April 9–15, 2012The Cyber Risk Report is a strategic intelligence product that highlights current security activity and mid- to long-range perspectives. The report addresses seven major risk management categories: vulnerability, physical, legal, trust, identity, human, and geopolitical. Cyber Risk Reports are powered by Cisco Security Intelligence Operations, an advanced security infrastructure that identifies, analyzes, and defends against threats to keep organizations informed and protected. Cyber Risk Reports are the collaborative efforts of Cisco security analysts from the following teams: IntelliShield, Applied Intelligence, Remote Management Services, Intrusion Prevention System Signature Development, Cisco Product Security Incident Response, Cisco Malware Research, Strategic Technology Assessment Team, Infrastructure Security Research & Development, IronPort Email and Web Threat Research, Critical Infrastructure Assurance Group, Advanced Services, Security Sales and Engineering, Corporate Security Programs, Government Affairs, and Legal Support. VulnerabilityVulnerability activity for the period was increased, primarily due to the Microsoft April security bulletins. Other vulnerability activity included security advisories and updates for Adobe Flash Player, Reader, and Acrobat; a Samba remote code execution vulnerability; a Nginx web server vulnerability; multiple VMware product vulnerabilities; RealNetworks Helix Mobile and Helix Server vulnerabilities; and multiple vulnerabilities in ImageMagick. The Microsoft April Security Bulletin release included six bulletins that addressed 11 individual vulnerabilities. Microsoft rated four of the vulnerabilities as critical and the remaining two as important. The most significant of the bulletins are likely MS12-023 for Internet Explorer and MS12-027 for Windows Common Controls (MSCOMCTL). Full details of the Microsoft security bulletins are available on the Cisco Security Intelligence Operations portal and in correlated Cisco IntelliShield alerts, Cisco Intrusion Prevention System (IPS) signatures, and an Applied Mitigation Bulletin listed in Cisco Event Response: Microsoft Security Bulletin Release for April 2012. A video summary of the bulletins is available in Insights on the Microsoft Security Bulletin Release for April 2012. Cisco released two IntelliShield alerts for vulnerabilities in the IronPort Web Security Appliance. The vulnerabilities were reported in alerts 25647 and 25648. Oracle will release the scheduled quarterly Critical Patch Update (CPU) on April 17, 2012. The prerelease announcement included 88 patches for multiple Oracle products. This CPU does not include updates for Java, which will be released in the next scheduled Java SE update in June 2012. IntelliShield published 129 events last week: 69 new events and 60 updated events. Of the 129 events, 84 were Vulnerability Alerts, eight were Security Activity Bulletins, two were Security Issue Alerts, 31 were Threat Outbreak Alerts, three were Applied Mitigation Bulletins, and one was a Cyber Risk Report. The alert publication totals are as follows: Weekly Alert Totals
Significant Alerts for the Time PeriodOracle Java Runtime Environment readMabCurveData nTblSize Arbitrary Code Execution Vulnerability Previous Alerts That Still Represent Significant RiskOracle Java Runtime Environment AtomicReferenceArray Type Violation Remote Code Execution Vulnerability Oracle Java SE Critical Patch Update February 2012 MIT Kerberos 5 Telnet Service Buffer Overflow Arbitrary Code Execution Vulnerability Apache HTTP Server Reverse Proxy Rewrite URL Validation Vulnerability Microsoft Windows Remote Desktop Uninitialized Memory Access Arbitrary Code Execution Vulnerability Multiple Apple Products Security Updates Apple iTunes and iTunes for Windows Multiple Memory Corruption Vulnerabilities Multiple Products Hash Collisions Denial of Service Vulnerability Trend Micro Control Manager CmdProcessor.exe Arbitrary Code Execution Vulnerability PhysicalThere was no significant activity in this category during the time period. LegalThere was no significant activity in this category during the time period. TrustU.S. Government and Cellular Carriers Plan a Database for Stolen Cell PhonesUsing or selling stolen cellular phones should become more difficult in the future. The two major U.S. cellular service providers without a stolen phone database, AT&T and T-Mobile, have agreed to create one. Along with Verizon and Sprint, these carriers have agreed to make the database available to the Federal Communications Commission. Future plans for the database include an international connection that could make a stolen cell phone unable to be used worldwide; stolen phones are resold in Latin America, Africa, and China. A number of stolen phone databases exist in Europe, and these have significantly reduced the number of cellular phone thefts. IdentityOgaki Kyoritsu Bank of Japan Using Biometric, Cardless Automated Teller MachinesA regional bank in Japan, Ogaki Kyoritsu, is rolling out cash machines that use biometric palm print scanners and PINs rather than traditional cards for authentication. The systems would allow bank customers to authenticate without needing a cash card, greatly increasing accessibility, particularly after the 2011 earthquake and tsunami in northern Japan. IntelliShield Analysis: The use of these biometric scanners may reduce the risk of theft because the card cannot be stolen with a customer's wallet. Pairing biometric authentication with the use of a bank-issued card could greatly reduce the potential for fraud, as a criminal could not access the ATM without the customer's palm print. Biometrics also allow service accessibility to customers who have lost their cards due to accident or disaster. Improper use or failure rates of the biometric scanners could lead to customer frustration. In addition, unlike issued cash cards and PIN codes, palm prints are not easily changed or replicated. However, the biometric information stored by the bank must be handled with care. HumanThere was no significant activity in this category during the time period. GeopoliticalNorth Korea May Be Eyeing CybercrimeDemocratic People's Republic of Korea (DPRK) 100th anniversary celebrations of the birth of founder Kim Il-Sung were spoiled by a failed satellite rocket launch late last week. Pyongyang's official news agency admitted that the rocket had broken up over the ocean shortly after launch, amounting to a humiliation for new leader Kim Jong-Un, who may have hoped to use the launch to showcase his consolidation of power. The country continues to spend heavily on defense, despite a weak economy and continued dependence on external food aid. Meanwhile, the livelihoods of the wealthiest North Koreans are dependent on organized crime, according to experts. A recent New York Times article described 20-something Kim Jong-Un as the de facto head of a mafia state. Major transnational organized crime activities include currency counterfeiting, gambling via pachinko parlors in Japan, drug trafficking, and black market trade. IntelliShield Analysis: The situation in North Korea, which at times seems cannot possibly deteriorate further, raises questions for information security experts. While a growing body of evidence points to a sophisticated military-led cyber offense program, the North's financially motivated cybercrime capabilities are hard to measure. As global financial transactions, gambling, and trade increasingly become electronic activities, it seems probable that online crime originating from the DPRK will increase. Indeed, as the regime clings to existence at least for a while longer, cybercrime may be an obvious solution for Kim, who needs to shore up power by keeping his top military leaders comfortable. Cybercrime requires minimal capital investment and provides quick payoff, particularly when compared to nuclear programs and satellite launches. The implications of de facto sovereign organized crime groups launching satellites and conducting nuclear tests, meanwhile, is a discussion for another day. Upcoming Security ActivityInterop May 6–10, 2012 Because of the potential for increased risk on multiple vectors, organizations' security teams should be aware of and consider making special preparations for the following: France Presidential Elections: April 22, 2012 Additional InformationFor more information about the vulnerabilities contained in this report or the Cisco Security IntelliShield Alert Manager Service, please visit For information on obtaining a free trial of the Cisco Security IntelliShield Alert Manager Service, please visit This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document or materials linked from the document is at your own risk. Cisco reserves the right to change or update this document at any time.
|
||||||||||||||||||||||||||||||||||||||||||
