4 X Security Team

Can you teach an old employee new phishing protection tricks?

In a recently presented study by the Intrepidus Group, the company behind the PhishMe.com spear phishing awareness service allowing companies to ethically attempt to phish their employees on their way to build security awareness, presents some interesting key findings based on 32 phishing scenarios tested against a total of 69,000 employees around the world. Here they are:

• 23% of people worldwide are vulnerable to targeted/spear phishing attacks
• Phishing attacks that use an authoritative tone are 40% more successful than those that attempt to lure people through reward-giving
• Men and women are both equally susceptible to phishing
• On an average 60% of corporate employees that were found susceptible to targeted spear phishing responded to the phishing emails within three hours of receiving them
• People are less cautious when clicking on active links in emails than when they are requested for sensitive data

Metrics are invaluable, but in this case the obsession with metrics can result in more insecurities since it excludes the possibility of blended threats. For instance, last year I was closely monitoring a similar blended Skype phishing campaign, where the cybercriminals (IkbMan) were attempting to optimize the click-through rate of their campaign by serving client-side exploits to the visitors, “just in case” if they find the site suspicious and do not enter any accounting data. For the time being the exploit is served instantly upon visiting the phishing site, however, the possibility for serving it only if the user hasn’t entered anything and is leaving the site is always there.

• Go through related phishing trends and tactics: Research: 76% of phishing sites hosted on compromised servers; Microsoft study debunks phishing profitability; Phishers increasingly scamming other phishers; DIY phishing kits introducing new features; Phishers apply quality assurance, start validating credit card numbers; Lack of phishing attacks data sharing puts $300M at stake annually

Considering one of the key points from Intrepidus Group’s study, namely that “People are less cautious when clicking on active links in emails than when they are requested for sensitive data“, a phishing email should be treated as spam, namely (in a perfect world) it shouldn’t be even allowed to reach the employee’s mailbox. Otherwise, it appears that the trade-off for coming up with quality metrics on the current degree of security awareness in regard to phishing, is the potential exposure of the tested population against potential blended threats.

With managed localization services in the sense of dedicated translators of messages to be used in spam, phishing, and malware campaigns already a fact, the cybercrime ecosystem will soon be talking in a native language, and with the increasingly automated phishing tools whose features were once available to a more sophisticated crowd of cybecriminals, now available for free - the future of phishing looks promising.

The only threat that can outpace its growth is the threat posed by the much more efficient and sophisticated financial data targeting tactic of using crimeware targeting each and every E-banking site simultaneously upon successful infection.

[Source: zdnet]

Microsoft today outlined plans to ship three security bulletins for software vulnerabilities in the Windows operating system.

One of the three bulletins will carry a “critical” rating, meaning that it will cover flaws that could be exploited to launch remote code execution attacks.

According to the advance notice from Microsoft, the other two bulletins are rated “important” and can expose Windows users to spoofing attacks.

All three bulletins require a restart after deployment.

All supported versions of Windows will be affected by next Tuesday’s releases, including the newer Windows Vista and Windows Server 2008.

This month’s batch of patches will NOT include a fix for a known — and under attack — code execution vulnerability affecting Microsoft Office. Microsoft has already issued a security advisory on the Office attacks (via rigged Excel files) with some suggested mitigation guidance.

[Source: zdnet]

After years of lagging behind on important security features, Apple has finally added a malware-blocker, a phishing filter and support for EV (extended validation) certificates into the latest refresh of its Safari Web browser.

The malware roadblock headlines a list of Safari 4 security features that also includes cookie blocking, private browsing, secure encryption, safe downloads and parental controls.

[ SEE: PayPal: If a browser doesn't have anti-phishing technology (like Safari) ditch it ]

Apple has been heavily criticized in the past for neglecting basic security features in Safari. PayPal CIO Michael Barrett went so far as to suggest that end users should avoid the browser because of the missing protections.

Now, it looks like Apple has finally caught up. According to a source, the crucial malware block is powered by Google’s blacklist of malicious sites and will trigger a warning when a user lands at known malware sites.

Microsoft’s Internet Explorer, Mozilla’s Firefox and Opera all provide the ability to issue similar warnings.

The support for EV-Certs (see right) is also important. This allows Web surfers to easily identify legitimate Web sites and businesses. For sites that have an EV Certificate, Safari 4 will display the site’s name in green on the right side of the address field.

