Hacking of LG handphone

Check Point disclosed today two vulnerabilities (CVE-2016-3117, CVE-2016-2035) which can be used to elevate privileges on LG mobile devices to attack them remotely at the LayerOne 2016 conference in Los Angeles.

The first vulnerability allows a malicious app installed on an LG device to abuse the lack of bind permissions in an LG service and to elevate its privileges, allowing additional control of the device.
The second vulnerability allows a remote attacker to delete or modify SMS messages received on a device. Attacker could use it to conduct credential theft or to fool a user into installing a malicious app. The attacker could modify a user’s unread SMS messages and add a malicious URL to redirect the user to download a malicious app or to a fake overlay to steal credentials.

Steps to mitigate the risk of this attack:
- Verify any app installation request before accepting it to make sure it is legitimate.
- Use a personal mobile security solution that monitors your device for any malicious behavior.

- Lookout for LG latest update on these vulnerabilities and patch it immediately

Below is the video demo of the remote attack.

For more details of these vulnerabilities, visit "OEMs Have Flaws Too: Exposing Two New LG Vulnerabilities"
http://blog.checkpoint.com/2016/05/29/oems-have-flaws-too-exposing-two-new-lg-vulnerabilities/ 

Misfortune Cookies Vulnerability

As everybody was focusing on the Sony hacking incident, there was a vulnerability that is affecting over 12 million Internet routers located in 189 countries across the globe been announced. At least over 200 different models of the devices are vulnerable. These lists of vulnerable devices consist of companies such as ASUS, D-Link, Edimax, Huawei, TP-Link, ZTE, and ZyXEL.

This vulnerability, which is discovered by the researchers from Check Point’s Malware and Vulnerability Research Group, called it "Misfortune Cookie vulnerability". It is exploitable due to an error within the HTTP cookie management mechanism in the affected software. It allows an attacker to determine the ‘fortune’ (critical information) of a request by manipulating cookies. Attackers can then send specially crafted HTTP cookies that exploit the vulnerability to corrupt memory and alter the application state, which will trick the device’s web server to treat the current session with administrative privileges.

The actual vulnerability lies on the software that is the embedded web server RomPager from AllegroSoft. Devices running RomPager services with versions before 4.34 are vulnerable.

So what can you do with the exploit of this vulnerability? With administrative access to your device, an attacker could take control over your wired and/or wireless network infrastructure. Depending on your gateway device, there may be risk of Man-in-The-Middle attacks, provide a possible attack vector for LAN-side vulnerabilities, and also gave the attacker the ability to extract useful information from the network connections from your devices.

With information extracted from your network, it also provide the stage for further attacks, such as installing malware on devices and making permanent configuration changes the bypassing gateway protection just as firewall or network isolation of your local network.

Since this is one of the most widespread vulnerabilities revealed in recent years, how can we mitigate it? There is actually a patch to the vulnerable software. AllegroSoft issued a fixed version to address this “Misfortune Cookie vulnerability” in 2005. It is advice to check with the device vendor if the patched firmware is already available.

But there is always this common issue of device vendors taking too long to patch up their firmware. Even if the patch of the vulnerable software available, they need to integrate this patch into their device firmware, test to make sure nothing breaks and then make it available which normally takes a long time.

Other mitigation that can be considered will be to deploy Intrusion Prevention Systems (IPS) in front of your device. There are IPS signatures available for this vulnerability (CVE-2014-9222 and CVE-2014-9223). 

Reference:
Misfortune Cookie

IPv6 InSecurity. Is your company ready for IPv6?

Everybody is announcing that IPv4 addresses are running out. Countries and major IT companies (such as Google) are encouraging others to move into IPv6. IPv6 have always been portrayed to be more secured than IPv4.

Image from Google

But in the recent talk by van Hauser on "IPv6 Insecurity" in HITB, he share that there are huge grow in the number of vulnerabilities found related to IPv6 in recent years. Several times more than IPv4.

So is IPv6 mature/stable enough? Do you think companies are ready for the change to IPv6? Should we be encouraging our companies to make the change now? These are the questions that I think we need to ask ourselves as a security professional.

