Microsoft Security Bulletin Coverage (Feb 9, 2016)

/in /by

Dell SonicWALL has analyzed and addressed Microsoft’s security advisories for the month of Feb. 9, 2016. A list of issues reported, along with Dell SonicWALL coverage information are as follows:

MS16-009 Cumulative Security Update for Internet Explorer

  • CVE-2016-0059 Internet Explorer Information Disclosure Vulnerability
    SPY: 1008 “Malformed-File xls.MP.49”
  • CVE-2016-0060 Internet Explorer Memory Corruption Vulnerability
    IPS:11444 “Internet Explorer Information Disclosure Vulnerability (MS16-009) 1”
  • CVE-2016-0061 Microsoft Browser Memory Corruption Vulnerability
    IPS: 11445 “Microsoft Browser Memory Corruption Vulnerability (MS16-009) 1 “
  • CVE-2016-0062 Microsoft Browser Memory Corruption Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0063 Internet Explorer Memory Corruption Vulnerability
    IPS: 11446 “Internet Explorer Memory Corruption Vulnerability (MS16-009) 2”
  • CVE-2016-0064 Internet Explorer Memory Corruption Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0065 Internet Explorer Spoofing Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0067 Internet Explorer Memory Corruption Vulnerability
    IPS: 11447 “Internet Explorer Memory Corruption Vulnerability (MS16-009) 3”
  • CVE-2016-0068 Internet Explorer Elevation of Privilege Vulnerability
    IPS: 11448 “Internet Explorer Elevation of Privilege Vulnerability (MS16-009) 1”
  • CVE-2016-0069 Internet Explorer Elevation of Privilege Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0071 Internet Explorer Memory Corruption Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0072 Internet Explorer Memory Corruption Vulnerability
    IPS: 11449 “Internet Explorer Memory Corruption Vulnerability (MS16-009) 4”
  • CVE-2016-0086 Internet Explorer Memory Corruption Vulnerability
    There are no known exploits in the wild.

MS16-011 Cumulative Security Update for Microsoft Edge

  • CVE-2016-0061 Microsoft Browser Memory Corruption Vulnerability
    IPS: 11445 “Microsoft Browser Memory Corruption Vulnerability (MS16-009) 1 “
  • CVE-2016-0062 Microsoft Browser Memory Corruption Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0077 Microsoft Edge Spoofing Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0078 Microsoft Edge Spoofing Vulnerability
    IPS: 11450 “Microsoft Edge Spoofing Vulnerability (MS16-011) 1 “
  • CVE-2016-0080 Microsoft Edge ASLR Bypass
    There are no known exploits in the wild.
  • CVE-2016-0082 Microsoft Edge Memory Corruption Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0083 Microsoft Edge Information Disclosure Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0084 Microsoft Edge Memory Corruption Vulnerability
    There are no known exploits in the wild.

MS16-012 Security Update for Microsoft Windows PDF Library to Address Remote Code Execution

  • CVE-2016-0046 Microsoft Windows Reader Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0058 Microsoft PDF Library Buffer Overflow Vulnerability
    There are no known exploits in the wild.

MS16-013 Security Updates for Windows Journal to Address Remote Code Execution

  • CVE-2016-0038 Windows Journal Memory Corruption vulnerability
    There are no known exploits in the wild.

MS16-014 Security Update for Microsoft Windows to Address Remote Code Execution

  • CVE-2016-0040 Windows Elevation of Privilege Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0041 Windows DLL Loading Remote Code Execution Vulnerability
    SPY: 4486 “Malformed-File ppsx.MP.2”
  • CVE-2016-0042 Windows DLL Loading Remote Code Execution Vulnerability
    SPY: 4483 “Malformed-File rtf.MP.8”
  • CVE-2016-0044 Windows DLL Loading Denial of Service Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0049 Windows Kerberos Security Feature Bypass Vulnerability
    There are no known exploits in the wild.

MS16-015 Security Update for Microsoft Office to Address Remote Code Execution

  • CVE-2016-0022 Microsoft Office Memory Corruption Vulnerability
    SPY: 4484 “Malformed-File rtf.MP.9”
  • CVE-2016-0039 Microsoft SharePoint XSS Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0052 Microsoft Office Memory Corruption Vulnerability
    SPY: 4480 “Malformed-File rtf.MP.6”
  • CVE-2016-0053 Microsoft Office Memory Corruption Vulnerability
    SPY: 4479 “Malformed-File rtf.MP.7”
  • CVE-2016-0054 Microsoft Office Memory Corruption Vulnerability
    SPY: 4481 “Malformed-File xlsx.MP.2”
  • CVE-2016-0055 Microsoft SharePoint XSS Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0056 Microsoft Office Memory Corruption Vulnerability
    SPY: 4482 “Malformed-File docx.MP.9”
  • CVE-2016-0057 Microsoft Office Security Feature Bypass Vulnerability
    There are no known exploits in the wild.

