CyberInsecure.com

Archive for December, 2009

Security researchers warn that the Fox Sports website has been compromised by unknown attackers, who injected malicious code into a custom error page. There are two separate offensive script tags, each of them created by a different infection.

The page was detected by the ThreatSeeker Network system developed and operated by Websense, a Web security vendor. Security researchers investigating the suspicious link determined that it was pointing to a custom “Page not Found” document, displayed in case of a 404 error.

Webmasters deploy such pages in order to help visitors who are looking for a Web resource that is no longer available. They include suggestions or search boxes that can be used to find the new location of the document.

The msn.foxsports.com website is operated by the Fox Sports division of the Fox Broadcasting Company and according to Alexa, it is in the top 330 websites in the world as far as traffic goes. This website is ranked at position 88 in the United States and is part of the MSN network.

The first malicious script tag loads a script for an external domain used in cybercriminal operations before. In particular, this script is part of the latest version of a mass injection attack known as Gumblar. Highly obfuscated code is used to perform various checks to determine a visitor’s browser, operating system or installed software, and then execute exploits for known vulnerabilities.

“After deobfuscation, the page uses PDF and Flash exploits to run malware in order to control a victim’s computer. In addition, a piece of VBScript is executed to download malware,” the Websense researchers explain.

The secondary script tag loads a potentially malicious JavaScript file from a .cn domain. However, the server hosting this threat was offline and the security analysts couldn’t determine its nature. The Fox Sports page seems to be clean now, but there is no way of telling for how long this infection ran until it was discovered.

It is worth noting that a similar issue was found on the MSN Canada website back in June. In that case, a redirect page, invisible to the user, but parsed by the browser, was infected with malicious code.

Credit: Softpedia.com

The unveiling of a GSM (Global System for Mobile Communications) encryption codebook compiled by a German security researcher and his team of collaborators lowers the bar significantly for the amount of money and technical expertise required to listen in on a GSM-based mobile phone call. More importantly, it illustrates just how old the current GSM encryption is and demonstrates why it’s time for an upgrade.

Law enforcement officials and well-financed cyber criminals have been able to crack GSM encryption for sometime, but the investment was so high that it didn’t pose much of a threat. This new method lowers the price of entry to the point that it is more of an issue, but still not a high risk.

Karsten Nohl announced that he and his team have compiled 2 terabytes worth of GSM encryption data. PC World’s Robert McMillan explains that the results are like “cracking tables that can be used as a kind of reverse phone-book to determine the encryption key used to secure a GSM (Global System for Mobile communications) telephone conversation or text message.”

GSM is the most widely-used mobile phone technology in the world–accounting for over 80 percent of the world’s 4.3 billion mobile phones. The encryption algorithm that protects GSM-based calls from being intercepted and eavesdropped is more than twenty years old, though.

Time is the enemy of encryption. When a new encryption algorithm is developed and claimed to be impenetrable, or that cracking it is so impractical as to not be plausible, those claims are based on current technology. As technology improves, the mainstream consumer computers of tomorrow eventually have the processing capacity of yesterday’s mainframes and suddenly the processing power required to crack the encryption becomes trivial.

As an analogy, think of encryption like a jigsaw puzzle where you have to find one specific puzzle piece. If the puzzle only has 25 pieces, it won’t take you too long to accomplish. That is like a weak encryption algorithm. However, if the puzzle has 10,000 pieces it will take significantly longer.

As time goes on, though, you gather more people to join in the process and develop new strategies to sift through the pieces faster and compress the time required to look through the 10,000 pieces. That is similar to the way difficult encryption algorithms eventually become simple to crack.

There is also always the possibility of a lucky guess. The encryption cracking estimates are based on the amount of time it would take to work through every possible combination and permutation of characters to determine the encryption key. But, you could theoretically find the right key on the eighth try rather than the ten thousandth.

The fact that the A5/1 algorithm used to encrypt GSM handsets is more than two decades old and still chugging along is a testament to the strength the algorithm had at its inception. The mobile phone industry should consider itself lucky that this is only now becoming an issue.

For now, the methods revealed at the Chaos Communication Conference in Berlin still require a fairly hefty investment in technology likely to discourage any casual GSM hacking. But, the mobile phone industry as a whole needs to address the weakness of the geriatric A5/1 encryption algorithm before breaking it becomes so trivial that the encryption is completely useless.

Credit: PCworld

People flocked to Google Wednesday evening to figure out what was happening with the UltraDNS service, which suffered a DDoS attack at the height of the last-minute shopping season.

An attack directed at the DNS provider for some of the Internet’s larger e-commerce companies–including Amazon, Wal-Mart, and Expedia–took several Internet shopping sites offline Wednesday evening, two days before Christmas.

Neustar, the company that provides DNS services under the UltraDNS brand name, confirmed an attack took place Wednesday afternoon, taking out sites or rendering them extremely sluggish for about an hour. A representative who answered the customer support line said the attacks were directed against Neustar facilities in Palo Alto and San Jose, Calif., and Allen Goldberg, vice president of corporate communications for Neustar, confirmed that at about 4:45 p.m. PST, “our alarms went off.”

Goldberg said the company received a disproportionately high number of queries coming into the system, and analyzed it as an attack. Neustar deployed “a mitigation response” within minutes of the attack, he said, and brought matters under control within an hour. The response limited the problems to Northern California, he said.

In addition to the high-profile sites, dozens of smaller sites that rely upon Amazon for Web-hosting services were also taken down by the attack. Amazon’s S3 and EC2 services were affected by the problems, according to Jeff Barr, Amazon’s lead Web Evangelist, who retweeted a report to that effect without clarification and confirmed it in later tweets.

For a brief period Wednesday evening, “ultradns” was the top search term on Google, likely as frantic technicians at Web sites attempted to figure out what was going on with their sites.

Web sites need DNS providers to translate the character-based URLs that people can remember to the IP addresses that Web sites actually use to list themselves on the Internet. When a DNS provider is overwhelmed with malicious requests for IP addresses, the system can overload and prevent legitimate users from reaching their destinations.

Amazon’s Web Services Health Dashboard declared an all-clear around 6:40 p.m. PST, saying that DNS resolution had returned to normal. Amazon and several other big sites seemed to recover around 5:40 p.m., but some other sites continued to report problems until around 6 p.m.

Needless to say, the timing of such an outage could not have been much worse, as holiday procrastinators rushed to make sure they could get one-day shipping for gifts to be delivered before Christmas Day on Friday.

UltraDNS suffered a similar attack earlier this year, which took out Amazon, Salesforce.com, and other sites. Goldberg described Wednesday’s attack as smaller than that one, in that it affected fewer customers.

However, Amazon is no small customer. Goldberg declined to comment on specific customers affected by the outage, and said Neustar had not yet determined the source of the attack.

One expert thought the attack might have been more widespread.

“This was wider than just UltraDNS,” said Bill Woodcock, research director at Packet Clearing House, which operates domain name servers and supports Internet exchange points around the globe.

“It’s difficult to tell at this point how much is a DDoS attack and how much is collateral damage from the attack that is being felt in other ways,” like a domino effect, he said. “There were routing problems at some major European exchanges at the same time that caused major Internet service providers’ routers to encounter a higher load and pass fewer packets.”

Credit: CNET News, Webware

A Romanian hacker who goes by the handle “unu” has struck again: this time, he demonstrated how a SQL injection vulnerability left personal information in the form of passports exposed on an Intel Corp. Website.

Unu, who previously exposed SQL injection vulnerabilities in The Wall Street Journal and Kaspersky Lab’s Websites, this time focused on an Intel site that runs online registrations for channel partner events. The site, which is currently down, has a message posted that it’s offline for maintenance.

An Intel spokesperson says the company has taken down the site and is “investigating the matter.”

In his blog post on the Intel site’s vulnerability, unu says: “Not only is the website vulnerable to sql injection but it also allows load_file to be executed making it very dangerous because with a little patience, a writable directory can be found and injection a malicious code we get command line access with which we can do virtually anything we want with the website: upload phpshells, redirects, INFECT PAGES WITH TROJAN DROPPERS, even deface the whole website.”

He was able to hack into the front-end Web application and then discovered that server administrators had their passwords stored in clear text, according to the post.

Security experts at Praetorian Security Group who analyzed Unu’s hack say most alarming about the hack is a screenshot that appears to show people who registered for an event, along with their passport numbers, birth dates, and credit card types. “Unu acknowledges that he simply is not showing the credit card numbers, expiration dates, and CW/CID codes but they are also in the table,” they blogged.

Daniel Kennedy, a partner with Praetorian, says the site had been defaced before by someone else before. “So Intel or the supporting vendor has to take a long look at who besides Unu could have been in that database,” Kennedy says.

“Intel realistically has to notify everyone who could be affected … this is passport and credit card data,” he says.

Credit: DarkReading.com, unu123456.baywords.com

Cybercrime affiliates of unlicensed pharmaceutical websites have begun moving on from attacks purely designed to poison Google search engine results, and are now targetting Microsoft’s web properties.

Search engine poisoners are actively making use of Microsoft’s Windows Live Spaces blog hosting environment, net security firm eSoft reports. Miscreants are creating accounts which they use only to push links to the pharma-fraud sites. As a result the search engine ranking of these spamvertised sites is pushed up.

In addition, spam emails contain the URLs of fake blogs, from which surfers are redirected onto penis pill sites. The tactic is designed to evade spam filters that might already have blacklisted the fraudulent website.

The misuse of fake blogs on Live Spaces is a refinement of the well established practice of link spamming: posting “comments” on legitimate blogs that supply links to dodgy pharmaceutical websites and the like.

Attacks similar to the Live.com blogspamming for fraudulent pharmacy sites have also recently been thrown against both Yahoo and Blogger sites, eSoft adds. The security firm adds that the recent Google job spam scam also infiltrated Microsoft’s Life Space environment.

Whatever the distribution method, its clear these cybercriminals will continue to evolve new ways of advertising their bogus sites. An alert by eSoft containing screen shots of the fake pharma punting blogs that have begun affecting Live Spaces can be found here.

Credit: The Register, Threat Center Live Blog

The malware writers and criminals who run botnets for years have been using shared hosting platforms and so-called bulletproof hosting providers as bases of operations for their online crimes. But, as law enforcement agencies and security experts have moved to take these providers offline, the criminals have taken the next step and begun setting up their own virtual data centers.

IP address space allocation is handled by five regional Internet registries (RIR), each of which is responsible for a particular group of countries. The RIRs work with large enterprises, ISPs, telecoms and other organizations that need large blocks of IP space. These organizations typically have to go through an application and screening process in order to get these allocations, including providing legal documentation listing the officers of the company, its business and why the address space is needed.

And that’s the way it’s supposed to work everywhere. Applicants who can’t show a need for the IP space are told politely to take a walk. But in some cases, criminals have found a way around this by going through local Internet registries (LIR) or by taking advantage of RIRs that don’t have the resources to investigate every application as fully as they’d like.

The criminals will buy servers and place them in a large data center and then submit an application for a large block of IP space. In some cases, the applicants are asked for nothing more than a letter explaining why they need the IP space, security researchers say. No further investigation is done, and once the criminals have the IP space, they’ve taken a layer of potential problems out of the equation.

“It’s gotten completely out of hand. The bad guys are going to some local registries in Europe and getting massive amounts of IP space and then they just go to a hosting provider and set up their own data centers,” said Alex Lanstein, senior security researcher at FireEye, an antimalware and anti-botnet vendor. “It takes one more level out of it: You own your own IP space and you’re your own ISP at that point.

“If there’s a problem, who are you going to talk to? It’s a different ball game now. These guys are buying their own data centers. These LIRs and RIRs aren’t going to push back if you say you need a /24 or /16. They’re not the Internet police,” Lanstein said.

The most famous example of this is the Russian Business Network case, in which a group of criminals was able to get a large amount of IP space by using an LIR to get an allocation from RIPE, the European RIR. The LIR gave RIPE documentation that supposedly showed a need for the allocation, and that’s as far as it went.

“It is impossible at that stage in the process for the RIPE NCC to determine that a company is involved in illegal activity. The member in question later proved to be a front for RBN,” RIPE said in a statement on the case. But the allocation was made in 2006 and it wasn’t until May 2008 that RIPE was able to close down the LIR and get the IP space back.

In most regions, a new organization requesting a large allocation will have to go through a fairly rigorous process to show the need for the address space. The RIR staff often will request a listing of each machine the organization has and may go as far as to request purchase receipts for the machines, as well, said John Curran, president and CEO of the American Registry for Internet Numbers (ARIN), which is responsible for the U.S., Canada and parts of the Caribbean.

Criminals subverting this process has become a major problem in some regions, particularly parts of Europe and the Caribbean, where there are dozens of jurisdictions and multiple languages, which can lead to confusion and difficulty in tracking down exactly who is doing what online, security experts say.

“There are a lot of instances where they don’t go past the letter of justification,” Lanstein said. “There are plenty of IP allocations I can pull up and look at the domains and see that they’re total BS. U.S. data centers are much better, but in Europe there are so many languages and countries, it’s impossible for them to check everyone. And the bad guys know this.”

This set-up has become a useful tactic for the criminals running botnets and large spam and carding operations. Attackers who own their own large blocks of IP space have a much easier time hiding their activities than do criminals who have to go through legitimate ISPs or hosting providers. There’s no abuse desk to complain to, no recourse for people who find themselves being attacked by a given range of IP addresses.

“The policies for handing out IP space and verifying the people behind and application are global, they apply to all of the RIRs. But within that framework, there’s room for RIRs to set their own local policies too,” said Curran. “The bad news is, those policies are very local. How does someone verify an organization when in some regions they may only have written records and it’s a town of 2,000 people? It’s very difficult in Africa, parts of Europe, parts of the Caribbean. It’s very much the case that parts of our process are very hard to implement in other regions. Other regions have different ways of recording how a company is formed and they recognize very informal structures. The record-keeping is decentralized and it might take a while to determine who is behind a company.”

And once the IP space has been allocated, getting it back can be a long and arduous process. Criminals often will use a certain IP block for as long as it’s useful and profitable for them. But if security researchers and ISPs notice suspicious activity in a certain block, they will sometimes stop accepting traffic from it and block any traffic from their own networks to that block. This can be an effective tactic, but once the criminals abandon the IP space, it can take a long time for a legitimate business to be able to get traffic flowing there again.

“This is part of the problem that’s causing the IPv4 shortage,” Lanstein said, referring to the imminent exhaustion of the IPv4 address space, forecasted to occur in less than two years. “They stop paying the bills, the space gets null-routed and then it’s a mess. There’s clear fraud going on, but who can do something about it?”

Credit: ThreatPost.com

A security researcher has identified more than 8 million Adobe Flash files that make the websites hosting them vulnerable to attacks that target visitors with malicious code.

The Flash files are contained on a wide variety of sites operated by online casinos, news organizations, banks, and professional sports teams. They make the pages where they reside susceptible to XSS, or cross-site scripting, attacks that have the potential to inject malicious code and content into a visitor’s browser and in some cases steal credentials used to authenticate user accounts.

The researcher, who goes by the moniker MustLive, said the Flash files contain poorly written ActionScript used to count the number of times a banner has been clicked and typically contain the clickTAG or url parameters. Google searches identified a total more than 8.3 million of them on sites hosted by the New York Giants football team, Praguepost.com and ParadaisPoker.com. Because Google results are often abbreviated, the actual number is probably higher.

MustLive said websites that host the buggy content aren’t automatically vulnerable to XSS exploits. Indeed, even though the pages on the official Citibank website included such content, XSS attacks that tried to exploit them failed.

But the researcher provided a wealth of examples of websites that were made vulnerable by the Adobe files, which provide graphics that move and are often referred to as SWFs, because of the three-letter suffix their file names carry.

It’s by no means the first time someone has identified a sprawling body of SWF files that threaten the security of the sites hosting them. Two years ago, researchers documented serious vulnerabilities in Adobe-based content that exposed more than 10,000 sites to attack.

The threat was particularly difficult to eradicate because webmasters had to patch their content-generation software and then render the animation scripts all over again. Months after the problem was identified, many websites still hadn’t bothered to take action.

Last year, MustLive reported 215,000 vulnerable Flash files, a number he later raised to the millions. That content was also made vulnerable by buggy ActionScript.

It should be said that the vulnerabilities exposed in the latest discovery are the result of bugs introduced by sloppy rendering, rather than vulnerable Adobe software. Adobe provides security guidance for designing banners with tracking capabilities.

Credit: The Register

Intel has released a patch for its series of silicon-based security protections after researchers from Poland identified flaws that allowed them to completely bypass the extensions.

The implementation errors in Intel’s TXT, or trusted execution technology, mean the feature can’t be counted on as advertised to protect sensitive files and prevent systems from booting operating systems that have been tampered with. The vulnerability affects the Q35, GM45, PM45 Express, Q45, and Q43 Express chipsets.

“We again showed that an attacker can compromise the integrity of a software loaded via an Intel TXT-based loader in a generic way, fully circumventing any protection TXT is supposed to provide,” researchers with the Invisible Things Lab stated in a press release issued Monday.

The researchers laid out a variety of ways their software-only attack could defeat the security measures, which Intel has built into its vPro-branded processors and held out as a way for large corporate customers to make their servers and PCs more resistant to criminal hackers. One TXT feature that can be overridden is a setting that restricts the use of USB-based flash drives. The researchers also said that attacks could allow them to defeat procedures for securely launching applications and encrypting hard disk contents.

The attacks exploit implementation errors in Intel’s SINIT Authenticated Code modules, which are digitally signed pieces of code that can’t be modified. The researchers brought the defects to the attention of Intel officials in late September and agreed to withhold publication of their findings until the chipmaker was able to patch the vulnerability.

In July, the researchers presented research that showed how to attack another Intel technology known as AMT, or active memory technology, using what’s known as a Ring -3 rootkit.

Credit: The Register

Twitter.com was down Thursday evening, and it appears that the microblogging site may have been a victim of DNS hijacking.

The site, which was inaccessible for about an hour starting around 10 p.m. PST, was defaced with the following image before it was taken offline:

The message at the bottom of the image appears to be written in Perso-Arabic script and when translated to English it read:

Iranian Cyber Army

THIS SITE HAS BEEN HACKED BY IRANIAN CYBER ARMY

iRANiAN.CYBER.ARMY@GMAIL.COM

U.S.A. Think They Controlling And Managing Internet By Their Access, But THey Don’t, We Control And Manage Internet By Our Power, So Do Not Try To Stimulation Iranian Peoples To….

NOW WHICH COUNTRY IN EMBARGO LIST? IRAN? USA?

WE PUSH THEM IN EMBARGO LIST

Take Care.

Twitter’s status blog was also inaccessible.

A Twitter update message posted at 11:28 p.m. said the site was “working to recovery from an unplanned downtime” and indicated that the incident was indeed a hijacking of Twitter’s DNS records:

Twitter’s DNS records were temporarily compromised but have now been fixed. We are looking into the underlying cause and will update with more information soon.

Security has been a thorny issue for Twitter in the past. In January, a hacker hijacked CNN anchor Rick Sanchez’s feed and proclaimed the journalist was “high on crack.” Twitter users have also been the target of a password-stealing phishing scam. Disguising itself as a private message that led to a fake Twitter log-in screen, the scam was widespread enough for Twitter to put a warning message on all members’ home pages alerting them of the issue.

Certainly, there is a contentious history between Twitter and Iran. In the wake of supposed results of that nation’s presidential election in June, protesters in Iran used Twitter to skirt government filters to report events, express outrage, and get people out to opposition rallies. Twitter even rescheduled some planned downtime in order to stay accessible for Iranian users in the midst of political upheaval at the request of the U.S. Department of State.

Currently Twitter Blog says:

As we tweeted a bit ago, Twitter’s DNS records were temporarily compromised tonight but have now been fixed. As some noticed, Twitter.com was redirected for a while but API and platform applications were working. We will update with more information and details once we’ve investigated more fully.

Credit: CNET News

Hackers on Thursday exploited a vulnerability on Ain’t It Cool News (http://aintitcool.com) that redirected anyone visiting the movie review site to a server containing a malicious Adobe Reader file.

The attack targeted a vulnerable PHP script on one of AICN’s servers that automatically appended the malicious link to banner ads served on the site, its publisher, Roland De Noie, said. As a result, anyone visiting the site over a 90-minute period on Thursday morning was silently redirected to speedconnection.cn which served a malicious file named annonce.pdf.

The booby-trapped PDF, according an analysis by researchers at Praetorian Prefect, exploited two vulnerabilities in Adobe Reader that the company has already fixed. When the file is opened by unpatched versions of Reader, it launches malicious shell code that hijacks the machine. Only 12 of the 41 major anti-virus programs currently detect the trojan, according to VirusTotal analysis.

In September, Mozilla found that more than half of Firefox users used insecure versions of Adobe Flash. It wouldn’t be surprising to find a similarly large proportion of the population using out-of-date versions of Reader, too.

“The point of weakness was actually our own ad server,” De Noie said. The unknown attackers “had cracked through a PHP server flaw and appended this link to all the ads.”

AICN has yet to warn its users that they may have been attacked. De Noie said his staff was still collecting information. The attack came as a shock to some AICN readers, many who consider themselves enthusiasts of science-fiction, fantasy and horror films.

Credit: The Register