Month: December 2019

@RISK: The Consensus Security Vulnerability Alert
December 26, 2019 – Vol. 19, Num. 52

CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
MOST PREVALENT MALWARE FILES December 19 – 26, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Attackers utilize Cisco ASA bug to carry out DoS attacks
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Old vulnerability in Cisco Adaptive Security Appliances exploited in DoS attacks
Description: Attackers are exploiting a patched vulnerability in Cisco ASA to carry out denial-of-service attacks and steal critical information. The vulnerability, CVE-2018-0296, is directory traversal bug found in the web framework of Adaptive Security Appliance and Firepower Appliance. The attacker can use a specially crafted URL to cause the ASA appliance to reboot or disclose unauthenticated information. This vulnerability was first discovered and patched in June 2018, but vulnerable devices are still being targeted.
Reference: https://www.bleepingcomputer.com/news/security/cisco-security-appliances-targeted-for-dos-attacks-via-old-bug/
Snort SIDs: 46897

Title: Multiple vulnerabilities in some WAGO devices
Description: The WAGO PFC200 and PFC100 controllers contain multiple exploitable vulnerabilities. The PFC200 is one of WAGO’s programmable automation controllers that are used in many industries including automotive, rail, power engineering, manufacturing and building management. The vulnerabilities disclosed here all have their root cause within the protocol handling code of the I/O Check (iocheckd) configuration service used by the controllers. The vulnerabilities discussed here could allow an attacker to remotely execute code, deny service to the device or weaken device login credentials.
Reference: https://blog.talosintelligence.com/2019/12/vulnerability-spotlight-multiple.html
Snort SIDs: 50786 – 50789, 50790 – 50793, 50797

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Reporters and researchers at the New York Times were able to use leaked location data to track cell phone users across the U.S., even President Donald Trump, the sign of a major national security risk.
https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html

The login credentials for more than 3,000 Ring camera users were leaked last week, the latest blow to the Amazon-owned security company.
https://www.buzzfeednews.com/article/carolinehaskins1/data-leak-exposes-personal-data-over-3000-ring-camera-users

Gas station chain Wawa says it was the victim of a credit card-stealing attack since March, potentially affecting every customer at each of its locations. The company is offering victims free fraud protection for a year.
https://slate.com/technology/2019/12/how-bad-is-the-wawa-data-breach.html

A U.S. government-sponsored study found there is a high rate of error in facial recognition technology, especially among non-whites, often assigning individuals the wrong genger or identifying them as the incorrect race.
https://news.yahoo.com/massive-errors-found-facial-recognition-tech-us-study-215334634.html

An airline in Alaska had to cancel several flights after what the company called a “malicious cyber attack.”
https://www.usatoday.com/story/travel/news/2019/12/22/alaska-airline-cancels-flights-after-malicious-cyber-attack/2727709001/

U.S. military members are now banned from using the popular social media app TikTok on government-issued devices, citing security concerns based on the app developer’s potential connections to China.
https://www.pcmag.com/news/372673/us-navy-bans-tiktok-citing-cybersecurity-threat

Content management system Drupal released a series of security updates, fixing a critical vulnerability that could allow an attacker to directly upload some malicious files to a website.
https://thehackernews.com/2019/12/drupal-website-hacking.html

An exposed Elasticsearch database exposed the personal information of more than 26,000 Honda car owners, including names, addresses, VINs and email addresses.
https://www.scmagazine.com/home/security-news/database-security/open-database-exposes-26000-honda-motors-customers/

MOST PREVALENT MALWARE FILES December 19 – 26, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: scan analysis
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos

SHA 256: 1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871
MD5: c2406fc0fce67ae79e625013325e2a68
VirusTotal: scan analysis
Typical Filename: SegurazoIC.exe
Claimed Product: Digital Communications Inc.
Detection Name: PUA.Win.Adware.Ursu::95.sbx.tg

SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: scan analysis
Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: scan analysis
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201

SHA 256: b32093d726609c88a06f71b8fe74e9e5a04c2dfe81fc39743bdd970bf4dea017
MD5: baadce7c152b24bd48cc1f2f4a0b088d
VirusTotal: scan analysis
Typical Filename: xme64-530.exe
Claimed Product: N/A
Detection Name: W32.B32093D726-100.SBX.TG

