tag:blogger.com,1999:blog-15271760463315380772024-02-21T08:13:06.679-08:004 X Security Team0day Exploits,Alerts,BlackhatHackers,BufferOverflow,Bulletin,DDos Attack,Exploit Code,Hacker Videos,Hacking Groups,Hacking News,Hijack,HITBSecConf2006,Kernel-level Exploits,KMS,Malware Attacks,Phlashing Attacks,Rootkit,SecurityAnalysis,Source Code,Spam Reports,SQL Injection,Tools,Trojan,Video Tutorials,Vulnerability,Whitehat Hackers, XSS Exploit,Zero-Day Attacks.Unknownnoreply@blogger.comBlogger653125tag:blogger.com,1999:blog-1527176046331538077.post-67579785106465814532011-05-08T22:58:00.000-07:002011-05-08T23:16:34.048-07:00New MAC OS X scareware delivered through blackhat SEO<p style=""><a href="http://i.zdnet.com/blogs/mac-defender-main-screen.jpg"><img style="width: 387px; height: 291px;" class="size-full wp-image-8615 aligncenter" src="http://i.zdnet.com/blogs/mac-defender-main-screen.jpg" alt="" /></a></p> <p>Researchers from Intego have intercepted <a href="http://blog.intego.com/2011/05/02/intego-security-memo-macdefender-fake-antivirus/"><strong>a new scareware sample targeting the MAC OS X</strong></a>.</p> <p>Named the MACDefender, the scareware sample shows a bogus interface, insisting that the end user is infected, and that their OS is in an insecure state. The researchers emphasize on the social engineering elements of the scareware, including the fact that although the site shows a fake Windows screen, the scareware itself is a well designed Mac application with no spelling or grammar mistakes in its description.</p> <p>The scareware will periodically open pornographic content on the affected Mac, in order to trick the users into thinking they’re infected with malware. The scareware is sold for $59,95, part of a scareware affiliate network targeting Mac OS X users in particular.</p> <p>Users are advised to exercise extra caution when dealing with suspicious downloads, especially ones delivered through blackhat search engine optimization techniques.</p><p>[Source:<a href="http://www.zdnet.com/blog/security/new-mac-os-x-scareware-delivered-through-blackhat-seo/8614"> zdnet</a>]<br /></p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-48311001500021236772011-04-18T07:27:00.001-07:002011-04-18T07:33:15.776-07:00Emergency Adobe Flash Player patch coming today<p><a href="http://blogs.zdnet.com/security/?p=8548"><img class="size-full wp-image-2344 alignright" title="Adobe Flash, Apple Safari fail privacy tests" src="http://i.zdnet.com/blogs/2009/01/broken_flash.png" alt="" width="128" height="128" /></a></p> <p><br /></p><p>Less than a week after warning that hackers were embedding malicious Flash Player files (.swf) into Microsoft Word documents to launch targeted malware attacks, Adobe plans to release an emergency Flash Player patch today to fix the underlying problem.</p> <p>The patch will fix a “critical” vulnerability in Flash Player 10.2.153.1 and earlier versions for Windows, Mac OS X Linux and Solaris.</p> <p><span id="more-8548"></span></p> <p>According to this <a href="http://secunia.com/advisories/44119/">Secunia advisory</a>, the flaw allows a hacker to completely hijack a vulnerable Windows computer:</p> <p style="padding-left: 30px;"><em>A vulnerability has been reported in Adobe Flash Player, which can be exploited by malicious people to compromise a user’s system.</em></p> <p style="padding-left: 30px;"><em>The vulnerability is caused due to an error when parsing ActionScript that adds a custom function to the prototype of a predefined class. This results in incorrect interpretation of an object (i.e. object type confusion) when calling the custom function, which causes an invalid pointer to be dereferenced.</em></p> <p>Secunia has posted a <a href="http://secunia.com/blog/210">technical analysis</a> of the flaw as well.</p> <p>Adobe has confirmed that the vulnerability (CVE-2011-0611) could cause a crash and potentially allow an attacker to take control of the affected system.</p> <p style="padding-left: 30px;"><em>There are reports that this vulnerability is being exploited in the wild in targeted attacks via a malicious Web page or a Flash (.swf) file embedded in a Microsoft Word (.doc) or Microsoft Excel (.xls) file delivered as an email attachment, targeting the Windows platform. At this time, Adobe is not aware of any attacks via PDF targeting Adobe Reader and Acrobat. Adobe Reader X Protected Mode mitigations would prevent an exploit of this kind from executing.</em></p> <p>A patch for Google Chrome users is already available in <a href="http://googlechromereleases.blogspot.com/2011/03/stable-and-beta-channel-updates_15.html">Chrome version 10.0.648.205</a>.</p> <p>Adobe plans to fix the vulnerability in Adobe Acrobat and Adobe Reader at a later date.</p>[Source:<a href="http://www.zdnet.com/blog/security/emergency-adobe-flash-player-patch-coming-today/8548"> </a><a href="http://www.zdnet.com/blog/security/emergency-adobe-flash-player-patch-coming-today/8548">zdnet</a>]Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-68162306399314263202011-04-18T07:25:00.000-07:002011-04-18T07:32:18.090-07:00Oracle to patch 73 critical DB server flaws<p><a href="http://blogs.zdnet.com/security/?p=8561"><img class="alignnone size-full wp-image-8560" title="oracle" src="http://i.zdnet.com/blogs/oracle.jpg" alt="" width="475" height="94" /></a></p> <p>The next batch of security patches from Oracle will be a biggie: 73 new security vulnerability fixes across hundreds of Oracle products.</p> <p>According to an <a href="http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html">advance notice</a> from the database server giant, some of the vulnerabilities affect multiple products and may be exploited over a network without the need for a username and password.</p> <p><span id="more-8561"></span></p> <p>The patches, scheduled for release next Tuesday (April 19, 2011), will affect the following products and components:</p> <p>Security vulnerabilities addressed by this Critical Patch Update affect the following products:</p> <ul><li>Oracle Database 11<em>g</em> Release 2, versions 11.2.0.1, 11.2.0.2</li><li>Oracle Database 11<em>g</em> Release 1, version 11.1.0.7</li><li>Oracle Database 10<em>g</em> Release 2, versions 10.2.0.3, 10.2.0.4, 10.2.0.5</li><li>Oracle Database 10<em>g</em> Release 1, version 10.1.0.5</li><li>Oracle Fusion Middleware 11<em>g</em> Release 1, versions 11.1.1.2.0, 11.1.1.3.0, 11.1.1.4.0</li><li>Oracle Application Server 10<em>g</em> Release 3, version 10.1.3.5.0</li><li>Oracle Application Server 10<em>g</em> Release 2, version 10.1.2.3.0</li><li>Oracle Identity Management 10<em>g</em>, versions 10.1.4.0.1, 10.1.4.3</li><li>Oracle JRockit, versions R27.6.8 and earlier (JDK/JRE 1.4.2, 5, 6), R28.1.1 and earlier (JDK/JRE 5, 6)</li><li>Oracle Outside In Technology, versions 8.3.2.0, 8.3.5.0</li><li>Oracle WebLogic Server, versions 8.1.6, 9.2.3, 9.2.4, 10.0.2, 11<em>g</em>R1 (10.3.2, 10.3.3, 10.3.4)</li><li>Oracle E-Business Suite Release 12, versions 12.0.6, 12.1.1, 12.1.2, 12.1.3</li><li>Oracle E-Business Suite Release 11<em>i</em>, version 11.5.10.2</li><li>Oracle Agile Technology Platform, versions 9.3.0.2, 9.3.1</li><li>Oracle PeopleSoft Enterprise CRM, version 8.9</li><li>Oracle PeopleSoft Enterprise ELS, versions 9.0, 9.1</li><li>Oracle PeopleSoft Enterprise HRMS, versions 9.0, 9.1</li><li>Oracle PeopleSoft Enterprise Portal, versions 8.8, 8.9, 9.0, 9.1</li><li>Oracle PeopleSoft Enterprise People Tools, versions 8.49, 8.50, 8.51</li><li>Oracle JD Edwards OneWorld Tools, version 24.1.x</li><li>Oracle JD Edwards EnterpriseOne Tools, version 8.98.x</li><li>Oracle Siebel CRM Core, versions 7.8.2, 8.0.0, 8.1.1</li><li>Oracle InForm, versions 4.5, 4.6, 5.0</li><li>Oracle Sun Product Suite</li><li>Oracle Open Office, version 3 and StarOffice/StarSuite, versions 7, 8</li></ul> <p>The highest CVSS 2.0 Base Score for vulnerabilities in this Critical Patch Update is 10.0 for Oracle JRockit of Oracle Fusion Middleware and Sun GlassFish Enterprise Server, Sun Java System Application Server of Oracle Sun Products Suite, the company said.</p> “Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible.<br /><br />[Source:<a href="http://www.zdnet.com/blog/security/oracle-to-patch-73-critical-db-server-flaws/8561"> zdnet</a>]Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-28915535694844125592011-04-18T07:15:00.000-07:002011-04-18T07:24:41.535-07:00Apple patches Pwn2Own iPhone OS vulnerabilities<div class="area-12 area-last"> <div class="content-1 entry space-1 clear"> <p><img class="size-full wp-image-8379 alignright" title="charlie_miller" src="http://i.zdnet.com/blogs/charlie_miller.png" alt="" width="200" height="284" /></p></div></div><br />Apple has released a critical update for its flagship iOS mobile operating system to fix several gaping security holes, including a few that were used in successful exploits at this year’s CanSecWest Pwn2Own contest. <p>The new iOS 4.3.2 software update, which is available for download via iTunes, provides cover for five documented security problems, including vulnerabilities <a href="http://www.zdnet.com/blog/security/charlie-miller-wins-pwn2own-again-with-iphone-4-exploit/8378">exploited by Charlie Miller</a> (iPhone) and a team of researchers who <a href="http://www.zdnet.com/blog/security/pwn2own-2011-blackberry-falls-to-webkit-browser-attack/8401">broke into RIM’s BlackBerry</a> smartphone.</p> <p><span id="more-8554"></span></p> <p>The raw details:</p> <ul><li><strong>QuickLook: </strong>A memory corruption issue existed in QuickLook’s handling of Microsoft Office files. Viewing a maliciously crafted Microsoft Office file may lead to an unexpected application termination or arbitrary code execution. Credit to Charlie Miller and Dion Blazakis working with TippingPoint’s Zero Day Initiative.</li><li><strong>WebKit:</strong> An integer overflow issue existed in the handling of nodesets. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. Credit to Vincenzo Iozzo, Willem Pinckaers, Ralf-Philipp Weinmann, and an anonymous researcher working with TippingPoint’s Zero Day Initiative.</li><li>WebKit: A use after free issue existed in the handling of text nodes. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. Credit to Vupen Security working with TippingPoint’s Zero Day Initiative, and Martin Barbella.</li></ul> <p>The iOS update also fixes the <a href="http://www.zdnet.com/blog/security/microsoft-warns-fraudulent-digital-certificates-issued-for-high-value-websites/8488">Comodo certificate trust policy problem</a> that allowed an attacker with a privileged network position to intercept user credentials or other sensitive information. This issue was also fixed in separate Safari and Mac OS X updates.</p>[Source: <a href="http://www.zdnet.com/blog/security/apple-patches-pwn2own-iphone-os-vulnerabilities/8554?tag=mantle_skin;content">zdnet</a>]Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-81151228594642374182009-06-26T05:41:00.000-07:002009-06-26T06:28:03.636-07:00Critical Adobe Shockwave flaw affects millions<p><a href="http://blogs.zdnet.com/security/?p=3664"><img class="size-full wp-image-3663 alignleft" title="adobe_shockwave" src="http://i.zdnet.com/blogs/adobe_shockwave.png" alt="" height="106" width="113" /></a>Adobe’s Shockwave Player contains a critical vulnerability that could be exploited by remote hackers to take complete control of Windows computers, according to a warning from the software maker.</p> <p>The flaw affects Adobe Shockwave Player 11.5.0.596 and earlier versions. Details from Adobe’s <a href="http://www.adobe.com/support/security/bulletins/apsb09-08.html">advisory</a>:</p> <p><span id="more-3664"></span></p> <p style="padding-left: 30px;">This vulnerability could allow an attacker who successfully exploits this vulnerability to take control of the affected system. Adobe has provided a solution for the reported vulnerability (CVE-2009-1860). This issue was previously resolved in Shockwave Player 11.0.0.465; the Shockwave Player 11.5.0.600 update resolves a backwards compatibility mode variation of the issue with Shockwave Player 10 content. To resolve this issue, Shockwave Player users on Windows should uninstall Shockwave version 11.5.0.596 and earlier on their systems, restart, and install Shockwave version 11.5.0.600, available here: <a href="http://get.adobe.com/shockwave/">http://get.adobe.com/shockwave/</a>. This issue is remotely exploitable.</p> <p>Adobe <a href="http://www.adobe.com/products/shockwaveplayer/">boasts</a> that 450 million Internet-enabled desktops have installed Adobe Shockwave Player.</p>[Source: <a href="hhttp://blogs.zdnet.com/security/?p=3664#more-3664">zdnet</a>]Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-23466734505930047862009-03-12T23:26:00.000-07:002009-03-12T23:30:18.787-07:00Rigged podcasts can leak your iTunes username/password<a href="http://blogs.zdnet.com/security/?p=2861#comments"> <span></span></a><a href="http://blogs.zdnet.com/security/?p=2861"><img class="alignleft size-full wp-image-2862" src="http://i.zdnet.com/blogs/itunes_podcast_logo.png" alt="" height="74" width="85" /></a>Hackers can create malicious podcasts to hijack usernames and passwords from Apple’s iTunes software. <p>According to a warning from Apple, a “design issue” in the iTunes podcast feature can be abused via rigged audio files to cause an authentication dialog to be presented to the user. From that dialog, a hacker can hijack iTunes credentials and upload it to the podcast server.</p> <p><span id="more-2861"></span><br /><strong>[ SEE: <a title="Permanent Link to Apple plugs gaping iTunes hole, doesn't tell everyone" rel="bookmark" href="http://blogs.zdnet.com/security/?p=496">Apple plugs gaping iTunes hole, doesn't tell everyone</a> ]</strong></p> <p>From <a href="http://support.apple.com/kb/HT3487">Apple’s advisory</a>:</p> <ul><li><em>A design issue exists in the iTunes podcast feature. A subscription to a malicious podcast may cause an authentication dialog to be presented to the user. This dialog may entice the user to send iTunes credentials to the podcast server. </em></li></ul> <p>Apple has shipped a patch in <a href="http://www.apple.com/itunes/download/">iTunes 8.1</a> to clarify the origin of the authentication request in the dialog box.</p> <p>The iTunes update also corrects a denial-of-service flaw that can be caused via maliciously crafted DAAP messages.</p> <ul><li><em>An infinite loop exists in the handling of iTunes Digital Audio Access Protocol (DAAP) messages. Sending a message containing a maliciously crafted Content-Length parameter in the DAAP header may lead to a denial of service. This update addresses the issue by performing additional validation of DAAP messages. </em></li></ul> <p>The denial -of-service bug does not affect Mac OS X systems. </p><p>[Source: <a href="http://blogs.zdnet.com/security/?p=2861#more-2861">zdnet</a>] <a href="http://www.apple.com/itunes/download/" target="_blank"> </a></p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-20228786930595057132009-03-12T23:16:00.000-07:002009-03-12T23:26:14.030-07:00Adobe PDF patch released, but only for some<a href="http://blogs.zdnet.com/security/?p=2856#comments"><span></span></a><a href="http://blogs.zdnet.com/security/?p=2856"><img class="alignleft" src="http://blogs.zdnet.com/images/adobe_logo.gif" alt="" height="112" width="90" /></a>After weeks of <a href="http://blogs.zdnet.com/security/?p=2690">swinging and missing on proper response</a> to a gaping security hole in its ever-present PDF Reader software, Adobe has finally shipped a patch but only for some affected users. <p>On the same day Microsoft issued its scheduled batch of patches, Adobe dropped a security bulletin warning of a “critical” vulnerability in Adobe Reader 9 and Acrobat 9 and earlier versions. However, if you are a user of one of those “earlier versions,” you’ll have to wait at least for another week.</p> <p><span id="more-2856"></span></p> <p><strong>[ SEE: <a title="Permanent Link to Adobe swings and misses as PDF abuse worsens" rel="bookmark" href="http://blogs.zdnet.com/security/?p=2690">Adobe swings and misses as PDF abuse worsens</a> ]</strong></p> <p>The Adobe bulletin <a href="http://www.adobe.com/support/security/bulletins/apsb09-03.html">explains the severity</a>:</p> <ul><li>This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports that this issue is being exploited.</li></ul> <p>Only Adobe Reader 9 and Acrobat 9 is patched.</p> <ul><li>Adobe is planning to make available updates for Adobe Reader 7 and 8, and Acrobat 7 and 8, by March 18. In addition, Adobe plans to make available Adobe Reader 9.1 for Unix by March 25.</li></ul> <p><strong>ALSO SEE:</strong></p> <p><a title="Permanent Link to Unofficial 'patch' for Adobe Reader, Acrobat zero-day" rel="bookmark" href="http://blogs.zdnet.com/security/?p=2668">Unofficial ‘patch’ for Adobe Reader, Acrobat zero-day</a></p><p>[Source: <a href="http://blogs.zdnet.com/security/?p=2856#more-2856">zdnet</a>] </p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-74890232785749313742009-03-12T23:09:00.000-07:002009-03-12T23:15:55.509-07:00Microsoft fixes critical Windows kernel, WINS flaws<p><a href="http://blogs.zdnet.com/security/?p=2853"><img class="alignleft" style="" src="http://i.i.com.com/cnwk.1d/i/zd-fd/img_hm_officepatch2.jpg" alt="" height="103" width="99" /></a>Microsoft today shipped three security bulletins with fixes for at least 8 documented vulnerabilities affecting millions of Windows OS users.