Have a Secret, Secure and Scalable Network from Today’s Cyber Attacks?

/0 Comments/in /by

“Is it secret? Is it safe?”

For those who’ve never seen the 1976 film Marathon Man, that’s what the fugitive Nazi war criminal played by Sir Laurence Olivier asks Dustin Hoffman while he’s sticking a pointy dental probe into Hoffman’s exposed cavity. Ouch. Excellent movie, though.

Cinema trivia notwithstanding, these are pertinent questions federal agencies need to ask when it comes to information under their control. Is it secret? There are many levels of classified information. Is it safe? We hope that, classified or not, information about the workings of our government and about us is safe from cyber attack.

Secrecy and safety should go together, and it would seem that “secret” and “safe” together should add up to “secure.” But there’s one situation in which, unfortunately, that’s not the case.

When the website you’re at shows up with a URL starting with “https://”, that site is using encryption to add security, specifically Secure Sockets Layer (SSL) or Transport Layer Security (TLS) protocols.

OMB Memorandum M-15-13, “A Policy to Require Secure Connections across Federal Websites and Web Services” (June 2015) requires that “all publicly accessible Federal websites and web services only provide service through a secure connection. The strongest privacy and integrity protection currently available for public web connections is Hypertext Transfer Protocol Secure (HTTPS).”

Encrypting HTTP does add latency, and agencies need to take this into account in planning their network infrastructure. But you’d think that the performance hit is well worth the increase in security (safety, secrecy) SSL and TLS provide. However, here’s where that assumption starts to fall apart:

More and more cyber attacks are taking place using SSL itself as a means of injecting malicious code and acting as a gateway into places they have no business being. SonicWall Security’s 2016 Annual Threat Report, just released, goes into great detail on the global increase in SSL traffic. The encrypted sessions themselves are being used as attack vectors.

Preventing this requires that agencies inspect all packets, even encrypted ones, that enter their networks. As you’d expect, SSL inspection can add yet another performance/latency hit, unless you implement a solution specifically architected to minimize that impact.

Fortunately, SonicWall has that solution. Our SuperMassive 9000 Series Next-Generation Firewalls (NGFWs) provide SSL decryption, inspection and protection with no added latency, through Reassembly-Free Deep Packet Inspection (RFDPI), patented by SonicWall. The SonicWall SuperMassive next-gen firewall series deployed in a SonicWall firewall sandwich architecture allows up to 16 SonicWall SuperMassive devices to perform DPI inspection in parallel, supporting up to 160Gbps of DPI and 80Gbps of SSL-DPI. Our Firewall Sandwich can be deployed in several different configurations depending on your agency’s existing network design helping you scale firewall services with more resiliency and availability. The SuperMassive and NSA Series NGFWs are now certified under the Department of Defense’s Unified Capabilities Approved Products List (UC APL), an essential for DoD and a significant plus for civilian agencies looking for the best, most cost-effective network security solutions they can find.

Picture of SonicWall's SuperMassive 9000 Series Next-Generation Firewall at a show

In the Federal Computer Week Digital Dialogue, “Speed and Security Aren’t Mutually Exclusive,” Angelo Rodriguez, director of security engineering at SonicWall Security Solutions Group, goes into greater detail on the firewall sandwich and the technology behind our NGFWs.

Read the Digital Dialogue

The Dialogue is a summary of December’s Government Computer News webcast, “Enabling Network Security at the Speed of Mission”, in which Angelo discusses the concept of a scale-out firewall architecture, a network-based model for scaling a next-generation firewall (NGFW) beyond 100Gbps, and deep packet inspection.

RIG Exploit Kit (March 9th, 2016)

/in /by

Dell Sonicwall Threat Research team has observed Rig Exploit kit, using exploits for Adobe Flash and IE vulnerabilities in its arsenal.

Redirection Chain:

Malicious javascript code is injected into compromised website to redirect victim to Kit’s Landing page.

Fig-1 : Compromised webpage with injected Javascript

This exploit kit uses Iframe redirection technique as shown below:

Fig-2 :Injected script has an iframe pointing to Kit’s landing page.

Exploit Kit’s landing page contains three HTML script elements as shown below:

Fig-3 : Kit’s Landing Page

First script element defines two custom variables. The next two scripts are used to decrypt data and add new HTML script elements.

The purpose of the data decrypted by the second script element is to play a malicious flash file, which exploits Adobe Flash vulnerability [CVE-2015-8416], as shown below:

Fig-4 : Decrypted data of second script

Similarly, the data decrypted by the third script tag, exploits vulnerability present in IE [CVE-2015-2419] as shown below:

Fig-5 : Decrypted data of third script

Fig-6 : packet capture with URI pattern

Sonicwall Gateway AntiVirus provides protection against this threat via the following signatures:

  • GAV: RigHtm.EKA (Exploit)

  • GAV: RigSWF.EKA (Exploit)

FrameworkPOS.acc: New variant of FrameworkPOS Uses DNS requests to deliver stolen card data to the attackers (Mar 1,2016)

/in /by

The Dell Sonicwall Threats Research team observed reports of a new variant POS family named GAV: FrameworkPOS.AAC actively spreading in the wild. FrameworkPOS malware affecting point-of-sale systems has been discovered to rely on DNS requests to deliver stolen card data to the attackers.

Infection Cycle:

Md5:

feac3bef63d95f2e3c0fd6769635c30b Detected as GAV: FrameworkPOS.AAC (Trojan)

The Trojan adds the following keys to the Windows registry to ensure persistence upon reboot:

  • HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLogMeInServer

    • ImagePath”=”%Userprofile%Malware.exe -service

FrameworkPOS retrieves a list of running processes; the malware is responsible for scraping the memory of current processes on the infected machine for credit card information periodically.

The Malware has an exclusion list that functions to ignore certain system processes; it gathers track data by scanning the memory of the all running processes except for the following List:

The malware tries to Enumerate Credit Card Data from POS Software. The hackers use the following API functions such as:

  • CreateToolhelp32Snapshot

  • Process32First

  • Process32Next

  • OpenProcess

The malware generates two files dspsvc.bid and [Random Name].dat

The dspsvc.bid file contains bot Campaign Id and the .dat file contains encrypted Credit Card information such as following example:

The malware sends a HTTP request to an external server and the server responds with the victim’s public IP address.

Once the public IP is acquired, then the malware tries to verify Credit Cards and then sends track 1 and track 2 credit card data in encrypted format to one of the given C&C Servers based on DNS Traffic format such as following example:

Command and Control (C&C) Traffic

FrameworkPOS performs C&C communication over DNS protocol.

The malware sends your Credit Card information to its own C&C server via following format, here are some examples:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

  • GAV: FrameworkPOS.AAC

Microsoft Security Bulletin Coverage (Mar 8, 2016)

/in /by

Dell SonicWALL has analyzed and addressed Microsoft’s security advisories for the month of Mar. 8, 2016. A list of issues reported, along with Dell SonicWALL coverage information are as follows:

MS16-023 Cumulative Security Update for Internet Explorer

  • CVE-2016-0102 Microsoft Browser Memory Corruption Vulnerability
    IPS:11490 ” Internet Explorer Memory Corruption Vulnerability (MS16-023) 1″
  • CVE-2016-0103 Internet Explorer Memory Corruption Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0104 Internet Explorer Memory Corruption Vulnerability
    IPS: 11491 “Internet Explorer Memory Corruption Vulnerability (MS16-023) 2 “
  • CVE-2016-0105 Microsoft Browser Memory Corruption Vulnerability
    IPS: 5173 “Obfuscated ActiveX Instantiation 3”
  • CVE-2016-0106 Internet Explorer Memory Corruption Vulnerability
    IPS: 11492 “Internet Explorer Memory Corruption Vulnerability (MS16-023) 3”
  • CVE-2016-0107 Internet Explorer Memory Corruption Vulnerability
    IPS: 11493 “Internet Explorer Memory Corruption Vulnerability (MS16-023) 4”
  • CVE-2016-0108 Internet Explorer Memory Corruption Vulnerability
    IPS: 11494 “Internet Explorer Memory Corruption Vulnerability (MS16-023) 5”
  • CVE-2016-0109 Microsoft Browser Memory Corruption Vulnerability
    IPS: 11495 “Internet Explorer Memory Corruption Vulnerability (MS16-023) 6”
  • CVE-2016-0110 Microsoft Browser Memory Corruption Vulnerability
    IPS: 11497 ” Internet Explorer Memory Corruption Vulnerability (MS16-023) 8″
  • CVE-2016-0111 Microsoft Browser Memory Corruption Vulnerability
    IPS: 11498 ” Internet Explorer Memory Corruption Vulnerability (MS16-023) 7″
  • CVE-2016-0112 Internet Explorer Memory Corruption Vulnerability
    IPS: 11501 “Internet Explorer Memory Corruption Vulnerability (MS16-023) 10”
  • CVE-2016-0113 Internet Explorer Memory Corruption Vulnerability
    IPS: 11503 “Internet Explorer Memory Corruption Vulnerability (MS16-023) 11”
  • CVE-2016-0114 Internet Explorer Memory Corruption Vulnerability
    IPS: 11504 “Internet Explorer Memory Corruption Vulnerability (MS16-023) 12”

