CONTENTS:

NOTABLE RECENT SECURITY ISSUES
USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES 10/04/2012 - 10/11/12

TOP VULNERABILITY THIS WEEK: The US House of Representatives

Intelligence Commitee urged American companies on Monday to stop doing
business with Huawei Technologies and ZTE Corp citing fears that China
could use their equipment to engage in espionage.

NOTABLE RECENT SECURITY ISSUES SELECTED BY THE SOURCEFIRE VULNERABILITY RESEARCH TEAM

Title: Huawei and ZTE labeled cyberthreats by US House of
Representatives Intelligence Commitee
Description: The US House of Representatives’ Intelligence Commitee
urged American companies on Monday to stop doing business with Huawei
Technologies and ZTE Corp citing fears that China could use their
equipment to engage in espionage. China has called the accusations
baseless and said that that the report “is merely based on subjective
conjecture and untrue foundations.”

Back in 2008, Huawei’s attempt to buy a major stake in 3Com Corp. was
blocked by the US government citing security concerns. Huawei is one of
the largest telecom gear suppliers in the world.

Reference:
http://intelligence.house.gov/sites/intelligence.house.gov/files/documents/Huawei-ZTE%20Investigative%20Report%20%28FINAL%29.pdf
Snort SID: N/A
ClamAV: N/A

Title: DDoS attacks against US banks
Description: Over the last two weeks, cyberattacks have disrupted the
websites of U.S. banks, including Wells Fargo, U.S. Bank, PNC Bank, Bank
of America and JPMorgan Chase. While a group called “Cyber fighters of
Izz ad-din Al qassam” has claimed credit, citing outrage over the same
controversial film that has caused riots throughout the Arab world, US
officials including Senator Joe Lieberman have insinuated that Iran is
actually sponsoring the attacks, questioning the ability of a group of
activists to take down major corporations. The Sourcefire VRT has
intelligence indicating that the attacks, wherever their origin, are
using a script dubbed “itsoknoproblembro” (so called because of a status
message it displays), which originally surfaced on PasteBin in January
of this year.
Reference: http://betabeat.com/2012/09/iran-possibly-behind-operation-ababil-cyber-attacks-against-financial-institutions/
http://www.zdnet.com/capital-one-hit-by-denial-of-service-attack-suffers-online-problems-7000005531/
Snort SID: Rate-based preprocessor
ClamAV: N/A

Title: Even more attacks against US banks
Description: According to security firm RSA and based on their analysis
of “underground chatter”, an international group of cybercriminals is
plotting a campaign to steal money from online accounts of thousands of
consumers at over 30 major U.S. banks. The gang is allegedly in process
of recruiting 100 botmasters who would each be responsible for the
control of bots similar to the Trojan “Gozi”. Each botmasters will be
financially backed by an investor in order to acquire the hardware and
software necessary to conduct the attacks. This could end up being the
largest coordinated attack on U.S. financial institutions to date.
Reference:
http://blogs.rsa.com/rsafarl/cyber-gang-seeks-botmasters-to-wage-massive-wave-of-trojan-attacks-against-u-s-banks/
http://krebsonsecurity.com/2012/10/project-blitzkrieg-promises-more-aggressive-cyberheists-against-u-s-banks/
http://www.scmagazine.com/us-banks-could-be-bracing-for-wave-of-account-takeovers/article/262493/
http://www.computerworld.com/s/article/9232117/Cybercriminals_plot_massive_banking_Trojan_attack
Snort SID: -
ClamAV: -

USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

Exploiting a MIPS stack based buffer overflow
http://www.devttys0.com/2012/10/exploiting-a-mips-stack-overflow/

Spear phishing in action
http://blog.fireeye.com/research/2012/10/spear-phishing-in-action.html

Virus Bulletin 2012 presentation slides
http://www.virusbtn.com/conference/vb2012/slides/index

Metasploit and PowerShell payloads:
http://carnal0wnage.attackresearch.com/2012/10/metasploit-and-powershell-payloads.html

x86 oddities:
http://code.google.com/p/corkami/wiki/x86oddities

Dissecting “Operation Ababil”
http://ddanchev.blogspot.com/2012/09/dissecting-operation-ababil-osint.html

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are
available. System administrators can use this list to help in
prioritization of their remediation activities. The Qualys Vulnerability
Research Team compiles this information based on various exploit
frameworks, exploit databases, exploit kits and monitoring of internet
activity.