@RISK: The Consensus Security Vulnerability Alert
December 19, 2019 – Vol. 19, Num. 51

CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES December 12 – 19, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Zeppelin ransomware spreads to U.S., Europe
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: New malware-as-a-service family targets tech, health care companies
Description: The new Zeppelin malware is targeting health care and tech companies in the U.S. and Europe. Researchers believe Zeppelin is a variant of the ransomware-as-a-service family known as Vega. While Vega started out earlier this year targeting Russian-speaking victims, researchers believe the malware could be in a new adversaries’ hands now that they are targeting users elsewhere. Zeppelin is highly configurable and can be deployed as an EXE, DLL, or wrapped in a PowerShell loader.
Reference: https://threatvector.cylance.com/en_us/home/zeppelin-russian-ransomware-targets-high-profile-users-in-the-us-and-europe.html
Snort SIDs: 52451 – 52453 (By Nicholas Mavis)

Title: Gamaredon attacks spread to Ukrainian journalists, law enforcement agencies
Description: A well-known APT is expanding its pool of targets, now going after journalists and law enforcement agencies in Ukraine. The group, which is believed to have Russian ties based on the language used in their malware, previously went after Ukrainian military and government agencies. There are also new TTPs associated with this group, including the use template injection in their malware.
Reference: https://www.anomali.com/files/white-papers/Anomali_Threat_Research-Gamaredon_TTPs_Target_Ukraine-WP.pdf
Snort SIDs: 52445 – 52448 (By Joanne Kim)

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

GSuite users will soon no longer be able to use apps Google considers “less secure,” and only apps with OAuth Tokens will be allowed.
https://ww.9to5google.com/2019/12/17/g-suite-less-secure-apps/

Congress is close to approving $425 million in spending to improve America’s election security, the largest influx of money to the U.S.’s voting systems since the 2016 presidential election.
https://www.cnn.com/2019/12/16/politics/congress-425-million-election-security-2019/index.html

Iran says it thwarted a major cyber attack last week, but if its claims are true, it would establish the country as a major cyber warfare threat.
https://www.forbes.com/sites/kateoflahertyuk/2019/12/16/iran-thwarts-spying-cyberattack-blames-foreign-actor/#64f5099a4d3a

Twitter users who followed the National Epilepsy Foundation were targeted with a cyber attack that sent the users flashing lights, likely an attempt to cause harmful seizures.
https://www.nytimes.com/2019/12/16/us/strobe-attack-epilepsy.html

The city of Pensacola, Florida still does not know the full extent of a recent ransomware attack and has brought in an outside firm to perform an audit on the city’s network.
https://www.pnj.com/story/news/2019/12/16/pensacola-hires-deloitte-140-000-assess-extent-cyberattack/2665576001/

New Orleans was also a victim of a cyberattack, with ransomware bringing down the city’s computer systems for several days. The city says recovery will take a week or longer.
https://www.nola.com/news/politics/article_0a132564-2061-11ea-8d52-53848745f381.html

Ring cameras have been in the headlines for a series of hacks on the smart devices, but Amazon, the company that owns ring, chalks up the breaches to customers reusing common passwords that are easy for attackers to guess.
https://www.inc.com/minda-zetlin/ring-camera-hacked-hackers-bitcoin-ransom-security.html

Credit card company VISA released a warning on a series of point-of-sale malware at gas stations across the U.S., saying the company’s security division has investigated five incidents of the sort over the past two months.
https://www.zdnet.com/article/visa-warns-of-pos-malware-incidents-at-gas-pumps-across-north-america/

MOST PREVALENT MALWARE FILES December 12 – 19, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: d73ea76f6f07f96b337335213418b58e3fbc7e4b519fec0ef3fbd19c1d335d81
MD5: 5142c721e7182065b299951a54d4fe80
VirusTotal: virus analysis
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA.Win.Adware.Flashserv::1201

SHA 256: 0cdd2a671195915d9ffb5c9533337db935e0cc2f4d7563864ea75c21ead3f94
MD5: 7c38a43d2ed9af80932749f6e80fea6f
VirusTotal: virus analysis
Typical Filename: xme64-520.exe
Claimed Product: N/A
Detection Name: PUA.Win.File.Coinminer::1201

