April 23, 2007 - Current Activity

New Attack Technique for ARM Architecture

US-CERT is aware of a new attack technique presented at CansecWest and Black Hat Amsterdam. This technique affects devices that use the ARM (including Xscale) architecture, such as routers, wireless access points and mobile phones. The technique demonstrates that a vulnerability that results in a NULL pointer dereference can be used to execute arbitrary code.

US-CERT has been working with vendors to inform them of this attack technique and provide mitigation strategies.

US-CERT will continue to investigate and provide additional information as it becomes available.

Apple Releases Security Update to Address Multiple Vulnerabilities in Various Products

Apple has released Security Update 2007-004 to address multiple vulnerabilities in various products. The impacts of these vulnerabilities include arbitrary code execution, privilege escalation, SYSTEM level access, information disclosure, and denial of service.

More information about these vulnerabilities is located in the Vulnerability Notes Database and Technical Cyber Security Alert TA07-109A.

US-CERT encourages users to apply the appropriate updates as soon as possible.

Oracle Releases Critical Patch Update for April 2007

Oracle has released the Oracle Critical Patch Update (CPU) for April 2007. This update contains 36 new security fixes for multiple vulnerabilities in various Oracle products and components. The impacts of these vulnerabilities vary depending on the product, component, and configuration of the system. Potential consequences include the execution of arbitrary code or commands, disclosure of sensitive information, and denial of service.

More information is available in the Critical Patch Update for April 2007.

We strongly encourage Oracle administrators to review, test, and install the patches within the April 2007 CPU.

Virginia Tech Tragedy May Spawn Phishing Sites

In recent years, US-CERT has received reports of an increased number of phishing sites set up in the wake of tragedies and natural disasters. US-CERT reminds users to remain cautious when receiving unsolicited email that could be a potential phishing attempt.

Phishing emails may appear as requests for donations from a charitable organization asking the users to click on a link that will then take them to a fraudulent web site that appears to be a legitimate charity. The users are then asked to provide personal information that can further expose them to future compromises.

Users are encouraged to take the following measures to protect themselves from this type of phishing attack:

• Do not follow unsolicited web links received in email messages.
• Contact your financial institution immediately if you believe your account and/or financial information has been compromised.
• Verify the legitimacy of the email by contacting the company directly through a trusted contact number.
• Visit the Anti-Phishing Working Group for more information on known phishing attacks.

For additional information regarding phishing, US-CERT recommends reading the following documents:

1. Technical Trends in Phishing Attacks
2. Recognizing and Avoiding Email Scams
3. Avoiding Social Engineering and Phishing Attacks

New Rinbot Variant Attempting to Exploit Microsoft Windows DNS RPC Vulnerability

US-CERT is aware of a new variant of the Rinbot worm that is currently scanning for port 1025/tcp and attempting to exploit the recent buffer overflow vulnerability in the Microsoft Windows DNS service RPC management interface. Like other variants of Rinbot, this variant is an Internet Relay Chat controlled backdoor that may provide an attacker unauthorized remote access to a compromised machine.

US-CERT recommends the following actions to help mitigate the security risks:

• Install anti-virus software, and keep its virus signature files up-to-date.
• Review Microsoft Security Advisory 935964 for additional information and workarounds.

New Storm Worm Variant Spreads through Social Engineering

US-CERT is aware of a new variant of the Trojan Worm known as "Storm Worm" that uses social engineering with mass mailing to spread to unsuspecting victims. This variant of Storm Worm arrives as an email attachment and also propagates through network file shares. Clicking on the executable file in the email installs a rootkit that may mask the malicious software from virus scans and shut down running security programs. This virus then scans the machine's hard drive to harvest email addresses that can be used to launch a spam attack.

Understanding that the subject lines can change at any time, we are currently aware of the following:

• Worm Alert!
• Worm Detected
• Virus Alert
• ATTN!
• Trojan Detected!
• Worm Activity Detected!
• Spyware Detected!
• Dream of You
• Virus Activity Detected!

The message body typically contains an image with text that warns of a worm and states that the attached .zip file is a patch for the worm. The .zip file is generally password-protected with the password given in the image. Passwords may differ among samples.

US-CERT urges users and administrators to take the following preventative measures to mitigate the security risks:

• Install anti-virus software, and keep its virus signature files up-to-date.
• Block executable and unknown file types at the email gateway.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Publicly Available Exploit Code for Vulnerability in RPC on Windows DNS Server

US-CERT is aware of publicly available exploit code for a buffer overflow vulnerability in the Microsoft Windows DNS service RPC management interface. We are also aware of reports indicating this vulnerability is being actively exploited.

More information about this vulnerability can be found in the following:

• Technical Cyber Security Alert TA07-103A
• Vulnerability Note VU#555920
• Microsoft Security Advisory 935964

US-CERT recommends the following actions to help mitigate the security risks:

• Disable the RPC interface used by the Microsoft Windows DNS service
• Block or Restrict access to RPC at the network perimeter