Beside worrying about the readiness of IPv6, van Hauser also highlighted the importance for companies (even those in pure IPv4 environment) to be aware and understand the threats from IPv6. Desktop and network devices these days may already support IPv6 and may enabled by default. Attackers may use these "channel" to target companies in IPv4 environment and bypass their network protection (e.g IPS), which is not IPv6 aware.

Related articles:
- HITB slides: Marc Heuse - IPv6 Insecurity Revolutions.pdf

Security Guideline for Mobile Devices in Enterprise

This week, NIST (National Institute of Standards and Technology) has release the guidelines for managing and securing of mobile devices in the enterprise (Guidelines for Managing and Securing Mobile Devices in the Enterprise - SP 800-124 Revision 1). The purpose of this publication is to provide recommendation to help organizations centrally manage and secure their mobile devices against various threats.

This document is intended for technical staffs such as security engineers and those who are responsible in planning, implementing and maintaining the security of the mobile devices.

It covers the type of mobile devices that are applicable such as smart phone and tablets. Basic cell phones and laptops are out of scope as their threat level and security control options are different.

It also talks about the different high-level threats and vulnerabilities related to these devices, as they are generally higher risk exposure that other client devices such as desktop and laptop. These threats are,

• Lack of physical security controls 
• Use of untrusted mobile devices 
• Use of untrusted networks 
• Use of applications created by unknown parties 
• Interaction with other systems 
• Use of untrusted content 
• Use of location services 

The next section of the document provides an overview of the current state of the MDM (Mobile Device Management) technologies, which mainly comprise of the components, the architectures and the capabilities. For components, it talks about the type of MDM solution between the solution from same vendor of the mobile device and using third party product that can manage one or more types of mobile devices. The architectures deal with the different consideration and the use of other enterprise services based on business requirement. As for the capabilities of the MDM, it should provide the following security services, 

• General policy that can enforce enterprise security policies on the mobile device. 
• Data communication and storage that provide strong data encryption during communication and on storage. It should also have the ability to remotely wipe the device. 
• User and device authentication, which includes account and device lockout and remotely locking of the device. 
• Application. It should be able to restrict the installing and removal of applications. Prevent access to enterprise resources based on devices OS (Operating System) version and status (rooted or jailbroken). 

Lastly, it talks about the security for the life cycle of the enterprise mobile device solution, which covers from policy down to operations. This life cycle consist of 5 main phases. 

• Phase 1: Initiation. This phase include identifying needs for mobile devices, creating a high-level strategy for implementing mobile device solutions, developing a mobile device security policy, and specifying business and functional requirements for the solution. 
• Phase 2: Development. In this phase, it covers technical characteristics of the mobile device solution and related components. These include the type of authentication methods, cryptographic mechanisms and the type of mobile device clients to be used. 
• Phase 3: Implementation. This phase involve equipment configuration to meet operational and security requirements. Ensuring the integration with other security controls such as security event logging and authentication servers. 
• Phase 4: Operations and Maintenance. This phase will cover security related tasks that should be performed on an on-going basis such as log review and attack detection. 
• Phase 5: Disposal. This phase will cover the tasks for retiring of components and the mobile device solutions, including preserving of information to meet legal requirements, sanitizing and disposing of equipment properly. 

For more details on this NIST publication, visit the following link:

• NIST Updates Guidelines for Mobile Device Security
• Guidelines for Managing and Securing Mobile Devices in the Enterprise (SP 800-124 Revision 1)

This post is also available in Seczine, an online Security magazine.

• Seczine.com: NIST Guidelines for Mobile Devices

HP ProCurve Switch comes with FREE malware

HP had announced in their Security bulletin yesterday (10 Apr) that they have shipped malware-infected compact flash card with their HP ProCurve switches.

In their official bulletin, "A potential security vulnerability has been identified with certain HP ProCurve 5400 zl switches containing compact flash cards which may be infected with a virus. Reuse of an infected compact flash card in a personal computer could result in a compromise of that system's integrity."

