Insecurity, ninth strip of this new comics.

Click on the image for full size.

Fergie (Paul Ferguson) just sent this to funsec:

From the duh-its-a-bot-department!

Via ABC News’ “The Blotter”.

[snip]

A foreign hacker who penetrated security at a Harrisburg, Pa., water
filtering plant is under investigation by the FBI for planting
malicious software capable of affecting the plant’s water treatment
operations, ABC News has learned.

The hacker tried to covertly use the computer system as its own
distribution system for e-mails or pirated software, officials told ABC.
(more…)

First we had Internet Explorer 7 “mhtml:” Redirection Information Disclosure issue and then Internet Explorer 7 Popup Address Bar Spoofing Weakness was reported.

Windows Injection case was originally discovered by Secunia Research guys in November 2004 already. MSIE versions 5.01, 5.5 and 6.0 are unpatched still and Mr. Per Gravgaard reported Internet Explorer 7 as affected today via new SA22628 advisory.

Microsoft Internet Explorer team had almost two years to fix the issue but they didn’t fix it.

Test link is located at the following URL:

secunia.com/multiple_browsers_window_injection_vulnerability_test/ 

Mr. Adam Laurie, UK has recently posted the demonstration code (Python) which

…will exchange crypto keys with the passport and read and
display the contents therein, including the facial image and the
personal data printed in the passport. Currently the data read is
limited to the following objects:

…..

Project site www.rfidiot.org (it stands for “RFID IO tools“) has other RFID passport related material as well.

This week with reported vulnerabilities in First-Generation RFID enabled credit cards is not good news to RFID technology! These NBC Today video and YouTube demonstration video show the skimming attack etc.

I’m not saying “Enjoy!”, I’m saying “Be careful!”

e360 is going after Spamhaus again, this time trying to use the US Marshall service to
seize www.spamhaus.org from Tucows, Inc.

“Game on.”

Gadi Evron,
ge@linuxbox.org.

When I first started [I was about 13 & 1/2] working with computers I was really interested in figuring out how the ‘did what they did’. So much so that I was tinkering with assembler within 6 months of getting a computer, not that I accomplished much at that time. I didn’t have internet access so my only ‘escape’ from the real world was delving deeper into the machine. I quickly developed programming skills and was becoming trapped by the limits imposed in QuickBasic (hey we all learn somehwere ). I went back to looking at assembler since I knew I could encode byte code into the basic programs. After that I made some great mode 13 games and demos. (more…)

From “Schneier on Security“:

FLUNKY: Sir, that Schneier person called again. He left a detailed
message.
(more…)

A newly released paper shows how a fragmentation attack can be used to cause web site that don’t filter out content too strictly to include arbitrary javascript which in turn can be used to cause a cross site scripting vulnerability. One such web site is of course MySpace.com.

The concept basically stems from the idea that if the web site looks for tags when it filters out content, then using broken tag content will render the filtering mechanism useless.

You can read more about this in the following link.

I have noticed over the couple last weeks that the amount of vulnerabilities being discovered in PHP related products have soared. This might have been a good thing if these vulnerabilities weren’t sometimes fictitious.

Take this example:
Smarty-2.6.1 Remote File Include Vulnerabilities

The poster of the vulnerability mentions these lines of code as being vulnerable:
require_once ‘./config.php’;
require_once SMARTY_DIR . ‘Smarty.class.php’;
require_once ‘PHPUnit.php’;

And further says that by passing:
/unit_test/test_cases.php?SMARTY_DIR=Sh3ll?

He is able to cause the PHP code to include arbitrary code. The vulnerability is simply not there, credit is due to J. Carlos Nieto for noting it first.

Is this a single incident? No, another example is a vulnerability titled:
gcards (languagefile) Remote File Include
(more…)

As can be seen in the quoted message below –

So, here we go. Real-life uses for vulnerabilities.

Below is an example of just ONE “drop-zone” server in the United States, which has “600 financial companies and banks”.

Several gigs of data.

How do these things work?
(more…)

Firefox version 2.0 is officially out now.

Mozilla Foundation has introduced a new Phishing Protection page at the same time:

Firefox 2 contains a built-in Phishing Protection feature that warns you of suspected Web forgeries, and offers to take you directly to a search page so you can find the real Web site you were looking for. You can test the Phishing Protection feature by browsing to this test site.

Page Known Vulnerabilities in Mozilla Products will be likely updated shortly too.

It appears that the most of localized builds are available.

Update 26th Oct: There was no security fixes included this time.

