Saturday, November 30, 2013

Prevalent Malware: November 2013 Edition

Sourcefire has compiled the list of this month’s most prevalent malware files.  The list provides the hash checkup values for each file as well as a link to the entry on virustotal.  To assist computer forensics analysts or incident responders, the list provides the file name and the fake publisher claimed by the malware.  Some notable examples of the identified malware files include:

SHA 256:
ca24a8f7c04fe15a758f3360c8e5619205c53807bfc65f82c028cdf808bf2189
MD5:
ec63f649f7090f885ebd4770ffb92fcb
VirusTotal:
https://www.virustotal.com/en/file/CA24A8F7C04FE15A758F3360C8E5619205C53807BFC65F82C028CDF808BF2189/analysis/
Typical Filename: UpdateTask.exe
Claimed Product: W32.Trojan.16l1
Claimed Publisher: None
SHA 256:
b2cad8322db85f67db6ea074d00c2ed56ce1fa92952d07b70baac249fa18236d
MD5:
249a44dcfa2500eb1c020e33a3e9f25b
VirusTotal:
https://www.virustotal.com/en/file/B2CAD8322DB85F67DB6EA074D00C2ED56CE1FA92952D07B70BAAC249FA18236D/analysis/
Typical Filename: FlashPlayerUpdateService.exe
Claimed Product: W32.Downloader:AgentASEBTrj.16mc.1201
Claimed Publisher: None

You may obtain a more complete list from Sourcefire or read a longer version of the list from AVM Technology Cybersecurity.

Recent Vulnerabilities With Available Exploits: November 2013 Edition

The list of recent vulnerabilities for which exploits are available is out.  This list was created to assist system administrators and computer incident responders in prioritization of their remediation activities.  This list can also help computer forensics experts in correctly identifying some of these exploits.

A few notable exploits identified include:

ID:     CVE-2013-3918
Title:  Microsoft ActiveX Controls “InformationCardSigninHelper Class”
Out-of-Bounds Memory Access Vulnerability
Vendor: Microsoft
Description: A remote code execution vulnerability exists in the
InformationCardSigninHelper Class ActiveX control.  Specifically the
issue occurs in the way “InformationCardSigninHelper Class” ActiveX
control (icardie.dll) is loaded into Internet Explorer and causes system
state corruption.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID:     CVE-2013-3906
Title:  Microsoft Graphics Component Could Allow Remote Code Execution
Vendor: Microsoft
Description: Remote exploitation of a memory corruption vulnerability
in multiple Microsoft products could allow attackers to execute
arbitrary code on the targeted host. The issue occurs with how the TIFF
codec in Microsoft’s graphics component handles crafted TIFF files.
Processing crafted TIFF files can corrupt system memory and create an
exploitable condition.
CVSS v2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C)

ID:     Not Available
Title:  D-Link Authentication Security Bypass Vulnerability
Vendor: D-Link
Description: A remote exploitation of a design error vulnerability in
D-Link Systems Inc.’s routers could allow attackers to bypass
authentication security restrictions. The router allows any user with a
Web browser having the user agent string
“xmlset_roodkcableoj28840ybtide” to gain access to the Web interface of
the device without the requirement for any authentication credentials.
Affects D-Link Firmware v1.13 and other versions may also be affected.
CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

The entire list is available from Qualys or you may read more at the AVM Technology, LLC blog.