STE WILLIAMS

Why the security industry’s traditional obsession and hype around vulnerabilities cannot be transferred to the ICS environment.

The red lines once thought to be unapproachable by cyber adversaries have dimmed significantly in industrial control systems (ICS) over the past year. While not yet commonplace, these disruptive and destructive attacks are no longer the thing of fiction. Even if we abandon the “cyber war” scenario, ICS attacks may become attractive to the new wave of ransom-driven cybercrime actors or shift towards the operational technology (OT) networks and systems that support the world’s most critical physical and virtual infrastructure.

As part of this transition, we will also likely see entrenched vendors repackage solutions with an ICS label, new entrants come to market with purpose-built solutions, and a wave of ICS vulnerability research released into the public domain. After all, making news with vulnerabilities is just what security people do, and the unfortunate fact is that discovering ICS vulnerabilities is an incredibly pedestrian exercise. We’ve seen evidence of this as recently as November with a few “zero-day” disclosures pointing to “trivial exploit” pathways timed for the annual American Petroleum Institute conference. 

But this space is vastly different than the traditional IT domain, and disclosure in this arena – far more than in IT – is an incredibly sharp double-edged sword. Where disclosing vulnerabilities, theoretically should prompt ICS vendors to improve their security design strategies and alert asset owners to the potential vectors of attack, in reality, the same pace of movement towards fixing vulnerabilities (arguably inadequate in IT) cannot be achieved in OT. Here’s why:

Experience Maturity
ICS vendors have come a long way when it comes to security vulnerability patching. However, they still don’t have the same level of experience and maturity that we find in the IT software world, and typically cannot develop patches for newfound vulnerabilities with the same degree of speed. Why? Traditionally, these companies were creating hardware and software built around reliability, up-time and real-time performance – not with security as a core focus. Because of this, these technologies were and are designed by engineers, not security experts. This is starting to change, as ICS engineers are expected to follow an accepted secure development cycle. This is clearly stated in ISA and IEC 62443-4-1, expected to be published in 2017. This industry transition will take years, though.

Long Lifecycles
The lifecycle of ICS components can be 25- to 35 years. Much of the technology in place today is at its end of life, from a support perspective. As researchers disclose vulnerabilities in “ubiquitously deployed” ICS components, they’re pointing to problems that will never be patched. These have been described as “forever-day” vulnerabilities. For example, facts identified in a recent report from FireEye concluded that 33% of vulnerabilities disclosed had no patch available at the time of disclosure. 

What’s Patching?
Patching ICS vulnerabilities comes down to the degree of adoption by asset owners/operators. This works against security since the majority of these owners/operators: 

• Cannot afford the downtime to install the patches – they are in the business of production, not in the business of running secure networks (a huge difference from IT). At Level 2 and 3 of ICS networks (where we find Windows-based systems), for example, there is some chance of patching but at Level 1 (the Programmable Logic Controllers or PLCs), firmware upgrades often require the controllers and PLCs to be taken offline. In this industry, downtime = no good for business = no patching!  
• Have not fully bridged the IT/OT gap, which means that organizational challenges get in the way. OT engineers are in charge of the OT systems and they don’t understand the security concern as deeply as they should. IT security teams own security, but they cannot enforce policy due to potential downtime impacts.
• Vulnerability disclosures and subsequent patches are relevant to an admin/operator when s/he knows exactly what is in the network. In industrial networks this is patently not the case. So, until stakeholders have a better and deeper visibility and understanding of their assets, the disclose and patch cycle won’t work.

You Can’t Force the ICS Vendor’s Hand
In IT we are used to “forcing the vendor hand” through vulnerability disclosure. But with ICS, there is no hand to force. It is simply a different world than what we are used to. Disclosing vulnerabilities prior to a patch being released by the vendor only helps the bad guys, and these disclosures significantly decrease the skills required for attackers to be successful.   

For researchers that are hell bent on the sensational, there is a real harsh ICS security reality that we also need to understand: Hacking a process in an ICS network doesn’t require some insanely well-crafted exploit of the latest and greatest vulnerability. The security gaps are so wide and so drastically need fixing that for highly-skilled adversaries, there are a gazillion ways to get in. In short, we don’t need to educate the low-skilled adversary on ways to target the ICS space with our disclosures.

