SANS Network Security offers 40+ cyber security courses in Las Vegas or Live Online. Save $300 thru tomorrow.

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.





SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure


@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

December 19, 2019

=============================================================

     @RISK: The Consensus Security Vulnerability Alert

              December 19, 2019 - Vol. 19, Num. 51


Providing a reliable, weekly summary of newly discovered attack vectors,

vulnerabilities with active exploits, and explanations of how recent

attacks worked


Archived issues may be found at http://www.sans.org/newsletters/at-risk


=============================================================


CONTENTS:

NOTABLE RECENT SECURITY ISSUES

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

MOST PREVALENT MALWARE FILES Dec. 12 - 19

============================================================


TOP VULNERABILITY THIS WEEK: Zeppelin ransomware spreads to U.S., Europe


****************** Sponsored By ZeroNorth ******************


This is How Rapid AppSec Fills the Security Gap. Gaps in your application security program may exist--and filling these gaps takes time. With the ZeroNorth Solution for Rapid AppSec, open source security scanning tools are embedded within the ZeroNorth platform. You can quickly fill gaps while a longer-term strategy--likely centered on commercial scanning tools--moves forward. Learn more or request a demo. http://www.sans.org/info/215060


============================================================

TRAINING UPDATE

 

-- SANS Security East 2020 | New Orleans, LA | February 1-8 | https://www.sans.org/event/security-east-2020


-- SANS Miami 2020 | January 13-18 | https://www.sans.org/event/miami-2020


-- SANS Threat Hunting & IR Summit & Training | London, UK | January 13-19, 2020 | https://www.sans.org/event/threat-hunting-europe-2020


-- SANS Tokyo January 2020 | January 20-25 | https://www.sans.org/event/tokyo-january-2020


-- SANS Amsterdam January 2020 | January 20-25 | https://www.sans.org/event/amsterdam-january-2020

    

-- Cyber Threat Intelligence Summit & Training | Arlington, VA | January 20-27 | https://www.sans.org/event/cyber-threat-intelligence-summit-2020


-- SANS Scottsdale 2020 | February 17-22 | https://www.sans.org/event/scottsdale-2020


-- Open-Source Intelligence Summit & Training 2020 | Alexandria, VA | February 18-24 | https://www.sans.org/event/osint-summit-2020


-- SANS Secure Singapore 2020 | 16-28 March | https://www.sans.org/event/secure-singapore-2020


-- SANS OnDemand and vLive Training

Get a Free GIAC Certification Attempt or Take $350 Off through December 25 with OnDemand or vLive training.

https://www.sans.org/online-security-training/specials/


-- Can't travel? SANS offers online instruction for maximum flexibility

-- Live Daytime training with Simulcast - https://www.sans.org/simulcast

-- Evening training 2x per week for 6 weeks with vLive | https://www.sans.org/vlive

-- Anywhere, Anytime access for 4 months with OnDemand format | https://www.sans.org/ondemand/


-- Single Course Training

SANS Mentor |  https://www.sans.org/mentor/about

Community SANS | https://www.sans.org/community/

 

-- View the full SANS course catalog and Cyber Security Skills Roadmap

https://www.sans.org/courses

https://www.sans.org/cyber-security-skills-roadmap


********************** Sponsored Links: ********************


1) Think you're a shared responsibility expert? Test your cloud security savvy and find out! http://www.sans.org/info/215065


2) ICYMI Webcast: Effectively Addressing Advanced Threats with SANS Matt Bromiley. View here: http://www.sans.org/info/215070


3) Join us at the SANS ICS Security Summit & Training Summit 2020 | Orlando, FL | March 2-9. http://www.sans.org/info/215075


============================================================


NOTABLE RECENT SECURITY ISSUES

SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


Title: New malware-as-a-service family targets tech, health care companies

Description: The new Zeppelin malware is targeting health care and tech companies in the U.S. and Europe. Researchers believe Zeppelin is a variant of the ransomware-as-a-service family known as Vega. While Vega started out earlier this year targeting Russian-speaking victims, researchers believe the malware could be in a new adversaries' hands now that they are targeting users elsewhere. Zeppelin is highly configurable and can be deployed as an EXE, DLL, or wrapped in a PowerShell loader.