[Source: zdnet]

According to PandaSecurity, the social news site Digg.com is among the very latest Web 2.0 services to be targeted by cybecriminals on their way to acquire legitimate traffic to their malware serving domains. The ongoing attack is far more widespread the originally stated, with +500,000 bogus comments

leading to 15 currently active malware domains, where the end user is enticed to install a fake video codec in order to view the video. Once executed, the codec attempts to trick the user that they’re infected with malware, and in order to get rid of it, a rogue security software has to be purchased.

Despite the obvious similarities with last month’s Google Video keywords poisoning attack, the comment-spam campaign at Digg.com is unique in the sense that it appears to have been active for over an year now. Let’s dissect the campaign, and explain how it works.

The cybercriminals are taking advantage of on purposely registrated bogus accounts, in a combination with compromised legitimate accounts to not only post Digg stories directly leading to malware, but also, to heavily comment on legitimate and bogus stories by posting even more malware-serving links.

So basically, you have a catchy title submitted through a bogus account, with a miltitude of bogus accounts commenting on it, and linking to more malware serving domains. Or exactly the opposite - bogus accounts commenting on legitimate stories since January, 2008. This practice of self-recommendation greatly reminds me a similar Ebay bot talk scheme back in 2006, where bogus accounts were automatically giving positive recommendation to fraudulent accounts, all operated by the same person/gang.

• Go through related abuse of Web 2.0 services by cybercriminals: Bogus LinkedIn profiles serving malware; Spammers targeting Bebo, generate thousands of bogus accounts; Malware and spam attacks exploiting Picasa and ImageShack; Twitter being used to distribute malware; Cybercriminals syndicating Google Trends keywords to serve malware; Malware-infected WinRAR distributed through Google AdWords

Interestingly, just like in Google’s keywords poisoning campaign, no client-side vulnerabilities are used. Instead, the cybecriminals are entirely relying on the end user to download and execute the codec on their way to view the video.

Digg.com’s abuse department has already been notified of all the related malware domains used across the site.

UPDATE: The following is a complete list of the malware domains used within the comments posted at Digg.

[Source: zdnet]

Last week, a commercial Twitter spamming tool (tweettornado.com) pitching itself as a “fully automated advertising software for Twitter” hit the market, potentially empowering phishers, spammers, malware authors and everyone in between with the ability to generate bogus Twitter accounts and spread their campaigns across the micro-blogging service.

TweetTornado allows users to create unlimited Twitter accounts, add unlimited number of followers, which combined with its ability to automatically update all of bogus accounts through proxy servers with an identical message make it the perfect Twitter spam tool.

TweetTornado’s core functionality relies on a simple flaw in Twitter’s new user registration process. Tackling it will not render the tool’s functionality useless, but will at least ruin the efficiency model. Sadly, Twitter doesn’t require you to have a valid email address when registering a new account, so even though a nonexistent@email.com is used, the user is still registered and is allowed to use Twitter.

So starting from the basics of requiring a validation by clicking on a link which will only be possible if a valid email is provided could really make an impact in this case, since it its current form the Twitter registration process can be so massively abused that I’m surprised it hasn’t happened yet. Once a Twitter spammer has been detected, the associated, and now legitimate email could be banned from further registrations, potentially emptying the inventory of bogus emails, and most importantly making it more time consuming for spammers to abuse Twitter in general.

If TweetTornado is indeed the advertising tool of choice for Twitter marketers, I “wonder” why is the originally blurred by the author Twitter account used in the proof (twitter.com/AarensAbritta) currently suspended, the way the rest of the automatically registered ones are? Pretty evident TOS violation, since two updates and 427 followers in two hours clearly indicate that a spammer’s tweeting.

[Source: zdnet]

a high-priority Chrome browser patch with fixes for three security vulnerabilities that expose users to cross-site scripting and data theft attacks.

Google Chrome’s beta and stable channels have been updated to version 1.0.154.46 to mitigate an issue with the Adobe Reader plug-in (two separate vulnerabilities) and to fix a bug in the V8 JavaScript engine could allow bypassing same-origin checks.

The skinny:

• CVE-2007-0048 and CVE-2007-0045: Workaround for Adobe Reader Plugin Open Parameters Cross-Site Scripting Vulnerability
  • Google Chrome now refuses requests for javascript: URLs in Netscape Plugin API (NPAPI) requests from the Adobe Reader plugin. Adobe is aware of this issue and has helped us develop this mitigation while they work on a fix for all users.
  • Severity: Moderate. This could allow a PDF document to run scripts on arbitrary sites.

