February 11–17, 2013We have introduced some changes to the format and structure of the Cyber Risk Reports. While we will remain focused on the seven primary risk categories, we also will be adding additional risk categories as they apply to activity in a specified period. These could include, for example, categories pertaining to botnets, cloud, mobile, and others. The Cyber Risk Report will remain focused on risk management, lessons learned, recommended practices, and analysis from our Cisco expert security engineers and analysts. We will also not include risk categories that have no activity for the period. If you missed Cisco Live London, several of the keynote and session recordings are available at www.ciscolive365.com. If you do not have an account, you can create one at no charge. Cisco released the Cisco Annual Security Report 2013, highlighting global threat patterns and trends, expert analysis and recommendations, and the results of the Cisco Connected World Report. VulnerabilityVulnerability activity was significantly increased for the period, primarily due to multiple large updates from Microsoft and Adobe. Microsoft released 12 bulletins that addressed 57 vulnerabilities. The bulletins addressed vulnerabilities in Microsoft Windows, Microsoft Internet Explorer, Microsoft .NET Framework, Microsoft Exchange Server, and Microsoft FAST Search Server for SharePoint. The vulnerabilities could allow an attacker to execute arbitrary code, access sensitive information, cause a denial of service condition, or gain elevated privileges. Only the Microsoft Internet Explorer SLayoutRun Use-After-Free Arbitrary Code Execution Vulnerability reported in MS13-009 has functional exploit code available. Details of the vulnerabilities and mitigations are available in the Cisco Event Response: Microsoft Security Bulletin Release for February 2013. Adobe released multiple security updates, including the Adobe Flash Player Security Updates for February 2013, the Adobe Flash Update for February 2013, and the Adobe Shockwave Player Security Update for February 2013. In addition, Adobe PSIRT released the Adobe Reader and Acrobat Vulnerability Report, indicating the team is investigating a report of a new vulnerability being exploited in the wild. IntelliShield alerts for these vulnerabilities and security updates are available on the Cisco SIO portal. Cisco released Security Notices for a Multiple Cisco Product Root Shell Access Vulnerability, a Cisco Unity Connection Memory Leak Denial of Service Vulnerability, and a Cisco Small Business Wireless Access Points SSID Validation Vulnerability. Additional security advisories and software updates where released for multiple vulnerabilities in WordPress, a Novell GroupWise Client for Windows ActiveX Control Arbitrary Code Execution Vulnerability, multiple vulnerabilities in HP LeftHand Virtual SAN Appliances, and multiple vulnerabilities in IBM WebSphere. In e-mail security activity, sources are reporting on a spam campaign targeting Citigroup customers. Cisco SIO identified and updated rules for this spam on January 23, 2013, and reported this activity in Threat Outbreak Alert 27956. In botnet activity, Zeus samples were identified in Japan, crossing the language barrier, and multiple sources reported the resurgence of the Kelihos botnet, which has been shut down in two previous actions. IntelliShield published 174 events last week: 125 new events and 49 updated events. Of the 174 events, 71 were Vulnerability Alerts, 38 were Security Activity Bulletins, two were Security Issue Alerts, 58 were Threat Outbreak Alerts, four were Applied Mitigation Bulletins, and one was a Cyber Risk Report. The alert publication totals are as follows: Weekly Alert Totals
Significant Alerts for the Time PeriodMicrosoft Internet Explorer SLayoutRun Use-After-Free Arbitrary Code Execution Vulnerability Novell GroupWise Client for Windows ActiveX Control Arbitrary Code Execution Vulnerability Previous Alerts That Still Represent Significant RiskIntel 82574L Ethernet Controller Packet Processing Remote Denial of Service Vulnerability Oracle Java SE Critical Patch Update Advisory for February 2013 Multiple Universal Plug and Play Devices Simple Service Discovery Protocol Processing Vulnerabilities Ruby on Rails Action Pack Parameter Processing Remote Code Execution Vulnerability Red October Cyber Espionage Campaign Identified Oracle Java Security Manager Security Bypass Arbitrary Code Execution Vulnerability Microsoft Internet Explorer CDwnBindInfo Object Processing Use-After-Free Vulnerability Fraudulent TURKTRUST Inc. Digital Certificates Financial Institution Websites Targeted by Distributed Denial of Service Attacks SSH Tectia Authentication Bypass Unauthorized Access Vulnerability PrivacyPrivacy and Electronic Devices at the U.S. BorderThe U.S. Department of Homeland Security (DHS) Office for Civil Rights and Civil Liberties has released a Civil Rights/Civil Liberties Impact Assessment Executive Summary regarding searches and seizures of electronic devices at national borders. The summary