InfoSec News

Twitter is contesting a court order requiring it to turn over private data on a user charged with disorderly conduct during the Occupy Wall Street protests in New York last year.
(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Experts suggest patience when dealing with this month?s round of Microsoft updates.

Add to digg Add to StumbleUpon Add to del.icio.us Add to Google
Many of the Twitter logins and passwords leaked on the web this week are either inaccurate or belong to accounts already suspended for spamming, the company said late Tuesday.
Based on feedback from February beta release, revisions affect coloring, icons, and Metro style
KingSCADA Insecure Password Encryption Information Disclosure Vulnerability
MyBB 'keywords' Parameter Multiple SQL Injection Vulnerabilities
Lenovo has again expanded the recall of some ThinkCentre all-in-one desktops that could catch fire due to a component defect.
Yahoo's board of directors said Tuesday it has formed a special committee to investigate CEO Scott Thompson's academic credentials, as well as documents and circumstances surrounding his hiring earlier this year.
In addition to other announcements, the folks behind PHP have released new versions in the 5.3 and 5.4 branches to address a couple of security issues.
5.3.13 addresses CVE-2012-2311 and 5.4.3 addresses both CVE-2012-2311 and CVE-2012-2329.
Details are available here: http://www.php.net/archive/2012.php#id2012-05-08-1 (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
It's tempting to treat Bobsled Calling as a variation on Skype. And while there are a lot of similarities between the two apps, there are also some crucial differences.
A panel of Yahoo board members has begun investigating the hiring of CEO Scott Thompson in the wake of revelations that his resume's listing of computer science as a second undergraduate major was false, according to the Wall Street Journal.
The U.S. Federal Trade Commission is seeking a civil court contempt ruling against the largest third-party billing vendor in the U.S., alleging that it placed more than US$70 million in unauthorized charges on telephone bills in violation of a previous court order.
Federal Communications Commission Chairman Julius Genachowski outlined several agency initiatives to open up more spectrum for mobile services, as well as improve spectrum efficiency, in a keynote address at CTIA Wireless on Tuesday.
Microsoft has fixed 23 vulnerabilities in its software products, including several considered critical, the company said on Tuesday in its monthly security patch report.
Adobe Photoshop '.tiff' File Use After Free Memory Corruption Vulnerability
Social networking site Myspace has agreed to settle charges from the U.S. Federal Trade Commission that it misrepresented its protection of users' personal information, the FTC announced Tuesday.
Responding to a U.S. district court judge's order, Apple and Samsung Electronics have trimmed the number of claims they will assert in a broad intellectual-property lawsuit regarding smartphone and tablet products.
Yahoo has acknowledged that its new CEO, Scott Thompson, does not hold a degree in "accounting and computer science" as his resume and the company's financial filings claimed, and instead majored only in accounting. Do questions about Yahoo CEO Scott Thompson's resume hurt the company?
Epicor is planning to work with Microsoft to bring Epicor's ERP (enterprise resource planning) applications to the Azure cloud service, the companies announced Tuesday during Epicor's Insights conference in Las Vegas.
Adobe has released their monthly security bulletins today:

Security Bulletin for Adobe Illustrator - APSB12-10 - http://www.adobe.com/support/security/bulletins/apsb12-10.html
Security Bulletin for Adobe Photoshop - APSB12-11- http://www.adobe.com/support/security/bulletins/apsb12-11.html
Security Bulletin for Adobe Flash Professional - APSB12-12 - http://www.adobe.com/support/security/bulletins/apsb12-12.html
Security update available for Adobe Shockwave Player - APSB12-13 - http://www.adobe.com/support/security/bulletins/apsb12-13.html

Note that APSB12-12 addresses Flash Professional, not the flash player add-on to your browser. Also of note is that the first three bulletins simply inform users that their current version of the software is vulnerable, and that the upgraded version isn't. No free security patch options, just pay to upgrade. At least the Shockwave player update is free. (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Overview of the May 2012 Microsoft patches and their status.

Contra Indications - KB
Known Exploits
Microsoft rating(**)
ISC rating(*)


Microsoft Word RTF Import

(Replaces MS10-079, MS11-089, MS11-094)

Microsoft Word 2003 and 2007

KB 2680352
No publicly known exploits

Exploitability: 1

Microsoft Office Remote Code Execution Vulnerabilities

(Replaces MS11-072, MS11-089, MS11-094, MS11-096)

Microsoft Excel 2003/2007/2010






KB 2663830
Yes (CVE-2012-0143)

Exploitability: 3,3,1,1,2,1

Visio Viewer 2010 Remote Code Execution Vulnerability

(Replaces MS12-015)

Microsoft Visio Viewer 2010

KB 2597981
No publicly known exploits

Exploitability: 1

TCP/IP Elevation of Privilege and Firewall Bypass Vulnerability

(Replaces MS11-083)

TCP/IP, Windows Firewall


KB 2597981
No publicly known exploits

Exploitability: 1

Vulnerability in Windows Client/Server Run-time Subsystem Could Allow Elevation of Privilege

Plug and Play (PnP) Configuration Manager Vulnerability

KB 2690533
Elevation of Privilege

Exploitability: Likely

Combined Security Update for Microsoft Office, Windows, .NET Framework, and Silverlight

(Replaces MS11-029, MS12-018)

Microsoft Windows, Microsoft .NET Framework, Microsoft Silverlight, Microsoft Office










KB 2681578

Exploitability: 1,1,1,1,2,1,1,1,1,1

.Net Framework Remote Code Execution

(Replaces MS11-044, MS11-078, MS12-016)

.NET Framework


KB 2693777
No publicly known exploits

Exploitability: 1

We will update issues on this page for about a week or so as they evolve.

We appreciate updates

US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY

(*): ISC rating

We use 4 levels:

PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
Critical: Anything that needs little to become interesting for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
Important: Things where more testing and other measures can help.
Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.

The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a t ypical worst-case role.
Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.

(**): The exploitability rating we show is the worst of them all due to the too large number of ratings Microsoft assigns to some of the patches.

Adam Swanger, Web Developer (GWEB, GWAPT)

Internet Storm Center - https://isc.sans.edu (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
One of the attacks I always perform when doing internal penetration tests is NetBIOS Name Spoofing. NetBIOS has been a golden mine for penetration testers for years many good articles about how to use NBNS spoofing have been written, and Metasploit comes with a module that allows you to easily abuse NBNS in order to collect LM and NT hashes from victim machines (of course, depending if LANMAN has been disabled or not).
I wrote a diary about this back in January so if you want to see details on how to abuse this Id suggest that you read http://isc.sans.edu/diary.html?storyid=12454 first.
However, attacking clients, retrieving their LM/NT hashes and cracking them, as fun as it is, is only half of the job a penetration tester has to do. Besides capturing the flag, the report you produce must also include recommendations on how to mitigate the detected vulnerability otherwise it is really useless for your client (no matter how cool it is for us penetration testers to pwn something).
So after seeing NBNS being abused in many internal penetration tests (all?) I started checking what potential security controls we have at our disposal to prevent such attacks, or at least to make them less effective.
Obviously, the best way to prevent NBNS spoofing attacks is to completely disable NetBIOS name resolution. However, this maybe be easier said than done from the diary I posted before (link above) it appears that there are many other services that still depend on NBNS.
Since Windows operating systems now come with a firewall (Windows firewall with Windows XP SP2 and Windows Firewall with Advanced Security with Vista and newer OSes) that can have multiple policies, depending on the current location of the machine (home, work or public networks), this sounded like a perfect idea for preventing NBNS attacks. In this scenario, an administrator that controls client machines through group policies could allow NBNS in home and work networks and disable it completely in public networks. While not perfect, this still offers a certain (and Id say decent) amount of protection.
However, while testing this I noticed that the Windows firewall has a nasty bypass vulnerability (the now patched CVE-2012-0174 vulnerability).
In order to test it I turned on both inbound and outbound firewalls remember that the Windows built-in firewall does not stop outbound connections by default:

Besides this, NBNS rules had to be disabled manually, in order to prevent NB-Name-Out network traffic. By stopping this traffic we would make sure that an attacker cannot abuse NBNS spoofing attacks, since the built-in firewall would stop all such outgoing requests. You can see the rules, with their respective profiles in the following picture:

After setting this, I expected that my NBNS spoofing attacks will fail. However, that did not happen the attacks were still successful, and I was able to see NBNS queries on my local network. After setting up logging in the Windows firewall as well, I confirmed that Windows was happily letting this traffic leave, despite all the rules that have been set above:
2012-01-29 11:07:21 ALLOW UDP 137 137 0 - - - - - - - SEND

This log shows a NBNS query destined to the local networks broadcast address.
The issue here is pretty clear this means that an organizations administrator who set such rules to protect his clients when they leave the organizations network cannot rely on the built-in Windows firewall!
And, if you take a look at the attack scenarios I mentioned in the first diary, this can be particularly nasty for browsers configured in organizations. For example, a lot of organizations configure browsers on client machines to automatically open intranet portals, which are typically hosted on machines with names intranet, portal or similar.
When a user with such a machine connects to an open wireless network and opens a browser, the browser will first try to resolve such a name via DNS. When that fails, the machine will try to resolve this name via NBNS and this is where an attacker can fake the response and start collecting LM/NT hashes.
Another very nasty scenario includes machines looking for WPAD (Web Proxy Auto-Discovery). By spoofing this request, an attacker can push his own machine as the web proxy and the clients web browser will happily use it, allowing the attacker to analyze network traffic and at least try to launch Man-in-the-Middle attacks (hopefully, weve trained our users not to click on certificate warnings, right?).
So, I got in touch with Microsoft and the MSRC guys verified that this is indeed an issue with the firewall. The conversations with the MSRC guys were great and, as you can see, the patch has been released that fixes this vulnerability.
As with other security patches, you should definitely install it as part of your monthly patch install cycles. The whole exercise also shows how one should always test security controls that you put in place just the fact that you added a rule to block certain network traffic does not have to mean that the traffic is really blocked.

More information and the patch is available at the Microsofts web site: http://technet.microsoft.com/en-us/security/bulletin/ms12-032
Advisory details at http://www.infigo.hr/en/in_focus/advisories/INFIGO-2012-05-01



INFIGO IS (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
John writes in to report that Symantec has announced an issue with their current definition files that may generate false-positive alerts on .xls files.


Thanks John!
The fix should be going out today as a rapid release: 134129 2012-05-08 rev. 016 (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
At three different events in three different U.S. cities 3LM, Symantec and Wyse Technology are all showing upgraded or new products to help IT staff better cope with the smartphones, tablets and other devices users are allowed to bring to work.
The people of Nevada may be in for a surprise when they drive to the market or down the highway: They might encounter driverless cars.
Research in Motion has appointed a new COO and CMO as it prepares to launch BlackBerry 10 smartphones later this year in hopes of reversing a decline in its global smartphone share.
A panel of Yahoo board members has begun investigating the hiring of CEO Scott Thompson in the wake of revelations that his resume's listing of computer science as a second undergraduate major was false, according to the Wall Street Journal.
Microsoft is pitching its SkyDrive online storage service to Office for Mac users, calling Apple's iCloud offering "not enough" for collaboration, file sharing and anywhere-access to documents.
Small and medium-sized businesses are spending more money on IT, including adopting tablets, cloud services and virtualization to a greater extent, according to Spiceworks' State of SMB IT survey.
At its annual Symantec Vision conference attended by enterprise customers and business partners, Symantec laid out its management and security product strategy for mobile endpoint devices, including the iPhone, iPad and Google Android devices.
Solid-state storage array maker Whiptail announced its first modular, scalable all-flash array with up to 72TB of capacity.
Correctly configuring a network for IP storage isn't quite as simple as it seems. Here's how to do it right. Insider (registration required)
The announcement Tuesday of a new partnership between Dell and Red Hat could mark a further expansion of open-source software use in the enterprise.
EBay is hiring for a development center it is setting up in Bangalore, its second in the country.
Yahoo CEO Scott Thompson says he's sorry, but is not admitting any wrongdoing.
Dell on Tuesday announced a new microserver with Intel Xeon server processors based on the Ivy Bridge microarchitecture, which has not been officially announced by the chip maker yet.
VMware Multiple Products Multiple Memory Corruption Privilege Escalation Vulnerabilities
Almost $1.5 billion was raised in 2011 by crowdfunding platforms around the world, according to an industry report.
Re: [Full-disclosure] Ubuntu, Linux Mint, and the Guest Account
Ubuntu, Linux Mint, and the Guest Account
Fwd: [cryptography] Apple Legacy filevault barn door...

Infosec experts speak out on natural gas pipeline attacks
CSO (blog)
Not long after I wrote about the cyberattacks against natural gas pipelines in the US, three infosec experts shared their thoughts on the matter. Here's what they had to say: Eric Chiu, president and founder of HyTrust, a cloud infrastructure control ...

and more »

InfoSec Skills CEO Backs David Willets' "Hybrid" Approach to National Cyber ...
PR.com (press release)
InfoSec Skills' CEO, Terry Neal, has said that he fully supports the position David Willets described in a speech at Europe's biggest Information Security trade show last week. London, United Kingdom, May 01, 2012 --(PR.com)-- InfoSec Skills' ...

and more »
Of the nation's four biggest wireless carriers, only T-Mobile USA has revealed plans to deploy Passpoint, a technology that would allow wireless users to automatically access Wi-Fi hotspots from carriers' 3G and 4G cellular networks.
Samsung Electronics and Qualcomm have joined forces and formed the Alliance for Wireless Power to accelerate the development of wireless charging.
APPLE-SA-2012-05-07-1 iOS 5.1.1 Software Update
[SECURITY] [DSA 2459-2] quagga security update
[ MDVSA-2012:070 ] samba
[ MDVSA-2012:069 ] cifs-utils

Live from Hollywood: An #infosec meeting of the minds
CSO (blog)
Last fall I lamented in a post about the lack of security conferences in LA and vowed that if I found some, I would start going. Why should San Francisco and San Jose get all the glory? And so, next week -- May 16, specifically -- I'll be at ...

The Washington State Attorney General's office reached a settlement on Monday with an advertising company it alleged baited and spammed Facebook users with salacious content in order to direct them to unrelated advertising.
While battery capacities in smartphones has increased, 4G LTE networks are taking their toll on battery life for Web browsing and video streaming, according to Metrico Wireless.
Printers are evolving from passive devices as vendors cram more features into them and buyers find ways to better integrate them into the overall environment.
The 2012 IDG Enterprise Unified Communications and Collaboration survey highlights the uptick in adoption and investments. Insider (registration required)
Lenovo on Tuesday launched its K-series of smart TVs in China, marking the PC vendor's entry into another hot devices market.

Posted by InfoSec News on May 08


By Steve Ragan
May 07, 2012

According to reports, which were confirmed Friday by ICS-CERT, an active
Phishing campaign is responsible for the U.S. Department of Homeland
Security (DHS) issuing three warnings since the end of March that the
natural gas industry has been under ongoing cyber attack. However, it’s

Posted by InfoSec News on May 08


By Dan Goodin
ars technica
May 7, 2012

A huge number of websites around the world are endangered by an
unpatched vulnerability in the PHP scripting language that attackers are
already trying to exploit to remotely take control of underlying
servers, security researchers warned.

The code-execution attacks threaten PHP...

Posted by InfoSec News on May 08


By George V. Hulme
May 07, 2012

Enterprise security pros have plenty to worry about: malware, insiders
stealing information, an employee leaving an unencrypted notebook full
of gigabytes of intellectual property on a train. However, the spate of
hacktivist attacks in recent years from groups such as Anonymous and
LulzSec has upped the anxiety...

Posted by InfoSec News on May 08


The Jakarta Post

China-based hackers are reportedly targeting US-based Google Inc and
Intel Corp.

An attack hackers launched on iBahn could help them access secret
e-mails, even encrypted ones, according to a US senior intelligence
official familiar with the matter.

As many as 760 companies have had their data accessed by hackers...

Posted by InfoSec News on May 08


By James Titcomb
Mail Online
4 May 2012

The millionaire British founder of security firm McAfee has been
forcefully arrested in Belize following a drugs and weapons bust at his

John McAfee had his house in Orange Walk, Belize City, surrounded by
armed guards on Monday. McAfee says they stormed his house, killed his
dog and handcuffed him in the sun for 14 hours without...
Internet Storm Center Infocon Status