CyberInsecure.com

Archive for August, 2009

Trend Micro reports the discovery of a spyware (detected as TSPY_EBOD.A by Trend Micro) purporting to be an Adobe Flash Player update. Upon execution, the spyware creates a Firefox add-on called “Adobe Flash Player 0.2,” the installer of which uses JavaScript (detected as JS_EBOD.A) and appears to spread via forum posts.

The add-on injects ads into the user’s Google search results pages. More disturbing, however, is its capability to monitor the user’s browsing activities, particularly his/her Google search queries using the Firefox browser. It then sends the information it gathers to http://******jupdate.com.

Malware targeting Internet Explorer is probably one of the reasons why a huge number of users are opting to use alternative browsers such as Firefox, Chrome, Safari, and Opera instead. Though this used to be considered a safe computing practice before, it seems it no longer is with the proliferation of malware targeting the most popular alternative Internet browser, Firefox.

Users should be wary, as always, of downloading updates from unknown sources. They should also note that no browser is safe from malicious attacks as cybercriminals will do just about anything to infect users with their malicious code.

Credit: TrendLabs Malware Blog by Trend Micro

Earlier this week, Swiss programmer Ruben Unteregger who has been reportedly working for a Swiss company ERA IT Solutions responsible for coding government sponsored spyware, has released the source code of a trojan horse that injects code into the Skype process in order to convert the incoming and outgoing voice data into an encrypted MP3 available at the disposal of the attacker.

When the trojan, currently detected as Trojan.Peskyspy, executed, it injects a thread into the Skype process and hooks a number of API calls, allowing it to intercept all PCM audio data going between the Skype process and underlying audio devices. Since the Trojan listens to the data coming to and from the audio devices, it gathers the audio independently of any application-specific protocols or encryption applied by Skype when it passes voice data at the network level.

The incoming and outgoing audio data are stored in separate .mp3 files. The Trojan also opens a back door on the compromised computer, allowing an attacker to perform the following actions:
- Send the .mp3 to a predetermined location
- Download an updated version
- Delete the Trojan from the compromised computer”

Skype is often dubbed a “national security threat” by governments all across the globe due to their — at least publicly acknowledged inability — to crack the 256-bit encryption VoIP calls.

And while some of these governments are reportedly spending surreal amounts of tax payer’s money (Rental of the Skype-Capture-Unit per month and instance EUR 3.500) in order to achieve their objectives, others are taking the cost-effectiveness path by attacking the weakest link in the process - the end user infected with a targeted DIY government sponsored spyware recording all ongoing and incoming Skype calls, thereby bypassing the need to attack the encryption algorithm.

Credit: ZDNet.com Security Blogs

Multiple serious security flaws in the Google Chrome browser could expose users to code execution attacks, according to an advisory released today.

The flaws, rated “high risk,” have been addressed in Google Chrome 2.0.172.43, which is released automatically to Chrome users.

Vulnerabilities include:

CVE-2009-2935 (High Severity): A flaw in the V8 Javascript engine might allow specially-crafted Javascript on a web page to read unauthorized memory, bypassing security checks. It is possible that this could lead to disclosing unauthorized data to an attacker or allow an attacker to run arbitrary code. Technical details are being withheld until the fix is shipped to a majority of Chrome users. An attacker might be able to run arbitrary code within the Google Chrome sandbox

CVE-2009-2416 (High Severity) Pages using XML can cause a Google Chrome tab process to crash. A malicious XML payload may be able to trigger a use-after-free condition. Other tabs are unaffected. An attacker might be able to run arbitrary code within the Google Chrome sandbox.

With this update, Google Chrome will no longer connects to HTTPS (SSL) sites whose certificates are signed using MD2 or MD4 hashing algorithms. These algorithms are considered weak and might allow an attacker to spoof an invalid site as a valid HTTPS site, Google explained.

Credit: ZDNet.com Security Blogs

Malicious hackers have managed to infect about 57,000 web pages with a potent exploit cocktail that targets a variety of vulnerable applications to surreptitiously install malware on visitor machines.

The exploits install an assortment of nasty software, including Gologger, a keystroke logging trojan, and a backdoor that attempts to connect to a website hosted in China, according to Mary Landesman, a researcher at ScanSafe, a company that protects end users from malicious websites.

The attackers were able to plant a malicious iframe in the pages by exploiting SQL injection vulnerabilities. Once in place, the script silently pulls down javascript from a0v.org that silently runs while people are visiting one of the infected websites. Affected sites included health care organizations such as the New York Methodist Hospital, charitable and nursing facilities such as howellcarecenter.com, sweetgrassvillagealf.com, foodsresourcebank.org, and morningsideassistedliving.com, and others.

The vast majority of search results returned by Google and Yahoo failed to detect the threat despite the use of technology on both sites that’s supposed to prevent users from clicking on malicious links.

