Google's Gmail adds security after China hacking

Google is tightening the security of its free e-mail service to combat computer hackers like the ones that recently 
targeted in China.
With the shift, Gmail accounts will automatically be set in an ``https'' mode, meaning contents of e-mail will be scrambled so they're less likely to leak out to unauthorized users. Before, only the log-in data was encrypted.
Google hadn't been using this more secure format as Gmail's default setting because it can be slower than the unprotected mode. 
The shift to the more secure setting began late Tuesday, just a few hours after Google announced Chinese hackers had pried into the e-mail accounts of human rights activists. Google is now considering pulling out of China and shutting down its search engine there because of the attacks. 
Fonte: http://economictimes.indiatimes.com/infotech/internet/Googles-Gmail-adds-security-after-China-hacking/articleshow/5442497.cms

Computer hacking - Students Arrested

Several Haddonfield Memorial High School students are under police investigation on accusations they hacked into the school's computer system.
The breach was discovered in the last few days, and the students, whom school district officials declined to identify, have been turned over to local police and the Camden County Prosecutor's Office.
At a regularly scheduled meeting with parents to discuss end-of-year activities, principal Michael Wilson said the FBI might get involved in the investigation.
The students used a keystroke-logging program installed on computers at the high school to capture the user names and passwords of anyone using one of the rigged computers.
With that data, they gained access to an internal information system on which the school posts grades, class schedules, attendance, even the status of homework assignments for students and their parents to view.
In an e-mail to students and parents, Wilson said the students had gained access to about 200 of the nearly 2,000 accounts that have access to the computer system at the high school.
"It was confirmed late yesterday afternoon that several HMHS students developed a plan to capture secure passwords from staff/students who used a computer in the high school," Wilson said in the letter, a copy of which was obtained by The Inquirer. "We are confident this is a contained situation.
"We know there is a small number of students who participated in this activity. Their access was limited to HMHS, and they successfully gained password information for about 200 of the nearly 2,000 accounts which have access to the computer system at the high school. We are confident we have identified the students and built in the appropriate controls to restrict their activity and that of anyone else who may foster a similar plan."
Wilson went on to say students and parents should change passwords to the system and change the password to any personal e-mail account that might have been accessed in the last six weeks from the school network.
"These kids may have your passwords," Wilson said, according to one person at last night's meeting.
Wilson wouldn't say what the students were doing with the information, or if they obtained administrator-level passwords, which would have allowed them to change grades, not just view them.
"Obviously, it's a serious intrusion, and they're looking into ways they can protect the system so this doesn't happen again," Board of Education president Steve Weinstein said.
Jason Laughlin, spokesman for the Prosecutor's Office, said last night that he was not aware of the investigation.
School computer use has been a topic of discussion lately because of a dispute at Lower Merion High School in which staff tracked school-issued laptops by accessing the computers remotely without students' knowledge. There is no indication of that situation occurring in Haddonfield.
Karen Acton, an art teacher, said last night that she had just learned of the security breach, but that she was not alarmed because she was confident that the school would take appropriate steps to deal with the computer break-in.
"We run a tight ship," Acton said.
Fonte: http://www.philly.com/inquirer/local/nj/89095142.html

New Spam Targeting Facebook Users

Cyber-criminals are using fake e-mails to target Facebook users and deliver computer viruses that were being detected only by one-third of the 42 most common anti-virus products as of 12 noon March 18, says a leading cyber-crime researcher at the University of Alabama at Birmingham (UAB).
Gary Warner, the UAB director of research in computer forensics, says his team in the UAB Spam Data Mine has been tracking the Facebook spam campaign for the past three days. While it is not in the data mine's list of the top 10 most prevalent malware threats, Warner says the fake Facebook messages and related viruses are serious.
"The malware being delivered is called 'BredoLab.' It has been occasionally spread by spam since May of 2009," Warner says. "The UAB Spam Data Mine has observed at least eight versions of the Facebook BredoLab malware since March 16.
"What is troubling is the newer versions of the BredoLab used in this latest attack campaign are not being detected by the majority of anti-virus services -- and that means the majority of users who unwittingly click on the bogus attachments linked to fake e-mails are going to have their computers infected," Warner says.
In this new campaign, cyber-criminals are using regular Internet e-mail services to deliver the false Facebook messages to the social media site's customers. The spam messages ask recipients to open an attachment in order to obtain new Facebook login information. Clicking the attachment exposes a user's computer to the BredoLab malware.
"Once a computer is infected with BredoLab, the cyber-criminals are able to add any other malicious software they desire to the infected computer, including password-stealing software, fake anti-virus software and spam-sending software," Warner says.
Warner warns that any legitimate company would never ask a customer to update his or her personal account information in an e-mail or through e-mail-embedded links or attachments.
"If there are questions about one of your account profiles, visit the site in question through your Web browser and log in as you normally would," he says. "If an entity has an important message for you, you'll be able to find it on its Web page."
Fonte : http://www.sciencedaily.com/releases/2010/03/100322100518.htm

Sicurezza Emule

E' sempre importante poter settare al meglio tutta la configurazione del nostro "EMULE" il più grande "p2p" dei nostri tempi per lo scambio di file, immagini, foto, musica mp3, video, programmi e tanto altro ancora con il mondo intero e tutto gratuitamente.
Vi indirizzo a questo sito ove potremo scaricare l'importante file "ipfilter" per poter filtrare server fake o spy, per salvaguardare la privacy dei nostri dati memorizzati sull'HD del PC, copiando dapprima i dati dall'IpFilter -parte 1- e poi quelli dell'IpFilter -parte 2-, consiglio quello "Hi-Security-, seguendo le istruzioni dettate direttamente dal sito stesso.
Dopodichè avrete a disposizione un indirizzo, che installa automaticamente sul vostro eMule in modo sicuro la vostra "lista server", consigliata quella "EneTec eMule IPFilter
Syncro servers list". Scorrendo sull'elenco dei download noterete anche dei "clip video" ove scorgere in dettaglio le istruzioni di configurazione.
Fonte : http://www.emulesecurity.com/intro.php

5 security threats to watch in 2010

 At a media gathering Wednesday, the security vendor released a report outlining security threats enterprises and consumers should be mindful of in 2010. Of these, the security risk faced by everyday Internet users is likely to increase as criminals look to trick people into downloading malware through means such as an innocent-looking URL link or videos and pictures from unknown sources.

"[Users] could be opening themselves up to identity theft and other types of cybercrime," Symantec said in the report, adding that the number of attempted attacks using social engineering "is sure to increase" next year.

Also, as the popularity of Apple products continue to grow, Mac and iPhone users--two of the most popular products by Apple--should look to protect the content they place on their devices as "more attackers will devote time to create malware to exploit these devices", according to the report. With the increased use of smartphones, mobile security will also be an area of concern, added Symantec.

On the burgeoning social networking scene and the opportunities this affords cybercriminals, Symantec noted that continuing "unprecedented growth" of social sites will elicit a corresponding growth in fraud attempts.

Shortened URLs are another key area for security, as the links may direct people to undesirable sites filled with malware, said David Hall, regional product manager, consumer products and solutions, Symantec Asia-Pacific, at the gathering. Condensed URLs are popular on social networking sites and in particular, Twitter and Facebook, so users of these platforms should avoid clicking on URLs sent by unknown users. Such links are likely to be created by phishers peddling links to malicious sites, said Symantec.

"Scareware" or fake antivirus software are also expected to make a bigger presence next year, the security firm said. In such scenarios, users are tricked by scareware promoters into downloading the fake application, which could then lead to sensitive information being compromised. Computers may even be "hijacked" or rendered useless by cybercriminals, who control the machines until the owners pay a ransom fee.

A look back at 2009
Scareware is, incidentally, one of 2009's top security concerns, according to Symantec's report.

Another security headliner this year was the Conficker worm, which allowed its creators to remotely install software on computers globally. Though detected in November 2008, the worm started infecting computers in March and April 2009.
Fonte:http://www.zdnetasia.com/5-security-threats-to-watch-in-2010-62059763.htm

Mozilla Bug FireFox Critico

Mozilla, lunedì, ha confermato la presenza di una vulnerabilità nell'ultima versione di Firefox annunciando, contemporaneamente, la distribuzione di una versione aggiornata entro il 30 marzo.

Secondo quanto si legge in un bollettino diramato dal produttore, "… la vulnerabilità è determinata da un conflitto durante l'esecuzione del codice remoto in fase di navigazione. Gli sviluppatori del gruppo di progetto hanno già messo a punto una modifica del codice e stanno verificando che esso sia capace, in ogni occasione, di garantire l'assoluta sicurezza".

L'affermazione suona strana, considerando che, in genere, la messa a punto di un patch per un bug definito "serio" non richiede più di un paio di giorni; evidentemente le difficoltà incontrate nel risolvere il problema sono più grandi di quelle che ci si poteva immaginare, e richiederanno una estesa manipolazione del codice sorgente, cosa che impone una accurata verifica prima del rilascio per evitare, come ha riferito un osservatore, "... che la cura sia peggiore della malattia".

Il bug interessa la versione 3.6 di Mozilla, rilasciata nel gennaio scorso che verrà, dopo la distribuzione della modifica, rinominata in 3.6.2.

Il problema è stato scoperto più di un mese fa da un ricercatore russo, Evgeny Legerov, che ne ha dato immediatamente notizia sul suo blog.
In quel caso il ricercatore aveva rifiutato di pubblicare il frammento di codice attraverso cui era possibile effettuare l'attacco e, inizialmente, rifiutò anche di offrire dettagli agli sviluppatori.
Il 4 marzo scorso, a giustificazione del suo comportamento, Legerov affermò, in una lettera aperta sul suo blog, che, nonostante i numerosi messaggi inviati al gruppo di Mozilla riguardo al problema, non aveva mai ricevuto risposta fino a quel giorno, momento in cui le richieste, da parte del gruppo, si erano fatte "inesistenti".

Questo comportamento non era piaciuto alla ricercatore che aveva bruscamente risposto alle richieste dicendo di "... non avere tempo da perdere appresso a loro".

Solo sabato Mozilla ha comunicato che Legerov ha fornito sufficienti dettagli per riprodurre e analizzare il problema. Domenica è stata rilasciata la versione beta della 3.6.2 che può essere scaricata direttamente dal sito.

Il comportamento di Mozilla, in quest'occasione, è apparso particolarmente strano, considerando la struttura open source del browser e la sempre cordiale disponibilità da parte dei progettisti ad accogliere suggerimenti e segnalazioni da parte della comunità internazionale.

I maligni hanno ipotizzato che il tutto sia legato alla scarsa volontà di pagare il premio di 10.000  dollari offerto dall'azienda per chi fosse stato capace di scoprire exploit del browser.
Evidentemente, se questa ipotesi fosse vera, la pericolosità della falla deve essere stata così grande da indurre l'azienda ad accelerare i contatti con Legerov per mettere a punto una strategia opportuna di difesa.
Fonte : http://www.techup.it/news/mozilla_bug_molto_critico_di_firefox-03509

Has the MBR rootkit disappeared? Not really

During these days we have talked a lot about the TDL3 rootkit infection, a nice example of how malware writers can make security vendors's work harder. We will continue writing about TDL3 to update our readers about the status of both the rootkit and defensive techniques.
However today we want to take a step back and talk about an old friend called the MBR rootkit, or Mebroot, or yet Torpig. The fact that we haven't talked about it for a while doesn't mean it has been defeated. Instead, the MBR rootkit is still actively spreading throughout the web, mostly through compromised websites.


During the last two days we have cleaned hundreds of infected machines, a quite impressive number that shows how the threat is still hitting hard.

As said before, compromised websites are the primary vehicle of infection. Injected iframes and obfuscated javascripts have become a serious threat during the last years, showing how often websites are not protected.

For instance, during the last months we have received a number of reports from Italy about massive attacks against hundreds of websites which have been compromised by infected code. After some analysis, injected code was dropping MBR rootkit through some exploits.

This could happen in several ways: weak website login credentials, flaw in the hosting servers, flaw in third party hosted applications (SQL injection, for instance).

Bad news is that authors of MBR rootkit are very active in the underground, they are just less noisy than TDL3 writers.

MBR rootkit has been improved during the last months, and it has added another trick to block security applications from cleaning its infection code.

As written in a previous blog post, MBR rootkit is using self defense routines which prevent security softwares from cleaning up the Master Boot Record. So, to clean the system, some security software is forcing the system to restart immediately after they have cleaned the infection. To do this, they are crashing the system, calling a specified system bugcheck.
MBR rootkit's response is that now it's using a BugCheck callback notify routine, which alerts the rootkit a bug check has been called. By doing so, it's able to rewrite its code in the MBR immediately before the system restarts.
Prevx is still able to detects the infection active in the system. Cleanup is under internal testing and we should release an update soon. In the meanwhile, if Prevx customers are infected by the MBR rootkit and they are not able to clean their machines, they can contact our technical support. We will help you fix the issue.

If you haven't installed Prevx and you want to check if your system is infected by MBR rootkit, it's possible to check inside Windows directory, under the Temp subdirectory (%windir%\Temp) for the presence of a hidden file with its name starting with "$$$". If there is such fle, your PC could be affected by the MBR rootkit.
Fonte: http://www.prevx.com

My memory home

Una casa digitale disponibile on line dove custodire i propri ricordi. Un luogo virtuale dove conservare le foto più importanti, la musica che ha fatto da colonna sonora alla nostra esistenza. Ma anche un efficace sistema per archiviare in totale sicurezza i documenti più riservati, le e-mail di lavoro, le bollette da pagare. Con una possibilità: la condivisione in rete delle proprie memorie personali.
Stiamo parlando di My Memory Home, un’esclusiva piattaforma web lanciata dall’azienda italiana Memory Dome che offre ad ogni utente la possibilità di archiviare e condividere i ricordi fino a 50Gb e di raccontare agli amici la storia della propria vita seguendo il fil rouge della memoria. E dietro questa idea innovativa c’è una sensibilità fortemente italiana…
Da una parte, My Memory Home è un sistema evoluto di archiviazione documentale, in quanto permette di conservare file di qualsiasi formato; dall’altra è un network emozionale che mette al centro di tutto la persona e la sua storia di vita,  e che consente di raccontare la propria biografia e di condividerla seguendo il filo conduttore dei ricordi. Pur avendo le stesse funzionalità di un social network, My Memory Home però non obbliga a schemi prefissati o a regole precostituite. Ogni utente può infatti scegliere la propria organizzazione dei contenuti e i livelli di condivisione e decidere - per esempio - a chi concedere una copia delle “chiavi di casa”, oppure quali amici o colleghi fare accomodare in soggiorno.
Ma non solo: My Memory Home vuole diventare un contenitore universale dei ricordi accessibile a tutta l’umanità, una banca dati mondiale, e ciò in quanto consente di archiviare enormi quantità di informazioni, fino a 50 GB per ogni utente. Ricordi che poi possono essere resi pubblici e conservati in un ambiente detto MybiblYou. In questo modo, vengono restituiti alla Storia degli istanti, dei frammenti e delle emozioni individuali che altrimenti andrebbero perduti.
Fonte: http://techblog.tgcom.it

ChatRoulette - Chat Free

Metti una sera, uno sconosciuto… Con queste poche parole si può riassumere il concetto contenuto in ChatRoulette, la video chat che mette in contatto persone che non si conoscono. Basta una connessione alla Rete e una webcam per provare quello che ormai è diventato un fenomeno di massa. L’uso è sconsigliato ai minori, si incontrano persone di vario genere.
ChatRoulette è nata da poco, correva il mese di novembre del 2009, quando è stata partorita da un’idea di Andrey Ternovskiy, 17enne russo reso celebre dalla sua trovata che sta rapidamente influenzando internet.
L’utilizzo è semplice, basta collegarsi al sito www.chatroulette.com e cominciare a chattare con l’utente che viene selezionato in modo del tutto casuale. Se l’interlocutore non è di nostro gradimento si può cambiare con un click. Si tratta di un fenomeno che contiene in sé diversi aspetti interessanti, nato in sordina è stato eletto a vero e proprio must dagli utenti stessi, con una campagna tipicamente virale perché, fino ad oggi almeno, di pubblicità il giovane russo ne ha fatta ben poca.
Sono oltre 1,5 milioni gli utenti che ogni giorno passano un po’ del loro tempo a socializzare con sconosciuti, non sempre facendo incontri entusiasmanti ma comunque sempre divertenti. Dal punto di vista della tutela soprattutto dei minori devono ancora essere fatti dei passi avanti. ChatRoulette non prevede registrazione, non c’è nessun tipo di controllo sull’età degli utenti tra i quali, di tanto in tanto, si trovano persone alternative e fuori dagli schemi, per usare alcuni eufemismi. Questo non impedisce la crescita del fenomeno, infatti si vocifera che Digital Sky Technologies, la venture capital russa che ha investito quasi 400milioni di dollari nel progetto Facebook, sia pronta ad iniettare capitale nell’idea del giovane Ternovskiy.
Non è un fenomeno erotico, anche se quella del sesso è e rimane una componente fondamentale del web. Si incontrano persone di ogni tipo, un campionario ben assortito della società attuale ed emerge anche la voglia di allargare il proprio giro di amicizie.
Fonte :http://techblog.tgcom.it

Googler ships exploit to defeat DEP

A prominent security researcher has released an exploit that uses a new technique to defeat DEP (Data Execution Prevention) on Microsoft’s Windows operating system. The exploit, released by Google security researcher “SkyLined,” uses the ret-into-libc technique to bypass DEP and launch code execution attacks on x86 platforms. SkyLined (real name Berend-Jan Wever) is best known for introducing heap-spraying in Web browsers, a technique used in exploits to facilitate arbitrary code execution.  He previously worked at Microsoft before leaving in 2008 to work on security Google’s Chrome browser. “I am releasing this because I feel it helps explain why ASLR+DEP are not a mitigation to put a lot of faith in, especially on x86 platforms,” SkyLined wrote on his blog.  ”32-bits does not provide sufficient address space to randomize memory to the point where guessing addresses becomes impractical, considering heap spraying can allow an attacker to allocate memory across a considerable chunk of the address space and in a highly predictable location,” he added.

The code in this exploit shows how to abuse this to perform a ret-into-libc attack when you can predict or, through information leakage, determine the location of modules (exe, dll) in the process’ memory.

The source code for the Internet Exploiter 2 exploit has been posted online [zip file]. Microsoft introduced ASLR (Address Space Layout Randomization) + DEP in Windows Vista, touting them as significant anti-exploit mechanisms but researchers have spent the better part of the last year finding ways around these mitigations. At the 2008 Black Hat conference, hackers Mark Dowd and Alex Sotirov demonstrated the new methods to get around ASLR and DEB by using Java, ActiveX controls and .NET objects to load arbitrary content into Web browsers.

Fonte : http://blogs.zdnet.com/security/?p=5573

Mariposa Botnet - Infettati 13 Milioni di PC

La polizia spagnola ha smantellato una tra le più grandi "reti" informatiche della cybercriminalità, arrestando tre giovani che avevano il controllo della "botnet", chiamata Mariposa. La "botnet", nel gergo informatico, è una rete di computer che, all'insaputa dei proprietari, è controllata da pirati informatici ed utilizzata per scopi diversi, come, ad esempio, l'appropriazione di dati sensibili degli utenti: "Mariposa" aveva coinvolto, fino ad oggi, oltre 13 milioni di computer sparsi in 190 Paesi. L'arresto dei tre cybercriminali ha permesso così di "spegnere" una delle più grandi botnet al mondo finalizzata alla sottrazione di informazioni personali riservate, credenziali bancarie, password e numeri di carte di credito. Finora, la "botnet" aveva preso il controllo dei computer di grandi aziende (oltre la metà delle 1.000 imprese più grandi al mondo) e di almeno 40 importanti banche. Sui computer degli arrestati la polizia postale spagnola ha trovato i dati personali "sensibili" di oltre 800 mila persone.

Gli esperti di sicurezza sottolineano che l'arresto dei responsabili di Mariposa costituisce un piccolo ma significativo successo contro "la piaga" delle botnet, diventate ormai lo strumento preferito dai criminali informatici. Rik Ferguson, ricercatore di Trend Micro ha commentato: "Mariposa, come botnet controllata da un unico gruppo di criminali, è sicuramente una botnet di grandi dimensioni, soprattutto se consideriamo che le botnet sono solitamente controllate e sfruttate da più gruppi criminali". "I computer compromessi, in alcuni casi, possono arrivare anche a 100 milioni, com'è emerso da nostre analisi precedenti, ciò significa che Mariposa, pur essendo considerevole come singola botnet, è tuttavia piccola rispetto al numero totale di PC potenzialmente infettabili", ha concluso Ferguson. 

Ma come funziona una "botnet"? I criminali usano software pericoloso, o malware, per penetrare nei computer altrui. Le macchine così infettate sono soprattutto i PC di casa di normali utenti. Recenti statistiche pubblicate da TrendLabs indicano che il 75% di tutti i computer infettati da un bot risiedono in un'abitazione privata, e in tutto il mondo se ne contano decine di milioni.
Un computer infettato si trova sotto il pieno controllo remoto di un criminale. "Bot" è un'abbreviazione di "robot"; un altro termine spesso applicato a questo genere di infezioni è "zombie", per ovvie ragioni. Una rete botnet è un gruppo di computer che ricadono sotto il controllo di un singolo individuo o di una banda criminale. Questi criminali usano i computer infettati come risorsa per guadagnare denaro e, con l'esplosione di una vera e propria economia sotterranea, hanno messo a punto vari metodi per monetizzare i loro "investimenti".

Le botnet sono innanzitutto progettate per sottrarre i dati per il login ai servizi di home banking, credenziali per l'uso di servizi online come PayPal ed eBay, o per accedere alla webmail - in pratica qualunque combinazione username/password che possa esistere su un computer. Le botnet sono anche in grado di aggiungere surrettiziamente contenuti supplementari alle pagine dei siti bancari per acquisire ulteriori informazioni: un esempio può essere una reale pagina di login del sito di una carta di credito che venga estesa per richiedere non solo username e password, come di consueto, ma anche il PIN del bancomat.
Oltre a essere utilizzate per la sottrazione di informazioni, le reti botnet vengono spesso affittate ad altri gruppi criminali come piattaforma di distribuzione. Chi per esempio intende distribuire un software antivirus fasullo può pagare il proprietario di una botnet in base al numero di copie del programma scaricate sui computer controllati dalla botnet stessa; chi deve inviare grandi quantità di messaggi spam può subappaltarne la spedizione al proprietario di una botnet che userà i PC infetti per diffondere spam ovunque. 

I bot sono impiegati anche per installare siti Web pericolosi approntati in maniera tale da allargare la catena delle infezioni o siti di phishing progettati per sottrarre informazioni. In alcuni casi i PC infettati sono usati per rendere possibile il download di contenuti pornografici legali e illegali.
Il malware usato per infettare i computer è spesso realizzato affinché eluda i controlli dei software antivirus tradizionali, e molti siti Web legittimi vengono compromessi per infettare il visitatore di passaggio. Il software necessario per crearsi una propria botnet è gratuitamente disponibile nei forum online. Criminali incalliti e principianti assoluti si dedicano sempre più a queste attività. Una botnet è la piattaforma preferita dalla maggior parte dei cybercriminali.
E così sempre più computer vengono infettati, e restano tali per periodi di tempo sempre più lunghi. Una precedente analisi condotta da Trend Micro su 100 milioni di PC compromessi ha evidenziato che in molti casi i computer restano infetti per circa 2 anni.

Cosa si può fare? Innanzitutto tenendosi informati. E poi scoprire come funziona il proprio software antivirus. Ad esempio, se non avvisa nel momento in cui visitate una pagina Web potenzialmente pericolosa allora non è in grado di proteggervi. E poi aggiornare costantemente il software antivirus e di Internet Security in modo da avere sempre tutte le "definizioni" dei nuovi malware e dei nuovi programmi pericolosi, così come delle pagine Web potenzialmente infette.

Fonte: http:\\www.repubblica.it

The Top Cyber Security Risks

Application Vulnerabilities Exceed OS Vulnerabilities

During the last few years, the number of vulnerabilities being discovered in applications is far greater than the number of vulnerabilities discovered in operating systems. As a result, more exploitation attempts are recorded on application programs. The most "popular" applications for exploitation tend to change over time since the rationale for targeting a particular application often depends on factors like prevalence or the inability to effectively patch. Due to the current trend of converting trusted web sites into malicious servers, browsers and client-side applications that can be invoked by browsers seem to be consistently targeted.
 

 Web Application Attacks

There appear to be two main avenues for exploiting and compromising web servers: brute force password guessing attacks and web application attacks. Microsoft SQL, FTP, and SSH servers are popular targets for password guessing attacks because of the access that is gained if a valid username/password pair is identified. SQL Injection, Cross-site Scripting and PHP File Include attacks continue to be the three most popular techniques used for compromising web sites. Automated tools, designed to target custom web application vulnerabilities, make it easy to discover and infect several thousand web sites.

Windows: Conficker/Downadup

Attacks on Microsoft Windows operating systems were dominated by Conficker/ Downadup worm variants. For the past six months, over 90% of the attacks recorded for Microsoft targeted the buffer overflow vulnerability described in the Microsoft Security Bulletin MS08-067. Although in much smaller proportion, Sasser and Blaster, the infamous worms from 2003 and 2004, continue to infect many networks.

Apple: QuickTime and Six More

Apple has released patches for many vulnerabilities in QuickTime over the past year. QuickTime vulnerabilities account for most of the attacks that are being launched against Apple software. Note that QuickTime runs on both Mac and Windows Operating Systems. The following vulnerabilities should be patched for any QuickTime installations: CVE-2009-0007, CVE-2009-0003, CVE-2009-0957.

Origin and Destination Analysis for Four Key Attacks

Over the past six months, we have seen some very interesting trends when comparing the country where various attacks originate to the country of the attack destination. In order to show these results, we have characterized and presented the data in relation to the most prevalent attack categories. The analysis performed for this report identified these attack categories as high-risk threats to most if not all networks, and as such, should be at the forefront of security practitioners' minds. These categories are Server-Side HTTP attacks, Client-Side HTTP attacks, PHP Remote File Include, Cross-site Scripting attacks, and finally SQL Injection attacks. As you might expect, there is some overlap in these categories, with the latter three being subsets of the first two categories. However, the trends we see in separating this data is worth pointing out.