MS16-016 Security Update for WebDAV to Address Elevation of Privilege

  • CVE-2016-0051 WebDAV Elevation of Privilege Vulnerability
    There are no known exploits in the wild.

MS16-017 Security Update for Remote Desktop Display Driver to Address Elevation of Privilege

  • CVE-2016-0036 Remote Desktop Protocol (RDP) Elevation of Privilege Vulnerability
    There are no known exploits in the wild.

MS16-018 Security Update for Windows Kernel-Mode Drivers to Address Elevation of Privilege

  • CVE-2016-0048 Win32k Elevation of Privilege Vulnerability
    There are no known exploits in the wild.

MS16-019 Security Update for .NET Framework to Address Denial of Service

  • CVE-2016-0033 .NET Framework Stack Overflow Denial of Service Vulnerability
    There are no known exploits in the wild.
  • CVE-2016-0047 Windows Forms Information Disclosure Vulnerability
    There are no known exploits in the wild.

MS16-020 Security Update for Active Directory Federation Services to Address Denial of Service

  • CVE-2016-0037 Microsoft Active Directory Federation Services Denial of Service Vulnerability
    There are no known exploits in the wild.

MS16-021 Security Update for NPS RADIUS Server to Address Denial of Service

  • CVE-2016-0050 Network Policy Server RADIUS Implementation Denial of Service Vulnerability
    There are no known exploits in the wild.

Dell SonicWALL and Financial Sector CIG

/in /by

Malicious cyber actors are targeting the U.S. financial sector with an increasing array of cyber malware. In order to provide better protection for its customers, Dell SonicWALL is a working with partners to provide comprehensive, accurate and timely protection against these threats.

Financial Sector Cyber Intelligence Group (CIG) Circulars are covered by Dell SonicWALL Security Services. Details are listed below:

Circular 37

    IPS:10967 "CIG APT C&C Traffic 2"

Circular 38

    IPS:10966 "CIG APT C&C Traffic 1"
    IPS:10968 "CIG APT C&C Traffic 3"

Circular 40

    IPS:11069 "CIG APT C&C Traffic 4"
    IPS:11070 "CIG APT C&C Traffic 5"
    IPS:11071 "CIG APT C&C Traffic 6"
    IPS:11072 "CIG APT C&C Traffic 7"
    IPS:11073 "CIG APT C&C Traffic 8"

Circular 41

    IPS:11092 "CIG APT C&C Traffic 9"
    IPS:11093 "CIG APT C&C Traffic 10"

Circular 43

    IPS:11133 "CIG APT C&C Traffic 11"
    IPS:11134 "CIG APT C&C Traffic 12"
    IPS:11135 "CIG APT C&C Traffic 13"
    IPS:11136 "CIG APT C&C Traffic 14"

Circular 44

    IPS:11144 "CIG APT C&C Traffic 15"

Circular 46

    IPS:11173 "CIG APT C&C Traffic 16"
    IPS:11174 "CIG APT C&C Traffic 17"

Circular 47

    GAV: "Exploit.CVE-2015-2590.A_2 (Exploit)"
    GAV: "Exploit.SWF.CVE-2015-3043 (Exploit)"
    GAV: "BackDoor.FCQQ (Trojan)"

Circular 51

    IPS:11246 "CIG APT C&C Traffic 19"

Circular 52

    IPS:11247 "CIG APT C&C Traffic 20"
    IPS:11248 "CIG APT C&C Traffic 21"
    IPS:11249 "CIG APT C&C Traffic 22"
    IPS:11250 "CIG APT C&C Traffic 23"
    IPS:11251 "CIG APT C&C Traffic 24"
    IPS:11252 "CIG APT C&C Traffic 25"

Circular 53

    IPS:11292 "CIG APT C&C Traffic 26"

Circular 55

    IPS:11453 "CIG APT C&C Traffic 27"
    IPS:11454 "CIG APT C&C Traffic 28"

FakeAV.DBG: A Malware uses Windows Sysinternals name to avoid detection (Feb 2, 2016)

/in /by

The Dell Sonicwall Threats Research team observed reports of a New Malware family named GAV: FakeAV.DBG actively spreading in the wild. This time attackers used fake name such as Sysinternals Debug Output Viewer for their malware to avoid detection by users. Sysinternals is a part of the Microsoft TechNet website which offers technical resources and utilities to manage, diagnose, troubleshoot, and monitor a Microsoft Windows environment.

