Weekly Infosec News Brief: 9-15 Nov

Microsoft Issues Twelve Updates, Including Four to Fix Critical IE and Windows Vulnerabilities

Last week, on “Patch Tuesday,” Microsoft issued a new batch of updates for its products. Four of these are classified as “critical,” including one for Internet Explorer, one for their new Edge browser (part of Windows 10), and one for the Windows kernel. The Internet Explorer vulnerability, MS15-112, is the most likely to be exploited in the wild, and should be a priority for organizations to patch as quickly as possible. The Windows patch, MS15-115, was modified and re-released on Wednesday after some users experienced problems following its installation. If you have not installed security update 3097877 yet, ensure you have the version from November 11th before installing. https://support.microsoft.com/en-us/kb/3097877
http://www.computerworld.com/article/3004464/application-security/four-critical-patches-for-november-patch-tuesday-update-core-windows-and-office-components.html
http://www.zdnet.com/article/outlook-crashing-after-windows-security-updates-you-are-not-alone/
https://technet.microsoft.com/en-us/library/security/dn903782.aspx

Adobe Publishes Update to Fix Seventeen Critical Flash Vulnerabilities

Last Tuesday, Adobe published a new update for Flash on their regular second-Tuesday-of-the-month schedule. This update fixes seventeen critical vulnerabilities, all of which could allow an attacker to run arbitrary code on vulnerable machines. Note that Flash is the most common attack vector on desktop PCs over the past year, by a significant margin. As a result, it is critical that organizations update Flash as quickly as possible and ensure they have a procedure in place to ensure all Flash installations are kept up to date.
http://www.scmagazine.com/patch-tuesday-adobe-addresses-17-critical-vulnerabilities-in-flash/article/453050/
https://helpx.adobe.com/security/products/flash-player/apsb15-28.html


New Ransomware Threat Hitting Linux-based Web Servers

A new type of malware, dubbed "Linux.Encoder.1” by the Doctor Web antivirus maker, has been discovered to infect Linux-based web servers via vulnerable services. The malware encrypts the websites running on the servers, as well as users’ home directories, then proceeds to search through all mounted volumes to encrypt various types of files, including executables, ASP scripts, SQL, JavaScript, Java, document files. The malware leaves behind a file demanding a ransom of approximately $500, payable in Bitcoin, for the keys to decrypt the files. Ransomware is an increasingly common threat, with new varieties appearing frequently. This one is notable for being the first that appears to attack servers via exposed web services rather than aiming at client machines via the web browser.
http://arstechnica.com/security/2015/11/new-encryption-ransomware-targets-linux-systems/
http://krebsonsecurity.com/2015/11/ransomware-now-gunning-for-your-web-sites/


New Power Worm Ransomware Accidentally Destroys Data

Power Worm has been around for some time, and is a fairly typical ransomware program: it finds data files on your computer and attacked network drives and encrypts it, demanding payment in return for the keys to unlocking your data. Computer criminals have netted hundreds of millions of dollars from this sort of scheme. Part of its success is that they deliver the goods, meaning that if you pay up, they really will enable you to get your data back. As a result, law enforcement (including the FBI) acknowledges that if you don’t have backups of your data, the best course of action may be to simply pay up. The new version of Power Worm, however, has an (apparently) unintentional bug which renders the decryption key useless. Even if you pay the ransom, your data is unrecoverable. This development simply highlights the best solution for ransomware, which is a reliable backup program. And remember that you can only know if your backup procedure is reliable if you have a recent, successful restore test. You don’t want an attempted recovery from a ransomware incident to be the first time in a year that you’ve attempted to restore from backup!
http://www.bbc.com/news/technology-34765484
http://www.bleepingcomputer.com/news/security/shoddy-programming-causes-new-ransomware-to-destroy-your-data/


Google to End Updates for Chrome on Outdate Operating Systems, Including Windows XP

Google announced last week that it will stop allowing updates for the Chrome browser running on outdated operating systems, including Windows XP, Windows Vista, and MacOSX 10.8 (Mountain Lion) and earlier. The change will take effect in April of 2016, at which point it will have been almost two years since Microsoft stopped publishing updates for Windows XP. Still, many individuals and organizations continue to run XP, at least in limited deployments. This announcement from Google is just another reminder of the need to replace these unsupported platforms.
http://www.zdnet.com/article/google-ending-chrome-support-for-windows-xp-vista-in-april/


NIST Issues Guidance on Application Whitelisting

Software or settings that allow only a specific list of programs to execute on a system are one of the strongest measures to prevent malware. NIST issued new Guidance last week on implementing configurations or add-on software to accomplish this type of application whitelisting. Note that Windows 7 and newer feature AppLocker and Software Restriction Policies, two built-in capabilities to implement forms of application whitelisting.
http://www.computerworld.com/article/3002516/security/deploying-application-whitelisting-nist-has-some-advice-for-you.html