JSOC INSIGHT vol.16 English Edition

"JSOC INSIGHT" is an analysis report on the trend of security incidents, such as unauthorized access and malware infection, in Japan, based on daily analysis results by our JSOC security analysts. Since this report analyzes the trends in attacks, based on the data of incidents which JSOC customers actually encountered, the report will help in understanding world trends as well as actual threats that Japanese users are facing.

JSOC INSIGHT vol.16 contains below topics.

• WordPress REST API vulnerability(CVE-2017-1001000)
• Arbitrary code execution vulnerabilities in Apache Struts 2(CVE-2017-5638/S2-045, S2-046)
• Arbitrary code execution vulnerability in IIS 6.0 WevDAV(CVE-2017-7269)

Contents

1. Preface
2. Executive Summary
3. Trends in Severe Incidents at the JSOC
    3.1 Trends in severe incidents
    3.2 Analysis of severe incidents
    3.3 Offensive traffic detected numerous times
4. Topics of This Volume
    4.1 WordPress REST API vulnerability
     4.1.1 Vulnerability details
     4.1.2 Examples of detected attacks that exploited a vulnerability
     4.1.3 Countermeasures against the vulnerability
    4.2 Arbitrary code execution vulnerabilities in Apache Struts 2
     4.2.1 Examples of attacks detected that exploited the vulnerabilities
     4.2.2 Trend of detected attacks that exploited the vulnerabilities
     4.2.3 Countermeasures against the vulnerabilities
    4.3 Arbitrary code execution vulnerability in IIS 6.0 WevDAV
     4.3.1 Verifications against the vulnerabilities
     4.3.2 Examples of attacks detected that exploited the vulnerabilities
     4.3.3 Countermeasures against the vulnerabilities
5. Fiscal Year 2016 Trend Summary
    5.1 FY2016 Summary
    5.2 Severe incidents related to attacks from the Internet
     5.2.1 Yearly trends of severe incidents related to attacks from the Internet
    5.3 Severe incidents that occurred in intra-networks
     5.3.1 Trends of severe intra-network incidents by industry

Conclusion