Infection Cycle:

The Malware uses the following icon:

Md5:

  • b11f23f988d7e8ea3664ef292f8f6d2b

The Malware adds the following files to the system:

  • Malware.exe

    • C:Program FilesCommon Filessochvst.exe [Detected as GAV: FakeAV.DBG (Trojan)]

The Malware adds the files to Windows start-up folder to ensure persistence upon reboot:

  • %Userprofile%Start MenuXnz.url [ Auto Start-up file ]

  • %Userprofile%Start MenuXnv.url [ Auto Start-up file ]

Once the computer is compromised, the malware copies its own files to User and Startup folders.

The Xnz.url and Xnv.url files dropped after malware launches on the target system, here is an example:

The malware uses a DLL Injection to avoid detection by Anti-Virus programs. Here is an example:

The Malware installs key Logger on the target machine and extracts valuable information such as pressed keys like following example:

Command and Control (C&C) Traffic

FakeAV.DBG performs C&C communication over 5133 port. The malware sends your system information to its own C&C server via following format, here is an example:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

  • GAV: FakeAV.DBG (Trojan)

Three Core Network Security Tips From a K-12 IT Expert

/0 Comments/in /by

Every moment of every day, anyone or any organization, government or institution – including K-12 – can fall victim to the latest threats and cyber-attacks. If you’re accountable for the network security of an entire school district, you know your success rests largely on everyone understanding and staying current with today’s complex and dynamic risk environment and how to avoid it.

K-12 IT expert Larry Padgett bears this out: “The most important thing is to get everybody to agree that technology security is everyone’s game, everybody on campus, and every division, department and schools must be fully engaged. Otherwise, it is going to be very difficult to be successful.”

Larry is the Director of IT Infrastructure, System Support, Security, and Governance for the School District of Palm Beach County (SDPBC). A career technology leader for more than 29 years, Larry oversees an IT infrastructure that is considered larger than the Coca-Cola® Company in terms of the number of ports and how his networks are laid out. SDPBC is one of the largest school district in the United States, with 187 schools and 225,000 thousands user accounts under management, including students, faculty, and general staff.

I had the privilege of meeting Larry at the 2015 SonicWall World Conference in Austin, Texas, where I had the opportunity to ask him specifically about the things that he is doing differently that allowed SDPBC to be successful.

Larry explained how security vendors typically talk about security as a layered approach but it can’t end there. He then described SDPBC’s winning approach to security rests on three core pillars: people, process and technology.

You must identify those who are, and who aren’t, fully engaged in exercising cyber hygiene within your district. You are responsible for every PC, servers and applications on your network. You’ll need to know if you are getting support from the board and leadership level down to everyone in the district.

People

  • How do you know if they are knowledgeable about security?
  • Can they identify the risks?
  • Do they all understand the risks?
  • What trial and test do you have in place to measure how knowledgeable they are about security?

If they’re not all engaged, you’re simply not going to be as successful as you could be. If they’re not as knowledgeable as they need to be, you would want to start discussing security as an everyday topic in your staff meetings, in the classrooms and, more importantly, in your executive and board room discussions. If security isn’t one of the top topics on the board agenda, you have much important work to do to get their buy-in, because nowadays, security is a key risk metric. Your ultimate goal is to get everybody to agree that security is everyone’s game so they become proactively involved in helping your institution be successful.

Process

When there are people involved, you also need to have processes in place that would allow you to make sure that you are doing the right things, that they are doing them well and that what they do is actually effective for the state of business you’re currently operating in.

  • What processes are you using?
  • Have you written them down?
  • How do you know if they are being followed?
  • How are they monitored and measured?

These are questions that enable you to think through all of the risks that you’re going to mitigate, and follow-through with implementing robust security policies and practices that can help put you in a better position for success.

