Latest Article

Calling Hawkins Power will give you 'Stranger Things' clues – CNET October 23, 2017

Fans of the Netflix series can call the fictional company Hawkins Power and Light to discover more clues of what may happen in the second season. Source: CNet

Loading images...

SWIFT attackers’ malware linked to more financial attacks

Bank in Philippines was also targeted by attackers, whose malware shares code with tools used by Lazarus group.

Twitter Card Style: 

summary

SWIFT header.jpg

Symantec has found evidence that a bank in the Philippines has also been attacked by the group that stole US$81 million from the Bangladesh central bank and attempted to steal over $1 million from the Tien Phong Bank in Vietnam.

read more

Source: Symantec

Android threats evolve to handle Marshmallow’s new permission model

Android.Bankosy and Android.Cepsohord are capable of working with the new runtime permission model introduced in Android 6.0 Marshmallow.

Twitter Card Style: 

summary

Header-image109.png

read more

Source: Symantec

Hacked Twitter accounts are posting links to adult dating and sex personals

Over 2,500 Twitter accounts were compromised to post links to adult dating and sex personals.

Blog Feature Image: 
Twitter Card Style: 

summary_large_image

More than 2,500 Twitter accounts have been compromised to tweet links to websites specializing in adult dating and sex personals. The attackers also changed the profile photo, biography, and full name of the accounts to promote these sites. It’s likely that the attackers earned money by redirecting users to these sites through affiliate programs.

read more

Source: Symantec

TA16-144A: WPAD Name Collision Vulnerability

Original release date: May 23, 2016 | Last revised: June 01, 2016

Systems Affected

  • Windows, OS X, Linux systems, and web browsers with WPAD enabled
  • Networks using unregistered or unreserved TLDs

Overview

Web Proxy Auto-Discovery (WPAD) Domain Name System (DNS) queries that are intended for resolution on private or enterprise DNS servers have been observed reaching public DNS servers [1]. In combination with the new generic top level domain (gTLD) program’s incorporation of previously undelegated gTLDs for public registration, leaked WPAD queries could result in domain name collisions with internal network naming schemes [2] [3]. Opportunistic domain registrants could abuse these collisions by configuring external proxies for network traffic and enabling man-in-the-middle (MitM) attacks across the Internet.

Description

WPAD is a protocol used to ensure all systems in an organization use the same web proxy configuration. Instead of individually modifying configurations on each device connected to a network, WPAD locates a proxy configuration file and applies the configuration automatically.

The use of WPAD is enabled by default on all Microsoft Windows operating systems and Internet Explorer browsers. WPAD is supported but not enabled by default on Mac OS X and Linux-based operating systems, as well as Safari, Chrome, and Firefox browsers.

With the New gTLD program, previously undelegated gTLD strings are now being delegated for public domain name registration [3]. These strings may be used by private or enterprise networks, and in certain circumstances, such as when a work computer is connected from a home or external network, WPAD DNS queries may be made in error to public DNS servers. Attackers may exploit such leaked WPAD queries by registering the leaked domain and setting up MitM proxy configuration files on the Internet.

Other services (e.g., mail and internal web sites) may also perform DNS queries and attempt to automatically connect to supposedly internal DNS names [4].

Impact

Leaked WPAD queries could result in domain name collisions with internal network naming schemes. If an attacker registers a domain to answer leaked WPAD queries and configures a valid proxy, there is potential to conduct man-in-the-middle (MitM) attacks across the Internet.

The WPAD vulnerability is significant to corporate assets such as laptops. In some cases, these assets are vulnerable even while at work, but observations indicate that most assets become vulnerable when used outside an internal network (e.g., home networks, public Wi-Fi networks).

The impact of other types of leaked DNS queries and connection attempts varies depending on the type of service and its configuration.

Solution

US-CERT encourages users and network administrators to implement the following recommendations to provide a more secure and efficient network infrastructure:

  • Consider disabling automatic proxy discovery/configuration in browsers and operating systems unless those systems will only be used on internal networks.
  • Consider using a registered and fully qualified domain name (FQDN) from global DNS as the root for enterprise and other internal namespace.
  • Consider using an internal TLD that is under your control and restricted from registration with the new gTLD program. Note that there is no assurance that the current list of “Reserved Names” from the new gTLD Applicant Guidebook (AGB) will remain reserved with subsequent rounds of new gTLDs [5].
  • Configure internal DNS servers to respond authoritatively to internal TLD queries.
  • Configure firewalls and proxies to log and block outbound requests for wpad.dat files.
  • Identify expected WPAD network traffic and monitor the public namespace or consider registering domains defensively to avoid future name collisions.
  • File a report with ICANN if your system is suffering demonstrable severe harm due to name collision by visiting https://forms.icann.org/en/help/name-collision/report-problems.

