013 Baltimore, MD October 14-19, 2013
9 courses. Bonus evening presentations include An Introduction to PowerShell for Security Assessments; The Security Impact of IPv6; and Tales from the Crypt: TrueCrypt Analysis.

--SANS Chicago 2013 Chicago, ILOctober 28-November 2, 2013
7 courses. Bonus evening presentations include SANS 8 Mobile Device Security Steps; and Privileged Domain Account Protection: How to Limit Credentials Exposure.

- -- SANS Forensics Prague 2013Prague, Czech RepublicOctober 6-13 2013
SANS's European forensics summit and dedicated forensics training event. Four of SANS's most important forensics training courses and opportunities to network with leading digital forensics experts.

- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013
SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach.

- -- SANS London 2013 London, UKNovember 16-25, 2013
17 courses. Bonus evening presentations include Real World Risk - What Incident Responders Can Leverage From IT Operations; Information Assurance Metrics: Practical Steps to Measurement; and APT: It Is Time To Act.

- -- Multi-week Live SANS training

- -- Looking for training in your own community?

- --Save on On-Demand training (30 full courses) - See samples at

Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live:

********************** Sponsored Links: ********************

1) Tools and Techniques Survey Results, Thursday, Oct. 3 at 1 PM EDT:

2) Looking for 20 Critical Security Controls or Security Leadership Essentials Training in San Francisco? Register today

3) Ask The Expert Webcast: Take Control! 7 Steps to Prioritize Your Security Program - Wednesday, October 16 at 1:00 PM EDT. John Pescatore and Matt Hathaway.


Title: Identity theft service discovered breaking into several data brokers
Description: Independent security reporter Brian Krebs last week broke the news last week that the notorious underground identity theft service SSNDOB had gained access to several major personal and business data aggregation services, including Lexis/Nexis and Dun & Bradstreet. The intrusions, which were ongoing for at least several months, used malware that exfiltrated data via an encrypted channel to attacker-controlled systems. Investigations by the impacted firms are ongoing, but the scope of the damage is expected to be extremely widespread.
Snort SID: 28085

Title: Rapid7, University of Michigan release unprecedented scan data
Description: A collaboration between the creators of Metasploit and the University of Michigan last week is providing security researchers with massive data sets collected through responsible, detailed scanning of large sections of the Internet. The project, which aims to expose poor security practices and help clear up issues such as the 10,000 root shells available via Telnet found during the scans, is so far receiving positive reviews from other researchers, and is likely to grow in scope as others use the data provided by the project.
Snort SID: N/A
ClamAV: N/A

Title: Linksys WRT110 router remote command execution
Description: A trivially exploitable remote command execution vulnerability, initially disclosed in July, had a Metasploit module released last week, dramatically increasing the likelihood of widespread exploitation in the wild. The bug, which likely applies to other related firmware sets, can be exploited via the web without authentication. No patches are available at this time.
Snort SID: 28052
ClamAV: N/A


Resources for getting started with iOS hacking:

CVE-2013-3122: from null to control - persistence pays off with crashes:

- From Russia with love.exe - the Russian underground hacking culture:

Large-scale detection of DOM-based XSS:

Delivering an executable without an executable:

CVE-2013-0640: Adobe Reader XFA oneOfChild uninitialized memory vulnerability:

Blind SQLi -> SQLi -> Command execution -> Meterpreter - based on a true story: JavaScript execution:

OSX/Leverage.a analysis:

Analysis of the FBI Tor malware:


This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: CVE-2013-3576
Title: HP System Management Homepage "" Command Injection Vulnerability
Vendor: HP
Description: in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the PATH_INFO to smhutil/snmpchp.php.en.
CVSS v2 Base Score: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)

ID: CVE-2013-3205
Title: Microsoft Internet Explorer CCaret Use-After-Free (MS13-069)
Vendor: Microsoft
Description: Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-0810
Title: Microsoft Windows Theme File Handling Arbitrary Code Execution (MS13-071)
Vendor: Microsoft
Description: Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary code via a crafted screensaver in a theme file, aka "Windows Theme File Remote Code Execution Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: Not Available
Title: Joomla! Unauthorised Uploads
Vendor: Joomla!
Description: Inadequate filtering leads to the ability to bypass file type upload restrictions.
Affects Joomla! version 2.5.13 and earlier 2.5.x versions; and version 3.1.4 and earlier 3.x versions.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 9/24/2013 - 10/1/2013

SHA 256: 055788EB475E7AC5EA2E03383D3F95BCC88D62F06E4456A5F5DD6B9E78506AB5
MD5: 12336775941D49CE6A4D6F391CB5E02F

Typical Filename: WebCakeDesktop.exe
Claimed Product: WebCake Desktop
Claimed Publisher: Web Cake

SHA 256: 6090C85CF5750E141F2BD6D2334EC0EB79188E2DE05DE06235726E73C0B0D792
MD5: 2ebbe2521176388c7bc5365e197bf801

Typical Filename: -
Claimed Product: Application Manager
Claimed Publisher: MediaTechSoft Inc.

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508

Typical Filename: -
Claimed Product: -
Claimed Publisher: -

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db

Typical Filename: 01.tmp
Claimed Product: -
Claimed Publisher: -

SHA 256: F09AFC177AFBC8E2D36A57D105D3F79A70EC2E36701C9759E19D54A009279F11
MD5: 3b7a992ae53ebb41dd1e566e4172e9c0

Typical Filename: -
Claimed Product: -
Claimed Publisher: -


(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit