#dashboard companion gus!

[terabitweb]

Original Post from Talos Security Author:

Newsletter compiled by Jonathan Munshaw.

Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.

We were packed with vulnerabilities this week. For starters, there’s Microsoft Patch Tuesday, which we’ll cover farther down. We also disclosed a remote code execution bug in Antenna House Rainbow PDF Converter, and two more in Adobe Acrobat Reader. There are also a number of vulnerabilities in the Roav A1 dashboard camera, as well as the chipset it utilizes.

Finally, we also have our weekly Threat Roundup, which you can find on the blog every Friday afternoon. There, we go over the most prominent threats we’ve seen (and blocked) over the past week.

Upcoming public engagements with Talos

Event: Copenhagen Cybercrime Conference

Location: Industriens Hus, Copenhagen, Denmark

Date: May 29

Speaker: Paul Rascagnères

Synopsis: Paul will give an overview of an espionage campaign targeting the Middle East that we called “DNSpionage.” First, he will go over the malware and its targets and then talk about the process the attackers took to direct DNSs. The talk will include a timeline of all events in this attack, including an alert from the U.S. Department of Homeland Security.

Event: Bsides London

Location: ILEC Conference Centre, London, England

Date: June 5

Speaker: Paul Rascagnères

Synopsis: Privacy has become a more public issue over time with the advent of instant messaging and social media. Secure Instant Messaging (SIM) has even become a problem for governments to start worrying about. While many people are using these messaging apps, it’s opened up the door for attackers to create phony, malicious apps that claim to offer the same services. In this talk, Paul will show various examples of these cloned applications and the different techniques used to send data back to the attacker. 

Cyber Security Week in Review

Facebook released an emergency update for WhatsApp after attackers were able to completely take over devices with just a phone call. While many mobile malware families usually require the user to open some sort of file, this vulnerability allowed hackers to infect a device as soon as the user answered a phone call using WhatsApp.

An anonymous Twitter user claims to be selling access to documents stolen in the ransomware attack on Baltimore’s government. Nearly two weeks after the initial infection, many of the city’s online services are still disabled.

Twitter says a bug in its iOS app caused the social media platform to mistakenly leak users’ locations to a yet-to-be-named third party. The vulnerability only affected a small number of iOS users, the company said.

President Donald Trump signed a national emergency this week that bans Chinese tech companies from selling their products in the U.S. While the executive order does not name any specific companies, it is largely thought that the U.S. is specifically targeting Huawei and ZTE.

Google promised to replace all of its Titan security keys after a vulnerability was discovered in its Bluetooth pairing. The bug could allow an attacker to remotely communicate with the device and the device its paired with via Bluetooth.

Europol says it has dismantled the cybercrime group behind the GozNym banking trojan. The international police agency says they’ve charged 10 individuals so far with infecting and stealing money from more than 41,000 victims.

Cisco patched a critical vulnerability in many of its devices that could allow attackers to lock out software updates. The flaw exists in Cisco’s Secure Boot process. 

Apple fixed a variety of bugs in its products as part of its monthly security update. WebKit had the largest number of vulnerabilities, while others exist in Mail and DesktopServices.

Two major Japanese online retailers say they were hit with a cyberattack that allowed attackers to steal shoppers’ information for two weeks. UNIQLO Japan and GU Japan stated that hackers breached their system using a credential-stuffing attack.

Notable recent security issues

Title: Microsoft patches 79 vulnerabilities, 22 critical Description: Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 79 vulnerabilities, 22 of which are rated “critical,” 55 that are considered “important” and one “moderate.” This release also includes two critical advisories: one covering Microsoft Live accounts and another addressing updates to Adobe Flash Player. This month’s security update covers security issues in a variety of Microsoft’s products, including the Scripting Engine, the Microsoft Edge web browser and GDI+.

Snort SIDs: 50014 – 50025

Title: Adobe fixes critical bugs in Flash Player, Acrobat Reader Description: Adobe disclosed 87 vulnerabilities in a variety of its products as part of its monthly security update. The majority of the bugs exist in Adobe Acrobat and Acrobat Reader. There are also critical arbitrary code execution vulnerabilities in Adobe Flash Player and Reader. Snort SIDs: 48293, 48294, 49189, 49190, 49684, 49685

Most prevalent malware files this week

SHA 256: e4cef790c953b769c08472ace6d6f3321851fb701882ebcb76a78a413ed85505 MD5: 2c5d83f7abe17e9ccdd6dcc0622a22aa Typical Filename: $RECYCLE.BIN .scr Claimed Product: N/A Detection Name: Win.Worm.Sality::1201

SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3 MD5: 3a61797cff12598b31443d5bce21e470 Typical Filename: WcInstaller.exe Claimed Product: Web Companion Installer Detection Name: W32.2C8CB61F62-95.SBX.TG

SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510 MD5: 4a50780ddb3db16ebab57b0ca42da0fb Typical Filename: xme64-2141.exe Claimed Product: N/A Detection Name: W32.7ACF71AFA8-95.SBX.TG

SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f MD5: e2ea315d9a83e7577053f52c974f6a5a Typical Filename: Tempmf582901854.exe Claimed Product: N/A Detection Name: W32.AgentWDCR:Gen.21gn.1201

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b MD5: 799b30f47060ca05d80ece53866e01cc Typical Filename: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b.bin Claimed Product: N/A Detection Name: W32.Generic:Gen.22fz.1201

#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: Threat Source newsletter (May 16) Original Post from Talos Security Author: Newsletter compiled by Jonathan Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.

