Trane ComfortLink XL850 thermostats running firmware version 3.1 or lower are vulnerable to information disclosure and remote access due to a weak authentication mechanism and hardcoded credentials. The device uses a custom protocol and a predictable port number to administer remote access to virtually all of the device functions. When you combine hardcoded credentials with a network accessible port, you have a device ripe for attack from the network or even an attack from the Internet if the thermostat is exposed through the router.

Once an attacker has gained access they can quickly extract all information from the device including the home heating and cooling schedule, current operation mode, current temperature, chat and alarm history, serial number, active socket connections, trusted URLs, secret IDs, software version info and detailed address and installer information. These will allow attackers to perform a number of dangerous operations. This includes forcing the device to maintain the maximum heating setting or disabling the device continuously thereby overriding user input. Attackers can also remove and create trusted server connections permanently disconnecting the device from the corporate command and control servers.

Below shows the exploit that affect the device. The "Get Connected" banner at the top of the screen is a marketing prompt indicating that the device is not enrolled in any remote services or special features.

Misfortune Cookies Vulnerability

As everybody was focusing on the Sony hacking incident, there was a vulnerability that is affecting over 12 million Internet routers located in 189 countries across the globe been announced. At least over 200 different models of the devices are vulnerable. These lists of vulnerable devices consist of companies such as ASUS, D-Link, Edimax, Huawei, TP-Link, ZTE, and ZyXEL.

This vulnerability, which is discovered by the researchers from Check Point’s Malware and Vulnerability Research Group, called it "Misfortune Cookie vulnerability". It is exploitable due to an error within the HTTP cookie management mechanism in the affected software. It allows an attacker to determine the ‘fortune’ (critical information) of a request by manipulating cookies. Attackers can then send specially crafted HTTP cookies that exploit the vulnerability to corrupt memory and alter the application state, which will trick the device’s web server to treat the current session with administrative privileges.

The actual vulnerability lies on the software that is the embedded web server RomPager from AllegroSoft. Devices running RomPager services with versions before 4.34 are vulnerable.

So what can you do with the exploit of this vulnerability? With administrative access to your device, an attacker could take control over your wired and/or wireless network infrastructure. Depending on your gateway device, there may be risk of Man-in-The-Middle attacks, provide a possible attack vector for LAN-side vulnerabilities, and also gave the attacker the ability to extract useful information from the network connections from your devices.

With information extracted from your network, it also provide the stage for further attacks, such as installing malware on devices and making permanent configuration changes the bypassing gateway protection just as firewall or network isolation of your local network.

Since this is one of the most widespread vulnerabilities revealed in recent years, how can we mitigate it? There is actually a patch to the vulnerable software. AllegroSoft issued a fixed version to address this “Misfortune Cookie vulnerability” in 2005. It is advice to check with the device vendor if the patched firmware is already available.

But there is always this common issue of device vendors taking too long to patch up their firmware. Even if the patch of the vulnerable software available, they need to integrate this patch into their device firmware, test to make sure nothing breaks and then make it available which normally takes a long time.

Other mitigation that can be considered will be to deploy Intrusion Prevention Systems (IPS) in front of your device. There are IPS signatures available for this vulnerability (CVE-2014-9222 and CVE-2014-9223). 

Reference:
Misfortune Cookie

Security Guideline for Mobile Devices in Enterprise

This week, NIST (National Institute of Standards and Technology) has release the guidelines for managing and securing of mobile devices in the enterprise (Guidelines for Managing and Securing Mobile Devices in the Enterprise - SP 800-124 Revision 1). The purpose of this publication is to provide recommendation to help organizations centrally manage and secure their mobile devices against various threats.

This document is intended for technical staffs such as security engineers and those who are responsible in planning, implementing and maintaining the security of the mobile devices.

It covers the type of mobile devices that are applicable such as smart phone and tablets. Basic cell phones and laptops are out of scope as their threat level and security control options are different.

It also talks about the different high-level threats and vulnerabilities related to these devices, as they are generally higher risk exposure that other client devices such as desktop and laptop. These threats are,

• Lack of physical security controls 
• Use of untrusted mobile devices 
• Use of untrusted networks 
• Use of applications created by unknown parties 
• Interaction with other systems 
• Use of untrusted content 
• Use of location services 

The next section of the document provides an overview of the current state of the MDM (Mobile Device Management) technologies, which mainly comprise of the components, the architectures and the capabilities. For components, it talks about the type of MDM solution between the solution from same vendor of the mobile device and using third party product that can manage one or more types of mobile devices. The architectures deal with the different consideration and the use of other enterprise services based on business requirement. As for the capabilities of the MDM, it should provide the following security services, 

• General policy that can enforce enterprise security policies on the mobile device. 
• Data communication and storage that provide strong data encryption during communication and on storage. It should also have the ability to remotely wipe the device. 
• User and device authentication, which includes account and device lockout and remotely locking of the device. 
• Application. It should be able to restrict the installing and removal of applications. Prevent access to enterprise resources based on devices OS (Operating System) version and status (rooted or jailbroken). 

Lastly, it talks about the security for the life cycle of the enterprise mobile device solution, which covers from policy down to operations. This life cycle consist of 5 main phases. 

• Phase 1: Initiation. This phase include identifying needs for mobile devices, creating a high-level strategy for implementing mobile device solutions, developing a mobile device security policy, and specifying business and functional requirements for the solution. 
• Phase 2: Development. In this phase, it covers technical characteristics of the mobile device solution and related components. These include the type of authentication methods, cryptographic mechanisms and the type of mobile device clients to be used. 
• Phase 3: Implementation. This phase involve equipment configuration to meet operational and security requirements. Ensuring the integration with other security controls such as security event logging and authentication servers. 
• Phase 4: Operations and Maintenance. This phase will cover security related tasks that should be performed on an on-going basis such as log review and attack detection. 
• Phase 5: Disposal. This phase will cover the tasks for retiring of components and the mobile device solutions, including preserving of information to meet legal requirements, sanitizing and disposing of equipment properly. 

For more details on this NIST publication, visit the following link:

• NIST Updates Guidelines for Mobile Device Security
• Guidelines for Managing and Securing Mobile Devices in the Enterprise (SP 800-124 Revision 1)

This post is also available in Seczine, an online Security magazine.

• Seczine.com: NIST Guidelines for Mobile Devices

Vulnerability found in WPA2

Recently, a vulnerability was found in WPA2 protocol. It is an insider vulnerability where authenticated attacker could launch a "Man in the Middle" attack by decrypting and injecting malicious traffic into the wireless network.

WPA2 is currently the strongest WiFi encryption and authentication protocol available. According to the researcher in AirTight networks, this vulnerability is a design loophole in IEEE 802.11 Standard.

Based on the standard, Group Temporal Key (GTK), which is used to protect broadcast data sent to multiple clients, is using a common shared key. This allows authenticated user to use the common key to encrypt and sends spoofed packets to other clients.

Currently there isn't any patch on this standard.

Related Report:
- NetworkWorld: WPA2 vulnerability found

The Pwn2Own 2010 Contest

The Pwn2Own 2010 organized by DVlabs was over. But there are some interesting information to share.
(Extract from "10 Lessons From The Pwn2Own Hacker Contest")


Google Chrome the Most Secured?

"The only browser that survived Pwn2Own this year was Google Chrome. This led to numerous news reports like this one suggesting that Google's browser was somehow more secure than the others. This is far from the truth. In fact, the vulnerability that caused the iPhone's downfall was in the WebKit engine and also affected the Google Chrome browser. Chrome's sandbox was also held up as a major CanSecWest roadblock but there's already scuttlebutt circulating that at least two security researchers have found a way to break out of the Chrome sandbox. Keep in mind that the iPhone has a sandbox that didn't help much when hackers hijacked the SMS database at Pwn2Own.

Survival at the Pwn2Own contest simply means that researchers weren't motivated enough to give up their vulnerabilities/exploits in exchange for a smartphone and cash prizes. The iPhone survived in 2008, didn't it?"


IE 8 seems to be Most Protected Browser.

"Despite the survival of Google Chrome and the fall of Internet Explorer 8 (running on Windows 7), all the browser hackers at the contest maintained that Microsoft's browser is by far the most difficult to exploit. For starters, IE 8 is the only browser to fully -- and properly -- implement ASLR. Peter Vreugdenhil, the researcher behind the successful IE 8 hack, needed two different vulnerabilities and several exploitation tricks to get it to work. However, because IE is the world's most widely deployed browser, it will continue to attract the attention of hackers and malware writers. Security doesn't equate to safety."


Apple Safari still the Easiest to Hack?

"For the third year in a row, security researcher Charlie Miller successfully compromised a fully patched MacBook Pro machine with a Safari vulnerability and exploit. Despite Apple's best efforts at making it difficult to exploit the Mac OS X, Miller's exploits show that Safari is still easy pickings because it lacks the mitigations found in Microsoft Windows. For example, Safari does not implement ASLR properly and does not have a sandbox to limit the damage from a hacker attack."

Singapore Boleh... Trojan connect to SG IP

Recently, there are several newly detected malicious PDF files that exploited Adobe Reader and execute backdoor trojan on victim's system. These trojans allow remote access from cecon.flower-show.org and posere.flower-show.org. Many will think that those hosts were likely to be from China or Russia, the usual suspect.

But both hostname are resolved to 202.150.213.12, which is in Singapore. The IP belongs to "NewMedia Express Pte Ltd, Singapore Web Hosting".



Likely that NewMedia server was compromised to host and re-direct the traffic to the real hacker's address.

More details from F-Secure blog

nullcon Goa 2010 Hacker Challenge

This challenge was forward to me by my colleague. Tried yesterday. Currently at level 2.

The winner of this challenge will win the entry pass to nullcon Goa 2010 security conference and 2 night stay.

Updated on 1st Feb
Have stop trying this challenge last week. Heard that there is a winner. Lucky i did not spend too much time on this.

OWASP X-Mas Capture the Flag challenge

OWASP had released a X-Mas Capture the Flag challenge. This challenge was the 7th challenge for the OWASP AppSec Research 2010 in Stockholm, Sweden. The winner gets the free entrance to their next year's conference.

Before you start hacking away, please read the rules first.

Rules of the Challenge:
- Please do not perform any resource-intensive tests, as the machine is pretty low-end and can be DoS:ed without much effort.
- The computer at the given IP address is the only system involved in this challenge, so please do not perform any tests of neighboring systems.
- Otherwise, you are free to hack away!

The Challenge URL: 66.249.7.26


For more infomation on the challenge, visit OWASP AppSec Research 2010

Updated on 24 Dec
Have some free time yesterday and decided to try out on the challenge.

I run a simple port scan on the IP and found port 22 and 80 running. So i tested the port 22 with SSH and HTTP. No respond from it.

Planning to run a Vulnerability scan on the webserver. But do not want to trigger the IDS in my office. So i move on to check the source code of the webpage. The source code looks like a static HTML page without any input fields. But the programmer did provide some pointer to us.

Congratulations, you reached the first goal. You checked the source! Now,
go ahead on your quest for the christmas spirit.

Join us inside the merry box and find the hidden present! And dont forget to leave
milk and cookies for santa and his helpers.

* Rule#1 : Do not (D)DoS this machine, it is a very very fragile old christmasgnome
who will topple if you push him too hard.
* Rule#2 : No more rules.

Try to search for any other folders on the website. Tried several folder such as /help/, /admin/, /cgi/, /bin/, /samples/, etc.. Manage to detect /icons/ and /manual/. There isn't anything useful in those folder.

While reading through the pointer from the source code again, i notice something they are trying to tell us. The statement "dont forget to leave milk and cookies for santa and his helpers.". The word cookies maybe relavant. So decide to try adding cookie on the request.

When using the "Cookie: testing", the webpage returns "Noooo noooo noooo - but close!". So it seems i am on the right track and the input to this webpage is via cookie.



So i decide to try changing the cookie values to "christmas", "merry", "present", "milk", etc.. It still return with "Noooo noooo noooo - but close!". Only when i use "santa", it returns with something positive. It show "Hoooo hoooo hoooo" with a long code "YToxOntzOjE5OiJCRU5DSE1BUksoMSxNRDUoMSkpIjtzOjE6IjAiO30=" . It looks like some hashing or encoding.



After checking on various hashing and encoding format, the code was found to be using Base64. It was decoded as "a:1:{s:19:"BENCHMARK(1,MD5(1))";s:1:"0";}"



Not knowing what to do with it, i try add it in the header and the body of the request. But it don't seems to work. So i continue to work on other cookie input. With some experience studying cookies from Ads site such as yieldmanager and doubleclick, i decided to give values to the "santa" variable.

I try putting "santa=1", "2" and "3". It seems to return different codes. So it means that the webpage is accepting the values and output according to the input. Maybe there are some calculation or algorithm in the program.



When i try with a large numbers like "santa=123456789", it gives an ouput "Ouch! Too much eggnog". Seems that there is a limit to the input values.



When i try with a string values such as "santa=testing", it gives an error "Warning: mysql_fetch_assoc(): supplied argument is not a valid MySQL result resource in /var/www/xmas/frontend/index.php on line 95". Looks like there is a MySQL database running in backend and the challenge will likely to be using SQL injection.



After collecting several encoded codes and trying out various different inputs (code injection). I am more or less stuck on this challenge. But i notice that a hint pops up saying "The magic parenthesis of Antiochia!", when i was trying various inputs and refreshing the webpage.



Frankly, i am not good in programming and not sure what this code or function "a:1:{s:19:"BENCHMARK(1,MD5(1))";s:1:"0";}" represents? And also not sure about the hint of "The magic parenthesis of Antiochia!", maybe it is about using parenthesis in the injection. See if anyone can pick up and solve the "mystery". I will be out of town to enjoy my holiday this christmas weekend. That's all from me on this challenge.

Merry Christmas!!

Disable Javascript in Adobe Acrobat

Adobe had recently confirmed a critical vulnerability in Adobe Reader and Acrobat 9.2 and earlier versions that could potentially allow an attacker to take control of the affected system and is being actively exploited in the wild.

The vulnerability, which occurs in a Javascript function in Adobe Acrobat and Reader, allows the attacker to invisibly run a program on the affected computer, when the victim opens a PDF file containing exploit code.

Currently, no patch was released for this vulnerability. It is likely to be released next year. But user can still mitigate this problem by disabling the javascript in Adobe Reader and Acrobat from the steps below.

1. Launch Acrobat or Adobe Reader.
2. Select Edit > Preferences
3. Select the 'JavaScript' Category
4. Uncheck the 'Enable Acrobat JavaScript' option
5. Click OK



But some Security firms and research groups claims that the level of attacks using this vulnerability were to limited number of attacks. It seems like hackers these days are focusing on targeted attacks (specific government, companies and organisation) to get the most value out of the vulnerability before it was exposed and patched.

For more finding on this vulnerability and exploit, visit my research blog @ w01f labs

Related report:
- SecurityFocus - Limited attacks target Adobe Acrobat

NetWars CyberChallenge

US Companies and government agencies face a critical shortage of cybersecurity experts with sufficient technical skills to protect their systems, and military organizations have a similar shortage of people who can fight and win in cyberwar.

An initiative by US government of having some Cyber Challenge competitions to discover these talented people. One of the competition was NetWars by SANS institute. Below is the video of an interview with the winner (Alan Paller) of NetWars at Gov 2.0 Summit 09.

Hope this video can motivate talented kids who is interested in IT Security.



Related Links:
- US Cyber Challenge
- NetWars Competition
- Interview with Top talent from Round 2

MS09-048 Critical Vulnerability with NO PATCH??

Microsoft recently release a Security bulletin (MS09-048 - Critical), announcing on several vulnerabilities in Transmission Control Protocol/Internet Protocol (TCP/IP) processing. These vulnerabilities could allow Denial of Service(DoS) or remote code execution if specially crafted TCP/IP packets were sent over the network to a computer with a listening service.

It have been a very HOT discussion in the Internet. Microsoft vulnerability is nothing new in IT security world. But what makes the commotion is that Windows 2000 SP4 and Windows XP were listed as affected product, but Microsoft was not issuing any updates for them. I had saw some very interesting comments and I think i should share some of those including my own comments. Below are the extract from Microsoft Security bulletin MS09-048.



- Extract from bulletin FAQ -
If Microsoft Windows 2000 Service Pack 4 is listed as an affected product, why is Microsoft not issuing an update for it?
The architecture to properly support TCP/IP protection does not exist on Microsoft Windows 2000 systems, making it infeasible to build the fix for Microsoft Windows 2000 Service Pack 4 to eliminate the vulnerability. To do so would require rearchitecting a very significant amount of the Microsoft Windows 2000 Service Pack 4 operating system, not just the affected component. The product of such a rearchitecture effort would be sufficiently incompatible with Microsoft Windows 2000 Service Pack 4 that there would be no assurance that applications designed to run on Microsoft Windows 2000 Service Pack 4 would continue to operate on the updated system. The impact of a denial of service attack is that a system would become unresponsive due to memory consumption. However, a successful attack requires a sustained flood of specially crafted TCP packets, and the system will recover once the flood ceases. Microsoft recommends that customers running Microsoft Windows 2000 Service Pack 4 use a firewall to block access to the affected ports and limit the attack surface from untrusted networks.