MS16-024 Cumulative Security Update for Microsoft Edge

  • CVE-2016-0102 Microsoft Browser Memory Corruption Vulnerability
    IPS:11490 ” Internet Explorer Memory Corruption Vulnerability (MS16-023) 1″
  • CVE-2016-0105 Microsoft Browser Memory Corruption Vulnerability
    IPS: 5173 “Obfuscated ActiveX Instantiation 3”
  • CVE-2016-0109 Microsoft Browser Memory Corruption Vulnerability
    IPS: 11495 “Internet Explorer Memory Corruption Vulnerability (MS16-023) 6”
  • CVE-2016-0110 Microsoft Browser Memory Corruption Vulnerability
    IPS: 11497 “Internet Explorer Memory Corruption Vulnerability (MS16-023) 8”
  • CVE-2016-0111 Microsoft Browser Memory Corruption Vulnerability
    IPS: 11498 ” Internet Explorer Memory Corruption Vulnerability (MS16-023) 7″
  • CVE-2016-0116 Microsoft Edge Memory Corruption Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0123 Microsoft Edge Information Disclosure Vulnerability
    IPS: 11496 “Microsoft Edge Memory Corruption Vulnerability (MS16-024) 1”
  • CVE-2016-0124 Microsoft Edge Information Disclosure Vulnerability
    IPS: 11499 “Microsoft Edge Memory Corruption Vulnerability (MS16-024) 2”
  • CVE-2016-0125 Microsoft Edge Information Disclosure Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0129 Microsoft Edge Memory Corruption Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0130 Microsoft Edge Memory Corruption Vulnerability
    There are no known exploits in the wild.

MS16-025 Security Update for Windows Library Loading to Address Remote Code Execution

  • CVE-2016-0100 Library Loading Input Validation Remote Code Execution Vulnerability
    There are no known exploits in the wild.

MS16-026 Security Updates for Graphic Fonts to Address Remote Code Execution

  • CVE-2016-0120 OpenType Font Parsing Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0121 OpenType Font Parsing Vulnerability
    There are no known exploits in the wild.

MS16-027 Security Update for Windows Media to Address Remote Code Execution

  • CVE-2016-0098 Windows Media Player Parsing Remote Code Execution Vulnerability
    IPS: 11500 “Windows Media Player Parsing Remote Code Execution 1”
  • CVE-2016-0101 Windows Media Player Parsing Remote Code Execution Vulnerability
    IPS: 11502 “Windows Media Player Parsing Remote Code Execution 2 “

MS16-028 Security Update for Microsoft Windows PDF Library to Address Remote Code Execution

  • CVE-2016-0117 Remote Code Execution Vulnerability
    SPY: 3280 “FathFTP ActiveX RasIsConnected Method Invocation”
  • CVE-2016-0118 Remote Code Execution Vulnerability
    There are no known exploits in the wild.

MS16-029 Security Update for Microsoft Office to Address Remote Code Execution

  • CVE-2016-0021 Microsoft Office Memory Corruption Vulnerability
    SPY: 3252 “Malformed-File rtf.MP.11”
  • CVE-2016-0057 Microsoft Office Security Feature Bypass Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0134 Microsoft Office Memory Corruption Vulnerability
    There are no known exploits in the wild.

MS16-030 Security Update for Windows OLE to Address Remote Code Execution

  • CVE-2016-0091 Windows OLE Memory Remote Code Execution Vulnerability
    SPY: 2439 “Malformed-File rtf.MP.10”
  • CVE-2016-0092 Windows OLE Memory Remote Code Execution Vulnerability
    SPY: 3251 “Malformed-File rtf.MP.12”

MS16-031 Security Update for Microsoft Windows to Address Elevation of Privilege

  • CVE-2016-0087 Windows Elevation of Privilege Vulnerability
    This is a local Vulnerability.

MS16-032 Security Update for Secondary Logon to Address Elevation of Privilege

  • CVE-2016-0099 Secondary Logon Elevation of Privilege Vulnerability
    This is a local Vulnerability.

