Hacking News

Your Daily Dose of Hacking News

2013-10-31T04:44:00.003-07:00

IE Security Bug

2012-09-19T02:32:00.001-07:00

Microsoft has received reports of "a small number of targeted attacks" based on a vulnerability in Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9. Internet Explorer 10 is not affected. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability.

Throughout its history Internet Explorer has been subjected to many security vulnerabilities and concerns: Much of the spyware, adware, and computer viruses across the Internet are made possible by exploitable bugs and flaws in the security architecture of Internet Explorer, sometimes requiring nothing more than viewing of a malicious web page in order to install themselves. This is known as a "drive-by install". There are also attempts to trick the user into installing malicious software by misrepresenting the software's true purpose in the description section of an ActiveX security alert.

Hacking Web 2.0

2009-02-23T04:10:00.000-08:00

In another indication of how easy it is for malware authors to leverage Web 2.0 technologies, spammers have taken control of a Facebook group with more than 1.5 million users.

The group, "5,000,000 against the new version of Facebook", was set up by Adam Stanborough in September 2008 for Facebook members unhappy with the social networking site's redesign in July. It gained one million members within 12 days, according to the Herald and Weekly Times.

A blog posting at Graham Cluley's Make Money Fast said spammers had put up advertisements on the site. Cluley is senior technology consultant for security vendor Sophos,

These advertisements are for get-rich-quick schemes and users who access the group are greeted with a description that reads

“PLEASE NOTE ... Facebook looks like it will keep the new facelift, however please read below to see how i have now made over 130 K USD$ in 3 months, and now i want to share with you how i did so you to CAN MAKE MONEY !”

Messages promoting other products, such as dating and seducing guides, are also sent to the 1,5 million users, who at one point had a good reason for signing up with the group.

"Our investigation showed a third party was involved in distributing the spam," Facebook spokesperson Barry Schnitt told InternetNews.com by e-mail. "We've cleaned up the site."

This is the latest attack on a social networking site by malware authors exploiting Web 2.0 technologies to distribute spam.

In January, hackers broke into the Twitter accounts of then President-elect Barack Obama and 32 other people, prompting the micro-blogging service to tell users to change their passwords.

Just one day later, spammers launched attacks using fake profiles of celebrities on the LinkedIn professional social networking site and on Google (NASDAQ: GOOG) Blogspot.

Late last month, Websense Security Labs found that hackers were distributing malware through blogs on MyBarackObama.com, an online community site put up by President Obama's team. Their blogs led to a Web site purporting to host a YouTube pornographic video. Clicking on that video would ultimately lead to visitors downloading malware onto their PCs.

The hackers have been distributing their BarackObama.com URLs all over the Web by adding them to their comments on various blogs and leveraging user generated content management systems used by Web 2.0 sites.
The threat to legitimate Web sites

According to predictions from a survey conducted by messaging and data protection firm Websense, hackers are increasingly compromising legitimate sites, mainly social networking or search sites. They are able to target the Web 2.0 elements of these sites because the sites allow users to upload their own content.

MagiKomputer: Keyloggers protection

2008-02-19T23:46:00.000-08:00

Keylogging works by recording the keystrokes you type on the keyboard to a log file that can be transmitted to a third party. Keyloggers can capture user names, passwords, account numbers, social security numbers or any other confidential information that you type using your keyboard.
There are two types of Keystroke loggers:

Hardware key loggers are devices that are attached to the keyboard cable or installed inside the keyboard. There are commercially available products of this kind, even dedicated keyboards with key logging functionality.
Software key loggers are usually simple programs that can capture the keystrokes the user is typing, They can also record mouse clicks, files opened and closed, sites visited on the Internet, etc. A more advanced type of key loggers can also capture text from windows and make screenshots of what displayed on the screen.

Source:
MagiKomputer: Keyloggers protection

Spybot - Search & Destroy v 1.5

2008-02-06T16:04:00.000-08:00

Spybot - Search & Destroy v 1.5 has been released.
It has quite a lot of advantages over version 1.4 such as improved compatibility, more effective detections and new functions.

This new version features a lot of improved detection mechanisms:

Improved Immunization:

New configuration for IE plugin:

New confirmation dialogs for IE plugin:

System support

Restored Win95 compatibility
Improved Wine compatibility
Fixed HyperThreading issues
Improved 64 bit immunization
Create Portable.ini in main folder to use app folder as data folder as well
New warnings about missing admin rights on Windows Vista
Support for multi-line bookmarks (IE 7 / Vista)
New Immunization for Firefox & Mozilla
Improved Immunization for Opera

Reports

Added version info to bug report
Include Errors.log now includes timestamps
Improved Windows version display

Misc

"Single excludes" now include filenames to be more unique
Improved settings retrieval from registry (mixed installations)
Fixed .reg import bugs
Added support for automated removal of F/Ps from host lists
Changed update UserAgent and Referrer
Improved (Vista-compatible) support for fast user switching
Updater now in separate executable file
Vista manifests for assigning required rights to each application
Deactivated list of active ports per process for Vista (incompatible)
Fixed support for handle list on 64 bit systems
Improved disabling/enabling BHOs
New special error reporting for beta versions
Support for Windows Error Reporting for public versions
Fixed update-related crashes on Vista
Fixed memory leaks (replaced Indy with Synapse)
Vista-compatible MSI installer for those who like/need that
Support for alpha tests on services and domains lists
Added hundreds of new automated tests of internal functionality for prerelease QA
Added TeaTimer hide icon (disabled) registry value in installer

