Talos ThreatSource is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Apple Releases Security Updates Across Product Portfolio
Synopsis: The modern model of vulnerability mitigation includes robust sandboxing and usermode privilege separation to contain inevitable flaws in the design and implementation of software. As adoption of containment technology spreads to browsers and other software, we see the value of exploits continue to rise as multiple vulnerabilities must be chained together with extreme levels of binary artistry to achieve full system control. As such, there has recently been a high demand to identify kernel vulnerabilities that can bypass sandboxes and process isolation to successfully achieve full system compromise. With this heightened demand, the past few years has seen a massive first wave of kernel vulnerability discovery in the graphics layer of the Windows kernel and the peripheral drivers of the Linux kernel. This lecture will discuss methods for applying evolutionary coverage guided fuzzing to kernel system calls, IOCTLS, and other low level interfaces.
Synopsis: The threat landscape is constantly evolving. As new methods and solutions for combating cyber threats are developed, threat actors will continue to evolve their tactics, techniques, and procedures. This is one of the many reasons that solid threat intelligence is such an essential part of a sound cyber security strategy. There are constantly new threats being faced by organizations globally across virtually every industry. This presentation will provide an overview of the threat landscape, a description of the common types of attacks that are used to compromise organizations, as well as a discussion of the potential impact these attacks can have on business operations. Ransomware, exploit kits, and malicious/phishing email campaigns will be discussed with specific examples provided in an attempt to provide an inside look at what is currently occurring within the threat landscape.
Synopsis: Buzzwords are the bane of the infosec community. Whether it’s “cyber” or “APT”, these terms are often used as nothing more than a way to generate clicks or by marketing teams to push more blinky lights to customers. “Fileless malware” is the latest example of this. Attacks leveraging malware that have been dubbed “fileless malware attacks” have been generating significant media coverage recently leading many to wonder what impact these attacks may have on their organizations or whether they are adequately protected against them. In many cases these attacks are not truly fileless and result in various artifacts being written to targeted systems. In this presentation we will provide a brief history of in-memory malware as well as walk through some specific examples of malware that makes use of this approach to infecting systems. We will also cover why most malware is not actually “fileless”, along with specific examples of threats that make use of interesting persistence mechanisms that do not resemble what many have grown accustomed to seeing from malware.
Description: Apple has releases security updates targeting various devices in its product portfolio such as iOS, macOS, tvOS, Safari, and more. This latest update addresses the "BroadPwn" bug where Broadcom Wi-fi chipsets contained a remote code execution vulnerability on affected devices. In addition, thirteen other arbitrary code execution vulnerabilities were also addressed.
Senator Calls For Use Of DMARC To Curb Phishing
https://threatpost.com/senator-calls-for-use-of-dmarc-to-curb-phishing/126931/
Adobe to Stop Supporting Flash Player in 2020
https://blogs.adobe.com/conversations/2017/07/adobe-flash-update.html
Remote Code Execution Bug Found in Valve's Source SDK; Affects Games
https://oneupsecurity.com/research/remote-code-execution-in-source-games?
EnglishmansDentist Exploit (from Apr 2017 Shadow Brokers Leak) Analysis
https://blogs.technet.microsoft.com/srd/2017/07/20/englishmansdentist-exploit-analysis/
How a Citadel Trojan Developer Got Busted
https://krebsonsecurity.com/2017/07/how-a-citadel-trojan-developer-got-busted/?