Talos ThreatSource is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Two Zero-Day Vulnerabilities In Foxit Reader and PhantomPDF Disclosed; Foxit Developing Patches
Synopsis: Buzzwords are the bane of the infosec community. Whether it’s “cyber” or “APT”, these terms are often used as nothing more than a way to generate clicks or by marketing teams to push more blinky lights to customers. “Fileless malware” is the latest example of this. Attacks leveraging malware that have been dubbed “fileless malware attacks” have been generating significant media coverage recently leading many to wonder what impact these attacks may have on their organizations or whether they are adequately protected against them. In many cases these attacks are not truly fileless and result in various artifacts being written to targeted systems. In this presentation we will provide a brief history of in-memory malware as well as walk through some specific examples of malware that makes use of this approach to infecting systems. We will also cover why most malware is not actually “fileless”, along with specific examples of threats that make use of interesting persistence mechanisms that do not resemble what many have grown accustomed to seeing from malware.
Synopsis: What happens when the biggest players in a market just get up and quit? That's exactly what has happened to the exploit kit landscape over the last year. Now that Angler, Neutrino, and Nuclear are gone, we're left to pick up the pieces. What's been created is a vacuum with Rig, Sundown, and others jockeying for position, but none have taken the lead. We've observed adversaries changing kits frequently and gates switching from one kit to the next. Just like any other threat, adversaries are going to evolve and change. Oddly the kits don't appear to have evolved much, but looks can be deceiving. Previously unreleased details on several high profile exploit kits will be disclosed. This talk will discuss the state of exploit kits today. There will also be a section related to how exploit kits will evolve in the future and the impacts it may potentially have on the threat landscape overall.
Synopsis: This presentation will show how APT actors are evolving and how the reconnaissance phase is changing to protect their valuable 0-day exploit or malware frameworks. This talk will mainly focus on the usage of Office documents and watering hole attacks designed to establish if the target is the intended one (we will mention campaigns against political or military organizations). The techniques and the obfuscation put in place by these actors will be described in detail (techniques based on Macro, JavaScript, PowerShell, Flash or Python). At the end of the presentation, we will show different mitigations to help attendees protect their users.
Description: The Zero Day Initiative has disclosed a pair of vulnerabilities in Foxit Reader and PhantomPDF that could be used to execute arbitrary code on vulnerable systems. These flaws, identified as CVE-2017-10951 and CVE-2017-10952, manifest due to insufficient validation of user-supplied data, resulting in command injection and file write conditions respectively. Foxit has acknowledged these vulnerabilities and has indicated that are developing patches for both flaws despite initially disregarding them due to miscommunication.
Description: Drupal has released a maintenance update containing fixes for three access bypass vulnerabilities. Two of the vulnerabilities (CVE-2017-6923, CVE-2017-6924) are "moderately critical" and affect Views and the REST API. The remaining vulnerability (CVE-2017-6925) is "critical" and affects the entity access system which "could allow unwanted access to view, create, update, or delete entities." The three vulnerabilities are addressed in Drupal 8.3.7.
Description: Cisco has released a security advisory for its Application Policy Infrastructure Controller (APIC) to address CVE-2017-6767. CVE-2017-6767 is a privilege escalation vulnerability which manifests as a limitation in how the Role-Based Access Control (RBAC) "grants privileges to remotely authenticated users when login occurs via SSH directly to the local management interface." As a result, a remote, authenticated attacker could elevate their privileges to that of the user who last logged in. Note that the attacker cannot obtain root privileges. Cisco has released a software update that addresses this vulnerability.
Hacker Publishes iOS Secure Enclave Firmware Decryption Key
https://threatpost.com/hacker-publishes-ios-secure-enclave-firmware-decryption-key/127524/
Solving a Danish Defense Intelligence Puzzle
https://safiire.github.io/blog/2017/08/19/solving-danish-defense-intelligence-puzzle/
Login bypass in Ubiquiti airMAX/airOS before 8.0.2, 7.2.5, 6.0.2, 5.6.15 if airControl web-UI was used (Patched 2017-03-28)
http://www.nicksherlock.com/2017/08/login-bypass-in-ubiquiti-airmax-airos-if-aircontrol-web-ui-was-used/
How I Accidentally Framed Myself for a Hacking Frenzy
http://blog.portswigger.net/2017/08/how-i-accidentally-framed-myself-for.html
Booters with Chinese Characteristics: The Rise of Chinese Online DDoS Platforms
http://blog.talosintelligence.com/2017/08/chinese-online-ddos-platforms.html?f_l=s