SWIFT attackers’ malware linked to more financial attacks
Written by May 26, 2016, 1:10 pm
No Comment • Related Topics: General
Bank in Philippines was also targeted by attackers, whose malware shares code with tools used by Lazarus group.
Twitter Card Style:
summary
Symantec has found evidence that a bank in the Philippines has also been attacked by the group that stole US$81 million from the Bangladesh central bank and attempted to steal over $1 million from the Tien Phong Bank in Vietnam.
Source: Symantec
Android threats evolve to handle Marshmallow’s new permission model
Written by May 26, 2016, 8:58 am
No Comment • Related Topics: General
Android.Bankosy and Android.Cepsohord are capable of working with the new runtime permission model introduced in Android 6.0 Marshmallow.
Twitter Card Style:
summary
Source: Symantec
Hacked Twitter accounts are posting links to adult dating and sex personals
Written by May 23, 2016, 11:05 pm
No Comment • Related Topics: General
Over 2,500 Twitter accounts were compromised to post links to adult dating and sex personals.
Blog Feature Image:
Twitter Card Style:
summary_large_image
More than 2,500 Twitter accounts have been compromised to tweet links to websites specializing in adult dating and sex personals. The attackers also changed the profile photo, biography, and full name of the accounts to promote these sites. It’s likely that the attackers earned money by redirecting users to these sites through affiliate programs.
Source: Symantec
TA16-144A: WPAD Name Collision Vulnerability
Written by May 23, 2016, 7:38 am
No Comment • Related Topics: General
Original release date: May 23, 2016 | Last revised: June 01, 2016
Systems Affected
- Windows, OS X, Linux systems, and web browsers with WPAD enabled
- Networks using unregistered or unreserved TLDs
Overview
Web Proxy Auto-Discovery (WPAD) Domain Name System (DNS) queries that are intended for resolution on private or enterprise DNS servers have been observed reaching public DNS servers [1]. In combination with the new generic top level domain (gTLD) program’s incorporation of previously undelegated gTLDs for public registration, leaked WPAD queries could result in domain name collisions with internal network naming schemes [2] [3]. Opportunistic domain registrants could abuse these collisions by configuring external proxies for network traffic and enabling man-in-the-middle (MitM) attacks across the Internet.
Description
WPAD is a protocol used to ensure all systems in an organization use the same web proxy configuration. Instead of individually modifying configurations on each device connected to a network, WPAD locates a proxy configuration file and applies the configuration automatically.
The use of WPAD is enabled by default on all Microsoft Windows operating systems and Internet Explorer browsers. WPAD is supported but not enabled by default on Mac OS X and Linux-based operating systems, as well as Safari, Chrome, and Firefox browsers.
With the New gTLD program, previously undelegated gTLD strings are now being delegated for public domain name registration [3]. These strings may be used by private or enterprise networks, and in certain circumstances, such as when a work computer is connected from a home or external network, WPAD DNS queries may be made in error to public DNS servers. Attackers may exploit such leaked WPAD queries by registering the leaked domain and setting up MitM proxy configuration files on the Internet.
Other services (e.g., mail and internal web sites) may also perform DNS queries and attempt to automatically connect to supposedly internal DNS names [4].
Impact
Leaked WPAD queries could result in domain name collisions with internal network naming schemes. If an attacker registers a domain to answer leaked WPAD queries and configures a valid proxy, there is potential to conduct man-in-the-middle (MitM) attacks across the Internet.
The WPAD vulnerability is significant to corporate assets such as laptops. In some cases, these assets are vulnerable even while at work, but observations indicate that most assets become vulnerable when used outside an internal network (e.g., home networks, public Wi-Fi networks).
The impact of other types of leaked DNS queries and connection attempts varies depending on the type of service and its configuration.
Solution
US-CERT encourages users and network administrators to implement the following recommendations to provide a more secure and efficient network infrastructure:
- Consider disabling automatic proxy discovery/configuration in browsers and operating systems unless those systems will only be used on internal networks.
- Consider using a registered and fully qualified domain name (FQDN) from global DNS as the root for enterprise and other internal namespace.
- Consider using an internal TLD that is under your control and restricted from registration with the new gTLD program. Note that there is no assurance that the current list of “Reserved Names” from the new gTLD Applicant Guidebook (AGB) will remain reserved with subsequent rounds of new gTLDs [5].
- Configure internal DNS servers to respond authoritatively to internal TLD queries.
- Configure firewalls and proxies to log and block outbound requests for wpad.dat files.
- Identify expected WPAD network traffic and monitor the public namespace or consider registering domains defensively to avoid future name collisions.
- File a report with ICANN if your system is suffering demonstrable severe harm due to name collision by visiting https://forms.icann.org/en/help/name-collision/report-problems.
References
- [1] Verisign – MitM Attack by Name Collision: Cause Analysis and Vulnerability Assessment in the New gTLD Era
- [2] ICANN – Name Collision Resources & Information
- [3] ICANN – New gTLDs
- [4] US-CERT – Controlling Outbound DNS Access
- [5] ICANN – gTLD Applicant Guidebook
Revision History
- May 23, 2016: Initial Release
- June 1, 2016: Added information on using TLDs restricted from registration with the gTLD program
This product is provided subject to this Notification and this Privacy & Use policy.
