Talkback Tuesday: latest MS vulnerability

Everyone was discussing the MS08-067 vulnerability and its out-of-cycle patchlast week. My post on the topic elicited several comments from our readers, including the following by frgough:

If this had been Apple, the article slant would have been all about
poor security models, inherently flawed structure with lots of
adjectives like massive, dangerous, overconfident, etc. thrown into
the mix.

Truth be told, ever since OS/X came out I have gladly contributed a significant portion of my salary to Apple over the years. From a security standpoint, however, Apple has yet to face the same threats that drove Microsoft to develop the Security Development Lifecycle, an process management system created to help grow better software and software engineers. As I discussed in the past, Apple won’t have to face the same sort of threats that are projected at Microsoft until their market share increases. However, I am certain that Apple will step up when and if they begin to experience those issues.

[Source: zdnet]

‘End of life’ beckons for Firefox 2

'End of life' beckons for Firefox 2If you have not yet upgraded to Firefox 3, keep in mind that Mozilla is very close to pulling the plug on support for older versions of the browser.

Support for Firefox 2, which includes security and stability patches, is scheduled to end six months after Firefox 3 shipped (June 17, 2008), which puts the end-of-life date in the mid-December range.


[ SEE: Talking Firefox security with Mozilla’s Window Snyder ]

Mozilla has not yet set a final date for Firefox 2 end-of-life activity but the open source group has started discussing the “requirements or issues” that would force a deadline extension. The current plan is for the next Firefox 2 patch to the final update of that version.

According to Mozilla’s Mike Beltzner, only about one-third of Firefox users are running older versions of the browser.

  • Presently 2/3rds of our users are using Firefox 3, with more than 50% accepting the first major upgrade offer back in late August. We’re looking through Hendrix and other sources to understand why people didn’t want to upgrade and ensure that those bugs have been fixed.

Firefox 3 is considered a major security improvement over Firefox 2 because of the addition of an anti-malware blocker and improved Web forgery warnings.

[Source: zdnet]

Code execution flaws haunt OpenOffice

OpenOffice security vulnerabilitiesOpenOffice.org has shipped a new version of the open-source desktop productivity suite to patch a pair of highly-critical vulnerabilities that could expose users to arbitrary code execution attacks.

The flaws, which affect all versions prior to OpenOffice.org 2.4.2, could be exploited via manipulated WMF and EMF files in StarOffice or StarSuite documents.

The skinny:

  • CVE-2008-2237: A security vulnerability with the way OpenOffice 2.x process WMF files may allow a remote unprivileged user who provides a StarOffice/StarSuite document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running StarOffice/StarSuite. No working exploit is known right now. There is no workaround.
  • CVE-2008-2238: A security vulnerability with the way OpenOffice 2.x process EMF files may allow a remote unprivileged user who provides a StarOffice/StarSuite document that is opened by a local user to execute arbitrary commands on the system with the privileges of the user running StarOffice/StarSuite. No working exploit is known right now. There is no workaround.

OpenOffice.org described the bugs as file-handling heap overflows. Patches are available in OpenOffice 2.4.2.

OpenOffice 3.0 is not affected by these vulnerabilities.

[Source: zdnet]

Cybercrime friendly EstDomains loses ICANN registrar accreditation

EstDomains AbuseDespite EstDomains persistent press releases during the last couple of days, next to the domain registrar’s delayed response to the security community, on Thursday the ICANN has sent a notice of termination of their registrar accreditation agreement with EstDomains, following obtained court records stating that EstDomains president Vladimir Tsastsin has been convicted of credit card fraud, money laundering and document forgery on 6 February 2008. The end of EstDomains? Could be, but their malicious customers are not going offline anytime soon.

“On 28 October 2008, ICANN sent a notice of termination to EstDomains. Based on an Estonian Court record, ICANN has reason to believe that the president of EstDomains, Vladimir Tsastsin, was convicted of credit card fraud, money laundering and document forgery on 6 February 2008. ICANN received a response from EstDomains regarding the notice of termination. To assess the merits of the claims made in EstDomains’ response, ICANN has stayed the termination process as ICANN analyzes these claims. ICANN’s records indicate that EstDomains has approximately 281,000 domain names under its management. ICANN will take all reasonable measures to protect the interests of registrants during the stay period and the subsequent termination process that may follow.”

