4 X Security Team

This weekend marks the 20th anniversary of the Internet Worm, the first major worm that propagated on the Internet. Even though many years have passed and underlying media has changed, worms are still able to wreak havoc and keep system administrators up at night. Today the damage done by worms is far less visible and far less newsworthy but far more difficult to repair than in the past.

On November 2nd, 1988, Robert Tappan Morris launched an application ostensibly designed to count the number of systems on the Internet. It was designed to propagate across Unix systems by exploiting several vulnerabilities, including a conceptual flaw in how r-services (rlogin, rsh, and rexec) authenticate connections, the archaic remote debug feature in Sendmail, and a buffer overflow in the finger daemon. Due to a flaw in it’s design, the Worm attempted far more propagation attempts than were necessary, causing targeted machines to slow dramatically from resource starvation. Long story short, the then Mr. Morris was caught, found guilty, and sentenced to probation and community service.

Many years of highly visible worms followed. Who could forget such classic hits as Melissa and I Love You, viruses that attacked software that is standard on Windows PCs, as well as Code Red and SQL Slammer for their Windows Server brethren. These worms were created just for the sole fact that they could be created. Their existence served no purpose but to exist. The damage done by the load they created on networks and systems made headlines not just on technical forums but in real newspapers.

Today’s worms, however, feel no need to make themselves known, and their authors don’t want to be visible. The authors want the worms to do one thing only, and that is make money. Modern worm authors will use any underlying transport mechanism that is available, eschewing operating system and programming language religious barriers maintained by more orthodox hackers. They propagate using systems like Facebook messages for lures, redirecting users through legitimate sites such as Google until finally they reach a piece of malware that claims to be a video, with the final goal being the infection of another desktop and restarting the infection process again. Even when the messages have been cleaned up from the servers, tens of thousands of desktop systems are left compromised and transmitting keystroke logs and credit card numbers captured from the unsuspecting user.

Two decades ago, we experienced a rare contagion that left us with thousands of servers compromised and experienced system administrators burning overtime to remediate the situation in what became a historical event. Today, we see frequent contagions that leave us with millions of compromised desktops and home users who are completely unprepared to fix the situation, costing us a fortune in losses due to electronic financial fraud, and it happens so frequently that it is no longer newsworthy. As a result, the average user feels safer because the headlines have gone away without realizing they are in far worse shape from a financial risk perspective than before.

One last topic I want to mention. The criminal justice system could have thrown the book at Robert Tappan Morris 20 years ago, and it chose not to. Mr. Morris went on to become Dr. Morris, Professor at MIT and co-founder of Y-Combinator, a venture incubator that helps ignite promising startups. While not all individuals who come before the courts have the capacity to achieve that level of success, it would be wrong to think that every teenager and college student who ends up in Mr. Morris’s situation is irredeemable and should not be allowed to contribute to society. Who knows what the future may hold for both the individual and technology at large once these kids are directed a better path.

[Source: zdnet]

With the exact number of end users interacting with phishing emails by submitting bogus data still unknown, phishers are on the other hand continuing to apply basic quality assurance processes ensuring that they will be collecting only validated credit card details, and limiting the opportunity for researchers and end users to poison their campaigns.

For instance, a recent blog post at Symantec’s Security Response blog analyzes a phishing page where the fraudster is applying credit card validation checks before accepting anything, an approach that in times when phishers are attempting to scam other phishers, can easily turn into a commodity feature for phishing pages in general — even the backdoored ones.

“Fraudsters are aware of these techniques and are continuously trying to optimize their attacks and thus their profits. As a proof of concept, shown below is a piece of PHP code revealed from a phishing attack that is intended to check the validity of the credit card number provided by the user according to card number conventions. After performing this check, the fraudster tries validating the card number by using the Luhn algorithm (figure 2). If both conditions are met (the card number appears to be correct and the Luhn algorithm is verified) the information is delivered to the drop box. This approach makes the Random Data Dilution strategy described above useless, because invalid data won’t be accepted. The piece of code in figure 3 (below) shows one of these tricks, which checks to see if the credentials provided by the user are indeed valid. It has been implemented by submitting the credentials to the original website and then identifying specific patterns in the response page in order to verify their validity.”