• CVE-2009-0276: Javascript Same-Origin Bypass
  • A bug in the V8 JavaScript engine could allow bypassing same-origin checks in certain situations.
  • Severity: High. A malicious script in a page could read the full URL of another frame, and possibly other attributes or data from another frame in a different origin. This could disclose sensitive information from one website to a third party.

The patch (see release notes) also fixes problems with Yahoo Mail and Windows Live Hotmail.

ALSO READ:

• Google adds HTTPS-only browsing to Chrome
• Google Chrome, the security tidbits
• Google Chrome vulnerable to carpet-bombing flaw
• Google hires browser hacking guru

[Source: zdnet]

The U.S. Computer Emergency Readiness Team (US-CERT) has issued a technical cyber-security alert to warn that Microsoft’s guidelines for disabling AutoRun in the Windows operating system “are not fully effective” and argues that this “could be considered a vulnerability.”

The U.S. CERT warning comes on the heels of live malware/worm attacks that take advantage of the Windows AutoRun and AutoPlay features to improve propagation.

[ SEE: Is there no end to the AutoRun madness? ]

Here’s the skinny on Microsoft’s hiccup:

• The Autorun and NoDriveTypeAutorun registry values are both ineffective for fully disabling AutoRun capabilities on Microsoft Windows systems. Setting the Autorun registry value to 0 will not prevent newly connected devices from automatically running code specified in the Autorun.inf file. It will, however, disable Media Change Notification (MCN) messages, which may prevent Windows from detecting when a CD or DVD is changed. According to Microsoft, setting the NoDriveTypeAutorun registry value to 0xFF “disables Autoplay on all types of drives.” Even with this value set, Windows may execute arbitrary code when the user clicks the icon for the device in Windows Explorer.

This means that malware authors can place an Autorun.inf file on a device to automatically execute arbitrary code when the device is connected to a Windows system. Code execution may also take place when the user attempts to browse to the software location with Windows Explorer, US-CERT warned.

The alert includes instructions for editing the registry to properly disable AutoRun in Microsoft Windows.

UPDATE: Microsoft sent me an e-mail to point out that its KB953252 document, published in May 2008, describes how to correct the problem of NoDriveTypeAutoRun registry value enforcement. This prompted an update on the US-CERT notice:

After the update is installed, Windows will obey the NoDriveTypeAutorun registry value. Note that this fix has been released via Microsoft Update to Windows Vista and Server 2008 systems as part of the MS08-038 Security Bulletin. Windows 2000, XP, and Server 2003 users must install the update manually. Our testing has shown that installing this update and setting the NoDriveTypeAutoRun registry value to 0xFF will disable AutoRun.

[Source: zdnet]

Skilled identity thieves can pilfer user names, passwords and other sensitive data for banking sites without using e-mail lures and other other social engineering tactics.

According to a security advisory from Trusteer, hackers can launch what is described as “in-session phishing attacks” using pop-up messages during an active browser session. The attack technique is somewhat sophisticated — it requires that a base Web site is compromised and the attacker must know which Web site the victim user is currently logged into — in-session phishing can be highly effective because the average end user is likely to enter credentials without a second thought.

Here’s how it works:

1. A user logs onto their online banking application. Leaving this browser window open, the user then navigates to other Web sites.
2. A short time later a pop-up box appears, allegedly from the banking website, requesting the user re-type their username and password because the session has expired, or complete a customer satisfaction survey, or participate in a promotion, etc.
3. Since the user had recently logged onto the banking website, he/she will likely not suspect this pop-up is fraudulent and thus provide the requested details.

To mount a successful in-session phishing attack, a base Web site must be compromised (check!), the malware injected onto the hijacked Web site must be able to identify the site the user is logged into (not trivial but very possible).

Trusteer has issued a research paper (.pdf) that calls attention to a vulnerability in the JavaScript engine of all leading browsers — Internet Explorer, Firefox, Safari, and Chrome — which allows a Web site to check whether a user is currently logged onto another website.

The source of the vulnerability is a specific JavaScript function. When this function is called it leaves a temporary footprint on the computer and any other website can identify this footprint. Websites that use this function in a certain way are traceable. Many websites, including financial institutions, online retailers, social networking websites, gaming, and gambling websites use this function and can be traced.

It explains how a skilled attacker can program a compromised website needs to maintain a list of sites it wants to check.

