STE WILLIAMS

A Russian businessman accused Kaspersky Lab security expert Ruslan Stoyanov, and Russian security officers, of leaking confidential data to US firms in 2010.

The treason charges against the former head of computer incidents investigation at Kaspersky Lab may be tied to a 2010 complaint by businessman Pavel Vrublevsky, who suspected a confidential information leak to US firms, says Softpedia, quoting Reuters. Kaspersky expert Ruslan Stoyanov was arrested in Russia in December, along with two officers of Russia’s Federal Security Service.

Vrublevsky and other sources claim the arrests were in response to the suspects’ involvement in passing secrets to American firms including Verisign. These allegations contributed to US intelligence agencies collecting information on Russia. Vrublevsky, founder of online payment firm ChronoPay, had lodged an official complaint for this seven years ago. The December arrests are seen as connected to this complaint.

Kaspersky Lab has denied any involvement in the case, clarifying that Stoyanov joined the company two years after Vrublevsky’s 2010 complaint.

Read more on Softpedia.           

           

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/threat-intelligence/kaspersky-lab-experts-treason-charge-linked-to-2010-complaint/d/d-id/1328281?_mc=RSS_DR_EDT

Microsoft launches a Mexican cybersecurity center and signs a Government Security Program to promote IT security research.

Tech giant Microsoft has launched a Cybersecurity Engagement Center in Mexico. The organization will work with its Redmond Cybercrime Center to provide support to Mexico, and other Latin American governments, in fighting regional cybercrime. Microsoft has also signed a Government Security Program with Mexico’s Federal Police to promote IT security research and cyber incident prevention.

“At Microsoft, we are committed to invest in the region so we can bring our cybersecurity capabilities to customers by identifying current threats that affect the economy’s prosperity,” explains Jorge Silva of Microsoft Mexico.

The center will work towards dismantling cybercriminal groups that operate through botnet schemes, and train authorities and the public sector in matters of creating and adopting strong cybersecurity measures.

“The objective is to help companies and governments with security solutions, which help them in their digital transformation through the international support of the intelligence, data analysis, avant-garde forensics and legal strategies that we offer,” says Jean-Philippe Courtois of Microsoft Global Sales.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/microsoft-opens-cybersecurity-center-in-mexico/d/d-id/1328280?_mc=RSS_DR_EDT

Recent attacks have focused attention on how to safely add “things”to enterprise networks, a topic that straddles IT and physical security. A zones-of-trust approach may be the answer.

Last year, when attackers hacked into more than 25,000 Internet of Things (IoT) closed-circuit TV devices and used them in a denial-of-service botnet attack, this question was asked in boardrooms everywhere: What would happen if hackers stole my organization’s surveillance video? This and other attacks on vulnerable IoT devices have put the focus on how we can safely add these devices to enterprise networks, a topic that involves both IT and physical security.

What’s the Worst That Can Happen?
Before considering an IoT surveillance video implementation, answer these questions: Why are you recording the video in the first place? What will happen if it gets stolen? 

We can put recorded video data into a few different buckets:

• Bucket 1: People can die if you don’t have your video, or other very bad things can happen.
• Bucket 2: Nothing life threatening, but not good. You might lose money. A business process may get disrupted.
• Bucket 3: Not a big deal.

The potential life-threatening outcome of the first bucket may seem extreme, but imagine a nefarious individual or group that manipulates and studies stolen video to understand the daily patterns of a company’s VIPs. This personnel monitoring could be to kidnap for ransom, or to find the right time or location to plant a virus or Trojan on a target’s computer or mobile device.

Also consider what happens if video is hijacked, or the wrong people can see the live streams from your IoT cameras. What if your video is compromised and unusable? How will that affect your organization? These are the foundational questions you must ask to determine how much cyber protection you should apply to the physical security of your networked components. But how do you prioritize securing these resources?

Zones of Trust
Looking at the most current cybersecurity trends for traditional enterprise architecture as well as IoT deployments, the architectural focus is moving toward “zones of trust.” This approach entails mapping, or prioritizing planning and resources in a ring of zones based on the critical nature of the networked resources. The most critical zone is one in which people and resources would be damaged or injured if there is a breach (cyber or physical). 

In the most critical zone (death or injury), cyber threats can target operational technology such as traffic lights or environmental systems. Cybersecurity must be at its strongest, and physical security such as video or access control and environmental sensors must be able to detect anomalous behavior to detect hacks as well as non-malicious failures.