Reference: https://threatvector.cylance.com/en_us/home/zeppelin-russian-ransomware-targets-high-profile-users-in-the-us-and-europe.html

Snort SIDs: 52451 - 52453 (By Nicholas Mavis)

 

Title: Gamaredon attacks spread to Ukrainian journalists, law enforcement agencies

Description: A well-known APT is expanding its pool of targets, now going after journalists and law enforcement agencies in Ukraine. The group, which is believed to have Russian ties based on the language used in their malware, previously went after Ukrainian military and government agencies. There are also new TTPs associated with this group, including the use template injection in their malware.

Reference: https://www.anomali.com/files/white-papers/Anomali_Threat_Research-Gamaredon_TTPs_Target_Ukraine-WP.pdf

Snort SIDs: 52445 - 52448 (By Joanne Kim)


============================================================


INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY


GSuite users will soon no longer be able to use apps Google considers "less secure," and only apps with OAuth Tokens will be allowed.

https://ww.9to5google.com/2019/12/17/g-suite-less-secure-apps/


Congress is close to approving $425 million in spending to improve America's election security, the largest influx of money to the U.S.'s voting systems since the 2016 presidential election.

https://www.cnn.com/2019/12/16/politics/congress-425-million-election-security-2019/index.html


Iran says it thwarted a major cyber attack last week, but if its claims are true, it would establish the country as a major cyber warfare threat.

https://www.forbes.com/sites/kateoflahertyuk/2019/12/16/iran-thwarts-spying-cyberattack-blames-foreign-actor/#64f5099a4d3a


Twitter users who followed the National Epilepsy Foundation were targeted with a cyber attack that sent the users flashing lights, likely an attempt to cause harmful seizures.

https://www.nytimes.com/2019/12/16/us/strobe-attack-epilepsy.html


The city of Pensacola, Florida still does not know the full extent of a recent ransomware attack and has brought in an outside firm to perform an audit on the city's network.

https://www.pnj.com/story/news/2019/12/16/pensacola-hires-deloitte-140-000-assess-extent-cyberattack/2665576001/


New Orleans was also a victim of a cyberattack, with ransomware bringing down the city's computer systems for several days. The city says recovery will take a week or longer.

https://www.nola.com/news/politics/article_0a132564-2061-11ea-8d52-53848745f381.html


Ring cameras have been in the headlines for a series of hacks on the smart devices, but Amazon, the company that owns ring, chalks up the breaches to customers reusing common passwords that are easy for attackers to guess.

https://www.inc.com/minda-zetlin/ring-camera-hacked-hackers-bitcoin-ransom-security.html


Credit card company VISA released a warning on a series of point-of-sale malware at gas stations across the U.S., saying the company's security division has investigated five incidents of the sort over the past two months.

https://www.zdnet.com/article/visa-warns-of-pos-malware-incidents-at-gas-pumps-across-north-america/


=========================================================


RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM


This is a list of recent vulnerabilities for which exploits are

available. System administrators can use this list to help in

prioritization of their remediation activities. The Qualys Vulnerability

Research Team compiles this information based on various exploit

frameworks, exploit databases, exploit kits and monitoring of internet

activity.


ID:        CVE-2019-19726

Title:    OpenBSD Dynamic Loader Privilege Escalation Vulnerability

Vendor:    OpenBSD

Description: A local privilege escalation vulnerability exisys in OpenBSD's dynamic loader. This vulnerability is exploitable in the default installation (via the set-user-ID executable chpass or passwd) and could allow local users or malicious software to gain full root privileges.

CVSS v2 Base Score:    7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)


ID:        CVE-2019-6192

Title:    Lenovo Power Management Driver Denial of Service Vulnerability

Vendor:    Lenovo

Description: A vulnerability in pmdrvs.sys driver exists in Lenovo Power Management Driver. The vulnerability exists due to insuffiecient input buffer validation when the driver processes IOCTL codes. Attackers can exploit this issue to cause a denial of service or possibly execute arbitrary code in kernel space.

