MS09-048 Critical Vulnerability with NO PATCH??

Microsoft recently release a Security bulletin (MS09-048 - Critical), announcing on several vulnerabilities in Transmission Control Protocol/Internet Protocol (TCP/IP) processing. These vulnerabilities could allow Denial of Service(DoS) or remote code execution if specially crafted TCP/IP packets were sent over the network to a computer with a listening service.

It have been a very HOT discussion in the Internet. Microsoft vulnerability is nothing new in IT security world. But what makes the commotion is that Windows 2000 SP4 and Windows XP were listed as affected product, but Microsoft was not issuing any updates for them. I had saw some very interesting comments and I think i should share some of those including my own comments. Below are the extract from Microsoft Security bulletin MS09-048.



- Extract from bulletin FAQ -
If Microsoft Windows 2000 Service Pack 4 is listed as an affected product, why is Microsoft not issuing an update for it?
The architecture to properly support TCP/IP protection does not exist on Microsoft Windows 2000 systems, making it infeasible to build the fix for Microsoft Windows 2000 Service Pack 4 to eliminate the vulnerability. To do so would require rearchitecting a very significant amount of the Microsoft Windows 2000 Service Pack 4 operating system, not just the affected component. The product of such a rearchitecture effort would be sufficiently incompatible with Microsoft Windows 2000 Service Pack 4 that there would be no assurance that applications designed to run on Microsoft Windows 2000 Service Pack 4 would continue to operate on the updated system. The impact of a denial of service attack is that a system would become unresponsive due to memory consumption. However, a successful attack requires a sustained flood of specially crafted TCP packets, and the system will recover once the flood ceases. Microsoft recommends that customers running Microsoft Windows 2000 Service Pack 4 use a firewall to block access to the affected ports and limit the attack surface from untrusted networks.

If Windows XP is listed as an affected product, why is Microsoft not issuing an update for it?
By default, Windows XP Service Pack 2, Windows XP Service Pack 3, and Windows XP Professional x64 Edition Service Pack 2 do not have a listening service configured in the client firewall and are therefore not affected by this vulnerability. Windows XP Service Pack 2 and later operating systems include a stateful host firewall that provides protection for computers against incoming traffic from the Internet or from neighboring network devices on a private network. The impact of a denial of service attack is that a system would become unresponsive due to memory consumption. However, a successful attack requires a sustained flood of specially crafted TCP packets, and the system will recover once the flood ceases. This makes the severity rating Low for Windows XP. Windows XP is not affected by CVE-2009-1925. Customers running Windows XP are at reduced risk, and Microsoft recommends they use the firewall included with the operating system, or a network firewall, to block access to the affected ports and limit the attack surface from untrusted networks.

Does this update completely remove the vulnerabilities, TCP/IP Zero Window Size Vulnerability - CVE-2008-4609 and TCP/IP Orphaned Connections Vulnerability - CVE-2009-1926?
Since the denial of service vulnerabilities, CVE-2008-4609 and CVE-2009-1926, affect the TCP/IP protocol itself, the updates for Windows Server 2003 and Windows Server 2008 do not completely remove the vulnerabilities; the updates merely provide more resilience to sustain operations during a flooding attack. Also, these denial of service vulnerabilities can be further mitigated through the use of NAT and reverse proxy servers, further lowering the severity of this issue on client workstations.
- End of Extract -

From the bulletin, they are saying that it is "technically infeasible" to build a fix for Windows 2000. It also mention that they did not patch XP because the client firewall (by default) mitigated the problem (if no ports is listening). It is not because XP is not vulnerable. As XP's TCP/IP stack uses the same underlying code as Windows 2000. It seems too hard for them to fix XP too.

Some Microsoft fans may rebutted that ALL should be upgraded to Windows 2003 or 2008. But the updates do not really fixed the issue, "the updates for Windows Server 2003 and Windows Server 2008 do not completely remove the vulnerabilities; the updates merely provide more resilience to sustain operations during a flooding attack". So they still do not fixed the issue, right?

There was also a statement that i find it comical:
- "The impact of a denial of service attack is that a system would become unresponsive due to memory consumption. However, a successful attack requires a sustained flood of specially crafted TCP packets, and the system will recover once the flood ceases".
For DoS, isn't the system always "become unresponsive" and most of the time always recover once the flood ceases , isn't it?

Customers should start looking into their support maintenance contract. Start thinking and asking on refund or cost incurred (on additional protection for vulnerable systems) from your software vendor when no patch was created according to the support contract. Also think of the possible cost and damages on your company in the event of a breach or exploit of these unpatched vulnerabilities occurs.

Nessus had released a plugin to detect this vulnerabilities.

Fake Antivirus... Beware!

Receive a suspicious file last week and did a simple behaviour analysis. It is a fake antivirus program that will claim to "scan" and "detect" several virus in your system. It will trick the user to purchase the full license by having various spyware and virus pop ups.

Major AV vendor such as McAfee, Symantec, TrendMicro were not able to detect it.

For more details on my findings, visit W01f Labs - Malware Analysis: Antivirus System PRO

How to increase your Virtual Machine's Disk Size

Have been working on Virtual machines for my malware reaserch. Normally will create a 3.8GB image (for portablility in flashdrive). But recently face the problem of VM image running out of diskspace.

At first, i thought it is not possible to increase the VM disk size. Only way is to recreate a bigger image. But after some googling and testing, i manage to increase my VM disk size without recreating a new image.

Steps to increase VM disk size:
I have a 3.8GB VM image, the following steps will show how to increase it to 6GB.


1> To increase the VM disk size,
- Move to VMware directory. e.g "C:\Program Files\VMware\VMware Workstation"
- Use the command "vmware-vdiskmanager -x". e.g "vmware-vdiskmanager -x 6GB G:\myDisk.vmdk" (refer to picture above)
- The additional space created will be unallocated space in your VM image. To merge it into the exisitng partition, you can use "diskpart" (as shown in step 7 and 8).

Note: The "vmware-vdiskmanager" command only works on disk with no snapshots. The "diskpart" command will not be able to merge a system partition, you will need to mount it and boot up from another VM image.


2> To mount your "increased" VM image(VM1) to another image (VM2)
- Select "Edit Virtual Machine Settings" from VM2.
- Select "Hard Disk" and Click "Add".


3> Select the Hardware type
- Under "Hardware type", select "Hard Disk" and click "Next".


4> Select what type of disk to be used for the drive
- Under "Select a Disk", select "Use an existing virtual disk" and click "Next".


5> Select the location of the existing virtual disk
- Select the location (path) of VM1 .vmdk file by clicking the "Browse...".
- Click "Finish". The VM image (VM1) is mounted into VM2
- Startup VM2 image


6> Check that VM1 successfully mounted into VM2
- Under "Control Panel" > "Admintrative tools" > "Computer Management" > "Disk Management".
- You should see VM1 mounted as one of the virtual disk (with both allocated and unallocated space). In the picture above, it is mounted as Disk 1.


7> Using command line utility to resize disk partitions in Windows.
- From "Start" button, select "Run".
- Type "diskpart" to run the commandline utility.


8> Merge the unallocated space with diskpart
- Type "list volume" to list all the disk volume.
- Based on the drive letter and the vloume size, choose the volume to merge by typing "Select volume "
- Type "extend" to merge the unallocated space with the selected volume.


9> Check if the partition successfully extended
- If the merging is successful, you will see the unallocated space gone and the partition being extended to 6GB in the "Disk Management" console.
- You can shutdown the VM2 and remove VM1 from as the mounted disk.
- To remove VM1 from the mounted disk, follow step 2. Instead of adding, select the VM1 disk and Click "Remove".

Download Limits in Internet Explorer

Recently, i heard an old question: "Why can only download 2 files at a time" again. This question was commonly asked during the times where most people were using dial-up and bandwidth were limited. I decided to blog this down as reference for those who might ask me again in future.

This download limitation only occurs in IE (Internet Explorer). But why does IE behave this way while some other Internet browsers don't?

This is because IE comply to the Internet standard (RFC2616). According to the RFC, Not more than 2 simultaneous connections should be maintain.

"Clients that use persistent connections SHOULD limit the number of simultaneous connections that they maintain to a given server. A single-user client SHOULD NOT maintain more than 2 connections with any server or proxy."

However, you can still bypass this restriction in IE by changing the registry setting. To increase the number of simultaneous connections follow these steps:

1) Run Registry Editor (Click on Start > Run, type "Regedit" and press OK)

2) Go to "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Internet Settings"

3) Select New > DWORD Value from the Edit menu

4) Name the new value "MaxConnectionsPer1_0Server"

5) Right-click the MaxConnectionsPer1_0Server value and choose Modify

6) Under Base, click the radio button next to "Decimal"

7) In the Value Data, enter the number of simultaneous connections you want to set (e.g. 10), and click OK

8) Repeat steps 3 - 7 using the new value MaxConnectionsPerServer

9) Exit the registry editor

Please note that changing this setting violates RFC standards. Use at your own risk!

