@RISK: The Consensus Security Vulnerability Alert
November 7, 2019 – Vol. 19, Num. 45
=========================================================
CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES October 31 – November 7, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Google Chrome contains critical remote execution vulnerability
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Use-after-free bug in Chrome could allow complete system takeover
Description: Google Chrome is urging users to update their web browsers as soon as possible due to a critical use-after-free vulnerability. The company says it will be releasing updates this week to protect against exploitation of the bug. The vulnerability, identified as CVE-2019-13720, exists in Chrome’s audio component, and could allow an attacker to execute arbitrary code or enable full remote code execution capabilities.
Reference: https://threatpost.com/google-discloses-chrome-flaw-exploited-in-the-wild/149784/
Snort SIDs: 52068, 52069
Title: Two remote code execution vulnerabilities in Investintech Able2Extract
Description: Cisco Talos recently discovered two remote code execution vulnerabilities in Investintech’s Able2Extract Professional. This software is a cross-platform PDF tool for Windows, Mac and Linux that converts PDFs and allows users to create and edit them. Other features include PDF signing, redactions and annotations. An attacker could exploit these vulnerabilities to execute arbitrary code on the victim machine.
Reference: https://blog.talosintelligence.com/2019/11/vuln-spotlight-RCE-investintech-able2extract-nov-2019.html
Snort SIDs: 50864 – 50869
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
The first public exploitation of the infamous BlueKeep vulnerability is here, but it’s not nearly as bad as it could have been.
https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
Stolen login credentials from the NordVPN service were recently used in a credential-stuffing attack.
https://arstechnica.com/information-technology/2019/11/nordvpn-users-passwords-exposed-in-mass-credential-stuffing-attacks/
The U.S. and Taiwan are staging simulated cyber-war exercises this week, marketed as the first of their kind, to fight back against “North Korea and other actors.”
https://www.bbc.com/news/technology-50289974
A ransomware attack hit a string of radio stations across Spain, as well as a number of other unidentified victims.
https://www.reuters.com/article/us-spain-cyber-ransomware/cyber-attack-hits-spanish-companies-including-radio-network-idUSKBN1XE1YJ
The head of Russia’s State Security Service announced at a recent conference that Russia and the U.S. recently resumed cooperation on cyber security standards.
https://www.thedailybeast.com/putins-top-spy-russian-fsb-chief-alexander-bortnikov-were-teaming-up-with-dc-on-cybersecurity
The U.S. Department of Homeland Security issued a new warning on the “Hoplight” malware family from a North Korean-sponsored threat actor.
https://duo.com/decipher/dhs-warns-of-new-north-korean-government-malware-hoplight
A bug in the Robinhood app is allowing users to trade stocks in excess of their borrowed funds, calling it the “infinite money cheat code.”
https://www.bloomberg.com/news/articles/2019-11-05/robinhood-has-a-glitch-that-gives-traders-infinite-leverage
Noted government document whistleblower recently called out Amazon, Google and Facebook, saying they “abuse” their access to users’ data, while the government has yet to pass any laws preventing them from profiting off this information.
https://www.cnet.com/news/edward-snowden-says-facebook-amazon-and-google-engage-in-abuse
MOST PREVALENT MALWARE FILES October 31 – November 7, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
MD5: 4a50780ddb3db16ebab57b0ca42da0fb
VirusTotal: virus analysis
Typical Filename: xme64-2141.exe
Claimed Product: N/A
Detection Name: W32.7ACF71AFA8-95.SBX.TG
SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: virus analysis
Typical Filename: qmreportupload
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos
SHA 256: 6b01db091507022acfd121cc5d1f6ff0db8103f46a1940a6779dc36cca090854
MD5: 74f4e22e5be90d152521125eaf4da635
VirusTotal: virus analysis
Typical Filename: jsonMerge.exe
Claimed Product: ITSPlatform
Detection Name: W32.GenericKD:Attribute.22lk.1201
SHA 256: 46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08
MD5: db69eaaea4d49703f161c81e6fdd036f
VirusTotal: virus analysis
Typical Filename: xme32-2141-gcc.exe
Claimed Product: N/A
Detection Name: W32.46B241E3D3-95.SBX.TG
SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
MD5: 8c80dd97c37525927c1e549cb59bcbf3
VirusTotal: virus analysis
Typical Filename: Eternalblue-2.2.0.exe
Claimed Product: N/A
Detection Name: W32.WNCryLdrA:Trojan.22k2.1201