Detection and removal of threats

Improved PE detection all over the place
New 64 bit detection all over the place
Improved file removal methods
Added optional custom RecoveryDir setting in Default.ini
Automatic guessing of "Download Dir" folders
Added support for renaming services before stopping/killing/deleting them
Improved plugin support (example: current TCP/IP Plugin)
Support for regular expressions nearly all over the SBI interface
Much improved logic connections between files, registry and API detections (others would invent a new TLA for that *g*)
Speed-ups through improved caches
File version checking
Authenticode checking
Improved archives checking
Faster fulltext checking
Improved Sys Internals file location algo
Improved hosts file location algo
Added some more Opera 9 detection schemes

User interface changes

Fixed "show more information" panels
Implemented workarounds for misarranged buttons (including TeaTimer)
Improved support for /allhives in tools section (inactive installation support)
Fixed flag shown on shortcut bar after changes
Fixed IE proxy import in wizard
Changed "use proxy" button to checkbox
Improved localization on simple dialogs
Added option to add a proxy inside app if running on Win PE
Improved localization of list of updates
Added Firefox icon on Cookie exclude page
Fixed bad keyboard handling on some exclude lists
Fixed cookie removal selection problems
New confirmation dialog for system restore points
Changed default font to Tahoma
Red cross (trademarked) replaced with green cross
Made "Check" option unavailable during fix
Process list now is a bit less eager on tooltips
Improved "delay start" dialogs
Now displays checksum for each result for better trackback of results
Fixed "Ignore Products" column width problems on Vista
Improved localization of product descriptions
Adjusted wizard for new situation (external updater etc.)
Fixed Tools snapshot comparison highlighting
Made display of registry changes in results list less confusing
Improved SDHelper dialogs and block/allow choices
Update date format on info page now localized
Displayed app version is now four digits (e.g. 1.5.1.12)
(De+)Select all in list of old reports
Improved Warning/Confirmation dialog IE plugin
Configuration & Information dialog in IE plugin

You can download Spybot - Search & Destroy v 1.5 from here:
http://www.safer-networking.org

Spybot-S&D is the result of quite a lot of work from a team of volunteers. In spite of that Spybot-S&D is being kept free.

If you feel that the program has been helpful to you, please donate to their cause here:
http://www.safer-networking.org

Hacking News AdSense Player

2008-02-01T01:29:00.000-08:00

YouTube has launched a new service called AdSense Players.

With AdSense Players you create customized video players for publishing to Websites or Blogs, using keywords or pre-selected premium content, like you see below:

Watch the latest videos on YouTube.com

This Post is just a test to see what AdSense Player picks up from the content of the Hacking News Blog.
Comments are welcome.

Hacking FAQs

2008-01-25T19:26:00.000-08:00

How can I get started on Hacking?

The best way for you to get started would probably be to go to a LUG (Linux user group) meeting. You can find such groups on the LDP General Linux Information Page; there is probably one near you, possibly associated with a college or university. LUG members will probably give you a Linux if you ask, and will certainly help you install one and get started.

When do you have to start? Is it too late for me to learn?

Any age at which you are motivated to start is a good age. Most people seem to get interested between ages 15 and 20, but I know of exceptions in both directions.

How long will it take me to learn to hack?

That depends on how talented you are and how hard you work at it. Most people who try can acquire a respectable skill set in eighteen months to two years, if they concentrate. Don't think it ends there, though; in hacking (as in many other fields) it takes about ten years to achieve mastery. And if you are a real hacker, you will spend the rest of your life learning and perfecting your craft.

Is Visual Basic a good language to start with?

If you're asking this question, it almost certainly means you're thinking about trying to hack under Microsoft Windows. This is a bad idea in itself. When I compared trying to learn to hack under Windows to trying to learn to dance while wearing a body cast, I wasn't kidding. Don't go there. It's ugly, and it never stops being ugly.

There is a specific problem with Visual Basic; mainly that it's not portable. Though there is a prototype open-source implementations of Visual Basic, the applicable ECMA standards don't cover more than a small set of its programming interfaces. On Windows most of its library support is proprietary to a single vendor (Microsoft); if you aren't extremely careful about which features you use — more careful than any newbie is really capable of being — you'll end up locked into only those platforms Microsoft chooses to support. If you're starting on a Unix, much better languages with better libraries are available. Python, for example.

Also, like other Basics, Visual Basic is a poorly-designed language that will teach you bad programming habits. No, don't ask me to describe them in detail; that explanation would fill a book. Learn a well-designed language instead.

One of those bad habits is becoming dependent on a single vendor's libraries, widgets, and development tools. In general, any language that isn't fully supported under at least Linux or one of the BSDs, and/or at least three different vendors' operating systems, is a poor one to learn to hack in.

Would you help me to crack a system, or teach me how to crack?

No. Anyone who can still ask such a question after reading this FAQ is too stupid to be educable even if I had the time for tutoring. Any emailed requests of this kind that I get will be ignored or answered with extreme rudeness.

How can I get the password for someone else's account?

This is cracking. Go away, idiot.

How can I break into/read/monitor someone else's email?

This is cracking. Get lost, moron.

How can I steal channel op privileges on IRC?

This is cracking. Begone, cretin.

I've been cracked. Will you help me fend off further attacks?

No. Every time I've been asked this question so far, it's been from some poor sap running Microsoft Windows. It is not possible to effectively secure Windows systems against crack attacks; the code and architecture simply have too many flaws, which makes securing Windows like trying to bail out a boat with a sieve. The only reliable prevention starts with switching to Linux or some other operating system that is designed to at least be capable of security.

