STE WILLIAMS

A student has discovered a critical vulnerability in BackTrack, a flavour of Linux that’s a favourite among security pros.

The previously undiscovered (hence zero-day) privilege escalation bug in the network penetration-testing distro was discovered during an ethical hacking class organised by the InfoSec Institute.

Jack Koziol, security programme manager at the institute, explained that the bug in Backtrack 5 R2 (the latest version) allowed the student to overwrite settings to gain a root shell. The flaw was found in wicd (the Wireless Interface Connection Daemon), which has not been tested for “potential remote exploitation vectors” according to Koziol.

The security flaw was discovered during fuzzing, which is a technique that lobs random or unexpected data at software to trigger vulnerabilities. While it’s unclear if it could be exploited remotely, it still needs fixing.

The security bug stems from a failure to sanitise user inputs, a deficiency that creates a mechanism to start a given executable or script with root-level privileges on systems running the daemon, provided the hacker has local hands-on access.

“This 0-day exploit for BackTrack 5 R2 was discovered by a student in the InfoSec Institute ethical hacking class, during an evening capture-the-flag exercise,” Koziol explained. “The student wishes to remain anonymous, he has contributed a python version of the 0-day, a patch that can be applied to wicd, as well as a writeup detailing the discovery and exploitation process.”

More details, with a proof-of-concept exploit and patch can be found, on the institute’s website here.

Developers rated the bug “critical” and put out an advisory and an (official) patched version of wicd 1.7.2, which fixes the issue.

BackTrack Linux is a favourite among the security community. Other Linux distributions share the vulnerable wireless network card manager component, including Debian (details here) and Arch.

The cleverclogs who discovered the flaw enjoyed a breakfast of champions, Koziol explained.

“Usually the winner of the CTF exercise in the ethical hacking course gets a free InfoSec polo shirt, and the instructor buys him or her a beer. This guy was so excited he found the bug he stayed up all night making an exploit and patch and ended up having the beer for breakfast the day after while the rest of the class ate pancakes.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/12/backtrack_linux_0day/

Financial firms were in the crosshairs of cyber-attackers during the first three months of 2012, while a threefold increase in DDoS attacks was recorded.

DDoS mitigation biz Prolexic reports that the growth in the number of attacks against its clients in banking and insurance was accompanied by a 3,000 per cent increase in malicious packet traffic (up from 14 billion packets of malicious traffic in Q4 2011 to 1.1 trillion in Q1 2012).

The firm, which released its Quarterly Global DDoS Attack Report this week, said that the overall number of attacks from Q4 2011 to Q1 2012 was virtually unchanged but that there had been a 6 per cent rise in more sophisticated Layer 7 (application layer) attacks. Average attack duration declined from 34 hours in the back end of 2011 to 28.5 hours in Q1 2012, however, average attack bandwidth increased to 6.1 Gbps. This represents an increase from 5.2 Gbps in the previous quarter – continuing a trend towards shorter, fiercer attacks that has continued in successive quarters over the last 12 months.

The firm said UDP (User Datagram Protocol) floods had declined in popularity over recent months, with SYN floods emerging as the prime vector of DDoS attacks over recent months.

China remains the top source country for attacks, but the US and Russia have both moved up in Prolexic’s rankings.

The security tools firm said that it had mitigated more attack traffic this quarter than it had done during the whole of 2011.

“This quarter was characterised by extremely high volumes of malicious traffic directed at our financial services clients,” said Neal Quinn, Prolexic’s vice president of operations. “We expect other verticals beyond financial services, gaming and gambling to be on the receiving end of these massive attack volumes as the year progresses.”

Several different motivations have spawned the growth in DDoS attacks over recent years, including ideological and politically motivated “hacktivism” and financially motivated cybercrime. Less frequently, DDoS attackers are conducting cyberespionage or are performing hate crimes. Occasionally hackers carry out attacks just to test out new tools or for the simple devilment of causing disruption, according to Prolexic.

Data for the Q1 2012 report was gathered and analysed by members of the Prolexic Security Engineering Response Team (PLXsert). The group monitors malicious cyber threats globally and analyses DDoS attacks. Using data forensics and post-attack analysis, PLXsert is able to build a global view of DDoS attacks, which the firm shares with its customers.

Prolexic’s DDoS attack trends report can be downloaded here (registration required). ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/12/prolexic_ddos_trends/

Japan-based Ogaki Kyoritsu Bank is claiming to be the first in the world set to offer its customers the option of using ATM services without the need for a cash card or passbook, thanks to palm-scanning biometric technology from Fujitsu.