Technology

Begin embracing a layered security approach as part of your defense-in-depth framework, because it provides you an effective and proactive way to help fend off today’s advanced threats. At a minimum, the top five security services that you must have as part of your layered security defense are:

  1. A capable intrusion prevention system with threat detection services that can provide complete anti-evasion and inbound anti-spam, anti-phishing and anti-virus protection
  2. SSL inspection to detect and prevent today’s advance evasive tactics and compromised web sites from sneaking malware into your network though the use of encryption
  3. Around-the-clock threat counter-intelligence for your next-generation firewalls and intrusion prevention systems, so you can receive the latest countermeasures to combat new vulnerabilities as they are discovered
  4. Email filtering and encryption to secure both inbound and outbound communications
  5. Security for endpoints, since most network infections begin with a compromised user device

SonicAlert: Microsoft Windows OS HTTP User-Agents (1/29/2016)

/in /by

Microsoft Windows™ OS HTTP User-Agents

This SonicAlert article presents some telemetry data regarding the relative occurrence of the various Microsoft Windows™ operating systems in use behind Dell SonicWALL firewalls.

What is an HTTP User-Agent?

Broadly speaking, a User-Agent is any software client program that makes web requests to a web server using the HTTP Protocol. The HTTP Protocol is a set of guidelines for how clients and servers should communicate. One of the Headers specified by the HTTP Protocol is the User-Agent (UA) string. This is a string sent by the client program to identify itself to the web server. Here is an example screenshot showing the break-down of a web request from a WIN8.1 OS with Internet Explorer 11.0 (IE11.0) to a site called WhatIsMyBrowser.com

WIN8.1 IE11 SCREENSHOT

Over time various conventions regarding the format of the string have been adopted by web clients which have resulted in unexpected parts. For example most UA strings for Windows begin with “Mozilla”. I am sure there is an interesting story there, but I won’t go into it. There are other interesting aspects to the UA string. Most Microsoft Windows™ web browsers will send along both the version of the operating system, as well as the version of the web browser. This information is useful to the web server so that it can serve web pages using HTML that won’t break the browser. (The history of web browsers is littered with all kinds of browser quirks–intentional, and un-.)

The following image shows what the HTTP Request looks like over HTTP Protocol, as sent from a WIN7 (NT 6.1) OS using IE10.0:

WIN7_IE10.0_WIRESHARK.PNG

Which version of Microsoft Windows™ is most common?

The data in the chart below is telemetry data from our Dell SonicWALL firewalls. The data shows the relative number of “hits” for different Microsoft Windows™ Operating Systems (OSes) by measuring the occurrences of hits for our various Application Control signatures for “HTTP User-Agent” signatures.

Microsoft Windows OS HTTP User-Agents Data Chart

The most obvious observation about this data is that Windows 7 (in purple plot line) appears to be the most common version of Microsoft Windows™ that we see by a huge margin. (This is probably acurate but one caveat to the data. The data counts a “hit” for every web request made by the client program. Some web browsers may be more “chatty” than other versions which will skew the results towards making that version seem more commom.) Other trends you can just make out in the chart are the rise of WIN8 (grey) and WIN8.1 (orange), and the slow long decline of WINXP (blue).

As a Security Admin, Why Should I Care?

With access to a Dell SonicWALL firewall, you as a Security Administrator can use the logging facility to analyze Application Control signatures for “HTTP User-Agent” (application) to make an assessment of which versions of Microsoft Windows™ are active on your network. From this analysis you can identify the presence of older, unsupported versions like WINXP, VISTA, WINNT that are end-of-life, or nearing so, and replace these systems for more secure versions.

Avoid Making a Costly Network Security Shortlist Decision

/0 Comments/in /by

Living the life of a chief security officer (CSO), chief information security officer (CISO) or any title with the word “security” in it nowadays is surely a heart-wrenching experience each day. Far too often, yet another data breach in the news reminds you of the obvious notion that it’s not a matter of if but when you’ll be called upon to manage and contain a security incident in your organization. Regardless of its depth and severity, this has to be very disturbing and there seems to be no end. As a result, you find yourself regularly worrying if you’ve done a thorough job at vetting your cyber-defense system, and determining if it is really doing its job to prevent avoidable attacks on your networks. You understand the stakes. If any part of your security strategy is not functioning at its optimal level, you know your organization is susceptible to countless security risks. The bottom line is you don’t ever want to stand in front of the executives explaining why the company is breached, and dealing with the after-math as a result of a failure in one or more of your security layers. There is a way, however, to help you avoid such a disaster.

