Archive for month: June, 2013

You are here: / / June

A World of Vulnerabilities – InfoSec Institute

An article by Pierluigi Paganini:

Introduction

Every day, we read about cyber-attacks and data breaches, incidents that represent in many cases a disaster for private companies and governments. Technology plays a significant role in our lives; every component that surrounds us runs a piece of software that could be affected by flaws and exploited by those with ill intentions.

Of course, the impact of these vulnerabilities depends on the nature and scope of the exposed software. Some applications are more commonly used, and their vulnerabilities could expose users to serious risks. Take for example the recent vulnerability discovered in Skype, in which a bug allowed an attacker to obtain full access to any Skype account by simply knowing the email address used by a victim during the creation of the account.

The possible damage that the exploit of a vulnerability could do depends on different factors such as the level of diffusion of the application compromised, the previous knowledge of the vulnerabilities, and the context in which the compromised application is used.

Zero-day vulnerabilities

In the wide universe of vulnerabilities, zero-day vulnerabilities represent a real nightmare for security experts. Knowledge of any leak about them makes it impossible to predict how and when they could be exploited. This characteristic makes their use ideal in state-sponsored attacks and in the development of cyber weapons.

Interest in the discovery of unknown vulnerabilities for a widespread application has totally changed the role of hackers. In the past, they were figures who kept away from government affairs; today, the industry and even intelligence agencies have launched a massive recruitment campaign for this new type of expertise.

Profiting from these vulnerabilities can be done through different channels: flaws could be sold to the makers of the compromised application; a government interested in exploiting a flaw could acquire it to conduct cyber-attacks against hostile countries; or it could be sold in the underground market.

Around this concept of vulnerability grew a market in which “instantaneity” of any transactions is a fundamental factor. Once a new bug is found and exploited, the researcher must be to quickly identify possible buyers, contact them to negotiate a price, and then complete the sale. Timing is crucial; the value of the sale could decay to zero if any third party preemptively divulges information on the vulnerability.

Read more at the InfoSec Institue’s Blog

Was Microsoft’s takedown of Citadel effective?

A posting from Naked Security:

As we mentioned last week, Microsoft recently fought back against more than 1,400 Citadel botnets by sinkholing their Command and Control (C&C) infrastructure.

SophosLabs has been monitoring Citadel for some time, including individual botnets such as those targeting Canadian institutions, so I decided to take a closer look at the impact of the takedown.

I took a snapshot of the active Citadel botnets we are currently seeing and cross referenced 72 C&C servers with the list published by Microsoft.

Then, I verified where the DNS records of those servers were now pointing.

Worryingly, I found that 51% of the 72 domains analysed did not appear in Microsoft’s published list.

A more worrying 20% of the Citadel domains were on Microsoft’s list but were not ending up at the sinkhole.

This implies either that the sinkholing was unsuccessful or that the domains have already been re-appropriated by the Citadel botnet owners.

Furthermore, as described by Swiss researchers at abuse.ch, Microsoft has caused the same sort of collateral damage as in its last Zeus botnet takedown.

 

To read more click here:

Black Hat USA 2013 Showcases NAND, Windows 8 Secure Boot Hacking Talks

A posting from Dark Reading in there Authentication Section: As July’s Black Hat US in Las Vegas nears, organizers have confirmed another trio of highlighted Briefings from the show, which all focus, in some way or other, on getting under the skin of key systems. Here’s the official rundown:

– Technologies don’t get much more ubiquitous than NAND memory, which is used in just about every gadget going. But ubiquity rarely equals safety, as Josh “m0nk” Thomas will demonstrate in “Hiding @ Depth: Exploring, Subverting, and Breaking NAND Flash Memory.” Thomas will show how NAND hardware can be subverted to hide persisting files, opening the door to everything from basic malwares to full-on device bricking. He’ll release two open-source Android tools to both hide and reveal these hidden files, and explore the security implications of NAND’s striking vulnerabilities. Think there’s an easy fix? Unlikely. Come to the session for the full appraisal.

— Windows 8’s Secure Boot, based on UEFI 2.3.1’s Secure Boot, marks a needed, long-in-coming step toward securing boot sequences against malware. But as ever, the devil is in the minute details, and it turns out that platform vendors are making certain mistakes that can completely undermine Secure Boot’s intended protections. Join Intel’s Yuriy Bulygin for “A Tale of One Software Bypass of Windows 8 Secure Boot,” in which he’ll demo a full software bypass of Windows 8 Secure Boot and explain how these breaches could HAve been avoided had the hardware vendors done things differently.

To read more click here: 

Bad SSH Key Management Leaves Databases At Risk

A posting from Dark reading in there Database Security Section:

A “gaping hole” in the way enterprises govern the use of one of IT’s least sexy but most used access control and encryption protocols is leaving many sensitive database servers and other network devices at serious risk.