If Windows XP is listed as an affected product, why is Microsoft not issuing an update for it?
By default, Windows XP Service Pack 2, Windows XP Service Pack 3, and Windows XP Professional x64 Edition Service Pack 2 do not have a listening service configured in the client firewall and are therefore not affected by this vulnerability. Windows XP Service Pack 2 and later operating systems include a stateful host firewall that provides protection for computers against incoming traffic from the Internet or from neighboring network devices on a private network. The impact of a denial of service attack is that a system would become unresponsive due to memory consumption. However, a successful attack requires a sustained flood of specially crafted TCP packets, and the system will recover once the flood ceases. This makes the severity rating Low for Windows XP. Windows XP is not affected by CVE-2009-1925. Customers running Windows XP are at reduced risk, and Microsoft recommends they use the firewall included with the operating system, or a network firewall, to block access to the affected ports and limit the attack surface from untrusted networks.

Does this update completely remove the vulnerabilities, TCP/IP Zero Window Size Vulnerability - CVE-2008-4609 and TCP/IP Orphaned Connections Vulnerability - CVE-2009-1926?
Since the denial of service vulnerabilities, CVE-2008-4609 and CVE-2009-1926, affect the TCP/IP protocol itself, the updates for Windows Server 2003 and Windows Server 2008 do not completely remove the vulnerabilities; the updates merely provide more resilience to sustain operations during a flooding attack. Also, these denial of service vulnerabilities can be further mitigated through the use of NAT and reverse proxy servers, further lowering the severity of this issue on client workstations.
- End of Extract -

From the bulletin, they are saying that it is "technically infeasible" to build a fix for Windows 2000. It also mention that they did not patch XP because the client firewall (by default) mitigated the problem (if no ports is listening). It is not because XP is not vulnerable. As XP's TCP/IP stack uses the same underlying code as Windows 2000. It seems too hard for them to fix XP too.

Some Microsoft fans may rebutted that ALL should be upgraded to Windows 2003 or 2008. But the updates do not really fixed the issue, "the updates for Windows Server 2003 and Windows Server 2008 do not completely remove the vulnerabilities; the updates merely provide more resilience to sustain operations during a flooding attack". So they still do not fixed the issue, right?

There was also a statement that i find it comical:
- "The impact of a denial of service attack is that a system would become unresponsive due to memory consumption. However, a successful attack requires a sustained flood of specially crafted TCP packets, and the system will recover once the flood ceases".
For DoS, isn't the system always "become unresponsive" and most of the time always recover once the flood ceases , isn't it?

Customers should start looking into their support maintenance contract. Start thinking and asking on refund or cost incurred (on additional protection for vulnerable systems) from your software vendor when no patch was created according to the support contract. Also think of the possible cost and damages on your company in the event of a breach or exploit of these unpatched vulnerabilities occurs.

Nessus had released a plugin to detect this vulnerabilities.

IE Zero day exploit on Video ActiveX Control

Microsoft is investigating a privately reported vulnerability in Microsoft Video ActiveX Control. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. When using Internet Explorer, code execution is remote and may not require any user intervention.

Currently, Many attacks were found attempting to exploit the vulnerability. Below are a list of exploit domains used by the attackers (provided by SANS Storm Center) and it is still growing.

Users can prevent the Microsoft Video ActiveX Control from running in Internet Explorer, either manually using the instructions* as an Workaround or automatically using the solution found in Microsoft Knowledge Base Article 972890. By preventing the Microsoft Video ActiveX Control from running in Internet Explorer, there is no impact to application compatibility.

Microsoft is currently working to develop a security update for Windows to address this vulnerability and will release the update when it has reached an appropriate level of quality for broad distribution.

w01f advise: Use Firefox or Chrome instead.

* Workaround instruction in Microsoft Advisory

List of exploit domains:
vip762.3322.org
3b3.org
www.27pay.com
www.hao-duo.com
dump.vicp.cc
64tianwang.com
webxue38.3322.org
556622.3322.org
jfg1.3322.org
df56y.3322.org
javazhu.3322.org
8dfgdsgh.3322.org
ceewe3w2.cn
js.tongji.linezing.com
h65uj.8866.org
45hrtt.8866.org
8oy4t.8866.org
www.mjbox.com
2wdqwdqw.cn
www.vbsjs.cn
cdew32dsw.cn
qvod.y2y2dfa.cn
kan31ni.cn
www.duiguide.us
gkiot.cn
www.carloon.cn
movie.wildmansai.com
www.7iai.cn
www.jazzhigh.com
www.netcode.com
6ik76.8866.org
76ith.8866.org
qd334t.8866.org
u5hjt.8866.org
vpsvip.com
x16ake8.6600.org
www.huimzhe.cn
www.hostts.cn
ucqh.6600.org
qitamove.kmip.net
news.85580000.com
guama.9966.org
dx123.9966.org
ds355.8866.org
dnf.17xj.cn
dasda11d.cn
d212dddw.cn
ckt5.cn
ccfsdee32.cn
aaa.6sys6.cn
9owe2211.cn
8man7.3322.org
6gerere3e.cn
66yttrre.cn
45hrtt.8866.org
tongji520.com
www.google-cdma.com
443ggr.8800.org
caonimabi.r154q.cn
ckt4.cn
fdg5.cn
guama.9966.org
home.xzx6.cn
q23r.cn
wf3gr.8800.org
www.ddlse.cn
www.gamezv.com

