@RISK: The Consensus Security Vulnerability Alert
July 11, 2019 – Vol. 19, Num. 29
=========================================================
CONTENTS:
NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES July 11 – 18, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: High-profile vulnerabilities in Zoom leads to compromise of some Mac cameras
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
Title: Vulnerabilities in Zoom meeting software could turn on Mac cameras
Description: Two vulnerabilities — CVE-2019-13449 and CVE-2019-13450 — in the Zoom remote could allow an attacker to use a malicious website to automatically start a Zoom meeting and look in on a user’s Mac camera. While Zoom says it has mitigated the issue, users are also encouraged to ensure the Mac Zoom app is up to date and to disable the setting that allows Zoom to automatically turn on the machine’s camera when joining a meeting. New SNORT(R) rules fire when they detect a file containing Zoom client information trying to disclose sensitive information.
Reference: https://www.theverge.com/2019/7/8/20687014/zoom-security-flaw-video-conference-websites-hijack-mac-cameras
Snort SIDs: 50724 – 50729
Title: Anubis malware returns to haunt Android users
Description: Researchers at Trend Micro recently discovered more than 17,400 new samples of the Android malware. Anubis has targeted several different banking apps on Android stores, installing malicious espionage and banking trojan capabilities onto users’ mobile devices. The actor behind Anubis has been active for at least 12 years, constantly making updates and adding new features. All four of these rules fire when Anubis attempts to make an outbound connection to a command and control (C2) server.
Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/anubis-android-malware-returns-with-over-17000-samples/
Snort SIDs: 50734 – 50737
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
The group behind the infamous GandCrab ransomware may have regrouped and started distributing a new malware strain known as “REvil.”
https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/
More than 300 Californian cities have access to the database of Palantir, a surveillance and data-mining company, primarily to provide information to their police departments.
https://www.vice.com/en_us/article/neapqg/300-californian-cities-secretly-have-access-to-palantir
A digital rights nonprofit filed a lawsuit against AT&T and two data aggregators over the sale of cellular customers’ location data.
https://www.cnet.com/news/at-t-hit-with-lawsuit-over-sale-of-customers-location-data/
Oracle’s latest quarterly security update contained fixes for more than 300 vulnerabilities, including nine bugs in Java that are remotely exploitable without authentication.
https://adtmag.com/articles/2019/07/16/oracle-summer-cpu.aspx
Facebook reportedly agreed on a $5 billion settlement with the U.S. Federal Trade Commission centered around the Cambridge Analytica scandal. However, some privacy advocates say the punishment doesn’t go far enough.
https://thehill.com/policy/technology/453192-critics-slam-5-billion-facebook-fine-as-weak
Apple disabled the popular walkie talkie service on its Watches due to a vulnerability that could allow an attacker to remotely secretly listen in on a user’s iPhone.
https://techcrunch.com/2019/07/10/apple-disables-walkie-talkie-app-due-to-vulnerability-that-could-allow-iphone-eavesdropping/
Threat actors have recently begun targeting educational facilities in wealthier areas with malware, due to the fact that they hold a large amount of data and are more likely to have the means to pay extortion payments.
https://www.apnews.com/4db421064ca84bcfad9fa195b7b41384
Cisco Talos recently identified a large number of ongoing malware distribution campaigns linked to a threat actor called “SWEED,” including such notable malware as Formbook, Lokibot and Agent Tesla.
https://blog.talosintelligence.com/2019/07/sweed-agent-tesla.html
MOST PREVALENT MALWARE FILES July 11 – 18, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP
SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
MD5: 4a50780ddb3db16ebab57b0ca42da0fb
VirusTotal: scan analysis
Typical Filename: xme64-2141.exe
Claimed Product: N/A
Detection Name: W32.7ACF71AFA8-95.SBX.TG
SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: scan analysis
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos
SHA 256: 46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08
MD5: db69eaaea4d49703f161c81e6fdd036f
VirusTotal: scan analysis
Typical Filename: xme32-2141-gcc.exe
Claimed Product: N/A
Detection Name: W32.46B241E3D3-95.SBX.TG
SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
MD5: 8c80dd97c37525927c1e549cb59bcbf3
VirusTotal: scan analysis
Typical Filename: Eter.exe
Claimed Product: N/A
Detection Name: W32.WNCryLdrA:Trojan.22ht.1201
SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: scan analysis
Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201