CONTENTS:

NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 7/9/2013 - 7/16/2013

TOP VULNERABILITY THIS WEEK: For the second week in a row, a fundamental

flaw has been found across versions of the Android operating system that
would allow for malicious code to be inserted into an APK without
disturbing the file’s cryptographic signature during verification. While
this new bug is somewhat more limited in scope, due to size constraints
on the malicious code imposed by the nature of the bug, it still poses
a serious threat to users obtaining apps from outside of known-clean
marketplaces. Google has pushed a patch to the field already, though
OEMs at this time are not yet distributing it to their customers.

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Second Android flaw allows code modification without signature tampering
Description: Researchers in China have discovered a new bug in the
processing of APK files, which allows attackers to store up to 65,533
bytes worth of uncompressed malicious DEX code inside of a package
without altering its cryptographic signature. Specifically, the problem
revolves around whether a given field in the APK structure is treated
as signed or unsigned, with malicious packages using very large unsigned
values to trick the verifier code used while loading the file. Google
has already made patches available for the issue, but the time to
distribution of the patch through OEMs could be significant based on
past experience. Concerned users should, as usual, stick to official
markets when installing applications.
Reference:
http://nakedsecurity.sophos.com/2013/07/17/anatomy-of-another-android-hole-chinese-researchers-claim-new-code-verification-bypass/
http://blog.sina.com.cn/s/blog_be6dacae0101bksm.html
Snort SID: N/A
ClamAV: BC.Exploit.Andr_Extra_Field

Title: Cryptocat warns users of message compromise
Description: The popular encrypted IM system Cryptocat warned its users
recently of a compromise in their encryption algorithm, and is telling
them to treat all conversations between October 17, 2011 and June 15,
2013 as having been conducted in cleartext. The compromise stemmed not
from tampering with the source or any centralized intrusion, but instead
from bugs that left encryption keys small enough as to render them
easily crackable. Patched versions are now available, and users are
encouraged to update their software immediately.
Reference:
http://tobtu.com/decryptocat.php
Snort SID: N/A
ClamAV: N/A

Title: Mac malware signed with Apple Developer ID, uses RTL trick
Description: Coming on the heels of malware discovered earlier this year
at the Oslo Freedom Forum, a new piece of Mac malware signed by a valid
Apple Developer ID has been found in the wild by Finnish security firm
F-Secure. This new treat, dubbed Janicab, also takes advantage of the
Unicode Right-to-Left text marker in order to obfuscate the name of the
file, in an attempt to social engineer its way onto user systems.
Reference:
http://www.f-secure.com/weblog/archives/00002576.html
Snort SID: 27228
ClamAV: OSX.Trojan.Janicab

Title: ColdFusion bugs could result in DOS, remote code execution
Description: Adobe released patches last week for two new
vulnerabilities in its popular ColdFusion web service software. While
public information on the bugs is scarce, research conducted by
Sourcefire indicates that both vulnerabilities are relatively simple to
exploit, and system administrators should operate under the assumption
that exploits will be emerging in the wild soon when weighing patching
policies.
Reference:
http://www.adobe.com/support/security/bulletins/apsb13-19.html
Snort SID: 27224, 27225
ClamAV: N/A

USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

A look at point-of-sale RAM scraper and how it works:
http://nakedsecurity.sophos.com/2013/07/16/a-look-at-point-of-sale-ram-scraper-malware-and-how-it-works/

Androrat - Android remote access tool:
http://vrt-blog.snort.org/2013/07/androrat-android-remote-access-tool.html

Alice in Warningland: A large-scale field study of browser security warning effectiveness:
http://www.cs.berkeley.edu/~devdatta/papers/alice-in-warningland.pdf

Researchers hack Verizon device, turn it into mobile spy station:
http://news.yahoo.com/researchers-hack-verizon-device-turn-mobile-spy-station-095949992.html

New FTP-based proxy application spotted in the wild:
http://blog.webroot.com/2013/07/11/new-commercially-available-mass-ftp-based-proxy-supporting-doorwaymalicious-script-uploading-application-spotted-in-the-wild/