ID: : CVE-2012-0507
Title: Oracle Java SE Remote Java Runtime Environment Code Execution Vulnerability
Vendor: Oracle
Description: Unspecified vulnerability in the Java Runtime Environment
(JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30
and earlier, and 5.0 Update 33 and earlier allows remote attackers to
affect confidentiality, integrity, and availability via unknown vectors
related to Concurrency.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-4969
Title: Microsoft Internet Explorer 7/8/9 contain a use-after-free vulnerability
Vendor: Microsoft
Description: Microsoft Internet Explorer versions 7, 8, and 9 are
susceptible to a use-after-free vulnerability that may result in remote
code execution.
CVSS v2 Base Score: 9.7 (AV:N/AC:L/Au:N/C:C/I:C/A:P)

ID: : CVE-2012-4681
Title: Java 7 Applet Remote Code Execution
Vendor: Oracle
Description: Oracle Java 7 Update 6, and possibly other versions, allows
remote attackers to execute arbitrary code via a crafted applet, as
exploited in the wild in August 2012 using Gondzz.class and
Gondvv.class.
CVSS v2 Base Score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

ID: : CVE-2012-1535
Title: Adobe Flash Player 11.3 Font Parsing Code Execution
Vendor: Adobe
Description: Unspecified vulnerability in Adobe Flash Player before
11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux
allows remote attackers to execute arbitrary code or cause a denial of
service (application crash) via crafted SWF content, as exploited in the
wild in August 2012 with SWF content in a Word document.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID: : CVE-2012-3579
Title: Symantec Messaging Gateway SSH Default Password Security Bypass
Vulnerability
Vendor: Symantec
Description: Symantec Messaging Gateway before 10.0 has a default
password for an unspecified account, which makes it easier for remote
attackers to obtain privileged access via an SSH session.
CVSS v2 Base Score: 7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C)

MOST PREVALENT MALWARE FILES 10/04/2012 - 10/11/12: COMPILED BY SOURCEFIRE

SHA 256: 0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3
MD5: b3b9295385f4e74d023181e5a24f4d83
VirusTotal: https://www.virustotal.com/file/0585CDC0293EA6B8C86482608C08C583BF32E12CFA59D143F4A0411D2894C0F3/analysis/

Typical Filename: activator.exe.xxx
Claimed Product: activator.exe.xxx
Claimed Publisher: activator.exe.xxx

SHA 256: DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C
MD5: 25aa9bb549ecc7bb6100f8d179452508
VirusTotal: https://www.virustotal.com/file/DF83A0D6940600E4C4954F4874FCD4DD73E781E6690C3BF56F51C95285484A3C/analysis/

Typical Filename: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Product: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin
Claimed Publisher: smona_df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c.bin

SHA 256: 9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302
MD5: 923c4d13bee966654f4fe4a8945af0ae
VirusTotal: https://www.virustotal.com/file/9A09BCC1402050E371E13056B606BBDE8DF15CD87732B28C8BDDB863B1C65302/analysis/

Typical Filename: winhsebb.exe
Claimed Product: winhsebb.exe
Claimed Publisher: winhsebb.exe

SHA 256: AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615
MD5: 3291e1603715c47a23b60a8bf2ca73db
VirusTotal: https://www.virustotal.com/file/AA0BBAECB678868E1E7F57C7CA9D61B608B3D788BE490790EB1D148BEADF4615/analysis/

Typical Filename: 123
Claimed Product: 123
Claimed Publisher: 123