</p> <p>The most serious of this month’s patch batch is rated “critical” and could allow full remote execution attacks if a Windows user is simply lured into viewing a booby-trapped image file.</p> <p>The skinny on the March 2009 bulletins:</p> <p><span id="more-2853"></span></p> <ul><li><a href="http://www.microsoft.com/technet/security/Bulletin/MS09-006.mspx">MS09-006</a>: (CRITICAL) Provides cover for <em>three newly discovered and privately reported vulnerabilities</em> in Windows, which could allow remote code execution if a user viewed a specially crafted EMF or WMF image file from an affected system. These vulnerabilities affect all versions of Windows, including Vista and Windows Server 2008. Microsoft expects to see exploit code for these flaws but reckons the reliability will be “inconsistent.”</li><li><a href="http://www.microsoft.com/technet/security/Bulletin/MS09-007.mspx" target="_blank">MS09-007</a>: (IMPORTANT): This bulletin includes a patch for <em>a solitary vulnerability</em> in Windows, which could allow spoofing if an attacker gains access to the certificate used by the end user for authentication. Again, Microsoft says “inconsistent exploit code” is likely. The bulletin is available for all versions of Windows — Windows 2000 through Windows Server 2008.</li><li><a href="http://www.microsoft.com/technet/security/Bulletin/MS09-008.mspx" target="_blank">MS09-008</a> (IMPORTANT): This update resolves<em> two privately reporte</em>d vulnerabilities and <em>two publicly disclosed</em> vulnerabilities in Windows , which could allow a remote attacker to redirect network traffic intended for systems on the Internet to the attacker’s own systems. Microsoft says the patches correct the way that Windows DNS servers cache and validate queries, and by modifying the way that Windows DNS servers and Windows WINS servers handle WPAD and ISATAP registration. For these issues, Microsoft warns that “consistent exploit code” is likely.</li></ul> <p>Windows users should treat the “critical” bulletin with the highest possible priority.</p><p>[Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>] </p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-48422143834778307502009-03-12T23:03:00.000-07:002009-03-12T23:09:17.009-07:00New study details the dynamics of successful phishing<a href="http://blogs.zdnet.com/security/?p=2846#comments"><span></span></a><a href="http://i.zdnet.com/blogs/phishme_ethical_phishing_demo.jpg"><img class="size-full wp-image-2847 alignleft" src="http://i.zdnet.com/blogs/phishme_ethical_phishing_demo.jpg" alt="" height="110" width="150" /></a>Can you teach an old employee new phishing protection tricks? <p>In a recently presented <a href="http://www.misti.com/includes/conferences/agendadetails.asp?pID=174&ISS=21541&SID=697529">study by the Intrepidus Group</a>, the company behind the <a href="http://phishme.com/">PhishMe.com</a> spear phishing awareness service allowing companies to ethically attempt to phish their employees on their way to build security awareness, <a href="http://media.haymarketmedia.com/Documents/2/InfoSecWorld-2009_1415.pdf">presents some interesting key findings</a> based on 32 phishing scenarios tested against a total of 69,000 employees around the world. Here they are:</p> <p><span id="more-2846"></span></p> <ul><li>23% of people worldwide are vulnerable to targeted/spear phishing attacks</li><li>Phishing attacks that use an authoritative tone are 40% more successful than those that attempt to lure people through reward-giving</li><li>Men and women are both equally susceptible to phishing</li><li>On an average 60% of corporate employees that were found susceptible to targeted spear phishing responded to the phishing emails within three hours of receiving them</li><li>People are less cautious when clicking on active links in emails than when they are requested for sensitive data</li></ul> <p>Metrics are invaluable, but in this case the obsession with metrics can result in more insecurities since it excludes the possibility of blended threats. For instance, last year I was closely monitoring a similar <a href="http://ddanchev.blogspot.com/2008/05/skype-phishing-pages-serving-exploits.html">blended Skype phishing campaign</a>, where the cybercriminals (IkbMan) were attempting to optimize the click-through rate of their campaign by <a href="http://ddanchev.blogspot.com/2008/12/skype-phishing-pages-serving-exploits.html">serving client-side exploits to the visitors</a>, “just in case” if they find the site suspicious and do not enter any accounting data. For the time being the exploit is served instantly upon visiting the phishing site, however, the possibility for serving it only if the user hasn’t entered anything and is leaving the site is always there.</p> <ul><li>Go through related phishing trends and tactics: <a href="http://blogs.zdnet.com/security/?p=2707">Research: 76% of phishing sites hosted on compromised servers</a>; <a href="http://blogs.zdnet.com/security/?p=2366">Microsoft study debunks phishing profitability</a>; <a href="http://blogs.zdnet.com/security/?p=1641">Phishers increasingly scamming other phishers</a>; <a href="http://blogs.zdnet.com/security/?p=1104">DIY phishing kits introducing new features</a>; <a href="http://blogs.zdnet.com/security/?p=2095">Phishers apply quality assurance, start validating credit card numbers</a>; <a href="http://blogs.zdnet.com/security/?p=2064">Lack of phishing attacks data sharing puts $300M at stake annually</a></li></ul> <p>Considering one of the key points from Intrepidus Group’s study, namely that “<em>People are less cautious when clicking on active links in emails than when they are requested for sensitive data</em>“, a phishing email should be treated as spam, namely (in a perfect world) it shouldn’t be even allowed to reach the employee’s mailbox. Otherwise, it appears that the trade-off for coming up with quality metrics on the current degree of security awareness in regard to phishing, is the potential exposure of the tested population against potential blended threats.</p> <p>With managed localization services in the sense of dedicated translators of messages to be used in spam, phishing, and malware campaigns already a fact, the cybercrime ecosystem will soon be talking in a native language, and with the increasingly automated phishing tools whose features were once available to a more sophisticated crowd of cybecriminals, now available for free - the future of phishing looks promising.</p> <p>The only threat that can outpace its growth <a href="http://blogs.zdnet.com/security/?p=2275">is the threat posed by</a> the much more efficient and sophisticated <a href="http://blogs.zdnet.com/security/?p=2596">financial data targeting tactic of using crimeware</a> targeting each and every E-banking site simultaneously upon successful infection.</p><p>[Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>] </p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-63751591924708772622009-03-12T23:00:00.000-07:002009-03-12T23:03:54.761-07:00International Kaspersky sites susceptible to SQL injection attacks<p><a href="http://i.zdnet.com/blogs/kaspersky_iframe_injected.gif"><img class="size-full wp-image-2843 alignleft" src="http://i.zdnet.com/blogs/kaspersky_iframe_injected.gif" alt="" height="96" width="142" /></a>According to a security group going under the name of <a href="http://nemesis.te-home.net/index.html?about">TeamElite</a>, the international sites of Kaspersky Iran (<strong>kasperskylabs.ir</strong>), Taiwan (<strong>web.kaspersky.com.tw</strong>) and South Korea (<strong>kasperskymall.co.kr)</strong> are <a href="http://nemesis.te-home.net/News/20090303_Others_Bad_Security_Settings_on_Kaspersky_s_Websit.html">susceptible to SQL injection attacks</a>, allowing the injection of malicious iFrames and potentially assisting malicious attackers into obtaining sensitive data from the web sites in question.</p> <p><span id="more-2842"></span></p> <p>The group’s analysis comes shortly after the series of posts by a Romanian group of serial pen-testers of security vendors, which discovered similar flaws in the web sites of <a href="http://www.hackersblog.org/2009/02/11/f-securecom-sql-injection-cross-site-scripting/">F-Secure</a>, <a href="http://www.hackersblog.org/2009/02/18/emeasymanteccom-vulnerabil-la-blind-sql-injection/">Symantec</a>, <a href="http://www.hackersblog.org/2009/02/15/in-atentia-bitdefender/">BitDiffender</a>, and <a href="http://www.hackersblog.org/2009/02/07/usakasperskycom-hacked-full-database-acces-sql-injection/">Kaspersky USA</a>.