They have not disclosed how those malware managed to infected the Flash cards but it is likely that it had infected the systems of the third-party manufacturer that supply those flash cards.

It is not the first time that renown companies are shipping malware in their products. Seagate and Apple also have reported cases. (See my previous blog "Battery not included ... but Malware is...)

Related Reports:
- HP SUPPORT COMMUNICATION - SECURITY BULLETIN

I won $10,000 worth of shopping voucher??

I received an email informing me that i have won $10,000 worth of shopping voucher coming from HardwareZone's newsletter.

The email format really give me the impression that i am the lucky winner, with two other "winners" listed in the email.



But after reading through the emails, it start to show tell-tale sign that it is just an advertisment and i did not really won a prize. They skillfully claims that "you may be a possible winner" as not to be accused as fraud later.



After clicking the link "www.greatsingaporevoucher.com.sg" to "verify" your details, it was obvious that the email is actually a legal "spam".

By "verifying" your details, you are actually joining the lucky draw instead. It also allow them to collect your information so to legally "spam" you further via Handphone, email, and mailing address.




w01f advise: If anyone still interested to join this lucky draw (or any similar online contest) and to be "spam" further, make sure you read and understand their "Terms and Conditions" and "Privacy Policy" before releasing your personal information to them.

Eleonore exploit pack

Exploit packs have been selling in the underground for hundreds of dollars in recent years. These pre-packaged kits are designed to probe the visitor’s browser for known security vulnerabilities, and then use the first one found as a vehicle to quietly install malicious software. They normally comes with a Web administration page, which gives the attacker real-time statistics about victims, such as which browser exploits are working best, and which browsers and browser versions are most successfully attacked. Those commonly found in the market were iPack, Crimepack and Eleonore.

The latter, Eleonore, is the most popular kit and have been making the headlines recently. It is claim to cost between USD$500 - USD$1000 (based on the version). The package was updated approximately every month with the latest browser, PDF and Java vulnerabilities. These kit providers provide "secured" support, updates and even cleanup of the package service if necessary.


Eleonore Web administration page


Crimepack Web administration page

w01f advise: Always patch up your system, especially Internet browser, Java, Flash and PDF applications.

New DLL injection attack in Windows

Microsoft had release an advisory on the vulnerability in Windows applications that allows attacker to execute malicious code remotely on victim's system.

Some exploits were found attacking third party applications. Microsoft is currently investigating whether any of their applications are susceptible to this DLL injection attack.

Many friends are asking me about this vulnerability. I think it will be good to explain in more details and share with everyone here.

The root cause of this vulnerability is the loading of dynamic libraries (DLL), which is the behavior and design of Windows. To better understand, you will need to know how DLL is used in Windows.

Windows provides a lot of DLL, which allow programmers to use functions from those DLL in their applications. Normally application load their libraries from the current working directory. But if the DLL is not found, there will be a search order that windows will perform.

Search order:
1. The directory from which the application loaded.
2. The system directory.
3. The 16-bit system directory.
4. The Windows directory.
5. The current directory.
6. The directories that are listed in the PATH environment variable.

If multiple directories hold a DLL with the same name, the first match be used.

So attacks exploit the weakness in the way windows search and load associated DLL. This DLL can be located in various directories, which include network paths that is controlled by the attacker. The malicious DLL may then be loaded.

Fix and workaround
Microsoft mentions that this flaw cannot be fixed in Windows without "Breaking expected functionality". It is because there are many applications that are written to search for their library based only on the file name, rather than the full directory path.

But Microsoft did provide some workaround such as disable loading of libraries from WebDAV and remote network shares. For more details, refer to the Microsoft Security Advisory (226937)

Related reports:
- The Register: Microsoft confirms code-execution bug in Windows apps

- Dark Reading: Microsoft Issues Advisory On New DLL Hijacking Attack

XSS found in Linkbucks.com

Linkbucks.com website was found to be vulnerable to Cross Site Scripting(XSS) vulnerability, which could be exploited using malicious scripts.