So, what I am going to talk about… A tad bit of history on vulnerabilities and their use on the Internet, and then, what we are going to see on corporate, ISP and Internet security relating to botnets this coming year.

Vulnerabilities don’t exist for the sake of vulnerabilities. They are used for something, they are a tool. Botnets are much the same, using vulnerabilities on the next layer.

This past year we have seen how disclosed vulnerabilities, patched vulnerabilities and 0days have been utilized by automated kits. An inter-linked system of websites which download malicious code (update the kits), try to infect millions of users from just a couple dozen main hubs, and react to the environment.
If a certain vulnerability is seen to be more successful on certain OS types or if one is found to not work, the kit will be fixed accordingly and distributed. Often immediately after a patch Tuesday, likely that same Friday evening.

This way, income can be maximized with the number of infections, data stolen and thus ROI. Both from the expected response time of the vendors as well as how many victims can be reached in that window.

One such kit is Webattacker, which has recently been getting more known in public circles.
(more…)

I have seen a PR last month from Mcafee on this issue, and now they issued another one.

For most cases, I don’t believe in IDS products.

I think that trying to pitch I[DP]S as a solution for botnets is technologically silly, but marketing-wise right on the spot. As THE solution it is plain and simple silly.
A lot of security vendors will now start taking that approach, dealing with the buzzword.

An IPS will not cure your botnet problems. It may help pinpoint some bots (or similar) on your network, which is important, but that’s about it.

I wish Mcafee all the luck in the world, but this is, in my opinion, way
way way over-hyped:
http://www.mcafee.com/us/local_content/white_papers/wp_botnet.pdf

In another PR they present a case study on how they saved a south American
country from a botnet attack using their IPS. I would like to see
more.. or something, to back it up as to how, before I state my opinion.

What do you think?

Gadi Evron,
ge@linuxbox.org.

How many times have you received an email offering “work from home” or 75K a year? These are money mule recruitment emails.

A money mule is much like a drugs mule. The mule facilitates the transfer of the money as a middle-man. If say, an eastern European mobster wants to get the money he stole from a bank account in the US by the means of phishing, he’d have to somehow transfer that money.

The money mule would get the money, keep a small percentage and send the rest via the anonymous Western Union, laundering it.

Today was the first time we observed a money mule recruitment happening on instant messaging.

Be careful on what you believe, no matter if via email, the phone or IM.

Gadi Evron,
ge@linuxbox.org.

So, blue pill no longer works on Vista. Well, that’s too bad. After talking to a few friends of mine, I decided writing a bit more about this.

The main question following this news is: does that mean we are now secure?

The answer, plain and simple, is no.

Why?

1. There are other rootkit and trojan horse technologies.
2. This did not solve the problem, it just made sure a driver would have to be loaded to make it work. As a rootkit is being installed, I don’t see this as much of a set-back.

What it is a set-back for, is legitimate software development. As an example, a hex editor. The devlopers would have to create a driver for this purpose specifically. I can see how this can become an issue for a lot of the software out there which needs to access the drive. Now they can’t.

A driver will be written and released for bad guys to use with their backdoor tools.

To quote Joanna on this issue, from the same blog:

Imagine a company wanting to release e.g. a disk editor. Now, with the blocked write access to raw disk sectors from usermode, the company would have to provide their own custom, but 100% legal, kernel driver for allowing their, again 100% legal, application (disk editor), to access those disk sectors, right? Of course, the disk editor’s auxiliary driver would have to be signed – after all it’s a legal driver, designed for legal purposes and ideally having neither implementation nor design bugs! But, on the other hand, there is nothing which could stop an attacker from “borrowing” such a signed driver and using it to perform the pagefile attack. The point here is, again, there is no bug in the driver, so there is no reason for revoking a signature of the driver. Even if we discovered that such driver is actually used by some people to conduct the attack!

But it seems that MS actually decided to ignore those suggestions and implemented the easiest solution, ignoring the fact that it really doesn’t solve the problem…

Gadi Evron,
ge@linuxbox.org.

Joanna just published a blog entry on this issue, and how her PoC doesn’t work on the new Vista release.

Why, etc.

“It quickly turned out that our exploit doesn’t work anymore! The
reason: Vista RC2 now blocks write-access to raw disk sectors for user
mode applications, even if they are executed with elevated administrative
rights.”

http://theinvisiblethings.blogspot.com/2006/10/vista-rc2-vs-pagefile-attack-and-some.html

Gadi.

(Hat tip to Elad Efrat)