There is no limit to the number of URLs that a compromised website can check for logged on users. It simply asks the browser a simple question: “is the user currently logged onto this specific website?” and the browser will answer “yes” or “no”. Once the compromised website identifies a website to which the user is logged on, it can inject a pop up message in the browser pretending to be from the legitimate website and asking for credentials and private information.

To protect themselves from in-session phishing attacks, Trusteer recommends that users:

1. Deploy Web browser security tools.
2. Always log out of banking and other sensitive online applications and accounts before navigating to other websites.
3. Be extremely suspicious of pop ups that appear in a web session if you have not clicked a hyperlink.

* Image source: ToastyKen’s Flickr photostream (Creative Commons 2.0)

[Source: zdnet]

Do phishers actually make money, or is phishing an unprofitable business, scammers lose time and resources into? Taking the economic approach of generalizing how much money phishers make, a recently released study by Microsoft researchers Cormac Herley and Dinei Florencio (A Profitless Endeavor: Phishing as Tragedy of the Commons), states that phishing isn’t as profitable as originally thought.

Citing a 1968 published article “Tragedy of the Commons” the researchers argue that due to the fact that so many phishers operate on the same scam-scene, they earn less than the could possibly do. Moreover, according to the research the enormous volume of phishing emails is in fact an indication of the failure of phishing. Naturally, they are many more factors to consider, in particular, are phishers in fact profit-maximization machines or are they willing to sacrifice potential profit for the sake of their own security? Is it all about making big money, or about breaking-even in general?

“However, as we will show, the economics of phishing are far far worse than this. Rather than sharing a fixed pool of dollars phishing is subject to the tragedy of the commons ; i.e. the pool of dollars shrinks as a result of the efforts of the phishers. A community (all phishers) share a finite resource (the pool of phishable dollars) that has limited ability to regenerate (dollars once phished are not available to other phishers). The tragedy of the commons is that the rational course of action for each individual (phisher) leads to over-exploitation and degradation of the resource (the phishable dollars).”

Using the Tragedy of the Commons analogy in this case makes it sound as every phished person’s disposable income to which phishers would eventually have access to is universally the same. Logically, that’s not the case, since a single phished person could prove to be a more profitable catch for a phisher than a hundred phished people, and the number of potentially phishable people is always increasing with more people going online.

Moreover, perhaps not so economic models minded phishers are constantly looking for ways to achieve better efficiency, lower costs, and ways to eat other phishers lunch - by scamming their fellow colleagues. For instance, a related research published in August, 2008, found evidence that phishers are in fact backdooring phishing pages and then distributing them for free so that they can have other phishers do the scam for them. The same backdooring process, even though no properly analyzed in a study, continues to take place at a more advanced and far more profitable level - backdooring web malware exploitation kits and botnet command and control interfaces. Therefore, of the hundred actively participating phishers, eighty could be easily phishing for the other twenty.

• Go through related phishing tactics - DIY phishing kits introducing new features; Phishers apply quality assurance, start validating credit card numbers; Lack of phishing attacks data sharing puts $300M at stake annually

There are even more variables to consider. Take internal competition among different phishers. Just because a phisher has just sent a million phishing emails pretending to be from a leading German bank to a million Chinese users, perhaps not knowing that the spamming database he’s using belongs to Chinese citizens, doesn’t mean that the outcome of his campaign would be similar to a fellow phisher that’s taken basic localization and targeting steps into account. With localization of cybecrime taking place as of early 2008, outsourcing the translation process of a particular phishing campaign/email is opening up an entire new space for phishers to more effectively target potential victims. The bottom line here is that the second phisher has a higher chance for success even though they’re attempting to phish the same Chinese users, since he’d be impersonating a local bank and his phishing creatives would be speaking native language.

This is where efficiency and scalability comes into play, a situation pretty similar to that of spam. As long as even a small number of people out of a million phishing emails sent become victims, the phishers would break-even and thus, continue expanding the number of emails sent. This shouldn’t be taken as a failure of phishing in general, instead, it should be considered as a campaign optimization practice attempting to achieve better results by targeting a larger population.

