CONTENTS:

NOTABLE RECENT SECURITY ISSUES
INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY
VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
MOST PREVALENT MALWARE FILES December 12 - 19, 2019
TOP VULNERABILITY THIS WEEK: Zeppelin ransomware spreads to U.S., Europe

NOTABLE RECENT SECURITY ISSUES
SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: New malware-as-a-service family targets tech, health care companies
Description: The new Zeppelin malware is targeting health care and tech companies in the U.S. and Europe. Researchers believe Zeppelin is a variant of the ransomware-as-a-service family known as Vega. While Vega started out earlier this year targeting Russian-speaking victims, researchers believe the malware could be in a new adversaries’ hands now that they are targeting users elsewhere. Zeppelin is highly configurable and can be deployed as an EXE, DLL, or wrapped in a PowerShell loader.
Reference: https://threatvector.cylance.com/en_us/home/zeppelin-russian-ransomware-targets-high-profile-users-in-the-us-and-europe.html
Snort SIDs: 52451 - 52453 (By Nicholas Mavis)

Title: Gamaredon attacks spread to Ukrainian journalists, law enforcement agencies
Description: A well-known APT is expanding its pool of targets, now going after journalists and law enforcement agencies in Ukraine. The group, which is believed to have Russian ties based on the language used in their malware, previously went after Ukrainian military and government agencies. There are also new TTPs associated with this group, including the use template injection in their malware.
Reference: https://www.anomali.com/files/white-papers/Anomali_Threat_Research-Gamaredon_TTPs_Target_Ukraine-WP.pdf
Snort SIDs: 52445 - 52448 (By Joanne Kim)

INTERESTING NEWS FROM AROUND THE SECURITY COMMUNITY

GSuite users will soon no longer be able to use apps Google considers “less secure,” and only apps with OAuth Tokens will be allowed.
https://ww.9to5google.com/2019/12/17/g-suite-less-secure-apps/

Congress is close to approving $425 million in spending to improve America’s election security, the largest influx of money to the U.S.’s voting systems since the 2016 presidential election.
https://www.cnn.com/2019/12/16/politics/congress-425-million-election-security-2019/index.html

Iran says it thwarted a major cyber attack last week, but if its claims are true, it would establish the country as a major cyber warfare threat.
https://www.forbes.com/sites/kateoflahertyuk/2019/12/16/iran-thwarts-spying-cyberattack-blames-foreign-actor/#64f5099a4d3a

Twitter users who followed the National Epilepsy Foundation were targeted with a cyber attack that sent the users flashing lights, likely an attempt to cause harmful seizures.
https://www.nytimes.com/2019/12/16/us/strobe-attack-epilepsy.html

The city of Pensacola, Florida still does not know the full extent of a recent ransomware attack and has brought in an outside firm to perform an audit on the city’s network.
https://www.pnj.com/story/news/2019/12/16/pensacola-hires-deloitte-140-000-assess-extent-cyberattack/2665576001/

New Orleans was also a victim of a cyberattack, with ransomware bringing down the city’s computer systems for several days. The city says recovery will take a week or longer.
https://www.nola.com/news/politics/article_0a132564-2061-11ea-8d52-53848745f381.html

Ring cameras have been in the headlines for a series of hacks on the smart devices, but Amazon, the company that owns ring, chalks up the breaches to customers reusing common passwords that are easy for attackers to guess.
https://www.inc.com/minda-zetlin/ring-camera-hacked-hackers-bitcoin-ransom-security.html

Credit card company VISA released a warning on a series of point-of-sale malware at gas stations across the U.S., saying the company’s security division has investigated five incidents of the sort over the past two months.
https://www.zdnet.com/article/visa-warns-of-pos-malware-incidents-at-gas-pumps-across-north-america/

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLE
COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: | CVE-2019-19726
Title: | OpenBSD Dynamic Loader Privilege Escalation Vulnerability
Vendor: | OpenBSD
Description: A local privilege escalation vulnerability exisys in OpenBSD’s dynamic loader. This vulnerability is exploitable in the default installation (via the set-user-ID executable chpass or passwd) and could allow local users or malicious software to gain full root privileges.
CVSS v2 Base Score: | 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

