CONTENTS:

NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 9/18/2012 - 9/25/2012

TOP VULNERABILITY THIS WEEK: American financial institutions are being

targeted for DDoS attacks, with Bank of America having been knocked
offline briefly last week. The perpetrators are unknown, with
suggestions ranging from political activists to the Iranian government,
but data about the attacks is all over PasteBin, from pre-announcements
of attacks to the tool being used by the attackers.

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Operation Ababil DDoS Campaign
Description: A DDoS campaign against US financial institutions dubbed
“Operation Ababil” has been going on since last week, with new attacks
announced on PasteBin as of Tuesday. While a group called “Cyber
fighters of Izz ad-din Al qassam” has claimed credit, citing outrage
over the same controversial film that has caused riots throughout the
Arab world, US officials including Senator Joe Lieberman have insinuated
that Iran is actually sponsoring the attacks, questioning the ability
of a group of activists to take down major corporations such as Bank of
America and Chase. The Sourcefire VRT has intelligence indicating that
the attacks, wherever their origin, are using a script dubbed
“itsoknoproblembro” (so called because of a status message it displays),
which originally surfaced on PasteBin in January of this year.
Reference:
http://betabeat.com/2012/09/iran-possibly-behind-operation-ababil-cyber-attacks-against-financial-institutions/
http://pastebin.com/yftgau9w
http://pastebin.com/5qHMEX5y
Snort SID: Rate-based preprocessor
ClamAV: N/A

Title: Symantec Norton Utilities 2006 source leaked on PirateBay
Description: Actors under the banner of Anonymous posted what they claim
to be source code for the Symantec Norton Utilities 2006 security suite
on PasteBin this week, along with a message deriding the quality of the
code that asked Symantec to quit writing “shitty” software. This is the
second time this year that Symantec source code has been leaked; in
February, code for pcAnywhere was posted after a failed attempt to
extort $50,000 from the company.
Reference:
http://www.zdnet.com/symantec-source-code-leaked-on-pirate-bay-7000004765/
https://thepiratebay.se/torrent/7669176/
Snort SID: N/A
ClamAV: N/A

Title: Crimeboss Exploit Kit
Description: A relatively new exploit kit dubbed Crimeboss has recently
been observed circulating in the wild, exploiting Java vulnerabilities
such as the recently patched 0-day CVE-2012-4681. The kit, which is not
particularly novel in terms of obfuscation or deployment, is interesting
in that it both gives you the opportunity to install Java if you have
not done so already, and also delivers an applet which does not attempt
to exploit a vulnerability, but merely asks you to run it instead. In
addition, the payloads it drops are disguised as image files, bypassing
many web filtering techniques for executables in an attempt to boost its
success rates.
Reference:
http://www.kahusecurity.com/2012/crimeboss-exploit-pack/
Snort SID: 24231 - 24234
ClamAV: N/A

Title: CrimeTLS Attack
Description: Security researchers Juliano Rizzo and Thai Duong presented
a new way of determining parts of the content of an encrypted message
without the need to fully decrypt the message last week at the Ekoparty
Security Conference, dubbed the Crime TLS attack. The technique relies
on compressed TLS-encrypted data, and revolves around the fact that an
attacker who can control a portion of a request will notice a size
difference in the compressed data when they have successfully matched
their portion of the request with the data that they wish to disclose
in the TLS request. While the vulnerability is serious in theory, and
has been demonstrated on live systems including Twitter, it can easily
be worked around by disabling TLS compression on the client or server
side, and as noted by the researchers, only works on around 40% of
systems in the wild even without mitigating steps.
Reference:
http://threatpost.com/en_us/blogs/demo-crime-tls-attack-091212
Snort SID: N/A
ClamAV: N/A

USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

Backdoored PHPMyAdmin distributed on SourceForge:
http://thehackernews.com/2012/09/backdoored-phpmyadmin-distributed-at.html

Mobile Pwn2Own: iPhone 4S hacked by Dutch team
http://www.zdnet.com/mobile-pwn2own-iphone-4s-hacked-by-dutch-team-7000004498/

Blackhole 2.0 Hits the Net with New Exploits
http://www.allspammedup.com/2012/09/blackhole-2-0-hits-the-net-with-new-exploits/

Twitter Video Facebook App: Rogue DMs, Fake Flash Umbra Loaders
http://www.gfi.com/blog/twitter-video-facebook-app-rogue-dms-fake-flash-umbra-loaders/

