Learn InfoSec skills you can implement immediately! Six courses available in Houston - Oct. 28-Nov. 2.

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.





SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure


@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

July 18, 2019

=============================================================

     @RISK: The Consensus Security Vulnerability Alert

              July 18, 2019 - Vol. 19, Num. 29


Providing a reliable, weekly summary of newly discovered attack vectors,

vulnerabilities with active exploits, and explanations of how recent

attacks worked


Archived issues may be found at http://www.sans.org/newsletters/at-risk


=============================================================


CONTENTS:

NOTABLE RECENT SECURITY ISSUES

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

MOST PREVALENT MALWARE FILES July 11 - 18

============================================================


TOP VULNERABILITY THIS WEEK: High-profile vulnerabilities in Zoom leads to compromise of some Mac cameras


***************** Sponsored By AWS Marketplace *************


AWS Cloud Security Training Webcast. Maximize advanced capabilities in today's cloud-based firewalls to protect workloads in AWS and Amazon's high-performance Elastic Compute Cloud (EC2). Speakers will cover deep filtering, logging, IDS/IPS features, SSO and more key capabilities, and explain how to manage firewalls through AWS CloudFormation, APIs, and independent software vendors. July 25, 2 PM ET.  http://www.sans.org/info/213435


============================================================

TRAINING UPDATE

 

-- SANS Network Security 2019 | Las Vegas, NV | September 9-16 | https://www.sans.org/event/network-security-2019


-- Supply Chain Cybersecurity Summit 2019 | Arlington, VA | August 12-19 | https://www.sans.org/event/supply-chain-cybersecurity-summit-2019


-- SANS Chicago 2019 | August 19-24 | https://www.sans.org/event/chicago-2019


-- SANS Virginia Beach 2019 | August 19-30 | https://www.sans.org/event/virginia-beach-2019


-- SANS London September 2019 | September 23-28 | https://www.sans.org/event/london-september-2019


-- SANS DFIR Europe Summit and Training 2019 | Prague, CZ | September 30-October 6 | https://www.sans.org/event/dfir-prague-2019


-- Threat Hunting & Incident Response Summit 2019 | New Orleans, LA | September 30-October 7 | https://www.sans.org/event/threat-hunting-and-incident-response-summit-2019


-- SANS Tokyo Autumn 2019 | September 30-October 12 | https://www.sans.org/event/tokyo-autumn-2019


-- SANS October Singapore 2019 | October 7-26 | https://www.sans.org/event/october-singapore-2019


-- SANS OnDemand and vLive Training

Get an iPad Pro with Smart Keyboard, HP ProBook, or Take $350 Off through July 24 with OnDemand or vLive training.

https://www.sans.org/online-security-training/specials/


-- Can't travel? SANS offers online instruction for maximum flexibility

-- Live Daytime training with Simulcast - https://www.sans.org/simulcast

-- Evening training 2x per week for 6 weeks with vLive | https://www.sans.org/vlive

-- Anywhere, Anytime access for 4 months with OnDemand format | https://www.sans.org/ondemand/


-- Single Course Training

SANS Mentor |  https://www.sans.org/mentor/about

Community SANS | https://www.sans.org/community/

 

-- View the full SANS course catalog and Cyber Security Skills Roadmap

https://www.sans.org/courses

https://www.sans.org/cyber-security-skills-roadmap


********************** Sponsored Links: ********************


1) Webcast: Learn about recent breaches, attacker targets and how security teams can prepare against them. http://www.sans.org/info/213660


2) Take the 2019 SANS Endpoint Survey for a chance to win a $400 Amazon gift card: http://www.sans.org/info/213670


3) ICYMI: DDI Data - a Critical Enabler of SOAR. See how a well architected DNS, DHCP and IPAM can power SOAR platforms. http://www.sans.org/info/213665


============================================================


NOTABLE RECENT SECURITY ISSUES

SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


Title: Vulnerabilities in Zoom meeting software could turn on Mac cameras

Description: Two vulnerabilities -- CVE-2019-13449 and CVE-2019-13450 -- in the Zoom remote could allow an attacker to use a malicious website to automatically start a Zoom meeting and look in on a user's Mac camera. While Zoom says it has mitigated the issue, users are also encouraged to ensure the Mac Zoom app is up to date and to disable the setting that allows Zoom to automatically turn on the machine's camera when joining a meeting. New SNORT(R) rules fire when they detect a file containing Zoom client information trying to disclose sensitive information.

Reference: https://www.theverge.com/2019/7/8/20687014/zoom-security-flaw-video-conference-websites-hijack-mac-cameras

Snort SIDs: 50724 - 50729

 

Title: Anubis malware returns to haunt Android users

Description: Researchers at Trend Micro recently discovered more than 17,400 new samples of the Android malware. Anubis has targeted several different banking apps on Android stores, installing malicious espionage and banking trojan capabilities onto users' mobile devices. The actor behind Anubis has been active for at least 12 years, constantly making updates and adding new features. All four of these rules fire when Anubis attempts to make an outbound connection to a command and control (C2) server.

Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/anubis-android-malware-returns-with-over-17000-samples/

Snort SIDs: 50734 - 50737


============================================================


INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY


The group behind the infamous GandCrab ransomware may have regrouped and started distributing a new malware strain known as "REvil."

https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/


More than 300 Californian cities have access to the database of Palantir, a surveillance and data-mining company, primarily to provide information to their police departments.

https://www.vice.com/en_us/article/neapqg/300-californian-cities-secretly-have-access-to-palantir


A digital rights nonprofit filed a lawsuit against AT&T and two data aggregators over the sale of cellular customers' location data.

https://www.cnet.com/news/at-t-hit-with-lawsuit-over-sale-of-customers-location-data/


Oracle's latest quarterly security update contained fixes for more than 300 vulnerabilities, including nine bugs in Java that are remotely exploitable without authentication.

https://adtmag.com/articles/2019/07/16/oracle-summer-cpu.aspx


Facebook reportedly agreed on a $5 billion settlement with the U.S. Federal Trade Commission centered around the Cambridge Analytica scandal. However, some privacy advocates say the punishment doesn't go far enough.

https://thehill.com/policy/technology/453192-critics-slam-5-billion-facebook-fine-as-weak


Apple disabled the popular walkie talkie service on its Watches due to a vulnerability that could allow an attacker to remotely secretly listen in on a user's iPhone.

https://techcrunch.com/2019/07/10/apple-disables-walkie-talkie-app-due-to-vulnerability-that-could-allow-iphone-eavesdropping/


Threat actors have recently begun targeting educational facilities in wealthier areas with malware, due to the fact that they hold a large amount of data and are more likely to have the means to pay extortion payments.

https://www.apnews.com/4db421064ca84bcfad9fa195b7b41384


Cisco Talos recently identified a large number of ongoing malware distribution campaigns linked to a threat actor called "SWEED," including such notable malware as Formbook, Lokibot and Agent Tesla.

https://blog.talosintelligence.com/2019/07/sweed-agent-tesla.html


=========================================================


RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM


This is a list of recent vulnerabilities for which exploits are

available. System administrators can use this list to help in

prioritization of their remediation activities. The Qualys Vulnerability

Research Team compiles this information based on various exploit

frameworks, exploit databases, exploit kits and monitoring of internet

activity.


ID:        CVE-2019-13482

Title:    D-Link DIR-818LW Multiple Command Injection Vulnerabilities

Vendor:    D-Link

Description: D-Link DIR-818LW is exposed to multiple command-injection vulnerabilities. Exploiting these issues could allow an attacker to execute arbitrary commands in the context of the affected device. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings.

CVSS v2 Base Score:    10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)


ID:        CVE-2019-1010023

Title:    GNU glibc Remote Code Execution Vulnerability

Vendor:    GNU

Description: GNU glibc is exposed to remote code execution vulnerability. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. GNU Libc current is affected by Re-mapping current loaded libray with malicious ELF file.

CVSS v2 Base Score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)


ID:        CVE-2019-13322

Title:    Xiaomi Mi6 Browser Remote Code Execution Vulnerability

Vendor:    Xiaomi

Description: Xiaomi Mi6 Browser is exposed to a remote code execution vulnerability. Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the user. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Mi6 Browser. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the miui.share application. The issue results from the lack of proper validation of user-supplied data, which can result in an arbitrary application download. An attacker can leverage this vulnerability to execute code in the context of the user.

