@RISK: The Consensus Security Vulnerability Alert
August 8, 2019 – Vol. 19, Num. 32
=========================================================
CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES August 1 – 8, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Remote code execution bug in popular VPN service
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Palo Alto Network’s GlobalProtect Secure Socket Layer (SSL) virtual private network contains remote code execution bug
Description: CVE-2019-1579 is a remote code execution vulnerability in Palo Alto Network’s GlobalProtect Secure Socket Layer (SSL) virtual private network (VPN). At the time of discovery, some systems belonging to ride-sharing service Uber were still at risk, though they have since patched the issue. An attacker could exploit this bug to carry out a buffer overflow, and then gain the ability to remotely execute code on the victim machine.
Reference: https://www.scmagazine.com/home/security-news/vulnerabilities/remote-code-execution-vulnerability-disclosed-in-palo-alto-networks-globalprotect-ssl-vpn/
Snort SIDs: 50859, 50860
Title: VMware vulnerability leads to other flaws in NVIDIA Windows GPU display driver
Description: VMware ESXi, Workstation and Fusion are affected by an out-of-bounds read vulnerability that can be triggered using a specially crafted shader file. This vulnerability can be triggered from a VMware guest, affecting the VMware host, leading to a crash (denial-of-service) of the vmware-vmx.exe process on the host. However, when the host/guest systems are using an NVIDIA graphics card, the VMware denial-of-service can be turned into a code execution vulnerability (leading to a VM escape), because of an additional security issue present in NVIDIA’s Windows GPU Display Driver.
Reference: https://blog.talosintelligence.com/2019/08/nvidia-vmware-gpu-rce-vulnerabilities.html
Snort SIDs: 48852, 48853, 49894, 49895 – 49897, 49205, 49206
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
State-sponsored actors may be behind three spear-phishing attacks on U.S. utility companies last month, according to a new report.
https://www.cyberscoop.com/apt-10-utilities-phishing-proofpoint/
Clothing resale app Poshmark said an “unauthorized third party” stole some users’ information, including usernames, first and last names, gender, email address and hashed password.
https://www.vice.com/en_us/article/8xw4n4/poshmark-hacked
Apple suspended the practice of humans reviewing Siri recordings as the company reviews the process and releases an update that will allow users to opt into the program that it uses to ensure Siri is working correctly.
https://techcrunch.com/2019/08/01/apple-suspends-siri-response-grading-in-response-to-privacy-concerns/
There are 14 states in the U.S. that use all-paperless voting systems, but they have been slow to replace or patch those machines ahead of the 2020 election.
https://www.politico.com/interactives/2019/election-security-americas-voting-machines/
Scammers tricked employees for the city of Naples, Florida into sending them $700,000 via a spear-phishing email.
https://www.naplesnews.com/story/news/local/2019/08/02/scammers-trick-naples-out-700-000-spear-phishing-cyber-attack/1902321001/
Some of the most popular websites in the world have recently unknowingly hosted malicious ads, the latest development in the exploding popularity of adware.
https://blog.talosintelligence.com/2019/07/malvertising-deepdive.html
Facebook said it deactivated two major accounts linked to spreading fake news in the Middle East, both of which may be connected to the Saudi Arabian government.
https://www.bbc.com/news/world-middle-east-49197576
MOST PREVALENT MALWARE FILES August 1 – 8, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: virus analysis
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos
SHA 256: b22eaa5c51f0128d5e63a67ddf44285010c05717e421142a3e59bba82ba1325a
MD5: 125ef5dc3115bda09d2cef1c50869205
VirusTotal: virus analysis
Typical Filename: helpermcp
Claimed Product: N/A
Detection Name: PUA.Osx.Trojan.Amcleaner::sbmt.talos
SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: virus analysis
Typical Filename: Tempmf582901854.exe
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201
SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: virus analysis
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201
SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
MD5: 4a50780ddb3db16ebab57b0ca42da0fb
VirusTotal: virus analysis
Typical Filename: xme64-2141.exe
Claimed Product: N/A
Detection Name: W32.7ACF71AFA8-95.SBX.TG