CyberInsecure.com

Archive for the ‘Apple’ Category

If you receive a text message on your iPhone any time after Thursday afternoon containing only a single square character, Charlie Miller would suggest you quickly turn the device off.

That small cipher will likely be your only warning that someone has taken advantage of a bug that Miller and his fellow cybersecurity researcher Collin Mulliner plan to publicize Thursday at the Black Hat cybersecurity conference in Las Vegas. Using a flaw they’ve found in the iPhone’s handling of text messages, the researchers say they’ll demonstrate how to send a series of mostly invisible SMS bursts that can give a hacker complete power over any of the smart phone’s functions. That includes dialing the phone, visiting Web sites, turning on the device’s camera and microphone and, most importantly, sending more text messages to further propagate a mass-gadget hijacking.

“This is serious. The only thing you can do to prevent it is turn off your phone,” Miller says. “Someone could pretty quickly take over every iPhone in the world with this.”

Though Miller and Mulliner say they notified Apple about the vulnerability more than a month ago, the company hasn’t released a patch, and it didn’t respond to Forbes’ repeated calls seeking comment.

The iPhone SMS bug is just one of a series that the researchers plan to reveal in their talk. They say they’ve also found a similar texting bug in Windows Mobile that allows complete remote control of Microsoft based devices. Another pair of SMS bugs in the iPhone and Google’s Android phones would purportedly allow a hacker to knock a phone off its wireless network for about 10 seconds with a series of text messages. The trick could be repeated again and again to keep the user offline, Miller says. Though Google has patched the Android flaw, this second iPhone bug also remains unpatched, he adds.

The new attacks can strike a phone without any action on the part of the user and are virtually unpreventable while the phone is powered on, according to Miller and Mulliner’s research. And unlike the earlier exploits, Apple has inexplicably left them unpatched, Miller says. “I’ve given them more time to patch this than I’ve ever given a company to patch a bug,” he says.

The Windows bug he and Mulliner plan to reveal hasn’t been patched either, says Miller, though he admits that he and Mulliner discovered the Windows flaw on Monday and hadn’t yet alerted Microsoft to its existence.

The attack developed by Miller and Mulliner works by exploiting a missing safeguard in the phones’ text messaging software that prevents code in the messages’ text from overflowing into other parts of the device’s memory where it can run as an executable program. The two researchers plan to demonstrate how a series of 512 SMS messages can exploit the bug, with only one of those messages actually appearing on the phone, showing a small square. (Someone could easily design the attack to show a different message or without any visible messages, Miller cautions.) The entire process of infecting an iPhone and then using the device to infect another phone on the user’s contact list would take only a few minutes, Miller says.

The researchers’ concerns aren’t merely theoretical. Finnish security firm F-Secure says it’s found nearly 500 different variants of mobile phone malicious software since 2004, mostly using Bluetooth to hop between phones in close proximity. But in the last 18 months, cybercriminals have begun using text messages to send links to malicious Web sites that infect the phone with malware, says Mikko Hyppönen, an F-Secure researcher.

One seemingly-Chinese variant, known as “Sexy View” and currently targeting the Symbian operating system, is far more threatening than an iPhone attack, given that around 50% of cellphones use Symbian, Hyppönen says. “After years of the security industry wondering why we aren’t seeing text message worms, it’s starting to happen now,” he says.

As dangerous as his iPhone attack sounds, Miller argues that it’s important to expose flaws in SMS software before they can be exploited by more malicious actors. Texting applications’ insecurity isn’t due to the software’s complexity so much as the security community’s inattention and the expense of sending thousands of text messages to test a phone’s security, Miller says.

“The bad news is that SMS is the perfect attack vector, but the good news is that it’s probably possible to build it securely,” he says. “As a researcher, I can only show [Apple] the bugs. It’s up to them to fix them.”

Credit: Forbes.com

Exploiting a bug in the way iPhones parse SMS messages, the principal analyst at Independent Security Evaluators has demonstrated how to crash a part of the phone that allows him to temporarily disconnect the device from the network. He’s still trying to figure out if the vulnerability will allow him to remotely execute code, a feat that would allow attackers to do much more nefarious things, including sending malicious commands to monitor the phone’s location or turn on its microphone so it becomes a remote bugging device.

“I can definitely make the thing crash,” Miller said. “I have still to determine whether it’s actually exploitable or not. This thing has the potential to be really serious, but I’m still looking at it and Apple is still looking at it.”

Miller presented his findings at the SyScan conference in Singapore on Thursday and plans to offer additional details later this month at the Black Hat security conference in Las Vegas. Researcher Collin Mulliner was also instrumental in discovering the bug, Miller said.

If the vulnerability turns out to be exploitable, it would be significant because there are few measures iPhone users can take to prevent an attack, said Dino Dai Zovi, a security researcher. Dai Zovi has yet to see technical details behind the vulnerability, but he has already experienced its effects last week.

While the two were speaking on a land line, Miller told Dai Zovi he found a new bug in the iPhone and, as a demonstration, instructed him to look at his own Apple handset. The display bore the words “No service.” (The outage caused by Miller’s proof of concept was only temporary).

“My reaction was that this has the potential to be a very serious vulnerability and likely the worst that has affected the iPhone to date,” Dai Zovi told The Register. “I was very surprised that he had a vulnerability that was triggerable with just an SMS message.”

Dai Zovi and several other iPhone experts said there is no way to prevent the iPhone from receiving SMS messages. While AT&T allows users to block text messages and multimedia messages sent as emails, there is no way to block all SMS messages. No comments were made by Apple so far.

Credit: The Register

Mac fans are targeted via a pair of new malware-themed attacks, one of which is on offer through what purports to be a portal for adult videos.

The Jahlav-C Mac-specific Trojan poses as an ActiveX update needed to watch grumble flicks. The same booby-trapped website, which runs code to detect whether surfers are using Mac or Windows PCs, is a equal opportunity infector that also deploys code designs to infect Windows PCs using similar social-engineering trickery.

In addition to the Trojan, Sophos discovered a new strain of the Mac OS X-specific Tored worm on Thursday.

Mac-specific malware remains a rarity compared to the hundreds of thousands of Windows-specific virus strains, of course. However, it would be a mistake for Mac fans to think they are immune from malware when downloading warez or hunting for porn. “It is becoming more and more common for hackers to use social engineering tricks - like telling surfers that they need to download a plugin on their Mac to watch a video - to weasel their way onto computers,” said Graham Cluley, senior technology consultant for Sophos.

“Once the malware is running on your computer, it can download further code from the internet - opening the door for your computer to be infected by scareware, send out spam, or become part of a zombie botnet. Windows users are used to fighting malware, but many Mac users are oblivious of the battle taking place for control of the public’s computers.”

Credit: The Register

Microsoft’s released this month 10 bulletins covering a total of 31 documented vulnerabilities affecting the Windows OS, Internet Explorer browser and Microsoft Office productivity suite (Word, Works and Excel).

Five of the 10 bulletins are rated “critical”, Microsoft’s highest severity rating. Among the patches this month are fixes for a pair of IIS WebDav flaws that were publicly disclosed last month and cover for the CanSecWest Pwn2Own vulnerability that was used to exploit Internet Explorer on Windows 7.

This month’s updates include:

MS08-018 (Critical): Fixes two privately reported vulnerabilities in implementations of Active Directory on Microsoft Windows 2000 Server and Windows Server 2003, and Active Directory Application Mode (ADAM) when installed on Windows XP Professional and Windows Server 2003. The more severe vulnerability could allow remote code execution. It is rated Critical for all supported editions of Microsoft Windows 2000 Server, and rated Important for supported versions of Windows XP Professional and Windows Server 2003.

MS09-019 (Critical): Patches seven privately reported vulnerabilities and one publicly disclosed vulnerability in Internet Explorer. The more severe of the vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Affects IE 5.01, IE 6, IE 7 and IE 8 running on all supported editions of Windows.

MS09-020 (Important): Fixes one publicly disclosed vulnerability and one privately reported vulnerability in Microsoft Internet Information Services (IIS). The vulnerabilities could allow elevation of privilege if an attacker sent a specially crafted HTTP request to a Web site that requires authentication. These vulnerabilities allow an attacker to bypass the IIS configuration that specifies which type of authentication is allowed, but not the file system-based access control list (ACL) check that verifies whether a file is accessible by a given user. Affects all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003.

MS09-021 (Critical): Patches seven privately reported vulnerabilities that could allow remote code execution if a user opens a specially crafted Microsoft Excel file that includes a malformed record object. An attacker who successfully exploited any of these vulnerabilities could take complete control of an affected system. It affects Excel 2000, Excel 2002, Excel 2003, Excel 2007, Office 2004 for Mac, and Microsoft Office 2008 for Mac; Open XML File Format Converter for Mac; and all supported versions of Microsoft Office Excel Viewer and Microsoft Office Compatibility Pack.

MS09-022 (Critical): Covers three privately reported vulnerabilities in Windows Print Spooler. The most severe vulnerability could allow remote code execution if an affected server received a specially crafted RPC request. It applies to Windows 2000, Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008.

MS09-023 (Moderate): Patches a privately reported vulnerability in Windows Search. The vulnerability could allow information disclosure if a user performs a search that returns a specially crafted file as the first result or if the user previews a specially crafted file from the search results. This security update is rated Moderate for Windows Search installed on all supported editions of Windows XP and Windows Server 2003.

MS09-024 (Critical): Fixes a privately reported vulnerability in the Microsoft Works converters. The vulnerability could allow remote code execution if a user opens a specially crafted Works file. Affects Word 2000, Word 2002, Word 2003 with the Microsoft Works 6–9 File Converter, Word 2007 Service Pack 1, Microsoft Works 8.5 and Microsoft Works 9.

MS09-025 (Important): Covers two publicly disclosed and two privately reported vulnerabilities in the Windows kernel that could allow elevation of privilege. An attacker who successfully exploited any of these vulnerabilities could execute arbitrary code and take complete control of an affected system. The vulnerabilities could not be exploited remotely or by anonymous users. Affects Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008.

MS09-026 (Important): Patches a publicly disclosed vulnerability in the Windows remote procedure call (RPC) facility where the RPC Marshalling Engine does not update its internal state appropriately. The vulnerability could allow an attacker to execute arbitrary code and take complete control of an affected system. Rated Important for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008.

MS09-027 (Critical): Covers two privately reported vulnerabilities that could allow remote code execution if a user opens a specially crafted Microsoft Word file. Rated Critical for all supported editions of Microsoft Office Word 2000. For all supported editions of Microsoft Office Word 2002, Microsoft Office Word 2003, Microsoft Office Word 2007, Microsoft Office 2004 for Mac, and Microsoft Office 2008 for Mac, and all supported versions of Open XML File Format Converter for Mac, Microsoft Office Compatibility Pack, and Microsoft Office Word Viewers, this security update is rated Important.

Apple has also shipped a Safari browser update that fixes more than 50 vulnerabilities, some rated extremely critical.

The latest fixes, available in the new Safari 4.0, corrects a wide range of code execution and denial-of-service vulnerabilities and even comes with a fix for the vexing “clickjacking” issues plaguing modern Web browsers.

Several proof-of-concept examples of clickjacking, also known as URI redressing, show how clicks on one Web page can actually apply to clicks on page that’s invisible to the end user. It is a problem that affects all the major Web browsers and it appears Apple is pushing out a fix for Mac and Windows users.

Updates include:

CFNetwork: CVE-2009-1704, CVE-2009-1716

ImageIO: CVE-2009-0040

International components for Unicode: CVE-2009-0153

libxml: CVE-2008-3281, CVE-2008-3529, CVE-2008-4409, CVE-2008-4225, CVE-2008-4226

Safari: CVE-2009-1682, CVE-2009-1706, CVE-2009-1707, CVE-2009-1708

Safari windows installer (no CVE name)

Webkit (CVE-2009-1681): A design issue exists in the same-origin policy mechanism used to limit interactions between websites. This policy allows websites to load pages from third-party websites into a subframe. This frame may be positioned to entice the user to click a particular element within the frame, an attack referred to as “clickjacking”. A maliciously crafted website may be able to manipulate a user into taking an unexpected action, such as initiating a purchase. This update addresses the issue through adoption of the industry-standard ‘X-Frame-Options’ extension header, that allows individual web pages to opt out of being displayed within a subframe. Also fixed: CVE-2006-2783, CVE-2008-1588, CVE-2008-2320, CVE-2008-3632, CVE-2008-4231, CVE-2009-1681, CVE-2009-1684, CVE-2009-1685, CVE-2009-1686, CVE-2009-1687, CVE-2009-1688, CVE-2009-1689, CVE-2009-1690, CVE-2009-1691, CVE-2009-1693, CVE-2009-1694, CVE-2009-1695, CVE-2009-1696, CVE-2009-1697, CVE-2009-1698, CVE-2009-1699, CVE-2009-1700, CVE-2009-1701, CVE-2009-1702, CVE-2009-1703, CVE-2009-1709, CVE-2009-1710, CVE-2009-1711, CVE-2009-1712, CVE-2009-1713, CVE-2009-1714, CVE-2009-1715, CVE-2009-1718

The latest Safari refresh also fixes five documented several code execution issues in CoreGraphics (all could lead to complete computer takeover attacks); an ImageIO issue that could be exploited via maliciously crafted PNG images; 5 flaws in libxml; and a variety of WebKit vulnerabilities that affect Safari on both Mac and Windows systems.

Needles to say, this update comes as highly recommended for anybody using safari.

Note some CVE names are quite old … e.g. CVE-2006-2783 was first discussed more than 3 years ago in Mozilla (June 1st, 2006) and was fixed by Apple for iPhone and iPod almost a year ago (July 11th, 2008).

Credit: ZDNet.com Security Blogs
Credit: SANS Internet Storm Center

Apple today released QuickTime 7.6.2 with fixes for a number of security vulnerabilities, some of which could lead to arbitrary code execution attacks.

The update, available for Mac OS X, Windows XP and Windows Vista, covers a total of 10 documented vulnerabilities that could be exploited via specially created, malicious movie, video, image and audio files.

The updates include:

CVE-2009-0188: A memory corruption issue exists in QuickTime’s handling of Sorenson 3 video files. This may lead to an unexpected application termination or arbitrary code execution.

CVE-2009-0951: A heap buffer overflow exists in the handling of FLC compression files. Opening a maliciously crafted FLC compression file may lead to an unexpected application termination or arbitrary code execution.

CVE-2009-0952: A buffer overflow may occur while processing a compressed PSD image. Opening a maliciously crafted compressed PSD file may lead to an unexpected application termination or arbitrary code execution.

CVE-2009-0010: An integer underflow in QuickTime’s handling of PICT may result in a heap buffer overflow. Opening a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution.

CVE-2009-0953: A heap buffer overflow exists in QuickTime’s handling of PICT images. Opening a maliciously crafted PICT file may lead to an unexpected application termination or arbitrary code execution.

CVE-2009-0954: A heap buffer overflow exists in QuickTime’s handling of Clipping Region (CRGN) atom types in a movie file. Opening a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution.

CVE-2009-0185: A heap buffer overflow exists in the handling of MS ADPCM encoded audio data. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution.

CVE-2009-0955: A sign extension issue exists in QuickTime’s handling of image description atoms. Opening a maliciously crafted Apple video file may lead to an unexpected application termination or arbitrary code execution.

CVE-2009-0956: An uninitialized memory access issue exists in QuickTime’s handling of movie files. Viewing a movie file with a zero user data atom size may lead to an unexpected application termination or arbitrary code execution.

CVE-2009-0957: A heap buffer overflow exists in QuickTime’s handling of JP2 images. Viewing a maliciously crafted JP2 image may lead to an unexpected application termination or arbitrary code execution.

The update is available via the Software Update utility in Mac OS X) and Apple’s Windows Automatic Software Update tool in Windows. QuickTime 7.6.2 may also be obtained from the QuickTime Downloads site at http://www.apple.com/quicktime/download/

Microsoft today warned that hackers are using rigged QuickTime media files to exploit an unpatched vulnerability in DirectShow, the APIs used by Windows programs for multimedia support.

The company has activated its security response process to deal with the zero-day attacks has issued a pre-patch advisory with workarounds and a one-click “fix it” feature to enable the mitigation.

From the advisory:

Microsoft is aware of limited, active attacks that use this exploit code. While our investigation is ongoing, our investigation so far has shown that Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are vulnerable; all versions of Windows Vista and Windows Server 2008 are not vulnerable.

According to MSRC blog, the vulnerability is in the QuickTime parser in Microsoft DirectShow. An attacker would try and exploit the vulnerability by crafting a specially formed video file and then posting it on a website or sending it as an attachment in e-mail. While this isn’t a browser vulnerability, because the vulnerability is in DirectShow, a browser-based vector is potentially accessible through any browser using media plug-ins that use DirectShow. Also, we’ve verified that it is possible to direct calls to DirectShow specifically, even if Apple’s QuickTime (which is not vulnerable) is installed.

The vulnerable component was removed from Windows Vista and later operating systems but is still available for use in the Microsoft Windows 2000, Windows XP, and Windows Server 2003 operating systems.

Vulnerable Windows users should immediately consider disabling QuickTime parsing to thwart attackers. The article at http://support.microsoft.com/kb/971778 provides fix-it button that automatically enables the workaround. It also provides detailed instructions on using a managed script deployment for Windows shops.

Credit: ZDNet.com Security Blogs

Tired of waiting for a patch from Apple for a Java flaw that was fixed upstream six months ago, Mac developer Landon Fuller (of Month of Apple Bugs/Fixes fame) has released a proof of concept exploit to demonstrate the severity of the issue. The vulnerability in question is CVE-2008-5353 which was publicly disclosed and fixed by Sun in January this year.

CVE-2008-5353 allows malicious code to escape the Java sandbox and run arbitrary commands with the permissions of the executing user. This may result in untrusted Java applets executing arbitrary code merely by visiting a web page hosting the applet. The issue is trivially exploitable.

Fuller writes:

Unfortunately, it seems that many Mac OS X security issues are ignored if the severity of the issue is not adequately demonstrated. Due to the fact that an exploit for this issue is available in the wild, and the vulnerability has been public knowledge for six months, I have decided to release a my own proof of concept to demonstrate the issue.

If you visit the following page, “/usr/bin/say” will be executed on your system by a Java applet, with your current user permissions. This link will execute code on your system with your current user permissions. The proof of concept runs on fully-patched PowerPC and Intel Mac OS X systems.

Fuller recommends that Mac OS X users disable Java applets in their browsers (both Firefox and Safari) and disable ‘Open “safe” files after downloading’ in Safari.

Credit: ZDNet.com Security Blogs

On the same day Microsoft shipped a bundle of patches for gaping holes in its PowerPoint software, Apple followed suit, dropping a monster Mac OS X update to correct 67 security vulnerabilities.

The sudden Apple Patch Day also included a patch to cover a trio of flaws in the Safari Web browser (Mac OS X and Windows).

The OS X update covers flaws in 31 different components, including several known (and dated) issues in open-source packages used by Apple. These include vulnerabilities in Apache, BIND, CUPS, OpenSSL, PHP and Kerberos.

The update also fixes what Apple describes as “arbitrary code execution” vulnerabilities in ATS, CFNetwork, CoreGraphics, Cscope, Disk Images and Spotlight.

The full list of affected software, components and discussion of risk is available on Apple’s support site at http://support.apple.com/kb/HT1222.

Separately, Apple shipped new versions of its Safari 3 and Safari 4 (beta) browsers to cover the following issues:

libxml (CVE-2008-3529) A heap buffer overflow exists in libxml’s handling of long entity names. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking.  Affects both Mac OS X and Windows XP and Vista.

Safari (CVE-2009-0162) Multiple input validation issues exist in Safari’s handling of “feed:” URLs. Accessing a maliciously crafted “feed:” URL may lead to the execution of arbitrary JavaScript. This update addresses the issues by performing additional validation of “feed:” URLs. These issues do not affect systems prior to Mac OS X v10.5.  Also affects Windows XP and Vista.

WebKit (CVE-2009-0945) A memory corruption issue exists in WebKit’s handling of SVGList objects. Visiting a maliciously crafted website may lead to arbitrary code execution. This update addresses the issue through improved bounds checking.

Credit: ZDNet.com Zero Day Blogs

Famed Mac hacker Charlie Miller has found another possible security vulnerability in Apple’s iPhone.

Miller, a principal security analyst at Independent Security Evaluators, is known for his prowess in hacking Apple products, winning the CanSecWest security conference hacking contest two years straight.

Miller detailed his latest find — just discovered a couple of days ago — on Thursday at the Black Hat Europe security conference. The finding refutes what was a commonly held belief about how an unmodified iPhone works.

Most security researchers thought it wasn’t possible to run shellcode on an iPhone. Shellcode is code that can run from a command line, but the iPhone was thought not to allow it for security reasons.

The ability to run shellcode is important, as it would let a hacker do all sorts of malicious actions, such as peeping at a person’s text messages or call history of an iPhone from a remote location.

Earlier versions of the iPhone software didn’t have many protections to prevent people from tampering with its memory to run other commands, Miller said. But the latest version of the iPhone’s software strengthened the overall security of the phone, Miller said.

Miller said he’s found a way to trick the iPhone into running code that enables shellcode. To run shellcode on an iPhone, however, an attacker would first need a working exploit for an iPhone, or a way to target some software vulnerability in, for example, the Safari Web browser or the mobile’s operating system. Miller said he doesn’t have one now.

But if someone did “this would allow you to run whatever code you want,” Miller said in an interview after his presentation.

In 2007 Miller and some of his colleagues did find a vulnerability in mobile Safari that would allow an attacker to control the iPhone. Apple was immediately notified and later issued a patch for the problem.

The significance of Miller’s find is that it works with unaltered versions of the iPhone as the devices are sold in stores. Researchers have shown a greater ability to manipulate iPhones that are “jailbroken,” the term for phones that have been modified to allow installation of applications not vetted by Apple. Those jailbroken phones have fewer protections on the device’s memory, Miller said.

Miller said he isn’t sure if Apple is aware of the latest issue. Miller stopped short of calling the problem a vulnerability, saying instead that Apple engineers may have overlooked the issue. Apple also has never come out publicly and said it is impossible to run shellcode on an iPhone, he said.

Credit: Jeremy Kirk, IDG News Service through Yahoo News

For the second consecutive year, the security researcher Charlie Miller hacked into a fully patched MacBook computer by exploiting a security vulnerability in Apple’s Safari browser.

“It took a couple of seconds. They clicked on the link and I took control of the machine,” Miller said moments after his accomplishment.

The Pwn2Own 2009 contest at CanSecWest security conference kicked off at exactly 3:15 PM and, within seconds, Miller launched his drive-by attack and claimed the $10,000 top prize. He also got to keep the MacBook machine.

Miller said he came to the CanSecWest with a plan to hack into Safari and had tested the exploit carefully to ensure “it worked the first time.” Technical details of the vulnerability will not be released until a patch is ready.

It took a while longer but Microsoft’s Internet Explorer 8 also did not survive the hacker onslaught. A security researcher named “Nils” (he declined to provide his full name) performed a clean drive-by download attack against the world’s most widely used browser to take full control of a Sony Vaio machine running Windows 7.

He won a cash prize and got to keep the hardware.  Details of the vulnerability, which was described by contest sponsor TippingPoint ZDI as a “brilliant IE8 bug!” are being kept under wraps.

Several members of Microsoft’s security response team were on hand to witness the successful exploit.

“Nils” also scored a clean hit against Apple’s Safari (he was the second hacker to exploit Safari) and, later in the afternoon, he exploited a Firefox zero-day flaw to claim the trifecta.

Credit: ZDNet.com Security Blogs