CVSS v2 Base Score:    4.6 (AV:L/AC:L/Au:S/C:N/I:N/A:C)


ID:        CVE-2019-17554

Title:    Apache Olingo OData XML External Entity Injection Vulnerability

Vendor: Apache

Description: The XML content type entity deserializer in Apache Olingo is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks. XML data is parsed by insecurley configured software components, which can be abused for XML External Entity Attacks

Base Score: 4.3 MEDIUMVector:  (AV:N/AC:M/Au:N/C:P/I:N/A:N)


ID:        CVE-2019-16451

Title:    Adobe Acrobat Reader Heap Based Memory Corruption Vulnerability

Vendor: Adobe

Description: A heap based memory corruption vulnerability exists in Adobe Acrobat Reader. This vulnerability in Acrobat Reader for Windows, allows access violation exception when opening a malformed PDF file. Successful exploitation could lead to arbitrary code execution.

Base Score: 7.5 HIGHVector:  (AV:N/AC:L/Au:N/C:P/I:P/A:P)


ID:        CVE-2019-16451

Title:    AppXSvc Arbitrary File Overwrite Denial of Service Vulnerability

Vendor: Microsoft

Description: An elevation of privilege vulnerability exists when the AppX Deployment Server (AppXSvc) improperly handles file hard links. AppXSvc can be forced to overwrite an arbitrary file by deleting all registry data files before creating the file hard link. A low privileged user could exploit this vulnerability to cause denial of service by overwriting critical system files.    

Base Score: 7.2 HIGHVector:  (AV:L/AC:L/Au:N/C:C/I:C/A:C)


ID:        CVE-2019-15627

Title:    Trend Micro Deep Security Agent 11 Arbitrary File Overwrite Vulnerability

Vendor: Trend Micro

Description: Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to availability impact. Local OS access is required. The vulnerability allows an unprivileged local attacker to delete any file on the filesystem, or overwrite it with abritrary data hosted elsewhere.

Base Score: 6.6 MEDIUMVector:  (AV:L/AC:L/Au:N/C:N/I:C/A:C)


=========================================================


MOST PREVALENT MALWARE FILES Dec. 12 - 19:

COMPILED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


SHA 256: d73ea76f6f07f96b337335213418b58e3fbc7e4b519fec0ef3fbd19c1d335d81

MD5: 5142c721e7182065b299951a54d4fe80

VirusTotal: https://www.virustotal.com/gui/file/d73ea76f6f07f96b337335213418b58e3fbc7e4b519fec0ef3fbd19c1d335d81/details

Typical Filename: FlashHelperServices.exe

Claimed Product: Flash Helper Service

Detection Name: PUA.Win.Adware.Flashserv::1201


SHA 256: 0cdd2a671195915d9ffb5c9533337db935e0cc2f4d7563864ea75c21ead3f94

MD5: 7c38a43d2ed9af80932749f6e80fea6f

VirusTotal: https://www.virustotal.com/gui/file/c0cdd2a671195915d9ffb5c9533337db935e0cc2f4d7563864ea75c21ead3f94/details

Typical Filename: xme64-520.exe

Claimed Product: N/A

Detection Name: PUA.Win.File.Coinminer::1201


SHA 256: 1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871

MD5: c2406fc0fce67ae79e625013325e2a68

VirusTotal: https://www.virustotal.com/gui/file/1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871/details

Typical Filename: SegurazoIC.exe

Claimed Product: Digital Communications Inc.

Detection Name: PUA.Win.Adware.Ursu::95.sbx.tg


SHA 256: f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc

MD5: c5608e40f6f47ad84e2985804957c342

VirusTotal: https://www.virustotal.com/gui/file/f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc/details

Typical Filename: FlashHelperServices.exe

Claimed Product: Flash Helper Service

Detection Name: PUA:2144FlashPlayer-tpd


SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b

MD5: 799b30f47060ca05d80ece53866e01cc

VirusTotal: https://www.virustotal.com/gui/file/15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b/details

Typical Filename: mf2016341595.exe

Claimed Product: N/A

Detection Name: W32.Generic:Gen.22fz.1201


=============================================================


(c) 2019.  All rights reserved.  The information contained in this

newsletter, including any external links, is provided "AS IS," with no

express or implied warranty, for informational purposes only.


Please feel free to share this with interested parties via email, but

no posting is allowed on web sites. For a free subscription, (and for

free posters) or to update a current subscription, visit

https://www.sans.org/account


SANS Institute, 8120 Woodmont Ave., Suite 310, Bethesda, MD 20814-2743