The phishers in this particular case are capable of achieving the validation by forwarding the submitted data to the original site, potentially exposing their campaigns in the process, if only was the targeted company properly monitoring where traffic is coming from. Phishers tend to switch tactics or introduce new ones on a quarterly basis, and with EstDomains about to face the music, yesterday Sophos already started detecting phishing campaigns targeting exclusively domain registrants by impersonating eNom and Network Solutions. Despite the potential for abuse of legitimate domains once the domain portfolio owner falls victim into the phishing scam, data mining malware infected hosts for domain registrant’s accounting data seems to be the tactic of choice on a large scale, at least for the time being.

Poisoning a phishing campaign by submitting bogus data or personal messages to the phisher isn’t the way. If you truly want to express your feelings about a phisher - report their campaigns.

Image courtesy of the Anti-Phishing Phil.

[Source: zdnet]

Guest editorial by Aviv Raff

If you ask any Opera fanboy, he will tell you that Opera is the most secured browser. Well frankly, it really is a good and secure browser, implementing many restrictions that other browsers simply ignore.

For example, while other browsers allow scripts running from local resources to access local files Opera doesn’t. And by that, it is almost impossible to steal local files, or execute code by exploiting vulnerabilities local resources.

You probably noticed that I used the word almost. It is almost impossible, due to the fact that one, and only one local resource, does allow you to access local files and other browser settings. The local resource is opera:config.

[ SEE: On Opera patch day, a new zero-day flaw ]

One of the many settings this local resource can be used to change is the mail external application. The mail external application will be opened whenever you click on a “mailto:” link, or whenever your browser redirects to a “mailto:” URL. If an attacker can change this setting it means that he can automatically execute arbitrary code on the user’s machine from remote.

This is of course irrelevant, unless you can actually change the settings automatically from remote, and unfortunately for Opera users, there was a way.

Today, Opera released a new version, 9.62, with a fix for a vulnerability in a different local resource - the “History Search” page (opera:historysearch). The problem was that Opera did not sanitize specific parameters correctly, and an arbitrary script could be injected to this page. An attacker could then execute a script that will create an iframe which will open the opera:config local resource. And then, it will call a script within the opera:config page, which will change the settings and execute arbitrary code on the user’s machine as previously explained.

[ SEE: Opera bitten by ‘extremely severe’ browser bug ]

The vulnerability in the “History Search” page was found by Stefano Di Paola, during our discussion on the full-disclosure mailing about an older vulnerability in the “History Page” that was found by Roberto Suggi and was fixed by Opera in version 9.61. I’ve created proof-of-concept codes which demonstrate the vulnerabilities. Both can be found on milw0rm.com.

While both vulnerabilities in the “History Page” are now fixed, the core problem which makes it possible to execute code from remote, still isn’t.

There is still no Same Origin Policy restriction between local resources in Opera. It is still possible for a script to access one local resource (e.g. opera:cache) from another (e.g. opera:config). In my submission to Opera I’ve asked them to fix this issue as well, and I really hope they will do so before other vulnerabilities will be found in more local resources.

Nevertheless, my recommendation for Opera users is still to upgrade to the latest version.

* Aviv Raff manages a security research team for a Fortune 500 company. You can read about his research at his blog or follow his daily activities on Twitter.

[Source: zdnet]

My colleague at Kaspersky Lab Roel Schouwenberg (see disclosure) has written a very interesting piece on the banker malware landscape, warning that attacks against financial institutions will get much more targeted and sophisticated.

Schouwenberg’s Attacks on Banks paper takes a close look at how malicious programs targeting financial institutions are designed to evade anti-malware and examines how phishing and money mules serve as the hub for global identity theft attacks.

Some important highlights:

• More sophisticated banker malware will use a MitM [man-in-the-middle] attack; this not only enables cyber criminals to attack more banks, but also ensures a higher return, as data is processed in real time. A MitM attack uses a malicious server to intercept all traffic between the client and the server i.e. the customer and the financial organization. Although everything will seem normal to the user, when s/he is asked to authorize a transaction, s/he is actually authorizing a transaction created by the cyber criminal. Malware which uses a MiTM attack typically either hides browser notifications about false web site certificates or, more commonly, shows a fake notification.
• With cyber criminals remaining eager to maximise their returns and remain at liberty, they have been examining other ways of conducting attacks. Thus, we are now seeing an increase in so-called next generation financial malware - Man-in-the-Endpoint (MitE).
• The increased usage of two-factor authentication by financial organizations has resulted in an increase in malware capable of defeating this type of authentication. This means that the eventual adoption of two-factor authentication will not have any significant long-term effect. It will simply raise the benchmark for financial malware.

