InfoSec News

Organizations that are interested in using open source in their own products but are wary of intellectual property issues might want to examine a new, mostly free, assistance program just launched by the non-profit Linux Foundation.
 
In view of all the brute force attacks still being attempted against Secure Shell (SSH), we have long since been extolling the virtues of forgoing passwords and moving to RSA/DSA keys instead.
While key based login indeed nicely addresses the problem of password guessing attacks, it looks like many a Unix admin has been less than diligent in the implementation. In pretty much every Unix security audit recently, we've come across unprotected or badly protected SSH private keys (id_dsa, id_rsa). Some reside plain flat out in the open, in /tmp and such. Others are found in world-readable tar backup archives of user and administrator home directories. Some are even built into home-grown Linux RPM and Solaris PKG packages, ready to be plucked off an install server.
It probably goes without saying, but let's repeat it nonetheless:

Whoever can access a TAR/ZIP/GZ archive, can read all its contents. Be super careful when you create a temporary archive copy of everything residing in a home directory. This copy is bound to include the .ssh directory, and the private keys therein
Whoever can access a RPM or PKG package, can read all its contents. Yes it is convenient to have the SSH keys that are part of your home-grown admin script suite already within the install package. But then don't be surprised if others make use of this convenience, too.

In a Unix penetration test within a company or academic institution network, we often first go looking for files and directories that can be read without authentication. Most large organizations have an install server from where they stage their new Unix systems, and often we find these install servers to openly share the package filesystem over NFS foreveryone. Other good choices are home directories, all too often also exported via NFS to everyone. Once read access is established, we can go hunting:
$find /mnt/some_exported_fs \( -name id_dsa -o -name id_rsa

$find /mnt/some_exported_fs -type d -name .ssh

$find /mnt/some_exported_fs -type f -name *.tar | egrep (^/|id_dsa|id_rsa|.ssh)
...etc. Adapt as needed for your environment.
To better protect your privates, please consider to

add a passphrase for all private keys that are used interactively. ssh-keygen -p can be used to add a passphrase to an existing private key
use a forced command for all private keys that are used in system automation, to limit the abuse potential. Use command=/bin/foo/bar in an authorized_keys file to limit what the corresponding private key can do



Keys without passphrase look differently from those that have one.If you want to make sure that your users also protect their privates, you can (as root) search for keys without passphrase with the following command
#find / \( -name id_dsa -o -name id_rsa \) -exec egrep -L Proc-Type 2/dev/null
Newer DSA/RSA Keys contain the string Proc-Type as part of the key file when a password is set on the key. The above command lists all those key files where this isn't the case (egrep -L)
If you got additional tips on how to protect SSH private keys on Unix, or how to best locate misplaced / unprotected private keys, please let us know.
(c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
 
This is a busy day for the folks doing patching out there. Aside from the MSpatches released today, Adobe also released a bunch of security updates.
Here are the links to the each of the security updates,
Flash Media Server - Rating :Critical (rated by Adobe)
Adobe AIRand Flash - Rating :Critical (rated by Adobe)
ColdFusion - Rating :Important (rated by Adobe)
With the current exploitation trend, the Flash vulnerability should be a high priority for patching. Happy patching.

--------------------

Jason Lam (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Adobe today patched six vulnerabilities in Flash Player, all of them pegged critical by the company.
 
Oracle has sketched out a five-year road map for Sun's Sparc-based servers, hoping to reassure customers about the future of the platform and reverse a pattern of declining sales.
 
Former Alaska Sen. Ted Stevens, best known in technology circles for once referring to the Internet as a series of tubes, died in a plane crash in Alaska at the age of 86. He was among five people killed in the crash, but at least three people have survived.
 
The biggest U.S. mobile operators are setting up more new data connections to devices such as the iPad and machine-to-machine networks than to traditional phones, an industry consultant said Tuesday.
 
Provider of network performance monitoring technology moves into security with acquisition of DDoS-prevention specialist.

Add to digg Add to StumbleUpon Add to del.icio.us Add to Google

Tektronix - Denial-of-service attack - Security - Consultants - General and Freelance
 
A patch heavy release includes critical fixes for Internet Explorer, Media Player and Microsoft Office Word.

Add to digg Add to StumbleUpon Add to del.icio.us Add to Google

Internet Explorer - Microsoft Office - Microsoft - Clients - WWW
 
Microsoft today issued a record 14 security updates to patch a record-tying 34 vulnerabilities in Windows, Internet Explorer (IE), Office and Silverlight.
 
Viral e-mails urging cell-phone users to hurry up and register with a government 'Do Not Call' list to avoid advertising spam are still circulating five years after federal officials first told consumers they could basically ignore the message.
 
After delays, Dell will start to ship the highly anticipated Streak mobile Internet device to customers in the U.S. this week.
 
Data warehousing vendor Teradata has quietly scooped up Kickfire, a startup analytic appliance vendor known for its use of the open-source MySQL database and a SQL processing chip to boost query performance.
 
The head of Motorola's mobile-phone business said he sees opportunity for his company when the iPhone comes to additional carriers in the U.S.
 
Sam's Club locations nationwide will have Wi-Fi from AT&T by November that will provide customers with access to Web-based price comparisons via their smartphones. The wireless access will also be used to better demonstrate Internet-ready TVs and other electronics.
 
Critics of a network neutrality proposal released Monday by Verizon and Google have complained that it would exempt wireless broadband and managed services from enforcement, but the biggest departure from recent practices may be its proposed limits on the FCC.
 
Online retail sales in the U.S. increased year-on-year in the second quarter, which continues a quarterly growth trend that began in last year's fourth quarter and merits guarded optimism for the second half of 2010, comScore said on Tuesday.
 
Verizon Wireless announced the pre-sale of the Motorola Droid 2 smartphone online starting tomorrow, with in-store sales on Thursday.
 
Hewlett-Packard and Sybase release a blueprint for quickly building a business intelligence system.
 
Overview of theAug 2010 MicrosoftPatchesand their status.


Update:Microsoft also released an advisory for an unpatched privilege escalation vulnerability
Update 2:Exploit code apparently exists for MS10-048, but it is not being seen in the wild at present.




#
Affected
Contra Indications
Known Exploits
Microsoft rating
ISC rating(*)


clients
servers





MS10-047
Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (Replaces MS10-021 )


Windows Kernel

CVE-2010-1888

CVE-2010-1889

CVE-2010-1890
KB 981852
no known exploits.
Severity:Important

Exploitability: 1,2,?
Important
Important



MS10-048
Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (Replaces MS10-032 )


Windows Kernel

CVE-2010-1887

CVE-2010-1894

CVE-2010-1895

CVE-2010-1896

CVE-2010-1897
KB 2160329
PoC code apparently exists
Severity:Important

Exploitability: ?,1,1,1,1
Important
Impoortant



MS10-049
Vulnerabilities in SChannel could allow Remote Code Execution


IIS and SChannel

CVE-2009-3555

CVE-2010-2566
KB 980436
no known exploits.
Severity:Critical

Exploitability: 3,2
Important
Critical



MS10-050
Vulnerability in Windows Movie Maker Could Allow Remote Code Execution (Replaces MS10-016 )


Windows Movie Maker

CVE-2010-2564
KB 981997
no known exploits.
Severity:Important

Exploitability: 1
Critical
Important



MS10-051
Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (Replaces MS08-069 )


Microsoft XML core services

CVE-2010-2561
KB 2079403
no known exploits.
Severity:Critical

Exploitability: 2
Critical
Critical



MS10-052
Vulnerability in Microsoft MPEG Layer-3 Codecs Could Allow Remote Code Execution


Microsoft MPEG Layer-3 Codecs

CVE-2010-1882
KB 2115168
no known exploits.
Severity:Critical

Exploitability: 1
Critical
Important



MS10-053
Cumulative Security Update for Internet Explorer (Replaces MS10-035 )


Internet Explorer

CVE-2010-1258

CVE-2010-2556

CVE-2010-2557

CVE-2010-2558

CVE-2010-2559

CVE-2010-2560
KB 2183461
no known exploits.
Severity:Critical

Exploitability: 3,2,1,2,2,1
Critical
Important



MS10-054
Vulnerabilities in SMB Server Could Allow Remote Code Execution


SMB server

CVE-2010-2550

CVE-2010-2551

CVE-2010-2552
KB 982214
no known exploits.
Severity:Critical

Exploitability: 2,3,3
Critical
Critical



MS10-055
Vulnerability in Cinepak Codec Could Allow Remote Code Execution


Cinepak codec

CVE-2010-2553
KB 982665
no known exploits.
Severity:Critical

Exploitability: 1
Critical
Important



MS10-056
Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (Replaces MS09-068 M009-027 MS10-036 )


Word

CVE-2010-1900

CVE-2010-1901

CVE-2010-1902

CVE-2010-1903
KB 2269707
no known exploits.
Severity:Critical

Exploitability: 1,1,2,2
Critical
Important



MS10-057
Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution (Replaces MS10-036 MS10-038 )


Excel

CVE-2010-2562
KB 2269707
no known exploits.
Severity:Important

Exploitability: 1
Critical
Important



MS10-058
Vulnerabilities in TCP/IP Could Allow Elevation of Privilege


Windows Networking (TCP/IP)

CVE-2010-1892

CVE-2010-1893
KB 978886
no known exploits.
Severity:Important

Exploitability: 3,1
Important
Important



MS10-059
Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege


Tracing Facility for Services

CVE-2010-2554

CVE-2010-2555
KB 982799
no known exploits.
Severity:Important

Exploitability: ?,1
Important
Important



MS10-060
Vulnerabilities in the Microsoft .NET Common Language Runtime and in Microsoft Silverlight Could Allow Remote Code Execution (Replaces MS09-061 )


.NET and Silverlight

CVE-2010-0019

CVE-2010-1898
KB 2265906
no known exploits.
Severity:Critical

Exploitability: 1,1
Critical
Critical






We will update issues on this page for about a week or so as they evolve.

We appreciate updates

US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY

(*): ISC rating

We use 4 levels:

PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
Critical: Anything that needs little to become interesting for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
Important: Things where more testing and other measures can help.
Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.


The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them



---------------

Jim Clausing, jclausing --at-- isc [dot] sans (dot) org

FOR408 coming to central OH in Sep, see http://www.sans.org/mentor/details.php?nid=22353 (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Browsing the Web in 'private mode' isn't as private as users think, a researcher said today.
 
Desktop virtualization makes it possible to centralize control and simplify management, improve security and compliance, and minimize help desk calls. It isn't perfect for all types of users within the enterprise, but when deployed appropriately, VDI can unlock new capabilities that could never be achieved through traditional physical desktop solutions.
 
Toshiba on Tuesday introduced a new hard drive feature that can wipe out data after the storage devices are powered down.
 
IBM announced it has purchased document capture software vendor Datacap. Terms of the deal were not disclosed.
 
Security vendor M86 Security says it's discovered that a U.K.-based bank has suffered almost $900,000 in fraudulent bank-funds transfers due to the ZeuS Trojan malware that has been targeting the institution.
 
A shortage of the main memory chips used in personal computers could send prices of the chips higher in the second half of this year, market researcher iSuppli warned on Monday
 
A few weeks ago I offered up some tips specifically for laptops. But maybe you've had more general mobile computing hassles. Ever run into a slow Wi-Fi network, regret buying a netbook, or wish you had more online storage? I can help! This week I'll tell you how to troubleshoot a hotspot, goose more speed from a netbook, and get 250MB of free storage with Dropbox.
 
Premier 100 IT Leader Jim Fortner also answers question on giving input to a nontechnical boss and the merits of switching employers.
 
The antivirus giant's latest quarterly report shows more than 10 million new pieces of malware were discovered last quarter alone. Plus, Macs are becoming a target.

Add to digg Add to StumbleUpon Add to del.icio.us Add to Google

AntiVirus - Malware - McAfee - Security - Computer virus
 

Same Goal, Differing Approach to Certification
GovInfoSecurity.com (blog)
In the blog, I observed: "Many certification programs are tailored to prepare infosec pros to fill out checklists to conform with the Federal Information ...

 
South Korean police raided Google offices in an investigation of the company's Street View mapping project, the latest instance of a country scrutinizing the company's collection of Wi-Fi data.
 
As Hewlett-Packard looks for a new leader after the sudden departure of Mark Hurd, HP customers back the company but offer advice on moving ahead.
 
Tektronix Communications will acquire Arbor Networks for an undisclosed amount, the companies announced.
 
People still running the now-retired Windows XP Service Pack 2 can trick the operating system into installing security updates, a researcher said Monday.
 
InfoSec News: DNS Made Easy rallies after punishing DDoS attack: http://www.theregister.co.uk/2010/08/09/dns_service_monster_ddos/
By John Leyden The Register 9th August 2010
DNS Made Easy has restored services following a vicious denial of service that peaked at 50Gbps on Saturday.
The identity of the perpetrators and their motives remain unclear. [...]
 
InfoSec News: Maui man convicted of selling top secret US weapons data to China: http://www.hawaiinewsnow.com/Global/story.asp?S=12951005
By Minna Sugimoto HawaiiNewsNow Aug 09, 2010
HONOLULU (HawaiiNewsNow) - A Maui man faces a maximum punishment of life in prison after a federal jury on Monday found him guilty of selling US military secrets to China. [...]
 
InfoSec News: Suspect in $9 Million RBS WorldPay Hack Extradited to U.S.: http://www.wired.com/threatlevel/2010/08/tsurikov-extradition/
By Kim Zetter Threat Level Wired.com August 9, 2010
One of the alleged ringleaders behind the 2008 hack of RBS WorldPay has been extradited to the U.S., where he was arraigned Friday in the [...]
 
InfoSec News: [Dataloss Weekly Summary] Week of Sunday, August 1, 2010: ========================================================================
Open Security Foundation - DataLossDB Weekly Summary Week of Sunday, August 1, 2010
2 Incidents Added.
======================================================================== [...]
 
InfoSec News: Jail For Laptop Hacker Exposed By Sky News: http://news.sky.com/skynews/Home/UK-News/Laptop-Hacker-Grzegorz-Zachodni-Caught-By-Sky-News-Hacking-Into-Laptop-Sentenced-To-Nine-Months/Article/201008115678323?lpos=UK_News_Carousel_Region_2&lid=ARTICLE_15678323_Laptop_Hacker:_Grzegorz_Zachodni_Caught_By_Sky_News_Hacking_Into_Laptop_Sentenced_To_Nine_Months
By Tom Parmenter Sky News correspondent August 06, 2010
A laptop engineer who was caught by Sky News trying to hack into a bank account has been sentenced to nine months in prison.
The 30-year-old worked at Laptop Revival in Hammersmith in March 2009 when our reporter dropped in a laptop with a seemingly simple fault.
The machine was actually loaded with covert software to monitor what files were accessed and the webcam had been set to film some of the work.
The spy software revealed that Zachodni worked on the laptop for 20 minutes and used the time to look at photos of the reporter in a bikini that had been marked private.
In another private file he had accessed her login details for Facebook, eBay and bank account details.
[...]
 
BlackBerry data services can continue in Saudi Arabia after Research in Motion agreed to monitoring of e-mail and instant messaging data services, an official of the country's regulator, Communications and Information Technology Commission, (CITC) said on Tuesday.
 
An offer of free smartphones may be a ruse for users in the United Arab Emirates to receive a handset loaded with spyware, a security researcher has warned, saying people who trade in their BlackBerry for a new smartphone should do a spyware check.
 

Posted by InfoSec News on Aug 09

http://www.hawaiinewsnow.com/Global/story.asp?S=12951005

By Minna Sugimoto
HawaiiNewsNow
Aug 09, 2010

HONOLULU (HawaiiNewsNow) - A Maui man faces a maximum punishment of life
in prison after a federal jury on Monday found him guilty of selling US
military secrets to China. Jurors convicted former B-2 stealth bomber
engineer Noshir Gowadia on 14 counts, including conspiracy and violating
the Arms Export Control Act.

The defendant had no...
 

Posted by InfoSec News on Aug 09

http://www.wired.com/threatlevel/2010/08/tsurikov-extradition/

By Kim Zetter
Threat Level
Wired.com
August 9, 2010

One of the alleged ringleaders behind the 2008 hack of RBS WorldPay has
been extradited to the U.S., where he was arraigned Friday in the
Northern District of Georgia on charges that he helped coordinate the
global $9.5 million bank card heist.

Sergei Tsurikov, 26, of Tallinn, Estonia, has been charged in Atlanta
with wire...
 

Posted by InfoSec News on Aug 09

========================================================================

Open Security Foundation - DataLossDB Weekly Summary
Week of Sunday, August 1, 2010

2 Incidents Added.

========================================================================

DataLossDB is a research project aimed at documenting known and reported data loss incidents world-wide. The Open
Security Foundation asks for contributions of new incidents and new data for...
 

Posted by InfoSec News on Aug 09

http://www.theregister.co.uk/2010/08/09/dns_service_monster_ddos/

By John Leyden
The Register
9th August 2010

DNS Made Easy has restored services following a vicious denial of
service that peaked at 50Gbps on Saturday.

The identity of the perpetrators and their motives remain unclear. One
possible scenario is that hackers with a grudge against the site hired a
botnet to swamp DNS Made Easy with useless traffic.

A blow-by-blow account of...
 

Internet Storm Center Infocon Status