Bottom line: The security industry’s traditional obsession and hype around vulnerabilities cannot be transferred to the ICS environment. In ICS, even more than in the IT domain, coordination with all parties is going to be of critical importance. Consequently, as security researchers, we need to help ICS vendors and asset owners focus on solving the systemic problems, not waste our efforts pointing to issues that generate sensational headline but no lasting solution.

Related Content:

• Ex-US National Security Official Clarke: Regulation Key To Protecting ICS/SCADA From Cyberattacks
• Ransomware Rising On The Plant Floor
• Latest Ukraine Blackout Tied To 2015 Cyberattackers

Galina Antova is the co-founder and chief business development officer at Claroty. Prior to co-founding the company, she was the global head of industrial security services at Siemens, overseeing the development of its portfolio of services that protect industrial customers … View Full Bio

Article source: http://www.darkreading.com/threat-intelligence/rethinking-vulnerability-disclosures-in-industrial-control-systems/a/d-id/1327986?_mc=RSS_DR_EDT

Dissenting judges seek revision of earlier ruling, saying it does not serve any privacy interest.

The July 14 decision by a US court in favor of Microsoft regarding data stored overseas received a boost when the 2nd US Circuit Court of Appeals in Manhattan stood equally divided on the issue voting 4-4, Reuters reports. The US government’s request to Microsoft to access email stored in a Dublin server in a narcotics case had received widespread criticism from tech and media companies citing privacy issues.

The dissenters in the appeals ruling believed the required data could be accessed since Microsoft was a US company. They sought a revision of the earlier verdict, which was based on the 1986 Stored Communications Act, so that challenges facing law enforcement in terms of electronic data storage could be appropriately addressed.  

“It has substantially burdened the government’s legitimate law enforcement efforts; created a roadmap for the facilitation of criminal activity; and impeded programs to protect the national security of the United States and its allies,” wrote Circuit Judge Jose Cabranes of the earlier ruling.

US Justice Department’s Peter Carr said the decision was being reviewed and options explored.

Click here for details.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/cloud/appeals-court-upholds-microsoft-victory-in-overseas-data-case/d/d-id/1327997?_mc=RSS_DR_EDT

House of Representatives’ SPY Car Study Act aimed at setting cybersecurity standards for new vehicles.

A bipartisan bill has been introduced in the US House of Representatives aimed at beefing up cybersecurity standards for connected cars.

The Security and Privacy in Your Car Study Act of 2017, or SPY Car Study Act, was sponsored by Reps. Joe Wilson (R-SC) and Ted Lieu(D-Calif.) , who previously co-authored an article on the subject.

The goal is to get experts to devise cybersecurity standards for new vehicles, including relevant firewall measures, isolating critical systems, plus setting an execution deadline, according to Ars Technica.

“By conducting a thorough study of isolation measures, detection protocol, and other best practices, we can bring industry, advocates, and government together to encourage innovation while ensuring consumer protection,” says Wilson.

The groups participating in the study will include the National Highway Traffic Safety Administration, Federal Trade Commission, National Institutes of Standards and Technology, and Department of Defense. They are expected to present a preliminary report to the Congress within one year of the act possibly becoming law.

Read details on Ars Technica.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/car-cybersecurity-center-of-new-bipartisan-bill-/d/d-id/1327996?_mc=RSS_DR_EDT

Voice-activated, internet-connected personal assistants are all the rage these days. Ask a group of friends what they got for Christmas and at least one will tell you how much they love their new Amazon Echo, Google Home or some equivalent.

This piece of smart home technology is a beautiful thing. But like all good things, there are risks.

Tomorrow is Data Privacy Day, an appropriate time to review those risks – and what users can do to protect their sensitive information.

Your technology is listening

The main concern among security experts when it comes to smart home devices is the degree to which they are listening. They obviously listen for any commands the user might utter, but what else is it taking in, and how could that put privacy at risk?

A murder case in Arkansas makes for an interesting case study.

Arkansas police are hoping that an Amazon Echo found at a murder scene in Bentonville will help them with their investigation into the death of a man strangled in a hot tub.

The Echo answers to the name of Alexa and will play music and answer simple questions on voice command. It also records what you say and sends that recording to a server.