CVSS v2 Base Score:    7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)


ID:        CVE-2019-6631

Title:    F5 BIG-IP Products Denial of Service Vulnerability

Vendor:    F5

Description: Multiple F5 BIG-IP Products are exposed to a denial of service vulnerability. An attacker can exploit this issue to cause a denial of service condition. On BIG-IP, iRules performing HTTP header manipulation may cause an interruption to service when processing traffic handled by a Virtual Server with an associated HTTP profile, in specific circumstances, when the requests do not strictly conform to RFCs.

CVSS v2 Base Score:    4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)


ID:        CVE-2019-0234

Title:    Apache Roller Cross Site Scripting Vulnerability

Vendor:    Apache

Description: Apache Roller is exposed to a cross site scripting vulnerability because it fails to properly sanitize user-supplied input. A Reflected Cross site Scripting vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.

CVSS v2 Base Score:    4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)


ID:        CVE-2019-10968

Title:    Philips Holter Local Security Bypass Vulnerability

Vendor:    Philips

Description: Philips Holter is exposed to a local security bypass vulnerability. A local attacker can exploit this issue to bypass security restrictions and gain unauthorized access to the disabled features of the product.

CVSS v2 Base Score:    1.0 (AV:L/AC:H/Au:S/C:N/I:P/A:N)


ID:        CVE-2018-19570

Title:    GitLab Cross Site Scripting Vulnerability

Vendor:    GitLab

Description: GitLab is exposed to a cross site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Fields that accept Markdown contained incomplete input validation and output encoding when accepting unrecognized HTML tags, which resulted in a persistent cross site scripting vulnerability.

CVSS v2 Base Score:    3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)


ID:        CVE-2019-13504

Title:    Exiv2 Remote Denial of Service Vulnerability

Vendor:    Exiv2

Description: Exiv2 is exposed to a remote denial of service vulnerability. An attacker can exploit this issue to cause a denial of service condition, denying service to legitimate users. There is an out of bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp.

CVSS v2 Base Score:    4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)


=========================================================


MOST PREVALENT MALWARE FILES July 11 - 18:

COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510

MD5: 4a50780ddb3db16ebab57b0ca42da0fb

VirusTotal: https://www.virustotal.com/gui/file/7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510/details

Typical Filename: xme64-2141.exe

Claimed Product: N/A

Detection Name: W32.7ACF71AFA8-95.SBX.TG


SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3

MD5: 47b97de62ae8b2b927542aa5d7f3c858

VirusTotal: https://www.virustotal.com/gui/file/3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3/details

Typical Filename: qmreportupload.exe

Claimed Product: qmreportupload

Detection Name: Win.Trojan.Generic::in10.talos


SHA 256: 46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08

MD5: db69eaaea4d49703f161c81e6fdd036f

VirusTotal: https://www.virustotal.com/gui/file/46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08/details

Typical Filename: xme32-2141-gcc.exe

Claimed Product: N/A

Detection Name: W32.46B241E3D3-95.SBX.TG


SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5

MD5: 8c80dd97c37525927c1e549cb59bcbf3

VirusTotal: https://www.virustotal.com/gui/file/85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5/details

Typical Filename: Eter.exe

Claimed Product: N/A

Detection Name: W32.WNCryLdrA:Trojan.22ht.1201


SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f

MD5: e2ea315d9a83e7577053f52c974f6a5a

VirusTotal: https://www.virustotal.com/gui/file/c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f/details

Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin

Claimed Product: N/A

Detection Name: W32.AgentWDCR:Gen.21gn.1201


=============================================================


(c) 2019.  All rights reserved.  The information contained in this

newsletter, including any external links, is provided "AS IS," with no

express or implied warranty, for informational purposes only.


Please feel free to share this with interested parties via email, but

no posting is allowed on web sites. For a free subscription, (and for

free posters) or to update a current subscription, visit

https://www.sans.org/account


SANS Institute, 8120 Woodmont Ave., Suite 310, Bethesda, MD 20814-2743