Vulnerability Description:
==================
Linkbucks.com is a famous advertising network site that brings web users, websites and marketers together. The XSS vulnerability is found in the Default.aspx page. Script can be injected to the Message and Returnurl parameters. This can be exploited by injecting arbitrary HTML and malicious script code, which will execute in a user's browser session. Unvalidated redirection and forwarding is also possible.

Vulnerability testing:
===============
Vulnerable URL: http://www.linkbucks.com/Default.aspx?
Tested with: Firefox 3.5 and Internet Explorer 7 on Windows XP SP3

A simple "alert("You are hACked by w01f")" script was injected to the "Default" page. It was executed and display on the web browser. Malicious script could be executed using this method.



Below is the video demonstration on exploiting the XSS vulnerability using redirection. It will redirect to my blog. Hacker can redirect to a spoofed Linkbucks site with malicious code.



Remediation:
==========
The Message and ReturnURL parameters need to be properly sanitized after a user's logging out. The Linksbuck support team was contacted on the vulnerability. The support ticket is "#KHT-97974-227" but so far no fixed was done.

Wing FTP Server XSS vulnerability by w01f Labs

New finding from the w01f Labs, the Wing FTP Server was found to be vulnerable to Cross Site Scripting(XSS) vulnerability, which could be exploited using malicious scripts.

Discovered Date: May 31, 2010
System affected: Wing FTP Server for Windows, Version 3.5.0 and prior version

For more detail on this vulnerability, visit my research site - w01f Labs

References:
- SecurityFocus: Wing FTP Server 'admin_loginok.html' HTML Injection Vulnerability
- Bugtraq: Wing FTP Server - Cross Site Scripting Vulnerability

D-Link Router XSS vulnerability found by w01f Labs

I have discover a Cross site Scripting (XSS) vulnerability on my own D-Link Router while working on fuzzing and vulnerability research last week. This vulnerability allows injecting of arbitrary HTML and malicious script code in the user's browser session.

Discovered Date: May 14, 2010
System affected: D-Link DI-724P+ Router, Firmware Version: v1.03

For more detail on this vulnerability, visit my research site - w01f Labs

Other References:
- SecurityFocus: D-Link DI-724P+ Router 'wlap.htm' HTML Injection Vulnerability
- OSVDB 65002 : D-Link DI-724P+ Admin Interface wlap.htm GET String XSS
- SANS: @RISK: The Consensus Security Vulnerability Alert

MS09-048 Critical Vulnerability with NO PATCH??

Microsoft recently release a Security bulletin (MS09-048 - Critical), announcing on several vulnerabilities in Transmission Control Protocol/Internet Protocol (TCP/IP) processing. These vulnerabilities could allow Denial of Service(DoS) or remote code execution if specially crafted TCP/IP packets were sent over the network to a computer with a listening service.

It have been a very HOT discussion in the Internet. Microsoft vulnerability is nothing new in IT security world. But what makes the commotion is that Windows 2000 SP4 and Windows XP were listed as affected product, but Microsoft was not issuing any updates for them. I had saw some very interesting comments and I think i should share some of those including my own comments. Below are the extract from Microsoft Security bulletin MS09-048.



- Extract from bulletin FAQ -
If Microsoft Windows 2000 Service Pack 4 is listed as an affected product, why is Microsoft not issuing an update for it?
The architecture to properly support TCP/IP protection does not exist on Microsoft Windows 2000 systems, making it infeasible to build the fix for Microsoft Windows 2000 Service Pack 4 to eliminate the vulnerability. To do so would require rearchitecting a very significant amount of the Microsoft Windows 2000 Service Pack 4 operating system, not just the affected component. The product of such a rearchitecture effort would be sufficiently incompatible with Microsoft Windows 2000 Service Pack 4 that there would be no assurance that applications designed to run on Microsoft Windows 2000 Service Pack 4 would continue to operate on the updated system. The impact of a denial of service attack is that a system would become unresponsive due to memory consumption. However, a successful attack requires a sustained flood of specially crafted TCP packets, and the system will recover once the flood ceases. Microsoft recommends that customers running Microsoft Windows 2000 Service Pack 4 use a firewall to block access to the affected ports and limit the attack surface from untrusted networks.

