OnDemand Training - Best Special Offers of the Year Ending Soon - Learn More

Newsletters: @RISK

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.





SANS NewsBites
@Risk: Security Alert
OUCH! Security Awareness
Case Leads DFIR Digest
Industrial Control Systems
Industrials & Infrastructure


@RISK provides a reliable weekly summary of (1) newly discovered attack vectors, (2) vulnerabilities with active new exploits, (3) insightful explanations of how recent attacks worked, and other valuable data

A key purpose of the @RISK is to provide the data that will ensure that the 20 Critical Controls (the US and UK benchmark for effective protection of networked systems) continue to be the most effective defenses for all known attack vectors. But since it is also valuable for security practitioners, SANS is making it available to the 145,000 security practitioners who have completed SANS security training and others at their organizations who hope to stay current with the offensive methods in use.

July 16, 2020

=============================================================

     @RISK: The Consensus Security Vulnerability Alert

                July, 16 2020 - Vol. 20, Num. 29


Providing a reliable, weekly summary of newly discovered attack vectors,

vulnerabilities with active exploits, and explanations of how recent

attacks worked


Archived issues may be found at http://www.sans.org/newsletters/at-risk


=============================================================


CONTENTS:

NOTABLE RECENT SECURITY ISSUES

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

MOST PREVALENT MALWARE FILES July 9 - 16

============================================================


TOP VULNERABILITY THIS WEEK: 123 vulnerabilities included in Microsoft Patch Tuesday


******************* Sponsored By CyberGRX *******************


CyberGRX has the world's largest cyber risk Exchange with over 70,000 participants. Because of the dynamic and scalable nature of the exchange, organizations and third parties work together in a one-to-many fashion to crowdsource data and mediation strategies. Rich with validated data and analytics, the CyberGRX Exchange is where organizations go to reduce third-party risk.

| http://www.sans.org/info/217040


============================================================

TRAINING UPDATE


Best Special Offers of the Year with OnDemand Cybersecurity Training

Get an 11" iPad Pro w/ Magic Keyboard, a Microsoft Surface Go 2 (256GB SSD), or Take $350 Off with your OnDemand registration through July 22.

- https://www.sans.org/ondemand/specials


SANS now offers THREE ways to complete a course:


OnDemand | Live Online | In-Person:


- https://www.sans.org/ondemand/

- https://www.sans.org/live-online

- https://www.sans.org/cyber-security-training-events/in-person/north-america


Keep your skills sharp with SANS Online Training:

.        The world's top cybersecurity courses

.        Taught by real world practitioners

.        Ideal preparation for more than 30 GIAC Certifications


Top OnDemand Courses

SEC401: Security Essentials Bootcamp Style

- https://www.sans.org/ondemand/course/security-essentials-bootcamp-style

SEC504: Hacker Tools, Techniques, Exploits, and Incident Handling

- https://www.sans.org/ondemand/course/hacker-techniques-exploits-incident-handling

SEC560: Network Penetration Testing and Ethical Hacking

- https://www.sans.org/ondemand/course/network-penetration-testing-ethical-hacking

______________________


Upcoming In-Person and Live Online Events:


SANS Summer of Cyber | Jul 27-Aug 1 | Live Online

- https://www.sans.org/event/summer-of-cyber-jul-27

 

Instructor-Led Training | Aug 3-8 | Live Online

- https://www.sans.org/event/live-online-aug3-2020-mdt


SANS Reboot - NOVA 2020 | August 10-15 | Arlington, VA or Live Online

- https://www.sans.org/event/reboot-nova-2020


SANS Network Security 2020 | September 20-25 | Las Vegas, NV or Live Online

- https://www.sans.org/event/network-security-2020

______________________


Test drive a course: https://www.sans.org/course-preview


View the full SANS course catalog and skills roadmap.

- https://www.sans.org/cyber-security-courses

- https://www.sans.org/cyber-security-skills-roadmap


********************** Sponsored Links: ********************


1) Webcast | July 29 @ 10:30 AM EDT | Tune in for our informative webcast as our host, SANS Instructor, Matt Bromiley presents "Browser Isolation: A SANS Review of Cyberinc's Isla".

| http://www.sans.org/info/217035


2) Webcast and hands-on workshop | Join our incredible webcast and hands-on workshop, hosted by Palo Alto Networks as they present "XSOAR HANDS-ON WORKSHOP: Take Your SOC To The Next Level!"

| http://www.sans.org/info/217030


3) Webcast | Waterfall Security hosts our upcoming webcast, "Eight Common OT / Industrial Firewall Mistakes" to discuss how to eliminate the potential for online attacks as a result of misconfiguration.