I'm having problems with my Windows software. Will you help me?

Yes. Go to a DOS prompt and type "format c:". Any problems you are experiencing will cease within a few minutes.

Where can I find some real hackers to talk with?

The best way is to find a Unix or Linux user's group local to you and go to their meetings (you can find links to several lists of user groups on the LDP site at ibiblio).

(I used to say here that you wouldn't find any real hackers on IRC, but I'm given to understand this is changing. Apparently some real hacker communities, attached to things like GIMP and Perl, have IRC channels now.)

Can you recommend useful books about hacking-related subjects?

I maintain a Linux Reading List HOWTO that you may find helpful. The Loginataka may also be interesting.

For an introduction to Python, see the introductory materials on the Python site.

Do I need to be good at math to become a hacker?

No. Hacking uses very little formal mathematics or arithmetic. In particular, you won't usually need trigonometry, calculus or analysis (there are exceptions to this in a handful of specific application areas like 3-D computer graphics). Knowing some formal logic and Boolean algebra is good. Some grounding in finite mathematics (including finite-set theory, combinatorics, and graph theory) can be helpful.

Much more importantly: you need to be able to think logically and follow chains of exact reasoning, the way mathematicians do. While the content of most mathematics won't help you, you will need the discipline and intelligence to handle mathematics. If you lack the intelligence, there is little hope for you as a hacker; if you lack the discipline, you'd better grow it.

I think a good way to find out if you have what it takes is to pick up a copy of Raymond Smullyan's book What Is The Name Of This Book?. Smullyan's playful logical conundrums are very much in the hacker spirit. Being able to solve them is a good sign; enjoying solving them is an even better one.

What language should I learn first?

XHTML (the latest dialect of HTML) if you don't already know it. There are a lot of glossy, hype-intensive bad HTML books out there, and distressingly few good ones. The one I like best is HTML: The Definitive Guide.

But HTML is not a full programming language. When you're ready to start programming, I would recommend starting with Python. You will hear a lot of people recommending Perl, and Perl is still more popular than Python, but it's harder to learn and (in my opinion) less well designed.

C is really important, but it's also much more difficult than either Python or Perl. Don't try to learn it first.

Windows users, do not settle for Visual Basic. It will teach you bad habits, and it's not portable off Windows. Avoid.

What kind of hardware do I need?

It used to be that personal computers were rather underpowered and memory-poor, enough so that they placed artificial limits on a hacker's learning process. This stopped being true in the mid-1990s; any machine from an Intel 486DX50 up is more than powerful enough for development work, X, and Internet communications, and the smallest disks you can buy today are plenty big enough.

The important thing in choosing a machine on which to learn is whether its hardware is Linux-compatible (or BSD-compatible, should you choose to go that route). Again, this will be true for almost all modern machines. The only really sticky areas are modems and wireless cards; some machines have Windows-specific hardware that won't work with Linux.

There's a FAQ on hardware compatibility; the latest version is here.

I want to contribute. Can you help me pick a problem to work on?

No, because I don't know your talents or interests. You have to be self-motivated or you won't stick, which is why having other people choose your direction almost never works.

Try this. Watch the project announcements scroll by on Freshmeat for a few days. When you see one that makes you think "Cool! I'd like to work on that!", join it.

Do I need to hate and bash Microsoft?

No, you don't. Not that Microsoft isn't loathsome, but there was a hacker culture long before Microsoft and there will still be one long after Microsoft is history. Any energy you spend hating Microsoft would be better spent on loving your craft. Write good code — that will bash Microsoft quite sufficiently without polluting your karma.

But won't open-source software leave programmers unable to make a living?

This seems unlikely — so far, the open-source software industry seems to be creating jobs rather than taking them away. If having a program written is a net economic gain over not having it written, a programmer will get paid whether or not the program is going to be open-source after it's done. And, no matter how much "free" software gets written, there always seems to be more demand for new and customized applications. I've written more about this at the Open Source pages.

Where can I get a free Unix?

If you don't have a Unix installed on your machine yet, elsewhere on this page I include pointers to where to get the most commonly used free Unix. To be a hacker you need motivation and initiative and the ability to educate yourself.

Start now...

From:
http://www.catb.org

Master boot record rootkits

2008-01-16T11:27:00.000-08:00

Security mavens have uncovered a new class of attacks that attach malware to the bowels of a hard drive, making it extremely hard to detect and even harder to remove.

The rootkit modifies a PC's master boot record (MBR), which is the first sector of a storage device and is used to help a PC locate an operating system to boot after it is turned on. The result: the rootkit is running even before Windows loads. There have been more than 5,000 infections in less than a month, researchers say.

"Master boot record rootkits are able to subvert the Windows kernel before it loads, which gives it a distinct stealth advantage over rootkits that load while Windows is running," said Matthew Richard, director of the rapid response team for iDefense, a security provider owned by VeriSign. "It gives it a great stealth mechanism that allows it to persist even after removal." Such rootkits can even survive reinstallation of the operating system, he said.

Because the rootkit lurks deep within the hard drive, well below the operating system, most antivirus programs don't detect the malware. Symantec's antivirus program is an exception, however. It labels the pest Trojan.Mebroot, according to Javier Santoyo, a senior manager for emerging technologies at Symantec.

The new rootkit is part of the arms race between security vendors and malware writers, he said. "We're definitely making it harder and harder for the bad guys to do stuff to the operating system," he said. They respond by attacking new parts of a PC.

Every version of Windows, including Vista, is vulnerable to the rootkit.

