Security Technology

Siemens SIPROTEC Denial of Service

A vulnerability exists in Siemens SIPROTEC. This is due to the way SIPROTEC handles certain malformed protocol requests. A successful attack can lead to a denial of service.

from Check Point Update Services Advisories http://ift.tt/2sOYIhP

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days.

Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back each Friday for highlights of the goings-on each week!

New Trojan Android, Xavier, Is an Information-Stealing Ad Library

We have recently discovered a Trojan Android ad library called Xavier (Detected by Trend Micro as ANDROIDOS_XAVIER.AXM) that steals and leaks a user’s information silently. Xavier’s impact has been widespread.

Erebus Linux Ransomware Strikes Again

On June 12, South Korea-based web hosting company NAYANA became one of the latest high-profile victim of ransomware after 153 of its Linux servers were found infected with an Erebus ransomware variant. The ransomware attack affected the websites, database and multimedia files of around 3,400 businesses employing NAYANA’s service.

Spam Run in Europe Uses Hover Action to Deliver Banking Trojan

While many of today’s malware sport relatively new capabilities, most of their authors or operators still use old techniques to deliver them. Malicious macros and shortcut (LNK) files are still used in ransomware, banking Trojans, and targeted attacks, for instance.

Cyberpropaganda Is a Major Growth Area for Cybercriminals

As we predicted in 2016, cyberpropaganda is a major growth area for cybercriminals. Per that prediction, “The rise in the Internet penetration has opened the opportunity for invested parties to use the Internet as a free-for-all tool to influence public opinion to go one way or another.”

Hack Override Malware Took Down a Power Grid

Hackers appear to be testing the most evolved specimen of grid-sabotaging malware ever observed in the wild. Researchers describe this malware as the second-ever known case of malicious code purpose-built to disrupt physical systems.

MacOS Security Reputation Challenged by New Ransomware-as-a-Service

Once viewed as nigh-on impregnable, Apple’s reputation for secure products is being challenged once again, this time by ransomware-as-a-service. Mac computers are being targeted by a new strain of malware created to infect the OS.

The Next Step in Advanced Targeted Attacks Is Business Process Compromise

Targeted attacks have come a long way in recent years, leveraging increasingly advanced techniques aimed at specific individuals. Often, these hackers pinpoint a single person within an enterprise, steal their credentials, log into an account, and leverage this position to find sensitive information.

Hackers Use Protection Strategies for Attack

It’s a recurring theme in sports movies, war stories and crime stories alike: In order to defeat the enemy, one must think like the enemy. This approach has been taken – oftentimes quite successfully – in an array of settings, including the cybersecurity realm.

The Demand for Crimeware-as-a-Service Is Growing

Malware, botnets, phishing and backdoors are all offered on the cheap as subscription. Today’s successful malware writers are remarkable in their ability to adjust not only their technical capabilities to evade the latest security technologies, but also their business practices.

Trend Micro’s Forward-Looking Threat Research Team is Presenting at FIRST

At the FIRST conference in San Juan, Trend Micro’s Forward-looking Threat Research team will be presenting four sessions on a wide range of topics. These sessions will demonstrate a sliver of the research going on at Trend Micro.

National Flight Academy Plans First-of-Its Kind Cybersecurity Camp for Kids

Instead of swimming, surfing or horseback riding, summer camp for some Pensacola-area kids involves sitting in a room filled with computer screens and learning about cybersecurity. Students will practice writing computer code, encrypting messages and thwarting hacking attempts.

Please add your thoughts in the comments below or follow me on Twitter; @JonLClay.

from Trend Micro Simply Security http://ift.tt/2siQgVx

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of June 12, 2017

“What can you sit on, sleep on, and brush your teeth with?” This was the question posed to Steve Martin’s character C.D. Bales in the 1987 movie Roxanne. In a modern take of Edmond Rostand’s 1897 verse play Cyrano de Bergerac, the movie centers around C.D.’s attempt to win the love of a woman while navigating life with his unusually large nose. When C.D. wonders what the point of the question is, his god sister responds, “The point is that sometimes the answer is so obvious, you don’t even realize it. It’s as plain as the nose on your face.” By the way, the answer to the question is so obvious: a chair, a bed, and a toothbrush.