| http://www.sans.org/info/217025


============================================================


NOTABLE RECENT SECURITY ISSUES

SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


Title: Patch Tuesday highlighted by DNS bug, critical vulns affecting Intel and AMD

Description: Microsoft released its monthly security update Tuesday, disclosing more than 120 vulnerabilities across its array of products. While only a few vulnerabilities are considered critical, users of all Microsoft and Windows products are urged to update their software as soon as possible to avoid possible exploitation. The security updates cover several different products including the Hyper-V engine, Microsoft Word and the rest of the Microsoft Office suite of products. Six of the critical vulnerabilities that Microsoft fixed this month could allow an adversary to execute remote code by exploiting the RemoteFX feature in the Windows Hyper-V engine. These bugs affect some Intel and AMD drivers.

References: https://blog.talosintelligence.com/2020/07/vuln-spotlight-intel-amd-microsoft-july-2020.html


https://blog.talosintelligence.com/2020/07/microsoft-patch-tuesday-for-july-2020.html

Snort SIDs: 54509 - 54511, 54516 - 54518, 54521 - 54525, 54534, 54535


Title: NetSupport RAT among biggest threats to government agencies

Description: The U.S. Department of Homeland Security recently released a report outlining the three most popular malware families its intrusion prevention system detects. The NetSupport remote access tool leads the group, followed by the Kovter trojan and the XMRig cryptocurrency miner. The NetSupport Manager RAT leverages legitimate administration software to infect victim machines and then remotely take control of them.

Reference: https://www.darkreading.com/vulnerabilities---threats/dhs-shares-data-on-top-cyber-threats-to-federal-agencies/d/d-id/1338261

Snort SIDs: 54496


============================================================


INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY


Among the vulnerabilities addressed in Microsoft's July Patch Tuesday release is a critical, wormable flaw that affects all versions of Windows Server from 2003 to 2019.

https://www.zdnet.com/article/critical-sigred-vulnerability-impacts-microsoft-windows-dns-2003-2019-patch-now/


A smartwatch commonly used by elderly medical patients could be hacked to send incorrect medication reminders, according to PenTest Partners.

https://www.pentestpartners.com/security-blog/hacking-smart-devices-to-convince-dementia-sufferers-to-overdose/


The U.K. has banned the use of Huawei technology in its 5G networks. No new Huawei equipment may be purchased for 5G networks after December 2020, and all existing Huawei equipment already in use must be removed by 2027.

https://www.nytimes.com/2020/07/14/business/huawei-uk-5g.html


U.S. President Donald Trump seemed to confirm America was behind a cyber attack on a Russian troll farm in the leadup to the 2018 midterm elections.

https://www.nytimes.com/2020/07/11/us/politics/trump-russia-cyber-attack.html


Security researchers discovered a second type of malware hidden inside Chinese software that American companies doing business in China are required to install to pay local sales taxes.

https://www.nbcnews.com/politics/national-security/cybersecurity-firm-finds-more-spyware-hidden-chinese-tax-software-n1233662


The U.K.'s National Cyber Security Centre released a new toolkit designed to test and educate remote workers on defending against and responding to cyberattacks.

https://www.zdnet.com/article/remote-working-this-free-tool-tests-how-good-your-security-really-is/


Google banned advertisements for stalkerware apps on its Play store, but the new rules do not include services designed to help parents track their children's location.

https://arstechnica.com/tech-policy/2020/07/google-bans-ads-for-stalkerware-apps-with-some-exceptions/


A malicious actor is attempting to sell what they claim is personal information on more than 140 million MGM Resort guests, stemming from a cyber attack that the company disclosed in February.

https://threatpost.com/leaked-details-142-million-mgm-hotel-guests/157402/


=========================================================


RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE

COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM


This is a list of recent vulnerabilities for which exploits are

available. System administrators can use this list to help in

prioritization of their remediation activities. The Qualys Vulnerability

Research Team compiles this information based on various exploit

frameworks, exploit databases, exploit kits and monitoring of internet

activity.


ID:        CVE-2020-6287

Title:  SAP NetWeaver Application Server JAVA Multiple Vulnerabilities

Vendor: SAP

Description: SAP NetWeaver AS JAVA (LM Configuration Wizard) does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check. An unauthenticated attacker can exploit this vulnerability through the Hypertext Transfer Protocol (HTTP) to take control of trusted SAP applications.