About 30,000 websites, mostly located in Europe, are actively trying to install the rootkit by exploiting users who have failed to install Windows updates, Richard says. There were 5,000 infections from December 12 to January 7. The rootkit is being spread by the same group responsible for distributing the Torpig banking Trojans, which are used to steal online banking credentials.

While the number of infections is relatively low, the number could rise quickly if the group expanded the number of exploits it used.

MBR-based attacks date back to the days of MS-DOS, when viruses such as Brain, Stoned, Tequila caused mischief by hiding themselves in a hard drive's primary partition. In 2005, researchers from eEye Digital Security demonstrated a proof of concept that showed how the technique could be extended to the Windows NT domain.

The rootkit comes as a wake-up call, demonstrating that new measures are needed to protect PC security. Many motherboard makers still don't provide functionality that prevents the overwriting of an MBR. But even when such capabilities do exist, the average user has no idea how to enable them. And even when they're enabled, malware writers are likely to target even deeper recesses within a PC.

"We will never win the battle with malware, especially rootkits, without a help from hardware and changes in the *design* of the OSes," Joanna Rutkowska, a researcher specializing in rootkits, wrote in an email.

Source:
Dan Goodin
The Register

Mass web infection

2008-01-16T11:19:00.000-08:00

Security maven Mary Landesman is in the midst of piecing together a who-done-it involving the infection of hundreds of websites that are generating an enormous amount of traffic. Or maybe it's a how-done-it. Either way, she's mostly drawing blanks.

Landesman is a researcher for ScanSafe, a company that monitors the web surfing of employees at large companies and provides them with real-time intelligence about what sites are spreading malware. When a client visits a site that has already attacked someone else, the service automatically blocks the site from loading in the end user's browser. Viewing some seven billion web requests per month, company researchers see a fair amount of internet gremlins.

Over the past four days, 15 per cent of the blocked malicious traffic has come from just a few hundred sites, which appear to be legitimate ecommerce destinations that have been compromised by attackers. This prompted Landesman to do some digging, and what she uncovered is unlike anything she's seen before.

For one thing, the sites themselves are hosting the malware, which is then foisted on visitors. Most of the time attackers are unable to gain such a high degree of control over the sites they hack, so they redirect end users to servers under the control of bad guys and use them to drop malicious payloads.

"I'm stumped," Landesman says. "This is a very different method of infecting the user. I want to find out how they're doing it and what is the common link between these sites."

So far, Landesman and other researchers have found no visible thread that ties the disparate group of mom-and-pop sites together. With addresses such as dubai.travel-culture.com, operationultimategoal.com and directline-citybreaks.co.uk, the sites are mostly based in the UK, but some also hail from India, Brazil and elsewhere. They don't use the same web host, and while most use web serving software from Apache, the versions vary widely, making it unlikely that attackers are exploiting a vulnerability in that program.

The outbreak coincides with another mass infection in progress that's infected tens of thousands of pages, including those of Boston University, security provider Computer Associates, and agencies from the state of Virginia and the city of Cleveland. It infects websites running Microsoft's Internet Information Server web program and the company's SQL database with links the redirect users to servers in China. The malicious sites then try to install keylogging software and other nasties.

As massive as that infection is, it's responsible for less than one per cent of the malicious traffic that ScanSafe has blocked over the past four days, a small fraction compared with the mystery sites Landesman is tracking.

The sites exhibit other intriguing characteristics. They attempt to infect visitors with a javascript file with a randomly generated name that changes each time a person visits the site. Accessing paddingtoncourt.com, for example, (we don't recommend readers try this) might result in the insertion of a script referencing a file titled xxxxx.js, which is dynamically created at paddingtoncourt.com/xxxxx.js. A different visitor might encounter a file titled yyyyy.js served from paddingtoncourt.com/yyyyy.js.

The constant flux makes it impossible for researchers to access the script responsible for delivering the payload or running Google searches that might provide a more comprehensive list of other sites that might be affected.

The script looks for various vulnerabilities specific to the visiting OS, and when it finds one pulls a .Mov file from the domain dedicated.abac.net. That in turn invokes a file from bds.invitations.fr, which installs a backdoor on end users' machines. Victims are unlikely to know they've been infected because the installation is clear and seamless, and the malware uses few PC resources. At last check, only three of 33 antivirus programs detected the malware, which appears to be a derivitive of the Rbot Trojan.

"This is pretty nasty," Landesman says. "It's a new type of compromise, and a pretty significant one." And so far very little is understood about it.

Source:
Dan Goodin
The Register

Anti-XSS protection with NoScript

2008-01-16T10:37:00.000-08:00

Cross-Site Scripting (XSS) vulnerabilities are usually programming errors made by web developers, which allow an attacker to inject his own malicious code from a certain site into a different site. They can be used, for instance, to steal your authentication credentials and, more in general, to impersonate you on the victim site (e.g. your online banking or your web mail).

This kind of vulnerability, often overlooked, is very widespread and becoming highly popular among hackers: someone even bothered to write a JavaScript-based bot, called Jikto, turning your browser into a zombie which relentlessly sends automated XSS attacks all around. Of course this tool has been built "for research purpose", but its code unfortunately appears to be leaked in the wild, so anybody can take advantage of it.

There's no real cure for this kind of attack unless you avoid using popular browsers such as Internet Explorer entirely and opt for Firefox Flock, Seamonkey and others mozilla-based browsers extended with an add-on called NoScript, developed by Giorgio Maone.

NoScript features unique Anti-XSS counter-measures, even against XSS Type 1 attacks targeted to whitelisted sites.