Quality assurance is yet another differentiation factor distinguishing the sophisticated phisher from the novice one, who will never get close to the potential market share the sophisticated one is aiming at. Just because all phishers have access to the same quality fakes of legitimate banks, and DIY phishing tools assisting them in redirecting accounting data to a single domain, doesn’t mean that all of them will make the same impact. The experienced ones would achieve a higher average online time for their phishing domains, and would apply better targeting and localization tactics due to the fact that spammers, phishers and malware authors are consolidating and vertically integrating to cut costs and achieve scalability. Phishing may be described as a low-skill, low-reward job in the study, but just like every cybercrime practice the “knowledge workers” in the phishing ecosystem are those getting most of financial rewards, with the rest basically generating noise and in fact often getting busted due to their inexperience, acting as a human shield for the sophisticated phishers.

There’s another issue to consider and that is how much money is a phisher actually looking to make out of his phishing campaigns, and is there in fact a maximum or a minimum to his ambitions? Even though access to someone’s account is obtained, is the phisher actually able to withdraw the money from the account, or is he in fact going to be making money from selling access to the phished account to someone who can do it, thus, monetizing the accounting data instead of using it? Evidence gathered on this practice clearly indicates that novice phishers may in fact never obtain any of the money that they have access it, but again make money out of selling the access to a particular account to those who can.

Phishers may not be making the money that they used to a couple of years ago, but then again phishing has long stopped being an exclusive cybercrime practice - it’s turned into a cybercrime practice “in between” with the phishers breaking-even given the lowering costs and entry barriers into the phishing space in general. And as long as they break-even, millions of phishing emails would continue circulating, again “in between” the rest of their malicious activities.

[Source: zdnet]

Guest post by John Viega

Today there’s been a lot of buzz about the clever new attack on public key infrastructure from Alex Sotirov and a team of researchers. In the attack, the bad guy ends up with his own Certification Authority (CA) that is fully trusted according to every major browser. People are declaring the entire Internet is broken, and that it will be hard to fix. This is simply not true.

The major misconception I’m seeing over and over is that the problem allows the bad guy to steal the signature off any valid MD5 signature from any certificate on the Internet.

[ SEE: SSL broken! Hackers create rogue CA certificate ]

Actually, the attack works by a bad guy generating two certificates, one that is just a regular web site certificate, and the other that is a CA certificate. Then, to get the CA certificate trusted, the bad guy submits the web site cert. If he can predict the internal values the CA will use when he starts generating the certificate (a process that takes a few days right now), then he will get back a signature that can be pasted onto the CA cert. That allows the CA to generate new certs to impersonate anybody on the Internet (e.g., Citibank.com).

This means that existing certificates aren’t currently an attack vector, unless they were actually used in an attack.

As a result, this hole is easier to close than people think. The few CAs signing certs with MD5 need to switch to SHA1 (or something stronger). That immediately gets rid of the problem for new certs.

[ Chris Eng: An easy fix ignored ]

For old certs, the risks are also pretty low. Just because of the up-front costs of research and development that would have been necessary, there’s a very good chance that bad guys have focused on low-hanging fruit like social engineering, instead of investing the research dollars.

Once the researchers publish technical details on the tricks they used to make the attack cost effective, then probably some bad guys will try, as long as there are still vulnerable CAs. My guess is that there won’t be.

Even if some bad guys have done all the work, it’s unlikely to have been used more than a handful of times. Either the bad guys will use their fake CA credentials selectively as to not get caught, or they will get caught quickly, and the certs will be blacklisted. Either way, the long term risks are negligible, as long as all CAs migrate from MD5 immediately, or take other precautionary measures, such as using a random certificate ID instead of a sequential one.

And for those CAs that don’t take mitigating steps immediately, the operating systems and browsers of the world should move to blacklist them ASAP.

Right now, the only CA that seems to consistently sign using only MD5 (signing with both also thwarts this attack) is RapidSSL/FreeSSL (FreeSSL is owned by RapidSSL, and is used for trial certs). Who knows why these guys have not migrated away from MD5. But assuming they do it soon, there is little to worry about.

* John Viega is CEO of Stonewall Software and author of several security books including the classic Building Secure Software (Addison Wesley, 2001), and the forthcoming Myths of Security (O’Reilly, 2009). Follow him on Twitter.

Source: zdnet]

Using computing power from a cluster of 200 PS3 game consoles and about $700 in test digital certificates, a group of hackers in the U.S. and Europe have found a way to target a known weakness in the MD5 algorithm to create a rogue Certification Authority (CA), a breakthrough that allows the forging of certificates that are fully trusted by all modern Web browsers.

