CyberInsecure.com

Archive for the ‘Microsoft’ Category

Microsoft on Monday rushed out an emergency patch for a critical vulnerability that criminals are exploiting to install malware on all supported versions of the Windows operating system.

As promised Friday, Microsoft released the update outside of its normal patching schedule because the vulnerability is being actively targeted. When the flaw first came to public attention three weeks ago, it was being used to attack SCADA — supervisory control and data acquisition — systems that control sensitive equipment at power plants, gas refineries, and other other critical infrastructure.

Since then, it’s been used to install general-purpose malware from Zeus and other do-it-yourself crimeware kits used to siphon credit card numbers and other sensitive data from compromised computers. The Windows flaw resides in a shortcut feature that makes it easy to store commonly accessed files and folders on the operating-system desktop.

Users who employed a stopgap FixIt published two weeks ago should roll back their machines using the “disable workaround” feature here. Those who don’t follow this advice will find that icons fail to display properly, causing folders and files to appear white without any of the customary graphics.

Users will most likely have to reboot their machines twice — once after uninstalling the workaround, and again after installing the update.

Credit: The Register

Hackers have developed malware that spreads via USB sticks using a previously unknown security weakness involving Windows’ handling of shortcut files.

Malware targeting the security weakness in the handling of ‘lnk shortcut files has been spotted in the wild by Belarus-based security firm VirusBlokAda. The malware uses rootkit-style functionality to mask its presence on infected systems. These rootlet drivers come digitally signed by legitimate software developer Realtek Semiconductor, a further mark of the sophistication of the attack.

In an advisory, VirusBlokAda says it has seen numerous incidents of the Trojan spy payloads dropped by the malware since adding detection for the malign code last month.

Even fully patched Windows 7 systems are vulnerable to attack in cases where a user views files on an infected USB drive using Windows Explorer, security blogger Brian Krebs reports. Instead of using Windows Autoplay the spread the malware takes advantage in security weaknesses involving shortcut files. Malicious shortcuts on the USB are reportedly capable of auto-executing if users open an infected storage device on Windows Explorer. Normally users would have to click on the link for anything to happen.

Independent researcher Frank Boldewin has uncovered evidence that the malware is targeting SCADA control systems, used to control industrial machinery in power plants and factories, and specifically Siemens WinCC SCADA systems.

“Looks like this malware was made for espionage,” Boldewin writes.

Firms faced with a spate of Windows autorun worms have responded by disabling outrun, but this advice may no longer be enough with the appearance of a new attack vector, Finnish security firm F-Secure warns. “Our initial analysis of the samples appears to indicate that the shortcuts somehow take advantage of the way in which Windows handles Control Panel shortcut files,” it adds.

Microsoft has released an advisory confirming a previously unknown vulnerability in the way Windows processes shortcut files (CVE-2010-2568). The critical bug is trivial to exploit, affects all versions of Windows and allows for arbitrary code execution.

According to Microsoft, all versions of Windows from Windows XP with Service Pack 3 forward, including both 32- and 64-bit flavors are affected. But, Chester Wisniewski, senior security advisor at Sophos Canada, points out that Windows 2000 and Windows XP SP2, which are no longer officially supported by Microsoft since earlier this week, are also vulnerable.

Even though the malware exploiting this vulnerability was spreading through USB devices, the bug itself can also be exploited from optical media, network shares and WebDAV. The temporary mitigation techniques suggested by Microsoft, involve disabling shortcut icons via a registry hack, which will result in a really weird experience for users, and stopping the WebClient service, which will severely impact SharePoint customers.

Credit: The Register

French vulnerability research company VUPEN Security reports the discovery of a use-after-free vulnerability affecting all versions of Internet Explorer that could possibly lead to code execution. According to the company’s new “no more bugs for free” policy, details of the flaw will not be shared with Microsoft unless it pays.

“We Discovered the 10th Unpatched Use-after-free Vulnerability in MS Internet Explorer. IE 8/7/6 are all affected,” a short announcement from VUPEN posted on Twitter reads. However, the research will only be available to its paying customers.

Use-after-free conditions occur when a program continues to use a pointer to a location in memory that has already been deleted or freed. According to an article from OWASP (Open Web Application Security Project) this type of vulnerability poses a very high risk level and has a high exploitation likelihood.

