STE WILLIAMS

Security bod Stefan Kanthak is asking Mozilla to quit using Windows self-extracting installs.

Last week, Kanthak posted to Full Disclosure that Mozilla’s SETUP.EXE package has a long-standing bug that allows privilege escalation for local users.

“SETUP.EXE loads SHFOLDER.DLL [‘] from a temporary (sub)directory “%TEMP%7zShex.tmp” created during self-extraction of the full setup packages”, he writes – and that opens up the install to DLL substitution.

That’s most particularly an issue in the corporate environment, since it would get users past the privileges set by sysadmins.

The problem Kanthak describes is simple: self-extracting archives (not just from Mozilla) are subject to an ancient exploit in the DLL search order. The attacker can load a rogue DLL instead of what the installer expects.

The DLL in Mozilla’s install that offends Kanthak is SHFOLDER.DLL, which he describes as “cruft from the last millennium, it was used on Windows 9x without Internet Explorer 4”.

From there, privilege escalation – and therefore access to files and settings that are meant to be blocked from the user – is easy, he says.

Of course, the more savvy sysadmin knows not to let Windows machines detect and auto-run installers, and as an extra precaution, Kanthak reminds everyone to turn off code execution in all ”%TEMP%” directories and their subdirectories. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/03/dev_to_mozilla_please_dump_ancient_windows_install_processes/

While Website owners may have noticed the need to get rid of old, buggy or weak crypto, those operating e-mail servers seem to be operating on autopilot.

Not in a good way, either: the world of e-mail is headed for “controlled flight into terrain” if sysadmins don’t grab the controls and get to work, the researchers from Austria’s SBA Research and the St Pölten University of Applied Sciences say.

Here’s just one of the sobering terrifying conclusions in their paper, announced here and published at Arxiv (scan data available for analysis here):

“The recent increase in HTTPS certificate security (moving certificates from 1024 to 2048 bit) went totally unnoticed for all e-mail related ports, IPv4-wide”.

Still feeling relaxed? How about this: “millions of hosts are currently misconfigured to allow AUTH-PLAIN over unencrypted connections”.

Moreover, user’s can’t easily check server certificates in e-mail, making it easy for an attacker to present a fake cert, and deprecated TLS versions 1.1 and 1.2 were accepted by 650,000 SMTP servers.

To compile the data, the SBA Research team conducted 10 billion TLS handshakes over three months, testing 20 million IP/port combinations covering the SMTP, POP3 and IMAP mail protocols.

The first step in solving this, the paper says, is for players like Google, Microsoft and Yahoo to push the deprecation of insecure e-mail mechanisms. This would force sysadmins to follow, since if you can’t handshake with Gmail (for example), your users are bound to notice. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/03/web_server_secured_good_now_lets_talk_about_email/

Google has patched two critical remote code execution vulnerabilities as part of a suite of seven fixes in its fourth round of Android patching since August.

The over-the-air updates set to hit Nexus, Samsung, and Android Open Source Project (AOSP) devices first for Google’s latest Marshmallow Android operating system.

Google informed “partners” on 5 October and patch source code is set to hit the AOSP soon.

Two flaws rated critical include libutils (CVE-2015-6609) and mediaserver (CVE-2015-6608) holes which grant attackers remote code execution.

Attackers can exploit the holes by sending crafted media files to affected devices.

Google says it is unaware of attacks targeting the patched vulnerabilities.

“The most severe of these issues is a critical security vulnerability that could enable remote code execution on an affected device through multiple methods such as email, web browsing, and MMS when processing media files,” Google says in an advisory.

“During media file and data processing of a specially crafted file, vulnerabilities in mediaserver could allow an attacker to cause memory corruption and remote code execution as the mediaserver process.

“The affected functionality is provided as a core part of the operating system and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.”

A vulnerability (CVE-2015-6610) was also fixed in the libstagefright library which was separate to the StageFright vulnerabilities reported by Zimperium researcher Joshua Drake that made headlines earlier this year.

