May 21–27, 2012The Cyber Risk Report is a strategic intelligence product that highlights current security activity and mid- to long-range perspectives. The report addresses seven major risk management categories: vulnerability, physical, legal, trust, identity, human, and geopolitical. Cyber Risk Reports are powered by Cisco Security Intelligence Operations, an advanced security infrastructure that identifies, analyzes, and defends against threats to keep organizations informed and protected. Cyber Risk Reports are the collaborative efforts of Cisco security analysts from the following teams: IntelliShield, Applied Intelligence, Remote Management Services, Intrusion Prevention System Signature Development, Cisco Product Security Incident Response, Cisco Malware Research, Strategic Technology Assessment Team, Infrastructure Security Research & Development, IronPort Email and Web Threat Research, Critical Infrastructure Assurance Group, Advanced Services, Security Sales and Engineering, Corporate Security Programs, Government Affairs, and Legal Support. VulnerabilityVulnerability activity for the period was decreased, highlighted by additional vendor updates for previously reported vulnerabilities. Highlights for the period include the release of the Google Chrome stable channel May 2012 update, which updates automatically for Chrome users. This update corrected multiple vulnerabilities, including two rated critical and 14 rated high by Google. Multiple vulnerabilities were corrected in updates for Wireshark. Red Hat released multiple security advisories and updates for the Linux Kernel, Apache, and Tomcat. Symantec reported multiple vulnerabilities that impact end-user products and the web gateway. Yahoo! reported a vulnerability in the Axis browser extension for Chrome that exposed the Yahoo! certificate. The exposed certificate information could be used to make malicious browser extensions appear to be trusted by Yahoo!. A new Microsoft Windows XP local privilege escalation vulnerability was reported, but Microsoft has not released an advisory or software updates. New proof-of-concept exploit code was released for an HP StorageWorks vulnerability originally reported in IntelliShield Alert 24581 in November 2011. An HP advisory and software updates have also been available since November 2011. Researchers have released some new information about tethered and untethered jailbreaks for the latest Apple iOS versions. The jailbreaks allow a user to escape the controls placed on the devices by Apple, which also exposes the devices to greater risks from malicious third-party applications. Users should carefully consider the risks of jailbreaking an Apple iOS device. Similarly, organizations should consider policies and technical controls to address these increased risks. Cisco Remote Management Services has identified increased threat activity associated with the zeroaccess rootkit and the Black Hole and Bleeding Life toolkits. As reported last week, research and metrics from Zscaler and Shadowserver have identified an increasing number of infected legitimate websites. Users should ensure their browsers are updated and all available security features are enabled to detect and prevent exploits from infected websites. McAfee released its analysis of the threats and activity identified during the first quarter of 2012. The report highlights what McAfee called the "busiest quarter in recent history," following the generally declining threats from the end of 2011. The full PDF format report is available at McAfee Threats Report: First Quarter 2012. Google and researchers reported some of the details of the attacks used to win the Pwnium contest. The information released to date shows how attackers were able to string together a series of seemingly minor vulnerabilities to gain increased access and control, and ultimately full control. These reports raise the issue of organizations that delay the installation of software updates for vulnerabilities regarded as low risk. Those who delay updates may not consider the combination of multiple low-risk vulnerabilities that could allow attackers to cause significant damage or fully compromise systems. While these types of attacks do require a much more determined and skilled attacker, underestimating and delaying software updates places the enterprise in a race with attackers, and the risk increases the longer the updates are delayed. IntelliShield published 92 events last week: 33 new events and 59 updated events. Of the 92 events, 49 were Vulnerability Alerts, three were Security Activity Bulletins, one was a Security Issue Alert, 37 were Threat Outbreak Alerts, one was an Applied Mitigation Bulletin, and one was a Cyber Risk Report. The alert publication totals are as follows: Weekly Alert Totals
Significant Alerts for the Time PeriodPHP php5-cgi Binary Setup Remote Unsanitized Command-Line Parameter Processing Vulnerability Previous Alerts That Still Represent Significant RiskAdobe Flash Player Object Confusion Arbitrary Code Execution Vulnerability OpenSSL ASN.1 asn1_d2i_read_bio() Heap Overflow Vulnerability Oracle Java SE Critical Patch Update February 2012 Samba Marshaling Code Remote Code Execution Vulnerability PHP Hash Collisions Fix Regression max_input_vars Arbitrary Code Execution Vulnerability Multiple Products Hash Collisions Denial of Service Vulnerability Microsoft Windows, Office, and Silverlight TrueType Font Parsing Remote Code Execution Vulnerability EXIM Mail Transfer Agent Arbitrary Configuration Loading root Privilege Escalation Vulnerability FreeType PostScript Type 1 Font Parsing callothersubr Arbitrary Code Execution Vulnerability Oracle Database Server TNS Listener Remote Registration Vulnerability PhysicalEmbedded Device RiskOn May 22, 2012, US Airways flight 787 traveling from Paris to North Carolina was diverted to Bangor International Airport in Maine. The reason was a French woman who made statements that seemed to imply she was carrying a device implanted in her body. She was examined during the flight, but doctors did not see evidence of recent surgery. The U.S. Federal Bureau of Investigation (FBI) investigated later and determined that the flight had not been in danger. IntelliShield Analysis: The reason for this kind of reaction is the escalating game of cat and mouse between terrorists and transport security. Bombs and explosive materials were initially smuggled into airplanes in bags, then in containers on a person, followed by explosives hidden in the clothing. The next step is to hide materials within a person; the same progression that drug smugglers went through some time ago. Luckily, terrorists' attempts to hide explosives within a person are few and far between, so the threat is currently not that prominent. If the frequency of such attempts increases, there is a danger that all travelers will be subjected to even more invasive searches and more expensive equipment will be installed at airports. Because the deployment of new scanners will lag (assuming they continue) and the locations for this coverage may be limited, companies may