Talos ThreatSource is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Cisco Discloses Remote Code Execution Vulnerability in SSL VPN Functionality of ASAs
Synopsis: Cisco's Talos team specializes in early-warning intelligence and threat analysis necessary for maintaining a secure network. People responsible for defending networks realize that the security threat landscape is constantly in flux as attackers evolve their skills. Talos advances the overall efficacy of all Cisco security platforms by aggregating data, cooperating with teams of security experts, and applying the cutting-edge big data technology to security. In this talk we will perform deep analysis of recent threats and see how Talos leverages large datasets to deliver product improvements and mitigation strategies.
Synopsis: Cisco's Talos team specializes in early-warning intelligence and threat analysis necessary for maintaining a secure network. People responsible for defending networks realize that the security threat landscape is constantly in flux as attackers evolve their skills. Talos advances the overall efficacy of all Cisco security platforms by aggregating data, cooperating with teams of security experts, and applying the cutting-edge big data technology to security. In this talk we will perform deep analysis of recent threats and see how Talos leverages large datasets to deliver product improvements and mitigation strategies.
Synopsis: Supply chain attacks are often long thought about and often overlooked in terms of how well a business prepares itself for any associated compromise or breach. 2017 has truly marked itself as ‘The Year Of The Supply Chain Attack’ and marked a turning point concerning supply chain attacks. Talos was involved in two major campaigns: MeDoc compromise that paralyzed the Ukraine and CCleaner compromise that impacted a reported 2.27M consumers. In this presentation we will firstly present these two cases. In both cases, we will present how the attackers modified a legitimate application and what was the result of the modification. We will explain the purpose of the attackers and the malware used against the victims. For the MeDoc compromise, we were directly involved in the incident response and we will provide a timeline of the events to give an idea of the before, during and after picture associated with Nyetya and MeDoc. Concerning the CCleaner compromise, we will provide some data and statistics from the attacker’s database and the profiles of the targeted organizations. In a second part, we will speak globally about supply chain attacks. We will remember that it’s not the first time in the history that this kind of attacks occurred and we will finally open the discussion on the future of this attacks.
Description: Cisco has released a security advisory to address CVE-2018-0101, a remote code execution vulnerability identified in the SSL VPN functionality of Cisco Adaptive Security Appliances (ASAs). The vulnerability, identified by Cedric Halbronn from the NCC Group, manifests as a double-free condition that can be triggered when the SSL VPN improperly handles XML packets. Cisco has released free software updates that address this vulnerability.
Description: Lenovo has released a security advisory, addressing a vulnerability that has been identified in Fingerprint Manager Pro. This vulnerability, assigned CVE-2017-3762, impacts systems where sensitive data stored by Fingerprint Manager Pro is "encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system it is installed in." Lenovo notes that this vulnerability only affects Windows 7, Windows 8, and Windows 8.1 systems. Windows 10 systems are not vulnerable. Lenovo has released a software update addressing these issues for affected systems.
Microsoft to classify software containing coercive messaging as unwanted software
https://cloudblogs.microsoft.com/microsoftsecure/2018/01/30/protecting-customers-from-being-intimidated-into-making-an-unnecessary-purchase/
How to Hack a Turned-off Computer, or Running Unsigned Code in Intel ME
http://blog.ptsecurity.com/2018/01/running-unsigned-code-in-intel-me.html
A Deep Dive Analysis of Microsoft’s Kernel Virtual Address Shadow Feature
https://blog.fortinet.com/2018/01/25/a-deep-dive-analysis-of-microsoft-s-kernel-virtual-address-shadow-feature
Malware Reversing - Burpsuite Keygen
https://0x00sec.org/t/malware-reversing-burpsuite-keygen/5167
Strava Fitness App Can Reveal Military Sites, Analysts Say
https://www.nytimes.com/2018/01/29/world/middleeast/strava-heat-map.html
Talos Blog: Vulnerability Spotlight: Walt Disney Per-Face Texture Mapping faceInfoSize Code Execution Vulnerability
http://blog.talosintelligence.com/2018/01/ptex-rce-vuln.html
Talos Blog: 2017 in Snort Signatures
http://blog.talosintelligence.com/2018/01/2017-in-snort-signatures.html