While Amazon’s smart assistant only records what’s said to it after it’s triggered by someone saying “Alexa”, police are hoping that the devices’ habit of piping up in response to a radio or TV might mean it inadvertently recorded something that might be of use to them.

But like other tech retailers, Amazon has resisted pressure to hand over this kind of customer information to law enforcement. Amazon stores voice recordings from the Echo on its servers to improve its services, but the Seattle-based company, which has apparently released the account details of the alleged attacker to police, has declined to provide the voice recordings they are seeking via a search warrant.

Though it remains unclear if this particular Echo recorded anything useful, the case raises a bigger question: with Echo/Alexa, Siri, Cortana and Google’s Home assistant in many homes these days, and knowing that some of the technology is listening and recording, who might be able to exploit that?

In this case law enforcement wants to access a device. But in the future, it may be hackers looking to have a listen.

Lessons from the Dyn attack

Personal assistants fit into the larger concept of the smart home, so it’s useful to look at threats that have already targeted Internet of Things (IoT) devices.

Security experts have long predicted threats targeting everyday home devices connected to the internet, and the threat was made plain last fall when Mirai malware was used to hijack internet-facing webcams and other devices into massive botnets that were then used to launch a coordinated assault against Dyn, one of several companies hosting the the Domain Name System (DNS). That attack crippled such major sites as Twitter, Paypal, Netflix and Reddit.

To be clear, that attack infected IoT devices and used them to target a company. It’s not the same as being snooped on, but in many cases the end goal is on the same wavelength: the bad guys want to see or hear what you have for personal data so they can use the information to benefit themselves or their cause.

A few short years ago, IoT attacks were discussed as some potential threat in a distant future. Now they are real. To some experts, it’s only a matter of time before hijacked personal assistants become a clear and present danger.

Defensive measures

Those who choose to use this technology can’t and shouldn’t expect 100% privacy. If not for the ability of Amazon Echo and Google Home to listen, these things would become nothing more than doorstoppers and paperweights.

But there are certainly things users can do to limit the risk of unintended consequences. Here are just a few examples:

• Not currently using your Echo? Mute it The mute/unmute button is right on top of the device. The “always listening” microphone will shut off until you’re ready to turn it back on.
• Don’t connect sensitive accounts to Echo On more than a few occasions,  daisy chaining multiple accounts together has ended in tears for the user.
• Erase old recordings If you use an Echo, then surely you have an Amazon account. If you go on Amazon’s website and look under “Manage my device” there’s a handy dashboard where you can delete individual queries or clear the entire search history.
• Tighten those Google settings If you use Google Home, you’re already aware of the search giant’s appetite for data collection. But Google does offer tools to tighten things up. Like the Echo, Home has a mute button and a settings page online, where you can grant or take away various permissions.

Follow @NakedSecurity
Follow @BillBrenner70

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/M9lRpy5oVv4/

Another Celebgate hacker is headed to jail.

Edward Majerczyk, 29, pleaded guilty in September to prying open more than 300 iCloud and Gmail accounts – at least 30 of them belonging to Hollywood glitterati – and ripping off what the US Attorney’s Office demurely refers to as his victims’ “sensitive and private photographs and videos”.

…which is what the rest of us call nude celebrity photos.

On Tuesday, he was sentenced to nine months in federal prison, according to the Central District of California US Attorney’s Office.

Majerczyk, who’s from Chicago, was sentenced by US District Judge Charles P Kocoras, who said his crime was “abhorrent”.

As well the prison sentence – which he’ll begin serving at the end of February  – Judge Kocoras also ordered Majerczyk to pay $5,700 in restitution to one unnamed victim whose photos were published online.

The charge is a felony violation of the Computer Fraud and Abuse Act (CFAA, and specifically, one count of unauthorized access to a protected computer to obtain information. Majerczyk was charged by federal prosecutors in Los Angeles, but the case was transferred to the Northern District of Illinois, where he pleaded guilty and was sentenced.

According to the plea agreement, Majerczyk was a busy phisherman between November 23 2013 through August 2014.

That’s right before the September 2014 Celebgate gang-mugging of celebrities let loose, as intimate images of celebrities were stolen and disseminated online in places such as Reddit.