Exploit binaries downloaded from these domains:
www.73yi.cn
w1.7777ee.com
w2.7777ee.com
w3.7777ee.com
w8.7777ee.com
w9.7777ee.com
milllk.com
haha999b.com
babi2009.com
haha888l.com
xin765.com

IP Address contain exploit page:
110.165.41.103

Related sites:
- Microsoft Security Advisory (972890)

趁火打劫 (Loot a burning house)

趁火打劫 (Loot a burning house) is one of the Thirty-Six Stratagems (三十六计). This stratagem basically teaches one to "attack" when the "enemy" is at the weakest, troubled by internal problem such as natural disaster.

As many of you may know the state of Victoria in Australia has seen the worst bushfires ever. The death toll seems to hit over 300 and it seems that the fire were deliberately lit. Some people are using this "opportunity" to carry out a "Loot a burning house" stratagem.

Many domains, that may sound relevant to the bushfire, are registered. Websites requesting for donations starts to appear. These people are trying to profit from this event either by sell those potentially demanded domain or by posing as collectors for charities.

There are some suspicious websites that are claims to collect donations and forward them to respective organisations.

- bushfireappealqld.org


This site claims to be collecting donation for Australian Red Cross.


Each donation is AUD$15 using Paypal


From the Whois record, the site belongs to "Yasin Odeh from Queensland"

- bushfirevictims.com


This site seems to be selling CD and donate AUD$10 from each CD sold to the bushfire. But he did not state which organisation he will donate to. The website also accept donation for the bushfire.


From the Whois record, the site belongs to "Bayram Kudret from Victoria"

There are other suspicious domains that have yet to put up any webpages such as:
- bushfirebunker.com
- bushfirerelief.info
- bushfireshelters.co
- bushfireactionplan.com
- bushfirehomes.com
- bushfirehomes.org
- bushfirehousing.net
- bushfiresafety.net
- victorianbushfires.info

There are others domains that are reserved. Maybe to make profit from the demand of the domain or to be reserved for organisation to use. To name afew,
- bushfireappeal.org
- bushfirerelief.com
- australianbushfires.com
- victorianbushfirereliefvolunteers.org

Besides all the suspicious domains and websites, there are also many that provide support for victims, or information and either do not ask for financial donations or redirect donations to the red cross or Salvation Army.
- victorianbushfire.com
- victorianbushfireforum.com
- bushfireappeal.com
- bushfirehousing.org
- victorianbushfires.com

If anyone want to donate for victims of the Australia Bushfire, i encourage them to use the official Australian Red Cross site or the Salvation Army websites.

Lastly, i wish to dedicate this post and my regards to all the victims and their family.

AV website been hacked AGAIN!!

Within 3 days, two Anti-Virus (Kaspersky & Bitdefender) websites were reported being hacked. Sensitive information such as Users info, account password were claim to be havested. Both attacks were reported to be using simple SQL injection on their databases.

Kaspersky
The hacker posted in the blog, claiming that just by altering one of the parameters, he was able to access every field in the database such as users, activation codes, lists of bugs, admins, shop, etc. So far, representatives from Kaspersky declined to comment on the vulnerbility.

The picture shows the version, username and name of the database. The other shows username, host and password for mysql user.



Updated on 15 Feb 09
An independent auditor has reported that no customer information was exposed during last week breach on the Kaspersky website, after an internal investigation conducted by the firm.

It wasn't the first time that a Kaspersky site was hit by a SQL injection attack. In July last year, Kaspersky's Malaysian site was defaced by hacker who left pro-Turkish slogans "hacked by m0sted And Amen Kaspersky Shop Hax0red No War Turkish Hacker Thanx to Terrorist Crew all team members".


Bitdefender
Bitdefender's portugese also been hit by SQL injection attack on their database. Customer sensitive data were extracted. It was said that "bitdefender.pt" is hosted by a reseller for bitdefender.

The picture shows the version, username and name of the database. The other shows the Admin userName, userPass, sessionID and lastlog.



