Tuesday, April 30, 2013

No, Iran didn't really hack and down a foreign military spy drone

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

A report by the Islamic Republic News Agency this weekend raised eyebrows, as it appeared to claim that Iran's Revolutionary Guard Corps had managed to hack and down a foreign spy drone.

Iranian news story

"A foreign spy drone was hacked outside the field of Payambar-e Azam 8 wargames on Saturday," reporters were told.

The official FARS news agency told a similar story, adding that the revolutionary guard were in possession of pictures taken by the drone and hoped to release them to the world's media.

FARS story

IRGC Hunts Alien UAV over Wargame Zone
TEHRAN (FNA)- The Islamic Revolution Guards Corps announced that it has hunted an alien Unmanned Aerial Vehicle (UAV) after the drone neared the IRGC's current wargames zone in Southern Iran.

"On the first day of Payambar-e Azam 8 (The Great Prophet 8) wargames, the IRGC's electronic warfare systems detected signals showing that alien drones were trying to enter the country (airspace)," Spokesman of the Wargames General Hamid Sarkheili told reporters on Saturday evening.

"Then our experts could bring down an alien drone over the wargames zone," he added.

Sarkheili said the IRGC is now in possession of the pictures taken by the drone and will release them if Okayed by the country's senior commanders.

However, you shouldn't be too quick to take these headlines at face value.

Because, as a corrected Reuters report makes clear, the downed enemy spy drone was hypothetical - a real drone was not hacked and brought down by Iranian forces.

In short, it was all part of Iran's war games, and the media were mislead by the testosterone-fueled bravado of those taking part.

That's not to say, of course, that real drones cannot be hijacked by hackers.

Last year, researchers at the University of Texas at Austin hacked and hijacked a drone in front of a group of dismayed Department of Homeland Security officials who had dared them $1,000 to do it.

Follow @gcluley

UAV image, courtesy of Shutterstock.


View the original article here

Monday, April 29, 2013

Researchers claim to have found more zero-day vulnerabilities in Java

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Coffee cup. Image from ShutterstockA security research team that has alerted Oracle to a series of security flaws in Java in the past, says that it has uncovered new zero-day vulnerabilities in the software.

According to Polish firm update posted by Security Explorations, it has sent proof-of-concept code to Oracle's security team - so they can investigate the issue.

The concern is that the flaws could be exploited to completely bypass Java's security sandbox and infect computers in a similar fashion to the attacks which recently troubled the likes of Facebook, Apple and Microsoft.

In those cases, cybercriminals hacked legitimate websites and planted code which exploited Java vulnerabilities when developers visited using web browsers that had a vulnerable version of the Java plugin.

Update from Security Explorations

Softpedia reports Security Explorations CEO Adam Gowdiak as saying:

"Both new issues are specific to Java SE 7 only. They allow to abuse the Reflection API in a particularly interesting way... Without going into further details, everything indicates that the ball is in Oracle's court. Again."

So, many computer users find themselves in what is becoming a disturbingly familiar situation - looking to see when Oracle will confirm that the flaws exist, and then waiting for the inevitable security update for Java.

Here's the best piece of advice we can give you right now:

Many people who have Java enabled in their browser simply do not need it (By the way, don't mix up Java with JavaScript - they're different things), so the best solution for many folks is to rip Java out of their browser entirely.

If you don't need Java, why put yourself at risk?

Follow @gcluley

Dirty cup of coffee image from Shutterstock.


View the original article here

Saturday, April 27, 2013

Facebook turns a deaf ear to users aged over 99

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Life goes into a sort of reverse time-warp after we attain the age of 99, if Facebook is to be believed.

The social media behemoth apparently never assumed that a person with three digits worth of living to their credit would sign up to use its service.

Hence, Facebook finds itself apologizing to Marguerite Joseph, a 104-year-old Michigan woman in the United States.

Marguerite Joseph on Facebook

According to Ms. Joseph's granddaughter, Gail Marlow, Facebook keeps shaving 20 years off of Joseph's age.

According to WDIV-TV, when Ms. Marlow tries to input her grandmother's birth year as 1908, Facebook rolls it back to 1928.

The real-life centenarian is legally blind and doesn't hear well, but her granddaughter reads posts from relatives and types in responses to all of the messages Ms. Joseph receives.

Ms. Marlow has been trying to bring the problem to Facebook's attention for years - including directly emailing Facebook founder Mark Zuckerberg - but hasn't yet heard back.

Her grandmother turns an auspicious age - 105 - in April, Ms. Marlow says, meaning it's high time to get her age right:

"Every time I tried to change the settings to the right year, Facebook always came back with an unknown error message and would send us right back to a year she wasn’t born in... I would love to see her real age on Facebook, I mean in April she’s going to be 105. It’s special."

Facebook logoFollowing press interest, Facebook finally apologized on Wednesday, saying that it's working to fix a problem limiting used of pre-1910 birthdates.

From WDIV-TV:

We've recently discovered an issue whereby some Facebook users may be unable to enter a birthday before 1910. We are working on a fix for this and we apologize for the inconvenience.

I'm glad to hear Facebook is finally paying attention.

True, Facebook has had much bigger fish to fry. Nothing like 83 million fake accounts, privacy glitches, arguments over facial recognition, and a Java-assisted network breach to distract a company.

But ignoring a reported glitch for years seems a bit excessive.

Talk about hard of hearing. Years of non-responsiveness does little to reassure us that Facebook is listening.

Follow @LisaVaas
Follow @NakedSecurity


View the original article here

Talking Angela iPhone app scare spreads on Facebook

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Talking Angela iPhone appA bogus warning is spreading across Facebook, telling parents of young children to watch out for a rogue iPhone/iPad app that (the warning claims) steals children's names, details of where they go to school, and even takes secret pictures of their faces.

The chain letter warning about the "Talking Angela" iOS app is being unwittingly spread by Facebook users, presumably with the thinking of "better safe than sorry" rather than "maybe I should just check the facts before forwarding this scare onto my friends".

The truth is that "Talking Angela" appears to be entirely benign, and there are no obvious privacy concerns that differentiate it from thousands of other iPhone apps.

Indeed, the "Talking Angela" app is no different from other similar popular children's apps from reputable iOS developer Out Fit 7 Ltd, including "Talking Tom Cat", "Talking Ben the Dog" and "Talking Gina the Giraffe".

Here's what a typical warning looks like when it is spread on Facebook:

Talking Angela warning

WARNING FOR TO ALL PARENTS WITH CHILDREN THAT HAVE ANY ELECTRONIC DEVICES , EX : IPOD,TABLETS ETC .... THERE IS A SITE CALLED TALKING ANGELA , THIS SITE ASKS KIDS QUESTIONS LIKE : THERE NAMES , WHERE THEY GO TO SCHOOL AND ALSO TAKE PICTURES OF THEIR FACES BY PUSHING A HEART ON THE BOTTOM LEFT CORNER WITHOUT ANY NOTICES . PLEASE CHECK YOUR CHILDREN'S IPODS AND ALL TO MAKE SURE THEY DO NOT HAVE THIS APP !!! PLEASE PASS THIS MESSAGE ON TO YOUR FRIENDS AND FAMILY MEMBERS THAT HAVE KIDS !!!!

The inference from the all-caps warning is clearly that "Talking Angela" is somehow a risk to children.

However, whoever started this scare has got their facts in a muddle.

Talking AngelaFor one thing, "Talking Angela" is an iOS app - not a website (although there is an optional Facebook component).

Also, the app's purpose is to wait until the child says something and then mimic what they say back to them (albeit in a Parisian feline fashion) rather than to pilfer details of where they go to school.

None of this, of course, is to say that you shouldn't be careful about what smartphone apps you install, and which Facebook applications you grant access to your social networking profile.

Furthermore, it's always a good idea to keep a close eye on what children are doing on the internet - in case they get themselves into a spot of bother.

But the warning spreading across Facebook appears to be nothing more than a scare - setting the cat amongst the pigeons unnecessarily.

Keep your wits about you and stay informed about the latest scams, hoaxes and malware attacks spreading fast across Facebook. Join the Naked Security from Sophos Facebook page, where more than 200,000 people regularly share information on the latest security issues.

Follow @gcluley

View the original article here

Thursday, April 25, 2013

China blamed for EADS and ThyssenKrupp hack attacks

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Two more major organisations have gone public about, what they claim, were attempts by Chinese hackers to infiltrate their networks and steal sensitive information.

EADS, the European Aeronautic Defense and Space company, and steelmaker ThyssenKrupp are said to have become the targets of hack attacks originating in China, according to Der Spiegel.

EADS - who makes the Eurofighter jet, as well as spy drones, surveillance satellites, and even rockets for French nuclear weapons - are said to have contacted the German government last year to warn them that the military contractor's computer network has been hacked.

Eurofighter

Officially, EADS have described the attack as "standard" and insisted that no harm has been done.

However, the attacks is against a backdrop created over the last few years of of other hacks against the defence industry including the likes of Lockheed Martin, L-3 Communications and Northrop Grumman.

And, of course, it's only 18 months since the then US Deputy Defense Secretary William Lynn claimed that a foreign intelligence agency was behind a hack attack that stole classified information about a top secret weapons system.

Meanwhile, ThyssenKrupp has also said to have confirmed that it was attacked by hackers - adding the detail that the attack occurred in the United States, and appeared to originate from a Chinese internet address.

According to Der Spiegel, the attacks against ThyssenKrupp were described as "massive" and of "a special quality", and the company was not sure of what (if any) information had been stolen by the hackers.

It is becoming increasingly clear that organisations need to defend themselves not only from the day-to-day financial-orientated cybercrime attacks which can impact anyone with a computer, but also from sophisticated targeted attacks that may be designed to spy and surreptitiously steal information.

BlueprintThe truth is that these hacking stories aren't really describing a technological problem. They're describing a human problem. It's remarkably easy to dupe someone into clicking on a link or opening an attachment in an email, and for their computer to become compromised.

You can reduce the chances of a targeted attack working by keeping your software (such as your PDF reader, your web browser, your word processor, as well as your operating system) up-to-date with the latest patches.

Furthermore, you should run a layered defence - that means not just running up-to-date anti-virus software, but also firewalls, email filtering technologies, vulnerability assessment, using DLP (data loss protection) technology and strong encryption to secure your most sensitive data.

Also, it's amazing how many people re-use passwords, and use the same weak password in multiple places. That means if you get hacked in one place, and your password is compromised, it may also unlock accounts elsewhere on the net. It's shocking how many people don't use different passwords for different places.

All of these methods can reduce your chances of suffering from a targeted attack.

But ultimately, there's no 100% technological solution as human beings can still make bad decisions. And that's why it's important to train users about threats, and warn them to be suspicious of unsolicited links and attachments and to always report suspicious activity.

Follow @gcluley

View the original article here

Tuesday, April 23, 2013

Microsoft admits it was also hit by hackers, malware infects their Mac business unit

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Late on Friday, Microsoft published a statement on its security blog revealing that it was joining the growing list of well-known companies who had suffered at the hands of hackers.

Microsoft says that a "small number of computers", including some in the company's Mac business unit, were infected by malware.

microsoft-statement

As reported by Facebook and Apple, Microsoft can confirm that we also recently experienced a similar security intrusion.

Consistent with our security response practices, we chose not to make a statement during the initial information gathering process. During our investigation, we found a small number of computers, including some in our Mac business unit, that were infected by malicious software using techniques similar to those documented by other organizations. We have no evidence of customer data being affected and our investigation is ongoing.

This type of cyberattack is no surprise to Microsoft and other companies that must grapple with determined and persistent adversaries (see our prior analysis of emerging threat trends). We continually re-evaluate our security posture and deploy additional people, processes, and technologies as necessary to help prevent future unauthorized access to our networks.

If Microsoft is right, and the attack is similar to those which impacted the likes of Facebook and Apple, then a key part of the attack was the exploitation of a Java browser plug-in vulnerability.

Simply visiting an infected webpage with a browser which had Java enabled would be enough to silently infect computers via a drive-by download.

If we have to say it once, twice or a thousand times - we'll keep on saying it:

Because if you don't, yours might be the next company having to make any uncomfortable announcement about a security breach.

Like Facebook before it, Microsoft chose to release the news on a Friday afternoon, west coast time.

microsoft-170Although some might view the timing of the disclosure cynically, and speculate that the bad news was released just before the weekend to limit its pick-up by the press, the good news is that Microsoft says it has found no evidence that any customer data was compromised as a consequence of the attack.

Let's not forget who the real villains are in this story - it's the criminal gangs who infected legitimate websites, and spread malware designed to steal information from unsuspecting computer users.

Knowing Microsoft, I am confident that they will be sharing information with the authorities and doing everything they can to ensure that the culprits are brough to justice.

If you haven't already done so, patch your computers and consider running anti-virus software on your Macs as well as your PCs. Clearly some of the bad guys are targeting Mac OS X, knowing that many "cool" developers prefer to write their software on shiny Apple hardware as well as dull beige PCs.

Sophos has a free Mac anti-virus for home users if you want to give it a whirl.

Follow @gcluley

Microsoft image from Shutterstock.


View the original article here

US soldiers and spies to get handheld biometric scanners

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Face being scanned. Image from ShutterstockUS soldiers and spies will soon be able to scan people's eyes, faces, thumbs and voices, at a distance, using everyday, commercially available smartphones - a boon for both the battlefield and for government snooping.

The biometrics company AOptix announced on Wednesday that the Pentagon has awarded it, along with CACI International Inc, a $3 million research contract to develop AOptix's Smart Mobile Identity devices for the US Department of Defense.

As Wired reported, the end result after two years of planned development will be a hardware peripheral and software suite that turns a regular smartphone into a device that scans and transmits data at distances not possible for current scanning technology.

AOptix's hardware is a peripheral that wraps around a smartphone, boosting the phone's sensing capabilities so that it can record biometric data.

Face scanning from mobile device. Image source: AOptix

Unlike the device currently used to scan, upload and transmit biometric data to the US military's wartime databases - the Handheld Interagency Identity Detection System (HIIDE) - the AOptix device can be operated single-handedly and will be as simple to use as a user-friendly smartphone application.

According to Wired, this new gadget will be able to scan faces at up to two meters away, irises from one meter, and voice from within a typical distance from a phone. Thumbprints will still require scanning against the phone's glass face.

AOptix executive Joey Pritikin told Wired that the system will be able to capture an iris in bright sunlight, which is a challenge for current biometric devices.

It will also be able to snap photos of a face or eye as soon as the phone focuses, without the need for the user to click, swipe or press.

It's easy to see the benefit of biometrics to troops. As early as the war in Iraq, fingerprint and iris scanners have been used to hire and maintain workforces, protect military bases and monitor inmates at detention centers.

For surveillance, biometrics has been more of a mixed bag.

As it is, the use of biometrics at borders is already threatening the security of undercover spies (and terrorists, or anybody traveling under assumed identity for any reason).

Wired reported in April that, pre-9/11, deep-undercover CIA operatives could use and toss false passports "like hand wipes," picking up new, fraudulent passports at local CIA stations.

Biometrics and linked databases are making that impossible, Wired reports, quoting an ex-spook who says that simply crossing the border with a real identity and then picking up a fake one in-country to conduct covert operations is presenting risks:

"When you go to check into a hotel room for a meeting with an asset, or even rent a car to drive to the meeting - or hold the meeting in the car - many hotels and car rental agencies upload their customer data, including passport number, to immigration every day... Most countries are looking for visa overstays. But when you show up on the list as never having entered the country... it brings the police around to ask questions."

Wired notes that, particularly in "hostile" places such as Iran, where the interior ministry's computers are assumably hard-wired into airline passenger lists and hotel guest lists, the use of false passport and travel data is a dangerous gambit.

Of course, "hostile" is a relative term. There are many who view the current state of über surveillance in the US, for example, as invasive, at best, and contemptuous of civil liberties, at worst.

It's understandable that government intelligence groups such as the CIA or the MI6 would be concerned for the safety of their deep-undercover agents.

AOptix hasn't identified which specific arms of US military or intelligence are gearing up to use the new biometrics scanners.

NSABut as normal Jane Doe citizens, particularly in these surveillance-happy post-9/11 days, it's a little scary to imagine ever-easier biometric scanning in the hands of outfits such as, say, the US's National Security Agency, which already has an insatiable hunger for data.

That's evidenced by the Utah Data Center, the vast facility the NSA is constructing to intercept, decipher, analyze, and store pretty much everything we do and everything we say, whether our communications are dragged up from undersea cables of international, foreign and domestic networks or pinched from the sky as relayed by satellite.

Do we really want US intelligence outfits to be able to identify us via biometrics, at a distance, and squirrel our movements away in their mind-bogglingly expansive data warehouses?

We have no choice in the matter, between the creation of hummingbird drones and the upcoming handheld scanners.

Let's just hope that more countries don't follow Canada's example and ban masks at protests.

Follow @LisaVaas
Follow @NakedSecurity

Facial scan image from Shutterstock. Image of man scanning other man's face from AOptix.


View the original article here

Monday, April 22, 2013

BlackBerry warns of TIFF vulnerability that could allow malware to run on enterprise servers

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Blackberry Enterprise ServerIf you are responsible for administering the BlackBerry phones used by staff at your company, there's some imporant security news.

According to a BlackBerry security advisory published last week, vulnerabilities exist that could allow remote hackers to run malicious code on the BlackBerry Enterprise Server (BES) software run by many firms.

The flaw, which has been rated as "high severity", involves how BlackBerry's enterprise software handles TIFF image files on webpages, in emails, and in instant messages.

According to BlackBerry's advisory:

Vulnerabilities exist in how the BlackBerry MDS Connection Service and the BlackBerry Messaging Agent process TIFF images for rendering on the BlackBerry smartphone.

Successful exploitation of any of these vulnerabilities might allow an attacker to gain access to and execute code on the BlackBerry Enterprise Server.

Depending on the privileges available to the configured BlackBerry Enterprise Server service account, the attacker might also be able to extend access to other non-segmented parts of the network.

In short, a malicious hacker could create a boobytrapped TIFF image file and either trick a BlackBerry smartphone user into visiting a webpage carrying the image, or embed the malicious image directly into an email or instant message.

According to BlackBerry, the BlackBerry Messaging Agent flaw does not even require a user to click on a link or view an email for the attack to succeed.

The risk is that by exploiting the flaw, hackers might be able to plant malicious code on your BlackBerry Enterprise Server that opens a backdoor for remote access.

Depending on how your network infrastructure is set up - intruders might be able to see into other parts of your network and steal information.

Alternatively, the hackers' code might cause your systems to crash - perhaps interrupting communications.

It's important to underline that these are not vulnerabilities in BlackBerry smartphones themselves. Like other BlackBerry-related vulnerabilities we've seen in the past, the potential attack is against the BlackBerry Enterprise Server used by businesses.

As more and more companies are waking up to the risk of targeted attacks with the apparent intention of stealing data and spying on activities, such a vulnerability is clearly a serious concern.

The good news is that BlackBerry has not received any reports of attacks targeting its enterprise customers, but obviously it is still a very good idea for affected customers to update their software as soon as possible. The company has published workarounds for those businesses who may not be able to quickly update their installation of Blackberry Enterprise Server.

Follow @gcluley

View the original article here

Sunday, April 21, 2013

Boy meets girl. Girl strips on webcam. Tells boy to do the same. Girl blackmails boy

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

# And when two lovers woo
They still say, "I love you."
On that you can rely
No matter what the future brings
As time goes by. #

The famous song Dooley Wilson sang in Casablanca may have got it wrong. For the age-old romantic story of "Boy meets girl" has surely become an awful lot more complicated now the internet has come along.

At least, that's what male computer users in Singapore are discovering.

We've warned readers before about some of the dangers involved in finding love online. Such as the true story of the Facebook blind date that turned into a supermarket robbery.

Now, people are being warned about another risk of finding love in the online world - webcam extortion.

Webcam extortion. Image from ShutterstockBut it's not the familiar headline of perverted hackers blackmailing young women into stripping in front of the camera.

This time the tables have turned, and it's *men* who are being victimised by *women*, in a peculiar twist on traditional webcam extortion.

Singapore's Police Force has warned of femme fatales befriending potential victims on sites such as Facebook and Tagged.com.

The women enter steamy webcam conversations with their prey, where they strip and encourage their male victim to do the same.

What the man doesn't realise, as he feverishly rips his clothes off and agrees to engage in various sexual acts in front of the camera, is that his female love interest is secretly recording everything that's going on.

The male victim is then blackmailed for money by the woman who threatens to circulate the compromising photographs and videos.

Ouch! That must put a dampener on the evening.

Here is a video of a Singapore TV programme which reconstructed just this kind of crime. (Warning: The acting is a bit cringeworthy)

The Singapore Police Force says it has seen a five-fold increase in the number of reported cases of such web extortion - over 50 in 2012, compared to 11 the previous year.

Here is a summary of their tips to avoid you becoming the next man to be duped in such a fashion:

Always be wary of strangers befriending you on social networks. If they're suddenly showing a romantic interest in you, ask yourself honestly if it's likely that they've selected you for online love out of the billions of other internet users.Never put yourself into a compromising position on your webcam. In short, keep your clothes on.. as you can't be sure if the person at the other end isn't making a video recording. At the same time, you shouldn't give away too much personal information to someone you don't really know.If anyone does ever attempt to extort money from you online, don't pay them. Contact the police instead. You may be embarrassed about the mess you have got yourself into, but the authorities are the right ones to investigate and (hopefully) bring the culprit to justice.

The threat doesn't just lie with webcam blackmail either. You can imagine how a man, believing he is being seduced online by a sexy woman, might be all too eager to click on a link she suggests or run a malicious program on his computer. Before he knows it, his computer could be under the control of a hacker.

Be careful out there, and keep your trousers on chaps.

Follow @gcluley

Webcam and female silhouette image from Shutterstock.


View the original article here

Friday, April 19, 2013

More Mac malware attacking minority groups in China

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Microsoft WordOver the last year, SophosLabs, has talked about attacks against minority groups in China that use old vulnerabilities in Microsoft Office, that already have patches available for them.

We have seen several attacks in the past.

Earlier this week, the folks at AlienVault saw another attack using the same vulnerability in Office products on Mac OS X, targeting the Uyghur people of East Turkestan.

The vulnerability, known as MS09-027, was patched by Microsoft back in June 2009, and allowed remote code execution in Microsoft Word.

That means simply opening a boobytrapped Word document on an unpatched computer could run malicious code on your Mac. While you are distracted, reading the contents of a Word file, malware is being invisibly and silently installed onto your computer.

Contents of Word document

Although many Mac users might clutch onto the hope that their operating system will ask for an administrator's username and password before installing any software, you won't see any such message pop-up with an attack like this as it is a userland Trojan and you will not be prompted for administrator credentials.

This is because neither the /tmp/ nor /$HOME/Library/LaunchAgents folders on Mac OS X require root privileges. Software applications can run in userland with no difficulties, and even open up network sockets to transfer data.

Word DOC code

Sophos products detect the malicious documents as Troj/DocOSXDr-B and the dropped malware as the Mac Trojan horse OSX/Agent-AADL.

OSX/Agent-AADL obviously went through some development during this campaign because we saw three distinct versions. The first was the most interesting:

Word DOC Trojan code

In later versions of the Trojan, the function and variable names were stripped out and the shell script filenames were further hidden/obfuscated.

Once again, Mac users need to remember to not be complacent about the security of their computers. Although there is much less malware for Mac than there is for Windows, that is going to be no compensation if you happen to be targeted by an attack like this.

Mac users, just like Windows users, need to pay attention to the latest security patches and ensure that their software is kept properly up-to-date.

If you're not already doing so, run anti-virus software on your Macs. If you're a home user, there really is no excuse at all as we offer a free anti-virus for Mac consumers.

Follow @SophosLabs

View the original article here

Thursday, April 18, 2013

Point-of-Sale malware attacks – crooks expand their reach, no business too small

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Filed Under: Featured, Malware

Numaan Huq and Richard Wang of SophosLabs have been keeping track of the evolution of Point-of-Sale malware.

We've recently been tracking a set of incidents involving malware attacking Point-of-Sale (PoS) equipment.

Your personally identifiable information (PII) flows into PoS devices, across PoS networks, and is processed by PoS servers, every time you pay for things without using cash.

As a result, PoS equipment and the local-area networks to support it are found all over the world, in both developed and developing countries.

When was the last time you tried to pay for a hotel stay in cash, for example?

Even if you settled the bill with cash, you probably swiped or waved a payment card when you checked in, just to avoid having to lay down a large cash deposit.

As a result, PoS systems are a lucrative target for crooks.

So it's not surprising that we've written about this particular malware family, Troj/Trackr-Gen, and its thirst for credit card data before.

It seems the criminals behind it have added a few new tricks in the last 15 months.

The most interesting development is that some versions now include the ability to exfiltrate data directly rather than just dumping it to disk.

? The Payment Card Industry has a set of Data Security Standards, known unsurprisingly as PCI-DSS. The standards specify, amongst other things, that credit card data must in general be encrypted if it is stored, and that some data, such as CVV numbers, mustn't be stored at all once a transaction is complete. Ironically, the crooks have learned from this, and are avoiding reading from or writing to disk themselves.

Another change is found when examining some of the targets.

As before, the criminals are avoiding very large businesses but in addition to the commonly attacked hospitality industry and hotel targets there are smaller victims, including a single car dealership in Australia.

A couple of cosmetic changes have also been made.

There is a new generator for random filenames, creating completely random five-character names such as IXWIG.exe and KPAOE.exe.

For variants using hardcoded names the common use of rdasrv.exe has been extended to include filename options designed to hide in plain sight such as windowsfirewall.exe or msupdate.exe.

It seems that no victim is too small for Point-of-Sale malware.

The popularity of terms like "Advanced Persistent Threat" and "state-level malware actors" may make it sound as though only the biggest multinationals and parastatals are at risk these days.

But stealing $75 each from 1,000,000 people gives the same financial result as stealing $75 million from a megacorporation.

So you simply cannot assume that your business or organization is not a big enough target to worry about web attacks or targeted malware.

Remember this: there is no radar below which you can fly.

As a final thought, since we already know the how and the why of this latest round of PoS attacks, we invite you to consider the where.

There's an intriguing hint buried in the code:

We don't know if that's where the crooks are from, or if it's where they've been most successful in infiltrating PoS networks (Botswana, home to the astonishing inland Okavango Delta, has a strong hospitality industry), or perhaps just where they spent some of their ill-gotten gains on a vacation.

Do you run a small business that relies on PoS equipment?

If so, how much of a challenge are you finding it to stay ahead of crooks like this?

Have your say in the comments...

Follow @sophoslabs

Image of PoS machine courtesy of Shutterstock.


View the original article here

Tuesday, April 16, 2013

Facebook owns up - admits network breached, blames "Java in the browser"

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

There's a scene in the movie The Social Network where Mark Zuckerberg is arguing with Eduardo, his CFO.

Eduardo's just frozen Facebook's bank account.

The plan is to get Zuckerberg's attention and to try to get Zuck back on what Eduardo thinks is the straight and narrow.

But Zuckerberg is irate.

He thinks it might end up with an unpaid bill and thus a network outage, and that won't do!

Zuck rants:

Let me tell you the difference between Facebook and everybody else: WE DON'T CRASH EVER!

It's only a movie, of course.

In real life it's not true that Facebook never goes down, but when you consider its size and the online activity it supports, Facebook's uptime and availability is astonishing. Stellar. Intergalactic, even.

The movie version of Zuckerberg goes on to explain:

If the servers are down for even a day, our entire reputation is irreversibly destroyed. Users are fickle... Even a few people leaving would reverberate through the entire user base.

But what about getting owned by hackers?

What effect do you think that might have?

If you're the world's biggest social network, and if collecting, storing and using other people's personal information is your bread and butter?

Hold your horses, because we're about to find out.

Facebook just published an article entitled Protecting People On Facebook, and it doesn't cover what you might at first expect when you see the title.

Sure, it starts upbeat enough:

Facebook, like every significant internet service, is frequently targeted by those who want to disrupt or access our data and infrastructure. As such, we invest heavily in preventing, detecting, and responding to threats that target our infrastructure, and we never stop working to protect the people who use our service.

But that's followed by a hint of what's coming next:

The vast majority of the time, we are successful in preventing harm before it happens, and our security team works to quickly and effectively investigate and stop abuse.

And then the bombshell. OK, not really a bombshell. Let's be fair and say it's actually a pretty candid admission for which the company deserves at least a nod of respect:

Last month, Facebook Security discovered that our systems had been targeted in a sophisticated attack. This attack occurred when a handful of employees visited a mobile developer website that was compromised. The compromised website hosted an exploit which then allowed malware to be installed on these employee laptops.

Later on in the article, Facebook claims that it has "found no evidence that Facebook user data was compromised," and and for what it's worth, I'm willing to accept that claim.

? Update. In an interview with Ars Technica, Facebook CSO Joe Sullivan has admitted that the crooks made off with information from the laptops themselves. ("What you typically find on an engineer's laptop, including corporate data, e-mail, and some software code.") But despite being able to get "some limited visibility" into Facebook's production systems, Sullivan confirmed that a forensic review found no evidence that the crooks got away with any data off those systems. Close, in a word, but no cigar. (Added 2013-02-16T22:11Z)

The crooks had a Java zero-day at their disposal, and this exploit let them infiltrate Facebook's network and inject malware.

But the company says it was fully patched and anti-virused, and it sounds as though the malware that followed the exploit was quickly spotted and cleaned up, with no lasting harm done.

Just one suggestion to Facebook developers: why not read Naked Security?

We've given you loads of good reasons to turn off Java in your browser, starting from the middle of last year.

That alone could have side-stepped this problem.

Even just using a browser with click-to-play (so that Java and Flash applets, amongst others, can't launch quietly in the background from compromised websites) would surely have been enough.

I'm guessing now, but I'd be very surprised if the mobile developer website alluded to above actually required Java, so there would have been no reason to have Java turned on for that site.

Similarly, the mobile developer website could have considered using outbound web or packet filtering to block the egress of Java applets if, indeed, its site was never supposed to serve them up in the first place.

? IPS technology is usually thought of as a way to keep bad guys out, not least because it stands for intrusion prevention system. But most decent IPSes work bidirectionally, and can act as effective EPSes, or exfiltration preventers, too. You filter email for spam both ways (don't you?), because you can, and because it makes sense. The same applies with network traffic in general. If the bad guys have already got in, you may as well stop them getting back out as well!

Having said all that, it remains for me to ask. You have turned off Java in your browser, haven't you?

If not, here you are: How to turn off Java in your browser.

And fear not that you will break JavaScript: Java is not JavaScript.

Follow @duckblog


View the original article here

Monday, April 15, 2013

Can freezing an Android device crack its encryption keys?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Every few years, someone reads, or remembers, or rediscovers something we often forget: computer memory isn't volatile, after all.

RAM chips don't lose their contents immediately when you turn your computer off, and that can have interesting security ramifications.

Don't get too excited: RAM contents don't persist without power in a reliable and consistent way.

If you accidentally pull the plug out of the wall before you've saved that fantastic new presentation, don't expect to get it back.

But if you can cycle the power quickly enough, and reboot under your own control from some secondary device, such as a USB key, you might be able to see the ghostly remnants of what the previously-running operating system was up to.

You can guess where this is going.

If you clean boot a computer with a hard disk that's running full disk encryption, or FDE, you can't get anything off it.

Not just the data, but also the operating system, swap and hibernation files are scrambled. Nothing can be accessed without the decryption key.

But what if the decryption key, or a large enough chunk of it, is part of the RAM that didn't fade to grey when you cycled the power?

That can happen, thanks to the phenomenon of left-behind data in RAM.

(The name you'll hear is remanence, a word originally used for residual magnetic fields, and now also used to refer to the not-yet-decayed electrical charge in memory chips.)

And if you cut the power abruptly, you prevent the operating system from taking any emergency shutdown measures, such as deliberately purging critical areas of memory to wipe any active encryption keys.

The latest researchers to rediscover remanence in a newsworthy way are from FAU, the Friedrich-Alexander Universität Erlangen-Nürnberg.

They've turned their sights on Android, building a custom distro of Android Linux called FROST, short for Forensic Recovery Of Scrambled Telephones.

So far, they've only tried it on the Samsung Nexus phone from Google.

That's because they need three planets to align before the attack will even begin to work:

The bootloader needs to be unlocked.The device needs an easily-removable battery.Ideally, the device needs to be at or close to 0°C.

The reason for these limitations are the things that go wrong if they aren't in place.

If the RAM is at room temperature, its remanence is greatly reduced, so it "forgets" much more quickly.

If you can't get at the battery, you can't easily cycle the power abruptly.

If the bootloader is locked, the device will automatically get wiped if you try to unlock it.

The wipe-on-unlock feature is a clean and simple security process enforced by Google, at least on recent devices.

? Android devices support a stripped-down mode called FASTBOOT, which gets its name because it boots up your device in a second or two. A magic chord of keys pressed down at power-up is typically used when you want to engage FASTBOOT's services. It has very limited functionality, but the key features are that it allows you to unlock your firmware, and to reflash it. Locked firmware can't be flashed, for security reasons, and unlocking (assuming your device allows it) it will wipe the device so that your freedom to reflash doesn't come at the previous owner's expense.

The first thing you need to do, when you rediscover remanence and want to use it against a specific device, is to find out if your proposed attack is practicable.

That means loading up memory with something you'll easily find and recognise later, and seeing how well your chosen content survives a power outage.

When a posse of Princeton programmers famously brought remanence into the limelight back in 2008, they used images of Mona Lisa.

The FROST crew picked a more modern mascot, Google's Android robot:

The results weren't terribly convincing at room temperature, given that rebooting the phone quickly by jiggling the battery takes an unpredictable time.

Lowering the temperatures offered improved results, as the authors showed graphically:

(They neglected to label the axes, a peccadillo usually restricted to marketing departments, so we'll have to assume that the X-axis shows reboot time in seconds, and the Y-axis shows the percentage of bits lost. The obvious conclusion: take less than a second, and head towards freezing point.)

The authors eventually settled on popping the target phone in a freezer at -15°C for an hour. They laconically point out that they can't promise you that your phone will survive, noting that "damaging the phone is your own risk, but we haven't experienced any problems yet."

? A word of warning. If you live somewhere warm and humid, such as Singapore, Dar es Salaam or Brisbane, your phone will rapidly start to collect moisture when you remove it from the freezer. If you're fiddling with the battery and the buttons of your phone to try to orchestrate this attack, you won't be able to dry it off as you go along. As the FROSTers say, damaging the phone is your own risk.

To find the FDE decryption keys in memory (Android uses AES encryption), the authors used a modified version of a program called aeskeyfind, originally created for the 2008 paper referenced above.

This cleverly-written tool uses a variety of heuristics to churn through memory, looking for contiguous blocks of RAM that look like the output of the AES key schedule.

This is the algorithm that AES uses at the outset to convert a 128-bit key into 176 bytes of key material to use in the AES process itself, or a 256-bit key into 240 bytes.

And now the burning question. Did the FROSTERs succeed?

Sort-of. They've got some visual material that suggests they did, though whether the key information was actually enough to unscramble the encrypted data on the phone is not specified.

The paper is similarly ambiguous, saying somewhat noncommittally that the authors were "able to recover the disk encryption keys (given that no or only a few bits were decayed)."

That's a bit like saying that "we came out ahead financially every time we placed a winning bet." It doesn't tell us much about the practicability of the attack in real life.

Nevertheless, the FROST paper teaches, nay proves, an important lesson:

If you have an Android phone with an unlockable bootloader,
LOCK IT AGAIN WHEN YOU'RE DONE REFLASHING.

The authors are unequivocal about this.

When they needed to unlock the bootloader to try to attack an encrypted phone, they ended up with nothing to decrypt.

Oh, and if you pick up your phone to make a call and it seems unusually cold against your ear, look out!

You may have been FROSTed.

Follow @duckblog

Image of frozen lake courtesy of Shutterstock.


View the original article here

Sunday, April 14, 2013

Was Alicia Keys hacked, or is she cheating on BlackBerry with iPhone this Valentine’s Day?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Alicia Keys. Image from ShutterstockBlackBerry recently surprised the tech industry when they announced at their major launch event on January 30 the appointment of musician, Alicia Keys, as the Global Creative Director.

And since then Keys has been pimping BlackBerry’s new smartphone model, Z10, tweeting from it since launch. But is there a secret that Keys has been keeping? An extra-cellular affair with the iPhone?

At the BlackBerry launch, Keys told the audience about her on-again/off-again love affair with BlackBerry.

She said she had been lured away from BlackBerry by “hotter, sexier phones, something with more bling” in the past, but now declaring that she and Blackberry were “exclusively dating”.

So it was a bit of a surprise when a tweet from her account went out to her 11 million followers on February 11 – just days after the BlackBerry launch – sent not from her exclusive BlackBerry, but from her ex, the iPhone.

Started from the bottom now were here!

Later the same day, Keys sent out a tweet stating that the previous tweet quoting lyrics from recording artist, Drake, had not come from her, but likely a hacker. (But don’t be offended – she still likes Drake.)

What the h*ll?!!!! Looks like I’ve been hacked… I like @Drake but that wasn’t my tweet :-(

But that doesn't explain this tweet pic posted a day before from her account showing the musician looking radiant in her dressing room at the Grammys with not just one, but two, of her exes in reach – iPhones.

Alicia Keys at the Grammys

Now, we at Naked Security have seen our fair share of hacked Twitter accounts of celebrities such as Justin Bieber and Britney Spears – and this doesn’t quite smell the same.

Would a hacker that has gone through the trouble of hacking an account of such a well-known figure with access to *11 million followers* really only send one tweet with just a song lyric?

This story reminds us of a previous incident when Kim Kardashian claimed her Twitter account was hacked after having trouble logging in to Twitter from her home computer.

Could it be that Keys is using the many recent celebrity Twitter hacks as a scapegoat for her mishap?

Of course, there is also the possibility that Keys could have her PR people monitoring and tweeting on her behalf, and this error could have been a mistake on their part. We can’t know for certain.

But the one thing we do know is that whoever accessed her Twitter account is hanging out with her ex.

Awkward.

Follow @NakedSecurity

Alicia Keys headshot image courtesy of Featureflash / Shutterstock.com


View the original article here

Unlock an iPhone without the passcode - harmless trick or computer crime?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

A YouTube video showing you how to unlock an iPhone 5 without the passcode has racked up nearly 300,000 hits over the past two weeks.

There are some caveats, though:

You need physical access to the device.You need manual dexterity or a fair bit of practice.You only get access to some of the data.You have to make a phoney emergency call as part of the process.

I'm not going to repeat the instructions here.

I'll just say that they're reasonably arcane: you almost turn the phone off twice during the process, as well as actually placing an emergency call but cutting it off before it goes through.

For the last reason alone, I invite you never to pull this trick, even on your own phone "to see if it works".

Deliberately dialling the emergency services when you don't need to, or, indeed, when you know your intention is not to complete the call at all, is a pretty poor show.

I'm not sure what the regulations are in your country, but there's every possibility you could get in trouble with the authorities for that part of the trick alone.

In fact, it's not really a trick. It's a crime, even without the bogus emergency call.

Not, perhaps, a terribly serious crime. But mucking around with other people's computers is behaviour we ought to stamp out of our lives.

Interestingly, the last time we wrote about this sort thing was when an MP in the New South Wales parliament live-tweeted joke comments from a colleague's iPad while the latter was giving a speech.

I suggested a zero-tolerance policy, especially from members of a legislative assembly, who ought to be setting standards, not flouting them, but not everyone was so sure.

Commenters Josh and foo suggested otherwise:

? For the record, I would vigorously oppose any attempt to regulate whoopee cushions. Like Dr Sheldon Cooper of the Big Bang Theory, "I still maintain the whoopee cushion has comic validity."

The good news is that this unlock crime trick doesn't give full access to the phone, but apparently only to your contact list, voicemails and photos.

That's still a lot of important stuff, though.

Macworld reports that Apple told the magazine that it was "aware of this issue, and will deliver a fix in a future software update."

That beats Apple's usual tight-lipped (and still apparently official) policy.

For the protection of our customers, Apple does not disclose, discuss or confirm security issues
until a full investigation has occurred and any necessary patches or releases are available.

So, watch out for the update, watch out for your phone, and don't let this bug make you complacent about phone lock codes overall.

It's still worth having a decent password on your iPhone, to protect all the data this bug doesn't give a miscreant access to.

To help you choose wisely, here are the Top Ten iPhone passcodes not to use:

5683, by the way, spells out L-O-V-E.

In conclusion, let the arcane nature of this trick remind you that hackers, in both the good and bad sense of the word, aren't deterred by secrecy, obscurity or complexity.

Indeed, this trick is surely making you wonder, "How did they think of that?"

Bear that in mind if you are ever called upon to design, implement or enforce security software, policies or procedures.

Follow @duckblog

Image of mobile phone courtesy of Shutterstock.


View the original article here

Friday, April 12, 2013

Bit9 hacked, used to inject malware into customers' networks

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Security vendor Bit9 has been hit by a serious security breach of its own network.

Intruders broke into a core part of the company's service and used its own trusted digital certificates to create pre-authorised malware.

The result, apparently, was that a small number of customers got infected with malware that wasn't merely missed by Bit9's detection algorithms, but was actively endorsed by its protection system.

It's always tricky to write about compromises and problems with competitors' products, but please bear with me here. I'll try to be as balanced as I can.

As a colleague wryly and compactly pointed out the other day when Kaspersky hit the news by cutting customers off from the internet with a dodgy update, "John 8:7."

Bit9's case is a bit different because the company eschews traditional security and anti-malware techniques and instead favours whitelisting.

? I'm not a fan of that name because at least some people find it offensive, and because there is a much clearer, self-descriptive alternative: allowlisting. Likewise, blacklisting is much more directly rendered as blocklisting. Simply put, blocklisting aims to recognise known bad stuff and to stop it. Allowlisting aims to recognise known good stuff and to stop everything else.

For what it's worth, Bit9 has done the right and honourable thing, and 'fessed up on its website.

The company is still keeping the precise details close to its chest, as it's entitled to, but has offered a general overview that's pretty clear. Call me old-fashioned, but that counts for a lot.

I'm not entirely convinced by the entire explanation, however.

Bit9's observation that "this incident was not the result of an issue with our product," for instance, is a trifle misleading.

I think I know what they mean, and why they said it, but the truth is simple: Bit9's service made the wrong call.

It misrecognised malware as good software (a false negative, in industry jargon) and let an infection through.

Conceptually, this is no different (in industry jargon, it had a similar failure mode) to what happens when a traditional anti-virus fails to spot malware as malware.

The truth is that any programmatic means of analysing another program and predicting its behaviour must be imperfect.

Regular readers of Naked Security will have heard me pronouncing on this matter before. That's because I'm a big fan of Alan Turing, who studied this very issue back in the 1930s, before digital computers even existed.

It's known as the Entscheidungsproblem (usually rendered into English as the Halting Problem), and it pretty much says that any security software must, at least occasionally, make mistakes.

It's become fashionable recently to bash anti-virus software harder than ever, decrying it as reactive, behind-the-times and even as "digital homeopathy." (Even I had to smile at that tweet.)

Allowlisting is often trumpeted as the preferred, scientific, simpler, cleaner, greener approach.

There's a lot to be said for that, if you can reliably predict in advance the complete list of software files you will need on your computers, and if you don't make any mistakes in ensuring that everything on the list really is good.

Of course, the pace of change is swift enough these days that you need to keep updating the list of known good stuff, and that's where errors can creep in.

In practice, modern anti-virus software doesn't rely on (indeed, hasn't relied on for about two decades already) a purely reactive, list-of-known-badness approach.

Today's anti-malware solutions aren't merely blocklists, and if you buy one and engage only its pure-play blocklisting parts, you're missing a trick.

Several tricks, in fact.

Similarly, any decent product that claims to work by permitting only known-good stuff doesn't rely entirely on allowlisting.

If a file is already known to be bad, you'd be silly not to use that information to ban the file so it never gets onto your allowlist by mistake!

No security solution can be perfect, because no solution can decide all the answers.

That's why defence in depth is really important, and why you should run a mile from any security vendor who still makes claims like "never needs updating" or "all others are imposters."

To the Bit9 crew: when I read the part where you wrote that "the threat from malicious actors is very real, extremely sophisticated, and that all of us must be vigilant," I felt your pain, brothers and sisters.

We may have varying approaches and differing opinions, but we're on the same side here.

I hope you catch the villains behind this, or at least find out more about the who, what and why...

Follow @duckblog


View the original article here

Thursday, April 11, 2013

Anatomy of a vulnerability - cURL web download toolkit holed by authentication bug

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

You may not have heard of cURL, but you've probably used software that uses it.

It's an open-source programming toolkit that helps you deal with writing client-side code that deals with URLs.

In the words of the project itself, "cURL groks those URLs."

It's popular because it's a URL Swiss Army knife, making it easy to handle popular protocols like HTTP, SMTP, POP3 and many more. It also supports uploads, downloads, authentication, proxies, cookies and SSL/TLS.

It even supports Gopher, if you remember that far back.

One risk with an all-singing, all-dancing library, of course, is that there's more code to go wrong.

And sometimes, even obscure bits of code you thought you'd never use might get triggered. Worse still, they might be triggerable by external circumstances you never predicted.

That's the curly problem here.

The vulnerable code was introduced in the 7.26.0 release, when support for DIGEST_MD5 authentication was added to the cURL software.

DIGEST_MD5 is an rudimentary way of allowing you to login over an unencrypted connection, for example to an HTTP or POP3 server, without sending your actual password.

The server sends a random challenge string, or nonce, together with a bunch of other authentication-related data; you reply with a cryptographic hash of your password mixed up with that server-supplied data:

So a cracker who sniffs your reply can't directly recover your password from it, and since the challenge is random and varies every time you log in, the cracker can't re-use your reply later.

As an aside: avoid using DIGEST_MD5 authentication. Encrypt the entire session using TLS instead.

A cracker who sniffs a DIGEST_MD5 reply can't re-use it directly, but he can use it to try to recover your password offline using a dictionary attack.

TLS not only prevents this, but also keeps the entire transaction secret, including the contents of your web session or email. That's a much better security outcome.

Here's the buggy code from a vulnerable version of cURL:

Don't worry if you aren't familiar with C. I'll explain.

In C, the management and use of memory is left up to the programmer. You can use library code to help you deal safely with variable-length data, such as user-supplied text strings, or you can deal directly with memory yourself.

Above, the programmer has done the latter.

Firstly, he allocates a series of fixed-length memory blocks on the stack.

Then he copies text strings supplied by the caller of the function into those blocks, but be uses the system functions strcpy() and strcat(), which stand for "string copy" and "string concatentate" (tack one string on the end of another) respectively.

In modern code, you should never use those functions, because you can't limit how much data they copy.

They simply duplicate every byte from the input string into the output string, until a NUL (zero) byte has been found. A NUL is how the end of a text string is denoted in C.

So, if the server sends too much data in its authentication challenge, for example an overly-long realm string (the contents of which can be whatever the server chooses), this function will stuff too much data into the buffer it uses to compute the authentication response.

A buffer overflow will result, and in this case, since the destination data blocks were allocated automatically on the stack, the function will crash when it ends.

That's because the stack also stores the address in memory from which the function was called, so the cURL software can return there when it's finished. The return address is overwritten in the above code if the string response get over-filled.

The fix was a simple one.

The uncontrollable strcpy() and strcat() functions have been replaced with the function snprintf(), which stands for "formatted print of string into at most n bytes":

You can still make mistakes with snprintf, since it's up to you to specify n, and if you aren't careful, you may get it wrong.

But the point is that is is at least possible to restrict the output of snprintf to a known buffer size, which you simply can't do with the old-fashioned strcpy() and strcat().

? The updated cURL code above still isn't perfect. The programmer should really check the return value of snprintf(), which reports how many bytes it wanted to write. If your buffer wasn't big enough, then the output will be incomplete and therefore incorrect. You ought not to use it: increase the size of your buffer and try again, or report an error instead.

You're probably thinking, at this point, that exploiting this vulnerability would be hard because most programs that use cURL do so in the background. They aren't interactive.

Autoupdating software, which might use the cURL library (known as libcurl) typically comes pre-configured with a list of known-good URLs, or asks you to enter a URL at install time, and that's that.

An attacker who could talk you unto switching your known-good autoupdate URL for a dodgy one, or who could persuade you to change from the POP3 email server you've always used to one you've never heard of, would surely find it easier to infect you simply by getting you to run his malware directly.

That's true, but there's still a risk.

If an attacker can redirect the requests from your autoupdater or your POP3 client, for example by fiddling with your DNS settings, or by hacking a server at the edge of your service provider's network, he could send you off to an imposter site and attempt to exploit you from there.

? As @kyprizel points out in the comments below, cURL only actually calls the vulnerable function from its POP3 and SMTP protocol handlers, so an HTTP request cannot directly put you in harm's way. But cURL follows HTTP redirects, even unusual ones that send you off to a POP3 server, so a crook who can modify your HTTP replies may be able to attack you nevertheless.

Because of the buffer overflow, this could lead to a drive-by download, where cURL itself is tricked into misbehaving, cutting your informed consent out of the loop altogether.

The lessons?

Don't use strcpy() or strcat().Ever.Use snprintf (or strlcpy() and strlcat(), or similar) instead.Always check the return value of string-handling functions so you don't end up using incorrect results.

Your next problem is to find out which software you are using, if any, includes cURL code with these bugs. (Versions of cURL from 7.26.0 to 7.28.1 inclusive are affected.)

Best start asking around...

Follow @duckblog

NB. Although several Sophos products use libcurl, none of them use code from the vulnerable versions.


View the original article here