At the Gartner Security and Risk Summit in Washington, D.C., held earlier this week, I heard a recurring theme across the various sessions I attended. The theme was around the fact that the discipline of patching isn’t where it needs to be. As we witnessed with the recent WannaCry ransomware attack, which utilized vulnerabilities that were disclosed by The Shadow Brokers and subsequently patched by Microsoft, many organizations were still affected because they hadn’t patched their systems. The general guidance given at various sessions: Patch your systems. While the answer is so obvious, it may not be practical for some organizations, especially those with thousands of systems. Our solutions can help through the use of “virtual patching.” While virtual patching is a term that is now pretty common in the security world, where we stand out is when vulnerabilities haven’t been patched by the vendor. If a vulnerability comes to us via the Zero Day Initiative, we will have protection for our customers ahead of a patch that’s made available by the vendor. This is even more important if a vulnerability is brought to us for a solution that is no longer supported by the vendor. Interestingly enough, with this month’s Microsoft Patch Tuesday, Microsoft has issued SMB patches for Windows XP, which reached its end of support deadline in April 2014. While Microsoft states that doing this is an exception and not the norm, it could create a false “safety net” for those who haven’t upgraded their systems. The precedent that this might set in the future is an answer that isn’t so obvious.

Microsoft Update

This week’s Digital Vaccine (DV) package includes coverage for Microsoft updates released on or before June 13, 2017. Microsoft released patches for almost 100 new CVEs in Internet Explorer, Edge, Office, Windows, and Skype. A total of 18 of these CVEs are rated Critical. The following table maps Digital Vaccine filters to the Microsoft updates. You can get more detailed information on this month’s security updates from Dustin Childs’ June 2017 Security Update Review from the Zero Day Initiative:

CVE #	Digital Vaccine Filter #	Status
CVE-2017-0173		No Vendor Intelligence Provided
CVE-2017-0193		No Vendor Intelligence Provided
CVE-2017-0215	28628
CVE-2017-0216		No Vendor Intelligence Provided
CVE-2017-0218		No Vendor Intelligence Provided
CVE-2017-0219		No Vendor Intelligence Provided
CVE-2017-0260		No Vendor Intelligence Provided
CVE-2017-0282		No Vendor Intelligence Provided
CVE-2017-0283		No Vendor Intelligence Provided
CVE-2017-0284		No Vendor Intelligence Provided
CVE-2017-0285		No Vendor Intelligence Provided
CVE-2017-0286		No Vendor Intelligence Provided
CVE-2017-0287		No Vendor Intelligence Provided
CVE-2017-0288		No Vendor Intelligence Provided
CVE-2017-0289		No Vendor Intelligence Provided
CVE-2017-0291		No Vendor Intelligence Provided
CVE-2017-0292		No Vendor Intelligence Provided
CVE-2017-0294		No Vendor Intelligence Provided
CVE-2017-0295		No Vendor Intelligence Provided
CVE-2017-0296		Insufficient Vendor Information
CVE-2017-0297		No Vendor Intelligence Provided
CVE-2017-0298		No Vendor Intelligence Provided
CVE-2017-0299		No Vendor Intelligence Provided
CVE-2017-0300		No Vendor Intelligence Provided
CVE-2017-8460		No Vendor Intelligence Provided
CVE-2017-8461		No Vendor Intelligence Provided
CVE-2017-8462		No Vendor Intelligence Provided
CVE-2017-8464	28614
CVE-2017-8465	28616
CVE-2017-8466	28618
CVE-2017-8468	28620
CVE-2017-8469		No Vendor Intelligence Provided
CVE-2017-8470		No Vendor Intelligence Provided
CVE-2017-8471		No Vendor Intelligence Provided
CVE-2017-8472		No Vendor Intelligence Provided
CVE-2017-8473		No Vendor Intelligence Provided
CVE-2017-8474		No Vendor Intelligence Provided
CVE-2017-8475		No Vendor Intelligence Provided
CVE-2017-8476		No Vendor Intelligence Provided
CVE-2017-8477		No Vendor Intelligence Provided
CVE-2017-8478		No Vendor Intelligence Provided
CVE-2017-8479		No Vendor Intelligence Provided
CVE-2017-8480		No Vendor Intelligence Provided
CVE-2017-8481		No Vendor Intelligence Provided
CVE-2017-8482		No Vendor Intelligence Provided
CVE-2017-8483		No Vendor Intelligence Provided
CVE-2017-8484		No Vendor Intelligence Provided
CVE-2017-8485		No Vendor Intelligence Provided
CVE-2017-8487		No Vendor Intelligence Provided
CVE-2017-8488		No Vendor Intelligence Provided
CVE-2017-8489		No Vendor Intelligence Provided
CVE-2017-8490		No Vendor Intelligence Provided
CVE-2017-8491		No Vendor Intelligence Provided
CVE-2017-8492		No Vendor Intelligence Provided
CVE-2017-8493		No Vendor Intelligence Provided
CVE-2017-8494		No Vendor Intelligence Provided
CVE-2017-8496	28613
CVE-2017-8497	28615
CVE-2017-8498		No Vendor Intelligence Provided
CVE-2017-8499		No Vendor Intelligence Provided
CVE-2017-8504		No Vendor Intelligence Provided
CVE-2017-8506		No Vendor Intelligence Provided
CVE-2017-8507		No Vendor Intelligence Provided
CVE-2017-8508		No Vendor Intelligence Provided
CVE-2017-8509	28619
CVE-2017-8510	28621
CVE-2017-8511		No Vendor Intelligence Provided
CVE-2017-8512		No Vendor Intelligence Provided
CVE-2017-8513		No Vendor Intelligence Provided
CVE-2017-8514		No Vendor Intelligence Provided
CVE-2017-8515		No Vendor Intelligence Provided
CVE-2017-8517		No Vendor Intelligence Provided
CVE-2017-8519		No Vendor Intelligence Provided
CVE-2017-8520		No Vendor Intelligence Provided
CVE-2017-8521		No Vendor Intelligence Provided
CVE-2017-8522		No Vendor Intelligence Provided
CVE-2017-8523		No Vendor Intelligence Provided
CVE-2017-8524	28622
CVE-2017-8527		No Vendor Intelligence Provided
CVE-2017-8528		No Vendor Intelligence Provided
CVE-2017-8529		Insufficient Vendor Information
CVE-2017-8530		No Vendor Intelligence Provided
CVE-2017-8531		No Vendor Intelligence Provided
CVE-2017-8532		No Vendor Intelligence Provided
CVE-2017-8533		No Vendor Intelligence Provided
CVE-2017-8534		No Vendor Intelligence Provided
CVE-2017-8543	28629
CVE-2017-8544		No Vendor Intelligence Provided
CVE-2017-8545		No Vendor Intelligence Provided
CVE-2017-8547	28611
CVE-2017-8548		No Vendor Intelligence Provided
CVE-2017-8549		No Vendor Intelligence Provided
CVE-2017-8550		No Vendor Intelligence Provided
CVE-2017-8551		No Vendor Intelligence Provided
CVE-2017-8553		No Vendor Intelligence Provided
CVE-2017-8554		No Vendor Intelligence Provided
CVE-2017-8555		No Vendor Intelligence Provided

