@RISK: The Consensus Security Vulnerability Alert
August 1, 2019 – Vol. 19, Num. 31
=========================================================
CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES July 25 – August 1, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Godlua backdoor communicates over DNS, targets Linux and Windows systems
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: New coverage available for Godlua malware
Description: Attackers recently targeted Linux and Windows machines with respective versions of the Godlua malware. The backdoor secures its communication via DNS over HTTPS. The attackers primarily use Godlua as a distributed denial-of-service bot, even launching an HTTP flood attack against one domain.
Reference: https://www.bleepingcomputer.com/news/security/new-godlua-malware-evades-traffic-monitoring-via-dns-over-https/
Snort SIDs: 50808 – 50811 (Written by Kristen Houser)
Title: New protection rolled out for Microsoft vulnerability exploited in the wild
Description: The OceanLotus APT recently launched a new malware known as “Ratsnif,” which comes in four different variant forms. These rules fire when Ratsnif attempts to make an outbound connection to a command and control (C2) server, or if the malware attempts to download any files. Ratsnif remained undetected after its C2 went online back in August 2018, though researchers believe it’s low level of infection kept it under the radar.
Reference: https://z6mag.com/2019/07/02/ratsnif-the-undetected-oceanlotus-malware-trojan/
Snort SIDs: 50800 – 50802 (Written by Kristen Houser)
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
A hacker obtained the information of more than 100 million Capitol One Bank customers in one of the largest data thefts against a bank in history.
https://www.nytimes.com/2019/07/29/business/capital-one-data-breach-hacked.html
The software engineer behind the Capitol One attack is reportedly a former employee of Amazon Web Services, and even took to Instagram after the hack to take credit for stealing the information.
https://nypost.com/2019/07/30/capital-one-hacker-boasted-on-social-media-after-breach-court-docs/
Democratic lawmakers in the U.S. are criticizing Republican leaders for not acting faster on cybersecurity policies that could help secure the 2020 American elections.
https://thehill.com/homenews/senate/454967-mcconnell-under-fire-for-burying-election-security-bills-in-legislative-graveyard
Louisiana declared a state of emergency after a cyberattack took down several county school systems’ networks, the first time such declaration has been made in the state due to a cyber incident.
https://www.cnbc.com/2019/07/26/louisiana-declares-state-of-emergency-after-cybercriminals-attack-school-districts.html
American tech companies are concerned that new cybersecurity policies in China could mean a reduction in business and too much power given to the government to control data. (This article is behind a paywall.)
https://www.wsj.com/articles/chinas-cybersecurity-regulations-rattle-u-s-businesses-11564409177
The malware researcher who helped bring down the WannaCry attacker will not face any jail time for his previous involvement with malware creation and infection.
https://www.zdnet.com/article/marcus-malwaretech-hutchins-gets-no-prison-time-one-year-supervised-release/
Equifax is paying $125 to customers who had their information stolen in a 2016 hack, but attackers are using it as an opportunity to spin up scams that aim to steal users’ personal information.
https://blog.malwarebytes.com/awareness/2019/07/how-to-get-your-equifax-money-and-stay-safe/
MOST PREVALENT MALWARE FILES July 25 – August 1, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: scan analysis
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos
SHA 256: 8c0b271744bf654ea3538c6b92aa7bb9819de3722640796234e243efc077e2b6
MD5: f7145b132e23e3a55d2269a008395034
VirusTotal: scan analysis
Typical Filename: r2
Claimed Product: N/A
Detection Name: Unix.Exploit.Lotoor::other.talos
SHA 256: 2f4e7dba21a31bde1192ca03b489a9bd47281a28e206b3dcf245082a491e8e0a
MD5: cc0f21a356dfa1b7ebeb904ce80d9ddf
VirusTotal: scan analysis
Typical Filename: f1cf1595f0a6ca785e7e511fe0df7bc756e8d66d.xls
Claimed Product: Microsoft Excel
Detection Name: W32.2F4E7DBA21-100.SBX.TG
SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
MD5: 4a50780ddb3db16ebab57b0ca42da0fb
VirusTotal: scan analysiss
Typical Filename: xme64-2141.exe
Claimed Product: N/A
Detection Name: W32.7ACF71AFA8-95.SBX.TG
SHA 256: 46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08
MD5: db69eaaea4d49703f161c81e6fdd036f
VirusTotal: scan analysis
Typical Filename: xme32-2141-gcc.exe
Claimed Product: N/A
Detection Name: W32.46B241E3D3-95.SBX.TG