The attack extracts details of the customers and sales table (tabel vendas). Under the table inscricoes(Newsletter), there are thousands of email addresses that can be useful for spammer.



Related Reports:
- SecurityFocus: Kaspersky exposes sensitive database, says hacker

- ZDnet.com: Kaspersky’s Malaysian site hacked by Turkish hacker

- HackerBlog: Bitdefender (Portugal) exposes sensitive customer data

Updated Report
- Kaspersky breach: No user info lifted, auditor confirms

Military Control

You have not seen any of my posting for awhile, as i am busy serving my Military Liability for my country for the past few weeks. After going through tough training in the jungle for the past years and it is finally over.

Military bases these days are strict on restricting camera phone. Luckily, i have a spare non-camera phone.

While i was away, there was the news on hacking of SSL certificate that using MD5 hashing. Rogue Certificate Authority (CA) could be setup to distribute fake Secure Socket Layer (SSL) certificates that browsers would treat as legitimate.

Related Report:
- SecurityFocus: Group attacks flaw in browser crypto security

X-Force vs TrendMicro

Recently, there are several discussion and public criticism in the Internet after IBM ISS X-Force published advisories on their competitor's product (ServerProtect) and criticised them (TrendMicro) on how they handle those vulnerabilities.

According to the X-Force blog posting, they discovered a total of eight vulnerilities in Trend Micro ServerProtect. Some reported to TrendMicro as early as 2006 and the latest disclosed in January 2008. After every report, TrendMicro would assure ISS that it will be fixed in the next scheduled patch.

ISS claims that for all the vulnerabilities reported, TrendMicro either ignored them or the solution implemented was inadequate. They even found a patch that can be easily evaded. ISS also claims that everytime they reported the vulnerabilities to TrendMicro, documentation and links to MSDN articles were provided to assist them. When the communication with TrendMicro comes to "dead-end", ISS also try to communicate with them via CERT/CC and JP-CERT. But it also hit "dead-end".

After facing some many problems with TrendMicro and for the benefit of their customers, ISS X-Force decided to published those advisories with technical details.

There have been mixed reactions on whether ISS did the right thing by disclosing the vulnerability. Some have criticized ISS for breaking industry code and question them if they will do the same if their products was at fault.

Below are the IBM ISS X-Force Trend Micro ServerProtect Advisories:

- CVE-2006-5268 - Trend Micro ServerProtect Unauthenticated Remote Administration

- CVE-2006-5269 - Trend Micro ServerProtect [PROCEDURE NAME REDACTED] Heap Overflow

- CVE-2007-0072 CVE-2007-0073 CVE-2007-0074 - Trend Micro ServerProtect [PROCEDURE NAME REDACTED] Heap Overflows (3)

- CVE-2008-0012 CVE-2008-0013 CVE-2008-0014 - Trend Micro ServerProtect [PROCEDURE NAME REDACTED] Heap Overflows (3)


Related Report:
- Computerworld: IBM's ISS blasts security rival Trend Micro over bugs

- Frequency X blog: The Scoop on the X-Force TrendMicro Advisories

Anti Virus, can be "dangerous"

Recently, there are reports that AVG (anti virus) update deletes critical Windows XP file causing the system un-bootable.

Many users of AVG 7.5 and AVG 8.0 reported seeing a warning that the Windows system file 'user32.dll' was infected with the PSW.Banker4.APSA or Generic9TBN Trojans, with a recommendation that the file be moved to the program's vault and deleted.

With the file 'user32.dll' deleted/quarantined, Windows XP will no longer be able to boot up as it is a critical system file.

AVG has since admitted that the detection was a false positive. " Unfortunately, the previous virus database might have detected the mentioned virus on legitimate files. We can confirm that it was a false alarm," said a company spokesman.

A workaround under Topics 1574 False Positive user32.dll was published in their support website. (Shown on picture on the right)

Anyway, Anti Virus having false positive is not only unique to AVG. Major Anti Virus companies such as Symantec, Mcafee and Trend Micro also had reported to wrongly identity Windows system file previously. Some examples below:

- In May 2007, Symantec Anti Virus cripples thousands of Chinese systems when it mistakenly identify two critical Windows .dll files for malware (Related Article in "ComputerWorld: Symantec false positive cripples thousands of Chinese PCs")

- In September 2008, Trend Micro issued two anti-virus signatures that causes Windows DLL files to be quarantined. (Related Article in "ZDNet UK: Trend Micro gives false positive details")

- In October 2008, a faulty update from Mcafee led to an integral component of the Windows Vista operating system being falsely flagged as a trojan horse. (Related Article in "The Register: McAfee update classifies Vista component as a Trojan")


Related Articles:
- Vnunet.com: AVG update deletes critical Windows file

- The Register: AVG slaps Trojan label on core Windows file

WPA crack details finally out

These few days, people have been talking about WPA cracking and the detail of the crack is finally available for download.