Limited resources and shortage of security staff can constrain your ability to carry out a rigorous vendor vetting process. The fundamental question then is what alternatives are there to help you efficiently select potential technologies that can put you in a position of strength and success against evolving threats. As a security leader, you’ve been down this road many times. You‘re aware that choosing the right technology partner with capable solutions to support your security strategy for the long-term is one of the most nerve-wracking but crucial task you must undertake. The range of capabilities and factors impacting your choice are overwhelming. You understand very well that making a poor choice could end up costing your organization millions in breach remediation expenses, immeasurable brand damage, loss of public confidence and possibly even your career. To help avoid such a costly decision when shortlisting possible vendors and their solutions for proof of concept (PoC) consideration or making the purchase, there are highly specialized market research companies that are well-recognized by the security industry for their reputable and impartial validation of network security quality and effectiveness that you can confidently use when making your selections.

The difficulty here is that there are many market research companies available. Most have specialization in a variety of technologies including network security. And to make things a little more complicated, each has it its own definition, criteria and approach to how vendors are evaluated and graded for their security effectiveness, performance and cost of ownership. The results often vary among them especially those that are vendor-sponsored research. Subsidized research and testing are always skewed to make one vendor’s product more favorable than its rival. And as such, these kind of reports lack objectivity, are seldom reliable from a technical perspective, and should not be viewed as serious research. So who should I depend on? Who do I need to stay clear of? Should I trust its finding completely? Where do I start? These are some good questions to help set clear direction and decision points. From our point of view, a good place to start is to give greater attention to independent research companies that are self-funded, has zero connection to any one vendor and focus exclusively on cyber-security. More importantly, you would also want the research to be fully verified by extensive public testing using different permutation of actual real-world use cases that best match your unique security environment requirements.

One particular company has differentiated itself in the IT security category over the past few years: NSS Labs. It is now broadly recognized as the world’s trusted authority in providing unbiased, independent, security product test reports and security intelligence services. NSS Labs reporting can help you shortlist vendors and their products based on empirical laboratory test results as opposed to fuzzy marketing, product surveys, opinion based analysis and/or peer-to-peer recommendation. The NSS Labs Test report is the ultimate validation of network security performance, resiliency and efficacy under various network traffic mixes and loads that mimic real-world use cases.  Download a free copy of the NSS Labs Test Report to gain knowledge of key performance indicators essential to the success of your cyber-defense strategy.

Download Report

Dodging the Next Hack with Dell Security: Wrap Up of NRF’s BIG Show in New York

/0 Comments/in /by

Back from NYC, where I attended last week’s National Retail Federation annual conference, “The Big Show.”It’s been a long time since I’ve been to a major event like this one, but retail continues to be important to SonicWall and is now part of what I do here at SonicWall Security, particularly for our SonicWall network security offerings.

So what’s new in the retail industry? Judging from all I saw, tons, of course. Retailers are all in on getting the most out of their brick-and-mortar locations as well as their various online and social outlets. Multichannel and omnichannel are retail’s new normal. New technologies continue to emerge, starting with information technology, which drives the customer experience with data analytics, to in-store beacons and other Internet of Things devices, store, website, and fulfillment design, POS systems, targeted marketing the list goes on and on, testament to the hundreds of vendors exhibiting at the NRF show.

We had plenty of visitors to the SonicWall Security booth, and good conversations with all. Some visitors and customers joined us for happy hour and a very elegant dinner Monday evening at Colicchio & Sons, in what we used to call the Meatpacking District when I called New York my home. A part of Manhattan that was almost desolate in the evening has become very much alive. The dinner gave me a chance to listen to what customers were thinking and providing a SonicWall perspective on how we can help.

You’d think that with all the attention to hacks and breaches of major retailers, security would be a major focus of an event like this, but I didn’t find that to be the case, and was, quite frankly, surprised. Our presentation by Kent Shuart, Dodging the Next Hack, How to Protect Your Business, was one of only two conference sessions with a security focus. You can read more about Kent’s presentation in SC Magazine. Of special note is Kent’s point that small and medium size retailers may be an even bigger target in 2916 than their larger retail counterparts. Many of these small and medium sized retailers have not updated their protections while hackers continue to get more sophisticated. The black market value of credit card records is such that even a small business’s account data can be a major hack windfall.

Me, I don’t believe that the retail industry doesn’t want to talk security. I think that the industry as a whole understands that without a secure network infrastructure, the customer and business data that is their lifeblood is at risk. Whether in a store or online, businesses large and small need solid, secure, scalable, beyond-PCI-compliant network security that doesn’t just protect them from cyber criminals, but gives them a leg up on their competition.

