Category: Blog

@RISK: The Consensus Security Vulnerability Alert
August 8, 2019 – Vol. 19, Num. 32
=========================================================
CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES August 1 – 8, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Remote code execution bug in popular VPN service
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Palo Alto Network’s GlobalProtect Secure Socket Layer (SSL) virtual private network contains remote code execution bug
Description: CVE-2019-1579 is a remote code execution vulnerability in Palo Alto Network’s GlobalProtect Secure Socket Layer (SSL) virtual private network (VPN). At the time of discovery, some systems belonging to ride-sharing service Uber were still at risk, though they have since patched the issue. An attacker could exploit this bug to carry out a buffer overflow, and then gain the ability to remotely execute code on the victim machine.
Reference: https://www.scmagazine.com/home/security-news/vulnerabilities/remote-code-execution-vulnerability-disclosed-in-palo-alto-networks-globalprotect-ssl-vpn/
Snort SIDs: 50859, 50860

Title: VMware vulnerability leads to other flaws in NVIDIA Windows GPU display driver
Description: VMware ESXi, Workstation and Fusion are affected by an out-of-bounds read vulnerability that can be triggered using a specially crafted shader file. This vulnerability can be triggered from a VMware guest, affecting the VMware host, leading to a crash (denial-of-service) of the vmware-vmx.exe process on the host. However, when the host/guest systems are using an NVIDIA graphics card, the VMware denial-of-service can be turned into a code execution vulnerability (leading to a VM escape), because of an additional security issue present in NVIDIA’s Windows GPU Display Driver.
Reference: https://blog.talosintelligence.com/2019/08/nvidia-vmware-gpu-rce-vulnerabilities.html
Snort SIDs: 48852, 48853, 49894, 49895 – 49897, 49205, 49206

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

State-sponsored actors may be behind three spear-phishing attacks on U.S. utility companies last month, according to a new report.
https://www.cyberscoop.com/apt-10-utilities-phishing-proofpoint/

Clothing resale app Poshmark said an “unauthorized third party” stole some users’ information, including usernames, first and last names, gender, email address and hashed password.
https://www.vice.com/en_us/article/8xw4n4/poshmark-hacked

Apple suspended the practice of humans reviewing Siri recordings as the company reviews the process and releases an update that will allow users to opt into the program that it uses to ensure Siri is working correctly.
https://techcrunch.com/2019/08/01/apple-suspends-siri-response-grading-in-response-to-privacy-concerns/

There are 14 states in the U.S. that use all-paperless voting systems, but they have been slow to replace or patch those machines ahead of the 2020 election.
https://www.politico.com/interactives/2019/election-security-americas-voting-machines/

Scammers tricked employees for the city of Naples, Florida into sending them $700,000 via a spear-phishing email.
https://www.naplesnews.com/story/news/local/2019/08/02/scammers-trick-naples-out-700-000-spear-phishing-cyber-attack/1902321001/

Some of the most popular websites in the world have recently unknowingly hosted malicious ads, the latest development in the exploding popularity of adware.
https://blog.talosintelligence.com/2019/07/malvertising-deepdive.html

Facebook said it deactivated two major accounts linked to spreading fake news in the Middle East, both of which may be connected to the Saudi Arabian government.
https://www.bbc.com/news/world-middle-east-49197576

MOST PREVALENT MALWARE FILES August 1 – 8, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: virus analysis
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos

SHA 256: b22eaa5c51f0128d5e63a67ddf44285010c05717e421142a3e59bba82ba1325a
MD5: 125ef5dc3115bda09d2cef1c50869205
VirusTotal: virus analysis
Typical Filename: helpermcp
Claimed Product: N/A
Detection Name: PUA.Osx.Trojan.Amcleaner::sbmt.talos

SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
VirusTotal: virus analysis
Typical Filename: Tempmf582901854.exe
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: virus analysis
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201

SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
MD5: 4a50780ddb3db16ebab57b0ca42da0fb
VirusTotal: virus analysis
Typical Filename: xme64-2141.exe
Claimed Product: N/A
Detection Name: W32.7ACF71AFA8-95.SBX.TG