</p> <p>Let’s start from the basics. PR contingency planning in the spirit of total denial is perhaps the worst thing a vendor can do in this case. Despite the fact that these are reseller web sites and are managed by local companies, they still have the license to harness the power of the brand of an information security company, and therefore not demonstrating basic security awareness by taking care of trivial web application vulnerabilities on these sites, can undermine the brand’s integrity and what it stands for at the first place.</p> <p>From a pragmatic perspective, the licensing company can either exercise pen-testing authority over the locally managed web sites, keep an eye on them through <a href="http://xssed.com/earlywarning">community service warning systems</a>, or introduce obligatory pen-testing before a license is obtained.</p> <p>Both groups have been notifying the affected vendors according to their posts.</p><p>[Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>] </p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-4189993190988874082009-03-12T22:56:00.000-07:002009-03-12T23:00:43.799-07:00USAID.gov compromised, malware and exploits served<a href="http://blogs.zdnet.com/security/?p=2817#comments"><span>0</span></a><a href="http://i.zdnet.com/blogs/usaid.jpg"><img class="size-full wp-image-2818 alignleft" src="http://i.zdnet.com/blogs/usaid.jpg" alt="" height="62" width="199" /></a>The Azerbaijan section at the United States Agency for International Development (<a href="http://www.google.com/safebrowsing/diagnostic?site=http://azerbaijan.usaid.gov/&hl=en">azerbaijan.usaid.gov</a>) has been compromised and is embedded with malware and exploits serving scripts approximately around the 1st of March. The malicious script is taking advantage of a series of redirects which are dynamically loading live exploits, or rogue security software and are all currently active. <a href="http://thompson.blog.avg.com/2009/03/usaid-indeed.html">Roger Thompson</a> at AVG Technologies <a href="http://www.youtube.com/watch?v=gjYhxsDeShQ&feature=channel_page">featured a video demonstrating</a> what happens when an unprotected user visits the site. <p>Let’s dissect the attack, take into consideration the big picture, and bring a skeleton out of the closet — one of the malware’s phone back locations is a domain exclusively used by <a href="http://en.wikipedia.org/wiki/Russian_Business_Network">the Russian Business Network</a> back in January, 2008.</p> <p><span id="more-2817"></span></p> <p><a href="http://i.zdnet.com/blogs/usaid_compromised1.png"><img class="size-full wp-image-2821 alignleft" src="http://i.zdnet.com/blogs/usaid_compromised1.png" alt="" height="43" width="220" /></a></p> <p>This particular campaign relies on an embedded malicious script that appears to be dynamically creating subdomains within the cybercriminal’s controlled domain. For instance, <strong>cs.ucsb.edu.4afad2ceace1e653.should-be .cn/jan10 .cn</strong> is where the first redirection in USAID.gov’s attack takes place. From there, the surfer is taken to <strong>orderasia .cn/index.php</strong> and then to <strong>orderasia .cn/iepdf.php?f=old</strong> where the exploitation of multiple (patched) Adobe Reader and Acrobat buffer overflows takes place. Upon successful exploitation, a downloader with an <a href="http://www.virustotal.com/analisis/39e72ae1839b0b16e88ce12205e1eefd">improving signatures-based detection rate</a> during the past several hours is served.</p> <p><a href="http://i.zdnet.com/blogs/usaid_compromised_2_malicious_script.jpg"><img class="size-full wp-image-2822 alignleft" src="http://i.zdnet.com/blogs/usaid_compromised_2_malicious_script.jpg" alt="" height="35" width="172" /></a>It gets even more interesting when the phone back location of the malware <strong>fileuploader .cn/check/check.php</strong> is revealed. The domain in question was exclusively used by <a href="http://ddanchev.blogspot.com/2008/01/rbns-fake-account-suspended-notices.html">Russian Business Network/customers of the RBN</a> in January, 2008 part of the cybercrime powerhouse’s attempt to throw sand in the eyes of the community by issuing fake account suspended notices whereas the malware campaigns remained active.</p> <p>USAID.gov’s insecurities appear to be a juicy target for cybercriminals. In 2007, the site’s <a href="http://blogs.computerworld.com/usaid_tanzania_server_hacked">Tanzanian section was hacked</a> with links redirecting to Zlob malware, followed by another research released the same year putting <a href="http://www.infoniac.com/hi-tech/google-blogs-spam.html">USAID.gov among some of the key spam doorways</a> which WebmasterWorld analyzed back then.</p> <p>Moreover, in 2007 cybercriminals indicated their ability and desire to target international governments’ web sites in an attempt to use them as infection vectors in the face of such incidents as the malware embedded <a href="http://ddanchev.blogspot.com/2007/12/have-your-malware-in-timely-fashion.html">French Embassy in Libya</a>; the <a href="http://ddanchev.blogspot.com/2007/09/syrian-embassy-in-london-serving.html">Syrian Embassy in London</a>; the <a href="http://ddanchev.blogspot.com/2007/09/us-consulate-st-petersburg-serving.html">U.S Consulate in St. Petersburg</a>; the <a href="http://ddanchev.blogspot.com/2008/01/dutch-embassy-in-moscow-serving-malware.html">The Dutch Embassy in Moscow</a>; and most recently the <a href="http://ddanchev.blogspot.com/2008/11/embassy-of-brazil-in-india-compromised.html">Embassy of Brazil in India</a> followed by the <a href="http://ddanchev.blogspot.com/2009/01/embassy-of-india-in-spain-serving.html">Embassy of India in Spain</a> - and the list is prone to expand, that’s for sure.</p><p>[Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>] </p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-73289793880884610002009-03-12T22:53:00.000-07:002009-03-12T22:56:08.565-07:00Metasploit's HD Moore releases 'war dialing' tools<p><a href="http://blogs.zdnet.com/security/?p=2808"><img class="size-full wp-image-2809 alignleft" src="http://i.zdnet.com/blogs/warvox_logo.png" alt="" height="72" width="203" /></a>HD Moore wants to simplify pen-testing and simulated hacking attacks against telephone systems.</p> <p>The Metasploit founder has released <a href="http://warvox.org/">WarVOX</a> as a free suite of tools to explore, classify and audit a range of telephone systems, including modems, faxes, voicemail boxes, PBXs, loops, dial tones, IVRs and forwarders.</p> <p><span id="more-2808"></span></p> <p style="">Moore explains:</p> <ul><li><em>WarVOX requires no telephony hardware and is massively scalable by leveraging Internet-based VoIP providers. A single instance of WarVOX on a residential broadband connection, with a typical VoIP account, can scan over 1,000 numbers per hour. The speed of WarVOX is limited only by downstream bandwidth and the limitations of the VoIP service. Using two providers with over 40 concurrent lines we have been able to scan entire 10,000 number prefixes within 3 hours.</em></li></ul> <ul><li><em>The resulting call audio can be used to extract a list of modems that can be fed into a standard modem-based wardialing application for fingerprinting and banner collection. One of the great things about the WarVOX model is that once the data has been gathered, it is archived and available for re-analysis as new signatures, plugins, and tools are developed. The current release of WarVOX (1.0.0) is able to automatically detect modems, faxes, silence, voice mail boxes, dial tones, and voices.</em></li></ul> <p>Moore hopes WarVOX can replace the “slow and inefficient” systems currently in place to identify security holes in phone systems.</p> <p>This <a href="http://warvox.org/media/warvox-1.0.0.pdf">presentation</a> (.pdf) covers the motivation behind the tools and the implementation details.</p>[Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>]Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-22918571580219113542009-03-12T22:50:00.000-07:002009-03-12T22:53:00.742-07:00Security holes in Apple Time Capsule, AirPort Base Station<p><a href="http://blogs.zdnet.com/security/?p=2799"><img class="size-full wp-image-2800 alignleft" src="http://i.zdnet.com/blogs/apple_base_station.png" alt="" height="84" width="159" /></a>Apple has released a firmware update with fixes for three documented security vulnerabilities affecting its Time Capsule and AirPort Base Station products.</p> <p>The vulnerabilities could lead to denial-of-service or information disclosure attacks via specially crafted packets. Details on <a href="http://support.apple.com/kb/HT3467">the vulnerabilities</a>:</p> <p><span id="more-2799"></span></p> <ul><li><strong>CVE-2008-2476 - </strong>The IPv6 Neighbor Discovery Protocol implementation does not validate the origin of Neighbor Discovery messages. By sending a maliciously crafted message, a remote user may cause a denial of service, observe private network traffic, or inject forged packets. This update addresses the issue by performing additional validation of Neighbor Discovery messages.