SmokeLoader malware downloader enters list of most wanted malware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2014-0160 | Heartbleed: unauthenticated memory disclosure in OpenSSL TLS/DTLS heartbeat handling The flaw (CVE-2014-0160, widely known as 'Heartbleed') is an out-of-bounds read (CWE-125) in the TLS and DTLS implementations of OpenSSL, caused by improper handling of Heartbeat Extension packets. A remote, unauthenticated attacker triggers it by sending a crafted heartbeat request whose declared payload length exceeds the data actually sent, causing OpenSSL to copy up to roughly 64 KB of adjacent process memory into the response. The attacker gains chunks of process memory per request — potentially TLS private keys, session cookies, usernames and passwords — and can repeat the request to harvest more, typically without any trace in logs. Any server or client running a vulnerable OpenSSL release that enables TLS or DTLS heartbeats is affected, which at the time of disclosure included hundreds of thousands of internet-exposed HTTPS servers as well as appliances, load balancers, and bundled libraries. Exploitation is confirmed in the wild: the vulnerability is listed in CISA KEV (added 2022-05-04, required action: apply updates per vendor instructions) and EPSS assigns it the maximum 100% probability of exploitation within 30 days. Do: Apply OpenSSL updates per your OS or vendor's instructions — the upstream fix at the time of the 2014 disclosure was OpenSSL 1.0.1g, with most distributions shipping backported patches — and restart or rebuild every service linked against OpenSSL, including bundled copies in load balancers, appliances, and VPN or management interfaces. Because leaked memory can include TLS private keys, treat keys and certificates on affected endpoints as compromised: rotate keys, reissue and revoke certificates, and invalidate session cookies and credentials that may have leaked. Confirm the heartbeat fix is present on all TLS/DTLS endpoints to satisfy the CISA KEV required action. | — | 100% | KEV |
| mass≈500,000+ internet-exposed HTTPS servers at the time of disclosure, plus vastly larger embedded/library deployments | |
| CVE-2017-7269 | Buffer Overflow in Microsoft IIS 6.0 via WebDAV PROPFIND Header CVE-2017-7269 is a buffer overflow (CWE-119) in Internet Information Services (IIS) 6.0, the web server shipped with Microsoft Windows Server 2003 R2. A remote attacker triggers it by sending a WebDAV PROPFIND request whose overly long header begins with 'If: <http://', overflowing a buffer during header parsing. Successful exploitation allows remote code execution on the affected web server, giving the attacker control of the host at the web service's privilege level. Only organizations still running IIS 6.0 on Windows Server 2003 R2 are affected, typically legacy web servers, since that OS reached end of support in July 2015. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a 99.8% EPSS score (100th percentile), indicating active in-the-wild exploitation; no public PoC is recorded in this data and, because the OS is out of support, no generally distributed patch exists. Do: Inventory internet-facing systems still running IIS 6.0 on Windows Server 2003 R2 and prioritize migration to a supported Windows/IIS version, since no general patch was released for this out-of-support product (custom-support customers may be able to obtain a hotfix from Microsoft). As interim mitigation, disable WebDAV if it is not needed, or block or limit PROPFIND requests and long 'If' headers via IIS request filtering, a reverse proxy, or a WAF. Per the KEV entry, apply updates per vendor instructions; ransomware association is currently unknown. | 9.8 | 100% | KEV PoC ×5 |
| largetens of thousands of internet-exposed IIS 6.0 servers today (hundreds of thousands at the 2017 disclosure) |
Full article738 words · extracted from helpnetsecurity.com · click to collapse
Check Point has published its latest Global Threat Index for December 2018. The index reveals that SmokeLoader, a second-stage downloader known to researchers since 2011, rose 11 places in December to enter the Index’s top 10 at ninth place. After a surge of activity in the Ukraine and Japan, its global impact grew by 20. SmokeLoader is mainly used to load other malware, such as Trickbot Banker, AZORult Infostealer and Panda Banker.