@RISK: The Consensus Security Vulnerability Alert
August 1, 2019 – Vol. 19, Num. 31
=========================================================
CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES July 25 – August 1, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: Godlua backdoor communicates over DNS, targets Linux and Windows systems
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: New coverage available for Godlua malware
Description: Attackers recently targeted Linux and Windows machines with respective versions of the Godlua malware. The backdoor secures its communication via DNS over HTTPS. The attackers primarily use Godlua as a distributed denial-of-service bot, even launching an HTTP flood attack against one domain.
Reference: https://www.bleepingcomputer.com/news/security/new-godlua-malware-evades-traffic-monitoring-via-dns-over-https/
Snort SIDs: 50808 – 50811 (Written by Kristen Houser)

Title: New protection rolled out for Microsoft vulnerability exploited in the wild
Description: The OceanLotus APT recently launched a new malware known as “Ratsnif,” which comes in four different variant forms. These rules fire when Ratsnif attempts to make an outbound connection to a command and control (C2) server, or if the malware attempts to download any files. Ratsnif remained undetected after its C2 went online back in August 2018, though researchers believe it’s low level of infection kept it under the radar.
Reference: https://z6mag.com/2019/07/02/ratsnif-the-undetected-oceanlotus-malware-trojan/
Snort SIDs: 50800 – 50802 (Written by Kristen Houser)

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

A hacker obtained the information of more than 100 million Capitol One Bank customers in one of the largest data thefts against a bank in history.
https://www.nytimes.com/2019/07/29/business/capital-one-data-breach-hacked.html

The software engineer behind the Capitol One attack is reportedly a former employee of Amazon Web Services, and even took to Instagram after the hack to take credit for stealing the information.
https://nypost.com/2019/07/30/capital-one-hacker-boasted-on-social-media-after-breach-court-docs/

Democratic lawmakers in the U.S. are criticizing Republican leaders for not acting faster on cybersecurity policies that could help secure the 2020 American elections.
https://thehill.com/homenews/senate/454967-mcconnell-under-fire-for-burying-election-security-bills-in-legislative-graveyard

Louisiana declared a state of emergency after a cyberattack took down several county school systems’ networks, the first time such declaration has been made in the state due to a cyber incident.
https://www.cnbc.com/2019/07/26/louisiana-declares-state-of-emergency-after-cybercriminals-attack-school-districts.html

American tech companies are concerned that new cybersecurity policies in China could mean a reduction in business and too much power given to the government to control data. (This article is behind a paywall.)
https://www.wsj.com/articles/chinas-cybersecurity-regulations-rattle-u-s-businesses-11564409177

The malware researcher who helped bring down the WannaCry attacker will not face any jail time for his previous involvement with malware creation and infection.
https://www.zdnet.com/article/marcus-malwaretech-hutchins-gets-no-prison-time-one-year-supervised-release/

Equifax is paying $125 to customers who had their information stolen in a 2016 hack, but attackers are using it as an opportunity to spin up scams that aim to steal users’ personal information.
https://blog.malwarebytes.com/awareness/2019/07/how-to-get-your-equifax-money-and-stay-safe/

MOST PREVALENT MALWARE FILES July 25 – August 1, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: scan analysis
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos

SHA 256: 8c0b271744bf654ea3538c6b92aa7bb9819de3722640796234e243efc077e2b6
MD5: f7145b132e23e3a55d2269a008395034
VirusTotal: scan analysis
Typical Filename: r2
Claimed Product: N/A
Detection Name: Unix.Exploit.Lotoor::other.talos

SHA 256: 2f4e7dba21a31bde1192ca03b489a9bd47281a28e206b3dcf245082a491e8e0a
MD5: cc0f21a356dfa1b7ebeb904ce80d9ddf
VirusTotal: scan analysis
Typical Filename: f1cf1595f0a6ca785e7e511fe0df7bc756e8d66d.xls
Claimed Product: Microsoft Excel
Detection Name: W32.2F4E7DBA21-100.SBX.TG

SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
MD5: 4a50780ddb3db16ebab57b0ca42da0fb
VirusTotal: scan analysiss
Typical Filename: xme64-2141.exe
Claimed Product: N/A
Detection Name: W32.7ACF71AFA8-95.SBX.TG

SHA 256: 46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08
MD5: db69eaaea4d49703f161c81e6fdd036f
VirusTotal: scan analysis
Typical Filename: xme32-2141-gcc.exe
Claimed Product: N/A
Detection Name: W32.46B241E3D3-95.SBX.TG

