Talos ThreatSource is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week and other security news.
Microsoft Releases Security Bulletins For March 2018
Synopsis: Supply chain attacks are often discussed, but overlooked in terms of how well a business prepares itself for any associated compromise or breach. Last year marked itself as "The Year Of The Supply Chain Attack," and marked a turning point concerning supply chain attacks. Talos was involved in two major campaigns: the MeDoc compromise that paralyzed the Ukraine, and the CCleaner compromise that impacted a reported 2.27 million consumers. In this presentation, we will present these two cases. In both cases, we will present how the attackers modified a legitimate application, and what the result of the modification was. We will explain the attackers’ purpose, and the malware used against the victims. For the MeDoc compromise, we were directly involved in the incident response. We will provide a timeline of the events of what happened before, during and after Nyetya and MeDoc. Concerning the CCleaner compromise, we will provide some data and statistics from the attacker’s database and the profiles of the targeted organizations. In the second part, we will speak globally about supply chain attacks. We will discuss the history of these attacks, and we will finally open the discussion regarding the future of these attacks.
Synopsis: PyREBox is an open-source tool focused on reverse engineering, which provides instrumentation and debugging capabilities on top of the QEMU emulator. It allows you to inspect a running QEMU virtual machine (VM), modify its memory or registers, and instrument its execution with simple Python scripts. It combines whole-system-emulation (QEMU) with VM introspection (Volatility). One of the possible applications of this tool is malware analysis. It allows you to debug any process running on the system, and also to instrument the execution of the VM with simple Python scripts to automate common tasks. In this talk, we will present an overview of PyREBox, how it works internally, and how it compares to other tools. We will explain some of the challenges found in implementing Python-based fine-grained instrumentation and how PyREBox tries to solve them. Finally, we will show you how to take advantage of PyREBox for malware analysis by releasing a set of open-source scripts for PyREBox and IDA Pro.
Description: Microsoft has released its monthly set of security bulletins. This month's release addresses 74 new vulnerabilities with 14 of them rated critical and 59 of them rated important. These vulnerabilities impact Internet Explorer, Edge, Exchange, Scripting Engine, Windows Shell and more.
Description: Adobe has released security bulletins for Flash Player, Dreamweaver and Connect. The Flash Player bulletin addresses 2 critical remote code execution vulnerabilities that manifest as use-after-free and type confusion conditions. The Dreamweaver bulletin addresses a critical, arbitrary OS command injection flaw. And the Connect bulletin addresses an arbitrary file deletion flaw and an information disclosure flaw. Adobe has released software updates that address these vulnerabilities.
Description: Cisco has released a software update that addresses a vulnerability in Cisco Prime Collaboration Provisioning (PCP) software which could allow an unauthenticated, local attacker to log in to the underlying Linux operating system via a hard-coded account password on the system. An attacker could exploit this vulnerability by connecting to the affected system via SSH, gain low level access and elevate to root privilege to take full control of the device.
Description: Samba has released two security advisories that address CVE-2018-1050 and CVE-2018-1057. CVE-2018-1050 is a denial of service vulnerability impacting Samba version 4.0.0 onwards and manifests when the RPC spoolss service is configured to run as an external daemon. CVE-2018-1057 is a security feature bypass flaw also affecting Samba 4.0.0 onward. CVE-2018-1057 manifests due to improper permission validation and could allow authenticated users to change other users' passwords. Samba has released software updates that address these vulnerabilities.
Vulnerability in Robots Can Lead To Costly Ransomware Attacks
https://threatpost.com/vulnerability-in-robots-can-lead-to-costly-ransomware-attacks/130245/
amass - Subdomain Enumeration in Go
https://github.com/caffix/amass
A House of Cards: An Exploration of Security When Building Docker Containers
https://blog.heroku.com/exploration-of-security-when-building-docker-containers
Detecting Attacks that Exploit Meltdown and Spectre with Performance Counters
https://blog.trendmicro.com/trendlabs-security-intelligence/detecting-attacks-that-exploit-meltdown-and-spectre-with-performance-counters/?
AMD investigating chip security flaws after less than 24 hours notice
http://www.zdnet.com/article/amd-investigates-chip-flaws-after-zero-day-research/