</li><li><strong>CVE-2008-0473</strong> - An out-of-bounds memory access issue exists in the handling of PPPoE discovery packets. By sending a maliciously crafted PPPoE discovery packet, a remote user may be able to cause an<br />unexpected device shutdown. This update addresses the issue through improved bounds checking.</li><li><strong>CVE-2008-3530</strong> - When IPv6 support is enabled, IPv6 nodes use ICMPv6 to report errors encountered while processing packets. An implementation issue in the handling of incoming ICMPv6 “Packet Too Big” messages<br />may cause an unexpected device shutdown. This update addresses the issue through improved handling of ICMPv6 messages.</li></ul> <p>Apple says the update (firmware version 7.4.1) is installed into Time Capsule or AirPort Base Station with 802.11n* via AirPort Utility provided with the device.</p><p>[Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>] </p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-88684635096696810932009-03-12T22:38:00.000-07:002009-03-12T22:46:57.671-07:00Coming on Patch Tuesday: 3 Windows bulletins, 1 critical<a href="http://blogs.zdnet.com/security/?p=2794#comments"> <span></span></a><a href="http://blogs.zdnet.com/security/?p=2794"><img class="size-full wp-image-2796 alignleft" src="http://i.zdnet.com/blogs/windows_update_icon.png" alt="" height="91" width="91" /></a>Microsoft today outlined plans to ship three security bulletins for software vulnerabilities in the Windows operating system. <p>One of the three bulletins will carry a “critical” rating, meaning that it will cover flaws that could be exploited to launch remote code execution attacks.</p> <p><span id="more-2794"></span></p> <p>According to the <a href="http://www.microsoft.com/technet/security/bulletin/ms09-mar.mspx">advance notice</a> from Microsoft, the other two bulletins are rated “important” and can expose Windows users to spoofing attacks.</p> <p>All three bulletins require a restart after deployment.</p> <p>All supported versions of Windows will be affected by next Tuesday’s releases, including the newer Windows Vista and Windows Server 2008.</p> <p>This month’s batch of patches will NOT include a fix for a known — and under attack — code execution vulnerability affecting Microsoft Office. Microsoft has already issued a <a href="http://www.microsoft.com/technet/security/advisory/968272.mspx">security advisory on the Office attacks</a> (via rigged Excel files) with some suggested mitigation guidance.</p><p><a href="http://blogs.zdnet.com/security/?p=1837" rel="bookmark" title="Permanent Link to Google Chrome, the security tidbits">[</a>Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>] </p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-22884667323836420842009-03-09T05:49:00.000-07:002009-03-09T06:22:09.577-07:00Study: Firefox wins browser time-to-patch race<a href="http://blogs.zdnet.com/security/?p=2786#comments"><span></span></a><a href="http://blogs.zdnet.com/security/?p=2786"><img class="alignleft" style="" src="http://i.zdnet.com/blogs/ie_firefox2.jpg" alt="" height="97" width="100" /></a>A new report from Secunia is pouring more gas on the Internet Explorer vs. Mozilla Firefox <a href="http://blogs.zdnet.com/security/?p=703">security debate</a>. <p>The security alerts aggregator collected and crunched the numbers on security flaws publicly reported — and fixed — by the two vendors and found that Mozilla easily won the time-to-patch race, despite having to respond to almost four times the number of vulnerabilities.</p> <p><span id="more-2786"></span></p> <p style=""><a title="Firefox wins browser time-to-patch race" href="http://blogs.zdnet.com/security/?p=2786"><img class="size-full wp-image-2788 aligncenter" src="http://i.zdnet.com/blogs/window_of_exposure.png" alt="" height="265" width="464" /></a></p> <p style=""><em>(Table shows window of exploitation for vulnerabilities publicly disclosed in IE and Firefox in 2008. The number of days unpatched are in red for those vulnerabilities that are still unpatched as of Dec. 1, 2008)</em></p> <p>On average, according to the <a href="http://i.zdnet.com/blogs/secunia2008report.pdf">Secunia 2008 report</a> (.pdf), Mozilla averaged 43 days to respond to 115 reported Firefox vulnerabilities while Microsoft took 110 days to release patches for 31 Internet Explorer holes.</p> <p><em>* Image source: <a href="http://www.flickr.com/photos/seokchanyun/2380390652/">Channy Yun’s Flickr photostream</a> (Creative Commons 2.0)</em></p><a href="http://blogs.zdnet.com/security/?p=1837" rel="bookmark" title="Permanent Link to Google Chrome, the security tidbits">[</a>Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>]Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-71928207961448937092009-03-09T05:46:00.000-07:002009-03-09T05:49:10.910-07:00Google downplays severity of Gmail CSRF flaw<p><a href="http://i.zdnet.com/blogs/gmail-logo1.jpg"><img class="size-full wp-image-2775 alignleft" src="http://i.zdnet.com/blogs/gmail-logo1.jpg" alt="" height="67" width="163" /></a>Yesterday, Vicente Aguilera Diaz from <a href="http://www.isecauditors.com/">Internet Security Auditors</a> released <a href="http://www.securiteam.com/securitynews/5ZP010UQKK.html">proof of concept of a CSRF (Cross-Site Request Forgery) vulnerability in Google’s Gmail</a>, which he originally communicated to Google two years ago. The CSRF flaw affects Gmail’s “Change Password” function, since according to Diaz the session cookie is automatically sent by the browser in every request making the attack possible.</p> <p>Google’s response came fast, and it’s in the form of - “<a href="http://www.darkreading.com/security/vulnerabilities/showArticle.jhtml?articleID=215800241">We do not consider this case to be a significant vulnerability.</a>” :</p> <p><span id="more-2773"></span></p> <blockquote><p>We’ve been aware of this report for some time, and we do not consider this case to be a significant vulnerability, since a successful exploit would require correctly guessing a user’s password within the period that the user is visiting a potential attacker’s site,” the spokesperson said. “Despite the very low chance of guessing a password in this way, we will explore ways to further mitigate the issue. We always encourage users to choose strong passwords, and we have an indicator to help them do this.</p></blockquote> <p>Compared to the futile password guessing attempts in order to execute the attack, nothing can replace flaw-independent approaches like social engineering. From a pragmatic perspective, malicious attackers have an extensive number of tactics to chose from if they were trying to obtain your Gmail password. Starting from plain simple <a href="http://blogs.zdnet.com/security/?p=2682">phishing campaigns</a>, and going to a more <a href="http://www.garchiver.com/what-happened.htm">efficiency-centered</a> approaches - remember the <a href="http://www.codinghorror.com/blog/archives/001072.html">G-Archiver</a> fiasco?</p> <ul><li>Related posts: <a href="http://blogs.zdnet.com/security/?p=1911">Google downplays Chrome’s carpet-bombing flaw</a>; <a href="http://blogs.zdnet.com/security/?p=2223">Google: no evidence of a Gmail vulnerability</a>; <a href="http://blogs.zdnet.com/security/?p=2169">Google fixes critical XSS vulnerability</a></li></ul> <p>Google’s most recently fixed flaws across its web properties include October 2008’s <a href="http://xssed.com/news/78/Google_cross_domain_frame_injection_vulnerability/">cross domain frame injection vulnerability</a>, November 2008’s <a href="http://xssed.com/news/79/Google_accounts_SSL_login_page_suffers_from_highly_critical_XSS/">XSS in Google’s accounts SSL login page</a>, and January 2009’s <a href="http://xssed.com/news/84/Google_Sites_Reflective_Cross-Site_Scripting/">Google sites reflective cross-site scripting flaw</a>.</p><p><a href="http://blogs.zdnet.com/security/?p=1837" rel="bookmark" title="Permanent Link to Google Chrome, the security tidbits">[</a>Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>] </p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-5511189926963096522009-03-09T05:42:00.000-07:002009-03-09T05:45:13.101-07:00Conficker worm to DDoS legitimate sites in March<a href="http://blogs.zdnet.com/security/?cat=17" title="View all posts in Botnets" rel="category">ets</a>, <a href="http://blogs.zdnet.com/security/?cat=8" title="View all posts in Browsers" rel="category">Browsers</a>, <a href="http://blogs.zdnet.com/security/?cat=3" title="View all posts in Hackers" rel="category">Hackers</a>, <a href="http://blogs.zdnet.com/security/?cat=72" title="View all posts in Malware" rel="category">Malware</a><span class="ellipsis">...