Related Articles:
- Microsoft Help and Support: WinInet limits connections per server

- RFC2616 - Hypertext Transfer Protocol -- HTTP/1.1

Can i "undelete" my files?

Recently i did a simple survey among my friends, asking them whether files/data deleted from the computer can be recovered? Most of them (including non-IT profession) knows that it is possible to recover deleted data. They claim that they got to know about it from the "Edison" incident.

But there are still one or two of them unaware that deleted data may still be recoverable (including a IT application analyst with many years of working experience). So i decided to write this post to share some of my knowledge on "file deletion/recovery" (known as Data remanence).

Most Computer system (Operating System, e.g Windows) do not actually remove the contents of a file when it is deleted. Instead, they simply remove the file's entry from the file system directory. The data of the file remains on the storage medium (harddisk, flashdrive, floppy or etc). The data will remain there until the operating system reuses the space for new data. Nowadays with very large harddisk in our system, the space may not even reuse.

Several questions were asked by them during the survey such as "How can we recover those deleted files ?", "Any recommended free tools ?" and "Any ways to delete the files permenantly ?". So below were my answers to those questions.

File Recovery Tools
There are many file recovery tools available in the Internet, some are free and others require license ($$$). I have found 2 Windows-based "freeware" tools (PC Inspector File Recovery and Recuva) to share with you all. PC Inspector File Recovery have better features and personally recommended for IT users, whereas Recuva will be more simple and user friendly.

CONVAR PC Inspector™ File Recovery 4.x - a data recovery program that supports the FAT 12/16/32 and NTFS file systems. Some "special" features -
> Finds partitions automatically, even if the boot sector or FAT has been erased or damaged
> Recovers files with the original time and date stamp
> Supports the saving of recovered files on network drives
> Recovers files, even when a header entry is no longer available

Piriform Recuva - a Windows utility to restore files that have been accidentally deleted from your computer. This includes files emptied from the Recycle bin as well as images and other files that have been deleted by user error from digital camera memory cards or MP3 players. It will even bring back files that have been deleted by bugs, crashes and viruses!

Secure Deletion
To permenantly delete your data/files, you will need to do secure deletion (or data sanitization). I have talk about this in my previous posting "What is data sanitization? - on April 6 2008". Please refer to this posting to learn more about secure deletion and the tools that i recommended.

Related Posts:
- Edison Chan Sex Scandal. Lesson to be learned! - on February 17, 2008
- What is data sanitization? - on April 6 2008

Windows Account Cracking

Last week, someone had problem logging into his Windows 2003. So needed a Windows account cracking tools. So i am thinking of sharing some of my knowledge in Windows account cracking. The passwords in Windows systems are hash and stored in SAM (Security Account Manager). Only 14 characters of the password are used for the hashing. The password is split into 2 (with 8 characters each) and hash seperately.

For account cracking tool, it normally uses either Brute-force/Dictionary, Rainbow table or replace the password hash in the SAM file.

For Brute-force method, it will try every possiblilites. But with long and complex password being used these days, this method will not be practical. A 8-characters complex password (mixed case with number or symbols) will have 7.2 Quadrillion (thousand million million)combinations will need 2 1/4 years to crack using current dual-processor PC. (Password Recovery Speed)

For Rainbow table method, which uses time-memory tradeoff technique, is by doing all cracking time computation in advance and store the result in files so called “rainbow table”. It is trading speed for memory and diskspace. The table can be very large if the table is more comprehensive. If you have a correct table, a complex password can be cracked in a few minutes rather than months to years with brute-force.

OPHCRACK - The "famous" Windows password cracker based on rainbow table. It comes with "LiveCD" that can be bootup and automatically crack the password.

The other ways to crack the password is to replace the hash in the SAM file. This method will need to bootup with another OS to dump the SAM file for modification. The username and the password hash are located, and be replaced with the hash of the password of your choice.

Offline NT Password & Registry Editor - My recommendated Windows password cracking tools that "reset" the password. This tool is bootable from a floppy or CD. It require the system to boot up from the tool to do the password "reset".

Related sites:
-Password Recovery Speed
http://www.lockdown.co.uk/?pg=combi

-Ophcrack
http://ophcrack.sourceforge.net/

-Offline NT Password & Registry Editor
http://home.eunet.no/~pnordahl/ntpasswd/