If Windows XP is listed as an affected product, why is Microsoft not issuing an update for it?
By default, Windows XP Service Pack 2, Windows XP Service Pack 3, and Windows XP Professional x64 Edition Service Pack 2 do not have a listening service configured in the client firewall and are therefore not affected by this vulnerability. Windows XP Service Pack 2 and later operating systems include a stateful host firewall that provides protection for computers against incoming traffic from the Internet or from neighboring network devices on a private network. The impact of a denial of service attack is that a system would become unresponsive due to memory consumption. However, a successful attack requires a sustained flood of specially crafted TCP packets, and the system will recover once the flood ceases. This makes the severity rating Low for Windows XP. Windows XP is not affected by CVE-2009-1925. Customers running Windows XP are at reduced risk, and Microsoft recommends they use the firewall included with the operating system, or a network firewall, to block access to the affected ports and limit the attack surface from untrusted networks.

Does this update completely remove the vulnerabilities, TCP/IP Zero Window Size Vulnerability - CVE-2008-4609 and TCP/IP Orphaned Connections Vulnerability - CVE-2009-1926?
Since the denial of service vulnerabilities, CVE-2008-4609 and CVE-2009-1926, affect the TCP/IP protocol itself, the updates for Windows Server 2003 and Windows Server 2008 do not completely remove the vulnerabilities; the updates merely provide more resilience to sustain operations during a flooding attack. Also, these denial of service vulnerabilities can be further mitigated through the use of NAT and reverse proxy servers, further lowering the severity of this issue on client workstations.
- End of Extract -

From the bulletin, they are saying that it is "technically infeasible" to build a fix for Windows 2000. It also mention that they did not patch XP because the client firewall (by default) mitigated the problem (if no ports is listening). It is not because XP is not vulnerable. As XP's TCP/IP stack uses the same underlying code as Windows 2000. It seems too hard for them to fix XP too.

Some Microsoft fans may rebutted that ALL should be upgraded to Windows 2003 or 2008. But the updates do not really fixed the issue, "the updates for Windows Server 2003 and Windows Server 2008 do not completely remove the vulnerabilities; the updates merely provide more resilience to sustain operations during a flooding attack". So they still do not fixed the issue, right?

There was also a statement that i find it comical:
- "The impact of a denial of service attack is that a system would become unresponsive due to memory consumption. However, a successful attack requires a sustained flood of specially crafted TCP packets, and the system will recover once the flood ceases".
For DoS, isn't the system always "become unresponsive" and most of the time always recover once the flood ceases , isn't it?

Customers should start looking into their support maintenance contract. Start thinking and asking on refund or cost incurred (on additional protection for vulnerable systems) from your software vendor when no patch was created according to the support contract. Also think of the possible cost and damages on your company in the event of a breach or exploit of these unpatched vulnerabilities occurs.

Nessus had released a plugin to detect this vulnerabilities.

Emerging Internet Security Threats: Spring 2009

Saw this video by Lenny Zeltser, the instructor for my GIAC Reverse-Engineering Malware(GREM) certification. Most of the stuffs presented may not be new to you, but it provide as a reminder with real life examples on some of the "attacks".

This video explores today's emerging Internet security threats to help organizations fine-tune their defenses. He examines attack patterns that have included the use of email as a gateway for fraud, the mighty power of network bots, the fertile ecosystem for web-based attacks, and the increased precision of modern attacks. The presentation presents lots of real-world examples of cyber attacks, and discusses the financial incentives behind the malicious activities that occur on the Internet.

He also covers:

• What is driving modern-day attackers to large-scale and targeted attacks
• Which recent breaches exemplify threat categories organizations need to track
• The approaches Internet criminals employ to trick victims and bypass defenses
• Whether you should adjust security architecture to match today's threat landscape

Part 1


Part 2


Part 3


About the speaker: Lenny Zeltser leads a security consulting team at Savvis. He is also a board of directors member at SANS Technology Institute, a SANS faculty member, and an incident handler at the SANS Internet Storm Center. Lenny frequently speaks on information security and related business topics at conferences and private events, writes articles, and has co-authored several books. Lenny is one of the few individuals in the world who has earned the highly regarded GIAC Security Expert (GSE) designation. He also holds the CISSP certification. Lenny has an MBA degree from MIT Sloan and a computer science degree from the University of Pennsylvania. For more information about his projects, see www.zeltser.com.