Zero-Day Filters

There are 11 new zero-day filters covering three vendors in this week’s Digital Vaccine (DV) package. A number of existing filters in this week’s DV package were modified to update the filter description, update specific filter deployment recommendation, increase filter accuracy and/or optimize performance. You can browse the list of published advisories and upcoming advisories on the Zero Day Initiative website.

Adobe (5)

	28543: ZDI-CAN-4719: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC) 28544: ZDI-CAN-4729: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC) 28546: ZDI-CAN-4730: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC) 28547: ZDI-CAN-4731: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC) 28548: ZDI-CAN-4732: Zero Day Initiative Vulnerability (Adobe Acrobat Pro DC)

Trend Micro (5)

28536: ZDI-CAN-4652: Zero Day Initiative Vulnerability (Trend Micro Mobile Security for Enterprise)
28537: ZDI-CAN-4653: Zero Day Initiative Vulnerability (Trend Micro Mobile Security for Enterprise)
28538: ZDI-CAN-4659: Zero Day Initiative Vulnerability (Trend Micro Mobile Security for Enterprise)
28541: ZDI-CAN-4664: Zero Day Initiative Vulnerability (Trend Micro Mobile Security for Enterprise)
28542: ZDI-CAN-4671,4675: Zero Day Initiative Vulnerability (Trend Micro Mobile Security for Enterprise)

Hewlett Packard Enterprise (1)

	28608: HTTPS: HPE Network Automation RedirectServlet SQL Injection Vulnerability (ZDI-17-331)

Missed Last Week’s News?