rethink their policies of flying their executives on regular public flights. The only possible winner in this scenario could be private jet operators, who may see an increase in demand for charter flights. Switching Bar Codes on ProductsA prominent vice president of a West Coast software firm was arrested and charged with felony burglary when he was caught on a store's security camera system applying replacement bar codes on higher-end LEGO sets with discounted versions of bar codes. Police discovered several bags of fraudulent bar codes in his car, and when police entered his residence they discovered hundreds of unopened LEGO sets. A search of his computer indicated he ran a site called Tom's Brickyard on eBay and had sold about US$30,000 worth of LEGO sets in the past. IntelliShield Analysis: This story highlights one of the issues with machine-readable codes and devices or systems that are not designed to be read or understood by human beings. Unless a method is provided by the device reading the bar code or radio frequency identification (RFID) tag and the person using the device actually vets the URI or link, there is no guarantee that the link is valid. In fact, it could very well lead the unsuspecting user to the download and installation of malware, particularly on mobile devices. In the case of the tampered bar codes in the LEGO story, the stores have a policy by which the cashiers do not confront or pursue the perpetrator, but let loss-prevention personnel deal with the situation. In the case when individuals casually browse quick response (QR) codes with phones, users are advised to ensure that the link to be visited is what they actually intended to use and that they do want to install any application the QR code leads them to. LegalThere was no significant activity in this category during the time period. TrustApple Siri Banned by IBMSiri, the personal assistant application on Apple iPhone 4S, has been banned by IBM when phones are used on IBM's internal networks. IBM implemented access control lists that prevent communication between the internal networks and the Apple data center in North Carolina where Siri's queries are processed. IBM's concern centers on the storage and use of queries received by Apple. Apple's privacy policy places very few restrictions on the use of received voice queries. IntelliShield Analysis: Information storage from the spoken word is not a new concern; the United States National Security Agency has previously banned all recording devices from their headquarters. The information in many queries should be a real concern to anyone who takes privacy seriously. Siri's queries can be combined with any information gleaned from the user running the query, including the contents of their personal contacts lists, current location information, and other "unspecified" information. Siri can also be used to compose text and e-mail messages. Thus far there have not been any requests from law enforcement related to the information stored from these queries. However, as stored queries accumulate, users can expect requests for disclosure of stored information in the not-too-distant future. Users are advised to carefully consider their use of search engines along with their privacy concerns. IdentityThere was no significant activity in this category during the time period. HumanGoogle Warns Users About Malicious Software InfectionsGoogle has started displaying warning messages on its websites when the company detects systems infected with the DNSChanger malicious software. The warning directs users to a page that describes how to remove the infection. Although numbers of the malicious software installations continue to fall, there are still an estimated 500,000 infected systems. Users of infected systems face a DNS outage as of July 9, 2012, when DNS servers that replaced malicious servers as part of the November 2011 Operation Ghost Click are scheduled to be removed. GeopoliticalInfosec Impact of a Greek Euro ExitMajor international banks are putting the chances of a Greek exit from the euro at better than 50 percent following an inconclusive election in Greece in early May that forced a second round of elections. This second round, expected on June 17, 2012, is being seen by many as a de facto referendum on Greece's continued membership in the euro zone (and potentially in the European Union as well). Policy makers are reluctant to speak on the record about whether contingency planning is taking place and what such an unscripted, undesirable scenario might look like, other than agreeing it would be damaging and messy. Top of mind for macroeconomic planners is whether an exit by Greece would prompt a rapid deterioration of neighboring, weak economies, particularly that of Spain. For information security specialists, however, concerns may be more tactical. IntelliShield Analysis: Questions start with when—investor panic could trigger devaluation and euro exit, conceivably before the June 17 election date. One scenario points to an exit over a weekend, with an announcement following the close of markets in New York on a Friday. This would allow 2 days for euro zone leaders and other stakeholders, including the International Monetary Fund and the European Central Bank, to convene emergency meetings before international markets open on the following Monday morning. While many international currency and business contracts have already been renegotiated and/or hedged against, the electronic data flow aspects of a euro exit are unknown. ATMs and Greek bank-issued credit cards likely would not work, at least temporarily. Greeks may turn to bartering as a stopgap measure. Information security professionals may encounter extended bank closures, opportunistic malware attacks aimed at panicking deposit holders, and network surges. Businesses may be affected by physical disruptions, including looting, strikes, and protests. There are considerable opportunities for crime around the issuance of a new currency, such as phishing scams and counterfeiting because few will be able to identify the new paper currency with confidence. The euro itself is sound, as is the broader European banking system, but information security specialists may want to brace for a long week if this undesirable and uncharted scenario comes to pass. Upcoming Security ActivityWorld IPv6 Launch: June 6, 2012 Because of the potential for increased risk on multiple vectors, organizations' security teams should be aware of and consider making special preparations for the following: G20 Summit (Los Cabos, Mexico): June 18–20, 2012 Additional InformationFor more information about the vulnerabilities contained in this report or the Cisco Security IntelliShield Alert Manager Service, please visit For information on obtaining a free trial of the Cisco Security IntelliShield Alert Manager Service, please visit This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document or materials linked from the document is at your own risk. Cisco reserves the right to change or update this document at any time.
|
|||||||||||||||||||||||||||||||||||||