The research, which will be presented today by Alex Sotirov (top left) and Jacob Appelbaum (bottom left) at the 25C3 conference in Germany, effectively defeats the way modern Web browsers trust secure Web sites and provides a way for attackers to conduct phishing attacks that are virtually undetectable.

The research is significant because there are at least six CAs currently using the weak MD5 cryptographic algorithm in digital signatures and certificates. The most commonly used Web browsers — including Microsoft’s Internet Explorer and Mozilla’s Firefox — whitelist these CAs, meaning that a fake Certificate Authority can display any site as secure (with the SSL padlock).

“We basically broke SSL,” Sotirov said in an interview ahead of his 25C3 presentation.

Our main result is that we are in possession of a “rogue” Certification Authority (CA) certificate. This certificate will be accepted as valid and trusted by many browsers, as it appears to be based on one of the “root CA certificates” present in the so called “trust list” of the browser. In turn, web site certificates issued by us and based on our rogue CA certificate will be validated and trusted as well. Browsers will display these web sites as “secure”, using common security indicators such as a closed padlock in the browser’s window frame, the web address starting with “https://” instead of “http://”, and displaying reassuring phrases such as “This certificate is OK ” when the user clicks on security related menu items, buttons or links.

Researchers at the Centrum Wiskunde & Informatica (CWI) in the Netherlands, EPFL in Switzerland, and Eindhoven University of Technology (TU/e) in the Netherlands helped in the design and implementation of the attack using an advanced implementation of a known MD5 collision construction and a cluster of more than 200 PlayStation 3 game consoles.

According to Sotirov, a rogue CA in combination with Dan Kaminsky’s DNS attack can have serious consequences:

For example, without being aware of it, users could be redirected to malicious sites that appear exactly the same as the trusted banking or e-commerce websites they believe to be visiting. The web browser could then receive a forged certificate that will be erroneously trusted, and users’ passwords and other private data can fall in the wrong hands. Besides secure websites and email servers, the weakness also affects other commonly used software.

Sotirov said the team was able to secure NDAs in advance of briefing the major browser vendors about the problem but because of issues — some practical and some political — there are no straightforward fixes unless the CAs stop using MD5 and move to the more secure SHA-1 algorithm.

To avoid abuse, the team back-dated its rogue CA (it was set only for August 2004) and will not release the private key. “We’re also not going to release the special code that we used to do the MD5 collisions until later this year,” Sotirov added.

“We don’t anticipate this attack to be repeatable very easily. If you do a naive implementation, you would need six months to run it successfully,” he added.

Arjen Lenstra, head of EPFL’s Laboratory for Cryptologic Algorithms, the key objective of the research was to stimulate better Internet security with adequate protocols that provide the necessary security.

The key takeaway, according to Lenstra: “It’s imperative that browsers and CAs stop using MD5, and migrate to more robust alternatives such as SHA-2 and the upcoming SHA-3 standard.”

Further details:

• Detailed explanation
• Slides from the 25c3 presentation
• Demo site (set your system date to August 2004 before clicking)

Colliding certificates:

• Real certificate
• Rogue CA certificate

[Source: zdnet]

Mozilla is joining Microsoft and Opera on the browser patching treadmill.

The open-source group has rolled out the final security fix for the Firefox 2 branch and a new version of Firefox 3 to plug about a dozen security holes that could lead to remote code execution attacks, browser crashes and information disclosure issues.

[ SEE: ‘End of life’ beckons for Firefox 2 ]

In all, Mozilla released eight different bulletins with details on the security flaws. Three of the bulletins carry a “critical” label, meaning they can be exploited “to run attacker code and install software, requiring no user interaction beyond normal browsing.”

One of the bulletins carry a “high severity” rating, meaning it can be used by hackers “to gather sensitive data from sites in other windows or inject data or code into those sites, requiring no more than normal browsing actions.”

[ SEE: ‘Extremely severe’ vulnerabilities in Opera browser ]

The details:

• MFSA 2008-69 XSS vulnerabilities in SessionStore
• MFSA 2008-68 XSS and JavaScript privilege escalation
• MFSA 2008-67 Escaped null characters ignored by CSS parser
• MFSA 2008-66 Errors parsing URLs with leading whitespace and control characters
• MFSA 2008-65 Cross-domain data theft via script redirect error message
• MFSA 2008-64 XMLHttpRequest 302 response disclosure
• MFSA 2008-63 User tracking via XUL persist attribute
• MFSA 2008-60 Crashes with evidence of memory corruption (rv:1.9.0.5/1.8.1.19)

Some of the bugs only affect Firefox 3 so it is important for all Firefox users to apply the update that’s released via the browser’s automatic patching mechanism.