Catch up on last week’s news in my weekly recap.

from Trend Micro Simply Security http://ift.tt/2rnaXOB

ZDI-17-411: Foxit Reader JPXDecode stream Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

from ZDI: Published Advisories http://ift.tt/2ttd04o

Google Releases Security Updates for Chrome

Original release date: June 15, 2017

Google has released Chrome version 59.0.3071.104 for Windows, Mac, and Linux. This version addresses several vulnerabilities, including one that an attacker could exploit to cause a denial-of-service condition.

US-CERT encourages users and administrators to review the Chrome Releases page and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.

from US-CERT: The United States Computer Emergency Readiness Team http://ift.tt/2rml720

Mozilla Releases Security Update

Original release date: June 15, 2017

Mozilla has released a security update to address multiple vulnerabilities in Thunderbird. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

US-CERT encourages users and administrators to review the Mozilla Security Advisory for Thunderbird 52.2 and apply the necessary update.

This product is provided subject to this Notification and this Privacy & Use policy.

from US-CERT: The United States Computer Emergency Readiness Team http://ift.tt/2sF7HSu

Linux is secure…right?

“There are no threats for Linux servers. Aren’t they built to be secure?”

“Linux servers are secure and hardened, why do we need additional security controls on those?”

“I do understand there are threats out there but I am not aware of any major attacks on Linux servers”

If you find yourself nodding as you read these statements, you’re not alone.

There is a common belief that Linux servers are more secure and less vulnerable than Windows servers.

Although there is some truth in the belief, the reality is that Linux servers (and the applications they host) also have vulnerabilities and by ignoring this, you are putting your business at unnecessary risk.

Widespread and increasing use

There was a time not too long ago when Linux was a ‘geek’ OS, the domain of command line management and limited enterprise use. Those days are definitely gone, clearly illustrated by things like Gartner pegging the global OS growth for Linux at 13.5%[1], as well as the prevalence of Linux in the public cloud environment, as demonstrated by the fact that approximately 90% of workloads in AWS EC2 are running some variant of Linux. With such widespread use for sensitive enterprise applications, it’s no small wonder that there is an increasing focus on attacking Linux servers, as evidenced in the recent ransomware attack in South Korea that used a Linux-focused ransomware attack called Erebus that impacted the web sites, databases, and multi-media files of 3,400 businesses.

Secure, but still vulnerable

With more and more servers moving beyond the enterprise boundary and into the cloud, network protection at the host-level becomes increasingly important, as workloads need to defend themselves vs. having a perimeter around them. And remember, workloads include the applications that sit on top of Linux…it’s more than just the OS.

Having a host-based Intrusion Prevention System (IPS) will help protect against vulnerabilities in core operating system AND the application stack running on top. Great examples of network-accessible vulnerabilities with wide-spread impacts are the recent Apache Struts-2 issue, Heartbleed and Shellshock, but there are many more. And just because a vulnerability, like Heartbleed, is a couple years old doesn’t mean that applications and servers are not still vulnerable. In a recent Shodan survey, it showed that Heartbleed was still an available vulnerability on more than 180,000 servers around the world, with the majority of them in the US!

[1] Gartner, “Market Share Analysis: Server Operating Systems, Worldwide, 2016”, ID#G00318388, May 26, 2017

If you run a web server on Linux (running on at least 37 percent of the web servers out there according to W3Techs), you need protection against vulnerabilities affecting them, including Apache, Nginx, etc.

	Vulnerabilities Covered in and after 2014 (approx.)	Before 2014 (approx.)	Total
Non-Windows OS and Core Services	80	230	310
Web Servers	114	472	586
Application Servers	255	319	574
Web Console/Management Interfaces	113	453	566
Database Servers	10	218	228
DHCP, FTP, DNS servers	9	82	91

Table 1: Vulnerabilities Protected by Deep Security

It is very important to not confuse vulnerabilities with threats. While there may be fewer known threats for Linux, if you look at the National Vulnerability Database, there are a similar number of vulnerabilities reported for both Linux, and Windows operating systems.

Malware, designed for Linux

Contrary to popular belief, there is a lot of malware for the Linux platform. While the numbers in comparison to Microsoft Windows are not quite as high, there are still tens of thousands of pieces of malware designed for Linux, including the Erebus ransomware mentioned above.

Deploying ONLY anti-malware is inadequate for protecting servers. However, most attacks on datacenters that lead to breach involve the installation of malware as part of the attack chain. This is why compliance and security frameworks such as PCI-DSS (Section #3), SANS CIS Critical Security Controls (Section #8), and NIST Cybersecurity Framework (Section DE.CM-4) all continue to recommend anti-malware as a best practice.

