CONTENTS:

NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 2/12/2013 - 2/19/2013

TOP VULNERABILITY THIS WEEK: Tensions between the United States and

China are running high after security firm Mandiant released a detailed
technical support claiming that the Chinese government has been actively
attacking American interests for at least the past 6 years.

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Mandiant Releases Report On Chinese “APT1” Group
Description: Incident response specialist company Mandiant released on
Tuesday a groundbreaking report, citing highly detailed evidence to
support a claim that the Chinese government, through Unit 61398 of the
People’s Liberation Army, has been engaging in systematic attacks on
American interests, as well as those of other English-speaking nations
around the globe, over the course of the past 6 years. The report, which
included domain names, IP addresses, SSL certificates, and MD5sums of
malicious binaries, has already caused a major political stir, with the
Obama administration set to impose trade penalties for cybertheft, with
the Chinese government denying any involvement.
Reference:
http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf
http://www.washingtonpost.com/business/claims-of-cyberstealing-by-china-prompt-administration-to-develop-more-aggressive-responses/2013/02/20/527cdc84-7b34-11e2-9c27-fdd594ea6286_story.html
Snort SID: 25836 - 25848
ClamAV: Trojan.Downbot-1 Trojan.Downbot-2 Trojan.Downbot-5
Trojan.Downloader-133181 Trojan.Downloader-134278
Trojan.Downloader-16819 Trojan.Downloader-74679
Trojan.Downloader-81796 Trojan.Downloader-83571 Trojan.Gloox
Trojan.Lithium.Capture Trojan.Onlinegames-2021 Trojan.Scar-992
Trojan.Small-10047 W32.Trojan.Downloader-579 Win.Trojan.Agent-108327
Win.Trojan.Agent-137590 Win.Trojan.Agent-138969
Win.Trojan.Agent-140739 Win.Trojan.Agent-142593
Win.Trojan.Agent-143322 Win.Trojan.Agent-149295
Win.Trojan.Agent-149699 Win.Trojan.Agent-154735
Win.Trojan.Agent-168098 Win.Trojan.Agent-23705 Win.Trojan.Agent-27353
Win.Trojan.Agent-35654 Win.Trojan.Agent-63410 Win.Trojan.Agent-65195
Win.Trojan.Agent-82578 Win.Trojan.Agent-8646 Win.Trojan.Agent-8648
Win.Trojan.Agent-8790 Win.Trojan.Agent-96394 Win.Trojan.Agent-96509
Win.Trojan.Cossta-4 Win.Trojan.Downloader-1837 Win.Trojan.Small-913

Title: Schneider Electric IGSS Buffer Overflow
Description: Independent researcher Aaron Portnoy recently discovered a
set of vulnerabilities in the widely used Schneider Electric IGSS
protocol, which could be remotely exploited for full administrative
privileges on target systems. The vendor has since issued a patch, and
users of these systems are strongly encouraged to both apply the patch
and to ensure that all electrical infrastructure is appropriately
firewalled from the Internet.
Reference:
http://ics-cert.us-cert.gov/pdf/ICSA-13-018-01.pdf
Snort SID: 25849 - 25852
ClamAV: N/A

Title: PDF 0-day Being Exploited In The Wild
Description: Adobe confirmed last week that a pair of new exploits
targeting Acrobat Reader were being exploited in the wild; as of the
time of writing, no patches had yet been released. The exploits were
particularly nefarious, in that they used a brand-new ROP-based
technique to escape Reader’s sandboxing technology, which was designed
by Adobe to mitigate the impact of vulnerabilities such as these. Users
are urged to be extremely cautious when opening PDF documents from any
source.
Reference:
http://vrt-blog.snort.org/2013/02/more-targeted-pdf-0-day.html
http://www.adobe.com/support/security/advisories/apsa13-02.html
https://blogs.mcafee.com/mcafee-labs/analyzing-the-first-rop-only-sandbox-escaping-pdf-exploit
Snort SID: 25818, 25819
ClamAV: PDF.Exploit.CVE_2013_0640

USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

Detailed analysis for MS12-081:
http://blog.ptsecurity.com/2013/02/surprise-for-network-resources-from.html

TeamViewer authentication protocol:
http://blog.accuvantlabs.com/blog/bthomas/teamviewer-authentication-protocol

iOS 6.1 hack allows lock screen bypass:
http://thehackernews.com/2013/02/ios-61-hack-allows-iphone-lock-screen.html

FROST: Forensic Recovery of Scrambled Telephones:
https://www1.informatik.uni-erlangen.de/frost

Cyber attacks against Uighur Mac OS X users intensify:
https://www.securelist.com/en/blog/208194116/Cyber_Attacks_Against_Uyghur_Mac_OS_X_Users_Intensify

Practical identification of SQL injection vulnerabilities:
https://www.us-cert.gov/reading_room/Practical-SQLi-Identification.pdf

Targeted ‘phone ring flooding’ as a service going mainstream:
http://blog.webroot.com/2013/02/13/targeted-phone-ring-flooding-attacks-as-a-service-going-mainstream/

DDoS attack on bank hid $900,000 cyberheist:
http://krebsonsecurity.com/2013/02/ddos-attack-on-bank-hid-900000-cyberheist/

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2013-0640, CVE-2013-0641
Title: Adobe Reader and Acrobat Unspecified Code Execution Vulnerability
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Reader and Acrobat 9.x
through 9.5.3, 10.x through 10.1.5, and 11.x through 11.0.1 allows
remote attackers to execute arbitrary code via a crafted PDF document,
as exploited in the wild in February 2013.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-0025
Title: Microsoft Internet Explorer SLayoutRun Use-After-Free (MS13-009)
Vendor: Microsoft
Description: Use-after-free vulnerability in Microsoft Internet Explorer
8 allows remote attackers to execute arbitrary code via a crafted web
site that triggers access to a deleted object, aka “Internet Explorer
SLayoutRun Use After Free Vulnerability.”

ID: CVE-2012-5088
Title: Java Applet Method Handle Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote
attackers to affect confidentiality, integrity, and availability via
unknown vectors related to Libraries.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2012-5076
Title: Java Applet AverageRangeStatisticImpl Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote
attackers to affect confidentiality, integrity, and availability,
related to JAX-WS.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2012-3569
Title: VMWare OVF Tools Format String Vulnerability
Vendor: VMWare
Description: Format string vulnerability in VMware OVF Tool 2.1 on
Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player
4.x before 4.0.5, and other products, allows user-assisted remote
attackers to execute arbitrary code via a crafted OVF file.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 2/12/2013 - 2/19/2013 COMPILED BY SOURCEFIRE

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/aa0bbaecb678868e1e7f57c7ca9d61b608b3d788be490790eb1d148beadf4615/analysis/

Typical Filename: avz00001.dta
Claimed Product: -
Claimed Publisher: -

SHA 256: B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96
MD5: 573b6cc513e1b7cd9e35b491eacc38f3
VirusTotal: https://www.virustotal.com/file/B7B28E855B8C6225C605330760FF4DC407EFC83F72F1A04E974A72189D0F1D96/analysis/

Typical Filename: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Product: 573b6cc513e1b7cd9e35b491eacc38f3
Claimed Publisher: 573b6cc513e1b7cd9e35b491eacc38f3

SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal: https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/

Typical Filename: Keygen.exe
Claimed Product: Keygen.exe
Claimed Publisher: Keygen.exe

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/

Typical Filename: File_0_2.ok
Claimed Product: -
Claimed Publisher: -

SHA 256: A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03
MD5: e010f298c086c2e1d7265fd18aea2dfbaa9dcd35
VirusTotal: https://www.virustotal.com/file/A6B140EC734C258C5EBF19C0BC0B414B5655ADC00108A038B5BE6A8F83D0BD03/analysis/

Typical Filename: lpkjnn.sys
Claimed Product: -
Claimed Publisher: -