Talos ThreatSource is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
WannaCry Ransomware Compromises Hosts Around The World Via Worm-like Activity
Synopsis: Talos is no stranger to APT attacks. During recent research, we observed how APT actors are evolving and how the reconnaissance phase is changing to protect their valuable 0-day exploit or malware frameworks. During the presentation, we will not speak about a specific malware actor but we will use various different cases to illustrate how the reconnaissance phase is becoming more important and more complex. This talk will mainly focus on the usage of malicious documents (Microsoft Office and Hangul Word Processor) and watering hole attacks designed to establish if the target is the intended one. We will mention campaigns against political or military organizations targeting USA, Europa and Asia.
Synopsis: The Internet of Things creates many new opportunities for our personal and professional lives. It also creates new opportunities for criminals to make illicit gain, and for the disaffected to wreak havoc. Recognising that IoT systems will inevitably have vulnerabilities, and will be attacked allows organisations to design systems to be resilient from the beginning rather than to repeat past mistakes and attempt to bolt on security at a later date. In this session, by referring to a simple IoT architecture, we will discuss examples of how attackers have previously attacked systems, and show how good practices can be applied to protect systems.
Subject: Invented by an insane criminal in 1989, ransomware has evolved into a major illicit activity. For the criminal, ransomware presents many advantages over trying to make money from selling stolen data, but also presents a number of challenges. In this presentation, I will start by presenting Talos (our activities, organisation and telemetry). Then, I will present how ransomware has developed over the past 28 years, the techniques used by current malware variants and how criminals seek to overcome the difficulties that they face. And finally, and how we can expect ransomware to develop in the near future.
Synopsis: Cisco's Talos Group specializes in early-warning intelligence and threat analysis necessary for maintaining a secure network. People responsible for defending networks realize that the security threat landscape is constantly in flux as attackers continuously evolve their techniques. Talos advances the overall efficacy of all Cisco security platforms by aggregating data, cooperating with teams of security experts, and applying the cutting-edge big data technology to security. In this talk/webinar, we will perform deep analysis of recent threats Talos has observed over the past quarter and see how Talos leverages large datasets to deliver product improvements and mitigation strategies.
Description: A major ransomware variant known as 'WannaCry' has compromised a large number of hosts around the world in a worm-like manner. WannaCry leverages tools and exploits leaked by the Shadow Brokers to exploit SMBv1 vulnerabilities patched by MS17-010. Damage appears to have been mitigated due to a "kill switch" domain being registered and thus, causing the malware to limit self propagation. Organizations should patch any vulnerable systems as well as block all inbound SMB traffic.
Description: Apple has releases security updates for macOS, iOS, watchOS, tvOS, as well as Safari, iTunes, and iCloud for Windows. These updates resolve 66 vulnerabilities, many of which were demonstrated at the annual Pwn2Own hacking contest. Eleven of the vulnerabilities addressed in iOS could have led to arbitrary code execution via various methods.
Microsoft Releases Security Updates for Out-of-Support Windows XP, Server 2003, and 8 in Response to WannaCry
https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/
ShadowBrokers Planning Monthly Exploit, Data Dump Service
https://threatpost.com/shadowbrokers-planning-monthly-exploit-data-dump-service/125710/
OpenVPN 2.4 Evaluation Summary and Report
https://www.privateinternetaccess.com/blog/2017/05/openvpn-2-4-evaluation-summary-report/
Breach at DocuSign Led to Targeted Email Malware Campaign
https://krebsonsecurity.com/2017/05/breach-at-docusign-led-to-targeted-email-malware-campaign/
Exploiting the Linux kernel via packet sockets
https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html