</span><span class="more"></span><span style="display: inline;" class="ellipsis">...</span><span style="display: none;" class="more">, <a href="http://blogs.zdnet.com/security/?cat=40" title="View all posts in Passwords" rel="category">Passwords</a>, <a href="http://blogs.zdnet.com/security/?cat=2" title="View all posts in Patch Watch" rel="category">Patch Watch</a></span> <p class="tags"><strong>Tags:</strong> <a href="http://updates.zdnet.com/tags/Security.html">Security</a>, <a href="http://updates.zdnet.com/tags/Internet+Worm.html">Internet Worm</a>, <a href="http://updates.zdnet.com/tags/Remote+Code+Execution.html">Remote Code Execution</a>, <a href="http://updates.zdnet.com/tags/MS08-067.html">MS08-067</a>, <a href="http://updates.zdnet.com/tags/Conficker.html">Conficker</a><span class="ellipsis">...</span><span class="more"></span><span style="display: inline;" class="ellipsis">...</span><span style="display: none;" class="more">, <a href="http://updates.zdnet.com/tags/Downadup.html">Downadup</a>, <a href="http://updates.zdnet.com/tags/Dancho+Danchev.html">Dancho Danchev</a></span></p> <script> var tb1 = new CNET.Blog.Toolbar.Interact(); CNET.Blog.Toolbar.Interact.allToolbars.push(tb1); tb1.id = 'zdsecurity_2754'; CNET.Blog.Toolbar.Interact.service.contentId.push(tb1.id); tb1.idContainer = 'interact_'+tb1.id; tb1.title = 'Conficker worm to DDoS legitimate sites in March'; tb1.emailTitle = 'Conficker worm to DDoS legitimate sites in March | Zero Day | ZDNet.com'; tb1.diggTopic = 'tech_news'; tb1.diggBodyText = 'A ZDNET Blog'; tb1.absoluteUrl = 'http://blogs.zdnet.com/security/?p=2754'; tb1.relativeUrl = '?p=2754'; tb1.commentUrl = '?p=2754#comments'; tb1.blogThisUrl = 'index.php?blogthis=1&p=2754'; tb1.noTalkback = ''; tb1.numTalkbacks = ''; tb1.votingId = tb1.id; tb1.voteCount = 7; tb1.voteTotal = 7; tb1.recommend.hasVoted = false; tb1.recommend.contentId = 'zdsecurity_2754'; tb1.recommend.userId = ''; tb1.recommend.encodedTitle = 'Q29uZmlja2VyIHdvcm0gdG8gRERvUyBsZWdpdGltYXRlIHNpdGVzIGluIE1hcmNo'; tb1.recommend.encodedUrl = 'aHR0cDovL2Jsb2dzLnpkbmV0LmNvbS9zZWN1cml0eS8_cD0yNzU0'; tb1.recommend.rpcHost = 'blogs.zdnet.com'; tb1.recommend.loginUrl = 'http://www.zdnet.com/1320-4_24-44.html?path='; tb1.recommend.returnUrl = 'http://blogs.zdnet.com/security/?p=2754'; tb1.recommend.cookieResults = ''; tb1.init(); </script> <p><a href="http://i.zdnet.com/blogs/conficker_final_msrt_microsoft.png"><img class="size-full wp-image-2755 alignleft" src="http://i.zdnet.com/blogs/conficker_final_msrt_microsoft.png" alt="" height="99" width="132" /></a>Among the key innovations of the <a href="http://blogs.zdnet.com/security/?p=2228">Conficker worm (W32.Downadup)</a> was the <a href="http://mtc.sri.com/Conficker/">pseudo-random domain generation algorithm</a> used for the generation of dynamic command and control locations in order to make it nearly impossible for researchers and the industry to take them down. However, once the domain registration algorithm was successfully reverse engineering, it became possible to <a href="http://blogs.zdnet.com/security/?p=2388">measure the estimated number of affected hosts</a> by registering several of the upcoming phone back locations.</p> <p>What if the Conficker worm suddenly decided that the phone-back locations for March were those of legitimate sites?</p> <p><span id="more-2754"></span></p> <p><a href="http://www.sophos.com/security/blog/2009/03/3457.html">According to Sophos</a>, during March, the millions of Conficker infected hosts will attempt to phone back to several legitimate domains, among which is a Southwest Airlines owned <strong>wnsux.com</strong>, potentially causing a distributed denial of service attack on all of them. Here’s a list of the legitimate domains and dates on which Conficker will attempt to contact/potentially DDoS them:</p> <p>Music Search Engine - <strong>jogli.com</strong> on 8th of March<br />Southwest Airlines - <strong>wnsux.com</strong> on 13th of March<br />Women’s Net in Qinghai Province - <strong>qhflh.com</strong> on 18th of March<br />Phonetics by Computer - <strong>praat.org</strong> on 31th of March</p> <p>In an attempt to mitigate this attack, Southwest Airlines owned <strong>wnsux.com</strong> domains was modified yesterday and is no longer resolving to a particular IP. However, <strong>praat.org</strong> is a redirect to the <a href="http://www.fon.hum.uva.nl/praat/">University of Amsterdam’s Institute of Phonetic Sciences</a> and just like <strong>qhflh.com </strong>and <strong>jogli.com </strong>is still active.</p> <p>The reverse engineering of the domain registration algorithm not only made it possible to anticipate the upcoming command and control locations, but also, allowed security companies to pre-register them and lock them under the <a href="http://asert.arbornetworks.com/2009/02/the-conficker-cabal-announced/">Conficker Cabal alliance with members such as Microsoft and the ICANN</a>. Moreover, perhaps the most pragmatic mitigation solution implemented on a large scale so far, has been <a href="http://blog.opendns.com/2009/02/09/stats-are-back-and-conficker/">OpenDNS updated Stats System which automatically stops resolving Conficker’s latest domains</a>, a feature which they introduced last month.</p> <p>For the time being, the Conficker botnet remains in a “stay tuned” mode with the real malicious payload to be delivered at any particular moment. <a href="http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx">A patch has been available</a> since October, 2008.</p> <p><em>Conficker graph courtesy of <a href="http://blogs.technet.com/mmpc">Microsoft’s Malware Protection Center</a>.</em></p><p><a href="http://blogs.zdnet.com/security/?p=1837" rel="bookmark" title="Permanent Link to Google Chrome, the security tidbits">[</a>Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>] </p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-30480983509973928032009-03-09T05:33:00.000-07:002009-03-09T05:41:00.935-07:00Pwn2Own hacker: Apple Safari is 'easy pickings'<p><a href="http://blogs.zdnet.com/security/?p=2748"><img class="alignleft" src="http://blogs.zdnet.com/security/images/apple_safari.jpg" alt="" height="76" width="76" /></a>Charlie Miller, the security researcher who won last year’s Pwn2Own hacker contest, is predicting that Apple’s Safari browser will be the easiest target this year.</p> <p>In a note posted on the popular Daily Dave mailing list, Miller describes Safari as “easy pickin’s” and forecasts that at least four zero-day Safari flaws will be used during <a href="http://blogs.zdnet.com/security/?p=2531">the contest at CanSecWest</a> later this month.</p> <p><span id="more-2748"></span><strong>[ SEE: <a title="Permanent Link to Pwn2Own hacker contest targets browsers, smart phones" rel="bookmark" href="http://blogs.zdnet.com/security/?p=2531">Pwn2Own hacker contest targets browsers, smart phones</a> ]</strong></p> <p>This year’s contest will pit hackers <a href="http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009">against browsers and smart phones</a> with Internet Explorer, Firefox, Safari, Opera and Chrome among the high-profile targets. It will also include attacks against fully patched BlackBerry, Android, iPhone, Symbian and Windows Mobile phones in their default configurations.</p> <p>Here are <a href="http://lists.immunitysec.com/pipermail/dailydave/2009-March/005595.html">Miller’s predictions</a>:</p> <ul><li> Safari: hacked by 4 different people. Easy pickin’s as usual.</li><li> Android: hacked by 1 person. Not too tough but no one owns one.</li><li> IE8, Firefox: Survive unscathed. The bugs to exploit equation is too hard for $5k.</li><li> iPhone, Symbian: Survive due to non-executable heap.</li><li> Blackberry, Windows Mobile, Chrome: I don’t know enough to say anything intelligent. That said, they’re probably hard/obscure and so survive.</li></ul> <p>Last year, Miller exploited a Safari flaw to <a href="http://dvlabs.tippingpoint.com/blog/2008/03/27/day-two-of-cansecwest-pwn-to-own---we-have-our-first-official-winner-with-picture">hijack a fully patched MacBook Pro</a> machine. He is also known for launching successful attacks <a href="http://blogs.zdnet.com/security/?p=393">against Apple’s iPhone</a> and <a href="http://blogs.zdnet.com/security/?p=2067">Google’s Android platform</a>.