Bypassing Intel SMEP on Windows 8 x64 Using Return-oriented Programming
http://blog.ptsecurity.com/2012/09/bypassing-intel-smep-on-windows-8-x64.html

Hotmail: Your password was too long, so we fixed it for you
http://www.securelist.com/en/blog/208193844/Hotmail_Your_password_was_too_long_so_we_fixed_it_for_you

Malware discovered developed with Google’s “Go” language:
http://www.securityweek.com/malware-discovered-developed-googles-go-programming-language

More samples of recent IE 0-Day appearing in the wild:
http://threatpost.com/en_us/blogs/another-ie-exploit-targeting-defense-industry-discovered-092412

How to launch a 65Gbps DDoS, and how to stop one:
http://blog.cloudflare.com/65gbps-ddos-no-problem

Protecting from DoS attacks using web referral architectures for privileged service:
http://www.ijert.org/browse/july-2012-edition?download=508:protecting-from-denial-of-service-attacks-using-web-referral-architectures-for-privileged-service

Defeating PatchGuard - bypassing kernel security patch protection in MS Windows:
http://www.reddit.com/tb/107kh6

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: : CVE-2012-4969
Title: Microsoft Internet Explorer 7/8/9 contain a use-after-free vulnerability
Vendor: Microsoft
Description: Microsoft Internet Explorer versions 7, 8, and 9 are
susceptible to a use-after-free vulnerability that may result in remote
code execution.
CVSS v2 Base Score: 9.7 (AV:N/AC:L/Au:N/C:C/I:C/A:P)

ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Vendor: Oracle
Description: Oracle Java 7 Update 6, and possibly other versions, allows
remote attackers to execute arbitrary code via a crafted applet, as
exploited in the wild in August 2012 using Gondzz.class and
Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

ID: : CVE-2012-1535
Title: Adobe Flash Player 11.3 Font Parsing Code Execution
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Flash Player before
11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux
allows remote attackers to execute arbitrary code or cause a denial of
service (application crash) via crafted SWF content, as exploited in the
wild in August 2012 with SWF content in a Word document.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-3579
Title: Symantec Messaging Gateway SSH Default Password Security Bypass Vulnerability
Vendor: Symantec
Description: Symantec Messaging Gateway before 10.0 has a default
password for an unspecified account, which makes it easier for remote
attackers to obtain privileged access via an SSH session.
CVSS v2 Base Score: 7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-4577
Title: Korenix Jetport 5600 Series Default Credentials Authentication Bypass Vulnerability
Vendor: Korenix
Description: The Linux firmware image on (1) Korenix Jetport 5600 series
serial-device servers and (2) ORing Industrial DIN-Rail serial-device
servers has a hardcoded password of “password” for the root account,
which allows remote attackers to obtain administrative access via an SSH
session.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 9/18/2012 - 9/25/2012: COMPILED BY SOURCEFIRE

SHA 256: CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B
MD5: 7961a56c11ba303f20f6a59a506693ff
VirusTotal: https://www.virustotal.com/file/CB85D393C4E0DB5A1514C21F9C51BA4C12D82B7FABD9724616758AE528A5B16B/analysis/
Typical Filename: file-4435098_exe
Claimed Product: My Web Search Bar for Internet Explorer and FireFox
Claimed Publisher: MyWebSearch.com

SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/
Typical Filename: winvbokexe
Claimed Product: winvbokexe
Claimed Publisher: winvbokexe

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/
Typical Filename: avz00001.dta
Claimed Product: avz00001.dta
Claimed Publisher: avz00001.dta

SHA 256: 1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442
MD5: bb74024a1d4e4808562c090980151653
VirusTotal: https://www.virustotal.com/file/1481ACE90584C46406259C653D2BD3457A2E5F44781E907731C9A618F96C7442/analysis/
Typical Filename: MWSSVC.EXE
Claimed Product: My Web Search Bar
Claimed Publisher: MyWebSearch.com

SHA 256: 02DB0F24CF8461FB903C65FAB7A1B5668BB6D912AFD8414D4AE872E97FCAD090
MD5: 64645e81435058738c137a67df84a5c5
VirusTotal: https://www.virustotal.com/file/02DB0F24CF8461FB903C65FAB7A1B5668BB6D912AFD8414D4AE872E97FCAD090/analysis/
Typical Filename: 00008.@
Claimed Product: Bitcoin Miner
Claimed Publisher: Ufasoft