concludes that the DHS policy, in place since at least 2008, permitting the suspicion-less and warrantless searches and seizures of electronic devices at the U.S. border “and its functional equivalent” comply with both the First and Fourth Amendments to the United States Constitution. The American Civil Liberties Union (ACLU) has filed a request under the Freedom of Information Act (FOIA) to obtain the full report, titled “Civil Rights and Civil Liberties Impact Assessment—Border Searches of Electronic Devices,” along with a lawsuit challenging the policy on the behalf of individuals and organizations impacted by the policy. Analysis: TrustEmergency Alert System Vulnerability Allows Spurious Message SendingSecurity researchers from IOActive discovered a vulnerability in certain Emergency Alert System (EAS) devices used by television and radio stations in the United States. The researchers indicate the vulnerability allows the complete compromise of the affected devices. Once compromised, the devices could allow attackers to send messages of their choice through the system. Details of the vulnerability and devices affected are not available publicly, as the researcher has waited to disclose details until the vendor can distribute fixes to customers. Further reading: Emergency Alert System Attacks Analysis: Weaknesses in public alerting systems have the potential to cause damage related to panic. Perhaps as important, the impact to trust in the system could cause issues when an actual emergency arises and people do not act because of fake messages in the past. Although security research into EAS products has so far been uncommon, this event might bring greater scrutiny and possibly expose additional flaws. Organizations that deploy EAS devices should take measures to protect devices from external access. GeopoliticalBig Week in Washington for CyberLast week, U.S. President Obama issued a long-awaited Executive Order on cyber security in conjunction with his State of the Union address. The Order, entitled “Improving Critical Infrastructure Cyber Security,” calls for the creation of a voluntary framework through which the federal government and critical industries can share threat information. One day after the Order was issued, the House of Representatives reintroduced a slightly amended version of the draft Cyber Intelligence Sharing and Protection Act (CISPA),which failed to come to a vote in Congress last year. At the same time, the White House issued a new Presidential Policy Directive (PPD-21) that broadens the definition of critical infrastructure and also broadens the government’s mission to protect these entities from threats beyond terrorism, including natural disasters and cyber attacks. As if that were not enough for one week, word of a new National Intelligence Estimate surfaced in press reports. The classified text reportedly lays out further evidence that the United States is the target of a massive cyber-espionage campaign that threatens national economic competitiveness and security. Analysis: Information security specialists have a lot to think about following last week’s flurry of Washington, D.C. news. The attention is not unwelcome; there is wide recognition that U.S. critical infrastructure will only become more Internet connected with time, and therefore more vulnerable. Moreover, most experts agree that a better framework for public-private information sharing is overdue. As ever, the devil is in the details. A central concern is how to protect privacy while increasing actionable threat communication. Service and content providers are rightly concerned about the risk of litigation if a clear framework for information sharing is not established. One difference between the CISPA draft and the President’s Executive Order is that the EO focuses primarily on government sharing with the private sector, rather than the other way around, according to a PC Magazine article on the subject. One crucial question left for debate is whether some entities will be subject to mandatory reporting requirements because of their critical nature. The National Institute of Standards and Technology has been tasked with developing a framework, in cooperation with private sector infrastructure providers, within 1 year. Upcoming Security Activity RSA Conference 2013: February 25–March 1, 2013 Because of the potential for increased risk on multiple vectors, organizations' security teams should be aware of and consider making special preparations for the following: Additional InformationFor information and commentary from the experts in Cisco Security Intelligence Operations, please visit the Cisco Security Blog. For timely information from across Cisco Security Intelligence Operations, please consider following @CiscoSecurity on Twitter. This document is provided on an “as is” basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document or materials linked from the document is at your own risk. Cisco reserves the right to change or update this document at any time.
|
|||||||||||||||||||||||||||||||||||||