Once called, the malicious javascript contacts one of a half-dozen other domains that actually serve the exploit code. The sites were registered on August 3, so it’s clear the attack is less than three weeks old. ScanSafe has been blocking the attack since August 14.

Web infections are an increasingly common way for criminals to get their malware installed on end-user machines. Because the attacks occur while people are visiting sites they know and are often operated by reputable businesses and charities, few victims have any reason to suspect what’s happening behind the scenes.

Landesman said in an email that she’s been tracking a separate mass infection that in late June was used to deliver exploits targeting a zero-day ActiveX vulnerability. While the number of infected sites was once in the millions, it has since slipped to about 70,000.

SQL injection attacks exploit weaknesses in web applications that fail to adequately scrutinize text that users enter into search boxes and other web fields. The attacks have the effect of passing powerful commands to the website’s back-end database.

Credit: The Register

Ilomo has been present in the malware landscape since at least the end of 2005, making it a veteran of the modern malware era. During that time it has changed its code constantly with an emphasis being placed on making the malware very difficult to reverse engineer, and also with the goal of staying under the radar. As with all malware it has picked up several names over that time but the most common are Ilomo, Clampi, Ligats or Rscan.

Ilomo botnet has being active without attracting too much unwanted attention from the security industry. Like Pushdo botnet, the Ilomo threat is quite modular in nature which makes it difficult to see the actions of the overall threat. Added to this is the fact that it uses a commercial virtual machine obfuscator, significantly adding to the effort involved in reverse engineering the malware binaries.

Ilomo has two key components to its business plan. The first is good old fashioned information stealing. Ilomo injects its code into the browser and monitors the internet connection waiting for the user to connect to one of over 4000 banking, financial or webmail sites. Not content with simply stealing the user’s credentials, Ilomo can also “piggyback” on the user’s session – transferring funds from an infected user’s account and making a mockery of the bank’s secure login system. Ilomo will also harvest all other login credentials from the machine – ftp, web servers, local administrators etc. These are then used to spread itself across the network and to take control of web servers online, which it will use to host new versions of the malware.

Ilomo‘s second source of revenue is selling “anonymity as a service”. Every infected Ilomo machine acts as a proxy so that criminals can route their illegal activities through different networks and countries. In addition to hiding the criminals identity this proxy network is very useful for defeating another defense built into many banking sites – namely that they can only be accessed from certain countries. If a criminal needs to access a Brazilian bank, they simply use an infected Ilomo machine in Brazil to route the connection.

More information and detailed technical aspects can be found here.

Credit: TrenLabs Malware Blog By TrendMicro

Tayside Police have restored their website following an embarrassing defacement late last week.

Surfers visiting the site from late afternoon on Thursday were confronted by a defacement, claimed in the name of Scottish comedian Frankie Boyle, and accompanied by notes more in the style of Irvine Welsh than Jim Taggart.

The text included in the defacement suggests the site - tayside.police.uk - was compromised via poor password security, though this remains unconfirmed.

Defacement of a website is the online equivalent of spraying graffiti and rarely carries more serious implications. As well as an unusual amount of technical detail, the defacement contains a joke that wouldn’t be too out of place on the Edinburgh Festival Fringe.

Alongside the usual greeting to fellow defacement crews the text goes on to say that the site was hacked by “the paisley young team” who have “more asbos than yer maw!”.

Tayside Police is the website for police in Dundee, Perth and Kinross, and surrounding areas. Netcraft reports that the tayside.police.uk site runs using Apache on a Linux platform.

Credit: The Register

Out to steal online gold and other assets worth real money, scammers are stepping up attacks on World of Warcraft players, according to security researchers.

A researcher from anti-virus firm Webroot has explained how official forums offered by WoW creator Blizzard are being used to spread links that lead to malware, which steals passwords and other game credentials. The scam employs the common technique of telling visitors that their Adobe Flash player needs to be updated and then offering a malicious trojan instead of the real installation file.

Elsewhere, phishers are churning out emails that purport to be official communications from Blizzard, according to researchers from security provider Sophos. The emails claim the game maker is launching a new service and invites them to click on a link for a free sneak peak. The resulting website, in turn, phishes user credentials.

The attack outbreaks come a few weeks after Blizzard issued an update for Warcraft III that fixed a gaping hole, which could lead to the complete hijacking of machines running the real-time strategy game. According to Webroot researcher Andrew Brandt, it was exploited simply by getting vulnerable victims to join a custom game hosted with booby-trapped maps.

Attackers targeted the vulnerability in a game called DotA, or Defense of the Ancients, by creating fake maps that used the same file configurations as legitimate custom maps.

“What makes this exploit particularly nasty is the fact that your PC gets infected the moment you join a game where the infected DotA map is in use,” Brandt wrote. “Once downloaded, the game automatically unpacks the infected map and executes the malicious code.”