Privilege elevation bugs are also closed in Bluetooth (CVE-2015-6613), the telephone app (CVE-2015-6614), and libmedia (CVE-2015-6612).

Google says exploitation is made harder on the security-improved Marshmallow Android platform. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/03/google_roasts_critical_twin_android_bugs_in_new_marshmallow_os/

An unnamed team of hackers has apparently received a million-dollar payout for disclosing a trio of iOS 9.x and Google Chrome security bugs to private zero-day buyer Zerodium.

However, only people willing to pay Zerodium a subscription will get to see how the remote browser-based untethered jailbreak works: the company won’t disclose it in public, but may later tell Cupertino.

Untethered jailbreaks allow users – or attackers – to break Apple’s iOS security model gaining root access to devices that persists across reboots.

The remote browser-based jailbreak exploit vuln supposedly works on the new iPhone 6 and iPhone 5 lines, iPad Air 2 and Air, iPad 4 and 3, and the iPad mini 4 and iPad mini 2.

“No software other than iOS really deserves such a high bug bounty,” founder Chaouki Bekrar told Vulture South.

“Our bounty required much more work than a classic jailbreak as it had to be remote and browser-based, so this required two to three additional zero-days compared to a public jailbreak.

“The exploit chain includes a number of vulnerabilities affecting both Google Chrome browser and iOS, and bypassing almost all mitigations in place.”

Our iOS #0day bounty has expired we have one winning team who made a remote browser-based iOS 9.1/9.2b #jailbreak (untethered). Congrats!

— Zerodium (@Zerodium) November 2, 2015

The jailbreak was reported under a September challenge that sought an exploit which would work through SMS or either Apple’s Safari or Google’s Chrome.

Bekrar says two teams hacked away under a Zerodium iOS bounty, but only one gained the remote and “full browser-based” untethered jailbreak of iOS 9.1 and 9.2 beta.

The winners submitted the polished zero day-laden jailbreak a few hours before the competition closed.

The other crew reported a partial jailbreak and could gain a partial reward, Bekrar says. Zerodium is working to test and document the vulnerabilities.

“We will first report the vulnerabilities to our customers, and we may later report them to Apple,” Bekrar says.

The firm will now prime other hacking challenges in the “near future” which will sport an average six figure payout.

Such subscription vulnerability firms are controversial because their exploits are sold to among other customers, or governments who would feasibly use the bugs for surveillance.

Bekrar was previously head of vulnerability discovery and broker firm Vupen which similarly sold exploits to US-friendly corporations and governments under a subscription model.

Many researchers disclose private bugs to brokers and firms for cash. That practice stands in contrast to the community jailbreaking efforts in which exploits are publicly reported without financial reward.

Those efforts by groups such as Pangu Team focus on areas of iOS that are less-valuable to attackers. The group tells El Reg it avoids targeting Apple’s Safari since that could be valuable to attackers.

They acknowledge the team of seven could make money by disclosing the flaws to firms such as Zerodium but prefer public jailbreaks as offer greater device control to users and security researchers. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/03/ios_million_dollar_bug_bounty/

Analysis The UK government is apparently going to ask Apple, Google, and other American tech giants to give it the skeleton keys to their encryption systems.

Based on our experience here in the US, the response is going to be a firm: “Fsck off.”

On Monday, the Daily Telegraph (a reliable friend of the ruling Conservative government) published comments from a conveniently well-placed source stating that companies doing business in the UK must allow Blighty’s intelligence to crack the encryption in their software and hardware.

In other words, the encryption used to protect people’s messages and calls from eavesdroppers must be weakened to the point where it can be decrypted on demand. The UK government isn’t happy that chatter can be protected end to end – meaning that only the people communicating can read each other’s messages, not the software maker, not the network provider, and not the authorities.