Layered security for Linux workloads

It’s clear that there is no silver bullet when it comes to server security, and that businesses should be using a layered security approach to protect vulnerable Linux workloads. Beyond anti-malware and IPS, there are a number of controls that will help to build a robust Linux strategy:

Application Control: helps ‘lock down’ the Linux host to prevent any unknown process or script from running. This prevents the malware from running in the first place or attackers from taking advantage of backdoors that it might have placed on the server.

Integrity Monitoring: A new threat is likely to make changes to the system somewhere (ports, protocol changes, files), so it’s important to watch for these. Integrity monitoring helps with monitoring the system for any changes outside of an authorized change window, which tend to be few for typical production workloads.

Log Inspection: Scans log files and provides a continuous monitoring process to help identify threats early in the cycle. Attacks like SQL Injection, command injection, attacks against APIs can be seen in the logs and then action taken.

The lesson we learn here is that although Linux is a more secure and reliable operating system option, it’s not your cure-all solution when it comes to security. Like any other OS, some assembly and maintenance is required, and it’s your responsibility to adopt a multi-layered security strategy, including managing regular updates and adding additional security controls to protect the servers AND the applications running on them. To learn more about Linux vulnerabilities and how to protect against them using Trend Micro Deep Security, read our short research paper here.

from Trend Micro Simply Security http://ift.tt/2oHg4qP

Microsoft Edge Scripting Engine Memory Corruption (CVE-2017-8497)

A remote code execution Vulnerability exists in Microsoft Edge. The vulnerability is due to the way JavaScript engine renders when handling objects in memory. A remote unauthenticated attacker could exploit this vulnerability by enticing the target user to open a specially crafted web page.

from Check Point Update Services Advisories http://ift.tt/2sf4Lte

Microsoft Browser Scripting Engine Memory Corruption (CVE-2017-8524)

A remote code execution Vulnerability exists in Microsoft Edge and Internet Explorer 11. The vulnerability is due to the way JavaScript engine renders when handling objects in memory. A remote unauthenticated attacker could exploit this vulnerability by enticing the target user to open a specially crafted web page.

from Check Point Update Services Advisories http://ift.tt/2rvhATm

Microsoft Office Malicious Macros

Microsoft Office files might contain a malicious downloader. A remote attacker could send spam e-mails including those downloaders, and use social engineering in order to convince users to manually enable them. This would allow the malicious code to run and infect the target system.

from Check Point Update Services Advisories http://ift.tt/2rA0FKf

Microsoft Device Guard Code Integrity Policy Security Feature Bypass (CVE-2017-0215)

A security feature bypass vulnerability exists in Microsoft Windows Device Guard. The vulnerability is due to the way Device Guard improperly validates certain elements of a signed PowerShell script. A remote attacker could exploit this vulnerability by enticing a target user to open a specially crafted file.

from Check Point Update Services Advisories http://ift.tt/2s4Y7ax

ZDI-17-410: Novell ZENworks Reporting Appliance Directory Traversal Arbitrary File Creation Vulnerability

This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of Novell ZENworks Reporting Appliance. Authentication is not required to exploit this vulnerability.

from ZDI: Published Advisories http://ift.tt/2s2fp89

ZDI-17-409: Microsoft Windows OTL Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

from ZDI: Published Advisories http://ift.tt/2rYMrX2

ZDI-17-408: Adobe Flash LocaleID determinePreferredLocales Uninitialized Memory Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

from ZDI: Published Advisories http://ift.tt/2rYHQnC

ZDI-17-407: Adobe Flash AuditudeSettings clone Use-After-Free Remote Code Execution Vulnerability

ZDI-17-406: Adobe Flash Profile Use-After-Free Remote Code Execution Vulnerability

ZDI-17-405: Microsoft Windows OTL Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI-17-404: (Pwn2Own) Microsoft Windows NtUserLinkDpiCursor Use-After-Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

from ZDI: Published Advisories http://ift.tt/2rYygRE

ZDI-17-403: (Pwn2Own) Microsoft Windows NtUserLinkDpiCursor Use-After-Free Privilege Escalation Vulnerability

ZDI-17-401: Microsoft Internet Explorer InsertRow Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

from ZDI: Published Advisories http://ift.tt/2rYuFmp