* Microsoft Out Of Band Patch Release – SANS Internet Storm Center

* Microsoft Out Of Band Patch Release
    
 
Published: 2010-01-21,
Last Updated: 2010-01-21 20:21:55 UTC
by Chris Carboni (Version: 1)
1 comment(s)

Microsoft released the out of band security bulletin and patch it announced yesterday. MS10-002 is a cumulative patch for Internet Explorer. It fixes a total of 8 vulnerabilities. The "famous" vulnerability that triggered the release, CVE-2010-0249, is currently being exploited. According to the bulletin, none of the other vulnerabilities are currently being exploited and all had been disclosed to Microsoft directly without any prior public disclosure.

Given the number of ever improving exploits against CVE-2010-0249, and the publicly known use of these exploits, we recommend that you patch as soon as possible.

Posted Thursday, January 21, 2010 2:32 PM by cmosby | with no comments
Filed under: , , , , , ,

Advance Notification for Out-of-Band Bulletin Release - The Microsoft Security Response Center

Advance Notification for Out-of-Band Bulletin Release

Today we issued our Advanced Notification Service (ANS) to advise customers that we will be releasing MS10-002 tomorrow, January 21st, 2010. We are planning to release the update as close to 10:00 a.m. PST (UTC -8) as possible.  This is a standard cumulative update, accelerated from our regularly scheduled February release, for Internet Explorer with an aggregate severity rating of Critical. It addresses the vulnerability related to recent attacks against Google and small subset of corporations, as well as several other vulnerabilities. Once applied, customers are protected against the known attacks that have been widely publicized. We recommend that customers install the update as soon as it is available.  For customers using automatic updates, this update will automatically be applied once it is released.

Today we also updated Security Advisory 979352 to include technical details addressing additional customer questions.

The updated Security Advisory includes guidance in relation to reports of proof of concept (POC) code that bypasses Data Execution Prevention (DEP) and additional information on the exploitability of, and mitigations and workarounds for, Microsoft products that use mshtml.dll.

Based on our comprehensive monitoring of the threat landscape, we continue to see only limited attacks. To date, the only successful attacks that we are aware of have been against Internet Explorer 6.

We continue to recommend that customers update to Internet Explorer 8 to benefit from the improved security protection it offers.

Additional Technical Details Related to Security Advisory 979352

Data Execution Prevention (DEP) Bypass

There is a report of a new exploit that bypasses Data Execution Prevention (DEP). We have analyzed the Proof-of-Concept (POC) exploit code and have found that Windows Vista and later versions of Windows offer more effective protections in blocking the exploit due to the improved security protection offered by Address Space Layout Randomization (ASLR).

On Windows XP, which does not benefit from the improved security protection provided by ASLR, attacks using the DEP bypass techniques are likely to be more effective.

The DEP bypass exploit is not, at this time, publicly available and we have not seen it used in attacks.

Additional details on the DEP bypass exploit are provided in a Security Research and Defense Blog published today.

Microsoft E-Mail Products That Render using mshtml.dll Protected by Default

There have been reports that supported versions of Outlook, Outlook Express and Windows Live Mail are affected by the vulnerability in Security Advisory 979352.

For customers using the default configuration of all supported versions of Outlook, Outlook Express and Windows Live Mail the risk of exploit using Outlook as an attack vector is low. We are unaware of active exploit against supported versions of Outlook, Outlook Express or Windows Live.

By default, Outlook, Outlook Express and Windows Live Mail open HTML e-mail messages in the Restricted sites zone, which helps mitigate attacks seeking to exploit this vulnerability by preventing Active Scripting and ActiveX controls from being used. Additionally, Outlook 2007 uses a different component to render HTML e-mail, removing the risk of the exploit.

If customers have modified their default configuration to not run in Restricted sites zone, their environments will be in a less secure, more vulnerable, state.

Other products may also use the HTML rendering engine for Internet Explorer and could expose this vulnerability.  Any successful attack would require bypassing the default security mechanisms used by each individual application. Therefore customers who use these default application configurations may have reduced risk from being exploited through additional vectors.

Office Applications with Active Scripting Enabled Potentially Vulnerable

We are also aware that the vulnerability can be exploited by including an ActiveX control in a Microsoft Access, Word, Excel, or PowerPoint file. Customers would have to open a malicious file to be at risk of exploitation.

To prevent exploitation, we recommend that customers disable ActiveX Controls in Microsoft Office.

Detailed information on how to disable ActiveX Controls is included in the Security Advisory.

To be clear, applying the update for Internet Explorer addresses the issue across all products that may use mshtml.dll. Customers should install the update to be protected.

We continue to monitor the situation and will keep customers apprised of any changes to the situation or threat landscape through the Microsoft Security Response Center Blog.

Please join us Thursday, January 21 at 1:00 p.m. PST (UTC – 8) for a public webcast where we will present information on the bulletin and take customer questions. Registration information:

Date: Thursday Jan 21
Time: 1:00 p.m. PST (UTC -8)
Registration: http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032440627

Thanks,

Jerry Bryant

*This posting is provided "AS IS" with no warranties, and confers no rights*

Anonymous comments are disabled
Posted Thursday, January 21, 2010 10:26 AM by cmosby | with no comments
Filed under: , , , , , , , ,

New Microsoft Advisory: Vulnerability in Windows Kernel Privilege Escalation (CVE-2010-0232) – SANS Internet Storm Center

New Microsoft Advisory: Vulnerability in Windows Kernel Privilege Escalation (CVE-2010-0232)
Share |
Published: 2010-01-21,
Last Updated: 2010-01-21 01:03:17 UTC
by Johannes Ullrich (Version: 1)
1 comment(s)

Yesterday, we reported about a new Windows Kernel vulnerability [1] . The vulnerability affects all versions of Windows (NT 3.51 up to Windows 7) unless 16-bit application support is disabled. If exploited, the vulnerability will lead to privilege escalation.

Today, Microsoft released an official response in the form of a Security Advisory [2]. The advisory (KB Article 979682) states that Microsoft is investigating the report, and is not aware of any use of the vulnerability in current exploits.

According to Microsoft's list of vulnerable and non-vulnerable systems, 64 bit version of the Windows OS are not vulnerable, but 32 bit versions are. In part this is due to the fact that 64 bit versions of Windows do not include the vulnerable feature (16 bit compatibility).

The workaround outlined by Microsoft matches the workaround proposed in the advisory: Disable access to 16 bit applications. This should work well for the vast majority of systems. But be aware that there is a reason for this feature: Some old (very old) applications do require 16 bit support. This may in particular affect old custom software and support for odd hardware configurations. A standard office desktop should not require any 16 bit applications. As always: Test first.

The CVE number CVE-2010-0232 has been assigned to this issue [3].

[1] http://isc.sans.org/diary.html?storyid=8023
[2] http://www.microsoft.com/technet/security/advisory/979682.mspx
[3] http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0232 (not live yet as of this writing)

Posted Thursday, January 21, 2010 8:45 AM by cmosby | with no comments
Filed under: , , , ,

Microsoft Security Advisory Notification - Issued: January 20, 2010 part 2

********************************************************************

Title: Microsoft Security Advisory Notification

Issued: January 20, 2010

********************************************************************

Security Advisories Updated or Released Today ==============================================

* Microsoft Security Advisory (979682)

- Title: Vulnerability in Windows Kernel Could Allow

Elevation of Privilege

- http://www.microsoft.com/technet/security/advisory/979682.mspx

- Revision Note: V1.0 (January 20, 2010): Advisory published.

* Microsoft Security Advisory (979352)

- Title: Vulnerability in Internet Explorer Could

Allow Remote Code Execution

- http://www.microsoft.com/technet/security/advisory/979352.mspx

- Revision Note: V1.2 (January 20, 2010): Revised Executive

Summary to reflect the changing nature of attacks attempting

to exploit the vulnerability. Clarified information in the

Mitigating Factors section for Data Execution Prevention

(DEP) and Microsoft Outlook, Outlook Express, and Windows

Mail. Clarified several Frequently Asked Questions to provide

further details about the vulnerability and ways to limit the

possibility of exploitation. Added "Enable or disable

ActiveX controls in Office 2007" and "Do not open unexpected

files" to the Workarounds section.

Posted Thursday, January 21, 2010 8:23 AM by cmosby | with no comments
Filed under: , , , , ,

Reports of DEP being bypassed – Microsoft Security Research & Defense

Reports of DEP being bypassed

Yesterday we heard reports of a commercially available exploit that bypasses DEP. This exploit was made available to a limited number of major security vendors (Antivirus, IDS, and IPS vendors) and government CERT agencies. We wanted to use this opportunity to give an overview of current customer risk related to this DEP bypass.

Real-world attacks so far still only effective against Internet Explorer 6

We have seen an increase in attacks attempting to exploit the vulnerability detailed in Security Advisory 979352. However, all attacks we have seen so far still target Internet Explorer 6 - this is also confirmed by the attack samples our Microsoft Active Protections Program (MAPP) partners have sent in.

While we have not seen real-world attacks for any other platform, we have seen researchers poking at other platforms and have seen the following:

  • Private proof-of-concept code exploiting IE7 on Windows XP for arbitrary code execution
  • Private proof-of-concept code exploiting IE7 on Windows Vista without DEP enabled for code execution within the Protected Mode sandbox. We are not aware of any proof-of-concept code exploiting Windows Vista with DEP enabled.
  • Commercial, limited distribution proof-of-concept code exploiting IE8 on Windows XP with DEP enabled for arbitrary code execution.

State-of-the-art of attacker research on various platforms

Here’s the current state-of-the-art on each platform:

  Windows XP Windows Vista Windows 7
IE 6 Public exploit code consistently reliable for arbitrary code execution N/A N/A
IE 7 Private proof-of-concept is likely consistently reliable for arbitrary code execution Private proof-of-concept is likely consistently reliable for limited code execution within the Protected Mode sandbox. N/A
IE 8 In our testing, the commercially-available, limited distribution exploit results in code execution about one in three attempts. For two in three attempts, it results in an Internet Explorer crash. No known proof-of-concept code. Current exploits modified for use on Windows Vista would likely be effective for limited code execution within the Protected Mode sandbox on less than 1% (1/256 + 1/255 + 1/254) of exploit attempts. It would result in an Internet Explorer crash for 99% of exploit attempts. Exploits are substantially less reliable due to the presence of ASLR on Windows Vista. No known proof-of-concept code. Current exploits modified for use on Windows 7 would likely be effectively for limited code execution within the Protected Mode sandbox on less than 1% (1/256 + 1/255 + 1/254) of exploit attempts. It would result in an Internet Explorer crash for 99% of exploit attempts. Exploits are substantially less reliable due to the presence of ASLR on Windows 7.

Other mitigations (besides DEP)

We have discussed DEP at length in this blog. As you can see in the table above, two other mitigations help prevent or limit the impact of attacks on later platforms.

  • Internet Explorer Protected Mode limits the impact of Windows Vista and Windows 7 exploits. Attackers who are able to successfully exploit Internet Explorer on those platforms are stuck in a “sandbox”, potentially able to read data but unable to install programs or change system configuration.
  • Address Space Layout Randomization (ASLR) makes exploiting vulnerabilities more difficult by relocating normally-predictable code locations pseudo-randomly in memory. ASLR re-bases DLL’s to random locations in memory, making ret2libc type attacks unreliable. Due to ASLR we believe exploits for Internet Explorer 8 on Windows Vista or Windows 7 could result in limited code execution for less than 1% of attempts.

Out-of-band update coming tomorrow

We’ll be releasing a comprehensive, well-tested security update tomorrow morning PST to address this vulnerability. In the meantime, we hope this information helps you assess risk and protect your environment.

Acknowledgements

Thanks Matt Miller and John Lambert for help with the ASLR arithmetic and other feedback. 

- Jonathan Ness, MSRC Engineering

*Posting is provided "AS IS" with no warranties, and confers no rights.*

Posted Wednesday, January 20, 2010 4:16 PM by cmosby | with no comments
Filed under: , , , , , , , , , ,

Microsoft Announces Out-of-Band Security Bulletin for the IE Vulnerability – SANS Internet Storm Center

Microsoft Announces Out-of-Band Security Bulletin for the IE Vulnerability
Share |
Published: 2010-01-20,
Last Updated: 2010-01-20 22:03:06 UTC
by Lenny Zeltser (Version: 2)
0 comment(s)

Microsoft posted "an advance notification of one out-of-band security bulletin that Microsoft is intending to release on January 21, 2010. The bulletin will be for Internet Explorer to address limited attacks against customers of Internet Explorer 6, as well as fixes for vulnerabilities rated Critical that are not currently under active attack."

For details, see:

http://www.microsoft.com/technet/security/bulletin/ms10-jan.mspx

Update:

Microsoft also posted a comprehensive overview of the exploits that target this vulnerability. See:

http://blogs.technet.com/srd/archive/2010/01/20/reports-of-dep-being-bypassed.aspx

-- Lenny

Lenny Zeltser - Security Consulting

Posted Wednesday, January 20, 2010 4:12 PM by cmosby | with no comments
Filed under: , , , , , , , ,

Microsoft Security Advisory Notification - Issued: January 20, 2010

********************************************************************

Title: Microsoft Security Advisory Notification

Issued: January 20, 2010

********************************************************************

 

Security Advisory Updated Today

==============================================

 

 * Microsoft Security Advisory (979352)

  - Title: Vulnerability in Internet Explorer Could

    Allow Remote Code Execution

  - http://www.microsoft.com/technet/security/advisory/979352.mspx

  - Revision Note: V1.2 (January 20, 2010): Revised Executive

    Summary to reflect the changing nature of attacks attempting

    to exploit the vulnerability. Clarified information in the

    Mitigating Factors section for Data Execution Prevention

    (DEP) and Microsoft Outlook, Outlook Express, and Windows

    Mail. Clarified several Frequently Asked Questions to provide

    further details about the vulnerability and ways to limit the

    possibility of exploitation. Added " Enable or disable

    ActiveX controls in Office 2007" and " Do not open unexpected

    files" to the Workarounds section.   

Posted Wednesday, January 20, 2010 4:08 PM by cmosby | with no comments
Filed under: , , , , ,

Microsoft Security Bulletin Advance Notification for January 2010 - Issued: January 20, 2010

********************************************************************

Microsoft Security Bulletin Advance Notification for January 2010

Issued: January 20, 2010

********************************************************************

This is an advance notification of one out-of-band security bulletin that Microsoft is intending to release on January 21, 2010.

The full version of the Microsoft Security Bulletin Advance Notification for January 2010 can be found at http://www.microsoft.com/technet/security/bulletin/ms10-jan.mspx.

This bulletin advance notification will be replaced with the January bulletin summary on January 21, 2010. The revised bulletin summary will include the out-of-band security bulletin, as well as the security bulletins already released on January 12, 2010.

For more information about the bulletin advance notification service, see http://www.microsoft.com/technet/security/Bulletin/advance.mspx.

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications on http://www.microsoft.com/technet/security/bulletin/notify.mspx.

Microsoft will host a webcast to address customer questions on the out-of-band bulletin on January 21, 2010, at 1:00 PM Pacific Time (US & Canada). Register for the Security Bulletin Webcast at http://www.microsoft.com/technet/security/bulletin/summary.mspx.

Microsoft also provides information to help customers prioritize monthly security updates with any non-security, high-priority updates that are being released on the same day as the monthly security updates. Please see the section, Other Information.

This advance notification provides a number as the bulletin identifier, because the official Microsoft Security Bulletin numbers are not issued until release. The bulletin summary that replaces this advance notification will have the proper Microsoft Security Bulletin numbers (in the MSyy-xxx format) as the bulletin identifier. The security bulletins for this month are as follows, in order of severity:

Critical Security Bulletins

===========================

IE Bulletin

- Affected Software:

- Internet Explorer 5.01 Service Pack 4 when installed on

Microsoft Windows 2000 Service Pack 4

- Internet Explorer 6 Service Pack 1 when installed on

Microsoft Windows 2000 Service Pack 4

- Internet Explorer 6 for

Windows XP Service Pack 2 and

Windows XP Service Pack 3

- Internet Explorer 6 for

Windows XP Professional x64 Edition Service Pack 2

- Internet Explorer 6 for

Windows Server 2003 Service Pack 2

- Internet Explorer 6 for

Windows Server 2003 x64 Edition Service Pack 2

- Internet Explorer 6 for

Windows Server 2003 with SP2 for Itanium-based Systems

- Internet Explorer 7 for

Windows XP Service Pack 2 and

Windows XP Service Pack 3

- Internet Explorer 7 for

Windows XP Professional x64 Edition Service Pack 2

- Internet Explorer 7 for

Windows Server 2003 Service Pack 2

- Internet Explorer 7 for

Windows Server 2003 x64 Edition Service Pack 2

- Internet Explorer 7 for

Windows Server 2003 with SP2 for Itanium-based Systems

- Internet Explorer 7 in

Windows Vista,

Windows Vista Service Pack 1, and

Windows Vista Service Pack 2

- Internet Explorer 7 in

Windows Vista x64 Edition,

Windows Vista x64 Edition Service Pack 1, and

Windows Vista x64 Edition Service Pack 2

- Internet Explorer 7 in

Windows Server 2008 for 32-bit Systems and

Windows Server 2008 for 32-bit Systems Service Pack 2

(Windows Server 2008 Server Core installation not affected)

- Internet Explorer 7 in

Windows Server 2008 for x64-based Systems and

Windows Server 2008 for x64-based Systems Service Pack 2

(Windows Server 2008 Server Core installation not affected)

- Internet Explorer 7 in

Windows Server 2008 for Itanium-based Systems and

Windows Server 2008 for Itanium-based Systems Service Pack 2

- Internet Explorer 8 for

Windows XP Service Pack 2 and

Windows XP Service Pack 3

- Internet Explorer 8 for

Windows XP Professional x64 Edition Service Pack 2

- Internet Explorer 8 for

Windows Server 2003 Service Pack 2

- Internet Explorer 8 for

Windows Server 2003 x64 Edition Service Pack 2

- Internet Explorer 8 in

Windows Vista,

Windows Vista Service Pack 1, and

Windows Vista Service Pack 2

- Internet Explorer 8 in

Windows Vista x64 Edition,

Windows Vista x64 Edition Service Pack 1, and

Windows Vista x64 Edition Service Pack 2

- Internet Explorer 8 in

Windows Server 2008 for 32-bit Systems and

Windows Server 2008 for 32-bit Systems Service Pack 2

(Windows Server 2008 Server Core installation not affected)

- Internet Explorer 8 in

Windows Server 2008 for x64-based Systems and

Windows Server 2008 for x64-based Systems Service Pack 2

(Windows Server 2008 Server Core installation not affected)

- Internet Explorer 8 in

Windows Server 2008 for Itanium-based Systems and

Windows Server 2008 for Itanium-based Systems Service Pack 2

- Internet Explorer 8 in

Windows 7 for 32-bit Systems

- Internet Explorer 8 in

Windows 7 for x64-based Systems

- Internet Explorer 8 in

Windows Server 2008 R2 for x64-based Systems

(Windows Server 2008 Server Core installation not affected)

- Internet Explorer 8 in

Windows Server 2008 R2 for Itanium-based Systems

- Impact: Remote Code Execution

- Version Number: 1.0

Posted Wednesday, January 20, 2010 4:04 PM by cmosby | with no comments
Filed under: , , , , , , ,

0-day vulnerability in Internet Explorer 6, 7 and 8 - SANS Internet Storm Center

0-day vulnerability in Internet Explorer 6, 7 and 8

Published: 2010-01-14,
Last Updated: 2010-01-14 22:19:56 UTC
by Bojan Zdrnja (Version: 1)

1 comment(s)

Microsoft just published an advisory about a critical security vulnerability in all versions of Internet Explorer (apart from 5 – but no one has that around anymore, right?).

While all versions of Internet Explorer are affected, the risk for everyone running Internet Explorer 8 is lower since it has DEP (Data Execution Prevention) enabled by default. DEP makes exploitation of this vulnerability more difficult so as a temporary workaround you might want to enable it for older IEs (keep in mind that it might break some add-ons).

Microsoft says that so far they only saw exploits against Internet Explorer 6. In a related post (here) McAfee said that this vulnerability was (one of those) used to compromise Google. So, it appears that it was maybe even a cocktail of 0-day exploits used (IE + Adobe).

Posted Friday, January 15, 2010 8:09 AM by cmosby | with no comments
Filed under: , , , , , , , ,

Microsoft Security Advisory Notification - Issued: January 14, 2010

********************************************************************

Title: Microsoft Security Advisory Notification

Issued: January 14, 2010

********************************************************************

Security Advisory Released Today

==============================================

* Microsoft Security Advisory (979352)

- Title: Vulnerability in Internet Explorer Could

Allow Remote Code Execution

- http://www.microsoft.com/technet/security/advisory/979352.mspx

- Revision Note: Advisory published.

Posted Friday, January 15, 2010 8:05 AM by cmosby | with no comments
Filed under: , , , , , ,

Secure USB Flaw Exposed – SANS Internet Storm Center

Secure USB Flaw Exposed

Published: 2010-01-06,
Last Updated: 2010-01-06 18:44:38 UTC
by Guy Bruneau (Version: 1)

0 comment(s) Facebookacebook witter

Several ISC readers have written in regarding a security flaw recently exposed on USB flash drive. The issue of the attack is with a software bug in the password verification mechanism. This affects Kingston, SanDisk and Verbatim.

Vendor Information

SanDisk Update Information: http://www.sandisk.com/business-solutions/enterprise/technical-support/security-bulletin-december-2009
Verbatim Update Information: http://www.verbatim.com/security/security-update.cfm
Kingston Recall Information: http://www.kingston.com/driveupdate/

Posted Wednesday, January 06, 2010 1:23 PM by cmosby | with no comments
Filed under: , ,

Binsservicesonline Scam Spreading on Facebook and SEO Poisoning – Websense Alerts

Binsservicesonline Scam Spreading on Facebook and SEO Poisoning

Date:01.05.2010

Threat Type: Malicious Web Site / Malicious Code

Websense Security Labs™ ThreatSeeker™ Network has discovered several spam messages on Facebook that trick the user into visiting BINSSERVICESONLINE(dot)INFO. When the link in the message is clicked, the Web site redirects the user to an online scam site similar to the one we published in the blog Google Scam Kits in mid-December. The use of Facebook to distribute links that lead to Google scam kits is fairly new, and is sure to trick some users into buying the kits.

A lot of users have apparently received this message, as it quickly became a popular search string on Google. As we've seen in the past, there are criminal groups monitoring the popular search terms on Google and other search engines to start their own malicious attacks, so it didn't take long until we started seeing Google search results for BINSSERVICESONLINE leading to rogue AV products.

Note that the two attacks are done by separate groups of criminals. One group started the spam attacks on Facebook and another started manipulating Google results.

We can see many messages spreading in Facebook, for example:

BINSSERVICESONLINE.INFO redirects to the following scam site:



Google search results for BINSSERVICESONLINE:

The Google Trend showing the hot CTR for BINSSERVICESONLINE:

Posted Wednesday, January 06, 2010 11:25 AM by cmosby | with no comments
Filed under: , , , ,

Report of Java Object Serialization exploit in use in web drive-by attacks – SANS Internet Storm Center

Report of Java Object Serialization exploit in use in web drive-by attacks

Published: 2010-01-05,
Last Updated: 2010-01-05 17:54:55 UTC
by Toby Kohlenberg (Version: 1)

0 comment(s) Facebookacebook witter

We've had a report (thanks Tom!) of a java applet exploiting CVE-2008-5353 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5353) as part of a web drive-by attack. While PoC has been around for a long time for this, this is the first time I've heard of it being used in the wild for a general attack. If anyone else has seen this, we'd be interested to hear about it.

The applet is already being detected by some A/V packages according to VirusTotal: https://www.virustotal.com/analisis/d4f5bcc9acecb2f53a78313fc073563de9fc4f7045dd8123a23a08f926a3974d-1262270360

As we get more details on what it does, we'll update this entry with it.

Posted Tuesday, January 05, 2010 1:40 PM by cmosby | with no comments
Filed under: , ,

Sophisticated, targeted malicious PDF documents exploiting CVE-2009-4324 – SANS Internet Storm Center

Sophisticated, targeted malicious PDF documents exploiting CVE-2009-4324

Published: 2010-01-04,
Last Updated: 2010-01-04 06:29:59 UTC
by Bojan Zdrnja (Version: 1)

0 comment(s) Facebookacebook witter

Couple of days ago one of our readers, Ric, submitted a suspicious PDF document to us. As you know, malicious PDF documents are not rare these days, especially when the exploit for a yet unpatched vulnerability is wide spread.

Quick analysis of the document confirmed that it is exploiting this vulnerability (CVE-2009-4324 – the doc.media.newPlayer vulnerability). This can be easily seen in the included JavaScript in the PDF document, despite horrible detection (only 6 out of 40 AV vendors detected this when I initially submitted it here).

After extracting the included JavaScript code, the shellcode that it uses looked quite a bit different than what we can usually see in such exploits: this shellcode was only 38 bytes long! Initially I even thought that it does not work, but after studying it a little bit, I found that this particular PDF document has some very interesting, sophisticated characteristics.

The exploit for this vulnerability is similar to most other exploits: it uses heap spraying in order to redirect the execution to shellcode. The NOP sled in this case actually consists of SBB AL,0x1C and SBB AL,0x0C instructions which do nothing (SBB is Subtract with borrow, from the register AL, so it keeps subtracting two values until it reaches the shellcode). The 38 bytes shellcode can be seen below:

Shellcode
Now comes the interesting part. This is an egg-hunting shellcode: it starts at the memory address ((0x02020200 OR 0xFF) + 0x01) = 0x02020300) and compares content of every 4 bytes with 0x58905090. You can see that initially the attacker moves 0x5890508F into the EAX register, which then gets increased by one – this was probably done to evade detection.

This pattern (0x58905090) corresponds to instructions POP EAX, NOP, PUSH EAX, NOP. Now, once this pattern has been identified in memory, the egg-hunting shellcode passes execution to this, second stage shellcode.

What is interesting about this approach is that the second stage shellcode is included as a different object in the PDF document. While the object is marked as a color object and its contents are inflated, it looks as if it is corrupted: it does not contain any inflated streams. You can see the object and the deflation error printed by pdf-parser, an excellent tool by Didier Stevens whom I wish to thank for useful discussion while I was analyzing this malicious PDF document:

$ pdf-parser.py --object 3 --raw --filter Requset.pdf

obj 3 0
Type:
Referencing:
Contains stream
<</BitsPerComponent 8/ColorSpace/DeviceRGB/Filter/FlateDecode/Height 90/Length 13136/Subtype/Image/Width 60>>
<<
   /BitsPerComponent 8
   /ColorSpace /DeviceRGB
   /Filter /FlateDecode
   /Height 90
   /Length 13136
   /Subtype /Image
   /Width 60
>>
FlateDecode decompress failed
The fact that the decompression fails does not matter – Adobe Reader will open the whole document (mmap it) into memory, including this "corrupted" object so the first stage shellcode will be able to find it and pass execution to it!

The advantage for the attacker is obvious: first, he can modify this object (what the exploit actually does) without having to modify the first stage shellcode. Additionally, this will make automatic analysis impossible for any tool that will use a JavaScript interpreter on the included JavaScript code (such as Wepawet) – the first phase shellcode will work only if the document is loaded in the memory. Sneaky, but that was not all!

The second stage shellcode does something interesting as well. It parses the document name from the command line arguments and opens the PDF document directly. The reason for this is that the PDF document carries two embedded binaries! The first binary (SUCHOST.EXE, b0eeca383a7477ee689ec807b775ebbb) contains a PoisonIvy client which tries to connect to the host cecon.flower-show.org which was down when I analyzed the document. Luckily, this binary has a bit better (but still not good, some major AV vendors missing it!) detection on VT (here). This binary is embedded in the PDF document – we can see it at offset 0x0e65c:

$ hexdump -C -v ../Requset.pdf |less
00000000  25 50 44 46 2d 31 2e 36  0d 25 e2 e3 cf d3 0d 0a  |%PDF-1.6.%......|
00000010  32 34 20 30 20 6f 62 6a  0d 3c 3c 2f 4c 69 6e 65  |24 0 obj.<</Line|
00000020  61 72 69 7a 65 64 20 31  2f 4c 20 39 34 37 32 33  |arized 1/L 94723|
00000030  32 2f 4f 20 32 36 2f 45  20 31 37 38 31 2f 4e 20  |2/O 26/E 1781/N |
...
0000e650  b4 b4 b3 88 8f a0 a0 c0  ca c3 88 8f c8 df 00 00  |................|
0000e660  84 00 00 00 87 00 00 00  7a 7a 00 00 c5 00 00 00  |........zz......|
0000e670  00 00 00 00 c5 00 00 00  00 84 00 00 8b 9a 31 8c  |..............1.|
The binary is XORed with value of 0x85 so the first two highlighted bytes are actually MZ, which is where the executable starts.

The second binary (temp.exe, 980e40cacbc9f898bc08cb453fa2d6bb) was even more surprising. This binary drops a benign PDF document on the machine, called baby.pdf. This PDF document is then opened with Adobe Reader – it just shows a table and, according to the metadata in the document, has been built from an Excel document. This was done by the attackers to make the victim believe as if nothing happened, because the original exploit will crash Adobe Reader and this might make the victim suspicious about what happened.

Additionally, the PDF document contains everything it needs to fully exploit the victim's machine – it does not have to download anything off the net.

Lessons learned

Not only was this a very interesting example of a malicious PDF document carrying a sophisticated "war head", but it also showed the length attackers are willing to go to in order to make their malware as hard to detect as possible, not only for the AV vendors, but also for victims.

Since this exploit has not been patched yet, I would like to urge you all to, at least, disable JavaScript in your Adobe Reader applications. We are getting more reports about PDF documents exploiting this vulnerability, and it certainly appears that the attackers are willing to customize them to get as many victims to open them as possible. Also keep in mind that such malicious PDF documents can go to a great length when used in targeted attacks – the fake PDF that gets opened can easily fool any user into thinking it was just a mistakenly sent document.

If we are to judge the new year by sophistication the attackers started using, it does not look too good.

Posted Monday, January 04, 2010 12:27 PM by cmosby | with no comments
Filed under: , , , ,

How Celebrity News Shapes the Spam Landscape – Symantec Security Blogs

How Celebrity News Shapes the Spam Landscape

MarissaVicario's picture
MarissaVicario
December 30th, 2009
Filed under: , , , , , ,

Posted on behalf of Paul Wood, MessageLabs Intelligence Senior Analyst, Symantec Hosted Services

Happy New Year! The uncertainty of what 2010 will bring news-wise is exactly what makes the spam landscape, well, interesting and unpredictable. Although we can predict general threat trends as we have in our 2010 Security Predictions, we can never foresee spam’s entire future which makes everyday a virtual crap-shoot – to an extent – for our MessageLabs Intelligence Team.

Let’s take a look back at the events that shaped the 2009 spam landscape:

The global credit crisis and the election of US President Barack Obama provided two major themes to much of the spam blocked in early 2009. Other events, festivities and news stories also contributed to many spam themes in 2009, including:

•    St. Valentine’s Day on 14 February

•    St. Patrick’s Day and NCAA March Madness in the US in March

•    4 July Independence Day in the US

•    Global flu pandemic of H1N1

•    Fatal crash of Air France flight 447

•    Deaths of singer Michael Jackson and actor Patrick Swayze.

Interestingly, following the death of Michael Jackson on 25 June, the topic had been quickly adopted in several spam campaigns and at the time, approximately one percent of all spam referenced Michael Jackson.

Even before Jackson’s death, news of Farrah Fawcett’s passing precipitated a spate of spam purporting to relate to her death and later when the death of Patrick Swayze was announced on 15 September it was only a matter of time before the spammers and cyber criminals used the opportunity to tailor their output accordingly.

The financial gloom has served as a popular topic for spammers and fraudsters, especially during the first half of 2009. As credit became harder to secure through traditional means and the global economic woes provided consumers with uncertainty, spammers, fraudsters and phishers added the recession to their list of themes to leverage. 

In February, spam containing hyperlinks to a number of major well-known search engines delivered much of the early recession-based spam. The hyperlinks were not using automated redirection links as had been seen previously, but using an automated search for the spammers’ website domains.  Search engine spamming techniques enable the spammers to include a hyperlink constructed from a search engine query within the body of the email. When the link is followed it leads the browser to the spammers’ websites.

Rather than watching the news and reacting by manually tweaking the subjects and content of their spam runs, MessageLabs Intelligence has tracked numerous spam runs that very strongly indicate a high level of automation in producing news-related spam campaigns.  Spammers aim to do as much as possible to attract or lure the recipient into opening the email, and reading it.  Spammers have demonstrated repeatedly that using topical or newsworthy events in subjects and in the spam message body is a very fruitful way to push up response rates.  As 2010 dawns, spam campaigns featuring a breaking news story can filter through to inboxes faster than ever before, as automated scripts scrape headlines and the text of new stories from hundreds of news sites. 

This is not a new thing, but anecdotally MessageLabs Intelligence suspects that newsworthy events are being squirted into spam campaigns more and more.  Increasingly spam campaigns are lined up very much in the style of <insert subject here>, and these automated scripts ensure that whatever the hot topic is, that internet users are reading in their lunch break, or seeing flood in to twitter or RSS feeds, is also appearing in inboxes in spam subjects.  With interest in the news event at a maximum within the first 12 hours or so of the story breaking, spammers are right there riding on the interest that the story generates.

An example of this a recent spam campaign where a news headline about a cricketer scoring a century, came through within hours of the century being scored.  The spam subject was found on a news website which suggests that some automated script picked up the headline.

Stay tuned as MessageLabs Intelligence uncovers what 2010 will bring.

For real-time updates on the threat landscape, follow us on Twitter @MessageLabs

To download the MessageLabs Intelligence Annual Report in its entirety, please visit: http://www.messagelabs.com/resources/mlireports

Posted Wednesday, December 30, 2009 1:33 PM by cmosby | with no comments
Filed under: ,

Microsoft puts up a blurb on their website about the IIS 0day. – SANS Internet Storm Center

Microsoft puts up a blurb on their website about the IIS 0day.
Published: 2009-12-28,
Last Updated: 2009-12-28 15:36:57 UTC
by Joel Esler (Version: 3)
0 comment(s) digg_url = 'http://isc.sans.org/diary.html?storyid=7819&rss'; digg_title = 'Microsoft puts up a blurb on their website about the IIS 0day.'; digg_skin='compact'; digg_topic = 'security'; Facebookacebook witter

Microsoft has put up a response on their security blog concerning the IIS "0day".  They say that only installations in a specific "non-default" and "unsafe configuration" are vulnerable to the condition.  Also they note that if the administrator had not altered the default configuration and followed best practices in the securing of the webserver, then this exploit wouldn't work.

Unfortunately, we know that doesn't always wind up being the case.  Read more of their blog post here.

Check out Patrick's Post here.

-- Joel Esler | http://blog.joelesler.net | http://twitter.com/joelesler

Posted Wednesday, December 30, 2009 12:58 PM by cmosby | with no comments
Filed under: , , , , ,

(Not So) Happy Holidays from Koobface – McAfee Labs Blog

(Not So) Happy Holidays from Koobface

Thursday December 24, 2009 at 3:39 pm CST
Posted by Paula Greve

No Comments

Activities associated with Koobface have increased during the month of December. Often it is for the sending of traffic to compromised servers in order to obtain more servers. Other times the activity centers around using those same compromised servers to proxy users to malicious domains that are then used for further distribution of malware or command and control of the infected machines.

This morning we noticed a trend with some of the domain-based locations making use of the holiday theme. This has included everything from “presents for your pets” to “festive holiday trees” – these are domains that appear legitimate but are not. In fact, many of the domains that are being used were legitimate at one point and now are serving a different, more questionable purpose.

Holiday Koobface Greetings

When users go to these sites for these happy holiday thoughts – they are instead instantly greeted by having files downloaded to their computers. And voila – a lovely “gift” is attempting to execute upon them. The gift of holiday identity theft!

We have been monitoring the progress of this attack as it rides upon the Holiday Cheer and its spread continued throughout the day – and based upon past trends – we expect it to continue to evolve and find new servers and methods with similar associations over the next few weeks.

Spread of Koobface Holiday Cheer

Stay updated and safe over the holidays!

Posted Wednesday, December 30, 2009 12:55 PM by cmosby | with no comments
Filed under: , ,

PH: Mayon Volcano Eruption Spews Out SEO Attack – Trend Labs Malware Blog

Dec24
4:58 am (UTC-7)   |   by Joseph Pacamarra (Threats Analyst)

While scouting the Web for the latest threats, Trend Micro threat analysts stumbled upon FAKEAV variants riding on the impending eruption of the Mayon Volcano. Renowned for its “perfect cone” shape, the Mayon Volcano became one of the candidates for inclusion in the New 7 Wonders of Nature list. It is not surprising, therefore, that news of its impending eruption, during the Christmas holidays no less, will attract the attention of both curious onlookers and concerned individuals alike.

Close on the heels of users seeking out news on the event, of course, are cybercriminals with their usual blackhat SEO tactics. Searching for news on the topic on Google using the string “Mayon Volcano eruption” may lead users to the malicious URL http://{BLOCKED}acsi.com/fgq.php?in=mayon%20volcano%20eruption. Clicking the link redirects users to the CNN homepage unless their browser has google.com as referrer, in which case, they are redirected to another malicious URL, http://{RANDOM}.xorg.pl. Afterward, they will again be redirected to any of the following URLs where FAKEAV variants are downloaded onto their systems:

  • http://{BLOCKED}can.com, which redirects to http://{BLOCKED}m.cn, where they will prompted to download install14300.exe (detected by Trend Micro as TROJ_FAKEAV.MVE)
  • http://{BLOCKED}puter22.com, which redirects to http://{BLOCKED}omputer.com, where they will be prompted to download setup_build6_195.exe (detected as TROJ_FAKEAV.PTO)
  • http://{BLOCKED}antispywaresolutions.com where they will be prompted to download install.exe (detected as TROJ_FAKEAV.XMS)
Click Click
Click

Smart Protection Network protects Trend Micro product users by preventing user access to the said malicious sites and detecting and by blocking the download of all related malicious files. As added precaution, however, users are advised to only rely on trusted news sites for updates on the event.

Posted Wednesday, December 30, 2009 12:52 PM by cmosby | with no comments
Filed under: , , ,

Fox Sports Web Site Compromised - Websense Alerts

Fox Sports Web Site Compromised

Date:12.29.2009

Threat Type: Malicious Web Site / Malicious Code

Websense Security Labs™ ThreatSeeker™ Network has detected that the Fox Sports site has been compromised and injected with malicious code. Fox Sports is a division of the Fox Broadcasting Company. It specializes in the latest sports news and world sports updates. Fox Sports has an Alexa ranking of 330.
Our research shows that the site has been injected with two pieces of malicious code. One of them is the latest Gumblar campaign, and the other redirects individuals to a malicious Web site, whose link was unreachable at the time of this alert.
The ThreatSeeker Network has detected that thousands of Web sites have been compromised by the latest Gumblar campaign. The Gumblar page is highly obfuscated. After deobfuscation, the page uses PDF and Flash exploits to run malware in order to control a victim's computer. In addition, a piece of VBScript is executed to download malware.

Screenshot of Fox Sports Web site: 
clip_image002
Screenshot of malicious injected code: 
clip_image004
Websense Messaging and Websense Web Security customers are protected against this attack.

Posted Tuesday, December 29, 2009 4:33 PM by cmosby | with no comments
Filed under: , , , , ,

Results of Investigation into Holiday IIS Claim - The Microsoft Security Response Center (MSRC)

Results of Investigation into Holiday IIS Claim

We’ve completed our investigation into the claims that came up over the holiday of a possible vulnerability in IIS and found that there is no vulnerability in IIS.

What we have seen is that there is an inconsistency in IIS 6 only in how it handles semicolons in URLs. It’s this inconsistency that the claims have focused on, saying this enables an attacker to bypass content filtering software to upload and execute code on an IIS server.

The key in this is the last point: for the scenario to work, the IIS server must already be configured to allow both “write” and “execute” privileges on the same directory. This is not the default configuration for IIS and is contrary to all of our published best practices. Quite simply, an IIS server configured in this manner is inherently vulnerable to attack.

However, customers who are using IIS 6.0 in the default configuration or following our recommended best practices don’t need to worry about this issue. If, however, you are running IIS in a configuration that allows both “write” and “execute” privileges on the same directory like this scenario requires, you should review our best practices and make changes to better secure your system from the threats that configuration can enable. Once again, here’s a list of best practices resources:

·         IIS 6.0 Security Best Practices

·         Securing Sites with Web Site Permissions

·         IIS 6.0 Operations Guide

·         Improving Web Application Security: Threats and Countermeasures

The IIS folks are evaluating a change to bring the behavior of IIS 6.0 in line with the other versions.  In the meantime, they’ve put more information up about this on their weblog.

I hope this helps answer any questions.

Happy Holidays and Happy New Year.

Christopher

*This posting is provided "AS IS" with no warranties, and confers no rights*

Posted Tuesday, December 29, 2009 3:07 PM by cmosby | with no comments
Filed under: , , , ,

Twitter outage via DNS hijacking – SANS Internet Storm Center

Twitter outage via DNS hijacking

Published: 2009-12-18,
Last Updated: 2009-12-18 08:37:38 UTC
by Stephen Hall (Version: 1)

5 comment(s) Facebookacebook witter

A number of diary readers have submitted that the popular micro blogging site, Twitter.com has been defaced this morning.

The twitter.com status page has the following report:

Update (11:28p): Twitter’s DNS records were temporarily compromised but have now been fixed. We are looking into the underlying cause and will update with more information soon.

If we receive any more information concerning the outage, or how the hijacking occured, we shall update the diary during the day. If you have any additional information, please let us know via the contact form.

Update: The following screen grab shows the DNS hijacking as recorded via the PassiveDNS systems. The host www . mowjcamp . org is currently hosting the defacement.

Steve Hall

Posted Friday, December 18, 2009 9:21 AM by cmosby | with no comments
Filed under: , ,

Adobe flash player and air patched – SANS Internet Storm Center

Adobe flash player and air patched

Published: 2009-12-09,
Last Updated: 2009-12-10 00:54:00 UTC
by Swa Frantzen (Version: 4)

2 comment(s) Facebookacebook witter

The almost universally installed flash player of adobe has been update to version 10.0.42.34. Adobe air was upgraded as well to version 1.5.3.

Read more about it in the apsb09-19 bulletin from adobe.

The reason behind it are 7 vulnerabilities: CVE-2009-3794, CVE-2009-3796, CVE-2009-3797, CVE-2009-3798, CVE-2009-3799, CVE-2009-3800 and, CVE-2009-3951 of which 6 lead to arbitrary code execution and the last one is a windows-only issue leading to unauthorized information disclosure, related to CVE-2008-4820.

"Upgrade!" is the loud and clear message should our audience need that encouragement.

At this point we have no guidance for users wishing to know more about version 9 of the flash player aside of considering an upgrade to the latest incarnation of version 10.

Thanks for the heads-up go to David and Andrew.

UPDATE 1:

Martin wrote in with a link to the download page for those with licenses (where you can get e.g. MSI packages) and that states: "As of December 8, 2009, Flash Player 9 is no longer available for distribution. All Licensees should now distribute Flash Player 10". I guess that implies those still holding out on Flash player 9 have but one path forward.

UPDATE 2:

We were informed by a reader that the w removed link to the download page for those with licenses is in fact a secret link. From the email adobe sends to their customers getting this link rightfully:

**********
You may not share the above link, share information with others, or publish the above link on websites, blogs, or by any other means that can be publicly accessed. The information contained on this site is meant for your use only in accordance with Adobe Flash Player Distribution License Agreement you accepted. You may direct others to http://www.adobe.com/products/players/fpsh_distribution1.html to request distribution rights.
Regards,
Adobe Systems Incorporated
***********

We didn't know about it being a secret link. And apologize for unknowingly exposing it.

If anybody knows a non-secret link that clearly states Flash Player 9 is at the end of it's updates, please send it to us as it's the kind of pressure some out there need to get to be allowed to upgrade the software.

UPDATE 3:

Flash player 9 updates for unsupported platforms are available in KB 406791. Note that his is intended for those still using unsupported OSes from their respective vendors such as Windows 98, Windows ME, MacOS X 10.1-10.3, and Red Hat Enterprise Linux 3 and 4 operating systems, who cannot run Flash player 10. Note adobe nowheresaid these were updated to fix the same bugs as those fixed in Flash player 10: use at your own risk.

--

Posted Friday, December 11, 2009 9:57 AM by cmosby | with no comments
Filed under: , , , , ,

Microsoft Security Advisory Notification - Issued: December 8, 2009

********************************************************************

Title: Microsoft Security Advisory Notification

Issued: December 8, 2009

********************************************************************

Security Advisories Updated or Released Today ==============================================

* Microsoft Security Advisory (977981)

- Title: Vulnerability in Internet Explorer Could Allow Remote Code Execution

- http://www.microsoft.com/technet/security/advisory/977981.mspx

- Revision Note: V2.0 (December 8, 2009): Advisory updated to reflect publication of security bulletin.

* Microsoft Security Advisory (974926)

- Title: Credential Relaying Attacks on Integrated

Windows Authentication

- http://www.microsoft.com/technet/security/advisory/974926.mspx

- Revision Note: V1.0 (December 8, 2009): Advisory published.

* Microsoft Security Advisory (973811)

- Title: Extended Protection for Authentication

- http://www.microsoft.com/technet/security/advisory/973811.mspx

- Revision Note: V1.2 (December 8, 2009): Updated the FAQ with information about three non-security updates relating to Windows HTTP Services, HTTP Protocol Stack, and Internet Information Services.

* Microsoft Security Advisory (954157)

- Title: Security Enhancements for the Indeo Codec

- http://www.microsoft.com/technet/security/advisory/954157.mspx

- Revision Note: V1.0 (December 8, 2009): Advisory published.

Posted Wednesday, December 09, 2009 12:41 PM by cmosby | with no comments
Filed under: , , , , , ,

Tiger Woods Car Accident Heating Up the Web – Symantec Security Blogs

Tiger Woods Car Accident Heating Up the Web

Hon Lau's picture
Hon Lau
November 28th, 2009
Filed under: , , , ,

The car accident involving Tiger Woods last night outside his home in Windemere, Florida has been generating a lot of heat as far as Web traffic and searches go. Since the news broke, the top web searches on Google has been related to the this story. Even hours after the break of the story, six out of the top ten search items are still related to this event.  Tiger Woods is obviously a huge celebrity from a sport that has a huge worldwide following. The circumstances surrounding this accident are still as yet unclear.  

Search rankings for results relating to Tiger Woods

From an IT security point of view this unfortunate incident is just another fruit ripe for the picking as far as malware writers are concerned. So it comes as no surprise that the creators of rogue antivirus or misleading application software have already jumped on the bandwagon and attempted to poison web search engine results to take advantage of this spike in web search activity.

We have observed some search engine results redirecting to a few malicious domains which are:

  • vir-curemypc-now.com
  • egafuki.cn
  • online-scanner-free.net
The sites go through the usual fake scanning activity before pointing out a whole host of serious errors and threats that needs to be cleaned from your computer. For a video of how these misleading applications generally behave you can view this video made by my colleague Benjamin Nahorney.

Fake AV scans

The files on offer on this occasion may be one of the following:
 
As you already know, taking advantage of celebrity mishaps, major news events or disasters is nothing new. We have seen this kind of activity before in relation to Serena Williams, Farah Fawcett, Michael Jackson, Tsunamis, the list is endless. So this is just another reminder that we always have to be on our guard. When searching for information on the Web, make sure your legitimate antivirus software is updated and if you are ever feel yourself being strong-armed into buying antivirus software from any dubious online sources-Don't do it! Instead go to a trusted source such as your local physical shop.
 
And if you are interested in the real news, try one of these sources:
• Reuters
• CNN
• BBC
Posted Thursday, December 03, 2009 11:17 AM by cmosby | with no comments
Filed under: , , ,

SPAM and Malware taking advantage of H1N1 concerns – SANS Internet Storm Center

SPAM and Malware taking advantage of H1N1 concerns
Published: 2009-12-02,
Last Updated: 2009-12-02 18:06:25 UTC
by Rob VandenBrink (Version: 1)
1 comment(s) digg_url = 'http://isc.sans.org/diary.html?storyid=7678&rss'; digg_title = 'SPAM and Malware taking advantage of H1N1 concerns'; digg_skin='compact'; digg_topic = 'security'; Facebookacebook witter

Gary writes in, telling us of a recent spike in SPAM with a title similar to "“State Wide H1N1 Vaccination Program", which pretends to originate from the CDC (Center for Disease Control).  The email goes on to instruct you to "follow this link to create a vaccination profile on the CDC website".

Needless to say, this email is a fake, it redirects you to a site in the Ukraine, and plants malware on your PC.  The URL is "http://online.cdc.gov, followed of course by the real domain name,  six or seven digits of seemingly random characters.

You do not need to register with the CDC to receive a vaccine for the H1N1 strain of influenza

There's also a rise in fake H1N1 sites using other vulnerabilties to compromise your PC, including the recent Adobe issues.

It never ceases to amaze me the depths that these "malware folks" will stoop to.

If you are following a link in your email - always check to see that it's taking you where you think you are going before you click it.  Copy and paste it through your clipboard, or rekey the link entirely in your browser.  This kind of deception is just so prevalent that clicking links in a received note is simply not safe!

Posted Wednesday, December 02, 2009 3:29 PM by cmosby | with no comments
Filed under: , , ,

Microsoft Black Screen of Death - Fact of Fiction? – SANS Internet Storm Center

Microsoft Black Screen of Death - Fact of Fiction?
Published: 2009-12-02,
Last Updated: 2009-12-02 16:43:47 UTC
by Rob VandenBrink (Version: 1)
1 comment(s) digg_url = 'http://isc.sans.org/diary.html?storyid=7672&rss'; digg_title = 'Microsoft Black Screen of Death - Fact of Fiction?'; digg_skin='compact'; digg_topic = 'security'; Facebookacebook witter

We've had a lot of interest in the drama unfolding around Prevx's announcment on Nov 27 that they had found a "Black Screen of Death" issue that they had researched - you can find their initial post on this issue here ==>  http://www.prevx.com/blog/140/Black-Screen-woes-could-affect-millions-on-Windows--Vista-and-XP.html
The title of their blog indicates that this could affect "millions of Windows 7, Vista and XP stations".  Prevx's root cause post on dec 1 ( http://www.prevx.com/blog/141/Windows-Black-Screen-Root-Cause.html ) fleshes this out further, indicating that that one of the recent Microsoft patches, either KB915597 and/or KB976098  seemed to modify the ACLs on a registry key that in turn denies local users the right to view their own desktop, which results in the "black screen" symptom.

This is a well known and long-standing symptom -  you can deny users access to their own screen by changing the ACLs on the registry key  HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonShell .  This isn't a problem on it's own, it's part of the overall design of Windows - I can think of a few cases where this might be a useful thing in fact.

Anyway, on to the drama: Microsoft also posted on Dec 1 ( http://blogs.technet.com/msrc/archive/2009/12/01/reports-of-issues-with-november-security-updates.aspx ) - they had a few important points:

  • They've reviewed all of their recent updates - they simply do not change this ACL
  • They are not receiving millions of calls - this can't be affecteding millions of systems
  • Prevx went straight to press without involving Microsoft


I'd echo Microsoft on this one (on all 3 points actually) - we simply aren't seeing any widespread "black screen" issue.

Prevx has posted a final blog entry today ( http://www.prevx.com/blog/142/Windows-Black-Screen-recap.html ).  They're now agreeing with Microsoft, that the black screen issue that they've seen appears to have some cause unrelated to the Microsoft updates.  I can see how this might be an easy mistake to make, especially if you are researching several issues on one machine or VM image.

The thing I find most interesting in this cyber-opera is the number of  posts that we're seeing on other sites that took the original post as truth without doing any check at all.  I realize people are busy and everything, but a little bit of fact-checking goes a long way ....


So to recap - the "Black Screen of Death" is in fact a real thing, but it's not a recent thing, and you won't be seeing it as a result of applying any of the Microsoft patches to date.  It's still recommended to keep your Windows systems (and any other systems for that matter) as up to date as possible with vendor updates.

Posted Wednesday, December 02, 2009 3:27 PM by cmosby | with no comments
Filed under: , , , ,

Rogue Security Product Copies McAfee’s Look and Feel – McAfee Labs Blog

Rogue Security Product Copies McAfee’s Look and Feel

Tuesday November 10, 2009 at 11:22 am CST
Posted by Girish Pillai

4 Comments;

How good are you at identifying a genuine security product from an imposter that claims to offer protection? If you think you are good at it, then have a look at the images below.

[Legitimate McAfee site]

[ Legitimate McAfee site]

[Rogue Anti-Virus MaCatte site]
[Rogue Anti-Virus MaCatte site]

Recently we have seen the rapid growth of rogue anti-virus/spyware programs. This one is especially interesting. Why? Because it mimics McAfee’s security product. This rogue software displays the same user interface as McAfee Security Center. It also offers a web page that looks similar to McAfee’s legitimate site.

I suppose we should be flattered that malware authors have chosen our product as one worth imitating. Rogue anti-virus products have long mimicked Microsoft’s security apps in Windows XP (FakeAlert-XPSecCenter) and Windows Vista/Windows 7 (FakeAlert-EA).

The idea behind fake AV software is to trick unsuspecting users into thinking their machines are infected. The malware will display a window that shows many innocent files detected arbitrarily as compromised. These fake security alerts are baseless–they exist to trick victims into pressing the panic button. In this case agreeing to “Remove all threats now” will lead to purchasing the MaCatte Antivirus 2009 product. The rogue software offers several “features”:

  • It displays fake warning messages and “Safety Center Alert” pop-ups
  • It flashes icons that appear in the system tray
  • It hijacks the browser’s homepage to a site that mimics McAfee’s site
    (as shown in the second image)

    • [MaCatte SecurityCenter image]

    [MaCatte SecurityCenter image]

    And that’s not all–MaCatte Antivirus 2009 will block currently installed or downloaded anti-virus software. It will redirect your browser to various misleading websites, including the rogue program’s homepage, www.macatte.com.

    Once installed, MaCatte Antivirus will start automatically when you boot Windows. Then it will scan your computer and display numerous infections, but will not remove them until you first purchase the program.

    The cost of cleaning the “malicious” files comes at the rip-off price of $99. Leading legitimate anti-virus security products don’t come close to the cost of this imposter. I hope that’s an eye opener for you. Don’t become a victim.

    Update: McAfee’s legal team contacted the domain registrars, who swiftly brought down the site to spare unsuspecting surfers from becoming victims to this imposter. Detection is available beginning with the 5793 DATs as FakeAlert-MaCatte.

    Posted Wednesday, December 02, 2009 8:46 AM by cmosby | with no comments
    Filed under: , , , ,

    Malicious iPhone Worm – F-Secure Weblog

    <<< Sunday, November 22, 2009 >>>
     
    Malicious iPhone Worm Posted by Mikko @ 11:38 GMT | postCount('00001822'); Comments (2)

    We've received a sample of a malicious iPhone worm with botnet functionality.

    Like the Ikee worm, it only affects Jailbroken iPhones which have SSH installed and have not changed the default password.

    This one connects to a web-based command & control center running at 92.61.38.16 in Lithuania.

    duh

    The worm is not widespread, but it is much more serious than the first iPhone worm as it tries to steal information from the devices.

    Thanks to Scott at XS4ALL for all the help!

    Posted Wednesday, December 02, 2009 8:36 AM by cmosby | with no comments
    Filed under: , , ,

    Yet Another iPhone Worm? – Symantec Security Blogs

    Yet Another iPhone Worm?

    John McDonald's picture
    John McDonald
    November 22nd, 2009
    Filed under: , ,

    It's only been a couple of short weeks since the iPhone background-changing incident that took the world by storm (well, parts of Australia at least), but already a Dutch ISP has reported what would be the first malicious iPhone worm to be seen in the wild.

    Unfortunate news to be sure, but not exactly surprising. Our two recent blogs relating to iPhone threats warned (and I quote) that 'the publicly released code could easily be altered so that consequences were not so benign'. In case you missed them, the first blog was about the Ikee rickroller, which wasn't really considered malicious in that it only changed the iPhone background to a picture of 80's pop singer Rick Astley and was really more of a warning from the creator that jailbroken iPhones in a certain state could be compromised. That incident was followed closely by a hacktool that ran on computers but tried to scan for and log onto vulnerable devices. In both cases the so called vulnerable devices were restricted to jailbroken iPhones running SSH and using the default password of "alpine".

    The new worm, which also targets jailbroken iPhones running SSH and still using the default password, can reportedly steal data contained on the iPhone as well as connect back to the attacker giving them control over the phone including the ability to download and install malware onto it. The root password may also be changed in order to prevent the owner from accessing the device. Unlike the first iPhone worm, this one appears to cover a much broader range of IP addresses, including UPC in the Netherlands, Optus in Australia, possibly a Hungarian and a Portuguese provider, T-Mobile and potentially many others. And although this particular incarnation seems to be very similar in functionality to the hacktool we blogged about , this one supposedly runs and spreads directly from an infected iPhone, not from a computer.

    We are currently attempting to source a sample for analysis and will provide more information as it comes to light. If you have been infected and/or have a sample that you can share with us please post about it on the Norton Forum here.

    After all the fuss caused by the previous incidents it's hard to believe anyone would have left their jailbroken iPhone in a vulnerable state, but if you think your iPhone (or iPod Touch) may have been compromised, or if you have jailbroken your device and are worried about it, we recommend that you backup your data then restore your device to its factory settings and where applicable apply the latest firmware update from Apple.

    We also highly recommend you never leave a password blank, or as the factory default.

    UPDATE: Scott McIntyre at XS4ALL kindly provided us with a sample. We have added detection for it as iPhoneOS.Ikee.B.

    Posted Wednesday, December 02, 2009 8:35 AM by cmosby | with no comments
    Filed under: , , ,

    Get Out of Jail, Not so Free – McAfee Labs Blog

    Get Out of Jail, Not so Free

    Tuesday November 10, 2009 at 3:58 pm CST
    Posted by Jimmy Shah

    No Comments

    Nearly two years ago the first attempt at creating iPhone malware was seen.  That was an attack against jailbroken iPhones.  This month, although the shenanigans are still targeting jailbroken iPhones, things got a bit more complicated.

    Last week saw someone in the Netherlands attempting to extort iPhone owners.  The attacker scanned his mobile phone carrier’s network looking for jailbroken iPhones. Once he located a phone running the secure shell service(SSH) he attempted to login using the default root user account password.  instead of quietly taking a look at or copying the user’s SMS messages and emails,  he decided to be a nice guy and replace their wallpaper with a demand for €5(approximately $7) in order to secure their iPhone.  His PayPal account was shut down and he quickly put up instructions for changing the password on his site.

    Then this very week also saw the release of a worm by an Australian malware author using the handle ‘ikee’.  It exploits the same root password vulnerability as that used by the Netherlands attacker.  The worm family is now called OSX/RRoll.  It’s notable for replacing your wallpaper with an image of Rick Astley and a message from the author.  After changing the background image, OSX/RRoll.A-B will delete the binary of the SSH daemon(service) and terminate its process.  This serves the dual purpose of closing the hole that allowed infection and also preventing reinfection by the worm or other attackers.

    OSX/RRoll.A-B Lock Screen image

    Background image displayed while the iPhone is locked. (Simulated)

    OSX/RRoll.A-B during call image

    Background image displayed during a phone call. (Simulated)

    Potential Legal Issues

    The malware author gave an interview earlier in the week where he explains that there are four variants in the wild.  While he was willing to share the source code with his interviewer he expressed concern with its public release:

    [10:13] <ikee> [...](I don’t know if its so wise posting the code online, nefarious people that otherwise would not have had the chance could modify it to be quite destructive)

    Fortunately the interviewer shortly removed public access to the Google Code project.

    The concern by ikee is certainly good to see and shows that perhaps he views malware creation as a bad idea.  What is odd, is that he doesn’t think he will run into any trouble with the authorities.  Unlike our friend from the Netherlands.

    From ikee’s interview:

    [09:39] <JD> Are you aware of the possible legal consequences of this (the [OSX/RRoll worm])? Are you concerned?
    [09:40] <ikee> I’d like to think I’m aware, and also I highly doubt I’m in any real trouble (So no not concerned)

    It seems Australia actually has a number of laws concerning High Tech Crime and ikee may eventually have a conversation with the Australian Federal Police. But who knows as I am not a lawyer.

    Prevention

    OSX/RRoll.A-B only targets jailbroken iPhones that run on the networks of three mobile carriers in Australia.  If you’ve installed the SSH service on your iPhone but neglected to change your root password from the well known default, you’re likely to be at risk from attackers.

    Users can reduce their risk by:

    • Changing the default root password.
    • Not installing/uninstalling the SSH package if you don’t use it.
    • Modifying your phone’s firmware can sometimes result in having software installed by default or with default settings.

    Future threats

    The source code for both versions of OSX/RRoll was available from a Google Code project for a little while earlier this week.  Once you have working source code for a worm, it can be straightforward to add more malicious actions.

    As with the first attempt at iPhone malware which exploited an installer application for jailbroken iPhones, OSX/RRoll.B  exploits the Cydia Installer application.  Where previously the Installer application dealt only in free applications developed with the unofficial iPhone SDK, the Cydia application also provides the ability to buy applications through a Cydia Store. With the possibility of making money(application sales) and possibly lax security(unchanged default root passwords) attackers may see an opportunity in targeting  applications like Cydia.

    Posted Wednesday, December 02, 2009 8:32 AM by cmosby | with no comments
    Filed under: , , ,
    More Posts Next page »