The next zone could be one where a breach could cause serious financial hardship or a significant disruption in business operations. The next zones follow in terms of inconvenience, down toward the inconsequential. This helps to frame risk with assets. In this planning concept, there are significant overlaps between both physical security and cybersecurity.

On the cybersecurity side, much compromise is being tilted in favor of “ease of use” for networked resources over cybersecurity measures that may be inconvenient for users. We also see a similar trend with physical security, including video surveillance and access control. Organizations are reluctant to appear overly intrusive in day-to-day life at work, in retail settings, and even in the public sector, such as government facilities.

If you apply zones of trust to physical security, you first must look at the value of the various assets you’re trying to protect. This could mean senior executives or people with access to critical systems via their cyber credentials. 

You also need to monitor people and systems from an audio, visual, and access control perspective. You’re not looking for bad actors within your organizations, but people with the ability to unwittingly inject malware into your systems.

Next, look at personnel, and which zones they fit in in terms of their monetary and intellectual property value. What physical security resources and prioritization do you give to people, your most critical assets? What is the threat of physical harm? How do you protect against this in the environments you control?

Organizations can protect against edge device (for example, video) threats in a number of ways, including changing credentials from defaults; creating tiered access (such as view-only rights for monitoring access); and using credential-based access for servers and storage. In this manner, organizations can protect the device from becoming an attack point.

The Need to Prioritize Video Data
It’s important for IT organizations to understand that video is valuable data. As more video server and storage resources have moved to the network edge, cameras are targeted by attackers who seek to infect a corporate network with a virus or Trojan. Video can provide detailed information about personnel, locations, and procedures that surround high-level assets. Video feeds can be disabled or manipulated, leaving security teams effectively blinded or confused, putting an organization at risk of physical threats.

It can also be used to monitor and capture online passwords and monitor behaviors to be mimicked (e.g., computer repair services) to get closer to targets. This can be used to gain entry in the guise of a known person.

Given how valuable video data is, IT organizations should make it a priority to look closely at how video data is transmitted and stored on their network. This includes looking at who has what access rights, how policies are being enforced, whether the system is deployed and maintained properly, and whether there are clear roles of ownership.

A cybersecurity threat analysis focused on your video data will help determine if your organization’s video systems need to be more secure.

It will take careful planning and prioritization of resources to keep assets secure. By using zones of trust, your organization can ensure that the most critical assets have the highest levels of protection.

Related Content:

• Balancing The Risk Promise Of The Internet Of Things
• Internet Of Things ‘Pollutants’ The Case For A Cyber EPA
• How To Build A Strong Security Awareness Program

Vince Ricco serves as a business development manager for the Axis Technology Partner Program, Axis Communications, Inc. Mr. Ricco works with IT hardware providers to showcase the company’s network video surveillance solutions and educate the IT industry on the ongoing … View Full Bio

Article source: http://www.darkreading.com/iot/zones-of-trust-a-new-way-of-thinking-about-iot-security/a/d-id/1328261?_mc=RSS_DR_EDT

Two million voice recordings of kids and their families were exposed online and repeatedly held to ransom – because an IoT stuffed-toy maker used an insecure MongoDB installation.

Essentially, the $40 cuddly CloudPets feature builtin microphones and speakers, and connect to the internet via an iOS or Android app on a nearby smartphone or tablet. Families can use the fake animals to exchange voice messages between their children, friends, and relatives.

For example, a parent away on a work trip can open the CloudPets app on their smartphone, record an audio message, and beam it to their kid’s toy via a tablet within Bluetooth range of the gizmo at home; the recording plays when the tyke press a button on the animal’s paw.

Similarly, the youngsters can record messages using the stuffed creature, and send the audio over to their mom, dad, grandparent, and so on, via the internet-connected app.

Cute … How CloudPets passes messages from app to toy

These voice clips, along with records of 820,000 CloudPets.com accounts associated with the each of the toys, have been left wide open on the internet, with no password protection – allowing gigabytes of sensitive material to potentially fall into the hands of criminals. And it’s all due to a poorly secured NoSQL database holding 10GB of internal information.

