@RISK: The Consensus Security Vulnerability Alert
March 07, 2019 – Vol. 19, Num. 10
=========================================================
CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES March 1 – 7, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Attacks pick up on vulnerable Cisco SOHO routers
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Cisco patches critical vulnerabilities in RV series of routers
Description: Attackers are carrying out attacks on Cisco small and home office routers after the company patched a critical bug in its RV line of routers. The vulnerability bypasses authentication procedures, allowing attackers to go after routers remotely over the internet. Affected models include the Cisco RV110, RV130 and RV215.
Reference: https://www.zdnet.com/article/hackers-have-started-attacks-on-cisco-rv110-rv130-and-rv215-routers/
Snort SIDs: 49296
Title: 19-year-old WinRAR vulnerability finally patched
Description: A micropatch released last week fixes a 19-year-old vulnerability in WinRAR that could allow an attacker to obtain remote code execution privileges. The bug, CVE-2018-20250, could allow an attacker to completely take over a target machine by tricking a user into opening a specially crafted, malicious archive. The latest WinRAR update completely removes support for ACE archives to protect users from this vulnerability.
Reference: https://www.bleepingcomputer.com/news/security/19-year-old-winrar-rce-vulnerability-gets-micropatch-which-keeps-ace-support/
Snort SIDs: 49289 – 49292
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
Dow Jones’ list of 2.4 million people who are considered “high-risk” leaked after a company left the list on a database without a password.
https://techcrunch.com/2019/02/27/dow-jones-watchlist-leak/
New reporting pulled the curtain back on Facebook’s massive effort to sway privacy policies across the world by influencing politicians.
https://www.theguardian.com/technology/2019/mar/02/facebook-global-lobbying-campaign-against-data-privacy-laws-investment
Thailand passed a new law that many are considering “martial law” on the internet and could allow the country’s military to make its own cyber laws in urgent cases.
https://www.reuters.com/article/us-thailand-cyber/thailand-passes-internet-security-law-decried-as-cyber-martial-law-idUSKCN1QH1OB
The popular cryptocurrency miner Coinhive is shutting down — but not over security concerns.
https://www.theverge.com/2019/2/28/18244636/coinhive-cryptojacking-cryptocurrency-mining-shut-down-monero-date
The Chinese hacking group APT40 reportedly carried out multiple cyber attacks on different countries in an effort to bolster their Navy.
https://www.infosecurity-magazine.com/news/chinas-apt40-group-stole-navy-1-1/
U.S. Cyber Command carried out an offensive cyber attack against a well-known Russian troll farm on the day of the 2018 midterm elections in the U.S.
https://www.washingtonpost.com/world/national-security/us-cyber-command-operation-disrupted-internet-access-of-russian-troll-factory-on-day-of-2018-midterms/2019/02/26/1827fc9e-36d6-11e9-af5b-b51b7ff322e9_story.html
MOST PREVALENT MALWARE FILES March 1 – 7, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: dfe2fcb006df972edf4f8e721bab26cfec809768a0bfbccf5fc661b6ea85dba9
MD5: b860cf8c4cb5dc676ef4893a704c9f8d
VirusTotal: scan report
Typical Filename: MyMapDirections-14900991.exe
Claimed Product: IEInstaller
Detection Name: W32.Auto:dfe2fc.in03.Talos
SHA 256: 3573bf742920655ec2c28c9ec4ac04194e38096f54c63f0ceb02d366c1034f56
MD5: b6ca0e72b072f40f5544b9fd054d6ed1
VirusTotal: scan report
Typical Filename: maftask.zip
Claimed Product: N/A
Detection Name: Auto.3573BF7429.Sbmt.tht.Talos
SHA 256: d7d80bf3f32c20298cad1d59ca8cb4508bad43a9be5e027579d7fc77a8e47be0
MD5: d8461f2978de84045e7ad6bea7a60418
VirusTotal: scan report
Typical Filename: Window.exe
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201
SHA 256: 790c213e1227adefd2d564217de86ac9fe660946e1240b5415c55770a951abfd
MD5: 147ba798e448eb3caa7e477e7fb3a959
VirusTotal: scan report
Typical Filename: ups.exe
Claimed Product: TODO: <产品名>
Detection Name: W32.Variant:Malwaregen.22d1.1201
SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: scan report
Typical Filename: 799b30f47060ca05d80ece53866e01cc.vir
Claimed Product: N/A
Detection Name: W32.Generic:Gen.21ij.1201