Thieves and many equally scumbaggy photo-sharers trampled over the privacy of Jennifer Lawrence, Kate Upton, Kirsten Dunst, Selena Gomez, Kim Kardashian, Vanessa Hudgens, Lea Michele and Hillary Duff, among others.

Majerczyk got to his victims with a phishing scam in which he sent messages doctored to look like security notices from ISPs.

The phishing messages led victims to a website that harvested their usernames and the passwords for their Google or iCloud accounts. With the credentials in hand, Majerczyk was free to romp through victims’ accounts and grab whatever photos and videos he could find.

Nasty, eh? Oh yes, said Deirdre Fike, the assistant director in charge of the FBI’s Los Angeles Field Office:

Mr Majerczyk manipulated hundreds of victims by tricking them into providing access to their accounts, including high-profile victims whose information was specifically targeted. The lasting harm this type of intrusion can cause to celebrities and non-celebrities alike cannot be overstated…

And it should serve as an important reminder to all of us of how dangerous it can be to respond to unsolicited e-mails in which our personal information is requested, Fike said.

Majerczyk’s case followed a guilty plea by Pennsylvanian Ryan Collins, 36, who was sentenced to 18 months in jail in October.

Both Majerczyk and Collins pulled the same shtick: sending phishing emails spoofed to look like they came from Apple or Google which asked victims for account credentials.

We never heard the details of how they constructed the phishing emails, but October brought us a fascinating dissection of how hackers used Bitly shortened links in phishing attacks to trick Democratic National Committee officials into handing over their own Gmail credentials.

The Feds have said that both Collins and Majerczyk were apparently operating independently and there is no evidence to suggest that either Majerczyk or Collins were the ones who actually posted the nude photos online.

In another investigation sparked by Celebgate, the US government seized a Chicago man’s computers in June 2015.

None of those cases, apparently, are related to yet another celebrity hacking prosecution: that of Alonzo Knowles’ guilty plea in New York for stealing new screenplays and sex videos from celebrities, nor of the felony hacking conviction of Andrew Helton in Oregon for similar hacking of celebrity-owned Apple and Google accounts.

In other words, Majerczyk is just the latest in a string of busted, soon to be imprisoned celebrity hackers. Investigators sure don’t seem to be tired of chasing them down, though.

All the better for the people they’ve victimized.

Follow @NakedSecurity
Follow @LisaVaas

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/eLGD12OYxYo/

Antivirus is harmful and everyone should uninstall it, so says recently liberated ex-Mozilla developer Robert O’Callahan.

The former Mozilla man worked at the browser baron for 16 years and has now joined his voice to the growing chorus of hackers pouring scorn on the utility of antivirus software. Among O’Callahan’s beefs is that at one point vendors of the would-be malware protection technology blocked Firefox updates to sever the increasing security they found hard to deal with.

Almost all arguments against antivirus centre on the fact that the technology increases security attack surfaces, breaks operating system defences like address space layout randomisation and uses hacked-together hooks to comandeer web browsers.

Many security boffins therefore believe that antivirus reduces developers’ ability to ship secure products.

That includes antivirus software itself: Google’s Project Zero hack house has been revealing crushing vulnerabilities in all corporate antivirus that leave users open to remote compromise.

Moreover, the ease with which targeted attackers can craft malware that eludes and disables antivirus means the once essential security control has few friends left in information security circles.

@VessOnSecurity @Jindroush Kinda like how a lightbulb that sets things on fire is still high quality, so long as you only measure lumens?

— Tavis Ormandy (@taviso) November 19, 2016

O’Callahan roasts the ancient security control with similar arguments in a blog that concludes that such antivirus hate speech from staff developers would draw the ire of corporate gatekeepers; “But now I’m free! Bwahahaha!”.

“At best, there is negligible evidence that major non-Microsoft antivirus products give a net improvement in security,” O’Callahan says.

“Antivirus products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security.

“Antivirus software vendors are terrible; don’t buy antivirus software, and uninstall it if you already have.”

He says Redmond’s antivirus is okay since it is built by the company’s “generally competent” developers who follow good security practice.

Antivirus companies have irritated Mozilla hackers. Years back Firefox engineers had cooked the then new address space layout randomisation operating system exploit defense into their browser and were frustrated as antivirus companies installed on so many user machines disabled the critical control with DLLs.