References

Revision History

  • May 23, 2016: Initial Release
  • June 1, 2016: Added information on using TLDs restricted from registration with the gTLD program

This product is provided subject to this Notification and this Privacy & Use policy.

Source: CERT

Thousands of Ubiquiti AirOS routers hit with worm attacks

A worm is exploiting an old vulnerability to spread across Ubiquiti routers running outdated firmware.

Blog Feature Image: 
Twitter Card Style: 

summary

Ubiquiti worm blog.jpg

read more

Source: Symantec

Indian organizations targeted in Suckfly attacks

Suckfly conducted long-term espionage campaigns against government and commercial organizations in India.

Blog Feature Image: 
Twitter Card Style: 

summary

Header_Suckfly.jpg

read more

Source: Symantec

TA16-132A: Exploitation of SAP Business Applications

Original release date: May 11, 2016

Systems Affected

Outdated or misconfigured SAP systems

Overview

At least 36 organizations worldwide are affected by an SAP vulnerability [1]. Security researchers from Onapsis discovered indicators of exploitation against these organizations’ SAP business applications.

The observed indicators relate to the abuse of the Invoker Servlet, a built-in functionality in SAP NetWeaver Application Server Java systems (SAP Java platforms). The Invoker Servlet contains a vulnerability that was patched by SAP in 2010. However, the vulnerability continues to affect outdated and misconfigured SAP systems.

Description

SAP systems running outdated or misconfigured software are exposed to increased risks of malicious attacks.

The Invoker Servlet vulnerability affects business applications running on SAP Java platforms.

SAP Java platforms are the base technology stack for many SAP business applications and technical components, including:

  • SAP Enterprise Resource Planning (ERP),
  • SAP Product Lifecycle Management (PLM),
  • SAP Customer Relationship Management (CRM),
  • SAP Supply Chain Management (SCM),
  • SAP Supplier Relationship Management (SRM),
  • SAP NetWeaver Business Warehouse (BW),
  • SAP Business Intelligence (BI),
  • SAP NetWeaver Mobile Infrastructure (MI),
  • SAP Enterprise Portal (EP),
  • SAP Process Integration (PI),
  • SAP Exchange Infrastructure (XI),
  • SAP Solution Manager (SolMan),
  • SAP NetWeaver Development Infrastructure (NWDI),
  • SAP Central Process Scheduling (CPS),
  • SAP NetWeaver Composition Environment (CE),
  • SAP NetWeaver Enterprise Search,
  • SAP NetWeaver Identity Management (IdM), and
  • SAP Governance, Risk & Control 5.x (GRC).

The vulnerability resides on the SAP application layer, so it is independent of the operating system and database application that support the SAP system.

Impact

Exploitation of the Invoker Servlet vulnerability gives unauthenticated remote attackers full access to affected SAP platforms, providing complete control of the business information and processes on these systems, as well as potential access to other systems.

Solution

In order to mitigate this vulnerability, US-CERT recommends users and administrators implement SAP Security Note 1445998 and disable the Invoker Servlet. For more mitigation details, please review the Onapsis threat report [1].

In addition, US-CERT encourages that users and administrators:

  • Scan systems for all known vulnerabilities, such as missing security patches and dangerous system configurations.
  • Identify and analyze the security settings of SAP interfaces between systems and applications to understand risks posed by these trust relationships.
  • Analyze systems for malicious or excessive user authorizations.
  • Monitor systems for indicators of compromise resulting from the exploitation of vulnerabilities.
  • Monitor systems for suspicious user behavior, including both privileged and non-privileged users.
  • Apply threat intelligence on new vulnerabilities to improve the security posture against advanced targeted attacks.
  • Define comprehensive security baselines for systems and continuously monitor for compliance violations and remediate detected deviations.

These recommendations apply to SAP systems in public, private, and hybrid cloud environments.

Note: The U.S. Government does not endorse or support any particular product or vendor.

References

Revision History

  • May 11, 2016: Initial Release

This product is provided subject to this Notification and this Privacy & Use policy.

Source: CERT

Internet Explorer zero-day exploit used in targeted attacks in South Korea

Microsoft has patched an Internet Explorer zero-day vulnerability (CVE-2016-0189), which was exploited in targeted attacks in South Korea.

Blog Feature Image: 
Twitter Card Style: 

summary

zero day.jpg

read more

Source: Symantec

Microsoft Patch Tuesday – May 2016

This month the vendor is releasing 16 bulletins, eight of which are rated Critical.

Twitter Card Style: 

summary

ms-tuesday-patch-key-concept-white-light 2_11.png

read more

Source: Symantec

Latest Intelligence for April 2016

Our latest intelligence reveals Nuclear exploit kit comprised 42 percent of all web attacks, and 71 percent of all social scams spread through manual sharing.

Blog Feature Image: 
Twitter Card Style: 

summary

Intelligence-page-header02.jpg

read more

Source: Symantec