Eight AM, day one, week one, the British government wants to be able to decipher any communications it can lay its hands on – it always has done.

The requirement for knackered encryption will appear in the forthcoming Investigatory Powers Bill, we’re told.

According to the Torygraph, on Wednesday the government will publish proposed legislation that will outlaw technology that can encrypt conversations between two individuals so strongly that the authorities cannot decrypt the chatter without the individuals’ help.

Politicians are trying to justify this with the usual invocation of the four horsemen of the infopocalyse – terrorists, drug dealers, pedophiles, and organized crime. This needs to be done to keep Brits safe, so the narrative goes.

We’ve been here before, many times

This isn’t the first time governments have tried this sort of move, and it won’t be the last. FBI boss James Comey tried calling it “front-door access” to make it seem more cheery and palatable. The fear, he said, was that private conversations could lead to public crimes.

While a wonderful soundbite from Comey, it’s just not mathematically possible to provide a truly secure encryption system that can be enabled and disabled by a secret Feds-only switch. The switch will be there for anyone to flip.

Speak to the best crypto developers (and we have) and you get the same story. You can’t introduce a backdoor into encryption without someone, anyone in theory, exploiting it.

Foreign governments, organized crime, or anyone else who fancies having a free run at the encrypted secrets of a populace, will find a way to slip in.

By fighting criminals, our rulers are making us less secure to criminals.

Politicians will tell you that such special police-only backdoors must be possible, if only the technology geeks were properly motivated. Any half-decent mathematician responds by pointing out that mathematics – the purest of sciences – do not work like that.

In the past few weeks the US government has come to terms with this. The Feds are still making noises about requiring skeleton decryption keys, but the White House has decided to kick the issue into the long grass and wait for the next administration to deal with it. President Obama, nearing the end of his final term, has given up pushing for a law demanding breakable encryption.

Shades of empire

It seems that decision was not enough of a hint for America’s former masters. Instead David Cameron’s government has decided to go it alone and use the, er, massive influence of the Commonwealth of Nations to force the technology industry to bend to its will.

The response from Silicon Valley is going to be: “No. Please stop talking about this. Don’t make it look as though we hand over people’s private conversations at the drop of a hat.”

If the US government can’t force the big technology firms to play ball, then the UK government has no chance. The British Establishment can sound off all it likes about the need for encryption backdoors, but the days of the empire are over. The Prime Minister is going to have to accept the fact that he’s a small porker in a very big swine market.

But wait, there’s more

It’s interesting to see Number 10 getting its knickers in a twist over end-to-end encryption of communications – interesting in that one must wonder if Cameron’s advisors are aware of the actual state of end-to-end encryption provided by Apple, Google, Microsoft etc.

According to the EFF, Google Hangouts does not provide any end-to-end crypto at all, thus it can be wiretapped by investigators. The same goes for Microsoft Skype and Yahoo! Messenger.

Only out of the big tech companies are Facebook-owned WhatsApp and Apple’s communications – Messages and Facetime – end-to-end encrypted. However, WhatsApp is closed source, so there’s no easy way to verify its security, and there’s a flaw in Apple’s otherwise perfect design: Apple controls the key exchange between the two people talking to each other.

The iGiant insists it cannot read your messages and decrypt your calls. However, an FBI agent who manages – by court order or some other means – to get her key switched for your contact’s key will be able to successfully snoop on your communications. The technical capability is there no matter how much Apple tells you it cherishes your privacy.

This law, if passed and obeyed by tech companies, will stop dead any mass rollout of end-to-end cryptography. And if tech companies choose to ignore the rules, not all of their systems are fully secure anyway.

Your remaining solution, privacy-conscious readers, is to trust the likes of WhatsApp and Silent Circle, or pick software from Open Whisper Systems. These truly end-to-end encrypted systems will be the real target of this legislation. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/03/uk_government_policeproof_encryption/

Kiwi hacker Denis Andzakovic has developed an application that steals password vaults from the popular local storage vault KeyPass.

The jeu de mots KeyFarce works when a user has logged into their vault, and will dump the contents to a file that attackers can steal.

It is no death knell for KeyPass or other password managers, but is an extra bow in the quiver of attackers capable of compromising a target’s machine.

The Auckland-based researcher for Security-Assessment published Keefarce to Github and the Full Disclosure mailing list, first noticed by Ars Technica

He told Vulture South it is most useful to penetration testers who need better access to a corporate network.

“One of the main uses of the tool is for penetration testers,” Andzakovic says.

“If you imagine a pen tester compromised a domain and wants to compromise say non-domain infrastructure, and he knows the sys admin runs keep, if he pops the box he can loot Keypass passwords.”

KeeFarce works by leveraging DLL injection to export including usernames and passwords from unlocked KeePass databases into a cleartext CSV file.

Andzakovic says Keepass and other password vaults are not at fault; rather it indicates the risk to broader security of user data in the event of a compromise.

“If you’re owned, you’re boned.”

Keypass says as much in its security statements in which it says the program protects against generic keyloggers and the like.

In 2012 Andzakovic outfitted his Yamaha TRX 850 with cheap open-source WiFi-hacking kit making it mobile war-bike complete with a heads up display. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/03/keypass_looter_the_password_plunderer_to_hose_pwned_sys_admins/

Analysis How do you protect people’s privacy when you have big databases of personal records you want to share?

That’s the question that the US National Institute of Standards and Technology (NIST) has dug into in an extensive review [PDF] of the different methods that government departments and other organizations use when publishing data.

The paper, now finalized after a period of public comment and review, is chock-full of acronyms and jargon, but does its best to wade through them to provide an understandable document.

There are two main lessons that comes out of it: first, striking the balance between providing privacy and useful data is not easy and will require using a number of different approaches; and second, there is a lot more work that needs to be done.

There is a third point too: it’s harder to protect the privacy of celebrities.

On the second point, the paper attempts to make sense of the most common terms used in the ever-expanding privacy industry.

There are, for example, three words commonly used to describe the method of removing or altering information to shield people’s privacy. The paper broadly argues that they are all effectively interchangeable. De-identification and pseudonymization may purport to be different, but in reality there is no dividing line; likewise anonymization, which often fails to do what it says and actually anonymize people.

Likewise, the paper throws out the buzz-term “personally identifiable information” in preference to the simpler “personal information” because the former is largely meaningless.

Methods

But to the guts of it: what do people do and what are the best methods?

There is a surprisingly large array of different ways to protect privacy in data. They can be largely grouped into two areas: the data itself, and the way it is provided.

When it comes to the data itself, possibly the most common approach is to simply pull out the data fields that contain personal information – everything from social security numbers to IP addresses. But that can often remove data that is very useful to have – geographic identifiers for example. And information is never personal or not personal. As the paper points out, information is on more of a spectrum from unrelated (like weather) to highly personal (like your name). There is no clear cut-off.

Sometimes companies will replace the more personal data fields with values that are created through a different method in order to further separate the data. But the problem then comes when people are able to combine different databases to “re-identify” people. And efforts to encrypt data have also failed.

Several high-profile examples are given in the paper. One was the sending of Massachusetts governor William Weld’s own medical records to him through the post after the hospital data he had championed as being protected was used to identify him.

In that case, it was possible to find Weld’s records in the database by finding other identifying information about him: his zip code, date of birth, and sex.

Another famous example was when the encrypted taxi numbers published by New York City were cracked and then by reviewing photos of celebrities getting into or out of cabs, researchers and journalists were able to pinpoints people’s movements around the Big Apple.

Then there was when AOL anonymized people’s data but left in their search terms, making it easier in some cases to identify people (for example, searching on your home address) – and then learn a whole lot more about them.

Bradley Cooper’s cab journeys were tracked through the release of New York taxi data. Credit: Gawker

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/02/protecting_peoples_privacy/

Two chaps claim to have discovered how to trivially circumvent Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) using Redmond’s own compatibility tools.

A report [PDF] by the duo at Duo Security describes how the Windows on Windows (WoW64) environment can be abused to bypass builtin security tools.

WoW64 allows 32-bit applications to run on 64-bit Windows installations. At its core, it works by trapping system calls made by code running in 32-bit mode, and jumping to 64-bit long mode before letting Windows handle the call. By taking advantage of the mode changes, we’re told, it is possible to smuggle malicious code past EMET’s barriers, which ordinarily do a good job of blocking vulnerability exploits.

Of course, to pull this off, one must find and exploit a security hole in a piece of 32-bit software that’s running on a 64-bit system using WoW64.

Duo’s Darren Kemp and Mikhail Davidov reckon a ton of 32-bit web browsers run in WoW64 mode on Windows PCs, though.

“Based on a sample of one week’s worth of browser authentication data for unique Windows systems, we found that 80 per cent of browsers were 32-bit processes executing on a 64-bit host system (running under WoW64), 16 per cent were 32-bit processes executing on 32-bit hosts, while the remaining 4 per cent were true 64-bit processes,” their report reads.

“As you can see, based on this data, WoW64 is the most popular execution environment for Windows browsers,” Kemp added in a blog post on Monday.

“While much of public vulnerability research focuses on pure 32-bit app exploitation, the fact is, a significant portion of 32-bit software is now running on 64-bit operating systems.”

According to Kemp and Davidov, far calls using either x86 segment 0x23 or 0x33 can be used to begin skirting EMET’s defenses, ultimately leading to the infiltration of a target system. The pair say they were able to “modify an existing use-after-free Adobe Flash exploit” to bypass EMET and execute arbitrary malicious code.

Kemp said a definitive fix for the WoW64 flaw could be some time off, as patching the condition would be difficult.

“It appears that due to these limitations, enhancing EMET to overcome them is likely a non-trivial effort,” the pair noted in their report.

The researchers suggested that companies could mitigate some of the risk by encouraging the use of native 64-bit applications that, in addition to being protected from the WoW64 attack, also have additional security guards in place on Windows.

They also suggested that, even with its limitations, EMET remains a valuable security tool for Windows and should still be used.

“This paper is not meant to undermine the importance of having EMET deployed within an organization, but to highlight shortcomings within the current implementation,” Kemp said. “We are providing this information in the interest of helping defenders deploy EMET with the most effective strategies in mind.” ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/03/32bit_software_to_beat_emet/

Security bod Stefan Kanthak is asking Mozilla to quit using Windows self-extracting installs.

Last week, Kanthak posted to Full Disclosure that Mozilla’s SETUP.EXE package has a long-standing bug that allows privilege escalation for local users.

“SETUP.EXE loads SHFOLDER.DLL [‘] from a temporary (sub)directory “%TEMP%7zShex.tmp” created during self-extraction of the full setup packages”, he writes – and that opens up the install to DLL substitution.

That’s most particularly an issue in the corporate environment, since it would get users past the privileges set by sysadmins.

The problem Kanthak describes is simple: self-extracting archives (not just from Mozilla) are subject to an ancient exploit in the DLL search order. The attacker can load a rogue DLL instead of what the installer expects.

The DLL in Mozilla’s install that offends Kanthak is SHFOLDER.DLL, which he describes as “cruft from the last millennium, it was used on Windows 9x without Internet Explorer 4”.

From there, privilege escalation – and therefore access to files and settings that are meant to be blocked from the user – is easy, he says.

Of course, the more savvy sysadmin knows not to let Windows machines detect and auto-run installers, and as an extra precaution, Kanthak reminds everyone to turn off code execution in all ”%TEMP%” directories and their subdirectories. ®

Sponsored:
Go beyond APM with real-time IT operations analytics

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/03/dev_to_mozilla_please_dump_ancient_windows_install_processes/

An extremely serious vulnerability lay undiscovered at the heart of much of The Cloud for seven years.

The vulnerability (CVE-2015-7835), which affects the Xen hypervisor software used by Cloud hosting companies like Amazon Web Services, is so serious that it was widely patched under embargo before being disclosed on 29 October 2015.

It was discovered by 栾尚聪 (好风) of Alibaba and affects Xen software from version 3.4 onwards running on the x86 architecture.

If you’re running Xen and haven’t already patched your systems, do so now.

Xen hypervisor software allows a ‘host’ server to be sub-divided into a number of smaller, easily managed virtual ‘guest’ servers.

Although they share hardware and some software, the guests behave as entirely independent servers that are isolated from each other and their host.

Virtualisation has become incredibly popular in IT departments and data centres around the world and it’s a key underpinning technology for Cloud infrastructure and services.

The vulnerability within Xen allows an attacker who’s running a virtualised guest server to reliably access the host machine’s memory and take over the entire host system, something you might be forgiven for missing if you couldn’t stay awake all the way through the rather dry description in the advisory:

The code to validate level 2 page table entries is bypassed when certain conditions are satisfied. This means that a PV guest can create writeable mappings using super page mappings.

Such writeable mappings can violate Xen intended invariants for pages which Xen is supposed to keep read-only.

This is possible even if the “allowsuperpage” command line option is not used.

Malicious PV guest administrators can escalate privilege so as to control the whole system.

This most recent bug is at least the third such escape bug found in Xen this year, following the announcement of the VENOM vulnerability in May and a similar flaw disclosed in July that, for reasons unknown, wasn’t saddled with a super-villain moniker.

So how did something so serious go undiscovered for so long in something so critical?

One perspective is provided by the security team at QubesOS (a security-focused operating system that relies on Xen) in their 29 October 2015 security bulletin.

… this is subtle bug, because there is no buggy code that could be spotted immediately. The bug emerges only if one looks at a bigger picture of logic flows …

In other words it wasn’t obvious, but that doesn’t mean they’re letting Xen off the hook though:

On the other hand, it is really shocking that such a bug has been lurking in the core of the hypervisor for so many years …

Specifically, it worries us that, in the last 7 years (i.e. all the time when the bug was sitting there having a good time) so much engineering and development effort has been put into adding all sorts of new features and whatnots, yet no serious effort to improve Xen security effectively.

Ian Jackson, a long-time open source veteran and a member of the Xen Project Security Team provides a response on the Xen Project blog.

He explains why he thinks some people have the impression that Xen is buggier than other similar products:

Unlike almost all corporations, and even most Free Software projects, the Xen Project properly discloses, via an advisory, every vulnerability discovered in supported configurations.

… For researchers developing new analysis techniques, Xen is a prime target. A significant proportion of the reports to security@xenproject are the result of applying new scanning techniques to our codebase. So our existing code is being audited, with a focus on the areas and techniques likely to discover the most troublesome bugs.

More interesting than that though is his honest appraisal of the state of computer security and what he sees as our collective attitude to it:

The general state of computer security in almost all systems is very poor. The reason for this is quite simple: we all put up with it. We, collectively, choose convenience and functionality: both when we decide which software to run for ourselves, and when we decide what contributions to make to the projects we care about. For almost all software there is much stronger pressure (from all sides) to add features, than to improve security.

Ultimately, of course, a Free Software project like Xen is what the whole community makes it. In the project as a whole we get a lot more submissions of new functionality than we get submissions aimed at improving the security.

In other words, if we want better computer security then it necessarily comes at the expense of something else (typically, something shiny.)

Sentiments that apply as much to the entire Internet of Things and websites that still harbour SQL injection vulnerabilities in 2015 as they do to Xen.

Follow @NakedSecurity
Follow @markstockley

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/MASQTL4GA-o/