As I previously reported, Mozilla is not planning any more security and stability updates for Firefox 2. If you are still on the old version, also note that the Google-powered anti-phishing protection will no longer be available for Firefox 2 users.

ALSO SEE: As attacks escalate, MS readies emergency IE patch

* Image source: _sarchi’s Flicker photostream (Creative Commons 2.0)

[Source: zdnet]

Google has seeded a new version of its Chrome browser to developers with fixes for a pair of security issues that could expose users to data theft.

The issue, rated as a “moderate” risk could allow hackers to use HTML files to steal arbitrary files from a victim’s machine.

Details below:

• r4188 and r4827 Address an issue with downloaded HTML files being able to read other files on your computer and send them to sites on the Internet. We now prevent local files from connecting to the network using XMLHttpRequest() and also prompt you to confirm a download if it is an HTML file.
  • Severity: Moderate. If a user could be enticed to open a downloaded HTML file, this flaw could be exploited to send arbitrary files to an attacker.

The patch, which will eventually be rolled out via Chrome’s automatic update feature, also adds new features around bookmarking and pop-up blocking.

[Source: zdnet]

Mozilla is joining Microsoft and Opera on the browser patching treadmill.

The open-source group has rolled out the final security fix for the Firefox 2 branch and a new version of Firefox 3 to plug about a dozen security holes that could lead to remote code execution attacks, browser crashes and information disclosure issues.

[ SEE: ‘End of life’ beckons for Firefox 2 ]

In all, Mozilla released eight different bulletins with details on the security flaws. Three of the bulletins carry a “critical” label, meaning they can be exploited “to run attacker code and install software, requiring no user interaction beyond normal browsing.”

One of the bulletins carry a “high severity” rating, meaning it can be used by hackers “to gather sensitive data from sites in other windows or inject data or code into those sites, requiring no more than normal browsing actions.”

[ SEE: ‘Extremely severe’ vulnerabilities in Opera browser ]

The details:

• MFSA 2008-69 XSS vulnerabilities in SessionStore
• MFSA 2008-68 XSS and JavaScript privilege escalation
• MFSA 2008-67 Escaped null characters ignored by CSS parser
• MFSA 2008-66 Errors parsing URLs with leading whitespace and control characters
• MFSA 2008-65 Cross-domain data theft via script redirect error message
• MFSA 2008-64 XMLHttpRequest 302 response disclosure
• MFSA 2008-63 User tracking via XUL persist attribute
• MFSA 2008-60 Crashes with evidence of memory corruption (rv:1.9.0.5/1.8.1.19)

Some of the bugs only affect Firefox 3 so it is important for all Firefox users to apply the update that’s released via the browser’s automatic patching mechanism.

As I previously reported, Mozilla is not planning any more security and stability updates for Firefox 2. If you are still on the old version, also note that the Google-powered anti-phishing protection will no longer be available for Firefox 2 users.

ALSO SEE: As attacks escalate, MS readies emergency IE patch

* Image source: _sarchi’s Flicker photostream (Creative Commons 2.0)

[Source: zdnet]

Spammers are abusing Microsoft’s online services at such an alarming rate that a non-profit spam fighting group now lists Microsoft as the world’s 5th most spam-friendly ISP (Internet Service Provider).

The latest update of Spamhaus.org’s list of the world’s worst spam networks shows Microsoft at #5 because of 26 “current known spam issues” surrounding Nigerian (419) advance-free fraud e-mails (see screenshot below):

The comments from Spamhaus highlight the problems at Microsoft:

• Months of LifeFileStore abuse, we see little done to stop it.
• livefilestore.com - hacked by the tens of thousands.
• spaces.live.com used and abused by spammers.
• Pump and Dump spam anonymized via Hotmail.

Security Fix’s Brian Krebs first reported this story.

[Source: zdnet]

Computer maker Lenovo is shipping a malware-infected software package to Windows XP users, according to warning from anti-virus researchers at Microsoft.

The malicious file was identified by Microsoft as Win32/Meredrop, a Trojan dropper that is used to install and execute multiple malicious executables on an infected computer. Other anti-virus vendors are detecting the threat as a ‘hooligan’ virus or a porn dialer. It was found the Lenovo Trust Key software for Windows XP, a digitally signed driver package available to Windows XP SP2 users.