MS16-033 Security Update for Windows USB Mass Storage Class Driver to Address Elevation of Privilege

  • CVE-2016-0133 USB Mass Storage Elevation of Privilege Vulnerability
    There are no known exploits in the wild.

MS16-034 Security Update for Windows Kernel-Mode Drivers to Address Elevation of Privilege

  • CVE-2016-0093 Win32k Elevation of Privilege Vulnerability
    This is a local Vulnerability.
  • CVE-2016-0094 Win32k Elevation of Privilege Vulnerability
    This is a local Vulnerability.
  • CVE-2016-0095 Win32k Elevation of Privilege Vulnerability
    This is a local Vulnerability.
  • CVE-2016-0096 Win32k Elevation of Privilege Vulnerability
    This is a local Vulnerability.

MS16-035 Security Update for .NET Framework to Address Security Feature Bypass

  • CVE-2016-0035 .NET XML Validation Security Feature Bypass
    There are no known exploits in the wild.

Beating Cybercrime and Driving Better Security at RSA

/0 Comments/in /by

As I’ve spent the past few days talking with customers and fellow information security professionals at this year’s RSA Conference, it’s become crystal clear that the threat of cybercrime has changed up the way we work. As these threats morph and shapeshift into new, more sophisticated forms, we must stay one step ahead of the bad actors to protect our customers.

Customers at RSA feel this expanding threat environment is compounded by increased pressure to deploy new capabilities at warp speed. The massive explosion in both applications and access points makes it difficult for IT to keep the business productive and secure from these constantly evolving threats.

The release last month of the SonicWall Security 2015 Threat Report provides a dose of reality with its analysis of the cybercrime trends of 2015, and a jolting look at the emerging security threats we can expect in 2016. The evolution of exploit kits that conceal exploits from security systems, the surging growth in SSL/TLS encryption that enables hackers to launch under-the-radar attacks that conceal malware from firewalls, plus a continued rise in Android malware that puts most of the smartphone market at risk and a marked increase in malware attacks in general all are on the horizon this year. As information security professionals, our work is cut out for us.

SonicWall Security is committed to delivering comprehensive protection against dramatic growth of the zero-day attacks identified in the Threat Report. On Monday, we unveiled at RSA the SonicWall Capture Advanced Threat Protection Service, a first-to-market, adaptive, multi-engine sandboxing approach that enhances the ability of organizations to protect against shape-shifting cyber threats, not just by detecting the threats with a single engine solution as other sandboxing tools do, but by going a necessary step further to actually block those threats before they enter the network. This cloud offering, which was showcased throughout the week at RSA, incorporates the VMRay third-generation Analyzer threat detection analysis engine with the Lastline Breach Detection platform and the SonicWall Sonic Sandbox threat analysis engine, to deliver a much needed three-layer level of defense against today’s unknown threats.

We’re also reinforcing our commitment to our channel partners by beefing up the already best-in-class security offerings they have available to customers. Our new SonicWall Capture solution is available through the channel, and, in February, we announced that our newest Identity and Access Management solution, SonicWall One Identity Safeguard for Privileged Passwords, also is available through our channel partners. SonicWall Security’s first identity and access management solution offered through channel partners at the initial launch, Safeguard adds critical security controls to our partners’ portfolio.

In addition, I’m pleased to report that we’ve received significant industry validation for our SonicWall Security portfolio recently. For the fourth consecutive year, the SonicWall SuperMassive E10800 next-generation firewall (NGFW) running SonicOS 6.0 and integrated Intrusion Prevention Service has earned the coveted Recommended rating in the NSS Labs Next-Generation Firewall Security Value Map. This represents the highest rating given by NSS Labs, and SonicWall is one of only three vendors to earn this distinction for four consecutive years. NSS Labs is one of the industry’s most influential third-party evaluators of security products, and that means our customers are protecting their networks with a security product that is among the best-performing in the industry.

SonicWall Security solutions also received nine awards in the recently announced 2016 Info Security Products Guide Global Excellence Awards.

At SonicWall Security, we are committed to helping our customers fight constantly shapeshifting threats by extending end-to-end connected security that both protects the modern day enterprise, and enables support for mobility, cloud and easy user access that drives business productivity. We strive to deliver security solutions that support our open ecosystem where every aspect of security is covered with little overlap. Our goal is for all of our best-in-class solutions and technologies to reinforce each other and work both independently and together, to ensure we’re setting the highest bar for value to our partners and customers.