Whenever a non-trusted site tries to inject JavaScript code inside a trusted (whitelisted and JavaScript enabled) site, NoScript filters the malicious request neutralizing its dangerous load.

By default, its Anti-XSS protection filters all requests from untrusted origins to trusted destinations, considering trusted either "Allow"ed or "Temporary allow"ed sites. If you prefer "Temporarily allow"ed sites to be still considered as untrusted origins from the XSS point of view, you just need to set about:config noscript.xss.trustTemp preference to false.

NoScript's Anti-XSS filters have been deeply tested and proved their ability to defeat every known reflective XSS technique, but their power is a double-edged sword: sometime they may detect a weird looking but legitimate request as a "potential XSS attempt". This should almost never be a show stopper, since the filter most of the time doesn't prevent you from navigating the filtered page, but the aforementioned Unsafe reload command and the XSS Advanced Options are have been made easily accessible so you can work-around if you hit a false positive with side effects.

While Cross-Site Scripting (XSS) vulnerabilities need to be fixed by the web developers, users can finally do something to protect themselves: NoScript is the only effective defense available to "web-consumers", waiting for "web-providers" to clean up their mess.

See also the NoScript XSS FAQ, or read the excellent Cross Site Scripting Attacks: Xss Exploits and Defense book.

List of hacking incidents for the year 2008

2008-01-16T02:47:00.000-08:00

WHID 2008-02: Italian Bank's XSS Opportunity Seized by Fraudsters
Reported: 09 January 2008
Occurred: 08 January 2008

Classifications:
Attack Method: Cross Site Scripting (XSS)
Country: India
Outcome: Phishing
Vertical: Finance

It has been a while since a phishing scam using XSS vulnerability found its way to the Web Hacking Incidents database (SunTrust, WHID 2004-11). The current incident is a good example of what does and does not get into our database: XSS vulnerabilities in public web sites are discovered daily and reported in sites such as XSSed, however most of these vulnerabilities are not included in WHID for lack of public interest. The current incident is different since the vulnerability is known to be exploited by attackers, moving it from the realm of technical interest to the realm of a real problem.

References:
Italian Bank's XSS Opportunity Seized by Fraudsters
Advisory, NetCradt, 08 January 2008

WHID 2008-01: Information stolen from geeks.com
Reported: 08 January 2008
Occurred: 05 January 2008

Classifications:
Attack Method: Unknown
Country: USA
Outcome: Leakage of Information
Vertical: Retail

Very detailed records of geeks.com customers were stolen from the site. The records included name, address, telephone number, e-mail address, credit card number, expiration date, and most notoriously, card verification number (CVV).

The interesting part is that the site had a Hacker Safe seal. The seal was revoked twice last year due to vulnerabilities, but restored after they where patched. It seems that this time the hack preceded the scan or the scan missed the vulnerability. So much for application scanning and vulnerability assessment....

And don't take it lightly as a geeks site. Geeks.com is a $150M/year business.

References:
Update: 'Hacker safe' Web site gets hit by hacker
News Story, Copmputer World, 07 January 2008
'Hacker Safe' Geeks.com Hacked
News Story, Information Week, 07 January 2008
Geeks.com Website Hacked, Customer Data Stolen
News Story, Consumerist,

Source:
http://www.webappsec.org

Browser Vulnerabilities and Botnets head threat list

2008-01-12T11:30:00.000-08:00

Security experts have looked into the crystal ball to predict the cyber attacks most likely to cause substantial damage this year.

The resulting list (below), drawn together by 12 security experts under the auspices of the SANS Institute, is based on an analysis of emerging attack patterns. Two of the resulting predictions - malware on consumer devices and web application security exploits - have already come true in the early days of 2008, evidence that that the run down is closer to the mark than other security predictions.

As is often the case browser exploit came out as the top threat in the run down but the risk is evolving. Web site attacks have migrated from simple exploits to more sophisticated attacks based on scripts that cycle through multiple exploits to yet more sophisticated attacks featuring packaged modules. One of the latest such modules, mpack, produces a claimed 10-25 per cent success rate in infecting surfers.

Attackers are actively placing exploit code on popular, trusted web sites where users have an expectation of security. Placing better attack tools on trusted sites is giving attackers a huge advantage over the unwary public. Meanwhile attackers have broadened the scope of the vulnerabilities they target to encompass components, such as Flash and QuickTime, that are not automatically patched when the browser is patched.

Evolution in existing threats - including stealthier botnet control techniques and more subtle social engineering approaches in phishing attacks - is a theme that runs through the whole list.

Increasingly sophisticated website attacks that exploit browser vulnerabilities - especially on trusted websites.
Increasing sophistication and effectiveness in botnets
Cyber espionage efforts by well resourced organisations looking to extract large amounts of data – particularly using targeted phishing.
An increase in mobile phone threats, especially against iPhones and Android-based phones.
Insider attacks
Advanced identity theft from persistent bots. Malicious agents that stay on compromised machines for months will be able to gather enough data to enable extortion attempts (against people who surf child porn sites, for example) and advanced identify theft attempts where criminals have enough data to pass basic security checks.
Increasingly malicious spyware
Web application security exploits
Increasingly sophisticated social engineering including blending phishing with VoIP and event phishing. For example, a blended attack may include an inbound email, apparently being sent by a credit card company, asks recipients to "re-authorise" their credit cards by calling a 1-800 number. The number leads them (via VoIP) to an automated system in a foreign country that, quite convincingly, asks that they key in their credit card number, CVV, and expiration date.
Supply chain attacks infecting consumer devices (USB thumb drives, GPS systems, photo frames, etc.) Retail outlets are increasingly becoming unwitting distributors of malware-infected devices, the experts warns.