The security scourge even blocked Firefox updates.

“Major amounts of developer time are soaked up dealing with antivirus-induced breakage, time that could be spent making actual improvements in security,” O’Callahan says.

Antivirus would face broadsides everywhere if it were not for the need for developers to work with the security software companies in order to have false positive virus flags removed, he says.

That quiet has fooled users into “associating antivirus vendors with security”.

Others have been less dismissive of antivirus software. Respected Google hacker Darren Bilby has called on security thinkers to spend more energy on developing, refining, and deploying more meaningful defences than “magic” antivirus and intrusion detection systems that “do not work”.®

Sponsored:
Achieving rapid delivery of high quality software with continuous delivery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/01/27/gag_free_ex_mozilla_dev_joins_antivirus_roasting_chorus_its_poison/

Approximately 28 per cent of Americans are “not confident at all that the federal government can keep their personal information safe,” the Pew Research Center reported on Thursday, while also noting that many Americans fail to observe security best practices when online.

White House Press Secretary Sean Spicer appeared to validate these findings when he tweeted, for the second time in as many days, a string of letters and numbers that many believe was his Twitter account password.

The Pew report, “Americans and Cybersecurity,” suggests that skepticism about the ability of government agencies and private companies to protect personal data is justified, as it notes that the majority of Americans (64 per cent) have been affected by some form of data theft: fraudulent charges, compromised personal information, online account hijacking, social security number misuse, or identity theft.

Given recently-disclosed security failures – such as Yahoo!‘s admission that personal details for more than a billion user accounts had been stolen, and the Office of Personnel Management’s loss of sensitive data on some 21 million current and former government employees – it’s not difficult to see why such concerns might arise.

Yet Americans’ bad personal experiences aren’t translating into better security habits.

“[F]ully 84 per cent of online adults rely primarily on memorization or pen and paper as their main (or only) approach to password management,” the report states. That’s an approach that only scales well when people reuse the same password at multiple websites, and passwords that can be remembered often lack the complexity to resist dictionary-based attacks.

Unsurprisingly, 39 per cent of online adults say they use the same or very similar passwords for many of their online accounts, and 25 per cent admit to using passwords that are less secure than they might like because simple passwords are easier to remember.

Security experts tend to recommend a password management application, which obviates the need to remember multiple complex passwords.

But there’s more. Some 28 per cent of smartphone owners say they don’t bother to use a lockscreen, while 54 per cent say they use public, potentially insecure Wi-Fi networks. Worse still, 20 per cent acknowledge accessing public networks for online shopping and banking.

The Pew study observes that the majority of Americans (70 per cent) expect significant cyberattacks on the country’s public infrastructure in the next five years. With so much disinterest in improving their own online security postures, that expectation appears destined to be a self-fulfilling prophecy. ®

Sponsored:
DevOps and continuous delivery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/01/27/americans_fail_to_protect_their_data/

Antivirus is harmful and everyone should uninstall it, so says recently liberated ex-Mozilla developer Robert O’Callahan.

The former Mozilla man worked at the browser baron for 16 years and has now joined his voice to the growing chorus of hackers pouring scorn on the utility of antivirus software. Among O’Callahan’s beefs is that at one point vendors of the would-be malware protection technology deliberately blocked Firefox updates to sever the increasing security they found hard to deal with.

Almost all arguments against antivirus centre on the fact that the technology increases security attack surfaces, breaks operating system defences like address space layout randomisation and uses hacked-together hooks to comandeer web browsers.

Many security boffins therefore believe that antivirus reduces developers’ ability to ship secure products.

That includes antivirus software itself: Google’s Project Zero hack house has been revealing crushing vulnerabilities in all corporate antivirus that leave users open to remote compromise.

Moreover, the ease with which targeted attackers can craft malware that eludes and disables antivirus means the once essential security control has few friends left in information security circles.

@VessOnSecurity @Jindroush Kinda like how a lightbulb that sets things on fire is still high quality, so long as you only measure lumens?

— Tavis Ormandy (@taviso) November 19, 2016

O’Callahan roasts the ancient security control with similar arguments in a blog that concludes that such antivirus hate speech from staff developers would draw the ire of corporate gatekeepers; “But now I’m free! Bwahahaha!”.