CloudPets’ internet-facing MongoDB installation, on port 2701 at 45.79.147.159, required no authentication to access, and was repeatedly extorted by miscreants, evidence shows. The database contains links to .WAV files of voice messages hosted in the Amazon cloud, again accessible with no authentication, potentially allowing the mass slurping of more than two million highly personal conversations between families and their little ones.

It appears crooks found the database, presumably by scanning the public ‘net for insecure MongoDB installations, took a copy of all the data, deleted that data on the server, and left a note demanding payment for the safe return of a copy of the database. This happened three times, we’re told.

Of course, anyone else wandering by the database could have swiped the records for themselves and kept quiet, so the information potentially could be in the hands of just about any miscreant. The IP address of the database is also the address of the backend web server used by the Android and iOS app accompanying the toy. That app was developed by Romanian biz mReady. The IP belongs to server host Linode, which is presumably providing the machine.

Computer security breach expert Troy Hunt, who maintains the HaveIBeenPwned website, was tipped off about the insecurity of CloudPets, a brand of Spiral Toys, and went public today with details of the cockup.

“This is kids’ voices recorded on teddy bears,” Hunt told The Register after spending a week investigating the security blunder. “I can picture my four-year-old girl, sitting in her room – it’s hard to picture a more innocent scenario – and all these actors have access to what she says to her teddy bear.”

As proof that CloudPets’ security was hopeless, Hunt’s informant provided him more than 580,000 records from the CloudPets database, along with screenshots of three attempts to alert the toy manufacturer to the gaping hole. Each warning, we’re told, fell on deaf ears.

As Hunt dug deeper, things got more bizarre: yes, the account passwords in the database were hashed with bcrypt, but the website had no password rules, and its tutorial used only a three-character password – meaning many of the passwords were just a few characters and crackable anyway. The account records included email addresses, hashed login passwords, user IDs, and login times and dates.

Niall Merrigan, a Capgemini solution architect who investigates breaches on his own time, tracks MongoDB installations that have been held hostage on the open internet. He helped Hunt confirm the CloudPets’ database was hit multiple times by extortionists.

Using internet device search engine Shodan.io to look at historic snapshots of exposed online systems, Merrigan found that in January, CloudPets’ database was again and again deleted and replaced with DBs called “PLEASE_READ”, “README_MISSING_DATABASES”, and “PWNED_SECURE_YOUR_STUFF_SILLY” – a sign the data was being held to ransom for one Bitcoin at a time.

Hunt concluded: “The CloudPets data was accessed many times by unauthorised parties before being deleted and then on multiple occasions, held for ransom.” He’s added the 800,000-plus email addresses in the vulnerable database to HaveIBeenPwned.com, so as to alert owners of CloudPets toys. He also warns against buying web-connected toys because it’s too easy for a single design error to expose your children to snooping.

His advice to MongoDB sysadmins is simple: don’t accept the default configuration that allows anonymous unauthenticated access, and instead secure your installation.

“I can see both sides of this,” Hunt told The Register. “People are screwing up, but to be honest, I haven’t seen this with SQL Server, because you can’t stand it up with anonymous open access. You need a baseline that forces you have an account and forces you to have a password.”

A spokesperson for CloudPets and Spiral Toys, based in California, was not available for immediate comment. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/28/cloudpets_database_leak/

The technology industry has hit back at proposed plans by France and Germany to force EU member states to backdoor encryption for the police.

Last week, Thomas de Maizière and Bruno Le Roux, respectively the German and French ministers of the interior, sent a letter to the European Commission calling for measures to stem what they see as a tide of terrorism sweeping the land.

These proposed measures include allowing the greater sharing of people’s personal information between nations’ police forces to fight crime; more reliance on biometrics; and – depressingly predictable these days – demands for technology companies to come up with impossible encryption systems that are secure, strong, and yet easily crackable by law enforcement on demand. The German-French letter [PDF] calls for new legislation, to implement these changes, to be considered in October, after both countries have had their national elections.

This isn’t the first time the pair have called for such measures, but this time they received support from the European Commission. “Encryption technology should not prevent law enforcement agencies or other competent authorities from intervening in the lawful exercise of their functions,” an EC spokesman said in response to the letter, according to Politico.

The remarks brought a swift bite back from the Computer Communications Industry Association, the non-profit think tank that lobbies for the technology industry. Christian Borggreen, its director of international policy in Brussels, slammed the idea as counterproductive late last week.

“Any backdoors to encrypted data would pose serious risks to the overall security and confidentiality of Europeans’ communications, which seems inconsistent with existing legal protections for personal data,” he said.