@RISK: The Consensus Security Vulnerability Alert
July 25, 2019 – Vol. 19, Num. 30
=========================================================
CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES July 18 – 25, 2019
=========================================================
TOP VULNERABILITY THIS WEEK: AZORult trojan delivered via malicious YouTube links, supposed video game cheats
=========================================================
NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Attackers spread AZORult trojan, attempts to steal passwords
Description: Attackers recently began spreading the AZORult trojan AZORult through a series of phony cheat codes for video games, such as “CounterStrike: Go and Player Unknown’s Battlegrounds. The attackers embedded links to the supposed cheats in YouTube videos and other social media sites. Once installed, the trojan attempts to steal users’ passwords. This Snort rule fires when AZORult attempts to make an outbound connection to its command and control server.
Reference: https://www.bleepingcomputer.com/news/security/fake-cs-go-pubg-rust-cheats-push-password-stealing-trojan/
Snort SIDs: 50771

Title: New protection rolled out for Microsoft vulnerability exploited in the wild
Description: Attackers continue to exploit a previously disclosed vulnerability in Windows’ win32k.sys component. The escalation of privilege bug, identified as CVE?2019?1132, was exploited in a series of targeted attacks in Eastern Europe. An APT installed espionage malware on victim machines through this bug. Two new Snort rules activate when a user attempts to corrupt a machine’s memory using this vulnerability.
Reference: https://www.welivesecurity.com/2019/07/10/windows-zero-day-cve-2019-1132-exploit/
Snort SIDs: 50734 – 50737

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

Some Android phones are open to an exploit that could allow an attacker to listen in on any audio played over speakerphone using devices’ accelerometer.
https://threatpost.com/samsung-lg-android-spearphone-eavesdropping/146625/

A cloud hosting company that provides cloud-based QuickBooks accounting software said it was the victim of a ransomware attack last week, leading to some customers’ data becoming inaccessible.
https://krebsonsecurity.com/2019/07/quickbooks-cloud-hosting-firm-insynq-hit-in-ransomware-attack/

Credit reporting firm Equifax agreed to a settlement worth up to $700 million over a data breach in 2017, but security advocates and some lawmakers say the fine doesn’t go far enough.
https://www.wired.com/story/equifax-fine-not-enough/

Apple’s latest round of updates fixed a vulnerability in the Apple Watch’s Walkie Talkie app that could allow an attacker to listen in on users’ conversations.
https://arstechnica.com/gadgets/2019/07/apple-releases-ios-12-4-watchos-5-3-macos-10-14-6-and-more/

There are still 805,665 operating systems vulnerable to the highly publicized BlueKeep vulnerability, according to a new study.
https://www.bitsight.com/blog/industry-response-to-bluekeep-vulnerability

The National Security Agency plans to launch a new cybersecurity directorate later this year as part of a larger effort to align the U.S.’s offensive and defensive cyber capabilities. (Note: WSJ is behind a paywall.)
https://www.wsj.com/articles/nsa-forms-cybersecurity-directorate-under-more-assertive-u-s-effort-11563876005

U.S. Attorney General William Barr spoke out against encrypted data, saying that it could allow “criminals to operate with impunity.”
https://thehill.com/policy/technology/454292-barr-warns-encryption-allows-criminals-to-operate-with-impunity

MOST PREVALENT MALWARE FILES July 18 – 25, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: 6dfaacd6f16cb86923f21217ca436b09348ee72b34849921fed2a17bddd59310
MD5: 7054c32d4a21ae2d893a1c1994039050
VirusTotal: scan analysis
Typical Filename: maftask.zip
Claimed Product: N/A
Detection Name: PUA.Osx.Adware.Advancedmaccleaner::tpd

SHA 256: e062f35810260a1406895acff447e412a8133380807ef3ddc91c70c01bd34b50
MD5: 5a315fdaa14ae98226de43940630b147
VirusTotal: scan analysis
Typical Filename: FYDUpdate.exe
Claimed Product: Minama
Detection Name: W32.E062F35810-95.SBX.TG

SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
VirusTotal: scan analysis
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos

SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
MD5: 4a50780ddb3db16ebab57b0ca42da0fb
VirusTotal: scan analysis
Typical Filename: xme64-2141.exe
Claimed Product: N/A
Detection Name: W32.7ACF71AFA8-95.SBX.TG

SHA 256: 46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08
MD5: db69eaaea4d49703f161c81e6fdd036f
VirusTotal:scan analysis
Typical Filename: xme32-2141-gcc.exe
Claimed Product: N/A
Detection Name: W32.46B241E3D3-95.SBX.TG