EstDomains ICANNOn 29 October 2008, EstDomains’ Konstantin Poltev responded to the ICANN, with documents claiming that their convicted CEO has resigned in June 2008, but that EstDomains didn’t notify ICANN of the change. Is he buying time, or is he making a point? Whatever the case, taking into consideration the fact that EstDomains manages over 280,000 domains, the ICANN is already soliciting requests for bulk transfer of EstDomains portfolio to another domain registrar :

“As the result of the de-accreditation of EstDomains, Inc. (IANA ID 832), ICANN is seeking Statements of Interest from ICANN-accredited registrars that are interested in assuming sponsorship of the gTLD names that had been managed by EstDomains.”

Bulk Domain RegistrationWith the ICANN interested in “taking all reasonable measures to protect the interests of registrants during the stay period and the subsequent termination process that may follow“, among these very same registrants are the malicious cybercriminals whose portfolios of domains will be basically transferred to another registrar. Moreover, with the increasing number of domain registrars offering bulk domain registration services, cybercriminals could easily damage the reputation of legitimate registrars by simply starting to take advantage of their services.

Disconnected from the Internet at the end of September, Atrivo/Intercage’s marginal thinking approach of being always on the run, yet managing to satisfy the uptime needs of their malicious customers, is similar to what EstDomains rogue customers will be dealing with for months to come - increasing the average online time for their malicious domains with their cybercrime friendly registrar no longer in business.

[Source: zdnet]

Adobe nukes ‘critical’ Pagemaker flaws

Adobe nukes ‘critical’ Pagemaker flawsAdobe has released a patch to fix a pair of critical vulnerabilities in its PageMaker 7 software, warning that a hacker could exploit these flaws to “take control of the affected system.”

A third vulnerability, confirmed by Adobe, remains unpatched, the company acknowledged in an advisory. The flaws affect PageMaker 7.0.1 and PageMaker 7.0.2.

From Adobe’s security bulletin:

  • Critical vulnerabilities has been identified in Adobe PageMaker 7.0.1 and PageMaker 7.0.2 that could allow an attacker who successfully exploits these vulnerabilities to take control of the affected system. Adobe has provided a solution for two of the reported vulnerabilities (CVE-2007-6432, CVE-2007-5394), and is currently investigating potential solutions for a third vulnerability (CVE-2007-6021). It is recommended that users update their installations using the instructions provided above, and avoid opening PageMaker files from untrusted or unknown sources. These issues are not remotely exploitable.

Adobe categorizes this as a critical issue and recommends affected users patch their installations, and avoid opening PageMaker files from untrusted or unknown sources.

Secunia Research, one of the companies credited in Adobe’s bulletin, has released a separate advisory with technical details of the two patched vulnerabilities.

[Source: zdnet]

Google to introduce warnings for potentially hackable sites

Google hackable site warningLast week, Google’s Patrick Chapman and Matt Cutts announced that they’re experimenting with a new security feature aiming to alert webmasters on the potential for having their sites hacked due to the outdated version of their web applications, starting with Wordpress only :

“Recently we’ve seen more websites get hacked because of various security holes. In order to help webmasters with this issue, we plan to run a test that will alert some webmasters if their content management system (CMS) or publishing platform looks like it might have a security hole or be hackable. This is a test, so we’re starting out by alerting five to six thousand webmasters. We will be leaving messages for owners of potentially vulnerable sites in the Google Message Center that we provide as a free service as part of Webmaster Tools.

One of the most popular pieces of software on the web is WordPress, so we’re starting our test with a specific version (2.1.1) that is known to be vulnerable to exploits. If the test goes well, we may expand these messages to include other types of software on the web.”