“The use of previously freed memory can have any number of adverse consequences - ranging from the corruption of valid data to the execution of arbitrary code, depending on the instantiation and timing of the flaw. If the newly allocated data chances to hold a class, in C++ for example, various function pointers may be scattered within the heap data. If one of these function pointers is overwritten with an address to valid shellcode, execution of arbitrary code can be achieved,” is explained in the article.

VUPEN Security, which was previously known as FrSIRT, has been credited with discovering numerous critical vulnerabilities in widely deployed software, including Microsoft products. The company recently claimed to have discovered the first two vulnerabilities in the new Microsoft Office 2010 suite.

However, VUPEN is no longer willing to give away its research for free to the affected vendors. Instead, it practices responsible disclosure only with software developers that pay for the information. “Why should security services providers give away for free information aimed at making paid-for software more secure?,” Chaouki Bekrar, VUPEN’s chief executive officer, commented for Heise Media.

The company continues to provide intelligence about the unpatched vulnerabilities, to various governments who are members of its Threat Protection Program, even if the vendor has not been informed. The information includes full binary analysis and detection guidelines.

This “no more bugs for free” policy appears to be a growing trend between security researchers. Proeminent white hat hackers like Charlie Miller, Alex Sotirov or Dino Dai Zovi have already already this stance since a year ago. Evgeny Legerov, founder of Moscow-based vulnerability research company Intevydis, who declared himself a responsible disclosure contester, compared the practice with doing free Quality Assurance work for vendors.

Credit: Softpedia.com News

Microsoft on Thursday unveiled a program to alert banks and online services when accounts they oversee are compromised.

The Internet Fraud Alert will serve as a centralized repository for stolen account credentials and personal information, Microsoft said in a press release announcing the system. It creates a single place for researchers to match researchers who discover large caches of pilfered passwords and payment card numbers with the organizations responsible for the compromised accounts. The service is supported by almost a dozen online businesses and fraud-prevention groups.

The vast amount of stolen credentials stashed on servers and sites such as Pastebin.com often makes it hard for people who discover the information to bring it to the attention of the service providers, retailers and other groups whose customers are affected by the breaches. What’s more, many organizations don’t provide a prominent email address or weblink where compromises can be reported. The Anti-Phishing Working Group alone received more than 410,000 unique phishing reports last year.

Microsoft is billing Internet Fraud Alert as a secure location where researchers can systematically report information about compromised accounts. The service then alerts the proper banks, service providers or authorities.

Microsoft developed the technology underpinning the service and donated it to the National Cyber-Forensics and Training Alliance, a group that trains law enforcement agents, academics and public- and private-sector groups to combat online crime. The new project is supported by eBay, PayPal, the American Bankers Association, Citizens Bank, and the Federal Trade Commission, among others.

It goes into effect immediately. More information, including how to participate, is available at http://ifraudalert.org/

Credit: The Register

Microsoft has silently slipped a Firefox extension onto user machines via an automatic software update. Again.

This week, as part of its regular Patch Tuesday, Redmond released an update for its various browser toolbars, and as Ars Technica noticed, this update also installed an entire add-on for Internet Explorer and an extension for Mozilla Firefox – without asking users. Ars was unable to identify the installs, but Microsoft now says that the update was installing the latest version of its Bing toolbar on machines that were running the older Windows Live Toolbar or MSN Toolbar.

The company says it has now, um, updated the update, and the silent toolbar install no longer occurs. The company calls the silent install “a bug.”

“We discovered a bug in the latest update that was installing the Firefox extension for users with the Windows Live Toolbar and MSN Toolbar (specifically people who have not upgraded to the latest version of the Bing Bar),” the company tells us. “We fixed the update so that going forward folks who still have only the older Windows Live Toolbar or MSN Toolbar will not see this behavior anymore.”

The company apologizes for any inconvenience this may have caused.

Microsoft says that the update was supposed to include only its Search Enhancement Pack, a shared component used by the Windows Live Toolbar, MSN Toolbar, and Bing Bar. The Pack, the company says, enables certain toolbar features, such as the search suggestions drop down. The update was originally tagged with the Search Enhancement Pack label, but it also installed the Bing toolbar on certain machines.

The update was marked “important,” not “optional.” And Firefox users at MozillaZone weren’t too happy about the silent extension install. “I am still annoyed that Microsoft thinks it is ok to arbitrarily tack on something to my FF browser WITHOUT asking, and worst of all, disabling the Uninstall button! Why do they keep doing stupid things like that?!” says one posted.

Users were similarly peeved a year ago, when a service pack for the .NET Framework silently pushed a Firefox add-on. This add-on - Microsoft .NET Framework Assistant - enabled .NET apps to be installed with one click. It also shipped with a disabled uninstall button.

Credit: The Register

More than 100,000 webpages, some belonging to newspapers, police departments, and other large organizations, have been hit by an attack over the past few days that redirected visitors to a website that attempted to install malware on their machines.

The mass compromise appears to have affected sites running a banner-ads module on top of Microsoft’s Internet Information Services using ASP.net, said David Dede, head of malware research at Sucuri, a website monitoring firm. Intljobs.org, The Wall Street Journal’s wsj.com, The Jerusalem Post, tomtom.com.tw and the police department website for UK county of Strathclyde have been hacked.

Google searches on Tuesday indicated more than 100,000 pages were infected, Dede said, but that number had shrunk to about 7,750 at time of writing.

The sites were infected using SQL injection exploits, which allow attackers to tamper with a server’s database by typing commands into search boxes and other user-input fields. The hackers used the exploit to plant iframes in the compromised sites that redirected visitors to robint.us. Malicious javascript on that site attempted to infect end users with malware dubbed Mal/Behav-290 according to anti-virus firm Sophos.

Robint.us has been disabled, thanks to a sinkholing effort carried out by volunteer security outfit Shadowserver Foundation. The action will allow Shadowserver researchers to get a complete list of compromised sites and to gather additional information about how the attack was carried out, spokesman Andre’ M. Di Mino said in an email. He said the details would be published soon.

The SQL injection attacks came from Chinese IP address 121.14.154.69, Dede said. Robint.us was registered to a Dongguan Wanjian of Dongguan, China, according to whois records. Dede said he is still trying to determine the module that is being compromised in the mass hack attack.

Credit: The Register

Microsoft says it’s investigating a security flaw in older versions of its SharePoint Server product that an independent researcher says can easily expose sensitive data and user authentication credentials.

The XSS, or cross-site scripting, vulnerability has been confirmed in SharePoint Server 2007 and is likely also present in earlier versions of the content management system software, an advisory from High-Tech Bridge warned. It allows adversaries to inject malicious javascript into the application by appending commands to the address of the targeted system.

“The vulnerability exists due to failure in the ‘/_layouts/help.aspx’ script to properly sanitize user-supplied input in ‘cid0′ variable,” the advisory states. “Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.”

An example of a URL that will target the vulnerability is: http://host/_layouts/help.aspx?cid0=MS.WSS.manifest.xml%00%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E&tid=X. High-Tech Bridge said they notified Microsoft of the bug on April 12, but only made the report public on Thursday.

A Microsoft spokeswoman said Thursday that researchers are in the process of drafting a security advisory that includes mitigation and workaround details. With 17 days notice, it’s unclear why Redmond’s security team didn’t already have that information ready to go.

XSS bugs are by far the most common form of vulnerability plaguing the web. Web masters and software makers often downplay them as insignificant, because the severity of many of them is minimal. But as breaches like the one experienced by the heavily fortified Apache Foundation demonstrate, they have the potential to serve as the chink that compromises an otherwise secure defense.

On Thursday, a separate advisory on the Future Musings blog warned of an XSS vulnerability in the iPhone’s Facebook app. “I’ve removed some of the technical details until Facebook has a chance to address this,” author Jon Wedell wrote. “Let’s just say you may want to avoid viewing ‘friend’s’ notes using the Facebook iPhone app for now.”

Credit: The Register

Security researchers on Friday unveiled an open-source device that captures the traffic of a wide variety of wireless devices, including keyboards, medical devices, and remote controls.

Keykeriki version 2 captures the entire data stream sent between wireless devices using a popular series of chips made by Norway-based Nordic Semiconductor. That includes the device addresses and the raw payload being sent between them. The open-source package was developed by researchers of Switzerland-based Dreamlab Technologies and includes complete software, firmware, and schematics for building the $100 sniffer.

Keykeriki not only allows researchers or attackers to capture the entire layer 2 frames, it also allows them to send their own unauthorized payloads. That means devices that don’t encrypt communications - or don’t encrypt them properly - can be forced to cough up sensitive communications or be forced to execute rogue commands.

At the CanSecWest conference in Vancouver, Dreamlab Senior Security Expert Thorsten Schroder demonstrated how Keykeriki could be used to attack wireless keyboards sold by Microsoft. The exploit worked because communications in the devices are protected by a weak form of encryption known as xor, which is trivial to break. As a result, he was able to intercept keyboard strokes as they were typed and to remotely send input that executed commands on the attached computer.

“Microsoft made it easy for us because they used their own proprietary crypto,” Schroder said. “Xor is not a very proper way to secure data.”

Even when devices employ strong cryptography, Schroder said Keykeriki may still be able to remotely send unauthorized commands using a technique known as a replay attack, in which commands sent previously are recorded and then sent again.

The device can also be used to spot weaknesses in cryptographic communications by comparing keystrokes to corresponding ciphertext. His analysis shows wireless keyboards made by Logitech most likely use 128-bit AES encryption. But even so, it may still be possible to decipher the contents by exploiting the way the secret key is exchanged.

“We still didn’t figure out how to crack that one, but I think it’s just a matter of time,” he said.

Credit: The Register

The prolific Pushdo spam botnet has found a new way to penetrate Microsoft’s Live.com by exploiting weaknesses in the audio captchas designed to prevent automated scripts from accessing the popular email service.

A new version of the bot causes infected PCs to pull down Live.com audio captchas and return the correct response within 10 seconds, according to a researcher at anti-virus firm Webroot. The attack allows the zombi machines to send email through accounts with a Live.com address, which are whitelisted by many spam filters. The technique offers spammers an alternative to sending spam through open mail relays, which are often blacklisted.

“In one seven minute test period where I permitted the bot to operate freely, the bot demonstrated [a] remarkable capability to bypass the audio captchas,” Webroot researcher Andrew Brandt wrote Monday Morning. “In most cases, it was able to submit the correct answer within two tries, though in one instance, the bot tried six times before it could proceed, and once it gave the correct answer the first time.”

The attack is the latest to target captchas, the puzzles that websites use to ensure that email and forms are completed by humans rather than automated scripts. Captchas require a person to recognize a series of distorted characters that are hard for computers to read using optical character recognition programs. Audio captchas, which are available in event the user is visually impaired, work in much the same way except that characters are verbally recited amid background static and other noise.

Over the past few years, cybercrooks have used devised attacks on captchas protecting Google, Live.com, sites selling concert tickets and various other web properties. Web masters usually respond by tweaking the puzzles, forcing attackers to find new bypass techniques.

Webroot’s Brandt said it’s the first time he’s heard of an audio captcha being targeted. It remains unclear if the attackers are sending the WAV files to sweat shops where humans then decode the audio puzzles, or if the technique works with the help of speech recognition software.

Once the captcha is solved, the botnet uses a Live.com email address to send spam with a variety of come-ons written with poor English grammar and usage. Our favorite one was “Mamma mia! your grandmother is doing so strange things here! Look at these delineations!”

The spam includes a link to a Yahoo Groups page that uses offers for free porn to coax people into giving up financial information.

A botnet primarily used to spend spam, Pushdo goes by several other names, including Cutwail, Diehard, and Rabbit. Some of the IP addresses used by the audio-captcha buster have been used in the past by the Russian Business Network.

Credit: The Register

Microsoft has confirmed that an unpatched Internet Explorer vulnerability makes it potentially dangerous to press F1 if you are running earlier versions of Windows.

A security bug in the VBScript technology bundled with Internet Explorer means that it might be possible to create a web site that displays a specially crafted dialog box that pushes malware providing a victim is tricked into pressing the F1 (help menu) key while viewing a booby-trapped site using Internet Explorer. The novel exploit technique works on older versions of Windows (Win 2000, XP and Server 2003). Vista, Windows 7 and Windows Server 2008 are immune.

Proof of concept code is reportedly in circulation but Microsoft said: “We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time.”

Redmond went on to criticise security researchers for not coming to them with the problem first in an advisory, published on Monday.

“Microsoft is concerned that this new report of a vulnerability was not responsibly disclosed, potentially putting computer users at risk. We continue to encourage responsible disclosure of vulnerabilities. We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone’s best interests. This practice helps to ensure that customers receive comprehensive, high-quality updates for security vulnerabilities without exposure to malicious attackers while the update is being developed.”

The advisory expands on an earlier holding statement in providing a list of potentially vulnerable systems, a preliminary risk assessment and suggested workarounds. Redmond security gnomes are still investigating the flaw but a decision to develop a patch looks like a big odds-on favourite if past form holds true.

Microsoft gave no indication of when a patch might become available but the next scheduled Patch Tuesday is only six days away, cutting it very fine to develop, much less test, a fix. An April or even May update for IE seems more likely.

Credit: The Register