The SQL Injection attacks that compose this category include "SQL Injection using SELECT SQL Statement", "SQL Injection Evasion using String Functions", and "SQL Injection using Boolean Identity". The most prominent "PHP Remote File Include attack" is one that looks for a very small HTTP request that includes a link to another website as a parameter that contains a very specific evasion technique used by a number of attacks to increase the reliability of their attacks. Also of note is a very specific attack against the "Zeroboard PHP" application, the only single application that made the top attacks. The final type of attack included in these statistics is one of the more popular "HTTP Connect Tunnel" attacks, which remains a staple in the Server-Side HTTP category. The HTTP connect tunnels are used for sending spam emails via mis-configured HTTP servers.

Application Patching is Much Slower than Operating System Patching

Qualys scanners collect anonymized data of detected vulnerabilities to capture the changing dynamics in the vulnerability assessment field. The data documents changes such as the decline of server side vulnerabilities and the corresponding rise of vulnerabilities on the client side, both in operating system components and applications. A Top 30 ranking is used often to see if major changes occur in the most frequent vulnerabilities found. Here is the ranking for the first half of 2009 TH edited to remove irrelevant data points such as 0-day vulnerabilities.
Description

   1. WordPad and Office Text Converters Remote Code Execution Vulnerability (MS09-010)
   2. Sun Java Multiple Vulnerabilities (244988 and others)
   3. Sun Java Web Start Multiple Vulnerabilities May Allow Elevation of Privileges(238905)
   4. Java Runtime Environment Virtual Machine May Allow Elevation of Privileges (238967)
   5. Adobe Acrobat and Adobe Reader Buffer Overflow (APSA09-01)
   6. Microsoft SMB Remote Code Execution Vulnerability (MS09-001)
   7. Sun Java Runtime Environment GIF Images Buffer Overflow Vulnerability
   8. Microsoft Excel Remote Code Execution Vulnerability (MS09-009)
   9. Adobe Flash Player Update Available to Address Security Vulnerabilities (APSB09-01)
  10. Sun Java JDK JRE Multiple Vulnerabilities (254569)
  11. Microsoft Windows Server Service Could Allow Remote Code Execution (MS08-067)
  12. Microsoft Office PowerPoint Could Allow Remote Code Execution (MS09-017)
  13. Microsoft XML Core Services Remote Code Execution Vulnerability (MS08-069)
  14. Microsoft Visual Basic Runtime Extended Files Remote Code Execution Vulnerability (MS08-070)
  15. Microsoft Excel Multiple Remote Code Execution Vulnerabilities (MS08-074)
  16. Vulnerabilities in Microsoft DirectShow Could Allow Remote Code Execution (MS09-028)
  17. Microsoft Word Multiple Remote Code Execution Vulnerabilities (MS08-072)
  18. Adobe Flash Player Multiple Vulnerabilities (APSB07-20)
  19. Adobe Flash Player Multiple Security Vulnerabilities (APSB08-20)
  20. Third Party CAPICOM.DLL Remote Code Execution Vulnerability
  21. Microsoft Windows Media Components Remote Code Execution Vulnerability (MS08-076)
  22. Adobe Flash Player Multiple Vulnerabilities (APSB07-12)
  23. Microsoft Office Remote Code Execution Vulnerability (MS08-055)
  24. Adobe Reader JavaScript Methods Memory Corruption Vulnerability (APSA09-02 and APSB09-06)
  25. Microsoft PowerPoint Could Allow Remote Code Execution (MS08-051)
  26. Processing Font Vulnerability in JRE May Allow Elevation of Privileges(238666)
  27. Microsoft Office Could Allow Remote Code Execution (MS08-016)
  28. Adobe Acrobat/Reader "util.printf()" Buffer Overflow Vulnerability (APSB08-19)
  29. Adobe Acrobat and Adobe Reader Multiple Vulnerabilities (APSB08-15)
  30. Windows Schannel Security Package Could Allow Spoofing Vulnerability (MS09-007)

Zero-Day Vulnerability Trends

A zero-day vulnerability occurs when a flaw in software code is discovered and code exploiting the flaw appears before a fix or patch is available. Once a working exploit of the vulnerability has been released into the wild, users of the affected software will continue to be compromised until a software patch is available or some form of mitigation is taken by the user.

The "File Format Vulnerabilities" continue to be the first choice for attackers to conduct zero-day and targeted attacks. Most of the attacks continue to target Adobe PDF, Flash Player and Microsoft Office Suite (PowerPoint, Excel and Word) software. Multiple publicly available "fuzzing" frameworks make it easier to find these flaws. The vulnerabilities are often found in 3rd party add-ons to these popular and wide-spread software suites, making the patching process more complex and increasing their potential value to attackers.

The notable zero-day vulnerabilities during past 6 months were:

    * Adobe Acrobat, Reader, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862)
    * Microsoft Office Web Components ActiveX Control Code Execution Vulnerability (CVE-2009-1136)
    * Microsoft Active Template Library Header Data Remote Code Execution Vulnerability (CVE-2008-0015)
    * Microsoft DirectX DirectShow QuickTime Video Remote Code Execution Vulnerability (CVE-2009-1537)
    * Adobe Reader Remote Code Execution Vulnerability (CVE-2009-1493)
    * Microsoft PowerPoint Remote Code Execution Vulnerability (CVE-2009-0556)

The ease of finding zero-day vulnerabilities is a direct result of an overall increase in the number of people having skills to discover vulnerabilities world-wide. This is evidenced by the fact that TippingPoint DVLabs often receives the same vulnerabilities from multiple sources.

For example, MS08-031 (Microsoft Internet Explorer DOM Object Heap Overflow Vulnerability) was discovered independently by three researchers. The first researcher submitted remote IE 6/7 critical vulnerability on Oct 22, 2007. A second independent researcher submitted the same vulnerability on April 23, 2008. A third independent researcher submitted the same vulnerability on May 19, 2008. All three submissions outlined different approaches of auditing and finding the same vulnerability.

The implication of increasing duplicate discoveries is fairly alarming, in that the main mitigation for vulnerabilities of this type is patching, which is an invalid strategy for protecting against zero-day exploits. There is a heightened risk from cyber criminals, who can discover zero-day vulnerabilities and exploit them for profit. Add to this that software vendors have not necessarily lowered their average time for patching vulnerabilities reported to them, and that TippingPoint is aware of a number of vulnerabilities that were reported to vendors two years ago and are still awaiting a patch.

http://www.zerodayinitiative.com/advisories/upcoming/

This makes zero-day exploits in client-side applications one of the most significant threats to your network, and requires that you put in place additional information security measures and controls to complement your vulnerability assessment and remediation activities.

Fonte: http://www.sans.org/top-cyber-security-risks/#trends

VBScript 0-Day Vulnerability Affecting IE on XP Confirmed

Microsoft has confirmed officially a vulnerability in VBScript, which affects copies of Internet Explorer running on top of older releases of Windows, including Windows XP SP3, but also Windows 2000, and Windows Server 2003. At the end of the past week, the company noted that it was investigating claims of a security flaw and reviewing details published irresponsibly in the wild. Maurycy Prodeus, a security analyst with iSEC Security Research, came across the vulnerability and made it public, indicating that, in the eventuality of a successful exploit, an attacker could invoke winhlp32.exe from Internet Explorer and execute arbitrary code on the victim’s computer.

“The vulnerability exists in the way that VBScript interacts with Windows Help files when using Internet Explorer. If a malicious Web site displayed a specially crafted dialog box and a user pressed the F1 key, arbitrary code could be executed in the security context of the currently logged-on user. On systems running Windows Server 2003, Internet Explorer Enhanced Security Configuration is enabled by default, which helps to mitigate this issue,” Jerry Bryant, senior security communications manager – lead, Microsoft, revealed.

Bryant underlines that, at this point in time, Microsoft is not aware of any attacks in the wild targeting the VBScript vulnerability or of working exploit code. Customers that are running Windows Vista, Windows 7, Windows Server 2008, and Windows Server 2008 R2 have nothing to worry about in relation to this specific security hole, which cannot be exploited on their platforms.

The software giant is working on a patch for this issue, but, in the meanwhile, users can take matters into their own hands when it comes down to securing their machines. In this regard, the company issued Security Advisory 981169, a resource that contains a number of workarounds to avoid exposure to attacks. It is critical to note that the vulnerability can only be exploited in the context in which the end user presses F1 while prompted to do so by a malformed popup when visiting an attack website.

“Our analysis shows that if users do not press the F1 key on their keyboard, the vulnerability cannot be exploited. Consequently, malicious Web sites may attempt to persuade users into pressing the F1 key. Such a Web site could invoke an endless loop of dialog boxes that tell the user to press the F1 key to end the loop, or offer information such as pricing information or help to be revealed through the F1 key. Users are advised to avoid pressing F1 presented by Web pages or other Internet content. If a dialog box appears repeatedly in an attempt to convince the user to press F1, users may log off the system or use Task Manager to terminate the Internet Explorer process,” Microsoft advises.
Fonte : http://news.softpedia.com