Whereas the upcoming feature is a great proactive measure, WordPress isn’t necessarily the blogging platform of choice for the majority of cybercriminals and blackhat search engine optimizers looking for efficient ways to acquire traffic. In fact, the current tools and tactics that they take advantage of, attempt to inject their presents onto each and every known to be remotely exploitable web application. This automated approach often building hit lists through search engines reconnaissance, is many steps ahead of Google’s anticipated feature, so if they truly want to slow down the automated reconnaissance process, they could easily start challenging these automated crawlers.

Botnet scanning botWeb application specific attacks are happening, but the applications or blogging platforms’ susceptibility to exploitation as a key success factor was replaced by a “target everyone, everywhere” model, and the results in terms of the hundreds of thousands of sites remaining affected are pretty evident. Today’s threatscape not only empowers lone cybercriminals with the tools necessary to inject malware and redirection scripts on hundreds of thousands of vulnerable sites automatically, but has long reached the stage when publicly released exploits for remotely exploitable web applications are automatically syndicated for real-time hitlist building.

In May, Google introduced the Safe Browsing diagnostic as a reactive response to the increasing number of web sites hosting or redirecting to malware, so the key to providing value to webmasters using the new warnings feature, would be to diversify the list of vulnerable web applications, and perhaps most importantly - emphasize and point out to related tools and services aiming to allow webmasters to self-audit their web sites.

[Source: zdnet]

Inside an affiliate spam program for pharmaceuticals

Affiliate Pharmaceutical ProgramBargaining with your health doesn’t just mean you’re heading for a shorter life expectancy, but also, increases the chances that you will either get scammed in the process, or have to pay more in the long-term while dealing with the health issues arising from using expired pharmaceutical with unverifiable origins, you bargained for at the first place.

Just like vendors of rogue security software and system utilities software contributing to the increase of cybercrime activities due to the high payout rates enticing the affiliate network’s participants to spam, engage in blackhat SEO and SQL inject sites to redirect the visitors to the scam domains, pharmaceutical affiliate programs do exactly the same by allowing spamming, blackhat SEO, botnet traffic through redirects, and due to high amounts of money they make - directly advertise the scam sites on the major search engines.

Affiliate Pharmaceutical ProgramOut of the close to a hundred (100) unique pharmaceutical spam affiliate programs currently operating, let’s find out what is driving the increasing levels of pharmaceutical spam by taking an inside peek at such a program operating since 2003, whose advertisements speak for themselves in terms of revenues - “Around 50 Americans (85% of their sales) purchase pharmaceuticals from their affiliates on an hourly basis“.

Affiliate Pharmaceutical ProgramThe underground ecosystem for pharmaceutical spam is analogical to that of legitimate online shops, since it’s successfully scaling just like they do - through affiliate based programs where the scammers share revenues with the participants who will undertake a great deal of illegal activities while earning high commissions in the process.

It’s also worth pointing out that despite the program’s claims that it doesn’t endorses spam and traffic coming from botnets on its web page, some of the program’s managers have exatly the opposite attitude across multiple forums - they don’t mind. Here’s how the process works :

Affiliate Pharmaceutical Program1. Affiliates will receive an assigned code upon signing up for the affiliate program. That code is used to track all sales to adequately compensate affiliates. The code must be used as provided. Any altering of the code may result in inaccurate tracking and in some cases may constitute fraud. Affiliates are only allowed to use approved advertising banners and materials. Any affiliate wishing to create their own advertising materials must get explicit permission to do so in advance of using any such materials. Not gaining permission to do so may be grounds for termination from the program and forfeiture of any monies due

Affiliate Pharmaceutical Program2. Payouts will be made weekly on Tuesday for the week before previous. I.e., all earnings from monday to sunday of 1st week would be paid on the Tuesday of the 3rd week. The minimum payout is $100. If the minimum is not reached during the pay period, the amount will be rolled over until minimum is made. We pay out by bank wire transfers, WebMoney, and Fethard. The wire cost is $15. Wire is free for payments above $1000

Affiliate Pharmaceutical Program3. Affiliates may not make any unfounded claims about our product, company, website, affiliate program or transactions. Affiliates also may not make any false claims regarding prices