The technology works by mapping and identifying the unique pattern of veins in the user’s palm. Although biometric scanners are used in some Japanese banks already, they don’t allow users to authenticate via this method alone.

With the tag-line “You are the cash card”, the technology will be rolled-out from September in ten branches including the major city of Nagoya, as well as a drive-through cashpoint (yes, they have them too) and two mobile banking units.

Ogaki Kyoritsu – which is a regional bank centred in Gifu prefecture west of Tokyo – was quick to point out that a card-less authentication system could have helped survivors of the recent Tohoku earthquake and tsunami who, having lost cards and passbooks, were stranded unable to access their accounts.

One of the bank’s mobile units operates as a “rescue” bank for just such occasions.

The system is pretty straightforward. Initially the user must associate their palm scan with their account by inputting PIN and birth date, after which time they are free to access their account via the scan alone to withdraw or deposit money or check account balance, the bank said.

For those that can read Japanese, the original release is here.

This isn’t the first time Ogaki Kyoritsu has tried to innovate with its ATMs. In 2005, it reportedly introduced a fruit machine-style game to encourage punters to use its cash points. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/12/ogaki_palm_scanning_cash/

HP has sent out a warning to customers after the vendor found out it had inadvertently been shipping virus-laden compact flash cards with its networking kit.

The unnamed malware appeared on flash cards that came bundled with HP ProCurve 5400zl switches. The flash card wouldn’t do anything on the switch itself but “reuse of an infected compact flash card in a personal computer could result in a compromise of that system’s integrity,” HP warned in a bulletin issued on Tuesday.

“There is an irony that a major selling point of the ProCurve switches is its virus-throttling capability,” notes Reg reader Kevin L, one of a number of readers who told us about the HP snafu. “Pity they couldn’t throttle it in manufacture,” he added.

It’s unclear how the unknown malware got onto the Flash cards that come bundled with the 10 Gbps-capable line of LAN switches, but an infected computer somewhere in the manufacturing process – possible in a factory run by a third-party supplier – is the most obvious suspect.

These kind of problems are rare but not unprecedented and really only cause significant problems when a particular aggressively spreading or destructive strain of malware is involved, as was the case when the FunLove virus infected machines in a Dell factory a few years back in 1999. HP is not unacquainted with this type of problem. HP distributed printer drivers corrupted by FunLove after malware-ladened files were uploaded to its website back in 2001.

The latest incident is more like a case from 2008, when HP Australia warned that optional USB keys shipped with some of its ProLiant servers were infected by malware. A batch of 256MB and 1GB USB keys that shipped with the servers were infected by the Fakerecy and SillyFDC, both low-risk strains of malware. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/11/hp_ships_malware_cards_with_switches_oops/

Apple went out of its way to make life difficult for the Russian security firm that first alerted the world to the spread of the now infamous Flashback Trojan on Mac computers, it has emerged. However the fruitbite-branded firm has now pledged to resolve the problem, well after security firms – and Microsoft – had acted.

The Flashback Trojan created a zombie army now numbering more than 650,000 Mac machines by exploiting a Java hole that Apple only patched last Tuesday, six weeks after a patch for Windows machines became available.

Russian anti-virus firm Dr Web came up with the chilling statistics after it successfully managed to sinkhole one of the command-and-control servers used to control compromised Mac OS X machines hit by at the attack. Boris Sharov, chief exec of Dr. Web, said that its attempts to alert Apple about the issue went ignored.

“We’ve given them all the data we have,” Sharov told Forbes. “We’ve heard nothing from them until this.”

Worse still, Apple asked a Russian registrar to take down a domain Dr Web had established in order to observe and analyze the botnet in the mistaken belief that it was acting as a command and control server for the zombie network.

Sharov blames the communication problems and mix-ups on the difficulty of getting in touch with Apple’s security team, something that has not been an issue in dealing with Microsoft for many years. Even before Bill Gates’ Trustworthy Computing memo Microsoft staffers were involved in active outreach to the security community, attending important conference such as Black Hat and Virus Bulletin, for example. To its credit Microsoft has maintained friendly working relationships with security researchers over many years.

By contrast Apple has only recently conceded that malware is an issue on its platform. Its relationship with security researchers remains spiky even after the arrival of ex-Mozilla security boss Window Snyder back in March 2010.

For example, last year noted Apple security researcher Charlie Miller created a proof-of-concept mobile app demonstrating a flaw in Apple’s security restrictions. The manufacturer responded by suspending his developer’s license.

However signs are emerging of a shift in attitudes at Cupertino in the aftermath of the Flashback Trojan botnet debacle. Apple said it was developing software that will detect and remove the Flashback malware.