The WPA crack was recently announced by 2 German researchers. They were planned to present their finding at the PacSec 2008 conference (12/13 Nov) in Tokyo. But the details on this crack was released today at Aircrack website in a whitepaper.

Wired Equivalent Privacy (WEP), the basic protection mechanism for wireless, was long being cracked. With the more advanced technique these days, it could be easily cracked with less than a minute.

Wi-Fi Protected Access (WPA), which replace WEP, is a more secure method to protect wireless network. Previous attack on WPA was basically launching dictionary attack against weak Pre-Shared Key used. This new crack on WPA will works against the WPA protected network that uses Temporal Key Integrity Protocol(TKIP). The attack is able to decrypt an ARP request or response and send 7 packets with custom content to the network after access for more than 12 minutes.

To summarised, the recommendation against the attack is to use WPA2, which uses CCMP instead of TKIP. If for any reason you are not able to migrate your network to WPA2, There are some other mitigation recommended such as reducing the renew key interval and increase your wireless detection stance and check for multiple MIC failure messages. (Reminder, please test it before making the change on your production environment)

You can download the Whitepaper "Practical attacks against WEP and WPA" from Aircrack or alternatively from local copy.


Related Articles:
- Security Focus: "Researchers find more flaws in wireless security"

US Election over but more Security lessons to learn

As the US election comes to an end,with Barack Obama being the first black president of United States, there are some interesting things that we can learn from this election.

Months before the election, there were already many concerns on the electronic voting machines. There were reports on "flipping votes" (marking a vote for a different candidate than the one selected) and interface that was misleading, which worried the security experts. These had lead to the push for better checks and audit on those voting machines.

The advises that were given to the voters were to double-check on their votes. When in doubt, not to be afraid to ask for help during the voting.

Beside the problem with the voting machines, there were also reports on ways or "dirty tricks" used to influence the result of the election. There were reports of automated phone calls, sms, email or even flyers intended to convince the receiver that they should vote the day after the election, or providing false polling venue so that they will miss the voting day and their chance to support the candidates (useful on those states that pro their opposition).

- An example of those email:
From: Office of the Provost
Subject: Election Day Update

To the Mason Community:

Please note that election day has been moved to November 5th. We apologize for any inconvenience this may cause you.

Peter N. Stearns
Provost
- End of email

- An example of those SMS:
"Due to long lines if you are voting for Barack Obama you can vote tomorrow"

"Due to long lines, all Obama voters are asked to vote tomorrow".
- End of SMS

While some trying to influence the election results, others were using this election to send out malwares. Emails that were claiming to contains Obama's speech or interview were found to be spamming over the Internet. Video or download links will lead users to download the malware while trying to click on the speech or interview.

Currently the malwares that were found from those email were a keylogger that will sends the stolen keystrokes to the Ukraine and a trojan downloader that will automatically download more malwares into your system.

- An example of those email
From: news@cnn.com
Subject: Barack Obama wins

Barack Obama Elected 44th President of United States

Barack Obama, unknown to most Americans just four years ago, will become the 44th president and the first African-American president of the United States.
Watch His amazing speech at November 5!

Proceed to the election results news page>>

2008 American Government Official Website
This site delivers information about current U.S. Foreign policy and about American life and culture.
- End of email


Every election is not as simple as what we think. There are always someone who is trying ways to manipulate the results, trying to make use of the situation for their own benefit. Just don't blindly focus on the results. Be mindful of others that is taking advantage of the situation.

Related Articles:
- Concerns continue to shadow e-voting (Security Focus)

- Election Hoax Sent Via D.C. Based E-Campaign Group

- US Presidential Malware - Barack Obama Interview Lure (WebSense Alerts)

Wireshark 1.0.4 is out

Wireshark (formerly known as Ethereal) had released a new version (1.0.4). The free and most popular network protocol analyzer, among IT professional, had fixed on several security vulnerbilities and program bugs in this new version. No updates on the features but some improvement on the protocol supported.

The details on the updates and patches can be found in this URL - http://www.wireshark.org/docs/relnotes/wireshark-1.0.4.html

This release can be downloaded from their official Website - http://www.wireshark.org/download.html