[terabitweb]

Original Post from Talos Security Author:

Newsletter compiled by Jonathan Munshaw.

Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.

We were packed with vulnerabilities this week. For starters, there’s Microsoft Patch Tuesday, which we’ll cover farther down. We also disclosed a remote code execution bug in Antenna House Rainbow PDF Converter, and two more in Adobe Acrobat Reader. There are also a number of vulnerabilities in the Roav A1 dashboard camera, as well as the chipset it utilizes.

Finally, we also have our weekly Threat Roundup, which you can find on the blog every Friday afternoon. There, we go over the most prominent threats we’ve seen (and blocked) over the past week.

Upcoming public engagements with Talos

Event: Copenhagen Cybercrime Conference

Location: Industriens Hus, Copenhagen, Denmark

Date: May 29

Speaker: Paul Rascagnères

Synopsis: Paul will give an overview of an espionage campaign targeting the Middle East that we called “DNSpionage.” First, he will go over the malware and its targets and then talk about the process the attackers took to direct DNSs. The talk will include a timeline of all events in this attack, including an alert from the U.S. Department of Homeland Security.

Event: Bsides London

Location: ILEC Conference Centre, London, England

Date: June 5

Speaker: Paul Rascagnères

Synopsis: Privacy has become a more public issue over time with the advent of instant messaging and social media. Secure Instant Messaging (SIM) has even become a problem for governments to start worrying about. While many people are using these messaging apps, it’s opened up the door for attackers to create phony, malicious apps that claim to offer the same services. In this talk, Paul will show various examples of these cloned applications and the different techniques used to send data back to the attacker. 

Cyber Security Week in Review

Facebook released an emergency update for WhatsApp after attackers were able to completely take over devices with just a phone call. While many mobile malware families usually require the user to open some sort of file, this vulnerability allowed hackers to infect a device as soon as the user answered a phone call using WhatsApp.

An anonymous Twitter user claims to be selling access to documents stolen in the ransomware attack on Baltimore’s government. Nearly two weeks after the initial infection, many of the city’s online services are still disabled.

Twitter says a bug in its iOS app caused the social media platform to mistakenly leak users’ locations to a yet-to-be-named third party. The vulnerability only affected a small number of iOS users, the company said.

President Donald Trump signed a national emergency this week that bans Chinese tech companies from selling their products in the U.S. While the executive order does not name any specific companies, it is largely thought that the U.S. is specifically targeting Huawei and ZTE.

Google promised to replace all of its Titan security keys after a vulnerability was discovered in its Bluetooth pairing. The bug could allow an attacker to remotely communicate with the device and the device its paired with via Bluetooth.

Europol says it has dismantled the cybercrime group behind the GozNym banking trojan. The international police agency says they’ve charged 10 individuals so far with infecting and stealing money from more than 41,000 victims.

Cisco patched a critical vulnerability in many of its devices that could allow attackers to lock out software updates. The flaw exists in Cisco’s Secure Boot process. 

Apple fixed a variety of bugs in its products as part of its monthly security update. WebKit had the largest number of vulnerabilities, while others exist in Mail and DesktopServices.

Two major Japanese online retailers say they were hit with a cyberattack that allowed attackers to steal shoppers’ information for two weeks. UNIQLO Japan and GU Japan stated that hackers breached their system using a credential-stuffing attack.

Notable recent security issues

Title: Microsoft patches 79 vulnerabilities, 22 critical Description: Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 79 vulnerabilities, 22 of which are rated “critical,” 55 that are considered “important” and one “moderate.” This release also includes two critical advisories: one covering Microsoft Live accounts and another addressing updates to Adobe Flash Player. This month’s security update covers security issues in a variety of Microsoft’s products, including the Scripting Engine, the Microsoft Edge web browser and GDI+.

Snort SIDs: 50014 – 50025

Title: Adobe fixes critical bugs in Flash Player, Acrobat Reader Description: Adobe disclosed 87 vulnerabilities in a variety of its products as part of its monthly security update. The majority of the bugs exist in Adobe Acrobat and Acrobat Reader. There are also critical arbitrary code execution vulnerabilities in Adobe Flash Player and Reader. Snort SIDs: 48293, 48294, 49189, 49190, 49684, 49685

Most prevalent malware files this week

SHA 256: e4cef790c953b769c08472ace6d6f3321851fb701882ebcb76a78a413ed85505 MD5: 2c5d83f7abe17e9ccdd6dcc0622a22aa Typical Filename: $RECYCLE.BIN .scr Claimed Product: N/A Detection Name: Win.Worm.Sality::1201

SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3 MD5: 3a61797cff12598b31443d5bce21e470 Typical Filename: WcInstaller.exe Claimed Product: Web Companion Installer Detection Name: W32.2C8CB61F62-95.SBX.TG

SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510 MD5: 4a50780ddb3db16ebab57b0ca42da0fb Typical Filename: xme64-2141.exe Claimed Product: N/A Detection Name: W32.7ACF71AFA8-95.SBX.TG

SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f MD5: e2ea315d9a83e7577053f52c974f6a5a Typical Filename: Tempmf582901854.exe Claimed Product: N/A Detection Name: W32.AgentWDCR:Gen.21gn.1201

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b MD5: 799b30f47060ca05d80ece53866e01cc Typical Filename: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b.bin Claimed Product: N/A Detection Name: W32.Generic:Gen.22fz.1201

#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: Threat Source newsletter (May 16) Original Post from Talos Security Author: Newsletter compiled by Jonathan Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.