Although the booth was small the message was big: SonicWall would like to be your trusted partner in all things IT. We can help build your retail business in a secure way without breaking the bank. Learn more about our retail solutions, or visit us online.

download ebook

Microsoft Word Remote Code Execution Vulnerability (CVE-2015-0097) (Nov 25,2015)

/in /by

Remote code execution vulnerability exists in Microsoft Office software and is caused when the Office improperly handles objects in memory while parsing specially crafted Office files. This could corrupt system memory in such a way as to allow an attacker to execute arbitrary code CVE-2015-0097.

To exploit this vulnerability the user has to be tricked into visiting the attacker’s website by clicking on a link. Another scenario could be downloading and opening specially crafted MS office email attachment. Microsoft Word, Excel and Powerpoint contains a remote code execution vulnerability because it is possible to reference documents such as Works document (.wps) as HTML. It will process HTML and script code in the context of the local machine zone of Internet Explorer which leads to arbitrary code execution.

Once the user opens the office document the attacker is able to perform actions in security context of the logged in user.

In the following exploit the word document contains embedded html and script code.

When the user opens this document the code is executed. The code connects to attacker’s server and downloads a file which is saved as .hta in the appdataroamingmicrosoftwindowsstart menuprogramsstartup directory.

So when the user reboots the machine this malicious file which is saved in the startup directory is executed. This allows remote attacker to execute arbitrary code via crafted office document aka “Microsoft Word Local Zone Remote Code Execution Vulnerability.”

Dell SonicWALL Threat Research Team has researched this vulnerability and released following signature to protect their customers

  • GAV 19554 : Malformed.wps.MP.2

A wave of malicious VBScript may lead to financial fraud (Jan 22, 2016)

/in /by

The Dell SonicWALL Threats Research team has observed a recent wave of malicious VBScript files targeting the Portuguese-speaking population. These files arrive as attachments to emails purporting to be important bank documents.

Infection Cycle

The file arrives as a zip file attachment to an email.

Figure 1: Spam email with a malicious zip attachment

The archive contains a file with a .vbs or .vbe file extension with names such as the following:

Figure 2: Malicious VBScript filename examples

Upon execution the malware makes a DNS query to the following domains:

Figure 3: DNS queries made to random domain names in attempt to contact the remote server

It then downloads additional malicious files:

Figure 4: HTTP GET request made by this malware

It also tried to connect to another remote server possibly to send information out. But at the time of analysis, that server appeared to have already been taken down.

Figure 5: TCP connection requests made to abuse-sinkhole.changeip.net

Our statistics show that countries with Portuguese-speaking population are the main target of this attack with Brazil being hit most, followed by Portugal, US, Uruguay and Spain. The signature hits show a clear upward trend in the number of infections detected over the past week.

Figure 6:Firewall hits per country

Figure 7: Daily signature hits

Overall, this Trojan is capable of downloading additional malware into the victim’s machine. It can also send sensitive information out to a remote server. We urge our users to always be vigilant and cautious with any unsolicited emails specially if you are not certain of the source.

Dell SonicWALL Gateway AntiVirus provides protection against this threat with the following signature:

  • GAV: Download.VBS (Trojan)

Windows Media Center Information Disclosure Vulnerability CVE-2015-6127 (Jan 22, 2016)

/in /by

Windows Media Center (WMC) is digital video recorder and media player created by Microsoft. WMC allows remote attackers to read arbitrary files via a crafted .mcl file, aka “Windows Media Center Information Disclosure Vulnerability”

.mcl file has a application tag that has run parameter. When this file is opened whatever is in the run parameter gets executed .For example if we create a simple .mcl which looks like this and click it calculator pops up.

The application element can also have a URL parameter. The url/file mentioned in this parameter would be rendered as html in WMC’s embedded browser. So if the URL parameter points to itself (the same .mcl file), this file will be executed as html in WMC’s embedded browser. An attacker can create a specially crafted .mcl file which reads information from the user’s local system and send it to the attacker’s website.

As shown in the code below the url parameter in the newSong.mcl file points to itself. When the user clicks the mcl file it will launch
and the script in the mcl file will upload the “calc.exe” file to attacker’s website.

Due to this vulnerability (CVE-2015-6127) the attacker can disclose information or steal documents from victim’s computer.

Dell SonicWALL Threat Research Team has researched this vulnerability and released following signature to protect their customers.

  • IPS 11327 : Windows Media Center Information Disclosure (MS15-134)