IE Zero day exploit on Video ActiveX Control

Microsoft is investigating a privately reported vulnerability in Microsoft Video ActiveX Control. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. When using Internet Explorer, code execution is remote and may not require any user intervention.

Currently, Many attacks were found attempting to exploit the vulnerability. Below are a list of exploit domains used by the attackers (provided by SANS Storm Center) and it is still growing.

Users can prevent the Microsoft Video ActiveX Control from running in Internet Explorer, either manually using the instructions* as an Workaround or automatically using the solution found in Microsoft Knowledge Base Article 972890. By preventing the Microsoft Video ActiveX Control from running in Internet Explorer, there is no impact to application compatibility.

Microsoft is currently working to develop a security update for Windows to address this vulnerability and will release the update when it has reached an appropriate level of quality for broad distribution.

w01f advise: Use Firefox or Chrome instead.

* Workaround instruction in Microsoft Advisory

List of exploit domains:
vip762.3322.org
3b3.org
www.27pay.com
www.hao-duo.com
dump.vicp.cc
64tianwang.com
webxue38.3322.org
556622.3322.org
jfg1.3322.org
df56y.3322.org
javazhu.3322.org
8dfgdsgh.3322.org
ceewe3w2.cn
js.tongji.linezing.com
h65uj.8866.org
45hrtt.8866.org
8oy4t.8866.org
www.mjbox.com
2wdqwdqw.cn
www.vbsjs.cn
cdew32dsw.cn
qvod.y2y2dfa.cn
kan31ni.cn
www.duiguide.us
gkiot.cn
www.carloon.cn
movie.wildmansai.com
www.7iai.cn
www.jazzhigh.com
www.netcode.com
6ik76.8866.org
76ith.8866.org
qd334t.8866.org
u5hjt.8866.org
vpsvip.com
x16ake8.6600.org
www.huimzhe.cn
www.hostts.cn
ucqh.6600.org
qitamove.kmip.net
news.85580000.com
guama.9966.org
dx123.9966.org
ds355.8866.org
dnf.17xj.cn
dasda11d.cn
d212dddw.cn
ckt5.cn
ccfsdee32.cn
aaa.6sys6.cn
9owe2211.cn
8man7.3322.org
6gerere3e.cn
66yttrre.cn
45hrtt.8866.org
tongji520.com
www.google-cdma.com
443ggr.8800.org
caonimabi.r154q.cn
ckt4.cn
fdg5.cn
guama.9966.org
home.xzx6.cn
q23r.cn
wf3gr.8800.org
www.ddlse.cn
www.gamezv.com

Exploit binaries downloaded from these domains:
www.73yi.cn
w1.7777ee.com
w2.7777ee.com
w3.7777ee.com
w8.7777ee.com
w9.7777ee.com
milllk.com
haha999b.com
babi2009.com
haha888l.com
xin765.com

IP Address contain exploit page:
110.165.41.103

Related sites:
- Microsoft Security Advisory (972890)

Keep your Java Runtime Environment (JRE) updated

Everyone is talkng about patching their Windows, updating their AV(Anti Virus). But not many people really bother whether their Java Runtime Environment(JRE) is patched or up to date.


Many websites uses Java. Searching on the Vulnerabilities for JRE from the National Vulnerability Database (NVD), 23 vulnerabilities were found for the past 3 months. Majority of them are rated Severity High by NVD.


Recently, Java website provides a link to verify whether one's JRE version, is up to date. It will also prompt to download and install the latest version if older version was found. It is very useful and it just ttook less than a minute to check your JRE version.

You can click HERE or goes to the link below to check your JRE now. http://java.com/en/download/installed.jsp

Anti Virus, can be "dangerous"

Recently, there are reports that AVG (anti virus) update deletes critical Windows XP file causing the system un-bootable.