Source: CERT
Thousands of Ubiquiti AirOS routers hit with worm attacks
Written by May 19, 2016, 6:47 pm
No Comment • Related Topics: General
A worm is exploiting an old vulnerability to spread across Ubiquiti routers running outdated firmware.
Blog Feature Image:
Twitter Card Style:
summary
Source: Symantec
Indian organizations targeted in Suckfly attacks
Written by May 17, 2016, 8:59 am
No Comment • Related Topics: General
Suckfly conducted long-term espionage campaigns against government and commercial organizations in India.
Blog Feature Image:
Twitter Card Style:
summary
Source: Symantec
TA16-132A: Exploitation of SAP Business Applications
Written by May 11, 2016, 7:31 am
No Comment • Related Topics: General
Original release date: May 11, 2016
Systems Affected
Outdated or misconfigured SAP systems
Overview
At least 36 organizations worldwide are affected by an SAP vulnerability [1]. Security researchers from Onapsis discovered indicators of exploitation against these organizations’ SAP business applications.
The observed indicators relate to the abuse of the Invoker Servlet, a built-in functionality in SAP NetWeaver Application Server Java systems (SAP Java platforms). The Invoker Servlet contains a vulnerability that was patched by SAP in 2010. However, the vulnerability continues to affect outdated and misconfigured SAP systems.
Description
SAP systems running outdated or misconfigured software are exposed to increased risks of malicious attacks.
The Invoker Servlet vulnerability affects business applications running on SAP Java platforms.
SAP Java platforms are the base technology stack for many SAP business applications and technical components, including:
- SAP Enterprise Resource Planning (ERP),
- SAP Product Lifecycle Management (PLM),
- SAP Customer Relationship Management (CRM),
- SAP Supply Chain Management (SCM),
- SAP Supplier Relationship Management (SRM),
- SAP NetWeaver Business Warehouse (BW),
- SAP Business Intelligence (BI),
- SAP NetWeaver Mobile Infrastructure (MI),
- SAP Enterprise Portal (EP),
- SAP Process Integration (PI),
- SAP Exchange Infrastructure (XI),
- SAP Solution Manager (SolMan),
- SAP NetWeaver Development Infrastructure (NWDI),
- SAP Central Process Scheduling (CPS),
- SAP NetWeaver Composition Environment (CE),
- SAP NetWeaver Enterprise Search,
- SAP NetWeaver Identity Management (IdM), and
- SAP Governance, Risk & Control 5.x (GRC).
The vulnerability resides on the SAP application layer, so it is independent of the operating system and database application that support the SAP system.
Impact
Exploitation of the Invoker Servlet vulnerability gives unauthenticated remote attackers full access to affected SAP platforms, providing complete control of the business information and processes on these systems, as well as potential access to other systems.
Solution
In order to mitigate this vulnerability, US-CERT recommends users and administrators implement SAP Security Note 1445998 and disable the Invoker Servlet. For more mitigation details, please review the Onapsis threat report [1].
In addition, US-CERT encourages that users and administrators:
- Scan systems for all known vulnerabilities, such as missing security patches and dangerous system configurations.
- Identify and analyze the security settings of SAP interfaces between systems and applications to understand risks posed by these trust relationships.
- Analyze systems for malicious or excessive user authorizations.
- Monitor systems for indicators of compromise resulting from the exploitation of vulnerabilities.
- Monitor systems for suspicious user behavior, including both privileged and non-privileged users.
- Apply threat intelligence on new vulnerabilities to improve the security posture against advanced targeted attacks.
- Define comprehensive security baselines for systems and continuously monitor for compliance violations and remediate detected deviations.
These recommendations apply to SAP systems in public, private, and hybrid cloud environments.
Note: The U.S. Government does not endorse or support any particular product or vendor.
References
- [1] Onapsis Threat Report: Wild Exploitation & Cyber-Attacks on SAP Business Applications
- [2] SAP: Invoker Servlet
Revision History
- May 11, 2016: Initial Release
This product is provided subject to this Notification and this Privacy & Use policy.
Source: CERT
Internet Explorer zero-day exploit used in targeted attacks in South Korea
Written by May 10, 2016, 3:37 pm
No Comment • Related Topics: General
Microsoft Patch Tuesday – May 2016
Written by May 10, 2016, 2:59 pm
No Comment • Related Topics: General
This month the vendor is releasing 16 bulletins, eight of which are rated Critical.
Twitter Card Style:
summary
Source: Symantec
Latest Intelligence for April 2016
Written by May 6, 2016, 10:56 am
No Comment • Related Topics: General
Our latest intelligence reveals Nuclear exploit kit comprised 42 percent of all web attacks, and 71 percent of all social scams spread through manual sharing.
Blog Feature Image:
Twitter Card Style:
summary
Source: Symantec
Malware may abuse Android’s accessibility service to bypass security enhancements
Written by May 4, 2016, 8:55 am
No Comment • Related Topics: General
Mobile financial malware authors may borrow tricks from adware by using Android’s accessibility service to circumvent OS improvements.
Twitter Card Style:
summary
Source: Symantec
