Talos ThreatSource is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Google Releases Monthly Security Bulletin for Android; 39 Vulnerabilities Addressed
Synopsis: Supply chain attacks are often discussed, but overlooked in terms of how well a business prepares itself for any associated compromise or breach. Last year marked itself as "The Year Of The Supply Chain Attack" and marked a turning point concerning supply chain attacks. Talos was involved in two major campaigns: the MeDoc compromise that paralyzed the Ukraine, and the CCleaner compromise that impacted a reported 2.27 million consumers. In this presentation, we will present these two cases. In both cases, we will present how the attackers modified a legitimate application, and what the result of the modification was. We will explain the attackers’ purpose, and the malware used against the victims. For the MeDoc compromise, we were directly involved in the incident response. We will provide a timeline of the events of what happened before, during and after Nyetya and MeDoc. Concerning the CCleaner compromise, we will provide some data and statistics from the attacker’s database and the profiles of the targeted organizations. In the second part, we will speak globally about supply chain attacks. We will discuss the history of these attacks, and we will finally open the discussion regarding the future of these attacks.
Synopsis: PyREBox is an open-source tool focused on reverse engineering, which provides instrumentation and debugging capabilities on top of the QEMU emulator. It allows you to inspect a running QEMU virtual machine (VM), modify its memory or registers, and instrument its execution with simple Python scripts. It combines whole-system-emulation (QEMU) with VM introspection (Volatility). One of the possible applications of this tool is malware analysis. It allows you to debug any process running on the system, and also to instrument the execution of the VM with simple Python scripts to automate common tasks. In this talk, we will present an overview of PyREBox, how it works internally, and how it compares to other tools. We will explain some of the challenges found in implementing Python-based fine-grained instrumentation and how PyREBox tries to solve them. Finally, we will show you how to take advantage of PyREBox for malware analysis by releasing a set of open-source scripts for PyREBox and IDA Pro.
Description: Google has released its monthly security bulletin for Android to address 37 vulnerabilities that have been identified. This month's bulletin release addresses 11 critical vulnerabilities and 26 high-severity vulnerabilities. The 2018-03-01 security patch level contains fixes for the Media framework and Android System, while the 2018-03-05 security patch level fixes bugs in the kernel, Qualcomm and nVidia components. Updates have been published for Nexus and Pixel devices. Android partners should be in the process of integrating these updates and pushing them out in the near future for other Android handsets.
Description: Hewlett Packard Enterprise has released a security bulletin for a denial-of-service (DoS) vulnerability in HPE Integrated Lights-Out 3 (iLO 3). This vulnerability, identified as CVE-2017-8987, could be exploited by a remote, unauthenticated attacker and impacts HPE iLO 3 version 1.88. HPE has released a software update to address this vulnerability.
How to Fight Mobile Number Port-out Scams
https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/
VMware Exploitation Through Uninitialized Buffers
https://www.zerodayinitiative.com/blog/2018/3/1/vmware-exploitation-through-uninitialized-buffers
Memcrashed - Major amplification attacks from UDP port 11211
https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/
Gaining Domain Admin from Outside Active Directory
https://markitzeroday.com/pass-the-hash/crack-map-exec/2018/03/04/da-from-outside-the-domain.html
Trustico website goes dark after someone drops critical flaw on Twitter
https://arstechnica.com/information-technology/2018/03/trustico-website-goes-dark-after-someone-drops-critical-flaw-on-twitter/
Intel Releases Updated Spectre Fixes For Broadwell and Haswell Chips
https://threatpost.com/intel-releases-updated-spectre-fixes-for-broadwell-and-haswell-chips/130144/