Join us at the Rocky Mountain Hackfest, Live Online!! Virtual summit and courses take place June 4-13.

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.





SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure


@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

April 2, 2020

=============================================================

     @RISK: The Consensus Security Vulnerability Alert

            April 2, 2020 - Vol. 20, Num. 14


Providing a reliable, weekly summary of newly discovered attack vectors,

vulnerabilities with active exploits, and explanations of how recent

attacks worked


Archived issues may be found at http://www.sans.org/newsletters/at-risk


=============================================================


CONTENTS:

NOTABLE RECENT SECURITY ISSUES

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

MOST PREVALENT MALWARE FILES March 26 - April 2

============================================================


TOP VULNERABILITY THIS WEEK: Storage devices targeted by new Mirai variant


************** Sponsored By AWS Marketplace ****************


Deploying Least Privilege and Micro-Segmentation in the AWS Cloud. Learn how to reduce risk and strengthen attack resistance by allowing only the minimum authority to perform tasks. Also learn how to use micro-segmentation to restrict east-west movement and more methods for architecting a granular security environment. Webcast Tuesday, April 14, 2 PM ET. http://www.sans.org/info/215990


============================================================

TRAINING UPDATE


Keep your skills sharp, train online with SANS OnDemand:


* 45 of the world's top cybersecurity courses

* Flexible self-paced format you can take anytime, anywhere

* A battle-tested training platform including 4 months of access

* Hands-on labs and GIAC-certified SME support


Test drive and purchase SANS OnDemand courses.

- https://www.sans.org/ondemand/


SANS Network Security 2020 | Las Vegas, NV | September 20-27

- https://www.sans.org/event/network-security-2020


View the full SANS course catalog and skills roadmap.

- https://www.sans.org/courses

- https://www.sans.org/cyber-security-skills-roadmap


Any course you have or will purchase is protected by the SANS Training Guarantee.

- https://www.sans.org/training-guarantee.


********************** Sponsored Links: ********************


1) Rocky Mountain Hackfest Summit & Training 2020 - SANS Live Online | June 1-8. http://www.sans.org/info/215995


2) SANS Live Online April 8 at 12:30PM ET: Effortlessly Immunize Software - Rapidly Inoculate Compiled Code Against Software Memory Vulnerabilities. http://www.sans.org/info/216000


3) Webcast | Pre-runtime vs runtime protection. Which do you choose? Learn best practices for securing your cloud workloads. http://www.sans.org/info/216005


============================================================


NOTABLE RECENT SECURITY ISSUES

SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


Title: Zyxel devices exploited by critical vulnerability, now patched

Description: A variant of the Mirai botnet, known as Mukashi, targeted vulnerable Zyxel network-attached storage devices. CVE-2020-9054 was assigned a critical rating of 9.8 out of 10 and has since been patched. Attackers can exploit this vulnerability to compromise a device and then launch additional distributed denial-of-service attacks and attach the malware to specific TCP ports.

Reference: https://www.cisomag.com/mukashi-malware-exploits-zyxel-nas-device-vulnerabilities/

Snort SIDs: 53495, 53496, 53507 - 53510


Title: Ransomware families launch new sites to publish stolen data

Description: Attackers behind several different ransomware families are creating websites where they say they will publish information stolen in attacks if the victims do not pay the requested extortion payment. Malware like Sodinokibi, Nemty and DoppelPaymer are following the lead of the actors behind the Maze ransomware, who launched a similar site in early March. Cisco Talos released new Snort rules this week to prevent the Sodinokibi ransomware from being downloaded onto targeted machines.

Reference: https://www.bleepingcomputer.com/news/security/three-more-ransomware-families-create-sites-to-leak-stolen-data/

Snort SIDs: 53511, 53512


============================================================


INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY


Democratic Congressional leaders are pushing for more states to move to vote-by-mail, and many governments are planning to use cyber security grants to change their plans.

https://www.cnbc.com/2020/03/31/coronavirus-update-pelosi-says-country-must-move-to-vote-by-mail-taking-aim-at-trump.html


Tech companies are preparing to detect and deflect election meddling efforts similar to those in 2016, but the bad actors are changing their tactics just as quickly.

https://www.nytimes.com/2020/03/29/technology/facebook-google-twitter-november-election.html


A new phishing campaign lures victims in by lying to them that they've been exposed to someone infected with the coronavirus.

https://www.bleepingcomputer.com/news/security/phishing-attack-says-youre-exposed-to-coronavirus-spreads-malware/


In another COVID-19 related attack, other attackers are using DNS hijacking to redirect users accessing coronavirus-related mobile apps, eventually taking over their wireless routers.

https://threatpost.com/hackers-hijack-routers-to-spread-malware-via-coronavirus-apps/154170/


So-called "Zoombombers" are taking advantage of the rise in virtual meetings and hangouts, jumping into calls and sharing unwanted vulgar content.

https://www.insidehighered.com/news/2020/03/26/zoombombers-disrupt-online-classes-racist-pornographic-content


More than 42 million Iranian users of the popular Telegram encrypted messaging app had their user IDs and phone numbers leaked online, as they were stored on an unprotected server.

