CONTENTS::

NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 9/5/2012 - 9/11/2012

TOP VULNERABILITY THIS WEEK: Detailed research from the University of

Cambridge was released this week on weaknesses in the random number
scheme used as part of the process of securing chip-and-pin
transactions. The vulnerability allows for simple man-in-the-middle
attacks, likely impacts a large number of banks and device vendors, and
there are indications that the technique is already being used by
criminals in the wild.

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Chip and PIN random number vulnerability
Description: Researchers at the University of Cambridge recently
discovered that random numbers which play a crucial role in chip-and-pin
card transactions throughout the world are actually predictable in many
cases, allowing for straightforward man-in-the-middle attacks against
virtually any electronic payment system in the world. The research began
after individuals who had been the victim of fraudulent transactions
against them brought the cases to the researchers’ attention, indicating
that criminals are already exploiting this vulnerability in the wild.
Reference:
http://www.lightbluetouchpaper.org/2012/09/10/chip-and-skim-cloning-emv-cards-with-the-pre-play-attack/
Snort SID: N/A
ClamAV: N/A

Title: Dorifel/Quervar/XDocCrypt causing major damage worldwide
Description: This malware of many names is the latest example of a
recent trend of more destructive payloads. Delivered via a variety of
mechanisms, including exploit kits and social engineering scams, Dorifel
searches out all of the Microsoft Word documents on an infected system
and then encrypts them, rendering them unusable for the average user.
Infections are widespread enough to have taken entire offices offline
during cleanup, particularly in the Netherlands. While initial media
reports about the malware have slowed, the Sourcefire VRT has
information indicating that this destructive piece of software is still
actively spreading in the wild.
Reference:
http://hitmanpro.wordpress.com/2012/08/11/joint-strike-force-against-dorifel/
http://blog.eset.com/2012/08/21/quervar-induc-c-reincarnate
http://vrt-blog.snort.org/2012/09/dorifel-aka-quervar-xdoccrypt.html
Snort SID: 24143 - 24146
ClamAV: WIN.Worm.Dorifel

Title: GoDaddy DNS outage temporarily kills millions of web sites worldwide
Description: Major hosting provider GoDaddy was suffered a major outage
on Monday, with their DNS services worldwide taken offline. As they
provide DNS services for millions of web sites worldwide, this resulted
in a major Internet outage for thousands upon thousands of innocent
parties. Initial reports claimed that it was a hack, although GoDaddy
later claimed it was due to internal network issues. Regardless,
GoDaddy’s lack of geographical and AS-based redundancy for its DNS
service highlights just how vulnerable many sites are to attacks if they
lack proper disaster recovery and redundancy plans.
Reference:
http://techcrunch.com/2012/09/11/godaddy-says-it-wasnt-anonymous-it-wasnt-a-hack-it-wasnt-a-ddos-it-was-internal-network-issues/
http://blog.rootshell.be/2012/09/11/godaddy-outage-rfc-for-dummies/
Snort SID: N/A
ClamAV: N/A

USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

Exclusive: the real source of Apple device IDs leaked by Anonymous last week:
http://redtape.nbcnews.com/_news/2012/09/10/13781440-exclusive-the-real-source-of-apple-device-ids-leaked-by-anonymous-last-week

Huge collection of vulnerable apps/OSes/tools:
http://sourceforge.net/projects/virtualhacking/files/

Google native client: attack surface and vulnerabilities, part 4:
http://blog.leafsr.com/2012/09/google-native-client-attack-surface-and.html

Cybercriminals abuse Skype’s SMS sending feature, release DIY SMS flooders:
http://blog.webroot.com/2012/09/07/cybercriminals-abuse-skypes-sms-sending-feature-release-diy-sms-flooders/

New Metasploit exploit: SAP NetWeaver CVE-2012-2611
https://community.rapid7.com/community/metasploit/blog/2012/09/06/cve-2012-2611-the-walk-to-the-shell

Measuring and fingerprinting click spam in ad networks:
http://research.microsoft.com/pubs/168962/sigcomm12-clickspam.pdf

Penetration testing for iPhone applications, part 3:
http://resources.infosecinstitute.com/iphone-penetration-testing-3/

On the feasibility of side-channel attacks on brain-computer interfaces:
https://www.usenix.org/conference/usenixsecurity12/feasibility-side-channel-attacks-brain-computer-interfaces

BitFloor exchange robbed of $250,000, all trading halted:
http://www.zdnet.com/bitfloor-exchange-robbed-of-us250000-all-trading-halted-7000003736/

Widely used fingerprint reader exposes Windows passwords in seconds:
http://arstechnica.com/security/2012/09/windows-passwords-exposed/

Gauss malware detection tool released by Iranian CERT:
http://thehackernews.com/2012/09/gauss-malware-detection-tool-released.html

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Vendor: Oracle
Description: Oracle Java 7 Update 6, and possibly other versions, allows
remote attackers to execute arbitrary code via a crafted applet, as
exploited in the wild in August 2012 using Gondzz.class and
Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

ID: : CVE-2012-1535
Title: Adobe Flash Player 11.3 Font Parsing Code Execution
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Flash Player before
11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux
allows remote attackers to execute arbitrary code or cause a denial of
service (application crash) via crafted SWF content, as exploited in the
wild in August 2012 with SWF content in a Word document.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-3579
Title: Symantec Messaging Gateway SSH Default Password Security Bypass
Vulnerability
Vendor: Symantec
Description: Symantec Messaging Gateway before 10.0 has a default
password for an unspecified account, which makes it easier for remote
attackers to obtain privileged access via an SSH session.
CVSS v2 Base Score: 7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-4577
Title: Korenix Jetport 5600 Series Default Credentials Authentication
Bypass Vulnerability
Vendor: Korenix
Description: The Linux firmware image on (1) Korenix Jetport 5600 series
serial-device servers and (2) ORing Industrial DIN-Rail serial-device
servers has a hardcoded password of “password” for the root account,
which allows remote attackers to obtain administrative access via an SSH
session.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: : CVE-2007-1036
Title: JBoss DeploymentFileRepository WAR Deployment (via JMXInvokerServlet)
Vendor: JBoss
Description: The default configuration of JBoss does not restrict access
to the (1) console and (2) web management interfaces, which allows
remote attackers to bypass authentication and gain administrative access
via direct requests.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

MOST PREVALENT MALWARE FILES 9/5/2012 - 9/11/2012: COMPILED BY SOURCEFIRE

SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/

Typical Filename: file-4435098_exe
Claimed Product: My Web Search Bar for Internet Explorer and FireFox
Claimed Publisher: MyWebSearch.com

SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/

Typical Filename: winhsebb.exe
Claimed Product: winhsebb.exe
Claimed Publisher: winhsebb.exe

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/

Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/

Typical Filename: 123
Claimed Product: 123
Claimed Publisher: 123

SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal: https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/

Typical Filename: activator.exe.xxx
Claimed Product: activator.exe.xxx
Claimed Publisher: activator.exe.xxx