Cryptomining malware continues to lead the Index, with Coinhive retaining its number one position for the 13th month in a row and impacting 12% of organizations worldwide. XMRig was the second most prevalent malware with a global reach of 8%, closely followed by the JSEcoin miner in third with a global impact of 7%. Organizations continue to be targeted by cryptominers, despite an overall drop in value across all cryptocurrencies in 2018.
The report also showed banking Trojans rising up the index, with Ramnit, a banking Trojan that steals login credentials and other sensitive data, returned to the top 10 this month in 8th place.
Maya Horowitz, Threat Intelligence and Research Group Manager at Check Point commented: “December’s report saw SmokeLoader appearing in the top 10 for the first time. Its sudden surge in prevalence reinforces the growing trend towards damaging, multi-purpose malware in the Global Threat Index, with the top 10 divided equally between cryptominers and malware that uses multiple methods to distribute numerous threats. The diversity of the malware in the Index means that it is critical that enterprises employ a multi-layered cybersecurity strategy that protects against both established malware families and brand new threats.”
December 2018: Top 3 most wanted malware
1. Coinhive – Crypto Miner designed to perform online mining of Monero cryptocurrency when a user visits a web page without the user’s knowledge or approval. The implanted JavaScript uses a great deal of the computational resources of end users’ machines to mine coins, and may crash the system.
2. XMRig– Open-source CPU mining software used for the mining process of the Monero cryptocurrency, and first seen in-the-wild on May 2017.
3. Jsecoin – JavaScript miner that can be embedded in websites. With JSEcoin, you can run the miner directly in your browser in exchange for an ad-free experience, in-game currency and other incentives.
Triada, the modular backdoor for Android, has retained first place in the top mobile malware list. Guerilla has climbed to second place, replacing Hiddad. Meanwhile, Lotoor has replaced Android banking Trojan and info-stealer Lokibot in third place.
December 2018: Top 3 most wanted mobile malware
1. Triada – Modular Backdoor for Android which grants super user privileges to downloaded malware, as helps it to get embedded into system processes. Triada has also been seen spoofing URLs loaded in the browser.
2. Guerilla – Android ad-clicker which has the ability to communicate with a remote command and control (C&C) server, download additional malicious plugins and perform aggressive ad-clicking without the consent or knowledge of the user.
3. Lotoor – Hack tool that exploits vulnerabilities on Android operating system in order to gain root privileges on compromised mobile devices.
Check Point researchers also analyzed the most exploited cyber vulnerabilities. Holding on to first place was CVE-2017-7269, whose global impact also rose slightly to 49%, compared to 47% in November. In second place was OpenSSL TLS DTLS Heartbeat Information Disclosure, with a global impact of 42% closely followed by PHPMyAdmin Misconfiguration Code Injection with an impact of 41%.
December 2018: Top 3 most exploited vulnerabilities
1. Microsoft IIS WebDAV ScStoragePathFromUrl Buffer Overflow (CVE-2017-7269) – By sending a crafted request over a network to Microsoft Windows Server 2003 R2 through Microsoft Internet Information Services 6.0, a remote attacker could execute arbitrary code or cause a denial of service conditions on the target server. That is mainly due to a buffer overflow vulnerability resulted by improper validation of a long header in HTTP request.
2. OpenSSL TLS DTLS Heartbeat Information Disclosure (CVE-2014-0160; CVE-2014-0346) – An information disclosure vulnerability exists in OpenSSL. The vulnerability is due to an error when handling TLS/DTLS heartbeat packets. An attacker can leverage this vulnerability to disclose memory contents of a connected client or server.
3. Web servers PHPMyAdmin Misconfiguration Code Injection – A code injection vulnerability has been reported in PHPMyAdmin. The vulnerability is due to PHPMyAdmin misconfiguration. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the target.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/01/15/smokeloader-malware-downloader/