</p> <p><strong>ALSO SEE: <a title="Permanent Link to 10 questions for MacBook hacker Dino Dai Zovi" rel="bookmark" href="http://blogs.zdnet.com/security/?p=176">10 questions for MacBook hacker Dino Dai Zovi</a></strong></p><p><a href="http://blogs.zdnet.com/security/?p=1837" rel="bookmark" title="Permanent Link to Google Chrome, the security tidbits">[</a>Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>] </p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-64491690515873678802009-03-09T03:14:00.000-07:002009-03-09T04:37:22.765-07:00Opera plugs security holes; adds ASLR, DEP support<a href="http://blogs.zdnet.com/security/?p=2745#comments"><span></span></a><p><a href="http://blogs.zdnet.com/security/?p=2745"><img class="size-full wp-image-2746 alignleft" style="" src="http://i.zdnet.com/blogs/opera_sware.png" alt="Opera plugs security holes, adds anti-exploit mechanisms" height="57" width="187" /></a> Opera Software has shipped a high-priority security patch for its flagship Web browser to plug at least three vulnerabilities that expose Windows users to code execution and cross-domain scripting attacks.</p> <p>The Opera 9.64 upgrade also adds support for DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization), two anti-exploitation mechanisms that helps to limit the damage from malware attacks on the Windows platform.</p> <p><span id="more-2745"></span></p> <p>Opera has only <a href="http://www.opera.com/docs/changelogs/windows/964/">released details</a> on one of the three security vulnerabilities, which was <a href="http://www.opera.com/support/kb/view/926/">discovered and reported</a> by Google’s Tavis Ormandy.</p> <ul><li><em>Specially crafted JPEG images can cause Opera to corrupt memory and crash. Successful exploitation can lead to execution of arbitrary code.</em></li></ul> <p>Opera said the update also fixes an issue where plug-ins could be used to allow cross domain scripting and a third “moderately severe” issue that remains a mystery.</p> <p>“Details will be disclosed at a later date,” the company said.</p> <p><em>* Image source: <a href="http://www.flickr.com/photos/andreas/1348165186/">andyket’s Flickr photostream</a> (Creative Commons 2.0)</em></p><p><a href="http://blogs.zdnet.com/security/?p=1837" rel="bookmark" title="Permanent Link to Google Chrome, the security tidbits">[</a>Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>] </p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-66624652204527318972009-03-09T01:09:00.000-07:002009-03-09T03:13:56.828-07:00The return of L0phtCrack<a href="http://blogs.zdnet.com/security/?p=2737#comments"><span></span></a><a href="http://blogs.zdnet.com/security/?p=2737"><img class="size-full wp-image-2740 alignleft" style="" src="http://i.zdnet.com/blogs/lophtcrack.png" alt="" height="94" width="207" /></a>More than two years after <a href="http://www.eweek.com/c/a/Security/Symantec-Pulls-Plug-on-L0phtCrack/">Symantec pulled the plug</a> on L0phtCrack, the venerable password cracking tool is being prepped for a return to the spotlight. <p>The original creators of L0phtCrack has <a href="http://twitter.com/dildog/status/1263911100">reacquired</a> the tool with plans to release a new version at next week’s SOURCE Boston conference.</p> <p><span id="more-2737"></span></p> <p>A teaser post on the <a href="http://l0phtcrack.com/">l0phtcrack.com</a> Web site mentions “new features and platform support,” which, <a href="http://www.spacerogue.net/wordpress/?p=147">according to Space Rogue</a>, includes 64-bit Windows support and upgraded rainbow tables.</p> <ul><li>Details on potential additional new features, and pricing have not yet been released but you can bet that it will be better than Symantec’s.</li></ul> <p>There’s a special session on the return of L0phtCrack <a href="http://www.sourceconference.com/schedule-boston2009/index.html#thursday">scheduled for Thursday March 12</a> at SOURCE Boston.</p> <p>Symantec quietly discontinued sales and support for L0phtCrack in 2006 out of concerns that it violated cryptography export controls.</p> <p>L0phtCrack was a popular tool used to identify and remediate security vulnerabilities that result from the use of weak or easily guessed passwords. It was also used to recover Windows and Unix account passwords to access user and administrator accounts whose passwords are lost or to streamline migration of users to newer authentication systems.</p> <p>It was originally produced by the L0pht, the Boston-based security research group founded by Peiter “Mudge” Zatko and Chris “Weld Pond” Wysopal.</p><a href="http://blogs.zdnet.com/security/?p=1837" rel="bookmark" title="Permanent Link to Google Chrome, the security tidbits">[</a>Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>]Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-72114256782074671262009-03-01T20:42:00.000-08:002009-03-01T20:44:48.800-08:00PHP plugs security holes<img class="alignleft" src="http://blogs.zdnet.com/security/images/mopb-logo.png" alt="" height="96" width="147" />The open-source PHP Group has issued a patch for at least four security flaws in the widely-used general-purpose scripting language. <p>With PHP 5.2.9 (see <a href="http://www.php.net/ChangeLog-5.php#5.2.9">changeLog</a>), the PHP development team corrects a total of 50 bugs, including a publicly-known flaw that allows attackers to read the contents of arbitrary memory locations in certain situations.</p> <p><span id="more-2732"></span></p> <p>Here’s the skinny on that issue, which is rated medium-severity:</p> <ul><li><em>Array index error in the imageRotate function in PHP 5.2.8 and earlier allows context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument (aka the bgd_color or clrBack argument) for an indexed image.</em></li></ul> <p>The other security fixes in PHP 5.2.9 are:</p> <ul><li>Fixed a crash on extract in zip when files or directories entry names contain a relative path. (Pierre)</li><li>Fixed explode() behavior with empty string to respect negative limit. (Shire)</li><li>Fixed a segfault when malformed string is passed to json_decode(). (Scott)</li></ul> <p><strong>ALSO SEE:</strong></p> <p><strong><a href="http://blogs.zdnet.com/security/?p=107">Flaw trifecta kicks off Month of PHP Bugs</a></strong></p> <p><strong><a href="http://blogs.zdnet.com/security/?p=189">Controversial ‘month of bugs’ getting security results<br /></a></strong></p><p><a href="http://blogs.zdnet.com/security/?p=1837" rel="bookmark" title="Permanent Link to Google Chrome, the security tidbits">[</a>Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>] </p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-77048064512976574442009-03-01T20:30:00.000-08:002009-03-01T20:38:00.870-08:00URL rewriting can help thwart Web app attacks<a href="http://blogs.zdnet.com/security/?p=2728#comments"><span></span></a><a href="http://blogs.zdnet.com/security/?p=2728"><img class="size-full wp-image-2729 alignleft" src="http://i.zdnet.com/blogs/xss_alert.png" alt="" height="111" width="177" /></a>A Microsoft Web application security specialist is suggesting an offbeat defense-in-depth strategy to protect Web sites and applications from cross-site scripting (XSS) and cross-site request forgery (XSRF) attacks. <p>According to Bryan Sullivan, security program manager for Redmond’s Security Development Lifecycle team, Web developers should consider URL Rewriting as a technique to ward off hackers looking to exploit Web app vulnerabilities.</p> <p><span id="more-2728"></span></p> <p>Here’s the gist of <a href="http://msdn.microsoft.com/en-us/magazine/dd458793.aspx" target="_blank">Sullivan’s recommendation</a>:</p> <ul><li><em>Attacks like cross-site scripting (XSS), cross-site request forgery (XSRF), and open-redirect phishing are routinely propagated through malicious hyperlinks sent in e-mail messages. (If you’re unfamiliar with these attacks, I recommend reading about them at the </em><a href="http://owasp.org/" target="_blank"><em>Open Web Application Security Project (OWASP) Web</em></a><em>.) We could mitigate much of the risk of these vulnerabilities by frequently changing our URLs — not once every 200 years but once every 10 minutes. Attackers would no longer be able to exploit application vulnerabilities by mass e-mailing poisoned hyperlinks because the links would be broken and invalid by the time the messages reached their intended victims.</em></li></ul> <p>Of course, there are some caveats, especially in cases where bookmarking and e-mailing static links are necessary:</p> <ul><li><em>URL rewriting may not be appropriate for all applications. One negative side effect of this approach is that although attackers are no longer able to e-mail malicious hyperlinks, legitimate users are similarly prevented from sending valid links or even from bookmarking pages in the application. Any page marked as a landing page could be bookmarked, but as I mentioned before, you need to be very cautious when using landing pages. Therefore, if you expect users of your application to bookmark pages other than the home page, URL rewriting is probably not a good solution for you.