Security Vulnerability Alert Archives - Page 8 of 33

January 2, 2020March 6, 2020

@RISK: The Consensus Security Vulnerability Alert: Vol. 20, Num. 01

@RISK: The Consensus Security Vulnerability Alert
January 2, 2020 – Vol. 20, Num. 01

CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
MOST PREVALENT MALWARE FILES December 26, 2019 – January 2, 2020
=========================================================
TOP VULNERABILITY THIS WEEK: Bug in Citrix leaves corporate local networks open to attack
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Arbitrary code execution vulnerability in Citrix
Description: The Citrix Application Delivery Controller (ADC) and Citrix Gateway contain remote code execution vulnerability that could allow an attacker to infiltrate a large-scale LAN. The digital workspace and enterprise network vendor said the bug does not require the use of any credentials, so therefore could be carried out by anyone. Citrix released a set of measures to mitigate the vulnerability, including software updates. These products are installed in more than 150,000 companies’ networks across the globe.
Reference: https://threatpost.com/critical-citrix-bug-80000-corporate-lans-at-risk/151444/
Snort SIDs: 52512, 51513

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Russia’s meddling in the 2016 American presidential election may trace back to a breach at a Florida tech company, according to a new report.
https://www.politico.com/news/magazine/2019/12/26/did-russia-really-hack-2016-election-088171

U.S. Congress passed a law aimed at cracking down on the companies and individuals behind robocalls, but the legislation is unlikely to actually help most users.
https://www.wsj.com/articles/washingtons-new-anti-robocall-law-wont-stop-the-calls-heres-why-11577367931

The British government apologized to the high-profile individuals whose information was leaked online, all of whom had received a prestigious award in the past, including Sir Elton John.
https://www.bbc.com/news/uk-50929543

New Orleans says it is raising its cyber insurance coverage in 2020 after a crippling ransomware attack in mid-December.
https://www.msspalert.com/cybersecurity-breaches-and-attacks/ransomware/new-orleans-cyber-insurance-plan/

Home security company Wyze says it mistakenly left 2.4 million users’ information exposed over the course of three weeks, including email addresses, SSIDs and API tokens.
https://www.theverge.com/2019/12/30/21042974/wyze-server-breach-cybersecurity-smart-home-security-camera

A government agency in South Korea is launching an investigation into the TikTok social media app after an official raised concerns about how the Chinese company behind the app handles personal data.
https://news.softpedia.com/news/security-risks-trigger-tiktok-investigation-in-south-korea-528726.shtml

Several individuals and groups have already filed lawsuits against Wawa after they say their credit card information was stolen and used in the data breach the gas station chain disclosed in December.
https://www.inquirer.com/business/wawa-data-breach-class-action-lawsuit-20191226.html

A deadline in Russia is quickly approaching that would require smart device manufacturers to install Russian-made software on their devices before they can hit store shelves, including a web browser that would restrict access to some social media apps.
https://www.hollywoodreporter.com/news/new-russian-legislation-targets-apple-facebook-twitter-netflix-1264747

MOST PREVALENT MALWARE FILES December 26, 2019 – January 2, 2020
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: scan analysis
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos

SHA 256: 1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871
MD5: c2406fc0fce67ae79e625013325e2a68
VirusTotal: scan analysis
Typical Filename: SegurazoIC.exe
Claimed Product: Digital Communications Inc.
Detection Name: PUA.Win.Adware.Ursu::95.sbx.tg

SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: scan analysis
Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201

SHA 256: 252555d28366ea4d2d2066ea1f66b1250b7cc297a2b0066a595f5a2b240a0637
MD5: 3e1e9579a3b11547adc012d9b1caf273
VirusTotal: scan analysis
Typical Filename: cloudnet.exe
Claimed Product: EpicNet Cloud Office
Detection Name: W32.252555D283-100.SBX.TG

SHA 256: d8b594956ed54836817e38b365dafdc69aa7e07776f83dd0f706278def8ad2d1
MD5: 56f11ce9119632ba360e5b3dd0a89acd
VirusTotal: scan analysis
Typical Filename: xme64-540.exe
Claimed Product: N/A
Detection Name: W32.D8B594956E-100.SBX.TG

December 26, 2019March 6, 2020

@RISK: The Consensus Security Vulnerability Alert: Vol. 19, Num. 52

@RISK: The Consensus Security Vulnerability Alert
December 26, 2019 – Vol. 19, Num. 52

CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
MOST PREVALENT MALWARE FILES December 19 – 26, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Attackers utilize Cisco ASA bug to carry out DoS attacks
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Old vulnerability in Cisco Adaptive Security Appliances exploited in DoS attacks
Description: Attackers are exploiting a patched vulnerability in Cisco ASA to carry out denial-of-service attacks and steal critical information. The vulnerability, CVE-2018-0296, is directory traversal bug found in the web framework of Adaptive Security Appliance and Firepower Appliance. The attacker can use a specially crafted URL to cause the ASA appliance to reboot or disclose unauthenticated information. This vulnerability was first discovered and patched in June 2018, but vulnerable devices are still being targeted.
Reference: https://www.bleepingcomputer.com/news/security/cisco-security-appliances-targeted-for-dos-attacks-via-old-bug/
Snort SIDs: 46897

Title: Multiple vulnerabilities in some WAGO devices
Description: The WAGO PFC200 and PFC100 controllers contain multiple exploitable vulnerabilities. The PFC200 is one of WAGO’s programmable automation controllers that are used in many industries including automotive, rail, power engineering, manufacturing and building management. The vulnerabilities disclosed here all have their root cause within the protocol handling code of the I/O Check (iocheckd) configuration service used by the controllers. The vulnerabilities discussed here could allow an attacker to remotely execute code, deny service to the device or weaken device login credentials.
Reference: https://blog.talosintelligence.com/2019/12/vulnerability-spotlight-multiple.html
Snort SIDs: 50786 – 50789, 50790 – 50793, 50797

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Reporters and researchers at the New York Times were able to use leaked location data to track cell phone users across the U.S., even President Donald Trump, the sign of a major national security risk.
https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html

The login credentials for more than 3,000 Ring camera users were leaked last week, the latest blow to the Amazon-owned security company.
https://www.buzzfeednews.com/article/carolinehaskins1/data-leak-exposes-personal-data-over-3000-ring-camera-users

Gas station chain Wawa says it was the victim of a credit card-stealing attack since March, potentially affecting every customer at each of its locations. The company is offering victims free fraud protection for a year.
https://slate.com/technology/2019/12/how-bad-is-the-wawa-data-breach.html

A U.S. government-sponsored study found there is a high rate of error in facial recognition technology, especially among non-whites, often assigning individuals the wrong genger or identifying them as the incorrect race.
https://news.yahoo.com/massive-errors-found-facial-recognition-tech-us-study-215334634.html

An airline in Alaska had to cancel several flights after what the company called a “malicious cyber attack.”
https://www.usatoday.com/story/travel/news/2019/12/22/alaska-airline-cancels-flights-after-malicious-cyber-attack/2727709001/

U.S. military members are now banned from using the popular social media app TikTok on government-issued devices, citing security concerns based on the app developer’s potential connections to China.
https://www.pcmag.com/news/372673/us-navy-bans-tiktok-citing-cybersecurity-threat

Content management system Drupal released a series of security updates, fixing a critical vulnerability that could allow an attacker to directly upload some malicious files to a website.
https://thehackernews.com/2019/12/drupal-website-hacking.html

An exposed Elasticsearch database exposed the personal information of more than 26,000 Honda car owners, including names, addresses, VINs and email addresses.
https://www.scmagazine.com/home/security-news/database-security/open-database-exposes-26000-honda-motors-customers/

MOST PREVALENT MALWARE FILES December 19 – 26, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: scan analysis
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201

SHA 256: b32093d726609c88a06f71b8fe74e9e5a04c2dfe81fc39743bdd970bf4dea017
MD5: baadce7c152b24bd48cc1f2f4a0b088d
VirusTotal: scan analysis
Typical Filename: xme64-530.exe
Claimed Product: N/A
Detection Name: W32.B32093D726-100.SBX.TG

December 19, 2019March 6, 2020

@RISK: The Consensus Security Vulnerability Alert: Vol. 19, Num. 51

@RISK: The Consensus Security Vulnerability Alert
December 19, 2019 – Vol. 19, Num. 51

CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES December 12 – 19, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Zeppelin ransomware spreads to U.S., Europe
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: New malware-as-a-service family targets tech, health care companies
Description: The new Zeppelin malware is targeting health care and tech companies in the U.S. and Europe. Researchers believe Zeppelin is a variant of the ransomware-as-a-service family known as Vega. While Vega started out earlier this year targeting Russian-speaking victims, researchers believe the malware could be in a new adversaries’ hands now that they are targeting users elsewhere. Zeppelin is highly configurable and can be deployed as an EXE, DLL, or wrapped in a PowerShell loader.
Reference: https://threatvector.cylance.com/en_us/home/zeppelin-russian-ransomware-targets-high-profile-users-in-the-us-and-europe.html
Snort SIDs: 52451 – 52453 (By Nicholas Mavis)

Title: Gamaredon attacks spread to Ukrainian journalists, law enforcement agencies
Description: A well-known APT is expanding its pool of targets, now going after journalists and law enforcement agencies in Ukraine. The group, which is believed to have Russian ties based on the language used in their malware, previously went after Ukrainian military and government agencies. There are also new TTPs associated with this group, including the use template injection in their malware.
Reference: https://www.anomali.com/files/white-papers/Anomali_Threat_Research-Gamaredon_TTPs_Target_Ukraine-WP.pdf
Snort SIDs: 52445 – 52448 (By Joanne Kim)

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

GSuite users will soon no longer be able to use apps Google considers “less secure,” and only apps with OAuth Tokens will be allowed.
https://ww.9to5google.com/2019/12/17/g-suite-less-secure-apps/

Congress is close to approving $425 million in spending to improve America’s election security, the largest influx of money to the U.S.’s voting systems since the 2016 presidential election.
https://www.cnn.com/2019/12/16/politics/congress-425-million-election-security-2019/index.html

Iran says it thwarted a major cyber attack last week, but if its claims are true, it would establish the country as a major cyber warfare threat.
https://www.forbes.com/sites/kateoflahertyuk/2019/12/16/iran-thwarts-spying-cyberattack-blames-foreign-actor/#64f5099a4d3a

Twitter users who followed the National Epilepsy Foundation were targeted with a cyber attack that sent the users flashing lights, likely an attempt to cause harmful seizures.
https://www.nytimes.com/2019/12/16/us/strobe-attack-epilepsy.html

The city of Pensacola, Florida still does not know the full extent of a recent ransomware attack and has brought in an outside firm to perform an audit on the city’s network.
https://www.pnj.com/story/news/2019/12/16/pensacola-hires-deloitte-140-000-assess-extent-cyberattack/2665576001/

New Orleans was also a victim of a cyberattack, with ransomware bringing down the city’s computer systems for several days. The city says recovery will take a week or longer.
https://www.nola.com/news/politics/article_0a132564-2061-11ea-8d52-53848745f381.html

Ring cameras have been in the headlines for a series of hacks on the smart devices, but Amazon, the company that owns ring, chalks up the breaches to customers reusing common passwords that are easy for attackers to guess.
https://www.inc.com/minda-zetlin/ring-camera-hacked-hackers-bitcoin-ransom-security.html

Credit card company VISA released a warning on a series of point-of-sale malware at gas stations across the U.S., saying the company’s security division has investigated five incidents of the sort over the past two months.
https://www.zdnet.com/article/visa-warns-of-pos-malware-incidents-at-gas-pumps-across-north-america/

MOST PREVALENT MALWARE FILES December 12 – 19, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: d73ea76f6f07f96b337335213418b58e3fbc7e4b519fec0ef3fbd19c1d335d81
MD5: 5142c721e7182065b299951a54d4fe80
VirusTotal: virus analysis
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA.Win.Adware.Flashserv::1201

SHA 256: 0cdd2a671195915d9ffb5c9533337db935e0cc2f4d7563864ea75c21ead3f94
MD5: 7c38a43d2ed9af80932749f6e80fea6f
VirusTotal: virus analysis
Typical Filename: xme64-520.exe
Claimed Product: N/A
Detection Name: PUA.Win.File.Coinminer::1201

SHA 256: 1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871
MD5: c2406fc0fce67ae79e625013325e2a68
VirusTotal: virus analysis
Typical Filename: SegurazoIC.exe
Claimed Product: Digital Communications Inc.
Detection Name: PUA.Win.Adware.Ursu::95.sbx.tg

SHA 256: f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc
MD5: c5608e40f6f47ad84e2985804957c342
VirusTotal: virus analysis
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA:2144FlashPlayer-tpd

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: virus analysis
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201