The list will be formally launched at the SANS Security 2008 conference in New Orleans later on Monday (14 January).

Source:
John Leyden
The Register

SANS Top 20 Internet Security Risks of 2007

2007-12-22T11:37:00.000-08:00

About SANS

SANS is the most trusted and by far the largest source for information security training and certification in the world. More than 65,000 security professionals were trained by SANS. SANS also develops, maintains, and makes available at no cost, the largest collection of research documents about various aspects of information security, and it operates the Internet's early warning system - Internet Storm Center. SANS was established in 1989 as a cooperative research and education organization. Its programs now reach more than 215,000 security professionals around the world. Through SANS, a range of individuals from auditors and network administrators, to chief information security officers are sharing the lessons they learn and are jointly finding solutions to the challenges they face. At the heart of SANS are the many security practitioners in varied global organizations from corporations to universities working together to help the entire information security community.

The cyber arms race continues. Cyber criminals and cyber spies have shifted their focus again, successfully evading the countermeasures that most companies and government agencies have worked for years to put into place. Facing real improvements in system and network security, the attackers now have two new prime targets that allow them to evade firewalls, antivirus, and even intrusion prevention tools: users who are easily misled and custom-built applications. This is a major shift from prior years when attackers limited most of their targets to flaws in commonly used software.

Scenario 1: The Chief Information Security Officer of a medium sized, but sensitive, federal agency learned that his computer was sending data to computers in China. He had been the victim of a new type of spear phishing attack highlighted in this year's Top 20. Once they got inside, the attackers had freedom of action to use his personal computer as a tunnel into his agency's systems.

Scenario 2: Hundreds of senior federal officials and business executives visited a political think-tank Web site that had been infected and caused their computers to become zombies. Keystroke loggers, placed on their computers by the criminals (or nation-state), captured their user names and passwords when they signed on to their personal bank accounts, and their stock trading accounts and their employers computers, and sent the data to computers in different countries. Bank balances were depleted; stock accounts lost money; servers inside their organizations were compromised and sensitive data was copied and sent to outsiders. Back doors were placed on some of those computers and are still there.

Scenario 3. A hospitals Web site was compromised because a Web developer made a programming error. Sensitive patient records were taken. When the criminals proved they had the data, the hospital had to choose between paying extortion or allowing their patients health records to be spread all over the Internet.

Scenario 4. A teenager visits a Web site that exploits the old version of her media player that she never updated. She didn't do anything but visit the site; the video started up automatically when the page opened. The attacker put a key stroke logger on her computer. Her father used the same computer to access the family bank account. The attackers got his user name and password and emptied his bank account (the bank reimbursed him). US law enforcement officials followed the money and found that it ended up in an account being used by a terrorist group that recruits suicide bombers.

All of these scenarios are composites of actual events. To protect the victims from more embarrassment, facts have been altered and segments of multiple attacks have been combined. Thousands of attacks like these are happening every month. More than ten million computers have been compromised.

On November 27, the SANS Institute will unveil the 2007 Top 20 Internet Security Risks, the research group's seventh annual update of its consensus list of the cyber security risks that caused the most damage to individuals, corporations, and government agencies in 2007. Forty three security experts from government, industry, and academia in a half dozen countries cooperated to produce the consensus. Their names are listed in the Top 20 which will be available online at: www.sans.org

This year's SANS Top 20 illuminates two new attack targets that criminals have chosen to exploit and the older targets where attackers have significantly raised the stakes. Although the Top 20 focuses on emerging attack patterns, the old vulnerabilities are still being targeted by automated attack programs constantly scanning the Web for vulnerable systems. So many automated programs are searching for victims that SANS Internet Storm Center (an early warning system for the Internet) reports that computers can expect to survive only five minutes before being attacked and will withstand the attacks only if they are configured securely before being connected to the Internet.

A summary of the highlights of year's Top 20, along with the most effective defenses, is available at the end of this document.

"For most large and sensitive organizations, the newest risks are the ones causing the most trouble," says Alan Paller, director of research at SANS. "The new risks are MUCH harder to defend; they take a level of commitment to continuous monitoring and uncompromising adherence to policy with real penalties, that only the largest banks and most sensitive military organizations have, so far, been willing to implement," continues Paller.

According to Paller, Web application insecurity is particularly troublesome because so many developers are writing and deploying Web applications without ever demonstrating that they can write secure applications. Most of their Web applications provide access to back-end databases that hold sensitive information.
Says Paller,

"Until colleges that teach programmers and companies that employ programmers ensure that developers learn secure coding, and until those employers ensure that they work in an effective secure development life cycle, we will continue to see major vulnerabilities in nearly half of all Web applications."

On November 20, 2007, the Secure Programming Council released the first standard of due care for the security knowledge and skills that Web programmers should be able to demonstrate. Interested parties can see the report at http://www.sans-ssi.org

This year's Top 20 project was led by Rohit Dhamankar, senior manager of security research for TippingPoint, the company that understands the attack vectors because they make intrusion prevention systems trusted by many of the most sensitive enterprises.
According to Dhamankar,

"Although half the total vulnerabilities reported in 2007 are in Web applications, its only the tip-of-the-iceberg. These data exclude vulnerabilities in custom developed Web applications. Compromised Web sites provide avenues for massive client-side compromises via Web browser, office documents, and media player exploits. This vicious circle of compromise is proving to be harder to break each day."

