Cisco Blogs

Threat Research

  • Vulnerability Spotlight: Apple Remote Code Execution With Image Files

    - July 19, 2016 - 0 Comments

    Vulnerabilities discovered by Tyler Bohan of Cisco Talos.

    Many of the wide variety of file formats are designed for specialized uses within specific industries. Apple offers APIs as interfaces to provide a definitive way to access image data for multiple image formats on the Apple OS X platform. Talos is disclosing the presence of five remote code execution vulnerabilities in Apple OS X related to processing image formats: TALOS-2016-0171, TALOS-2016-0180,TALOS-2016-0181, TALOS-2016-0183, TALOS-2016-186.

    Read More>>

  • Microsoft Patch Tuesday – July 2016

    - July 12, 2016 - 0 Comments

    This post was authored by William Largent

    Today, Microsoft has released their monthly set of security bulletins designed to address security vulnerabilities within their products. This month’s release is has 11 bulletins addressing 49 vulnerabilities. 6 of these bulletins are rated critical and address vulnerabilities in Edge, Internet Explorer, JScript/VBScript, Print Spooler, Office and Adobe Flash Player.  The remaining bulletins are rated important and address vulnerabilities in Windows Kernel, Office, Kernel-Mode Drivers, .NET Framework, and Secure Boot.

    Bulletins Rated Critical

    Microsoft bulletins MS16-084 through MS16-088, and MS16-093 are rated as critical in this month’s release.

    MS16-084 and MS16-085 are this month’s Internet Explorer and Edge security bulletins respectively.  The IE security bulletin addresses vulnerabilities in Internet Explorer versions 9, 10, & 11. The IE bulletin covers 15 vulnerabilities in total and resolves 9 memory corruption bugs, 1 security feature bypass bug, 3 information disclosure, and 2 spoofing bugs. The Edge bulletin addresses 13 vulnerabilities in total and resolves 7 memory corruption bugs, 1 security feature bypass, 3 information disclosure and 2 spoofing bugs. The IE bugs are rated critical on affected Windows clients but only Moderate on affected Windows Servers.

    Read More >>

  • When Paying Out Doesn’t Pay Off

    - July 11, 2016 - 0 Comments

    This blog post was authored by Edmund Brumaghin and Warren Mercer

    Summary

    Talos recently observed a new ransomware variant targeting users. This ransomware shows that new threat actors are continuing to enter the ransomware market at a rapid pace due to the lucrative nature of this business model. As a result, greater numbers of unique ransomware families are emerging at a faster rate. This sometimes results in complex variants emerging or in other cases, like this one, less sophisticated ones. In many cases these new ransomware threats share little resemblance to some of the more established operations in their approach to infecting systems, encrypting/removing files, or the way in which they attempt to coerce victims into complying with their ransom demands.

    Ranscam is one of these new ransomware variants. It lacks complexity and also tries to use various scare tactics to entice the user to paying, one such method used by Ranscam is to inform the user they will delete their files during every unverified payment click, which turns out to be a lie. There is no longer honor amongst thieves. Similar to threats like AnonPop, Ranscam simply delete victims’ files, and provides yet another example of why threat actors cannot always be trusted to recover a victim’s files, even if the victim complies with the ransomware author’s demands. With some organizations likely choosing to pay the ransomware author following an infection,  Ranscam further justifies the importance of ensuring that you have a sound, offline backup strategy in place rather than a sound ransom payout strategy. Not only does having a good backup strategy in place help ensure that systems can be restored, it also ensures that attackers are no longer able to collect revenue that they can then reinvest into the future development of their criminal enterprise.

    Read More >>

  • Vulnerability Spotlight: Local Code Execution via the Intel HD Graphics Windows Kernel Driver

    - July 11, 2016 - 0 Comments

    This vulnerability was discovered by Piotr Bania.

    Talos, in coordination with Intel, is disclosing the discovery of TALOS-2016-0087, a local arbitrary code execution vulnerability within the Intel HD Graphics Windows Kernel Driver. This vulnerability exists in the communication functionality of the driver and can be exploited if a specially crafted message is sent to the driver, resulting in a denial of service or arbitrary code execution. Note that exploitation of this vulnerability is only achievable in local contexts. This vulnerability has been responsibly disclosed to Intel in accordance with our Vulnerability Reporting and Disclosure guidelines.

    Read More>>

  • Connecting the Dots Reveals Crimeware Shake-up

    - July 7, 2016 - 0 Comments

    This Post Authored by Nick Biasini

    CrimewareEmail_Background

    For a couple of weeks in June the threat landscape was changed. Several high profile threats fell off the landscape, causing a shake-up that hadn’t been seen before.  For a period of three weeks the internet was safer, if only for a short time. Still to date the Angler exploit kit has not returned and the threat landscape appears to be forever changed. This post will discuss a series of connections tying back to a banking trojan called lurk and a registrant account with ties that were far reaching across the crimeware landscape.

    Read More>>

  • Gotta be SWIFT for this Spam Campaign!

    - June 30, 2016 - 0 Comments

    Talos have observed a large uptick in the Zepto ransomware and have identified a method of distribution for the Zepto ransomware, Spam Email. Locky/Zepto continue to be well known ransomware variants and as such we will focus on the spam email campaign. We found 137,731 emails in the last 4 days using a new attachment naming convention. It was just coincidence that the number is a palindrome. The naming choice this time for this spam campaign is “swift [XXX|XXXX].js”, where ‘X’ is some combination of letter/numbers we have seen both 3 and 4 char strings after the “swift” name. This began Monday 27th June with approx 4000 emails being caught within our Email Security Appliances (ESA). This started to ramp up over the next few days, with spikes occurring around 7-10pm UTC and 7-10am over the next 4 days.

    Read More >>