Information Security News
Thanks for reading the ISC Diary! I hope you find useful information in the diary posts. I, and the other handlers, work hard to try and bring you the latest news as it develops, as well as point out interesting new research that affects our industry and our ability to protect our networks. BUT don’t stop with the diary. Quite often the MOST interesting part of the article is in the comments from the readers. Consider the following:
About a year ago I did a post entitled “What can you do with funky directory names?” https://isc.sans.edu/forums/diary/Challenge+What+can+you+do+with+funky+directory+names/12958
The post is about creating a “.. “ (Dot Dot Space) directory. You can even create a funky directory name that will cause windows to generate an error dialog message and go into an error condition. This is COOL STUFF right? Well, yeah but not nearly as interesting as the mostly overlooked last comment on the page. An anonymous ISC reader posted this comment:
“It's also easy to use similar file name tricks to make your malicious binary appear to be Microsoft signed. Name your malware file "svchost.exe " (note trailing space) and put it in the same folder as the legitimate file. Attempted reads of your malicious file will "miss" your file and instead hit the legitimate (and signed) binary. (This is because win32 will auto-remove the trailing space.)
The nice thing about CreateProcess is that it launches the malicious process just fine.”
What does this mean? Well, if you create a executable on the hard drive that ends with a SPACE and then execute it some interesting things happen. Applications such as Microsoft Sigcheck, Mandiant Redline, Process hacker and other tools that will check the digital signatures of the processes in the process list check the incorrect file. The malware is “svchost.exe “. But when these tools turn to the hard drive to read the executable digital signature the underlying API trims the trailing space and they read the signature on the real “svchost.exe”. The result is that those security tools find a legitimate digital signature and incorrectly believe the file “svchost.exe “ has been digitally signed by Microsoft.
Matt Graeber (@mattifestation) did a write up on his testing of the issue here http://www.exploit-monday.com/2013/02/WindowsFileConfusion.html
I have found this technique to be useful for fooling Non-Microsoft tools that rely on digital signatures. So don't stop with the article! Read the comments from our brilliant readers. Please TEST your HIPS, Whitelisting applications, Forensics tools and other digital signature based tools using the process outline by Matt Graeber. Is it vulnerable? Post a comment (responsible disclosure is encouraged) and other brilliant insights in the comments!
Follow me on Twitter: @markbaggett
There are a couple of chances to sign up for SANS Python programming course. The course starts from the very beginning, assuming you don't know anything about programming or Python. The course is self paced learning and we cover the essentials before we start building tools you can use in your next security engagement. You will love it!! Join me for Python for Penetration testers in Reston VA March 17-21 or at SANSFire in Baltimore June 23-27.
by Cyrus Farivar
The easiest way to not be tracked via your phone is to not have a phone. Of course, that means you won’t have a phone. So you can’t call or text, much less check your e-mail or play Angry Birds while on the bus.
Even if you do have a phone, setting it up with privacy-minded tools—Tor, OTR chat, secure texting, and calling—is cumbersome, and of course requires that your calling or texting partner on the other end of the line has all of that installed as well.
On Wednesday FreedomPop, a Los Angeles-based mobile data startup, announced what it’s nicknamed the “Snowden Phone” after the notorious whistleblower. Officially called the Freedom Privacy Phone, it's actually a three-year-old Samsung Galaxy II Android with a modified bootloader, which means you can’t easily upgrade the Android firmware without, say, breaking the entire VOIP setup.
We've all read a lot about the scans and exploits of UPNP (Universal Plug N Play), on UDP port 1900. Jens, one of our readers, pinged us this morning with a question about an uptick he was seeing in TCP/5000, which is also listed as UPNP - who knew? (not me, that's who!)
After a quick check, I'm seeing an uptick in attack activity on TCP/5000 starting in mid-February, both in our dshield database and on various customer firewalls. Our reader was seeing his attacks come from an IP allocated to China, but I'm seeing more attacks sourced from the US.
Does anyone have any of these attack packets captured, preferably more than just SYN packets?
Or if anyone has a sample of the attack software or any malware involved, we'd of course love a sample of that as well !
by Jon Brodkin
Flexcoin, the self-proclaimed "world's first Bitcoin bank," was robbed by attackers who took advantage of a flaw in the bank's code for transferring bitcoins.
As reported yesterday, Flexcoin shut down after an attacker made off with 896 bitcoins, the equivalent of about $600,000. The company has since posted a more thorough explanation of just how it was robbed on its home page:
The attacker logged into the flexcoin front end from IP address 22.214.171.124 under a newly created username and deposited to address 1DSD3B3uS2wGZjZAwa2dqQ7M9v7Ajw2iLy
The coins were then left to sit until they had reached 6 confirmations.
The attacker then successfully exploited a flaw in the code which allows transfers between flexcoin users. By sending thousands of simultaneous requests, the attacker was able to "move" coins from one user account to another until the sending account was overdrawn, before balances were updated.
The stolen coins were in Flexcoin's "hot wallet," the account used to instantly pay out withdrawals. The bitcoins that Flexcoin customers had deposited were stored separately on computers that weren't connected to the Internet, according to Flexcoin. The company said it will attempt to give users their coins back, presuming it can verify users' identities.
In late January we all heard about bluetooth enabled credit card skimmers on gas pumps. Since that story broke, I've been seeing some attempts at reassuring the public on this issue - I'm seeing pumps at multiple chains having their card readers taped and initialed.
I suppose they figure crooks don't have red tape, or pens. This really is more to reassure consumers, to say "yes, we do check these once in a while to make sure that your card isn't being skimmed". Though that assumes the person checking can tell a reader cover from a skimmer.
I was surprised also to find that this "breaking story" on skimmers which hit the news in January 2014 was first posted by Brian Krebbs way back in 2010 -
... but by the time my brain caught up with who's page I found this on, I wasn't surprised at all.
The main protection we have against skimmers is the moral fortitude of the attendant working at the station. We're depending on that person doing the right thing when faced with a choice between a potentially very large bribe. Skimmer operations can easily net tens of thousands per week, or millions in this recent case https://krebsonsecurity.com/2014/01/gang-rigged-pumps-with-bluetooth-skimmers/. So the risk / reward proposition is a large bribe, often in the tens-of-thousands range, against being aprehended and charged/convicted if the operation is caught and apprehended before they shut down and move on to the next set of target gas stations.
Please, weigh in using our comment form. I'd be really interested if our readers might have solutions or preventitive measures that will work better than the red tape I described in this story!
Posted by InfoSec News on Mar 05http://www.informationweek.com/government/cloud-computing/fedramp-cloud-security-approval-look-who-applied/d/d-id/1114101
Posted by InfoSec News on Mar 05http://www.infosecnews.org/the-open-enigma-project-kickstarter/
Posted by InfoSec News on Mar 05http://www.fiercegovernmentit.com/story/dhs-proposes-125-billion-cybersecurity-spending/2014-03-04
Posted by InfoSec News on Mar 05http://www.washingtonpost.com/world/national-security/italian-spyware-firm-relies-on-us-internet-servers/2014/03/03/25f94f12-9f00-11e3-b8d8-94577ff66b28_story.html
Posted by InfoSec News on Mar 05http://www.computerworld.com/s/article/9246737/No_special_treatment_for_China_on_XP_patches_end_April_8_in_the_PRC_too
Posted by InfoSec News on Mar 05http://arstechnica.com/security/2014/03/critical-crypto-bug-leaves-linux-hundreds-of-apps-open-to-eavesdropping/
Posted by InfoSec News on Mar 05http://www.dailymail.co.uk/sciencetech/article-2573101/Could-NHS-COMPUTER-virus-Outdated-software-putting-official-sites-risk-attack.html