Discussing its approaches towards a security problem that is not yet fully resolved is a shift from Apple’s traditional policy “not [to] disclose, discuss or confirm security issues until a full investigation has occurred and any necessary patches or releases are available”, as Paul Ducklin of Sophos notes.

Pending the arrival of a removal tool from apple security firms including Kaspersky Labs have developed their own Flashback removal tools. Meanwhile Doctor Web has established a site – www.drweb.com/flashback – that allows consumers to check whether their Mac machines are infected. Users need to supply their Hardware UUID to use the site, something the more privacy conscious might baulk at. The best option for such people is probably to run the Kaspersky removal tool, as a precaution, before installing free anti-virus software for Macs from the likes of Sophos.

Doctor Web has published a timeline of the Flashback Trojan here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/11/apple_snubs_mac_botnet_fighter/

Cybercrooks have forged a ZeuS-based Trojan that targets cloud-based payroll service providers.

ZeuS, a favourite tool for financially motivated cybercrooks, has provided a straightforward way to harvest online banking credentials for years. A new attack, detected by transaction security firm Trusteer, shows that crooks are going up the food chain.

Trusteer researchers have captured a ZeuS configuration that targets Ceridian, a Canadian human resources and payroll services provider. The ZeuS-based Trojan works by capturing a screenshot of the payroll services web page when a malware-infected PC is used to visit the site. This information is uploaded, allowing crooks to obtain the user ID, password, company number and the icon selected by the user for the image-based authentication system – enough information to siphon funds from compromised accounts into those controlled by money mules, as explained in a blog post here.

Trusteer reckons crooks are targeting the small cloud service provider in order to get around the tougher problem of how to bypass industrial strength security controls that are typically maintained by larger businesses. Cloud services can be accessed using unmanaged devices that are typically less secure and more vulnerable to infection by ZeuS-style financial malware.

The financial losses associated with this type of attack are potentially huge. For example, last August cyberthieves reportedly stole $217,000 from the Metropolitan Entertainment Convention Authority (MECA) after compromising its payroll system and adding money mules as employees. A MECA worker reportedly fell for a phishing email that allowed crooks to steal access credentials to the organisation’s payroll system.

Hitting payroll providers is certainly far more lucrative than targeting individual consumers, according to Trusteer, which predicts a growth in this type of attack as a result. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/11/zeus_based_trojan_targets_payrolls/

Microsoft released six bulletins on Tuesday to fix a total of 11 vulnerabilities, one of which has become the target of active attacks against unpatched applications.

One of the four critical patches in the batch – MS12-027 – addresses an Active X issue that impacts numerous application and creates a mechanism to drop malware onto vulnerable Windows systems.

Microsoft warned of attacks in the wild against the zero-day flaw, which affects an unusually wide range of Microsoft products and Microsoft users. Applications affected include Office 2003 through 2010 on Windows; SQL Server 2000 through 2008 R2; BizTalk Server 2002; Commerce Server 2002 through 2009 R2; Visual FoxPro 8; and Visual Basic 6 Runtime.

“Attackers have been embedding the exploit for the underlying vulnerability CVE-2012-0158 into an RTF document and enticing the target into opening the file, most commonly by attaching it to an email,” Wolfgang Kandek CTO at security services firm Qualys explains. “Another possible vector is through web browsing, but the component can potentially be attacked through any of the mentioned applications.”

Other critical updates in the April batch include a cumulative security update for Internet Explorer (MS12-023), an update that addresses a critical vulnerability in the .NET XBAP (a browser based application module) and a patch that addresses a security flaw in Windows Authenticode that might be used to camouflage the presence of malware within application installer packages.

The IE update tackles four vulnerabilities and affects all supported versions of Microsoft’s browser software. Redmond’s security gnomes warn that an attack against the vulnerabilities covered by the update is likely within 30 days. The browsers update omits a fix for the vulnerability found during last month’s PWN2OWN contest at CanSecWest 2012, which will probably be fixed by another IE update next month.

Microsoft’s security bulletin summary for April can be found here.

In other patching news, Adobe released updates for both Adobe Reader 9 and 10 that plug crucial vulnerabilities on Tuesday. The cross-platform updates covers versions of the PDF reader application on Windows, Mac and Linux computers. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/11/ms_april_patch_tuesday/

The early hacker activist life of Julian Assange is set to be immortalised in a television drama for Australia’s Network Ten.

The two hour telemovie called Underground will be directed and written by Robert Connolly, the director of Balibo.