</em></li><li><em>Additionally, while URL rewriting is a fast and easy defense-in-depth mechanism, it is just that: defense-in-depth. It is by no means a silver bullet against XSS or any other attacks. An automatically expiring URL can still be exploited by an attacker with access to a Web server of his own. Instead of sending out malicious hyperlinks that point directly to the vulnerable page, he can send out hyperlinks that point to his own site. When his site gets a hit from one of the phished e-mails, it can contact a landing page on the vulnerable site to obtain a valid time stamp and then redirect the user accordingly.</em></li></ul> <p>Sullivan argues that URL rewriting does make the attacker’s work more difficult: he now has to convince a user to follow a hyperlink to his Web site (evil.contoso.com) rather than a trusted one (<a title="www.msn.com" href="http://www.msn.com/" target="_blank">www.msn.com</a>), and he is also leaving a very clear trail back to himself for law enforcement agencies to follow. However, this will probably be of little comfort to any victims who fall for the phished e-mail and have their identities stolen as a result.</p> <ul><li><em>Do use URL rewriting as an extra defensive measure, but always be sure to address vulnerabilities at the root of the problem.</em></li></ul> <p>Read the <a href="http://msdn.microsoft.com/en-us/magazine/dd458793.aspx" target="_blank">entire article here</a>.</p><p><a href="http://blogs.zdnet.com/security/?p=1837" rel="bookmark" title="Permanent Link to Google Chrome, the security tidbits">[</a>Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>] </p>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-19828571841806431362009-02-28T02:54:00.000-08:002009-02-28T02:56:29.947-08:00Microsoft takes aim at Vista 'SoftMod' hack<p><a href="http://blogs.zdnet.com/security/?p=2720"><img class="size-full wp-image-2724 alignleft" style="" src="http://i.zdnet.com/blogs/win_vista_logo.png" alt="" height="75" width="102" /></a>Starting this week, Microsoft will ship an update to Windows Vista Ultimate users to ferret out cracked copies of its most expensive and feature-packed operating system.</p> <p>The renewed anti-piracy campaign is aimed directly at the activation exploit known as the “SoftMod hack,” according to a post on Microsoft’s WGA blog.</p> <p><span id="more-2720"></span></p> <p>This <a href="http://support.microsoft.com/kb/940510">Knowledge Base article explains</a>:</p> <ul><li>This update enables Windows Vista to detect activation exploits that bypass product activation and that interfere with usual Windows operation. An activation exploit is a form of software that replaces or modifies authentic Windows components. When activation exploits are present on a system, it indicates that a software or hardware vendor may have tampered with genuine Windows to enable the sale of counterfeit software. Therefore, the security and the privacy of the computer are put at risk. After this update is installed, you will know if activation exploits are present on the system.</li></ul> <p>According to Alex Kochis, director of Microsoft’s Windows Genuine group, <a href="http://blogs.msdn.com/wga/archive/2009/02/24/update-to-windows-vista-activation-exploit-detection-begins-today.aspx">this is what a user would see</a> on a system that has detected the SoftMod activation exploit:</p> <p><a href="http://blogs.zdnet.com/security/?p=2720"><img class="alignnone size-full wp-image-2725" src="http://i.zdnet.com/blogs/softmod_hack.png" alt="" height="456" width="480" /></a></p> <p><em>* Hat tip: <a href="http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9128592&source=rss_topic17">Gregg Keizer</a>.</em></p><a href="http://blogs.zdnet.com/security/?p=1837" rel="bookmark" title="Permanent Link to Google Chrome, the security tidbits">[</a>Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>]Unknownnoreply@blogger.com1tag:blogger.com,1999:blog-1527176046331538077.post-86728632155306846742009-02-28T02:51:00.000-08:002009-02-28T02:53:33.384-08:00Google wants to buy Native Client security flaws<a href="http://blogs.zdnet.com/security/?p=2702#comments"><span></span></a><a href="http://i.zdnet.com/blogs/google_code_small.png"><img class="size-full wp-image-2703 alignleft" src="http://i.zdnet.com/blogs/google_code_small.png" alt="" height="55" width="153" /></a>Google is (indirectly) buying security vulnerabilities from white hat hackers. <p>Under the guise of a Native Client Security Contest, the search engine firm is offering big cash prizes to hackers who find bugs and other security flaws in the open-source research technology for running x86 native code in Web applications.</p> <p><span id="more-2702"></span></p> <p><strong>[ SEE: <a title="Permanent Link to Android security team appeals to hackers" rel="bookmark" href="http://blogs.zdnet.com/security/?p=1746">Android security team appeals to hackers</a> ]<br /></strong></p> <p>From the contest <a href="http://code.google.com/contests/nativeclient-security/faq.html" target="_blank">FAQ</a>:</p> <ul><li>To participate, you will need to test the Native Client builds, identify security exploits which affect the current Native Client build at the time of submission and report them to our team. Our judges will review your entry. If you are one of the top five participants selected by the judges and satisfy the requirements for eligibility, then you will win a cash prize.</li></ul> <p>The <a href="http://code.google.com/contests/nativeclient-security/judges.html">judging</a> will be led by Princeton University’s Ed Felten.</p> <p>The first prize is $8,192, the second prize $4,096, the third prize is $2,048, the fourth prize is $1,024 and the fifth prize is $1,024. All amounts are in USD.</p> <p>At least one <a href="http://code.google.com/p/nativeclient/issues/detail?id=23">exploitable defect</a> is already publicly known.</p><a href="http://blogs.zdnet.com/security/?p=1837" rel="bookmark" title="Permanent Link to Google Chrome, the security tidbits">[</a>Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>]Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-1527176046331538077.post-13431059597425237022009-02-28T02:47:00.000-08:002009-02-28T02:50:54.426-08:00Malware campaign at YouTube uses social engineering tricks<p><a href="http://i.zdnet.com/blogs/youtube_porntube_fake_codec_malware.jpg"><img class="size-full wp-image-2696 alignleft" src="http://i.zdnet.com/blogs/youtube_porntube_fake_codec_malware.jpg" alt="" height="103" width="168" /></a>Remember last month’s <a href="http://blogs.zdnet.com/security/?p=2433">Google Video search results poisoning attack</a> which was hijacking legitimate YouTube titles in order to acquire potential traffic coming from Google Video? Or the <a href="http://blogs.zdnet.com/security/?p=2544">massive comment-spam attack on Digg.com</a>?</p> <p>It appears that the cybercriminals behind both of these campaigns aren’t giving up just yet, and are currently experimenting with a catchy social engineering attack at YouTube which is once again attempting to serve rogue security software under the disguise of a required media codec.</p> <p>Here’s how the new campaign looks like.</p> <p><span id="more-2695"></span></p> <p><a href="http://i.zdnet.com/blogs/youtube_social_engineering_fake_codec.jpg"><img class="size-full wp-image-2697 alignleft" src="http://i.zdnet.com/blogs/youtube_social_engineering_fake_codec.jpg" alt="" height="107" width="170" /></a>This time their experiment relies on a new “visual social engineering vector”, a message “<em>Click Here to Join the Club</em>” or “<em>Click Here for Free Porn</em>” is embedded within the legitimate video, with a pointer enticing the user into clicking on the PornTube link right next to it. This novel approach slightly differs from previous campaigns involving fake YouTube sites, or the use of the very same malware links this time basically posted within the comments of a video.</p> <p>The campaign does suffer from a major weakness, and that’s its adult content which YouTube has already — perhaps automatically — started removing. The fake codecs used in the campaign act as downloaders for rogue security software, with the cybercriminals earning revenue in the process. Moreover, not only are the Google Video, Digg.com’s and this latest campaign launched by the same attackers, but the malware campaigners behind them continue using highly toxic net blocks residing within the Latvian DATORU EXPRESS SERVISS Ltd (<strong>zlkon.lv</strong>), and the Dutch WORLDSTREAM DBM which makes them fairly easy to keep track of - at least for now.</p><a href="http://blogs.zdnet.com/security/?p=1837" rel="bookmark" title="Permanent Link to Google Chrome, the security tidbits">[</a>Source<a href="http://blogs.zdnet.com/security/?p=1975#more-1975">: zdnet</a>]Unknownnoreply@blogger.com0