CVSS v3 Base Score: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)


ID:        CVE-2020-1350

Title:  Microsoft Windows DNS Server Remote Code Execution Vulnerability

Vendor: Microsoft

Description: A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account. Windows servers that are configured as DNS servers are at risk from this vulnerability.

CVSS v3 Base Score: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)


ID:        CVE-2020-14664

Title:  Oracle Java SE Critical Vulnerability

Vendor: Oracle

Description: A vulnerability exists in the Java SE product of Oracle Java SE. In order to exploit the vulnerability, it allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE.

CVSS v3 Base Score: 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)


ID:        CVE-2020-5902

Title:  F5 BIG-IP Remote Code Execution Vulnerability

Vendor: F5

Description: F5 BIG-IP is exposed to remote code execution vulnerability. The vulnerability that has been actively exploited in the wild allows attackers to read files, execute code or take complete control over vulnerable systems having network access.

CVSS v3 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)


ID:        CVE-2019-19781

Title:  Citrix Application Delivery Controller and Gateway Directory Traversal Vulnerability

Vendor: Citrix

Description: A vulnerability exists in Citrix Application Delivery Controller (ADC) formerly known as NetScaler ADC and Citrix Gateway formerly known as NetScaler Gateway that, if exploited, could allow an unauthenticated attacker to perform arbitrary code execution. This vulnerability exploits a directory traversal to execute an arbitrary command payload.

CVSS v3 Base Score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)


ID:        CVE-2020-2021

Title:  Palo Alto Networks PAN-OS Authentication Bypass in SAML Authentication Vulnerability

Vendor: Palo Alto Networks

Description: When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability.

CVSS v3 Base Score: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)


ID:        CVE-2020-1421

Title:  Microsoft LNK Remote Code Execution Vulnerability

Vendor: Microsoft

Description: A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. The attacker could present to the user a removable drive, or remote share, that contains a malicious .LNK file and an associated malicious binary. When the user opens this drive(or remote share) in Windows Explorer, or any other application that parses the .LNK file, the malicious binary will execute code of the attacker's choice, on the target system.

CVSS v3 Base Score: 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)


=========================================================


MOST PREVALENT MALWARE FILES July 9 - 16:

COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP


SHA 256: 449f4a4524c06e798193c1d3ba21c2d9338936375227277898c583780392d4d8

MD5: 179c09b866c9063254083216b55693e6

VirusTotal: https://www.virustotal.com/gui/file/449f4a4524c06e798193c1d3ba21c2d9338936375227277898c583780392d4d8/details

Typical Filename: SAService.exe

Claimed Product: SAService

Detection Name: PUA.Win.File.Segurazo::95.sbx.tg


SHA 256: 8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9

MD5: 34560233e751b7e95f155b6f61e7419a

VirusTotal: https://www.virustotal.com/gui/file/8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9/details

Typical Filename: SAService.exe

Claimed Product: SAService

Detection Name: PUA.Win.Dropper.Segurazo::tpd


SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5

MD5: 8c80dd97c37525927c1e549cb59bcbf3

VirusTotal: https://www.virustotal.com/gui/file/85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5/details

Typical Filename: FlashHelperServices.exe

Claimed Product: Flash Helper Services

Detection Name: Win.Exploit.Shadowbrokers::5A5226262.auto.talos


SHA 256: 094d4da0ae3ded8b936428bb7393c77aaedd5efb5957116afd4263bd7edc2188

MD5: a10a6d9dfc0328a391a3fdb1a9fb18db

VirusTotal: https://www.virustotal.com/gui/file/094d4da0ae3ded8b936428bb7393c77aaedd5efb5957116afd4263bd7edc2188/details

Typical Filename: FlashHelperServices.exe

Claimed Product: Flash Helper Service

Detection Name: PUA.Win.Adware.Flashserv::100.sbx.vioc


SHA 256: e3eeaee0af4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd

MD5: 8193b63313019b614d5be721c538486b

VirusTotal: https://www.virustotal.com/gui/file/e3eeaee0af4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd/details

Typical Filename: SAntivirusService.exe

Claimed Product: SAService

Detection Name: PUA.Win.Dropper.Segurazo::95.sbx.tg


=============================================================


(c) 2020.  All rights reserved.  The information contained in this

newsletter, including any external links, is provided "AS IS," with no

express or implied warranty, for informational purposes only.


Please feel free to share this with interested parties via email, but

no posting is allowed on web sites. For a free subscription, (and for

free posters) or to update a current subscription, visit

https://www.sans.org/account


SANS Institute, 8120 Woodmont Ave., Suite 310, Bethesda, MD 20814-2743