Data On How Big The Problem Is

Qualys, the firm that scans for vulnerabilities on millions of systems in hundreds of large organizations around the world, has an excellent perspective on where new vulnerabilities are being discovered.

"We have seen a huge jump in the vulnerabilities in Microsoft(R) Office products,"

says Amol Sawarte, manager of vulnerability labs at Qualys.
These charts show growth of nearly 300% from 2006 to 2007, primarily in new Excel(R) vulnerabilities that can easily be exploited by getting unsuspecting users to open Excel files sent via email and instant message.

When systems are compromised through any of the new attack targets, spyware infections (including keystroke loggers) are among the most common result.
Webroot, the largest spyware detection and monitoring firm, keeps track of how spyware is spreading.
Gerhard Eschelbeck, chief technology officer of Webroot reports that:

"Since January 2007, Webroot has seen a 183 percent increase in Web sites harboring spyware. (2) Infection rates for Spyware and Trojans that steal keystrokes are currently at 31 percent and rapidly growing, (3) Based on a small and medium size enterprise survey we conducted in September, 2007, seventy-seven percent said their success depends on the Internet, and 47.2 percent reported lost sales due to spyware."

The Top 20 will be presented to the public in a meeting in London on November 28, jointly sponsored by SANS and the UK CPNI (Centre for Protection of National Infrastructure), where 200 leading UK security practitioners will gather to learn about the Top 20 and discuss countermeasures. The meeting, at 1700 UTC, is open to the press.

Free Testing Tools

As in past years, Qualys is making available a free service that tests computers for the elements on the Top 20 amenable to such testing. That service can be accessed at https://sans20.qualys.com.

This year, Applicure Technologies, a Web application firewall firm, is offering a free monitoring tool that assesses how many Web attacks are hitting IIS and Apache servers. It is available at www.applicure.com/?page=Sans.

The SANS 2007 Top 20 Internet Security Risks, An Overview

Top New Risks That Are Particularly Difficult To Defend:

Critical vulnerabilities in Web applications enabling the Web site to be poisoned, the data behind the Web site to be stolen, and other computers connected to the Web site to be compromised.

Best defenses: Web application firewall, Web application security scanner, application source code testing tools, application penetration testing services, and most importantly a formal policy that all important Web applications will be developed using a valid secure development life cycle and only by developers who have proven (through testing) that they have the skills and knowledge to write secure applications.
Gullible, busy, accommodating computer users, including executives, IT staff, and others with privileged access, who follow false instructions provided in spear phishing emails, leading to empty bank accounts, compromise of major military systems around the world, compromise of government contractors, industrial espionage and much more.

Best defenses: This is the most challenging risk. Security awareness training is important but is definitely not sufficient to solve this problem. Two defenses seem promising: (a) inoculation in which all users are sent periodic spear phishing emails that are benign. Those who err are educated or cut off, (b) Admit that this problem cannot be solved in all cases and establish new monitoring and forensics systems that constantly search network traffic and systems for evidence of deep penetration and persistent presence.

Other Priorities That Have Grown In Importance but Have Reasonable Technical Defenses:

Critical vulnerabilities in software on personal computers inside and outside enterprises (client-side vulnerabilities) allowing these systems to be turned into zombies and recruited into botnets and also allowing them to be used as back doors for stealing information from and taking over servers inside large organizations.
- Web Browsers
- Office Software
- Email Clients
- Media Players
Best defenses: firmly enforced secure configurations (at installation time) for all applications, constantly verified patching and upgrading of both applications and system software, constant vulnerability scanning and rapid resolution of problems found, tightly configured firewalls and intrusion prevention systems, up-to-date anti-virus and anti-spyware at gateways as well as on desktops.
Critical vulnerabilities in the software and systems that provides the operating environment and primary services to computer users (server side software)
- Windows Services
- Unix and Mac OS Services
- Backup Software
- Anti-virus Software
- Management Servers
- Database Software
- VOIP servers
Best defenses: (mostly the same as group 3) firmly enforced secure configurations (at installation time) for all applications, constantly verified patching and upgrading of both applications and system software, tightly configured firewalls and intrusion prevention systems.
Policy and Enforcement Problems that allow malware to do extra harm and that lead to loss of large amounts of data
- Excessive User Rights and Unauthorized Devices
- Unencrypted Laptops and Removable Media
Best defenses: no-exception policies, constant monitoring, substantial penalties for failure to comply.
Application abuse of tools that are user favorites leading to client and server compromise, loss of sensitive information, and use of enterprise systems for illegal activity such as serving child pornography
- Instant Messaging
- Peer-to-Peer Programs
Best defenses: use only tightly secured versions of these tools, or prohibit them entirely.
Zero-day attacks

Best defenses: Build much more restrictive perimeters with deny-all, allow some firewall rules and redesign networks to protect internal systems from Internet-facing systems

The Bottom Line: What is Not Being Done to Protect Systems?

Best Practices for Preventing Top 20 Risks

Configure systems, from the first day, with the most secure configuration that your business functionality will allow, and use automation to keep users from installing/uninstalling software
Use automation to make sure systems maintain their secure configuration, remain fully patched with the latest version of the software (including keeping anti-virus software up to date)
Use proxies on your border network, configuring all client services (HTTP, HTTPS, FTP, DNS, etc.) so that they have to pass through the proxies to get to the Internet
Protect sensitive data through encryption, data classification mapped against access control, and through automated data leakage protection
Use automated inoculation for awareness and provide penalties for those who do not follow acceptable use policy.
Perform proper DMZ segmentation with firewalls.
Remove the security flaws in Web applications by testing programmers security knowledge and testing the software for flaws.

