Talos ThreatSource is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Researcher Discloses Several Zero Day Vulnerabilities in AT&T Modems/Residential Gateways
Synopsis: Buzzwords are the bane of the infosec community. Whether it’s “cyber” or “APT”, these terms are often used as nothing more than a way to generate clicks or by marketing teams to push more blinky lights to customers. “Fileless malware” is the latest example of this. Attacks leveraging malware that have been dubbed “fileless malware attacks” have been generating significant media coverage recently leading many to wonder what impact these attacks may have on their organizations or whether they are adequately protected against them. In many cases these attacks are not truly fileless and result in various artifacts being written to targeted systems. In this presentation we will provide a brief history of in-memory malware as well as walk through some specific examples of malware that makes use of this approach to infecting systems. We will also cover why most malware is not actually “fileless”, along with specific examples of threats that make use of interesting persistence mechanisms that do not resemble what many have grown accustomed to seeing from malware.
Synopsis: The threat environment is in constant flux as defenders adopt improved techniques and attackers adapt their tools, techniques and procedures to counteract these. Sophisticated attackers are already altering their behaviour in order to make their attacks less visible and more likely to blend into the ‘background noise’ of network traffic. From using a genuine government website for command and control traffic, to using software update systems to distribute malicious executables, to ensure that payloads are only delivered to the intended target, threat actors are trying as much as possible to fly under the radar.
Synopsis: What happens when the biggest players in a market just get up and quit? That's exactly what has happened to the exploit kit landscape over the last year. Now that Angler, Neutrino, and Nuclear are gone, we're left to pick up the pieces. What's been created is a vacuum with Rig, Sundown, and others jockeying for position, but none have taken the lead. We've observed adversaries changing kits frequently and gates switching from one kit to the next. Just like any other threat, adversaries are going to evolve and change. Oddly the kits don't appear to have evolved much, but looks can be deceiving. Previously unreleased details on several high profile exploit kits will be disclosed. This talk will discuss the state of exploit kits today. There will also be a section related to how exploit kits will evolve in the future and the impacts it may potentially have on the threat landscape overall.
Synopsis: This presentation will show how APT actors are evolving and how the reconnaissance phase is changing to protect their valuable 0-day exploit or malware frameworks. This talk will mainly focus on the usage of Office documents and watering hole attacks designed to establish if the target is the intended one (we will mention campaigns against political or military organizations). The techniques and the obfuscation put in place by these actors will be described in detail (techniques based on Macro, JavaScript, PowerShell, Flash or Python). At the end of the presentation, we will show different mitigations to help attendees protect their users.
Description: Joseph Hutchins of Nomotion has identified several zero day vulnerabilities affecting AT&T modems/residential gateways that could allow an attacker to perform a variety of different actions. These actions include remotely log into affected devices, gather sensitive information with respect to a network behind the affected device, perform command injection on the affected device, or bypassing the firewall of the modem/residential gateway to directly connect to a device. Given the "trivial" nature these vulnerabilities could be exploited, these flaws were disclosed without notification to Arris or AT&T as Hutchins believes there's "no way people are not exploiting this in the wild".
Description: Security researchers at lgtm.com have identified a critical vulnerability in Apache Struts that could allow a remote attacker to execute arbitrary code on vulnerable hosts. This vulnerability, identified as CVE-2017-9805, manifests due to the way Struts deserializes untrusted data. This vulnerability affects "all web applications using the framework’s popular REST plugin" since 2008. Administrators are strongly urged to update their Struts installations to 2.5.13. In the event it's not possible to immediately update, it is suggested to remove the Struts REST plugin or to limit it to server normal pages and JSONs only.
Description: Siemens has released a security advisory and software update for a pair of vulnerabilities that were identified in its LOGO! 8 BM devices. These vulnerabilities, identified by Maxim Rupp -- an independent researcher, could allow an attacker to hijack an active user session or to perform man-in-the-middle attacks between LOGO! BM devices and other devices. While an updated firmware image (version 1.81.2) which addresses the session hijacking flaw has been released, Siemens has issued guidance to mitigate the impact of the man-in-the-middle vulnerability.
Analyzing the 320 million hashes released by Troy Hunt, founder of "Have I been pwned?"
https://cynosureprime.blogspot.fi/2017/08/320-million-hashes-exposed.html
Detecting debuggers by abusing a bad assumption within Windows
http://www.triplefault.io/2017/08/detecting-debuggers-by-abusing-bad.html
Graftor - But I Never Asked for This…
http://blog.talosintelligence.com/2017/09/graftor-but-i-never-asked-for-this.html?f_l=s
Abusing A Writable Windows Service
https://blog.didierstevens.com/2017/09/05/abusing-a-writable-windows-service/
Four Million Time Warner Cable Records Left on Misconfigured AWS S3
https://threatpost.com/four-million-time-warner-cable-records-left-on-misconfigured-aws-s3/127807/