@RISK: The Consensus Security Vulnerability Alert
December 12, 2019 – Vol. 19, Num. 50
CONTENTS:
=========================================================
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES December 5 – 12, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Microsoft Patch Tuesday for December 2019
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Microsoft discloses two critical bugs as part of monthly security update
Description: Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month’s Patch Tuesday covers 25 vulnerabilities, two of which are considered critical. This month’s security update covers security issues in a variety of Microsoft services and software, including Remote Desktop Protocol, Hyper-V and multiple Microsoft Office products.
Reference: https://blog.talosintelligence.com/2019/12/microsoft-patch-tuesday-dec-2019.html
Snort SIDs: 52402, 52403, 52410, 52411, 52419, 52420
Title: AMD ATI Radeon ATIDXX64.DLL shader functionality sincos denial-of-service vulnerability
Description: Cisco Talos recently discovered a denial-of-service vulnerability in a specific DLL inside of the AMD ATI Radeon line of video cards. This vulnerability can be triggered by supplying a malformed pixel shader inside a VMware guest operating system. Such an attack can be triggered from VMware guest usermode to cause an out-of-bounds memory read on vmware-vmx.exe process on host, or theoretically through WEBGL.
Reference: https://blog.talosintelligence.com/2019/12/vuln-spotlight-amd-radeon-550-DoS-VM-dec-2019.html
Snort SIDs: 51461, 51462 (By Tim Muniz)
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
The city of Pensacola, Florida was hit with a ransomware attack over the weekend, taking many services offline, and officials aren’t ruling out that the attack is connected to a shooting on a local military base from last week.
https://www.cnn.com/2019/12/09/us/pensacola-cyber-attack/index.html
A new ransomware called “Snatch” forces Windows machines to boot in safe mood, which allows the malware to avoid detection.
https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
A new decryptor that the makers of the Ryuk ransomware say will recover victims’ files after the ransom is paid will damage larger files, rendering them unusable.
https://blog.emsisoft.com/en/35023/bug-in-latest-ryuk-decryptor-may-cause-data-loss/
Several top cyber security officials from the White House announced their departure last week, a major blow to national election security as the 2020 presidential election just gets rolling.
https://www.wsj.com/articles/top-u-s-cybersecurity-officials-to-depart-as-election-season-enters-full-swing-11575658194
A new report from the National Infrastructure Advisory Council states that a cyber attack on American infrastructure poses an “existential threat” to national security, and suggested President Donald Trumpt take “bold action” to secure ICS systems.
https://thehill.com/policy/cybersecurity/473682-federal-council-to-trump-cyber-threats-pose-existential-threat-to-the
A new malware popping on Macs is staying fileless to avoid detection and may originate from hackers working with the North Korean government.
https://arstechnica.com/information-technology/2019/12/north-koreas-lazarus-hackers-up-their-game-with-fileless-mac-malware/
Reporters were able to bypass security protections on Ring smart doorbells, eventually uncovering more than 65,800 social media posts that were specifically related to video footage from the cameras in a randomly selected area of Washington, D.C.
https://gizmodo.com/ring-s-hidden-data-let-us-map-amazons-sprawling-home-su-1840312279
Adobe disclosed 14 critical vulnerabilities as part of its monthly security update, including bugs in Acrobat, Reader and Photoshop.
https://www.bleepingcomputer.com/news/security/adobe-releases-their-december-2019-security-updates/
MOST PREVALENT MALWARE FILES December 5 – 12, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: 64f3633e009650708c070751bd7c7c28cd127b7a65d4ab4907dbe8ddaa01ec8b
MD5: 42143a53581e0304b08f61c2ef8032d7
VirusTotal: virus analysis
Typical Filename: myfile.exe
Claimed Product: N/A
Detection Name: Pdf.Phishing.Phishing::malicious.tht.talos
SHA 256: f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc
MD5: c5608e40f6f47ad84e2985804957c342
VirusTotal: virus analysis
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA:2144FlashPlayer-tpd
SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: virus analysis
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos
SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: virus analysis
Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201
SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: virus analysis
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201