The infected software is used to install the Lenovo Security Logon and the Lenovo Private folder applications for use with the Lenovo Trust Key (also known as Lenovo Insider Key).

[ SEE: Malware-infected USB drives distributed at security conference ]
My sources tell me the Lenovo package contains lots of files, including the one with the embedded malware. At first glance, the malicious file contains functional, but buggy code and attemps to infect files, spread across the network and USB drives.

Lenovo has been notified and is investigating the issue.

UPDATE: Lenovo has removed the compromised download from its Web site.

[Source: zdnet]

Apple has quietly teamed up with Google to add anti-phishing features into the latest version of the Safari browser.

The feature, turned on by default in Safari 3.2, displays a warning page (see screenshots below) when Safari users surf to a fraudulent Web site. It is powered by Google’s blacklist of fake Web sites that are used to steal user credentials for banking and other finance-related Web sites.

[ SEE: Apple fixes 12 Safari security flaws ]

Here’s the roadblock that appears when Safari is used to surf to a phishing site:

Apple is the last major Web browser provider to add anti-phishing protection. Microsoft’s Internet Explorer, Mozilla’s Firefox and Opera all provide warning mechanisms to end users.

[Source: zdnet]

Google has seeded a new version of its Chrome browser to developers with fixes for a pair of security issues that could expose users to data theft.

The issue, rated as a “moderate” risk could allow hackers to use HTML files to steal arbitrary files from a victim’s machine.

Details below:

• r4188 and r4827 Address an issue with downloaded HTML files being able to read other files on your computer and send them to sites on the Internet. We now prevent local files from connecting to the network using XMLHttpRequest() and also prompt you to confirm a download if it is an HTML file.
  • Severity: Moderate. If a user could be enticed to open a downloaded HTML file, this flaw could be exploited to send arbitrary files to an attacker.

The patch, which will eventually be rolled out via Chrome’s automatic update feature, also adds new features around bookmarking and pop-up blocking.

[Source: zdnet]

Several major news outlets are reporting that the shutdown of a rogue ISP in the Bay Area has lead to a massive drop in the global amount of spam. While this is “good thing”, this event is not an end of spam, nor is it even the beginning of the end of spam; it is merely a temporary lull.

Thanks in no small part to evidence gathered by Brian Krebs, The San Jose based McColo was dropped from the Internet yesterday resulting in a massive decline in spam rates around the globe. The common consensus right now is that the takedown resulted in a 35% to 50% drop in inbound spam sending attempts.

The shutdown has removed pieces of infrastructure critical for the operation of several spammers, but this does not mean they cannot adapt. We have seen that command and control servers can be eliminated by using distributed control algorithms, and storefronts can be hidden across compromised websites. The spammers may even regroup by recreating the services provided by McColo somewhere in Eastern Europe.

While many people would like to declare this event as the first step in the end to spam, I can pretty much guarantee you that it isn’t. Over the next few weeks, spammers will further decentralize their operation, turn the botnets back on, and restart their barrage.

[Source: zdnet]

Researchers at UCSD have determined the return on investment for spam generated by the Storm botnet. While the per-message response rate is astonishingly low, it is sufficient for a spammer to generate a profit.

At this year’s ACM Conference on Computer and Communication Security, Stefan Savage, Vern Paxson and crew presented a paper that measures the conversion rate, or the rate at which an advertising impression results in a product sale, for spam. The team used somewhat aggressive tactics to collect their data; namely, they hijacked a portion of the Storm botnet to inject spam that contained links to domains and storefronts they controlled.

The team’s data and analysis has shown that that generating 28 sales, averaging around $100 each, of various “male-enhancement” products required 350 million separate spams. This provides a yearly revenue rate of the Storm botnet for the sale of pharmaceuticals of around $3.5 million dollars.

What I feel to be the most interesting result from the paper is the direct measurement of the quality of anti-spam technology broken down by geographic location. The countries with the spam lowest response rate include the UNited States and Japan. Both nations have some of the highest capital investment in anti-spam technologies. As of early 2008, the countries with the worst anti-spam technology appear to be India, Pakistan, and Bulgaria.

The researchers do state that the profit margins of the spammers appear to be sensitive to anti-spam techniques. I am left to wonder what would be the profitability of spam if everyone in the world used effective anti-spam software.

[Source: zdnet]