“Weakened security ultimately leaves online systems more vulnerable to all types of attacks, from terrorists to hackers. This should be a time to increase security – not weaken it.”

It looks as though the encryption wars have moved to Europe. For years now in the US, the FBI and others have been banging on about the need for crimefighters to have secret backdoors into encryption, or even a front door, as the director of the Feds likes to call it.

There may be British readers who are feeling rather smug about this latest European proposal, and think that Brexit UK will be immune from such silliness. Not so – Blighty already has legislation that paves the way for mandatory backdoored encryption, it just hasn’t worked out how to force the issue yet.

As has been pointed out many times, it isn’t mathematically or technologically possible to build a backdoor into encryption that is completely exclusive to a select set of people, and can’t be found and exploited by others. The only way under today’s technology would be to have a key escrow system, and that would fall down if someone with access to the keys were to be bribed or coerced into handing them over. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/28/german_french_ministers_breaking_encryption/

The Prisons and Courts Bill, introduced to Parliament last week, will force UK mobile networks to deploy fake mobile phone masts around the outside of prisons to snoop on mobile phone users.

Provisions in the new bill will allow the Justice Secretary to order networks to deploy so-called “IMSI catchers” to prevent, detect or investigate the use of mobile phones in prisons.

Currently fake base stations can only be deployed under the legal provisions in the Prisons (Interference with Wireless Telegraphy) Act 2012, which restrict their deployment to within prison walls – and further, only allows prison governors to deploy them.

The new proposals therefore expand the ability of the state to spy on innocent citizens by further co-opting mobile phone companies’ technical abilities.

Clause 21 of the new bill, along with its schedule 4, will amend the P(IWT) Act to allow the Justice Secretary to authorise “interference with wireless telegraphy”.

The Register asked Ofcom, the designated regulator of these things, for comment. It referred us to information about the test deployment of an IMSI catcher at HMP Shotts, Scotland, in 2014. There the device was deployed to detect illegal use of mobile phones by prisoners illicitly communicating with the outside world. Although the IMSI catcher itself was legal, the Scottish Prison Service was very reluctant to talk about its use.

The Interception of Communications Commissioner’s Office (IOCCO) told The Register last year that it was waiting for a request from the Prime Minister to step in and regulate the use of IMSI catchers instead of Ofcom, this has not happened. Instead IOCCO is effectively being wound up, with some of its functions due to be transferred to a combined Investigatory Powers Commission.

In effect, use of IMSI catchers is effectively unregulated, albeit legal for the state and bodies authorised by the state under the Data Retention and Investigatory Powers Act 2014. It remains illegal for ordinary citizens to use them.

British police forces already own and operate IMSI catchers, though they refuse to talk about them for fear of a public backlash and the inevitable clipping of their wings. Despite this, The Register has previously reported on the purchases of such devices under the accounting euphemism “CCDC”, which stands for “covert communications data capture”.

Back in 2011 one-time Reg correspondent Bill Ray explained how IMSI catchers work:

2G networks only authenticate in one direction – the SIM proves its identity to the network – so creating a fake base station is relatively easy. The GSM standard also allows the base station to ask for an unencrypted connection, essential in countries where strong encryption isn’t allowed, so a man-in-the-middle attack is very feasible. Handsets are supposed to provide an on-screen notification when encryption has been disabled, but conformance to that detail is very rare indeed.

But that’s to listen in to calls. Tracking people is a good deal easier. Phones broadcast an identifying number (the TIMSI) which can’t immediately be linked to an individual but can be used to track movements in an entirely passive way. The lack of identity actually makes the process (legally) easier, as under the current legislation (in 2011) the privacy implications disappear when there’s no identity. Private companies such as Path Intelligence do exactly the same thing for shopping malls and suchlike, tracking footfall without knowing (or caring) whose feet are falling.

The police, however, are slightly different in that they can go back to the network operator later and link the TIMSI to a real IMSI. That will generally link to a physical person, who might then have to explain what his/her phone was doing at the time in question.

The Metropolitan Police in particular has been operating IMSI catchers, along with a covert air wing run through a front company registered to an anonymous mailbox in South London, since at least 2011. The Met’s surveillance aircraft, a twin-engined Cessna Caravan F406 with the registration G-BVJT, is a familiar sight to Londoners. It is thought the aircraft’s surveillance fit includes IMSI catchers and live mobile phone tracking and eavesdropping capability. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/27/prison_courts_bill_imsi_catcher_wireless_interference/

Updated The availability of Transport Layer Security protocol version 1.3 was supposed to make network encryption faster and more secure.

