@RISK: The Consensus Security Vulnerability Alert
May 16, 2019 – Vol. 19, Num. 20
=========================================================
CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES May 9 -16, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Microsoft releases monthly security update
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Microsoft patches 79 vulnerabilities, 22 critical
Description: Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 79 vulnerabilities, 22 of which are rated “critical,” 55 that are considered “important” and one “moderate.” This release also includes two critical advisories: one covering Microsoft Live accounts and another addressing updates to Adobe Flash Player. This month’s security update covers security issues in a variety of Microsoft’s products, including the Scripting Engine, the Microsoft Edge web browser and GDI+.
Reference: https://blog.talosintelligence.com/2019/05/MS-Patch-Tuesday-May-2019.html
Snort SIDs: 50068 – 50091, 50115 – 50119, 50120 – 50122
Title: Adobe fixes critical bugs in Flash Player, Acrobat Reader
Description: Adobe disclosed 87 vulnerabilities in a variety of its products as part of its monthly security update. The majority of the bugs exist in Adobe Acrobat and Acrobat Reader. There are also critical arbitrary code execution vulnerabilities in Adobe Flash Player and Reader.
Reference: https://threatpost.com/adobe-flash-acrobat-reader-flaws/144716/
Snort SIDs: 48293, 48294, 49189, 49190, 49684, 49685
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
WhatsApp is urging users to update the app as soon as possible after it was reported attackers could install malware on a mobile device just by calling the phone through WhatsApp.
https://www.wired.com/story/whatsapp-hack-phone-call-voip-buffer-overflow/
Photo storage app Ever unknowingly uploaded users’ photos to their servers to improve the company’s facial recognition technology, which it sold to other firms.
https://www.nbcnews.com/tech/security/millions-people-uploaded-photos-ever-app-then-company-used-them-n1003371
Baltimore’s city government continues to recover from a ransomware attack. A week later, all of the city’s emails, phones and computers are still offline.
https://www.wbaltv.com/article/baltimore-government-is-still-recovering-from-ransomware-attack/27457696
The U.S. Department of Justice charged six people with stealing $2.4 million worth of cryptocurrency over several months in a SIM card hijacking campaign.
https://www.cyberscoop.com/hackers-allegedly-stole-2-4-million-cryptocurrency-six-month-sim-hijacking-spree/
A new bill in Congress would require all U.S. lawmakers to undergo annual cybersecurity and IT training.
https://www.infosecurity-magazine.com/news/lawmakers-propose-cyber-training-1/
A bug in Twitter’s iOS app mistakenly shared users’ location data with a yet-to-be-named third party.
https://techcrunch.com/2019/05/13/twitter-bug-disclosed-some-users-location-data-to-an-unnamed-partner/
MOST PREVALENT MALWARE FILES May 9 – 16, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: e4cef790c953b769c08472ace6d6f3321851fb701882ebcb76a78a413ed85505
MD5: 2c5d83f7abe17e9ccdd6dcc0622a22aa
VirusTotal: scan analysis
Typical Filename: $RECYCLE.BIN .scr
Claimed Product: N/A
Detection Name: Win.Worm.Sality::1201
SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: scan analysis
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos
SHA 256: 2c8cb61f622f8c4c4babc19ebf9fad759d9913c4ca47ad393448c48bad08d71a
MD5: 3a61797cff12598b31443d5bce21e470
VirusTotal: scan analysis
Typical Filename: WcInstaller.exe
Claimed Product: Web Companion Installer
Detection Name: W32.2C8CB61F62-95.SBX.TG
SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
MD5: 4a50780ddb3db16ebab57b0ca42da0fb
VirusTotal: scan analysis
Typical Filename: xme64-2141.exe
Claimed Product: N/A
Detection Name: W32.7ACF71AFA8-95.SBX.TG
SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: scan analysis
Typical Filename: Tempmf582901854.exe
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201
SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: scan analysis
Typical Filename: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b.bin
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201