In other words, trust but verify through automation and testing.

The jar: protocol bug

2007-11-16T10:55:00.000-08:00

The recent disclosure by pdp of the jar: protocol bug originally discovered and responsibly reported by Jesse Ruderman in February, and its redirect variant discovered and popularized by Beford with a nice Google-targeted proof of concept, spawned some interesting 3rd party coverage.
Interesting, because very few 3rd party reporters and commenters seem to truly understand how this vulnerability works, and — worse — because of the quite nonsensical advices given to protect users.

How the Vulnerability Works

The jar: protocol is used internally by Mozilla browsers to resolve and address resources stuffed inside optionally compressed archives in Zip format called JARs (Java ARchives).

A JAR URL looks like this:
jar:http://someserver.com/some/path/somearchive.jar!/some/internal/path/resource.jpg
As you can see, after the jar: scheme we’ve got a regular http: URL (http://someserver.com/some/path/somearchive.jar), followed by an exclamation mark separator and the internal path to find the actual resource inside the archive.

When a Mozilla browser is asked to open a jar: URL, it first downloads the whole JAR file from the server using a regular HTTP GET request (for http://someserver.com/some/path/somearchive.jar, in our example), then extracts the required resource (resource.jpg, in our example) from the archive on the client side.

All good and handy, but here’s the problem: the jar: protocol currently assumes any nested URL following the jar: scheme actually points to a JAR, no matter what the actual content-type header or any other file type hint (e.g. the file extension) suggests.
This means that I can stuff a malicious HTML page of mine inside a Zip file, rename it as “ma1.jpg” and upload it as my avatar on a message board.
Then trick some user to open my malicious page directly through a jar: URL like
jar:http://someforum.com/images/avatars/ma1.jpg!my_evil_page.html
Worse, my page’s JavaScript code will run in the same domain as the hosting site, i.e. someforum.com, hence I’m cross-site scripting the message board.
To make it even more nightmarish, I don’t actually need the target website to be a message board allowing file uploads: I just need an open redirect, which can be found on Google and many other “safe” places, because my disguised JAR file will inherit the security context of my victim’s redirector even if it’s hosted on a website of mine. That’s how Beford’s proof of concept works.
Did you say “Universal XSS”?

What Firefox Users Can Do

At least until a Firefox patch is released, Firefox users should install latest NoScript stable release, or even better help us testing latest development version.
NoScript will prevent remote JAR resources from being loaded as documents, neutralizing the XSS dangers of the jar: protocol while keeping its functionality. See this FAQ for more details.
It should be noted that this specific protection is completely independent from JavaScript blocking: this means that you’re protected on every site, no matter if there you’ve set NoScript to allow JavaScript or not.
Strangely enough, even if this is the only advice which works (other than switching to a different browser), it has been give only by the US Cert advisory (together with another less effective one, see below).

Bogus Advices

Firefox users should avoid follow untrusted “jar:” links on suspicious Web sites.
(Ryan Naraine’s Zero Day)

There are several ways for a browser to open an URL automatically without your consent: JavaScript, an IFrame, a Meta Refresh, a redirect…
If this vulnerability is exploited in the wild, you won’t see any “jar: link” coming.

Poor Ryan has probably been misled by reading the following:

Do not follow untrusted “jar:” links or browse untrusted websites.
(Secunia Advisory)

Admittedly, the “don’t browse untrusted websites” clause adds some correctness to this advice, but also makes it practically useless.
Furthermore, Ryan quotes the US Cert advisory as well, hence he’s got no excuses for omitting the NoScript work-around.
As we said, US Cert correctly referenced NoScript’s JAR protection, but also gave a bogus advice of its own:

Using proxy servers or application firewalls to block URIs that contain jar: may mitigate this vulnerability.

If you read how this issue works carefully, you should have noticed that all the jar: protocol resolution happens inside the browser: the only request which is sent, possibly hitting proxy servers or application firewalls, is the regular nested HTTP request. Are you going to block every image together with my innocent looking http://someforum.com/images/avatars/ma1.jpg? At any rate, your network devices are very unlikely to ever see mythological beasts like “URIs that contain jar:”…

No matter how nonsensical the advices above are, someone decided to endorse them all:

No patch is available through there are a number of workarounds (such as blocking URIs that contain “jar:” using a reverse proxy or application firewall). For home users, Secunia advises users to avoid following untrusted “jar:” links or visiting untrusted websites.
(The Register)

What a pity they left out the only one which does work ;)

Update:

PC World and ComputerWorld finally joined the fun:

application firewalls and proxy servers can be used to block Windows Universal Resource Identifiers (URIs) that contain the JAR protocol

They actually reference NoScript, but in a quite misleading way:

Users can download a NoScript add-on for Firefox to block JavaScript and executable content from untrusted Web sites, and can secure their Google accounts by remaining signed out whenever possible.
IBRS security consultant James Turner, who has used the NoScript add-on, said protection against these vulnerabilities can be a trade-off between security and a rich online experience.
“The add-on works fine but it is a trade-off between reducing your online experience by blocking JavaScript and protecting yourself against the exploit,” Turner said.

As said, NoScript’s JAR protection has nothing to do with JavaScript blocking and it works no matter what the content of your whitelist is: in other words, there’s no trade-off at all because you keep JavaScript enabled where you need it and Ryan Naraine ackneledged it by wroting a follow-up honestly reporting it.

Source:
Giorgio Maone’: A Jar of Misleading Advices