“At best, there is negligible evidence that major non-Microsoft antivirus products give a net improvement in security,” O’Callahan says.

“Antivirus products poison the software ecosystem because their invasive and poorly-implemented code makes it difficult for browser vendors and other developers to improve their own security.

“Antivirus software vendors are terrible; don’t buy antivirus software, and uninstall it if you already have.”

He says Redmond’s antivirus is okay since it is built by the company’s “generally competent” developers who follow good security practice.

Antivirus companies have irritated Mozilla hackers. Years back Firefox engineers had cooked the then new address space layout randomisation operating system exploit defense into their browser and were frustrated as antivirus companies installed on so many user machines disabled the critical control with DLLs.

The security scourge even blocked Firefox updates.

“Major amounts of developer time are soaked up dealing with antivirus-induced breakage, time that could be spent making actual improvements in security,” O’Callahan says.

Antivirus would face broadsides everywhere if it were not for the need for developers to work with the security software companies in order to have false positive virus flags removed, he says.

That quiet has fooled users into “associating antivirus vendors with security”.

Others have been less dismissive of antivirus software. Respected Google hacker Darren Bilby has called on security thinkers to spend more energy on developing, refining, and deploying more meaningful defences than “magic” antivirus and intrusion detection systems that “do not work”.®

Sponsored:
DevOps and continuous delivery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/01/27/gag_free_ex_mozilla_dev_joins_antivirus_roasting_chorus_its_poison/

Russian penetration tester Vladimir Ivanov has reported a bug in anti-ransomware backup service Code42 that could have seen attackers pilfer data from the likes of Uber, Lockheed Martin, and Adobe.

Ivanov, of SCADA hack house Positive Technologies, reported the since-patched XML external entity vulnerability to Uber, which paid him US$9,000. Code42 doesn’t have a bug bounty program.

He says he found the vulnerability while trying to score a hit under Uber’s bug bounty.

“The only option to break the service and get a bounty for pwning the [Code42] application was to find a zero day,” Ivanov says.

“[The vulnerability] could give access to backups of all users in a given company. Uber security guys were excited with this vulnerability: they contacted vendor and confirmed that this vulnerability was a zero day.”

XML External Entity attacks are common application flaws that occur when XML input containing a reference to an external entity is processed by a weakly configured XML parser.

They open up disclosure of confidential data, denial of service, and server-side request forgery.

Ivanov reported the vulnerability to Uber in May through its HackerOne bug bounty, which passed the flaw to Code42. The latter patched the bug the same month but asked that the hacker hold off publishing a disclosure until all customers had applied the patch.

Ivanov says Code42 did not reply to his request to publish this week, labelling his engagement with the backup company “difficult”. ®

Sponsored:
DevOps and continuous delivery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/01/27/uber_bug_bounty/

Bug hunter Craig Arendt has reported vulnerabilities in major eBook readers including those from Apple, Google, and Amazon.

The similar but separate XML external entity (XXE) flaws also impact all online epub ebook services that use the popular epubcheck library that ensures good format conversions into the universal epub book format.

“[I] applied a familiar XXE pattern to exploit services and readers that consume the epub format [and exploited] vulnerabilities in EpubCheck, Adobe Digital Editions, Amazon KDP, Apple Transporter, and Google Play Book uploads,” Arendt says.

“The validator tool (EpubCheck) was vulnerable to XXE, so any application that relies on a vulnerable version to check the validity of a book would be susceptible to this type of attack.”

The named vendors have applied patches preventing the possible information disclosure and denial of service conditions.

Arendt (@craig_arendt) says the Amazon KDP Kindle file upload service designed to help publishers upload their books suffered from a XXE flaw that could allow attackers to steal books and data.

Apple’s Transporter which ships books to the App Store was also affected.

In one instance Arendt accidentally grabbed the shadow password file for one unnamed service using the vulnerable EpubCheck library.

Google Play Books was not vulnerable to XXE but was to the XML exponential entity expansion mess, a flaw that leads to denial of service through an explosive growth of parsed data.

Other services permit Java and Flash, and as a result likely more brutal exploits. Arendt says he will disclose further attacks once the vendors have issued patches. ®

Sponsored:
DevOps and continuous delivery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/01/27/bookish_hacker_finds_holes_in_amazon_apple_google_epub_services/