Many users of AVG 7.5 and AVG 8.0 reported seeing a warning that the Windows system file 'user32.dll' was infected with the PSW.Banker4.APSA or Generic9TBN Trojans, with a recommendation that the file be moved to the program's vault and deleted.

With the file 'user32.dll' deleted/quarantined, Windows XP will no longer be able to boot up as it is a critical system file.

AVG has since admitted that the detection was a false positive. " Unfortunately, the previous virus database might have detected the mentioned virus on legitimate files. We can confirm that it was a false alarm," said a company spokesman.

A workaround under Topics 1574 False Positive user32.dll was published in their support website. (Shown on picture on the right)

Anyway, Anti Virus having false positive is not only unique to AVG. Major Anti Virus companies such as Symantec, Mcafee and Trend Micro also had reported to wrongly identity Windows system file previously. Some examples below:

- In May 2007, Symantec Anti Virus cripples thousands of Chinese systems when it mistakenly identify two critical Windows .dll files for malware (Related Article in "ComputerWorld: Symantec false positive cripples thousands of Chinese PCs")

- In September 2008, Trend Micro issued two anti-virus signatures that causes Windows DLL files to be quarantined. (Related Article in "ZDNet UK: Trend Micro gives false positive details")

- In October 2008, a faulty update from Mcafee led to an integral component of the Windows Vista operating system being falsely flagged as a trojan horse. (Related Article in "The Register: McAfee update classifies Vista component as a Trojan")


Related Articles:
- Vnunet.com: AVG update deletes critical Windows file

- The Register: AVG slaps Trojan label on core Windows file

WPA crack details finally out

These few days, people have been talking about WPA cracking and the detail of the crack is finally available for download.

The WPA crack was recently announced by 2 German researchers. They were planned to present their finding at the PacSec 2008 conference (12/13 Nov) in Tokyo. But the details on this crack was released today at Aircrack website in a whitepaper.

Wired Equivalent Privacy (WEP), the basic protection mechanism for wireless, was long being cracked. With the more advanced technique these days, it could be easily cracked with less than a minute.

Wi-Fi Protected Access (WPA), which replace WEP, is a more secure method to protect wireless network. Previous attack on WPA was basically launching dictionary attack against weak Pre-Shared Key used. This new crack on WPA will works against the WPA protected network that uses Temporal Key Integrity Protocol(TKIP). The attack is able to decrypt an ARP request or response and send 7 packets with custom content to the network after access for more than 12 minutes.

To summarised, the recommendation against the attack is to use WPA2, which uses CCMP instead of TKIP. If for any reason you are not able to migrate your network to WPA2, There are some other mitigation recommended such as reducing the renew key interval and increase your wireless detection stance and check for multiple MIC failure messages. (Reminder, please test it before making the change on your production environment)

You can download the Whitepaper "Practical attacks against WEP and WPA" from Aircrack or alternatively from local copy.


Related Articles:
- Security Focus: "Researchers find more flaws in wireless security"

US Election over but more Security lessons to learn

As the US election comes to an end,with Barack Obama being the first black president of United States, there are some interesting things that we can learn from this election.

Months before the election, there were already many concerns on the electronic voting machines. There were reports on "flipping votes" (marking a vote for a different candidate than the one selected) and interface that was misleading, which worried the security experts. These had lead to the push for better checks and audit on those voting machines.

The advises that were given to the voters were to double-check on their votes. When in doubt, not to be afraid to ask for help during the voting.

Beside the problem with the voting machines, there were also reports on ways or "dirty tricks" used to influence the result of the election. There were reports of automated phone calls, sms, email or even flyers intended to convince the receiver that they should vote the day after the election, or providing false polling venue so that they will miss the voting day and their chance to support the candidates (useful on those states that pro their opposition).

- An example of those email:
From: Office of the Provost
Subject: Election Day Update

To the Mason Community:

Please note that election day has been moved to November 5th. We apologize for any inconvenience this may cause you.

