Threat Intelligence Report - October 21-27 2019

Trends

• The top attacker country was China with 2639 unique attackers (32%).
• The top Exploit event was Authentication with 54% of occurrences.
• The top Trojan C&C server detected was Trickbot with 65 instances detected.
• The most prevalent malware detected was Bitcoin Miner xme64-2141.exe, first seen 10th March 2019.

Top Attacker by Country

Threat Geolocation

Top Attacking Hosts

Top Network Attackers

Top Event NIDS and Exploits

Top Alarms

Comparison from last week 

Remote Access Trojan C&C Servers Found

Common Malware

ID:        CVE-2019-14287
Title:    SUDO Security Policy Bypass Vulnerability
Vendor:    Multi-Vendor
Description: When sudo is configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, it is possible to run commands as root by specifying the user ID -1 or 4294967295. This can be used by a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access as long as the ALL keyword is listed first in the Runas specification. An attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID.
CVSS v2 Base Score:    7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

ID:        CVE-2019-2215
Title:    Android Binder Use-After-Free Vulnerability
Vendor:    Google
Description: A use after free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.
CVSS v2 Base Score:    4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)

ID:        CVE-2019-7609
Title:    Kibana Timelion Remote Code Execution Vulnerability
Vendor:    Elastic
Description: Kibana Timelion visualizer is exposed to an arbitrary code execution vulnerability. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
CVSS v2 Base Score:    10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID:        CVE-2019-16278
Title:    Nostromo Nhttpd Remote Code Execution Vulnerability
Vendor:    Nazgul
Description: A Directory Traversal vulnerability exists in the function http_verify in nostromo nhttpd. It allows an attacker to achieve remote code execution via a crafted HTTP request. An attacker can bypass a check for /../ which allows to execute /bin/sh with arbitrary arguments.
CVSS v2 Base Score:    7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

ID:        CVE-2019-2890
Title:    Oracle WebLogic Server Vulnerability
Vendor:    Oracle
Description:  A vulnerability exists in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Easily exploitable vulnerability allows high privileged attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
CVSS v2 Base Score:    6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)

ID:        CVE-2019-17662
Title:    ThinVNC Authentication Bypass Vulnerability
Vendor:    Cybelsoft
Description: ThinVNC 1.0b1 is vulnerable to arbitrary file read, which leads to a compromise of the VNC server. The vulnerability exists even when authentication is turned on during the deployment of the VNC server. The password for authentication is stored in cleartext in a file that can be read via a ../../ThinVnc.ini directory traversal attack vector.
CVSS v2 Base Score:    5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

ID:        CVE-2019-11510
Title:    Pulse Connect Secure arbitrary file read vulnerability
Vendor:    PulseSecure
Description: In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability.
CVSS v2 Base Score:    7.5  (AV:N/AC:L/Au:N/C:P/I:P/A:P)

New CVE's