Assange will be played by acting newcomer Alex Williams while Rachel Griffiths will play Christine, Assange’s mother and Anthony LaPaglia will take the role of a policeman investigating the young hacker.

The telemovie will draw from the 1997 book Underground: Tales of Hacking, Madness and Obsession on the Electronic Frontier by Suelette Dreyfus, which chronicles the tales of a group of neophyte Australian, American, and British hackers of the late 1980s and early 1990s including the notorious long-haired, early 20’s Assange.

The book covers Australia’s first significant trial for computer crimes which revolved around the convicted hackers Phoenix, Electron and Nom . While the book also provides the first glimpse of Australian Mendax (Julian Assange) in action who along with Prime Suspect, penetrated the DDN, NIC and the Nortel internal network.

Connolly also collaborated on the script with Australian journalist Mark Davis, who, when Assange was relatively unknown and on the run, traveled extensively with him through Europe.

Melbourne based production company Matchbox is behind the project, which most likely means that it will also be screened in the US on NBC as NBC Universal recently took a majority stake in the company. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/11/assange_tv_movie/

The Chinese authorities have voiced concerns after uncovering security vulnerabilities in the application stores run by mobile operators China Mobile and China Telecom.

Regional newspaper the Guangzhou Daily reported (via Sina Tech) that according to the Ministry of Industry and Information Technology (MIIT), mobile operators’ overall network security comes in at an impressive compliance rate of 98 per cent.

However, deputy director Xiong Sihao reportedly added that there are “many problems” in the app stores of the two operators, which between them have a market share of around 80 per cent.

China Unicom, which has a share of around 20 per cent, is spared in the report.

Sihao’s comments in the report also hinted that the ministry is somewhat displeased that the state-run operators are not doing more to ensure a safe environment for their users.

“Judging by the industry at present, there has not been a fundamental change in the operators’ security weaknesses, and despite some improvements there have not been any fundamental improvements,” he reportedly said.

Although there are no reliable stats, China appears to have a big problem when it comes to malicious mobile apps either finding their way onto legitimate sites such as those run by the operators, or dubious third party platforms.

Roy Ko, a consultant at the Hong Kong Computer Emergency Response Team Coordination Center, told The Register that part of the problem lies with Chinese mobile users themselves.

“In China people like to crack software and make it available for free but that is dangerous because Google Play at least has some quality control, but on the other sites you get these cracked apps alongside malicious ones,” he argued.

The most common end goal for the creators of these malicious apps is either to steal data, or make money out of premium dialler malware, although increasingly hackers are using these infection channels to turn smartphones into botnets, Ko explained.

Given the government always gets its way one way or another in the People’s Republic, it probably won’t be long before the operators announce new measures to vet applications on their app stores more rigorously.

With the country’s number of mobile subscribers now topping one billion, and Android steaming ahead of the competition, it’s pretty certain that cyber criminals will be targeting the OS via malicious apps for some time to come. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/11/china_mobile_telecom_app_store_malware/

Security experts are warning of yet another targeted malware campaign using socially engineered emails to infiltrate pro-Tibet organisations in a bid to covertly nab sensitive files.

Trend Micro threat research manager Ivan Macalintal explained in a blog post that the attacks are linked to the same command and control server used in the Gh0st RAT (remote access Trojan) campaign most recently observed at the end of March.

The Gh0st Trojan has been used by suspected Chinese hackers in several advanced persistent threat (APT) style attacks, most notably the ‘Nitro’ attacks against energy firms in 2011.

Following the classic modus operandi for such attacks, the threat arrives as an innocuous looking email socially engineered to encourage the recipient to click on an embedded malicious link – in this instance it is an invitation to a Tibetan film festival.

Macalintal explained that the user is then taken to a site which determines whether they are on a Mac or Windows system before loading a Java applet designed to exploit a vulnerability in the Java Runtime Environment.

If successful, the exploit will then install a SASFIS backdoor for Windows or an OLYX backdoor for Mac OSX.

Both backdoors report back to the same CC server, which is the same as that used in Gh0st RAT attacks and the attacks uncovered by AlienVault recently.

“Moreover, both backdoors have functionalities that include features to allow them to upload and download files and navigate through files and directories in the affected system, providing them further means for their lateral movement and data exfiltration activities,” explained Macalintal.

The covert hacking of pro-Tibetan organisations is nothing new, given Communist China’s strained relationship with the country which it has asserted power over since the 1950s.

However, this latest discovery goes some way further to uncovering the true scale and sophistication of such attacks and creating a clearer picture of the actors behind Gh0st RAT. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2012/04/11/china_tibet_gh0st_rat_trojan/