CyberInsecure.com

Archive for April, 2010

Microsoft says it’s investigating a security flaw in older versions of its SharePoint Server product that an independent researcher says can easily expose sensitive data and user authentication credentials.

The XSS, or cross-site scripting, vulnerability has been confirmed in SharePoint Server 2007 and is likely also present in earlier versions of the content management system software, an advisory from High-Tech Bridge warned. It allows adversaries to inject malicious javascript into the application by appending commands to the address of the targeted system.

“The vulnerability exists due to failure in the ‘/_layouts/help.aspx’ script to properly sanitize user-supplied input in ‘cid0′ variable,” the advisory states. “Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.”

An example of a URL that will target the vulnerability is: http://host/_layouts/help.aspx?cid0=MS.WSS.manifest.xml%00%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E&tid=X. High-Tech Bridge said they notified Microsoft of the bug on April 12, but only made the report public on Thursday.

A Microsoft spokeswoman said Thursday that researchers are in the process of drafting a security advisory that includes mitigation and workaround details. With 17 days notice, it’s unclear why Redmond’s security team didn’t already have that information ready to go.

XSS bugs are by far the most common form of vulnerability plaguing the web. Web masters and software makers often downplay them as insignificant, because the severity of many of them is minimal. But as breaches like the one experienced by the heavily fortified Apache Foundation demonstrate, they have the potential to serve as the chink that compromises an otherwise secure defense.

On Thursday, a separate advisory on the Future Musings blog warned of an XSS vulnerability in the iPhone’s Facebook app. “I’ve removed some of the technical details until Facebook has a chance to address this,” author Jon Wedell wrote. “Let’s just say you may want to avoid viewing ‘friend’s’ notes using the Facebook iPhone app for now.”

Credit: The Register

Splunk, a kind of Google for business technology that boasts it can help reinforce your security, has exposed the accounts of major customers to hackers following a web site slip up.

The passwords of customers on Splunk.com were revealed after some debug information leaked on to its production servers. The debug code exposed users passwords to Splunk.com as clear text, the company said.

Splunk has reset all affected users’ passwords in what it called an “abundance of caution”, and purged the log files and indexes of users’ active sessions on Splunk.com. It advised customers to change the temporary password as soon as possible.

Also, Splunk urged those who used their Splunk.com password on other systems or web sites to also change those passwords.

That should mean around half of Splunk users affected should have to change: a survey of web users’ habits in the UK alone in January found 46 per cent use the same password for most web-based accounts. Five percent use the same password for every site.

The company notified customers through a letter and on its blog. According to the blog: “We have no reason to believe that the information was exposed to anyone other than the small subset of Splunk employees that have access to our internal Splunk deployment.”

It said a “small number of passwords” were exposed in the web server’s error log.

Splunk has 1,750 customers including BT, Cisco, LikedIn, Nasa, Visa and the US Department of Energy. Its software is downloaded from the web and is used as a search, monitor and reporting tool that crawls through the raw data on applications, hardware and network systems.

Credit: The Register

A hacker named Kirllos has a rare deal for anyone who wants to spam, steal or scam on Facebook: an unprecedented number of user accounts offered at rock-bottom prices.

Researchers at VeriSign’s iDefense group recently spotted Kirllos selling Facebook user names and passwords in an underground hacker forum, but what really caught their attention was the volume of credentials he had for sale: 1.5 million accounts.

IDefense doesn’t know if Kirllos’ accounts are legitimate, and Facebook didn’t respond to messages Thursday seeking comment. If they are legitimate, he has the account information of about one in every 300 Facebook users. His asking price varies from $25 to $45 per 1,000 accounts, depending on the number of contacts each user has.

To date, Kirllos seems to have sold close to 700,000 accounts, according to VeriSign Director of Cyber Intelligence Rick Howard.

Hackers have been selling stolen social-networking credentials for a while — VeriSign has seen a brisk trade in names and passwords for Russia’s VKontakte, for example. But now the trend is to go after global targets such as Facebook, Howard said.

Facebook has more than 400 million users worldwide, many of whom fall victim to scams each day. In one such scam, criminals send out messages from a compromised account, telling friends that the account’s owner is trapped in a foreign country and needs money to get home.

In another, they send Web links that lead to malicious software, telling friends that it’s a hilarious or sensationalistic video.

“People will follow it because they believe it was a friend that told them to go to this link,” said Randy Abrams, director of technical education with security vendor Eset. Once the malware gets installed, criminals can steal more passwords, break into bank accounts, or simply use the computers to send spam or launch distributed denial of service attacks. “There’s just a plethora of things that people can do if they can trick people into installing their software,” he said.

Kirllos’ Facebook prices are extremely cheap compared to what others are charging. In its most recent Internet Security Threat Report, Symantec found that e-mail usernames and passwords typically went for between $1 to $20 per account — Kirllos wants as little as $0.025 per Facebook account. More coveted credit card or bank account details can go for much more, ranging between $0.85 to $30 for credit card numbers to $15 to $850 for top-quality online bank accounts.

Credit: Computerworld.com

The UK’s National Health Service has been hit by a voracious, data-stealing worm that’s easily detected by off-the-shelf security software, according to researchers who directly observed the mass compromise.

Researchers from anti-virus provider Symantec have been monitoring the Qakbot worm since last May. On Thursday, after infiltrating two of the six servers used to collect pilfered data from infected machines, they provided an update that didn’t exactly instill confidence in the healthcare system.

“The logs show that there is a significant Qakbot infection on the National Health Service (NHS) network in the UK,” the Symantec update states. “This threat has managed to infect over 1,100 separate computers that are spread across multiple subnets within the NHS. We have attempted to contact the affected parties and have no evidence to show that any customer or patient data has been stolen.”

Not that Qakbot doesn’t have the ability to clean out the NHS if it wanted do. Over a two week period, the researchers observed 4 GB of stolen data being funneled to the monitored servers. Because that represents a fraction of the servers used by Qakbot, the amount of pilfered information is likely much higher.

Qakbot spreads through webpages that install malware by exploiting patched vulnerabilities in Microsoft’s Internet Explorer and Apple’s QuickTime software. It is able to self-propagate on local networks through file shares. It “moves slowly and with caution, trying not to bring attention to its presence,” according to the update.

The malware scours an infected machine’s hard drive for internet search histories, banking and payment card information and logon credentials for some dozen websites and then uploads them to one of the six servers. It also records the contents of data stored by a browser’s autocomplete feature.

“In a nutshell, if your computer is compromised, every bit of information you type into your browser will be stolen,” Symantec researchers wrote.

While Qakbot primarily targets home users, plenty of corporate and government machines are infected as well. In addition to the NHS, other government computers that are compromised are located in Brazil. The threat is easily detected by Symantec’s anti-virus product, and presumably software from plenty of other companies as well.

Credit: The Register

Network Solutions’ security team is battling a mysterious attack that has silently infected a “huge” number of the websites it hosts with malicious code.

The mass compromise affects sites running WordPress, Joomla, and HTML, according to reports from Securi Security and Stop Malvertising. Many of the infected sites include encoded javascript that secretly attempts to install malware on visitors’ computers.

The attacks are responsible for about 3.7 percent of web-based malware encounters blocked by ScanSafe, a security service owned by Cisco. About 17.5% of ScanSafe enterprise customers are affected. “Translated, that means that while it’s not impacting the majority of enterprise users, for those enterprises it is impacting the rate of encounters is significant,” said ScanSafe’s Mary Landesman.

The outbreak comes less than a week after another mass hack hit Network Solutions-hosted websites running publishing software from WordPress. That infection touched off a round of finger-pointing and recriminations among researchers and executives from Network Solutions and WordPress over who was responsible for the security lapse.

“The bottom line - although Network Solutions criticized the media last week, for blaming this on Network Solutions, or WordPress itself, the company should realize that for the sake of its reputation it should always use the following mentality - ‘protect the end user from himself’ when offering any of its services,” researcher Dancho Danchev wrote on Sunday.

Network Solutions admins are aware of the attack and are working to remove the errant code from customer websites, Shashi Bellamkonda, an employee with the company, wrote in a post headlined “We feel your pain.” He said the company wouldn’t release technical details of the attack out of concern they would only help the perpetrators. He also recommended users change their passwords. That suggestion didn’t sit well with some Network Solutions customers.

“This is completely ridiculous,” a customer named Chris wrote in response. “We have spent at least a hundred hours over the past few weeks trying to repair our site, changing passwords at least 15 or 20 times for Network Solutions and for our blog, only to have it halfway working again. Now, before it’s even 100% restored, you let them back in? Who’s going to compensate me for the near complete loss of traffic and ad revenue from this problem?”

It remained unclear exactly how many Network Solutions customers were affected by the mass compromise. Stop Malvertising said the infection hit “a huge number of websites,” while Securi Security said only that “more than 50 sites” were hacked with malicious javascript.

Network Solutions spokeswoman Susan Wade said the attack is “affecting a subsect of our hosting customers, so it’s not a whole universe of our hosting customers.” But she declined to provide even a rough estimate of the percentage. The company won’t release additional details until it had time to complete a more thorough investigation, she added.

Credit: The Register

Miscreants have created a Trojan that poses as a Google Chrome extension. Spammed messages attempt to dupe prospective marks into trying an add-on that “helps you better organize your documents received in your email”.

Interested parties are pointed towards a counterfeit Google Chrome Extensions page, which offers a malware executable. More observant punters will notice that the download is offered in an .exe file and not a .crx Google Chrome extension. Such markers are easily missed, however.

The Trojan horse malware on offer (identified by Romanian security firm BitDefender as the Agent-20577) blocks access to Google and Yahoo webpages. Attempts to reach these sites on infected machines are hijacked and redirected to counterfeit sites. Such trickery is commonly a prelude to either phishing attacks or a technique by the hackers behind the trick to gain affiliate income from scareware slingers or other undesirables.

The appearance of the attack shows that cybercrooks have begun targeting Google Chrome users, something that only tends to happen when a product or service becomes widely used among end users and is therefore a compliment (of sorts) to the success of Google’s browser technology.

Credit: The Register

A Trojan circulating in Japan seeks to extort money from shame-faced fans of hentai-themed games. Those who download illegal copies of ”over 18″ hentai-themed games from file sharing networks are liable to wind up with a nasty surprise, Trend Micro warns.

Some bogus files posing as games from Abel software attempt to trick victims into handing over personal information as part of a supposed game registration process:

Meanwhile, in the background, the malware is collecting information on the victim’s computer including domain, OS version, file use history and IE favourites.

Screenshots from a prospective mark’s PC are also obtained.
 
This data is then published on a publicly-viewable website before victims receive an email pointing them towards the incriminating content from Romancing Inc, which also maintains the domain hosting the incriminating data.

The email offers to resolve the “copyright infringement” and remove incriminating (and potentially embarrassing) information in exchange for a fee.

Trend Micro notes that the Trojan forming the centrepiece of the attack drops MP3 files on a victim’s machine that are elsewhere offered for sale online at an extortionate price of hundreds of thousands of dollars.

Security researcher Rik Ferguson writes: “Could it be that once a victim has shown themselves to be extortion-friendly they will get hit with yet another ‘copyright infringement’ notice from Romancing Inc? Japanese copyright law was strengthened this year largely in an attempt to address the problem of illegal downloading.

“This is certainly another illustration of why, in the long run, you may well be better off paying up front for your downloads and steering clear of file-sharing networks.”

Previous scams along the same lines have claimed to be FBI notices of copyright infringement. The Hentai-themed ruse goes further by publicly shaming prospective marks before hitting them with extortionate demands.

Credit: The Register, TrendMicro

Two websites hosted on the telegraph.co.uk domain were defaced to display Romanian patriotic messages and the country’s flag, yesterday. The hacktivists who claimed responsibility for the attack expressed anger at the British media for portraying the Romanian people in an unfavorable light.

The attack targeted the wine-and-dine.telegraph.co.uk and shortbreaks.telegraph.co.uk websites and was originally reported on the Romanian Security Team (RST) hacking forum. However, according to the message left behind on the affected websites, the compromise is attributed to a group called Romanian National Security (R.N.S.).

It seems that both of the affected subdomains were being used for Daily Telegraph promotions. “With the Telegraph’s Wine and Dine for only £10 offer enjoy two courses and a glass of Bordeaux for only £10 at more than 600 restaurants and pubs,” reads a Google cached summary for wine-and-dine.telegraph.co.uk. Meanwhile, shortbreaks.telegraph.co.uk seems to correspond to a campaign, which allows readers to “save up to 50% at more than 400 hotels throughout the British isles.”

There is a strong possibility that the Daily Telegraph was targeted as a representative of the entire British media, because the hackers were a lot broader in their accusations. “We’re tired of sitting and watching how ’scum’ like you mock our country. Of the picture you paint of us, and which has nothing to do with reality, by calling us ‘Romanian gypsies’ and by airing [expletive] shows like TopGear. For having the nerve to step on the toes of an entire country, be warned that we will not stop here!,” they wrote [human translation from Romanian], before ending their statement with “Guess what, gypsies aren’t Romanians, morons.”

The TopGear reference concerns the first episode of the series’ 14th season, which follows the TopGear team in its quest to locate and drive along the Romanian Transfagarasan highway, one of the most dramatic paved roads in Europe. Unfortunately, the segment contains some rather unflattering remarks about the Eastern European country and its people.

The irony of this attack is while the hacktivists condemn ethnic discrimination - treating Romanians differently because of their nationality - it goes on to indirectly discriminate gypsies (Romani people) by suggesting that being a member of that ethnic group is a bad thing.

At the time of writing this article, only the shortbreaks.telegraph.co.uk defacement was still live. A song called The Lonely Sheppard, played by world-renowned Romanian pan flute master Gheorghe Zamfir, loads in the background.

Credit: Softpedia.com News

An application that offers to unlock iPhones is actually designed to hijack internet connections on compromised Windows PCs, security watchers warn.

Spam messages direct potential victims to a domain called iphone-iphone.info that offers links to download a Windows executable called blackra1n.exe. The application claims to offer an unlock utility but instead it changes default DNS settings on infected Windows PCs, hijacking internet connections in the process.

Romanian anti-virus firm BitDefender, which identifies the executable as Trojan-BAT-AACL, explains that the malware comes as a Windows batch file packed alongside the iPhone jailbreaking application.

“The Trojan attempts to change the preferred DNS server address for several possible Internet connections on the users’ computers to 188.210.[REMOVED],” BitDefender explains. “This allows the malware creators to intercept the victims’ calls to reach internet sites and to redirect them to their own malware-laden versions of those sites.”

DNS-contaminating malware has been used in the past to redirect users to counterfeit versions of online banking sites. The precise purpose of the malware in this case seems to be to infect compromised Windows PCs with yet more crud, earning hackers affiliate revenues in the process. The Trojan affects only the host Windows PC, not any connected iPhone.

Credit: The Register

A popular song lyrics website has been found serving attack code that tries to exploit a critical vulnerability in Oracle’s Java virtual machine, which is installed on hundreds of millions of computers worldwide.

The site, songlyrics.com, is serving up javascript that invokes the weakness disclosed last week by security researcher Tavis Ormandy. After determining that the bug made it trivial for attackers to remotely execute malicious code on end-user machines, he said he alerted Java handlers inside Oracle’s Sun division, but they decided no patch was necessary outside of the next update release scheduled for July.

AVG Technologies Chief Research Officer Roger Thompson, who discovered the in-the-wild attack, said songlyrics.com reaches out to another domain, assetmancomjobs.com, for a malicious JAR, or Java Archive, file and gets a 404 error indicating the payload isn’t available. “The attack site has been flaky,” he said. “We can’t get at the code they’re trying to download but it’s sure trying to download.”

He said songlyrics.com appears to be compromised by attackers for the purpose of exploiting the Java vulnerability. He said people should stay away from both sites for the time being unless they are experienced security researchers.

The bug in the Java Web Start component has been confirmed exploitable on all recent versions of Windows by Ormandy and fellow researcher Ruben Santamarta of Spain-based security firm Wintercore. The latter researcher said a related flaw potentially affects Linux users as well.

Both researchers stressed the ease in which attackers can exploit the bug using a website that silently passes malicious commands to various Java components that jump-start applications in Internet Explorer, Firefox, and potentially other browsers. The vulnerability has existed since April 2008, when Sun tweaked the Java Web Start feature in Java 6, update 10.

Short of uninstalling Java altogether, it’s not easy to prevent the kind of drive-by attacks Ormandy and Santamarta have warned are possible. Merely disabling ActiveX or Firefox plugins isn’t enough because the Java toolkit that’s responsible is installed separately from Java. That means the only temporary fixes are browser specific for IE and Firefox and involve setting killbits or employing file system access control list features.

Detailed documentation on killbits is provided by Microsoft here: http://support.microsoft.com/kb/240797

Credit: The Register