Security Updates and Important Information

Mandiant Releases Report On Chinese “APT1″ Group

Incident response specialist company Mandiant released on Tuesday a groundbreaking report, citing highly detailed evidence to support a claim that the Chinese government, through Unit 61398 of the People’s Liberation Army, has been engaging in systematic attacks on American interests, as well as those of other English-speaking nations around the globe, over the course of the past 6 years. The report, which included domain names, IP addresses, SSL certificates, and MD5sums of malicious binaries, has already caused a major political stir, with the Obama administration set to impose trade penalties for cybertheft, with the Chinese government denying any involvement.

Reference:
http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf

Schneider Electric IGSS Buffer Overflow

Independent researcher Aaron Portnoy recently discovered a set of vulnerabilities in the widely used Schneider Electric IGSS protocol, which could be remotely exploited for full administrative privileges on target systems. The vendor has since issued a patch, and users of these systems are strongly encouraged to both apply the patch and to ensure that all electrical infrastructure is appropriately firewalled from the Internet.

PDF 0-day Being Exploited In The Wild

Adobe confirmed last week that a pair of new exploits targeting Acrobat Reader were being exploited in the wild; as of the time of writing, no patches had yet been released. The exploits were particularly nefarious, in that they used a brand-new ROP-based technique to escape Reader’s sandboxing technology, which was designed by Adobe to mitigate the impact of vulnerabilities such as these.  Users are urged to be extremely cautious when opening PDF documents from any source.

USEFUL EXPLANATIONS OF HOW NEW ATTACKS WORK

Detailed analysis for MS12-081:

http://blog.ptsecurity.com/2013/02/surprise-for-network-resources-from.html

TeamViewer authentication protocol:

http://blog.accuvantlabs.com/blog/bthomas/teamviewer-authentication-protocol

iOS 6.1 hack allows lock screen bypass:

http://thehackernews.com/2013/02/ios-61-hack-allows-iphone-lock-screen.html

FROST: Forensic Recovery of Scrambled Telephones:

https://www1.informatik.uni-erlangen.de/frost

Cyber attacks against Uighur Mac OS X users intensify:

https://www.securelist.com/en/blog/208194116/Cyber_Attacks_Against_Uyghur_Mac_OS_X_Users_Intensify

Practical identification of SQL injection vulnerabilities:

https://www.us-cert.gov/reading_room/Practical-SQLi-Identification.pdf

Targeted ‘phone ring flooding’ as a service going mainstream:

http://blog.webroot.com/2013/02/13/targeted-phone-ring-flooding-attacks-as-a-service-going-mainstream/

DDoS attack on bank hid $900,000 cyberheist:

http://krebsonsecurity.com/2013/02/ddos-attack-on-bank-hid-900000-cyberheist/

About these ads