ID: | CVE-2019-6192
Title: | Lenovo Power Management Driver Denial of Service Vulnerability
Vendor: | Lenovo
Description: A vulnerability in pmdrvs.sys driver exists in Lenovo Power Management Driver. The vulnerability exists due to insuffiecient input buffer validation when the driver processes IOCTL codes. Attackers can exploit this issue to cause a denial of service or possibly execute arbitrary code in kernel space.
CVSS v2 Base Score: | 4.6 (AV:L/AC:L/Au:S/C:N/I:N/A:C)

ID: | CVE-2019-17554
Title: | Apache Olingo OData XML External Entity Injection Vulnerability
Vendor: Apache
Description: The XML content type entity deserializer in Apache Olingo is not configured to deny the resolution of external entities. Request with content type “application/xml”, which trigger the deserialization of entities, can be used to trigger XXE attacks. XML data is parsed by insecurley configured software components, which can be abused for XML External Entity Attacks
Base Score: 4.3 MEDIUMVector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

ID: | CVE-2019-16451
Title: | Adobe Acrobat Reader Heap Based Memory Corruption Vulnerability
Vendor: Adobe
Description: A heap based memory corruption vulnerability exists in Adobe Acrobat Reader. This vulnerability in Acrobat Reader for Windows, allows access violation exception when opening a malformed PDF file. Successful exploitation could lead to arbitrary code execution.
Base Score: 7.5 HIGHVector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

ID: | CVE-2019-16451
Title: | AppXSvc Arbitrary File Overwrite Denial of Service Vulnerability
Vendor: Microsoft
Description: An elevation of privilege vulnerability exists when the AppX Deployment Server (AppXSvc) improperly handles file hard links. AppXSvc can be forced to overwrite an arbitrary file by deleting all registry data files before creating the file hard link. A low privileged user could exploit this vulnerability to cause denial of service by overwriting critical system files. |
Base Score: 7.2 HIGHVector: (AV:L/AC:L/Au:N/C:C/I:C/A:C)

ID: | CVE-2019-15627
Title: | Trend Micro Deep Security Agent 11 Arbitrary File Overwrite Vulnerability
Vendor: Trend Micro
Description: Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to availability impact. Local OS access is required. The vulnerability allows an unprivileged local attacker to delete any file on the filesystem, or overwrite it with abritrary data hosted elsewhere.
Base Score: 6.6 MEDIUMVector: (AV:L/AC:L/Au:N/C:N/I:C/A:C)

MOST PREVALENT MALWARE FILES December 12 - 19, 2019
COMPILED BY TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

SHA 256: d73ea76f6f07f96b337335213418b58e3fbc7e4b519fec0ef3fbd19c1d335d81
MD5: 5142c721e7182065b299951a54d4fe80
VirusTotal: https://www.virustotal.com/gui/file/d73ea76f6f07f96b337335213418b58e3fbc7e4b519fec0ef3fbd19c1d335d81/details
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA.Win.Adware.Flashserv::1201

SHA 256: 0cdd2a671195915d9ffb5c9533337db935e0cc2f4d7563864ea75c21ead3f94
MD5: 7c38a43d2ed9af80932749f6e80fea6f
VirusTotal: https://www.virustotal.com/gui/file/c0cdd2a671195915d9ffb5c9533337db935e0cc2f4d7563864ea75c21ead3f94/details
Typical Filename: xme64-520.exe
Claimed Product: N/A
Detection Name: PUA.Win.File.Coinminer::1201

SHA 256: 1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871
MD5: c2406fc0fce67ae79e625013325e2a68
VirusTotal: https://www.virustotal.com/gui/file/1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871/details
Typical Filename: SegurazoIC.exe
Claimed Product: Digital Communications Inc.
Detection Name: PUA.Win.Adware.Ursu::95.sbx.tg

SHA 256: f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc
MD5: c5608e40f6f47ad84e2985804957c342
VirusTotal: https://www.virustotal.com/gui/file/f917be677daab5ee91dd3e9ec3f8fd027a58371524f46dd314a13aefc78b2ddc/details
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA:2144FlashPlayer-tpd

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
VirusTotal: https://www.virustotal.com/gui/file/15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b/details
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201