Secure Shell (SSH)–a Swiss army knife in the arsenal of many an IT department–is best known for aiding in the creation of encrypted tunnels to secure remote access and file transfers, but has gradually gained even more acceptance as a way to secure machine-to-machine connections to help enterprises move large amounts of valuable and sensitive data.

But experts say that enterprises do such a poor job managing the public/private key pairs upon which the protocol depends that they’re putting many of their most sensitive data assets at risk, including database servers that use SSH to connect with applications that tap into them.

According to Charles Kolodgy, analyst for IDC, at most enterprises the internal means by which organizations manage their SSH keys are “often clumsy and decentralized.” What’s more, when organizations do take steps to secure use of keys by central access by only a few privileged administrators, they often don’t monitor those privileged insiders for policy violations, creation of rogue keys or other suspicious behavior that could put the security of SSH communications in jeopardy.

 

To real more click here: 

‘Activation lock’ to tighten iOS security

A posting from Cnet News in there Security and Privacy section; Apple may not be able to do anything to stop a mugger from stealing your iPhone, but changes in iOS 7 will prevent the thief from trying to sell the phone as new.

At its Worldwide Developers Conference here on Monday, Apple unveiled several security enhancements. Activation Lock is the most interesting. Though the company didn’t go deep into detail on the new feature, Apple’s head of Mac software engineering, Craig Federighi, said the feature prevents unauthorized resetting of an iPhone or iPad.

Basically, if the Find My Phone tracking utility has been deactivated, or if the phone has been wiped, the thief will have to know the owner’s Apple ID and password before the device will work again.

To read more click here: 

Microsoft announces five Bulletins for Patch Tuesday, including Office for Mac

A posting  from Naked Security:

Midsummer Patch Tuesday (or midwinter, depending on your latitude) takes place on Tuesday 11 June 2013.

As you probably already know, Microsoft publishes an official Advance Notification each month to give you early warning of what’s coming.

These early notifications generally don’t give any details, summarising only the basics, such as:

  • The number of Bulletins (read: security patches) you’ll get.
  • The severity levels (read: urgency) of the patches.
  • The products or components being fixed.
  • Whether a reboot is required.

And June’s answers, as briefly as possible, are:

  • Five.
  • One critical and four important.
  • Windows and Office.
  • Yes.

So it sounds on the surface like a light month, with only two remote code execution (RCE) vulnerabilies to worry about.

To read more click here: 

 

 

Facebook forensics? What the feds can learn from your digital crumbs

An  interesting article In NBC News in there Technology section:

Bits of you are all over the Internet. If you’ve signed into Google and searched, saved a file in your Dropbox folder, made a phone call using Skype, or just woken up in the morning and checked your email, you’re leaving a trail of digital crumbs. People who have access to this information — companies powering your emails and Web searches, advertisers who are strategically directing ads at you — can build a picture of who you are, what you like, and what you will probably do next. Revelations about government counter-terrorism programs such as PRISM indicate that federal agents and other operatives may use this data, too.

“Google knows what kinds of porn everyone in the world likes,” Bruce Schneier, a security and cryptography expert told NBC News. Not only are companies tracking what you are doing, they are correlating it, he said.

To read more click here: 

12 Endpoint Security Myths Dispelled

A posting from Dark Reading in there Endpoint  Security  section:

It’s been years now since the security pundits have taken up the mantle to dispel the myth that AV alone is enough to protect the typical endpoint. And while that misconception does hang on in certain quarters, to a large degree it has been discussed ad nauseum. And that’s too bad, because there are plenty of other misapprehensions and delusions out there about endpoint security that are ignored in the process.

Dark Reading recently talked to a spate of security experts to get them to weigh in on some of the other myths that get in the way of smart endpoint protection strategies. Here is the dirty dozen.

 

TO read more click here:

New proof-of-concept malware demonstrates virus for OS X

A posting from Cnet  News in there Security and Privacy Section:

Security researchers have found a proof-of-concept attack that appears to be the first true viral malware approach for compromising OS X.

The malware is called “Clampzok.A” and is a cross-platform malware package that alters the binary files on an affected system so when executed, the binary will infect neighboring binary files.

The malware is written in assembly code, and was originally released in 2006 for Windows and Linux systems, but was recently updated to affect 32-bit Mach-O binary files in OS X machines.

Unlike Trojan horses, spyware, and adware that hide in one location on the system and persistently run to steal information or otherwise be a nuisance, viral malware attempts to spread itself around the system. Of these, a form known as a worm will try to replicate itself, but does not infect otherwise healthy files. The classic virus, by contrast, will inject itself into the compiled code of an executable or into the structure of a file, modifying it significantly so that when the file is read, the virus is executed and further injects itself around the system, wreaking havoc on the system’s ability to function.

This latest malware shows promise to do just that.

To Read more click here: