CyberInsecure.com

Archive for the ‘Vulnerabilities’ Category

Over thirty websites of various Representatives and House Committees fell victim to mass defacement yesterday. The incident occurred shortly after President Obama gave his State of the Union address.

The attack seems to be politically motivated as it contained an offensive anti-Obama message. All affected websites are from within the house.gov domain and most of them served House Representatives. However, a few, such as gop.cha.house.gov, republicans.financialservices.house.gov, republicans.oversight.house.gov or resourcescommittee.house.gov, correspond to House committees.

According to Web defacement archive Zone-H, the Red Eye Crew is a prominent hacking group responsible for more than 45,000 defacements in 2009 alone. Around 2,000 of the affected websites are listed as special, meaning they belong to governments, military organizations or important corporations.

Determining a specific point of entry for these attacks without any insider knowledge is hard. However, security researchers from Praetorian Security Group determined that all compromised websites use the Joomla content management system. “But not all of the Joomla CMS web sites [on the same server] are affected. This might indicate that it is a Joomla component that is to blame, however that is just speculation,” they write.

It is worth noting that a significant number of websites within the house.gov domain were defaced last August by a different group. At the time, there was information to suggest that the compromise was the result of default passwords that were left unchanged.

“Unfortunately we won’t know that until someone who manages house.gov provides some details. Server access seems unlikely, because while the sites we checked are hosted on dcserver1.house.gov, not every site hosted on that server is defaced (example congressman Joe Sestak’s web site was fine). The sites are not redirecting anywhere,” the Praetorian Security Group experts conclude.

Credit: Softpedia.com News

A technique used to get complete listings of files and directories from illegal installations of vBulletin has been revealed on a Romanian hacking forum. This vulnerability is generated by a file included in many cracked versions of the forum platform.

vBulletin (vB) is a commercial-only Internet forum software written in PHP and using MySQL as a database backend. Since its release in 2000, the platform has gained a lot of popularity due to its unique set of features and professional support. Searching for “powered by vBulletin” on Google reveals a staggering 1.6 billion results.

Most of these results correspond to legit installations made by people who paid a license fee in order to use the software. However, there are many installs, which are rogue, because similarly to all popular programs, vBulletin is pirated too.

vB versions with their copyright protection mechanism subverted are called “nullified” and one of the most prominent providers of such releases is a group called DGT. It seems that this team of crackers is in the habit of including a file called validator.php in all of its illegal vBulletin packages.

According to the release notes, this file can be used to verify that files included in the package have not been altered by third parties. It is also noted in the instructions that this file should be removed after installation, but obviously most users never read them.

Left on the server, the validator.php file can be executed via the browser by virtually anyone. This is certainly not desirable as it will output the full path of all files within the installation directory and can lead to sensitive information being exposed.

For example, a section in the vBulletin administration interface allows creating database backups, which get saved in a writable directory. It’s safe to assume that people who do not bother deleting validator.php are not likely to delete these backups either. Knowing the exact names of these files would make it trivial for an attacker to steal them.

Given the nature of this vulnerability, it is very likely that it has been known for quite some time in restricted hacking circles.

This should serve as a lesson for people who choose to run pirated copies of commercial software - you can never be certain that illegally downloaded code is safe. Nevertheless, if are running a “nullified” vBulletin distribution, check if there is a validator.php file in your installation directory and remove it immediately. Also, remove any potentially sensitive files that you are currently hosting inside that folder.

Credit: Softpedia.com News

The University of Exeter in South West of England experienced serious problems with its computer network earlier this week due to a virus outbreak. Systems running Microsoft Windows Vista with Service Pack 2 seem to have been particularly affected by the unnamed malware.

The problems started on Monday when a computer virus was introduced onto the network. “Experience of dealing with data corrupting viruses elsewhere indicates that it is essential to shut down the network ASAP to avoid so many machines and files being corrupted that it takes weeks to recover. Therefore, although this is a PC rather than a network problem, we had to shut down the network to isolate the virus,” announced David Allen, the university’s registrar and deputy chief executive.

The exact name of the virus has not been disclosed, but ZDNet cites insider sources according to which, it exploits the vulnerability described in Microsoft’s MS09-050 Security Bulletin. “This is a completely new virus and we are the only organisation in the world to experience it. None of the mainstream virus software suppliers have seen this virus, and as such, there is no fix,” a leaked internal e-mail from the IT department allegedly reads.

Mr. Allen also pointed out that a security expert had been called on site to assist with the cleaning efforts. Apparently, this malware has only been detected on computers running Windows Vista and the specialized staff plans to check all such systems. This would suggest that the “virus” can spread from one computer to another, which would technically make it a computer worm.

“University campuses are, of course, complex beasts and the IT teams who secure them can have a tough job. The problem is compounded by having a massive userbase of students who may plug their own devices into the network, or may show little care for the security of a communal computer and put it at unnecessary risk,” notes Graham Cluley, senior technology consultant at antivirus vendor Sophos.

The network is slowly being brought back online, beginning with buildings that do not use Windows Vista computers. Several services such as Outlook Web Access and the MyExeter Web portal remain functional, but other network-dependent equipment like VoIP telephones or interactive teaching boards are unusable.

The University of Exeter has almost 16,000 students and three campuses, two in Exeter and one in Cornwall. The Cornwall campus is shared with the University College Falmouth and was isolated from the affected network immediately after the threat was discovered.

Credit: Softpedia.com News

Scareware distributors are hijacking vulnerable osCommerce websites in order to launch their blackhat SEO campaigns. The attacks leverage a publicly disclosed vulnerability and drop several rogue scripts on the compromised servers.

The vulnerability is known since at least August 31, 2009, when a working exploit was publicly released on Milw0rm. In a security advisory, published by vulnerability management company Secunia, the flaw is described as “an error in the authentication mechanism [which] can be exploited to bypass authentication checks and gain access to the administrative interface in the ‘/admin’ folder.”

According to a report from Unmask Parasites, upon successful exploitation, several rogue PHP scripts will be uploaded on the servers. These are mm.php, sh1.php, betty.php and lname.php.

The betty.php script has the purpose of generating bogus URLs of the form http://compromised_domain.com/bety.php?q=keywords, which get indexed by search engines and poison search results for certain terms. The script also creates HTML landing pages and stores them in a “.cache” directory.

The lname.php script handles the redirection of visitors to the malicious sites that push fake antivirus programs. The scareware distributed through this campaign is fairly new and has a very low AV detection rate on VirusTotal.

Meanwhile, mm.php is used to upload files to the compromised server and sh1.php is a PHP Web shell. Finding any of these files on a Web server is a clear indication of infection. Unmask Parasites also points out that, “Google Webmaster Tools can help you detect this attack. Their ’search queries’ report has also proven to reveal many other security problems, so it’s a good idea to use GWT at least once a week.”

The vulnerability has not yet been patched and affects the latest stable version of osCommerce, 2.2 RC2a. However, this attack can be prevented by restricting access to the /admin directory, through .htaccess or some other way. Renaming this directory and removing the abused file-manager.php script can also enhance the security of your osCommerce website.

Credit: Softpedia.com News

A rare emergency update from Microsoft to patch a critical vulnerability in Internet Explorer will be released on Thursday. Critical patches for Adobe Systems software keep coming. This time, they fix serious security bugs in the company’s Shockwave Player. Apple has also released a major security update designed to fix security bugs, some of which present a critical security risk on unpatched systems.

Microsoft update will mark only the 10th 12th time Microsoft has issued a security update outside of its normal schedule since 2003, when it began issuing patches on the second Tuesday of each month. It will come a week after the world learned an attack exploiting the potent IE flaw was used to pierce the defenses of Google and at least some of the other 33 large companies that suffered similar assaults.

Microsoft researchers said that they continue to see only limited attacks that exploit the bug and that, so far, they have only succeed against IE 6. But, as reported Tuesday, researchers elsewhere said they have figured out how to bypass security measures offered in later versions of the widely used browser, making it theoretically possible to compromise a much broader base of PCs.

Microsoft said the emergency patch will be issued as close to 10 am Seattle time as possible and will contain fixes for several other vulnerabilities as well. The company recommends users install it as soon as possible. The patch will require users to restart their machines.

For the first time, Microsoft said the vulnerability could also be exploited to attack users of its email and office productivity software. Thursday’s patch will close holes in those programs as well. Users of Microsoft Access, Word, Excel, or PowerPoint can workaround the issue by disabling ActiveX Controls.

Adobe is strongly urging users to upgrade. Unlike the vast majority of patches, the Shockwave fix requires users manually uninstall the out-of-date version, reboot their systems, and then install the latest version. For an application with more than 450 million installations, that’s downright primitive.

More importantly, making it inconvenient for users to upgrade is a guarantee that a sizable portion of them will remain vulnerable. Adobe has recently unveiled an automatic updater for its Reader application. It’s about time the software maker made seamless updating for Flash and Shockwave standard too. The critical patch, assuming it’s installed, will update Shockwave to version 11.5.6.606.

Patches released by Apple on Tuesday address a malware injection risk in the CoreAudio media player, Flash Player plug-in bugs and a similarly critical vulnerability involving Image Raw. The update also tackles a recently discovered OpenSSL renegotiation exploit. Security fixes for CUPS and Image IO make up the remainder of the patch batch.

Most of these updates are connected with third party software. For example, seven of the twelve CVEs are connected with the update for Adobe’s flash player plug-in. The remainder of the bugs are the usual file format parsing problems that we’ve seen a lot of in the past.

Apple advisory can be found at http://support.apple.com/kb/HT4004.

Credit: The Register

Microsoft published an advisory today about a critical security vulnerability in all versions of Internet Explorer (apart from version 5). While all versions of Internet Explorer are affected, the risk for everyone running Internet Explorer 8 is lower since it has DEP (Data Execution Prevention) enabled by default.

According to McAfee, hackers who breached the defenses of Google, Adobe Systems and at least 32 other companies used this vulnerability to carry out at least some of the attacks.

The previously unknown flaw in the IE browser was probably just one of the vectors used in the attacks, McAfee CTO George Kurtz wrote in a blog post. Using a sophisticated spear-phishing campaign, the perpetrators included malicious links exploiting the bug in emails and instant messages sent to employees from at least three of the targeted companies.

Contrary to previous speculation, there was no evidence vulnerabilities in Adobe’s Reader or Acrobat applications were used in any of the attacks, Kurtz said. In its own statement, adobe concurred, saying researchers “have not been able to obtain any evidence to indicate that Adobe Reader or other Adobe technologies were used as the attack vector in this incident.”

Kurtz said his findings were based on malware samples taken from “three to five” of the targeted companies and he stressed that other zero days or exploits could have been used against other victims.

“In our investigation we discovered that one of the malware samples involved in this broad attack exploits a new, not publicly known vulnerability in Microsoft Internet Explorer,” Kurtz wrote. “Our investigation has shown that Internet explorer is vulnerable on all of Microsoft’s most recent operating system releases, including Windows 7.”

Shortly after the report, Microsoft confirmed the new IE vulnerability was “one of the vectors used in targeted and sophisticated attacks against Google and possibly other corporate networks.” A company statement said the attacks were carried out against version 6 of the widely used browser and suggested users protect themselves by enabling security features that have been added to successor versions.

McAfee’s report is the latest to shed light on one of the most significant cyberattacks in years. Google first disclosed the “highly sophisticated and targeted attack” on Tuesday, saying it originated in China and targeted its intellectual property. It added that 20 other companies suffered similar assaults, a number that independent researchers soon raised to 34. So far, only Google and Adobe have been identified as victims.

Yahoo, Symantec, Northrop Grumman and Dow Chemical have also been penetrated according to The Washington Post, citing unnamed “congressional and industry sources.”

The malware that McAfee researchers analyzed was sent to a highly select group of employees of a handful of companies that Kurtz declined to identify.

“This wasn’t something that got blasted to 300,000 people in a corporation,” Kurtz said in an interview with The Register. “It was really targeted at senior technology leaders that had access to core pieces of intellectual property, source code, et cetera.”

Kurtz has dubbed the attack “Aurora,” a reference to the filepath on the attacker’s machine that showed up in some of the malware code McAfee researchers analyzed. They believe that is the name the attackers gave to the operation. There was nothing in the binaries that indicated either way whether the code writers spoke Cantonese or Mandarin or were located in China.

The IE vulnerability stems from an invalid pointer reference that when exploited allows an attacker to execute malicious shell code on underlying machines. The malware caused exploited machines to download further malicious scripts that installed a backdoor. The machines then connected to command and control channels that were hosted on servers that resided in the US and Taiwan.

A security feature known as data execution prevention, which prevents data loaded into memory from being executed, will block the particular exploits McAfee has observed. But Kurtz warned the vulnerability exists in all versions of IE except for IE 5.01, service pack 4, and that it would be possible for attackers to work around the protection.

In an advisory, Microsoft recommended people use DEP, which by default is enabled in IE 8 but must be turned on in prior versions. The statement also advised users on Vista and later versions of Windows to run IE in protected mode. The advisory didn’t say when an update would be released that patches the vulnerability.

Credit: The Register, SANS ISC

A Romanian grey hat hacker has disclosed an SQL inject (SQLi) vulnerability on a website belonging to the United States Army, which leads to full database compromise. The website, called Army Housing OneStop, is used to provide information about military housing facilities to soldiers. The website has been taken offline.

The Army Housing OneStop (AHOS) is “the official Army website for soldiers who need information about Military Family Housing (MFH), Unaccompanied Personnel Housing (UPH) and/or Community (Off-Post) Housing. It includes both comprehensive and quick-reference information for Army installations worldwide.”

A self-confessed security enthusiast, who goes by the online handle of TinKode, documented a proof-of-concept attack against the onestop.army.mil on his personal blog. The published screenshots reveal that the Web server runs on Microsoft Windows 2003 with Service Pack 2 and the database engine used to power the ASP website is Microsoft SQL Server 2000:

#Version: Microsoft SQL Server 2000 - 8.00.2282 (Intel X86) Dec 30 2008 02:22:41 Copyright (c) 1988-2003 Microsoft Corporation Enterprise Edition on Windows NT 5.2 (Build 3790: Service Pack 2
#User: Dynatouch
#Database: AHOS
#Host Name: AHSGSVDAHQIT130

The AHOS website seems to have been developed by DynaTouch Corporation, a third-party government contractor that provides software and hardware solutions to create “self-service kiosk systems.” The company’s client portfolio includes a long list of local and federal government organizations.

There are a number of 76 databases on the server, but TinKode focused his attention on the one called “AHOS.” There are various tables in this database containing general website configuration information, but two in particular stand out as they are called “mgr_login” and “mgr_login_passwords.”

Upon investigating the latter, the hacker stumbled upon passwords stored in plain text, a major security oversight. Storing cryptographic hashes instead of the actual password strings has been a common practice in Web application programming for years now. Furthermore, if for convenience the hashes are generated with a weak algorithm, a technique known as “salting” can be employed to make them nearly impossible to crack.

In a time when even the most amateur programmers follow such security practices, the fact that many business or government websites do not boggles one’s mind. Additionally, the administrative account is called “Dynatouch” – who would have guessed that? – and its password is “AHOS” – yes, really.

Credit: Softpedia News

Kingston Technology is instructing customers to return certain models of its memory sticks, after the firm discovered a glitch in its DataTraveler Secure flash drives.

The company said in a security notice that the models affected were “privacy” editions of the DataTraveler Secure, DataTraveler Elite and DataTraveler Blackbox. Kingston said the security flaw could allow a wrongdoer to hack into the memory sticks.

“A skilled person with the proper tools and physical access to the drives may be able to gain unauthorized access to data,” warned the vendor. Kingston added that a number of its USB drives weren’t affected by the security flaw.

Customers whose drives could be exploited by the security loophole should return the product, where Kingston said it would apply a factory update.

Kingston had claimed that its Data Traveler Secure drive was the first of its kind to protect “100 per cent of data on-the-fly via 256-bit hardware-based AES encryption”.

It’s also supposed to “meet enterprise-level security and compliance requirements”, according to blurb about the drive on the firm’s website.

Credit: The Register

Security researchers warn that the Fox Sports website has been compromised by unknown attackers, who injected malicious code into a custom error page. There are two separate offensive script tags, each of them created by a different infection.

The page was detected by the ThreatSeeker Network system developed and operated by Websense, a Web security vendor. Security researchers investigating the suspicious link determined that it was pointing to a custom “Page not Found” document, displayed in case of a 404 error.

Webmasters deploy such pages in order to help visitors who are looking for a Web resource that is no longer available. They include suggestions or search boxes that can be used to find the new location of the document.

The msn.foxsports.com website is operated by the Fox Sports division of the Fox Broadcasting Company and according to Alexa, it is in the top 330 websites in the world as far as traffic goes. This website is ranked at position 88 in the United States and is part of the MSN network.

The first malicious script tag loads a script for an external domain used in cybercriminal operations before. In particular, this script is part of the latest version of a mass injection attack known as Gumblar. Highly obfuscated code is used to perform various checks to determine a visitor’s browser, operating system or installed software, and then execute exploits for known vulnerabilities.

“After deobfuscation, the page uses PDF and Flash exploits to run malware in order to control a victim’s computer. In addition, a piece of VBScript is executed to download malware,” the Websense researchers explain.

The secondary script tag loads a potentially malicious JavaScript file from a .cn domain. However, the server hosting this threat was offline and the security analysts couldn’t determine its nature. The Fox Sports page seems to be clean now, but there is no way of telling for how long this infection ran until it was discovered.

It is worth noting that a similar issue was found on the MSN Canada website back in June. In that case, a redirect page, invisible to the user, but parsed by the browser, was infected with malicious code.

Credit: Softpedia.com

The unveiling of a GSM (Global System for Mobile Communications) encryption codebook compiled by a German security researcher and his team of collaborators lowers the bar significantly for the amount of money and technical expertise required to listen in on a GSM-based mobile phone call. More importantly, it illustrates just how old the current GSM encryption is and demonstrates why it’s time for an upgrade.

Law enforcement officials and well-financed cyber criminals have been able to crack GSM encryption for sometime, but the investment was so high that it didn’t pose much of a threat. This new method lowers the price of entry to the point that it is more of an issue, but still not a high risk.

Karsten Nohl announced that he and his team have compiled 2 terabytes worth of GSM encryption data. PC World’s Robert McMillan explains that the results are like “cracking tables that can be used as a kind of reverse phone-book to determine the encryption key used to secure a GSM (Global System for Mobile communications) telephone conversation or text message.”

GSM is the most widely-used mobile phone technology in the world–accounting for over 80 percent of the world’s 4.3 billion mobile phones. The encryption algorithm that protects GSM-based calls from being intercepted and eavesdropped is more than twenty years old, though.

Time is the enemy of encryption. When a new encryption algorithm is developed and claimed to be impenetrable, or that cracking it is so impractical as to not be plausible, those claims are based on current technology. As technology improves, the mainstream consumer computers of tomorrow eventually have the processing capacity of yesterday’s mainframes and suddenly the processing power required to crack the encryption becomes trivial.

As an analogy, think of encryption like a jigsaw puzzle where you have to find one specific puzzle piece. If the puzzle only has 25 pieces, it won’t take you too long to accomplish. That is like a weak encryption algorithm. However, if the puzzle has 10,000 pieces it will take significantly longer.

As time goes on, though, you gather more people to join in the process and develop new strategies to sift through the pieces faster and compress the time required to look through the 10,000 pieces. That is similar to the way difficult encryption algorithms eventually become simple to crack.

There is also always the possibility of a lucky guess. The encryption cracking estimates are based on the amount of time it would take to work through every possible combination and permutation of characters to determine the encryption key. But, you could theoretically find the right key on the eighth try rather than the ten thousandth.

The fact that the A5/1 algorithm used to encrypt GSM handsets is more than two decades old and still chugging along is a testament to the strength the algorithm had at its inception. The mobile phone industry should consider itself lucky that this is only now becoming an issue.

For now, the methods revealed at the Chaos Communication Conference in Berlin still require a fairly hefty investment in technology likely to discourage any casual GSM hacking. But, the mobile phone industry as a whole needs to address the weakness of the geriatric A5/1 encryption algorithm before breaking it becomes so trivial that the encryption is completely useless.

Credit: PCworld