TLS 1.3 dispenses with a number of older cryptographic functions that no longer offer adequate protection, and reduces the amount of time required to negotiate “handshakes” between devices.

Google introduced support for TLS 1.3 in Chrome 56, which began rolling out for Linux, macOS, and Windows in late January, and reached Android and iOS devices a few days later.

The specification is still being finalized, but Google has been open about its plan to implement it. Now it seems at least one security vendor ignored the memo. Chromium’s bug tracker indicates that Symantec’s Blue Coat 6.5 security software can’t handle TLS 1.3.

Six days ago, an IT administrator with Montgomery County Public Schools in Maryland reported that following the update to Chrome version 56, almost a third of the 50,000 Chromebooks he manages became “stuck in a state of flickering between a login screen and a ‘Network not available’ screen.” He also said that some of the roughly 45,000 Windows PCs he manages were affected. The admin said Blue Coat 6.5 doesn’t appear to support TLS 1.3.

Attempts to reach the administrator via phone and email were unsuccessful and Montgomery County Public Schools’ CTO Sherwin Collette did not respond to a request for comment.

According to Google engineer David Benjamin, the issue is that Blue Coat implements TLS 1.3 incorrectly. “[Blue Coat was] made aware of TLS 1.3 several months ago, but evidently did not test [its] software per our instructions,” he wrote. Benjamin did not respond to further requests for comment.

A spokesperson for Symantec, which acquired Blue Coat last year, told The Register in an email, “Symantec has been alerted of a potential issue with TLS 1.3 on select devices. We’re investigating now and are working to resolve the issue.”

Symantec’s spokesperson did not respond to a request to explain why the issue has gone unaddressed for so long. Another Google employee posting to the list wrote that a customer using iBoss’s security software also encountered problems following the Chrome update.

However, an iBoss spokesperson told The Register that the company was aware of only one report and believes the problem in that instance is related to a customer configuration issue rather than the implementation of its software.

Benjamin mentions “a list of buggy products.” But Google did not respond to a request for further details.

The Chromium team considered a rollback, but appears to have decided against it because TLS, when properly implemented, should be backwards compatible. “That these products broke is an indication of defects in their TLS implementations,” wrote Benjamin. ®

Updated to add

Google has told The Register it has paused its TLS 1.3 deployment, and is working with various vendors to address issues that have emerged. TLS 1.3 support has been rolled out to about a tenth of Chrome users, we’re told.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/27/blue_coat_chokes_on_chrome_encryption_update/

Apple’s Mac operating system may be the safer choice – but only because cybercriminals can’t get their hands on people who know how to exploit it.

That’s according to security showman Eugene Kaspersky, who gave a keynote at the Mobile World Congress in Barcelona on Monday. In recent months, Kaspersky has made a habit of giving MacOS a kicking, and this keynote was no different.

“People still think MacOS is safe,” he told attendees with some measure of incredulity. But it’s not. While there is certainly less malware for the operating system than, say, Windows, it’s more a case of difficulty in hacker recruitment than evidence of stronger inherent security.

Of course, this zeal may have something to do with a big push from Kaspersky for its security software for the Mac, not that you’d need it from Eugene’s logic. And that may have something to do with Kaspersky’s huge certificate cock-up at the start of the year that exposed millions of people to interception attacks.

To be fair though, it wasn’t just Apple that Kaspersky attacked: he also had some harsh words for car manufacturers, internet-of-things developers, and pretty much anyone who has ever made a software product.

Always one for theatrical flourishes, the Russian businessman started off his keynote in complete darkness. It wasn’t a power failure: he was emphasizing his talk’s main point that if everyone doesn’t work together to improve cybersecurity, we face blackouts – or “very bad scenarios,” as he put it.

(It may be worth noting that this global collaboration plan is not shared by all – such as the Russian authorities who arrested Kaspersky Lab’s head of the computer incidents investigation team, Ruslan Stoyanov, late last year and charged him with treason. New reports say the arrest stems from allegations that he passed information to US company Verisign.)

