Get an 11" iPad Pro, Surface Go 2, or $300 Off with OnDemand Training

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.

SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure

@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

October 17, 2013

@RISK: The Consensus Security Vulnerability Alert

Vol. 13, Num. 42

Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked.



MOST PREVALENT MALWARE FILES 9/24/2013 - 10/1/2013

TOP VULNERABILITY THIS WEEK: Vulnerability in Microsoft Internet Explorer 8

******************** Sponsored By Bit9 *********************

47% of surveyed organizations have suffered a cyber-attack in the past year and a frightening 13% say they do not even know if they have been attacked. Download the 2013 Cyber Security Study and gain insight into the latest cyber security trends and how you can stay one step ahead of today's sophisticated attackers.



- -- Securing the Internet of Things Summit (October 17-22, 2013) San Francisco, CA
The Internet of Things summit focuses on new solutions, demonstrates security technology that already works and provides a force multiplier to make the Internet of Things more secure.

- -- Health Care Cyber Security Summit (October 17-24, 2013) San Francisco, CA Meet leaders from the top health care organizations and see what really works in securing and succeeding in the new health care environment - balance security, compliance, and innovation.

- -- SANS Baltimore 2013 Baltimore, MD October 14-19, 2013
9 courses. Bonus evening presentations include An Introduction to PowerShell for Security Assessments; The Security Impact of IPv6; and Tales from the Crypt: TrueCrypt Analysis.

--SANS Chicago 2013 Chicago, ILOctober 28-November 2, 2013
7 courses. Bonus evening presentations include SANS 8 Mobile Device Security Steps; and Privileged Domain Account Protection: How to Limit Credentials Exposure.

- --October Singapore 2013 Singapore, Singapore October 21-November 2, 2013
5 courses. Bonus evening presentations include Pen Testing the Smart Grid; and You Can Panic Now. Host Protection is (Mostly) Dead.

- -- SANS Dubai 2013Dubai, UAEOctober 26th - November 7th 2013
SANS returns to Dubai with four essential courses at the Hilton Jumeirah Beach.

- -- SANS London 2013 London, UKNovember 16-25, 2013
17 courses. Bonus evening presentations include Real World Risk - What Incident Responders Can Leverage From IT Operations; Information Assurance Metrics: Practical Steps to Measurement; and APT: It Is Time To Act.

- -- Multi-week Live SANS training

- -- Looking for training in your own community?

- --Save on On-Demand training (30 full courses) - See samples at

Plus Johannesburg, Abu Dhabi, Seoul, and Bangalore all in the next 90 days. For a list of all upcoming events, on-line and live:

********************** Sponsored Links: ********************

1) Webcast: Six Steps to SIEM Success Friday, October 18 at 1:00 PM EDT with Tom D'Aquino and Sandy Hawke. In this webinar, we'll cover the six key steps every IT practitioner should take to go from installation to insight as quickly as possible with a SIEM solution.

2) Take our BYOD survey and share your influence with other thought leaders; also enter to win a new iPad!

3) Attend the DHS Continuous Diagnostics & Mitigation (CDM) Award Workshop - November 6, 2013.


Title: Secclean fake antivirus
Description: FakeAV continues to be a prevalent threat in the wild surrounding the Microsoft Windows Operating system, typically loaded in the Trojan method.
Snort SID: 28248-28250
ClamAV:Win.Downloader.Seclean, Win.Trojan.Seclean

Title: DLink DIR-100 User-Agent Backdoor
Description: By setting a User-Agent to a specific value, as detailed in the below link, certain DLink devices can be accessed without authorization or security.
Snort SID: 28240
ClamAV: N/A

Title: MS IE cdisplaypointer 0-day metasploit module
Description: This week a Metasploit module released for Microsoft Internet Explorer CVE-2013-3897 was released. This makes a previously not-well-known vulnerability in Microsoft Internet Explorer more available to penetration testers and researchers.
Snort SID: 28091-28092, 28207-28208
ClamAV: BC.Exploit.CVE_2013_3897


Vulnerabilities Discovered in Global Vessel Tracking Systems:

What will the cybersecurity landscape look like in 2020?

"Dexter" malware infects South African restaurants, costs banks millions

SafeSlinger App for mobile devices


This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: Not Available
Title: D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: A remote exploitation of a design error vulnerability in D-Link Systems Inc.'s routers could allow attackers to bypass authentication security restrictions. The router allows any user with a Web browser having the user agent string "xmlset_roodkcableoj28840ybtide" to gain access to the Web interface of the device without the requirement for any authentication credentials. Affects D-Link Firmware v1.13 and other versions may also be affected.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3897
Title: Microsoft Internet Explorer CDisplayPointer Use-After-Free (MS13-080)
Vendor: Microsoft
Description: Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3576
Title: HP System Management Homepage "" Command Injection Vulnerability
Vendor: HP
Description: in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the PATH_INFO to smhutil/snmpchp.php.en.
CVSS v2 Base Score: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)

ID: Not Available
Title: Joomla! Unauthorised Uploads
Vendor: Joomla!
Description: Inadequate filtering leads to the ability to bypass file type upload restrictions. Affects Joomla! version 2.5.13 and earlier 2.5.x versions; and version 3.1.4 and earlier 3.x versions
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2251
Title: Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution
Vendor: Apache
Description: Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 6/11/2013 - 6/18/2013

SHA 256: 6090C85CF5750E141F2BD6D2334EC0EB79188E2DE05DE06235726E73C0B0D792
MD5: 2ebbe2521176388c7bc5365e197bf801

Typical Filename: BitGuard.dll
Claimed Product: Protector
Claimed Publisher: MediaTechSoft Inc.

SHA 256: 440BB8C5BF684C60CA4725FA43DB52EF471E9C7B47834E82B8E2B76656312EDF
MD5: da25422dd2ef0a33bb5725bfe5be1367

Typical Filename: Random
Claimed Product: Trojan.Zeroaccess
Claimed Publisher: None

SHA 256: 1DCAD6AE885A6D24662982290D9CE62DC0C708786025C297E85118236FF61E64
MD5: 3aec103d38c7520229e18af260c5a00d

Typical Filename: (Random)
Claimed Product: Sirefef
Claimed Publisher: None.

SHA 256: A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03
MD5: 8ac1e580cf274b3ca98124580e790706

Typical Filename: Virus.Win32.Sality.ab
Claimed Product: Virus.Win32.Sality.ab
Claimed Publisher: Virus.Win32.Sality.ab

SHA 256: A97BA73A76DF83CA934700B1F3F61851BEEE3A9AF21272323408A4FA3424A64B
MD5: 1ec55311a564f8272d62ccb621a8b513

Typical Filename: Random
Claimed Product: Trojan.Sisron
Claimed Publisher: None.


(c) 2013. All rights reserved. The information contained in this newsletter, including any external links, is provided "AS IS," with no express or implied warranty, for informational purposes only.

Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit