Talos ThreatSource is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Major macOS Bug Identified That Allows Root Access Without a Password
Synopsis: Email threats have always been a major part of the threat landscape. As the use of exploit kits and other malware distribution techniques have decreased, malicious spam campaigns play an even greater role in the distribution of malware to organizations around the globe. Enter Necurs. Over the past couple of years, Necurs has singlehandedly transformed the email threat landscape and continues to innovate with regards to the distribution of malware downloaders. This talk will take a deep dive on the botnet itself and the ways in which C2 is handled. This includes analysis of some of the major spam campaigns for which it has been responsible. Additionally, we will discuss details of the C2 infrastructure and DGA capabilities we’ve observed over the last several months. We will also cover the modular nature of the Necurs malware itself, and how this multi-faceted threat is capable of generating revenue and damaging organizations without sending a single email.
Synopsis: People responsible for defending networks realize that the security threat landscape is constantly in flux as attackers continuously evolve their techniques. Talos advances the overall efficacy of all Cisco security platforms by aggregating data, cooperating with teams of security experts, and applying the cutting-edge big data technology to security. In this talk, we will perform deep analysis of recent threats Talos has observed over the past quarter and see how Talos leverages large datasets to deliver product improvements and mitigation strategies.
Description: A major bug has been identified in macOS that could allow a user to elevate their privileges to that of root on affected systems. This bug manifests due to macOS allowing users to login to the root account if a password has not been set for it. This bug appears to only affect macOS High Sierra. Apple has released a statement that a software update is in the process of being developed. Apple has also released guidance on how to disable and set a root password to mitigate the issue.
Description: A remote denial-of-service vulnerability has been identified in systemd that could cause affected systems to hang if exploited. This vulnerability, assigned CVE-2017-15908, manifests in the DNS resolver within systemd. Exploitation of this vulnerability is achievable if the DNS resolver receives a specially crafted response to a DNS query. Software updates that address this vulnerability have been developed and are available for affected Linux distributions.
Uber Reveals 2016 Breach of 57 Million User Accounts
https://threatpost.com/uber-reveals-breach-of-57-million-users-admits-to-covering-up-incident/128969/
Using DNS to Break Out of Isolated Networks in a AWS Cloud Environment
https://dejandayoff.com/using-dns-to-break-out-of-isolated-networks-in-a-aws-cloud-environment/
Kernel Exploit Demo - Windows 10 privesc via WARBIRD
https://blog.xpnsec.com/windows-warbird-privesc/
Don’t Feed Them After Midnight: Reverse-Engineering the Furby Connect
https://www.contextis.com/blog/dont-feed-them-after-midnight-reverse-engineering-the-furby-connect
Using Burp Suite’s Collaborator to Find the True IP Address for a .Onion Hidden Service
http://digitalforensicstips.com/2017/11/using-burp-suites-collaborator-to-find-the-true-ip-address-for-a-onion-hidden-service/
ROKRAT Reloaded
http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html?f_l=s