CONTENTS:

NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 12/27/2012 - 1/2/2013

TOP VULNERABILITY THIS WEEK: A major new Internet Explorer 0-day attack

was released last week, with live exploits occurring heavily in the
wild. Microsoft has not yet issued guidance on whether it will move
forward with an out-of-band patch; impacted users are advised to deploy
ancillary protection such as IDS or AV in the meantime.

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Internet Explorer 0-day released
Description: A new Internet Explorer remote code execution vulnerability
was discovered last week after the Council on Foreign Relations’ web
site was shown to be compromised and serving up malicious code. Many
live exploit campaigns are currently operating in the wild using this
attack, which has a great deal of proof-of-concept code available,
including a Metasploit module. Microsoft is investigating whether it
will issue an out-of-band patch or wait until the January 8 patch cycle
to release an update resolving this vulnerability. Impacted users are
urged to deploy all other available protections in the interim.
Reference:
http://technet.microsoft.com/en-us/security/advisory/2794220
https://community.rapid7.com/community/metasploit/blog/2012/12/29/microsoft-internet-explorer-0-day-marks-the-end-of-2012
http://stopmalvertising.com/malware-reports/cve-2012-4792-analysis-of-today.swf.html
http://labs.alienvault.com/labs/index.php/2012/just-another-water-hole-campaign-using-an-internet-explorer-0day/
Snort SID: 25124 - 25134
ClamAV: JS.Exploit.CVE_2012_4792

Title: GPU-accelerated Gauss encryption cracker released
Description: State-sponsored malware Gauss, which caused serious waves
in the information security community in 2012, included an encrypted
payload, which no one has yet publicly cracked. However, a new tool is
available to take advantage of GPU hardware when attempting to break the
encryption, dramatically increasing the speed at which people can
attempt to crack it. A breakthrough here could have major implications
for defenders and attackers alike in 2013.
Reference:
https://hashcat.net/oclGaussCrack/
https://www.securelist.com/en/blog?weblogid=208194061
Snort SID: N/A
ClamAV: N/A

Title: Activist group MalwareMustDie starts new takedown project
Description: A relatively new analyst group known as “Malware Must Die”,
who have published a series of in-depth articles on current threats in
the wild on their web site since they organized in August, have started
a new domain takedown project, in which they work with legal authorities
to destroy malicious domain names they find in the course of their work.
This project, similar to others in the sphere, differs primarily in that
the group is for now giving away a list of domains they are killing, as
indicators organizations can use to find and clean infections. Those who
might be able to assist them are urged to contact them directly.
Reference:
http://malwaremustdie.blogspot.com/2012/12/announce-of-malware-multiple-domains.html
Snort SID: 15168, 25141 - 25223
ClamAV: N/A

USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

Running code from a non-elevated account at any time:
http://www.scriptjunkie.us/2013/01/running-code-from-a-non-elevated-account-at-any-time/

Username anarchy:
http://www.morningstarsecurity.com/research/username-anarchy

Mona.py version 2 released:
https://www.corelan.be/index.php/2012/12/31/jingle-bofs-jingle-rops-sploiting-all-the-things-with-mona-v2/

Outmaneuvered at their own game, antivirus makers struggle to adapt:
http://www.nytimes.com/2013/01/01/technology/antivirus-makers-work-on-software-to-catch-malware-more-effectively.html?_r=0

Getting terminal access to a Cisco Linksys E-100:
http://blog.spiderlabs.com/2012/12/getting-terminal-access-to-a-cisco-linksys-e-1000.html

Controlling Cuckoo Sandbox from C#:
http://volatile-minds.blogspot.com/2012/12/controlling-cuckoo-sandbox-from-c.html

How I got a $3,500 USD Facebook bug bounty:
http://blog.detectify.com/post/39209711597/how-i-got-a-3-500-usd-facebook-bug-bounty

Hello Mach-O:
http://seriot.ch/hello_macho.php

Malware analysis #1 protip:
http://jcsocal.blogspot.com/2012/12/malware-analysis-1-protip.html

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: : CVE-2012-4792
Title: Microsoft Internet Explorer CDwnBindInfo Object Use-After-Free Vulnerability
Vendor: Microsoft
Description: Use-after-free vulnerability in Microsoft Internet Explorer
6 through 8 allows remote attackers to execute arbitrary code via a
crafted web site that triggers access to an object that (1) was not
properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo
object, and exploited in the wild in December 2012.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-2176
Title: IBM Lotus Quickr 8.2 qp2.cab ActiveX Control Buffer Overflow Vulnerability
Vendor: IBM
Description: Multiple stack-based buffer overflows in a certain ActiveX
control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for
Domino allow remote attackers to execute arbitrary code via a long
argument to the (1) Attachment_Times or (2) Import_Times method.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-2175
Title: IBM Lotus iNotes “Attachment_Times” ActiveX Buffer Overflow Vulnerability
Vendor: IBM
Description: Buffer overflow in the Attachment_Times method in a certain
ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2
allows remote attackers to execute arbitrary code via a long argument.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-2174
Title: IBM Lotus Notes URL Handler Design Error Vulnerability
Vendor: IBM
Description: The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2
allows remote attackers to execute arbitrary code via a crafted notes:// URL.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-4959
Title: Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability
Vendor: Novell
Description: Directory traversal vulnerability in NFRAgent.exe in Novell
File Reporter 1.0.2 allows remote attackers to upload and execute files
via a 130 /FSF/CMD request with a .. (dot dot) in a FILE element of an
FSFUI record.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-5975
Title: SSH Tectia Authentication Bypass Remote
Vendor: SSH Communications
Description: A remote authentication bypass vulnerability was disclosed
which affects the current Unix/Linux versions of Tectia SSH Server. The
vulnerability exploits a bug in the SSH USERAUTH CHANGE REQUEST
function.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

MOST PREVALENT MALWARE FILES 12/27/2012 - 1/2/2013 COMPILED BY SOURCEFIRE

SHA 256: 1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442
MD5: bb74024a1d4e4808562c090980151653
VirusTotal: https://www.virustotal.com/file/1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442/analysis/

Typical Filename: bb74024a1d4e4808562c090980151653
Claimed Product: My Web Search Bar
Claimed Publisher: MyWebSearch.com

SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/

Typical Filename: uliig.exe
Claimed Product: uliig.exe
Claimed Publisher: uliig.exe

SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/

Typical Filename: 7961a56c11ba303f20f6a59a506693ff
Claimed Product: My Web Search Bar for Internet Explorer and FireFox
Claimed Publisher: MyWebSearch.com

SHA 256: 358289754D01E20D564E39D79124AFA9BED4D35B3BC22F4E09210EC75E6461B2
MD5: b94b0c0efb6f33bddd2f16907a3a9cd1
VirusTotal: https://www.virustotal.com/file/358289754D01E20D564E39D79124AFA9BED4D35B3BC22F4E09210EC75E6461B2/analysis/

Typical Filename: virus-2010-10-18-id0018936109
Claimed Product: Firefox
Claimed Publisher: Mozilla

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/

Typical Filename: File_0_2.ok
Claimed Product: File_0_2.ok
Claimed Publisher: File_0_2.ok