SHA 256: 1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871
MD5: c2406fc0fce67ae79e625013325e2a68
VirusTotal: virus analysis
Typical Filename: SegurazoIC.exe
Claimed Product: Digital Communications Inc.
Detection Name: PUA.Win.Adware.Ursu::95.sbx.tg

SHA 256: f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc
MD5: c5608e40f6f47ad84e2985804957c342
VirusTotal: virus analysis
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA:2144FlashPlayer-tpd

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: virus analysis
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201

@RISK: The Consensus Security Vulnerability Alert
December 12, 2019 – Vol. 19, Num. 50

CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES December 5 – 12, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Microsoft Patch Tuesday for December 2019
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Microsoft discloses two critical bugs as part of monthly security update
Description: Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month’s Patch Tuesday covers 25 vulnerabilities, two of which are considered critical. This month’s security update covers security issues in a variety of Microsoft services and software, including Remote Desktop Protocol, Hyper-V and multiple Microsoft Office products.
Reference: https://blog.talosintelligence.com/2019/12/microsoft-patch-tuesday-dec-2019.html
Snort SIDs: 52402, 52403, 52410, 52411, 52419, 52420

Title: AMD ATI Radeon ATIDXX64.DLL shader functionality sincos denial-of-service vulnerability
Description: Cisco Talos recently discovered a denial-of-service vulnerability in a specific DLL inside of the AMD ATI Radeon line of video cards. This vulnerability can be triggered by supplying a malformed pixel shader inside a VMware guest operating system. Such an attack can be triggered from VMware guest usermode to cause an out-of-bounds memory read on vmware-vmx.exe process on host, or theoretically through WEBGL.
Reference: https://blog.talosintelligence.com/2019/12/vuln-spotlight-amd-radeon-550-DoS-VM-dec-2019.html
Snort SIDs: 51461, 51462 (By Tim Muniz)

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

The city of Pensacola, Florida was hit with a ransomware attack over the weekend, taking many services offline, and officials aren’t ruling out that the attack is connected to a shooting on a local military base from last week.
https://www.cnn.com/2019/12/09/us/pensacola-cyber-attack/index.html

A new ransomware called “Snatch” forces Windows machines to boot in safe mood, which allows the malware to avoid detection.
https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/

A new decryptor that the makers of the Ryuk ransomware say will recover victims’ files after the ransom is paid will damage larger files, rendering them unusable.
https://blog.emsisoft.com/en/35023/bug-in-latest-ryuk-decryptor-may-cause-data-loss/

Several top cyber security officials from the White House announced their departure last week, a major blow to national election security as the 2020 presidential election just gets rolling.
https://www.wsj.com/articles/top-u-s-cybersecurity-officials-to-depart-as-election-season-enters-full-swing-11575658194

A new report from the National Infrastructure Advisory Council states that a cyber attack on American infrastructure poses an “existential threat” to national security, and suggested President Donald Trumpt take “bold action” to secure ICS systems.
https://thehill.com/policy/cybersecurity/473682-federal-council-to-trump-cyber-threats-pose-existential-threat-to-the

A new malware popping on Macs is staying fileless to avoid detection and may originate from hackers working with the North Korean government.
https://arstechnica.com/information-technology/2019/12/north-koreas-lazarus-hackers-up-their-game-with-fileless-mac-malware/

Reporters were able to bypass security protections on Ring smart doorbells, eventually uncovering more than 65,800 social media posts that were specifically related to video footage from the cameras in a randomly selected area of Washington, D.C.
https://gizmodo.com/ring-s-hidden-data-let-us-map-amazons-sprawling-home-su-1840312279

Adobe disclosed 14 critical vulnerabilities as part of its monthly security update, including bugs in Acrobat, Reader and Photoshop.
https://www.bleepingcomputer.com/news/security/adobe-releases-their-december-2019-security-updates/

MOST PREVALENT MALWARE FILES December 5 – 12, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8ddaa01ec8b
MD5: 42143a53581e0304b08f61c2ef8032d7
VirusTotal: virus analysis
Typical Filename: myfile.exe
Claimed Product: N/A
Detection Name: Pdf.Phishing.Phishing::malicious.tht.talos

SHA 256: f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc
MD5: c5608e40f6f47ad84e2985804957c342
VirusTotal: virus analysis
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA:2144FlashPlayer-tpd

SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: virus analysis
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos

SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: virus analysis
Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: virus analysis
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201