Peter N. Stearns
Provost
- End of email

- An example of those SMS:
"Due to long lines if you are voting for Barack Obama you can vote tomorrow"

"Due to long lines, all Obama voters are asked to vote tomorrow".
- End of SMS

While some trying to influence the election results, others were using this election to send out malwares. Emails that were claiming to contains Obama's speech or interview were found to be spamming over the Internet. Video or download links will lead users to download the malware while trying to click on the speech or interview.

Currently the malwares that were found from those email were a keylogger that will sends the stolen keystrokes to the Ukraine and a trojan downloader that will automatically download more malwares into your system.

- An example of those email
From: news@cnn.com
Subject: Barack Obama wins

Barack Obama Elected 44th President of United States

Barack Obama, unknown to most Americans just four years ago, will become the 44th president and the first African-American president of the United States.
Watch His amazing speech at November 5!

Proceed to the election results news page>>

2008 American Government Official Website
This site delivers information about current U.S. Foreign policy and about American life and culture.
- End of email


Every election is not as simple as what we think. There are always someone who is trying ways to manipulate the results, trying to make use of the situation for their own benefit. Just don't blindly focus on the results. Be mindful of others that is taking advantage of the situation.

Related Articles:
- Concerns continue to shadow e-voting (Security Focus)

- Election Hoax Sent Via D.C. Based E-Campaign Group

- US Presidential Malware - Barack Obama Interview Lure (WebSense Alerts)

Microsoft Out-Of-Band Security Patch

Microsoft released an out-of-band security bulletin on 24 Oct (23 Oct-US Time) while i was away for holiday. This Patch is to resolve a vulnerability in the Server service of Microsoft Windows. It affects the Windows systems across the board from Windows 2000 to Windows 2008 (including XP, 2003 and Vista).

Microsoft has detected limited, targeted attacks exploiting this vulnerability in the wild and also noted the possibility that this vulnerability could be used in the crafting of a wormable exploit on Windows XP and older operating systems.

An unauthenticated attacker can trigger this vulnerability remotely by sending a specially crafted RPC request to execute arbitrary code on Windows Server 2000, Windows XP and Windows 2003. By default, Windows Vista and Windows Server 2008 require authentication.

However, the attacker must be able to reach the RPC interface to exploit the vulnerability. In the default out-of-the-box scenario, the interface is not reachable as the firewall is enabled on Windows XP SP2, Windows Vista, and Windows Server 2008. Unfortunately, the RPC could be exposed in one of the following two conditions:

1) Firewall is disabled
2) Firewall is enabled but file/printer sharing is also enabled.

When File/Printer Sharing is enabled on Windows Vista and Windows Server 2008, the firewall only expose the RPC interface to the network type shared. For example, if a printer is shared on a network type ‘Private’, the firewall will block incoming RPC connections if the computer switches over to a network type ‘Public’. If you then choose to share the printer on the network type ‘Public’, Vista and Windows Server 2008 will prompt to ask if you really want to enable “File and Printer Sharing” for ALL public networks.

Details and patches are available in Microsoft Security Bulletin MS08-067

For more technical information and advices on Microsoft Vulnerabilities, you can visit Microsoft Security Vulnerability Research & Defense Blog

When Microsoft meets Oracle

Today is the scheduled monthly patches (Black Tuesday) for Microsoft. Coincidentally, it collided with Oracle quarterly patches. When two software giants patch cycles meets, it will be only be more work and headache for the administrators.

Microsoft Patches
There are 11 patches released by Microsoft. 4 are Critical, 6 are Important and 1 is moderate rating. Those patches covers products from Windows OS, IE to Office.

For more information, visit the Microsoft Security Bulletin Summary for October 2008 website.

Oracle Patches
There are 36 patches released by Oracle. It covers product ranging from Database, Application Server, E-Business Suite, PeopleSoft to BEA. DBA and System admin are advise to review the patches and their CVSS* scoring before patching.

For more information, visit the Oracle Critical Patch Update Advisory - October 2008 website

We are likely to see the re-occurrence of this patch collision on their next scheduled release on January 13th, 2009.

Note:
*CVSS - Common Vulnerability Scoring System an open framework for communicating the characteristics and impacts of IT vulnerabilities.