Preventing DROWN Attack (March 2, 2016)

/in /by

On March 1st 2016, OpenSSL released patches that disable the SSLv2 protocol by default, as well as removing SSLv2 EXPORT ciphers.

A cross-protocol attack was discovered that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. Note that traffic between clients and non-vulnerable servers can be decrypted provided another server supporting SSLv2 and EXPORT ciphers (even with a different protocol such as SMTP, IMAP or POP) shares the RSA keys of the non-vulnerable server. This vulnerability is known as DROWN.

The vulnerability is referred by CVE as CVE-2016-0800.

Dell SonicWALL customers are encouraged to enable the following IPS signature to detect and block SSLv2 traffic:

  • 5160 SSLv2.0 Client Hello

SonicWall Releases Secure Mobile Access Models 200 and 400

/0 Comments/in /by

The exponential proliferation of mobile devices in the workplace, both employer issued and personally owned, has increased the demand on businesses to enable secure mobile access to company applications, data and resources. Often, mobile users are using the same device for both business and personal use, resulting in the intermingling of business and personal data and applications. Consequently, businesses are at a growing risk of multiple security breaches such as:

  • Unauthorized users gaining access to company networks and systems from lost or stolen devices
  • Malware infected devices acting as a conduit to infect company systems
  • Interception of company data “in-flight” on unsecured public Wi-Fi networks
  • Loss of business data stored on devices if rogue personal apps or unauthorized users gain access

Today, we have released  SonicWall’s answer to these challenges with the “SonicWall Secure Mobile Access” (SMA) 200 and 400. We are excited to further fortify and control the primary  SonicWall next-generation firewalls, by releasing SonicWall SMA solutions, which offer the following:

  • Provide mobile users secure access to allowed network resources including folders, applications, intranet, e-mail, etc.
  • Secure access across Windows, iOS, Mac OSX, Android, Kindle Fire, Linux & Chrome OS mobile devices
  • Allow administrators to easily configure security policies for context-aware authentication to grant access only to trusted devices and users
  • The SonicWall 100 Series models are rebranded as follows: SonicWall SMA 200, with support for up to 50 concurrent sessions, replaces the SonicWall SRA 1600 and the SonicWall SMA 400, with support for up to 250 concurrent sessions, replaces the SonicWall SRA 4600.

Our partners and customers have been participating in the beta for today’s release and appreciate the solution features. Together, we partner with our Value Added Resellers (VARs) to provide superior IT services worldwide. Peter Rennenkampff, at Fuelled Networks, was part of the recent beta, and he shares the following:

“We have several customers who will benefit from the enhanced platform support for SonicWall MobileConnect in this latest release. Businesses have to contend with the BYOD trend and increase security at the same time. The SMA platform addresses these issues with capabilities such as the End User Authorization, Granular Access Control and enhanced performance. As an established VAR, we have customers that already rely on the SonicWall SRA solution. The new SMA platform will immediately allow our customers to be better connected, more productive and greater control over who has access to valuable data.” said Peter Rennenkampff, Support Engineer, Fuelled Networks, Inc.

We invite you to see a live demo of our new solutions and join us at the booth 1-007 in the South Hall at the RSA Conference in San Francisco, CA from February 29th March 3rd . Follow us on Twitter at @SonicWallSecurity with hashtag #SonicWallGoverProtect to join the conversation. If you are virtual, see our new SMA via Live Demo and learn more: here.

Combat the Staggering Rise of Zero-Day Threats

/0 Comments/in /by

With the devastating rise of targeted, evasive, zero-day threats hitting IT infrastructures, computers, individuals and their devices, it is critical to have a multi-layer and revolutionary security solution. Today, at RSA Conference 2016, Feb. 29-Mar. 4 in San Francisco, we have launched the  SonicWall Capture Advanced Threat Protection (ATP) Service, our multi-engine or triple layer approach, which advances sandboxing beyond detection to deliver end-to-end prevention.

For SonicWall’s next-generation firewalls, we offer a multi-engine advance persistent threat analysis sandboxing service that has broad OS and file type analysis. Once a threat is identified, it not only detects but blocks it from entering the network. Come by SonicWall booth 1007 in the South Hall, where we will showcase this extraordinary SonicWall Capture sandboxing service with our worldwide customers and partners.

The RSA conference is the premier security event for thousands of experts gathering to gain greater in-depth knowledge of cyber criminal techniques and plans of attack to stop these catastrophic threats. Such threats are evolving quickly to disguise themselves, as we recently learned in the 2016 SonicWall Security Annual Threat Report. For this threat report, SonicWall leveraged its Global Response Intelligence Defense (GRID) network and telemetry data, gathered from SonicWall sensors. We continue to provide secure environments for our customers, stopping 2.17 trillion IPS attacks and blocking 8.19 billion malware attacks, up from 4.2 billion attacks last year.  Virtual sandboxes and other advanced threat detection techniques have been developed by security professionals to more effectively analyze the behavior of suspicious files and uncover hidden malware.

Detecting zero-day threats is critical, but it is not enough; technology is required that not only inspects traffic for suspicious code but also gives IT control to block suspicious code from entering the network until after it’s analyzed.  This protects the network from infection, eliminating time-consuming remedial tasks necessary to remediate damage. Additionally, follow-on attacks can be prevented with quickly generated IP signatures blocking newly discovered malware from automatically being distributed across network security devices.

This superior  SonicWall Capture Advanced Threat Protection (ATP) Service is a cloud-based service for SonicWall next-generation firewalls and Unified Threat Management Firewalls (UTM) that detects and blocks until the verdict is determined. SonicWall Capture is the only advanced threat protection offering that starts at the gateway, and includes multi-layer sandbox technologies that use system emulation, virtualization, and memory analysis techniques that not only detects but can block based on verdict before it infects the defended network. Our customers and partners benefit from high-security effectiveness, fast response times, and reduced total cost of ownership. This system is available in beta.

If you come to the booth, you will not only get to experience this ground breaking technology, but you will also talk to SonicWall experts and see live demonstrations of the SonicWall Firewall Sandwich, SonicWall Safeguard Privileged Management and other SonicWall One Identity Solutions, SonicWall Secure Mobile Access solutions, SonicWall Email Security Encryption in booth 1007. For our commercial PCs, SonicWall Data Protection and Encryption and Data Security will also be showcased.

Finally, join me and my SonicWall Security and SonicWall SecureWorks colleagues for these inspiring speaking sessions:

  • March 2 at 10:20 – Threat Actor Pivoting and the Underground Market for your Data.
  • March 4 at 11:30 – Are you worthy? Laws of Privileged Account Management.

Join the conversation on Twitter @SonicWall and follow the #SonicWallGovernProtect this week at RSA.

Follow Us

Oracle Application Testing Suite Directory Traversal Vulnerability (Feb 26, 2016)

/in /by

A Directory Traversal Vulnerability was identified in Oracle Enterprise Manager Application Testing Suite. The vulnerability can be exploited over the HTTP protocol. A remote, unauthenticated attacker can exploit this vulnerability to download arbitrary files from the target server.

This vulnerability affects the following supported versions:

  • Oracle Application Testing Suite 12.4.0.2
  • Oracle Application Testing Suite 12.5.0.2

The vulnerability has been patched by the vendor, please find the details here.

Dell SonicWALL Threat team has researched this vulnerability and released the following IPS signature to protect their customers:

  • 11463 Oracle Application Testing Suite Directory Traversal 1

This vulnerability is referred by CVE as CVE-2016-0484.

Yet another Linux malware spotted in the wild (Feb 26, 2016)

/in /by

The Dell Sonicwall Threat Research team has received reports of yet another Trojan targeting the Linux platform. Linux is widely used across many enterprise environments nowadays which make them lucrative targets by devious cybercriminals. This Trojan was reported to be created by the Sednit espionage group who are known to target organizations such as the government and military. The Trojan is capable of remotely executing arbitrary commands and keylogging.

Infection Cycle:

It copies itself as “ksysdefd” in the following locations:

  • ~/.config/ksysdef/ksysdefd
  • /bin/ksysdefd

In order to ensure that it autoruns, it adds the strings “./bin/ksysdefd & exit 0” to the rc.local file in the /etc/ directory:

It also creates the directory ~/.local/cva-ssys and saves its additional components within it.

It checks for which distribution of Linux it runs on.

And also checks for the type of desktop environment.

Looking further in its strings reveals additional capabilities of this Trojan like the ability of executing commands remotely, deleting and writing files and keylogging, among others.
Sednit capabilities found in strings

While the Trojan did not make any active network connections at the time of analysis, it has demonstrated to employ an effective way to stay undetected especially for inexperienced users as it gathers data from a victim’s machine.

Dell SonicWALL Gateway AntiVirus provides protection against this threat with the following signature:

  • GAV: Linux.Sednit.EL (Trojan)