In April, Blizzard took the drastic step of advising players steer clear of all custom games until a patch could be released. With the hole plugged, attackers are falling back on other ways of preying on players.

Credit: The Register

Users of Pidgin and other alternative IM clients need to update their software following the discovery of potentially serious security flaws.

Pidgin, Finch, Adium, Meebo, and Gaim are all vulnerable to a flaw that stems from a bug in Libpurple, library software for multi-protocol support that’s used by many IM clients. The vulnerability stems from bugs in the software function that handles instant messages from the MSN network. The flaw was discovered by CORE Security.

The flaw is particularly serious because all it takes to take advantage of the vulnerability is a message from a regular MSN user, not necessarily on a targeted user’s buddy list, the SANS Institute Internet Storm Centre warns.

Users are advised to update to an IM client that uses non-vulnerable versions of Libpurple (version 2.5.9 or above). For Pidgin, the most common of the alternative IM packages affected, that means updating to version 2.5.9 as explained at http://www.pidgin.im/news/security/?id=34.

The issue provides further evidence that users of alternative client software may remove themselves from the main line of attacks but not from the need to patch their systems.

Credit: The Register

For the past five months, a website for investment services giant Ameriprise Financial (http://www.ameriprise.com) contained bugs that allowed even low-level criminals to inject malicious content into official company webpages and steal user’s cookies, according to a web security expert.

The XSS, or cross-site scripting, flaws made it possible for phishers to send Ameriprise customers bona fide links to the Ameriprise website that opened pages that intermingled counterfeit content with legitimate text and graphics. The holes could also allow criminals to steal browser cookies used to authenticate online accounts.

In the five months since Russ McRee of HolisticInfoSec.org first identified the bugs, Ameriprise offered customers statements which assures visitors that “no one without the proper web browser configuration can view or modify information contained on our systems.” And yet, not one of the half-dozen warnings McRee sent was answered.

“The reality is that not enough of these companies at that level, particularly in the financial sector, properly do intake for vulnerabilities,” said McRee. “There should be something on their site that says ‘If you see a security issue on our site, please report it.’”

It was only earlier this week that federal prosecutors revealed that another garden-variety web vulnerability, known as an SQL injection, was the chink that allowed Albert Gonzalez and other hackers the toehold they needed to steal more than 130 million credit card numbers from card processor Heartland Payment Systems and four other companies. Like SQL injection flaws, XSS vulnerabilities have been around for more than a decade and are routinely discounted as insignificant by many of the websites plagued by the bugs.

Indeed, Benjamin Pratt, Ameriprise’s vice president of public communications, played down the severity of the bugs brought to his attention, saying they affected only one portion of the company’s site.

“It’s an important point to note that none of our client data can be exposed by this,” he said shortly after being alerted to the bug. “There’s no one at risk here. Like any other vulnerability, we’re aware of it and we’re moving as quickly as we can to repair it.”

He said Ameriprise officials have no way of verifying that the bugs were reported as long ago as March, but in any event he said that there are no plans to review any of the mechanisms the company may have in place to receive notifications from the public about website vulnerabilities.

“There are plenty of customer service and other phone numbers available on our website,” he said. “I can’t speak to that specific experience.”

It’s not the first time a major financial services company has been caught sitting on a bug that could undermine the security of its online customers. In December, web application developers fixed several XSS holes on the website of American Express, more than two and a half weeks after McRee reported them to company representatives.

That bug was particularly embarrassing because Amex is a founding member of the PCI Security Standards Council, the group that sets the rules governing the Payment Card Industry. According to the rules, sites that suffer from XSS vulnerabilities are not compliant with payment card industry data-security standards.

Both Internet Explorer version 8 and Firefox running the NoScript add-on were immune to the attacks, thanks to built-in safety mechanisms.

Such web-application flaws are often easy to fix because they require only a line or two of code to be changed. Sure enough, Ameriprise repaired its site less than two hours after The Register notified company representatives of the vulnerabilities.

Credit: The Register

Just one week after Microsoft issued a fix for a worm hole in the Windows Internet Name Service (WINS), malicious hackers have started launching attacks against unpatched systems.

The attacks, first spotted by the SANS Internet Storm Center, are hitting Microsoft Windows users who have not yet applied the MS09-039 update.

The MS09-039 update, released earlier this month on Patch Tuesday, is rated “critical” and Microsoft warned at the time that it expected to see dangerous exploit code within 30 days.

According to SANS ISC, there has been a sharp spike in Internet activity associated with TCP Port 42 in recent days. The vulnerability in question allows remote code execution attacks via specially crafted WINS replication packet to an affected system running the WINS service.

According to the IDG News Service, the attacks are originating from IP addresses in China.

Credit: ZDNet.com Security Blogs