Read the full report here.
* Image source: The akaalias Flickr photostream (Creative Commons 2.0)

[Source: zdnet]

(See update below for statement from Yahoo).

Malicious hackers are exploiting a cross-site scripting flaw on Yahoo’s HotJobs site to phish for Yahoo credentials, according to a warning from Netcraft.

In the ongoing attack, Netcraft discovered that the vulnerability allows the attacker to inject obfuscated JavaScript into the affected page to steal authentication cookies that are sent for the yahoo.com domain.

The stolen authentication cookies are then passed to a different web site in the United States, where the attacker is harvesting stolen authentication details.

• Simply visiting the malign URLs on yahoo.com can be enough for a victim to fall prey to the attacker, letting him steal the necessary session cookies to gain access to the victim’s email — the victim does not even have to type in their username and password for the attacker to do this. Both attacks send the victim to a blank webpage, leaving them unlikely to realise that their own account has just been compromised.

Netcraft said it notified Yahoo of the latest attack but warned that the HotJobs vulnerability and the attacker’s cookie harvesting script are both still present at the vulnerable site.

UPDATE: Yahoo e-mailed the following in response to this story:

The team was made aware of this particular Cross-Site Scripting issue yesterday morning (Sunday, Oct. 26) and a fix was deployed within a matter of hours. Yahoo! appreciates Netcraft’s assistance in identifying this issue.

As a safety precaution, we recommend users change their passwords, should they still be concerned. Users should always verify via their Sign-in Seal that they are giving their passwords to Yahoo.com.

[Source: zdnet]

The Facebook worm that has been squirming its way through the popular social network now has a new friend — Google Reader.

According to researchers at Fortinet, the worm’s creators are wrapping Google’s RSS reader around fake video downloads as part of a strategy to strengthen the social engineering component of the attack. From Fortinet’s advisory:

• This “hop” via a Google Reader share serves an essential purpose: it gives the targeted user the feeling that the video is hosted on Google. Thus it must be safe. Combo that with the “it’s a message from a friend” factor, which naturally lowers down users’ wariness shields, and you get quite a good chance of seeing your victim perform the dreaded click.

[ SEE: Web worms squirm through Facebook, MySpace ]

Fortinet researcher Guillaume Lovet believes the cyber-criminals behind the Facebook worms registered Google Reader accounts (either manually, or automatically via phishing operations or automated CAPTCHA solvers) for the sole purpose of loading them with links to malicious sites.

Fake video lures are used to infect Windows machines with rogue security software.

Image source: Jacob Botter’s Flickr photostream (Creative Commons 2.0)

[Source: zdnet]

Reliable exploit code for the remote code execution vulnerability patched with Microsoft’s MS08-067 update has been posted to the Internet, prompting a new “patch immediately” advisory from the Redmond software maker.

The exploit, which has been added to the freely available Metasploit point-and-click attack tool, provides a roadmap for code execution on Windows 2000, Windows XP, and Windows Server 2003. A second exploit has been posted to Milw0rm.com, increasing the likelihood of in-the-wild malware attacks.

[ SEE: MS ships emergency patch for Windows worm hole ]

From the Microsoft advisory:

• Our investigation of this exploit code has verified that it does not affect customers who have installed the updates detailed in MS08-067 on their computers. Microsoft continues to recommend that customers apply the updates to the affected products by enabling the Automatic Updates feature in Windows.

Several proof-of-concepts have also been publicly released.

Microsoft shipped an out-of-band update last week to plug the hole after discovering “limited, targeted attacks” against Windows users. The attacks included the use of reconnaissance Trojans hijacking sensitive system information.

The vulnerability is due to the Windows Server service not properly handling specially crafted RPC requests. The vulnerable Windows Server service provides RPC support, file and print support, and named pipe sharing over the network. It is also used to allow the sharing of your local resources (such as disks and printers) so that other users on the network can access them.

[Source: zdnet]