“We still have new technologies working on vulnerable platforms,” Kaspersky warned, adding a little bit of future fear about “smart machines” that may not be under our control.

So what’s the solution? A complete redesign of all of our systems, starting from scratch by building on top of secure platforms and software. He dreams of systems that are no longer “secure” but “immune.”

“Is it possible? I think yes. It’s my dream to have uncrackable devices with zero risk of hacker attack,” he told the crowd. But in the meantime, we will just have to rely on Apple’s control freak tendencies to keep us safe through developer disinterest. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/27/macos_safer_but_not_for_reason_you_think/

A feature in the Windows Insider Preview Build 15042 allows administrators to block the installation of any Win32 application that is not fetched from Microsoft’s software marketplace.

This configurable barrier is a new option presented in the beta Windows build. Users – with admin account permissions – will be able to allow only store-sourced apps to be installed; say they “prefer” apps from the store – meaning they’ll be warned if they’re about to install software from outside the store; or turn off the block entirely and allow the installation of any application. This doesn’t affect already installed apps.

It bears noting that the feature is only being offered in the latest “Insider” builds – and has yet to be confirmed for the general public build of Windows or the upcoming Creators Update release, which is expected in April.

The setting would have an obvious benefit to security by steering users away from potentially backdoored copies of popular applications. By limiting the installation of software to the Windows Store, Redmond could help to ensure that only properly screened apps are installed and eliminate the possibility of users being duped into running malware packages.

Starting with 15042, you can block installation of Win32 apps on ANY edition. Even Enterprise. pic.twitter.com/MHzpBkNLE3

— Vitor Mikaelson 🦄 (@vitorgrs) February 26, 2017

At the same time, it would also likely be disabled almost immediately in many cases. Gamers, for example, would not want software that blocks third-party services such as Steam, while business users may rely on third-party applications or opt for their own admin controls.

If the setting sounds familiar, it is because Apple has a virtually identical set of controls for OS X. The Mac “Gatekeeper” mechanism allows users to limit the installation of new apps to only what is available on the Mac App Store, rather than any app with a valid developer certificate. (Gatekeeper is far from perfect.)

Both services seek to reflect the “walled garden” security approach that has been favored for mobile devices. While smartphones and tablets are a relatively new ecosystem, however, desktop PCs have long enjoyed a more open approach that allows applications to be obtained through third-party services, or in many cases, directly from the developer. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/28/microsoft_restricts_windows_software/

Bored hacker looking for fun? We couldn’t possibly suggest you attack the latest vulnerability in ESET’s antivirus software, because it’s too basic to offer any challenge at all.

As outlined in this advisory today, all you need to get root-level remote code execution on a Mac is to intercept the ESET antivirus package’s connection to its backend servers, put yourself in as a man-in-the-middle, and exploit an XML library hole.

Or, to use the technically correct language of Google Security Team’s Jason Geffner and Jan Bee: “Vulnerable versions of ESET Endpoint Antivirus 6 are statically linked with an outdated XML parsing library and do not perform proper server authentication, allowing for remote unauthenticated attackers to perform arbitrary code execution as root on vulnerable clients.” Lovely.

The esets_daemon uses an old version of POCO’s XML parser library that is vulnerable to a buffer overflow bug, aka CVE-2016-0718, they explain. Among other things, that library handles license activation with a request to https://edf.eset.com/edf: whatever data is sent back from that server can exploit the XML parser bug to potentially gain arbitrary code execution as root – the user assumed by ESET’s antivirus.

The man-in-the-middle diddle is possible because the daemon doesn’t check ESET’s licensing server certificate, allowing a malicious machine masquerading as the ESET licensing server to give the client a self-signed HTTPS cert. Now the attacker controls the connection, they can send malformed content to to the Mac to hijack the XML parser and execute code as root.

“When ESET Endpoint Antivirus tries to activate its license, esets_daemon sends a request to https://edf.eset.com/edf,” the Googlers explain.

“The esets_daemon service does not validate the web server’s certificate, so a man-in-the-middle can intercept the request and respond using a self-signed HTTPS certificate. The esets_daemon service parses the response as an XML document, thereby allowing the attacker to supply malformed content and exploit CVE-2016-0718 to achieve arbitrary code execution as root.”

ESET has fixed the issue in version 6.4.168.0. Make sure you’re patched up to date to avoid any trouble. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/28/eset_antivirus_opens_macs_to_remote_execution_as_root/