4. Any means of attempting to cheat our program or our customers in any way will result in immediate termination with forfeiture of all monies due. Anyone terminated from our program for non-compliance of our terms will also be unable to participate in any other promotion or affiliate program we own and or operate

Affiliate Pharmaceutical ProgramSo once you’ve been approved as an affiliate and receive your unique tracking code, you’re free to choose the pharmaceutical products, pick up the creative and choose of the many templates for online pharmacy shops, then start driving traffic to them. Some affiliate programs add value to the registration process by introducing ratio calculators in order to make it easier for new participants to calculate their earnings based on the selling price that they choose for the item. Pretty simple, and that’s the problem, since anything required for the participant to drive traffic and monetize it, can be, and is easily outsourced.

Affiliate Pharmaceutical ProgramWhat about the big picture? MarkMonitor’s Summer 2008 Brandjacking Index, covers in-depth the proliferation of pharmaceutical scam sites, and points out that despite the fact that the total number of unique online pharmacies is decreasing, the traffic to the remaining ones triples due to the combination of traffic acquisition tactics applied by the participants of the affiliate programs. Here are some of the key summary points regarding their analysis of the current situation :

  • Of the 2,986 online pharmacies studied, only two are Verified Internet Pharmacy Practice Sites (VIPPS), the industry credential that assures consumers of legitimate online pharmacy operations
  • More than one-third of the online pharmacies in the study generate enough traffic to merit an Alexa ranking. Each of these sites sees an average of 99,000 visitors daily, more than triple the daily visitors noted in 2007. Using industry statistics for traffic conversion and average order sizes, MarkMonitor estimates that this traffic converts to $12 billion in annual sales for the six drug brands studied, an increase from the 2007 estimate of $4 billion
  • Marketers for these pharmacies and sites are becoming increasingly aggressive. MarkMonitor estimates brandjackers spend $26 million annually for search advertising using only those six keywords
  • Representative sampling of pricing for one popular drug brand shows an 85% average price discount at illicit pharmacies when compared to certified pharmacies
  • 64 percent of these 2,986 pharmacies do not secure customer data, putting consumers’ identity information at risk. This number has grown compared to 50 percent last year
  • 49 percent of the 2,986 pharmacies were hosted in the U.S., followed by the U.K., which hosted 12 percent, and Germany, which hosted 9 percent
  • Exchange sites that sell pharmaceuticals in bulk quantities by the pill as well as sell active pharmaceutical ingredients (APIs) risk corrupting the overall drug supply chain. Analysis of just 40 listings on exchange and trade sites shows a $30 million wholesale market for the six brands studied
  • 60 percent of pharmacies identified in 2007 are still operating, and 59 percent of online exchange listings identified in 2007 remain active

Affiliate Pharmaceutical ProgramWith more surveys indicating that users are buying from spammers, just ask yourself the following before purchasing pharmaceuticals in this particular case - how is it possible that the vendor is offering 45% payout rate and up to 85% average price discount compared to legitimate pharmacies? Pretty simple, since you’re never going to receive anything else from them, but a a billing entry on your bank statement :

“Here is an example of one online pharmacy that is labeled as Canadian but hosted in the Russian Federation, according to its IP address. Last year, it listed a Los Angeles area code, but this year the company shows a Texas phone number. We made a purchase from this website and our credit card statement reflects an Israeli merchant account; as of our publication date, the drugs have not been delivered. No matter where its real location is, it continues to display faked credentials, and when you telephone them, a heavily-accented Russian voice invites you to leave a message.”

Affiliate Pharmaceutical ProgramAnd even if you’re lucky enough to receive something, using the prescription drugs obtained without a prescription when shipped from India, might not be such a good idea.

With the ever-decreasing costs of spamming due to the efficiencies achieved by the managed spamming providers, the very few purchases out of the hundreds of thousands of spammed potential customers will remain sufficient revenue in order for spammers to break-even, and profit out of these very few people.

Images (excluding the affiliate program screenshots) courtesy of MarkMonitor, Spamdontbuyit.org and Modern Life.

[Source: zdnet]