Hackin9
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Oracle has given the first peek at its upcoming Sparc M7 processor, promising big performance gains for customers who use the in-memory compute features of its 12C database.
 
Two of the hottest startups for requesting rides from your smartphone are accusing each other of dirty tricks.
 
Just in time for the new school year, Google has launched a tool called Classroom that aims to make teachers' harried lives a little easier.
 
It started off as an experiment, but Microsoft now wants to speed up and return more accurate Bing search results with the help of reconfigurable chips called FPGAs (field-programmable gate arrays) in data centers.
 
Google is boosting Gmail's ability to detect and block malicious emails from spammers and scammers that exploit similarities among Unicode characters to dupe users into clicking on bad links.
 
Microsoft has issued 29 patches for its Internet Explorer browser, including one fixing a critical vulnerability that would allow a remote attacker to gain access to a computer from over the Internet.
 
A company accused of sending unsolicited and deceptive email before the roll out of the U.S. Affordable Care Act will pay US$350,000 to settle a complaint from the U.S. Federal Trade Commission.
 
SAP has relaxed hardware requirements for using its Hana in-memory database platform for development and testing, in a move that could make existing Hana customers' operations easier and less expensive while also generating more Hana sales.
 
Autonomy's former chief financial officer has claimed that Hewlett-Packard is accusing him and other ex-employees of fraud in order to cover up its own failings in the disastrous 2011 acquisition.
 
If the White House learned one thing from the Healthcare.gov debacle, it was that the government needs clear-thinking people who can see a problem for what it is. Mikey Dickerson may just be that person.
 
According to Gartner, business Intelligence and analytics will remain a top focus for CIOs through 2017, with companies spending millions on traditional BI software, cloud BI services and now mobile apps and even social BI. However, as the type and number of BI solutions has grown, so too has the possibility of failure, of picking the wrong business intelligence software for your business problem or problems or of having end users not understand or properly use the solution.
 
You'd think marketing pros speaking to a roomful of marketers about the rocky CMO-CIO relationship would devolve into an IT-bashing session -- but you'd be wrong.
 
The "Internet of things" won't be built overnight, but vendors are now stepping in to give enterprises a helping hand.
 
The Mac is poised to break Apple's annual sales record this year, according to an analysis of past sales trends as well as Wall Street projections.
 

Lean operations and a lack of technical staff make non-governmental organizations a prime, and relatively soft, target for well-funded adversaries, according to an academic study of a four-year campaign targeting one such group.

In a paper to be delivered at the USENIX Security Conference next week, six academic researchers analyzed nearly 1,500 suspicious e-mail messages targeting the World Uyghur Congress (WUC). The team found that, while the malware managed to reliably evade detection by many antivirus programs, the attacks were relatively unsophisticated, using known vulnerabilities that had already been patched. The social engineering tactics, however, were very targeted and convincing, with the majority written in the native language, referring to events of interest to the NGO and appearing to come from known contacts, said Engin Kirda, a professor of computer science at Northeastern University and a co-author of the paper.

"You read about sophisticated attacks, but the malware that we analyzed was pretty standard," Kirda said. "It was not some ground breaking obfuscation or malware."

Read 9 remaining paragraphs | Comments

 

When the Blackphone team arrived at Def Con last week, they knew they were stepping into a lion’s den. In fact, that's exactly why they were there. The first generation Blackphone from SGP Technologies has been shipping for just over a month, and the company’s delegation to DefCon—including Silent Circle Chief Technology Officer Jon Callas and newly hired SGP Technologies Chief Security Officer Dan Ford—was looking to both reach a natural customer base and get help with further locking down the device.

Ask and you shall receive. Jon “Justin Case” Sawyer, the CTO of Applied Cybersecurity LLC, walked up to the Blackphone table at Def Con and told them he rooted the phone. And those who followed him on Twitter received an abbreviated play-by-play.

What followed, however, was not what Sawyer or the Blackphone team counted on: a BlackBerry blogger at N4BB leapt on one of Sawyer’s tweets and wrote a story with the erroneous headline, “Blackphone Rooted Within 5 Minutes.” By the time Sawyer was presenting on Sunday at Def Con with Tim Strazzere, the story had been picked up by a number of blogs and websites—and nearly all of them didn’t bother getting further details from Sawyer or Blackphone.