The Carberp malware: an overview:
http://www.youtube.com/watch?v=f0GjfgekHyc&feature=youtu.be

Hacking through a straw (pivoting over DNS):
http://www.toolswatch.org/2013/07/hacking-through-a-straw-pivoting-over-dns/

Dealing with UPX packed executables:
http://secmem.blogspot.com/2013/07/dealing-with-upx-packed-executables.html

Brute force attack Xbox 360 parental controls:
http://hackaday.com/2013/07/06/brute-force-attack-xbox-360-parental-controls/

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: CVE-2013-3163
Title: Microsoft Internet Explorer CBlockElement Use-after-Free Vulnerability
Vendor: Microsoft
Description: Microsoft Internet Explorer 8 through 10 allows remote
attackers to execute arbitrary code or cause a denial of service (memory
corruption) via a crafted web site, aka “Internet Explorer Memory
Corruption Vulnerability,” a different vulnerability than CVE-2013-3144
and CVE-2013-3151.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-3660
Title: Microsoft Windows “win32k!EPATHOBJ::pprFlattenRec” Privilege
Escalation Vulnerability
Description: The EPATHOBJ::pprFlattenRec function in win32k.sys in
Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista
SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8,
Windows Server 2012, and Windows RT does not properly initialize a
pointer for the next object in a certain list, which allows local users
to obtain write access to the PATHRECORD chain, and consequently gain
privileges, by triggering excessive consumption of paged memory and then
making many FlattenPath function calls.
CVSS v2 Base Score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2013-2688
Title: QNX Phrelay Buffer Overflow Vulnerability
Vendor: QNX Software Systems Ltd
Description: Remote exploitation of a buffer overflow vulnerability in
QNX Software Systems Ltd.’s Phrelay could allow attackers to execute
arbitrary code on the targeted host.
CVSS v2 Base Score: 5.4 (AV:N/AC:H/Au:N/C:N/I:N/A:C)

ID: CVE-2013-2687
Title: QNX Multiple Products “bpe_decompress” Stack-based Buffer
Overflow Vulnerability
Vendor: QNX Software Systems Ltd
Description: Remote exploitation of a buffer overflow vulnerability in
QNX Software Systems Ltd.’s multiple products could allow attackers to
execute arbitrary code on the targeted host.
CVSS v2 Base Score: 7.3 (AV:N/AC:L/Au:N/C:N/I:N/A:C)

ID: CVE-2013-2460
Title: Java Applet ProviderSkeleton Insecure Invoke Method
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK
7, allows remote attackers to affect confidentiality, integrity, and
availability via unknown vectors related to Serviceability. NOTE: the
previous information is from the June 2013 CPU. Oracle has not commented
on claims from another vendor that this issue allows remote attackers
to bypass the Java sandbox via vectors related to “insufficient access
checks” in the tracing component.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: CVE-2012-1533
Title: Java Web Start Double Quote Injection Remote Code Execution
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update
35 and earlier, allows remote attackers to affect confidentiality,
integrity, and availability via unknown vectors related to Deployment.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 7/9/2013 - 7/16/2013 COMPILED BY SOURCEFIRE

SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Typical Filename: C8A787C22000AE378610003396E67500D587FA4E.exe
Claimed Product: My Web Search Bar for Internet Explorer and FireFox
Claimed Publisher: MyWebSearch.com

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/
Typical Filename:
smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product:
smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher:
smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: avz00001.dta
Claimed Product: avz00001.dta
Claimed Publisher: avz00001.dta

SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Typical Filename: winoaox.exe
Claimed Product: winoaox.exe
Claimed Publisher: winoaox.exe

SHA 256: E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B
MD5: bf31a8d79f704f488e3dbcb6eea3b3e3
VirusTotal: https://www.virustotal.com/file/E0B193D47609C9622AA018E81DA69C24B921F2BA682F3E18646A0D09EC63AC2B/analysis/
Typical Filename: bf31a8d79f704f488e3dbcb6eea3b3e3
Claimed Product: bf31a8d79f704f488e3dbcb6eea3b3e3
Claimed Publisher: bf31a8d79f704f488e3dbcb6eea3b3e3