Talos Threat Source is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Microsoft Releases Monthly Security Updates for September 2017
Synopsis: Buzzwords are the bane of the infosec community. Whether it’s “cyber” or “APT”, these terms are often used as nothing more than a way to generate clicks or by marketing teams to push more blinky lights to customers. “Fileless malware” is the latest example of this. Attacks leveraging malware that have been dubbed “fileless malware attacks” have been generating significant media coverage recently leading many to wonder what impact these attacks may have on their organizations or whether they are adequately protected against them. In many cases these attacks are not truly fileless and result in various artifacts being written to targeted systems. In this presentation we will provide a brief history of in-memory malware as well as walk through some specific examples of malware that makes use of this approach to infecting systems. We will also cover why most malware is not actually “fileless”, along with specific examples of threats that make use of interesting persistence mechanisms that do not resemble what many have grown accustomed to seeing from malware.
Synopsis: The threat environment is in constant flux as defenders adopt improved techniques and attackers adapt their tools, techniques and procedures to counteract these. Sophisticated attackers are already altering their behaviour in order to make their attacks less visible and more likely to blend into the ‘background noise’ of network traffic. From using a genuine government website for command and control traffic, to using software update systems to distribute malicious executables, to ensure that payloads are only delivered to the intended target, threat actors are trying as much as possible to fly under the radar.
Synopsis: What happens when the biggest players in a market just get up and quit? That's exactly what has happened to the exploit kit landscape over the last year. Now that Angler, Neutrino, and Nuclear are gone, we're left to pick up the pieces. What's been created is a vacuum with Rig, Sundown, and others jockeying for position, but none have taken the lead. We've observed adversaries changing kits frequently and gates switching from one kit to the next. Just like any other threat, adversaries are going to evolve and change. Oddly the kits don't appear to have evolved much, but looks can be deceiving. Previously unreleased details on several high profile exploit kits will be disclosed. This talk will discuss the state of exploit kits today. There will also be a section related to how exploit kits will evolve in the future and the impacts it may potentially have on the threat landscape overall.
Synopsis: The threat landscape constantly evolves and changes. Keeping up with what's new and what's evolved can be a challenge. Join us for this free webinar to hear about the latest innovations in threat intelligence from Talos Threat Researchers. After the the presentation, the floor will be opened up for a live Q&A based on questions asked by our audience.
Synopsis: This presentation will show how APT actors are evolving and how the reconnaissance phase is changing to protect their valuable 0-day exploit or malware frameworks. This talk will mainly focus on the usage of Office documents and watering hole attacks designed to establish if the target is the intended one (we will mention campaigns against political or military organizations). The techniques and the obfuscation put in place by these actors will be described in detail (techniques based on Macro, JavaScript, PowerShell, Flash or Python). At the end of the presentation, we will show different mitigations to help attendees protect their users.
Description: Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 81 new vulnerabilities with 27 of them rated critical, 52 rated important, and 2 rated moderate. These vulnerabilities impact Edge, Hyper-V, Internet Explorer, Office, Remote Desktop Protocol, Sharepoint, Windows Graphic Display Interface, Windows Kernel Mode Drivers, and more. Note that the Bluetooth vulnerabilities known as "BlueBorne" that affected Windows have been patched in this latest release. For more information, please refer to CVE-2017-8628.
Description: Adobe has released security bulletins for Flash Player, ColdFusion, and RoboHelp addressing a total of eight vulnerabilities. The Flash Player bulletin addresses two memory corruption vulnerabilities, while the ColdFusion bulletin addresses four vulnerabilities. Two of the ColdFusion flaws are information disclosure bugs while the other two are remote code execution bugs that manifests due to deserialization of untrusted data. The two RoboHelp bugs fixed consist of a DOM-based XSS bug and an open redirect flaw.
Description: Researchers have disclosed several major vulnerabilities in the implementation of Bluetooth stacks across various device platforms. In total, 8 vulnerabilities were disclosed which researchers have dubbed "BlueBorne." The severity of these vulnerabilities ranges from information leaks in Linux to full remote code execution on Apple devices. Patches for each of these vulnerabilities have been developed and are being released or already have been for each of the affected platforms.
Vulnerability Spotlight: TALOS-2017-0430/0431: Multiple Vulnerabilities in FreeXL Library
http://blog.talosintelligence.com/2017/09/vulnerability-spotlight-talos-2017.html
Equifax Hack Exposes Regulatory Gaps, Leaving Consumers Vulnerable
https://www.nytimes.com/2017/09/08/business/equifax.html
FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY
https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html
Introduction to Windows Kernel Driver Exploitation (Pt. 2) - Stack Buffer Overflow to System Shell
https://glennmcgui.re/introduction-to-windows-kernel-driver-exploitation-pt-2/
Reverse Engineering & Exploitation of a "Connected Alarm Clock"
https://courk.fr/index.php/2017/09/10/reverse-engineering-exploitation-connected-clock/