Read 19 remaining paragraphs | Comments

 
Adobe Flash Player and AIR CVE-2014-0541 Unspecified Security Bypass Vulnerability
 
The National Institute of Standards and Technology (NIST) will hold its second Privacy Engineering Workshop in San Jose, Calif., Sept. 15 and 16, 2014. The event is co-sponsored by the International Association of Privacy Professionals ...
 
Dell is organizing the backup software products that it has acquired in the past two years into a coherent portfolio, bundling three of its storage software products into a single package to simplify licensing for the enterprise.
 
Twitter is looking to boost its advertising business by letting more businesses pay to include video in their tweets.
 
Routers appear to be as insecure as ever, after hackers successfully compromised five popular wireless models during a contest at the DefCon 22 security conference, reporting 15 new vulnerabilities to affected vendors.
 
U.S. technology professionals searching for jobs may want to look in states not normally considered IT hot spots.
 
Sales of Chromebooks will reach more than 5 million this year, accounting for about 2% of all personal computers.
 

Adobe has released security updates for Adobe Flash Player, Adobe AIR, Adobe Reader, and Acrobat. The updates are rated as critical and an impressive number of CVE entries.  CVE-2014-0538, CVE-2014-0540, CVE-2014-0541, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, CVE-2014-0545, CVE-2014-0546. Summary: update now. 

http://helpx.adobe.com/security/products/flash-player/apsb14-18.html
//helpx.adobe.com/security/products/reader/apsb14-19.html" style="color: rgb(17, 85, 204); font-family: arial, sans-serif; line-height: normal;" target="_blank">http://helpx.adobe.com/security/products/reader/apsb14-19.html

or: rgb(68, 68, 68); font-family: 'Lucida Grande', 'Lucida Sans Unicode', Arial, sans-serif; font-size: 14px; line-height: 19.040000915527344px;">Cheers,
Adrien de Beaupré
Intru-shun.ca Inc.
My SANS Teaching Schedule

 

 

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 

Tuesday Morning, various networks experienced outages from 4-6am EDT (8-10am UTC) [1]. I appears the outage was the result of a somewhat anticipated problem with older routers and their inability to deal with the ever increasing size of the Internet's routing table.

These BGP routers need to store a map of the internet defining which IP address range belongs to which network. Due to the increasing scarcity of IPv4 space, registrars and ISPs assign smaller and smaller netblocks to customers, leading to a more and more fragmented topology. Many older routers are limited to store 512k entries, and the Internet's routing table has become large enough to reach this limit. Tuesday morning, it appears to have exceeded this limit for a short time [2][3].

The large number of route announcements, and immediate removals shown in [2] could indicate a malicious intend behind this events (or a simple configuration error), but either way likely point to one entity "pushing" the size of the routing table beyond the 512k limit briefly. At around this time, one larger ISP (Windstream, AS7029) recovered from an unrelated outage and routing changes due to the recovery are one suspect that may have triggered the event.

Vendors published guidance for users of older routers how to avoid this issue [5]. This guidance has been available for a while. Please contact your vendor if you are affected. You may also want to consider upgrading your router. The routing table is likely going to get larger over the next few years until networks rely less on IPv4 and take advantage of IPv6.

 

[1] https://puck.nether.net/pipermail/outages/2014-August/007090.html
="http://www.cymru.com/BGP/prefix_delta.html" style="color: rgb(17, 85, 204); font-family: arial, sans-serif; line-height: normal;" target="_blank">http://www.cymru.com/BGP/prefix_delta.html (see the spike in deltas around that time)
[3] 
http://www.cidr-report.org/2.0/#General_Statusote how close it is to 512k and rising)
[4] 
http://www.thewhir.com/web-hosting-news/liquidweb-among-companies-affected-major-outage-across-us-network-providers
[5] http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/117712-problemsolution-cat6500-00.html
 

e="color: rgb(68, 68, 68); font-family: 'Lucida Grande', 'Lucida Sans Unicode', Arial, sans-serif; font-size: 14px; line-height: 19.040000915527344px;">Cheers,
Adrien de Beaupré
Intru-shun.ca Inc.
My SANS Teaching Schedule

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 

Overview of the August 2014 Microsoft patches and their status.

# Affected Contra Indications - KB Known Exploits Microsoft rating(**) ISC rating(*)
clients servers
MS14-043 Vulnerability in Windows Media Center Could Allow Remote Code Execution
Microsoft Windows

CVE-2014-4060
KB 2978742 No Severity:Critical
Exploitability: 1
Critical Important
MS14-044 Vulnerabilities in SQL Server Could Allow Elevation of Privilege
Microsoft SQL Server

CVE-2014-1820
CVE-2014-4061
KB 2984340 No Severity:Important
Exploitability: 1
Important Important
MS14-045 Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation Of Privilege
Microsoft Windows

CVE-2014-0318
CVE-2014-1819
CVE-2014-4064
KB 2984615 No Severity:Important
Exploitability: 1
Important Important
MS14-046 Vulnerability in .NET Framework Could Allow Security Feature Bypass
Microsoft Windows,Microsoft .NET Framework

CVE-2014-4062
KB 2984625 No Severity:Important
Exploitability: 1
Important Important
MS14-047 Vulnerability in LRPC Could Allow Security Feature Bypass
Microsoft Windows

CVE-2014-0316
KB 2978668 No Severity:Important
Exploitability: 1
Important Important
MS14-048 Vulnerability in OneNote Could Allow Remote Code Execution
Microsoft Office

CVE-2014-2815
KB 2977201 No Severity:Important
Exploitability: 1
Critical Important
MS14-049 Vulnerability in Windows Installer Service Could Allow Elevation of Privilege
Microsoft Windows

CVE-2014-1814
KB 2962490 No Severity:Important
Exploitability: 1
Important Important
MS14-050 Vulnerability in Microsoft SharePoint Server Could Allow Elevation of Privilege
Microsoft Server Software

CVE-2014-2816
KB 2977202 No Severity:Important
Exploitability: 1
Important Important
MS14-051 Cumulative Security Update for Internet Explorer
Microsoft Windows, Internet Explorer

CVE-2014-2774 CVE-2014-2784 CVE-2014-2796 CVE-2014-2808 CVE-2014-2810 CVE-2014-2811 CVE-2014-2817 CVE-2014-2818 CVE-2014-2819 CVE-2014-2820 CVE-2014-2821 CVE-2014-2822 CVE-2014-2823 CVE-2014-2824 CVE-2014-2825 CVE-2014-2826 CVE-2014-2827 CVE-2014-4050 CVE-2014-4051 CVE-2014-4052 CVE-2014-4055 CVE-2014-4056 CVE-2014-4057 CVE-2014-4058 CVE-2014-4063 CVE-2014-4067 CVE-2014-2774 CVE-2014-2784 CVE-2014-2796 CVE-2014-2808 CVE-2014-2810 CVE-2014-2811 CVE-2014-2817 CVE-2014-2818 CVE-2014-2819 CVE-2014-2820 CVE-2014-2821 CVE-2014-2822 CVE-2014-2823 CVE-2014-2824 CVE-2014-2825 CVE-2014-2826 CVE-2014-2827 CVE-2014-4050 CVE-2014-4051 CVE-2014-4052 CVE-2014-4055 CVE-2014-4056 CVE-2014-4057 CVE-2014-4058 CVE-2014-4063 CVE-2014-4067
KB 2976627 Yes! Severity:Critical
Exploitability: 1
Critical Important
">We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
    • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threatatches.

--
Alex Stanford - GIAC GWEB & GIAC GSEC
Research Operations Manager,
SANS Internet Storm Center

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Oracle Java SE CVE-2014-4208 Remote Security Vulnerability
 
Splunk's new App for Stream will give IT departments more insight into their infrastructures by collecting network traffic on response times, network performance and database queries.
 
Oracle Java SE CVE-2014-4220 Remote Security Vulnerability
 
Same-day delivery is a boon for the online leader, but it will only help doom B&N.
 
acpi-support CVE-2014-1419 Local Privilege Escalation Vulnerability
 
Google Chrome CVE-2014-3155 Out of Bounds Memory Corruption Vulnerability
 
Google Chrome CVE-2014-3156 Buffer Overflow Vulnerability
 
CVE-2014-5035 - Opendaylight Vulnerable to Local and Remote File Inclusion in the Netconf (TCP) Service
 

I enjoy performing penetration tests, I also enjoy teaching how to do penetration testing correctly. Next time up is SANS Sec560 network penetration testing in Albuquerque, NM. When I am teaching one of the points I make is to make good use of your tools. You really want to know which tools is appropriate for which parts of the engagement methodology and test plan. You also want to be familiar with the features and quirks of each tool in your kit. Most people are familiar with nmap as a port scanner, and often some of the other features such as service versioning and operating system fingerprinting. What I would like to talk about today are some of the features of nmap that work well together. One of the tasks in a penetration test or a vulnerability assessment is to identify which hosts are likely alive and responsive. Security testing involves sending stimulus, monitoring, and seeing responses. In this case we typically use nmap to send the stimulus, tcpdump to perform the monitoring, and the responses will tell us which hosts are responding to the packets nmap is sending.

Nmap is most often used to perform a ping sweep with its default series of packets. This option was -sP and is now -sn.

'nmap -sn -iL targets nmap-default-ping'

With root privileges this will send ICMP ech request (ping), a TCP SYN packet to port 443, a TCP ACK packet to port 80, and an ICMP timestamp request. This is efficient and in many cases is sufficient to identify those hosts that are responsive. In the case of a relatively flat internal network this is often the case.  

Tcpdump shows us that 4 packets were sent, 4 responses were also seen.

17:08:37.469613 IP 198.41.30.84 > 74.207.244.221: ICMP echo request, id 44412, seq 0, length 8
17:08:37.469641 IP 198.41.30.84.42601 > 74.207.244.221.443: Flags [S], seq 4035393928, win 1024, options [mss 1460], length 0
17:08:37.469658 IP 198.41.30.84.42601 > 74.207.244.221.80: Flags [.], ack 4035393928, win 1024, length 0
17:08:37.469664 IP 198.41.30.84 > 74.207.244.221: ICMP time stamp query id 30952 seq 0, length 20
17:08:37.541827 IP 74.207.244.221 > 198.41.30.84: ICMP echo reply, id 44412, seq 0, length 8
17:08:37.541841 IP 74.207.244.221.443 > 198.41.30.84.42601: Flags [R.], seq 0, ack 4035393929, win 0, length 0
17:08:37.541868 IP 74.207.244.221.80 > 198.41.30.84.42601: Flags [R], seq 4035393928, win 0, length 0
17:08:37.541968 IP 74.207.244.221 > 198.41.30.84: ICMP time stamp reply id 30952 seq 0: org 00:00:00.000, recv 21:00:18.026, xmit 21:00:18.026, length 20

(74.207.244.221 is scan.nmap.org)

The problem with only sending these 4 packets as the means to do hosts discovery is that it may miss many test cases, and is therefore less accurate. This is an issue in many pentests where we need to balance accuracy against efficient use of our time. Scanning an arbitrary /19 and we see the following results:

Nmap done: 8192 IP addresses (5668 hosts up) scanned in 24.31 seconds
           Raw packets sent: 26981 (968.952KB) | Rcvd: 5954 (176.168KB)

Now consider the following:
 'nmap -sn -PS -PA -PU -PY -PE -PP -PM -PO -n -vv --reason --packet-trace --traceroute -iL targets -oA nmap-full-sweep'
 
Nmap done: 8192 IP addresses (5676 hosts up) scanned in 438.24 seconds
           Raw packets sent: 80075 (2.518MB) | Rcvd: 94752 (4.014MB)

The --reason option tells us which stimulus the hosts responded to. --paket-trace outputs to the screen the packets flying back and forth, giving us a visual indicator to see if the tests are running correctly. The second scan sends 3 different ICMP packets, TCP, UDP, SCTP, and some raw IP packets. The only other tool I often run along with nmap is ike-scan to identify VPN devices that do not respond to any other packets. From the nmap man page:             
-sn: Ping Scan - disable port scan
-PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
-PO[protocol list]: IP Protocol Ping

We gained an additional 8 hosts identified as being responsive, however we sent over 3 times the packets and it took much much longer. The second scan is arguably much more accurate, and certainly is a much more impressive command line! Putting together the tools we can construct a nice bash script to run tcpdump and nmap against a target list. The script checks to see if has root privilege, sets up some variables, creats a scan log, runs tcpdump, runs nmap, then stops tcpdump.  

Cheers,
Adrien de Beaupre
Intru-shun.ca Inc.

Check out BSides Ottawa, our CfP is still open! Con is 5-6 September
http://www.bsidesottawa.ca/
I will be teaching SANS Sec560, Network Penetration Testing next in Albuquerque, NM!
http://www.sans.org/event/albuquerque-2014/course/network-penetration-testing-ethical-hacking

References:
http://nmap.org/book/man-host-discovery.html
http://www.nta-monitor.com/tools-resources/security-tools/ike-scan

Begin script:

#!/bin/bash
#Usage: discover.sh targetfilename
# Modified 10 August 2014, Adrien de Beaupre
# Check to see if we have root privileges, exit if not.
if [[ $EUID -ne 0 ]]; then
        echo "$0 must be run as root"
        exit 1
fi
# Check to see if we have a filename as one argument, exit if not.
# Number of arguments we want
GOODARGS=1
if [ $# -ne $GOODARGS ]; then
        echo "Usage: `basename $0` {targetfilename}"
        exit 1
fi
# Check to see if target file exists, exit if not
if [ ! -f $1 ]; then
        echo "Target file \"`basename $1`\" does not exist"
        exit 1
fi
# Declare variables
# Target file
TARGETS=`cat $1`
# Timestamp variable
NOW=$(date +%F-%s)
# Tcpdump program to run variable
TCPDUMP=/usr/local/sbin/tcpdump
# Run the tcpdump program
$TCPDUMP -n -v -i eth0 -w tcpdump-discovery.$NOW.$1.dump 2>/dev/null &
# Variable for the process ID
PID=$!
# Start discovery scan, create or append to scanlog
echo -e 'Discovery scan start:' $HOST | tee -a scanlog
date >> scanlog
# Nmap discovery
nmap -sn -PS -PA -PU -PY -PE -PP -PM -PO -n -vv --reason --packet-trace --traceroute -iL $1 -oA $1-discovery-nmap-$NOW
# Wait two seconds before killing sniffer
sleep 2
# Kill the tcpdump program by PID
echo -e 'Tcpdump stopped:' $HOST | tee -a scanlog
date >> scanlog
kill $PID

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Amazon Web Services now lets enterprises use two-factor authentication to better protect hosted WorkSpaces virtual desktops.
 
LinuxSecurity.com: A vulnerability in LibSSH can result in leakage of private key information.
 
LinuxSecurity.com: Security Report Summary
 
LinuxSecurity.com: Updated java-1.7.1-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 7 Supplementary. Red Hat Product Security has rated this update as having Critical security [More...]
 
LinuxSecurity.com: Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security [More...]
 
LinuxSecurity.com: Updated tomcat6 packages that fix two security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Low security [More...]
 
LinuxSecurity.com: pyCADF could be made to expose sensitive information.
 
Apache Cordova 3.5.1: CVE-2014-3502 update
 
[security bulletin] HPSBMU03089 rev.1 - HP Executive Scorecard, Running OpenSSL, Disclosure of Information
 
[SECURITY] [DSA 2984-2] acpi-support regression update
 
IBM Maximo: Cross-site Scripting Vulnerability Addressed in Asset and Service Management (CVE-2014-0914 and -0915)
 
With a sapphire display and military-grade construction, the Kyocera Brigadier is one seriously tough Android phone. We put its durability to the test.
 
Facebook ignited a flood of criticism last week when it began requiring mobile users to load its Messenger app for Android and iOS separate from its basic Facebook app.
 
A new 'biochip' under development to accurately identify disease strains may reduce costs for medical testing and also reduce wait time for results.
 
Apache Cordova For Android CVE-2014-3502 Information Disclosure Vulnerability
 
Internet Storm Center Infocon Status