https://www.comparitech.com/blog/information-security/iranian-telegram-accounts-leaked/


The FBI is holding talks with cybersecurity insurance companies to discuss how they can work together to help companies prevent and recover from ransomware attacks.

https://www.cyberscoop.com/ransomware-fbi-insurance-companies-data/


Saudi Arabia reportedly can track its citizens who travel to the U.S. through a vulnerability in the global messaging system known as SS7.

https://www.theguardian.com/world/2020/mar/29/revealed-saudis-suspected-of-phone-spying-campaign-in-us


A new report from Google's Threat Analysis Group revealed it alerted 40,000 users of potential state-sponsored attacks against their accounts in 2019.

https://www.forbes.com/sites/daveywinder/2020/03/27/hacker-threat-google-confirms-40000-nation-state-cyber-attack-warnings-issued/#22f789b93b71


=========================================================


RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM


This is a list of recent vulnerabilities for which exploits are

available. System administrators can use this list to help in

prioritization of their remediation activities. The Qualys Vulnerability

Research Team compiles this information based on various exploit

frameworks, exploit databases, exploit kits and monitoring of internet

activity.


ID:        CVE-2020-0796

Title:  Microsoft Windows SMBv3 Client/Server Remote Code Execution Vulnerability

Vendor: Microsoft

Description: A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.

CVSS v3 Base Score: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)


ID:        CVE-2020-0041

Title:  Google Android Privilege Escalation Vulnerability

Vendor: Android

Description: In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed.

CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)


ID:        CVE-2020-7982

Title:  OpenWrt's opkg Man In The Middle Attack Vulnerability

Vendor: OpenWrt

Description: A bug in the fork of the opkg package manager before 2020-01-25 prevents correct parsing of embedded checksums in the signed repository index, allowing a man-in-the-middle attacker to inject arbitrary package payloads (which are installed without verification).

CVSS v3 Base Score: 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)


ID:        CVE-2019-13495

Title:  Zyxel Cross Site Scripting Vulnerability

Vendor: Zyxel

Description: In firmware version of Zyxel XGS2210-52HP, multiple stored cross-site scripting (XSS) issues allows remote authenticated users to inject arbitrary web script via an rpSys.html Name or Location field.

CVSS v3 Base Score: 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)


ID:      CVE-2020-10189

Title:  Zoho ManageEngine Desktop Central Remote Code Execution Vulnerability

Vendor: zohocorp

Description: An issue was discovered in Zoho ManageEngine Desktop Central. Remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets. An attacker could exploit this vulnerability to escalate privilege on the target system.

CVSS v3 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)


ID:        CVE-2019-18634

Title:  Sudo Buffer Overflow Vulnerability

Vendor: Multi-Vendor

Description: In Sudo versions, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.

CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)



=========================================================


MOST PREVALENT MALWARE FILES March 26 - April 2:

COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


SHA 256: a545df34334b39522b9cc8cc0c11a1591e016539b209ca1d4ab8626d70a54776

MD5: 5d34464531ddbdc7b0a4dba5b4c1cfea

VirusTotal: https://www.virustotal.com/gui/file/a545df34334b39522b9cc8cc0c11a1591e016539b209ca1d4ab8626d70a54776/details

Typical Filename: FlashHelperServices.exe

Claimed Product: Flash Helper Service

Detection Name: PUA.Win.Adware.Flashserv::in03.talos


SHA 256: 8e0aea169927ae791dbafe063a567485d33154198cd539ee7efcd81a734ea325

MD5: 5fb477098fc975fd1b314c8fb0e4ec06

VirusTotal: https://www.virustotal.com/gui/file/8e0aea169927ae791dbafe063a567485d33154198cd539ee7efcd81a734ea325/details

Typical Filename: upxarch.exe

Claimed Product: N/A

Detection Name: Win.Dropper.Ranumbot::in07.talos


SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f

MD5: e2ea315d9a83e7577053f52c974f6a5a

VirusTotal: https://www.virustotal.com/gui/file/c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f/details

Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin

Claimed Product: N/A

Detection Name: W32.AgentWDCR:Gen.21gn.1201


SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5

MD5: 8c80dd97c37525927c1e549cb59bcbf3

VirusTotal: https://www.virustotal.com/gui/file/85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5/details

Typical Filename: Eternalblue-2.2.0.exe

Claimed Product: N/A

Detection Name: W32.85B936960F.5A5226262.auto.Talos


SHA 256: 64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8

MD5: 42143a53581e0304b08f61c2ef8032d7

VirusTotal: https://www.virustotal.com/gui/file/64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8ddaa01ec8b/details

Typical Filename: myfile.exe

Claimed Product: N/A

Detection Name: Pdf.Phishing.Phishing::malicious.tht.talos


=============================================================


(c) 2020.  All rights reserved.  The information contained in this

newsletter, including any external links, is provided "AS IS," with no

express or implied warranty, for informational purposes only.


Please feel free to share this with interested parties via email, but

no posting is allowed on web sites. For a free subscription, (and for

free posters) or to update a current subscription, visit

https://www.sans.org/account


SANS Institute, 8120 Woodmont Ave., Suite 310, Bethesda, MD 20814-2743