STE WILLIAMS

Microsoft Patent Points to Snooping

A new Microsoft patent points towards Skype becoming equipped for lawful interception, which could be important as the service grows up to challenge traditional telcos.

The patent was filed back in 2009, but granted last week and picked up by Computerworld. Titled “Legal Intercept”, it covers one way in which a VoIP-based communications system might enable a call to be intercepted and covertly recorded, naming Skype as one of the services to which it could be applied.

Microsoft bought Skype back in May, but only received approval for the deal in June – so hasn’t had much time to do anything with the VoIP leader. Skype is hugely successful, with 170 million registered users, but it’s been very secretive about its protocols and security, refusing interoperability and asking users to just trust in Skype for their security.

That won’t wash in the real world, and neither will denying governments the right to listen in on their citizens. Most of us accept that security forces need to occasionally tap into phone lines, hopefully with suitable judicial oversight, but Skype’s apparent reluctance to permit such taps has resulted in rumours of secret deals and government-backed attacks on the cryptography used to protect Skype calls.

The patent describes how client, or network, software can be surreptitiously alerted that incoming and/or outgoing calls are to be monitored for a specific user. Such calls are then copied (packet by packet) to the monitoring server without the user being aware. The patent suggests the interception software could be placed in a NAT or router, but also incorporated into the VoIP client itself.

India has made it clear that Skype risks being kicked out of the country unless it sorts out some sort of lawful intercept capability, and other countries will be quick to follow India’s lead. So if Microsoft wants to see Skype spreading around the world then it will need to have just what’s described in the Legal Intercept patent.

Citizens aghast that their VoIP calls could be intercepted might be annoyed, but they’d be better off petitioning their governments, rather than raging against the companies trying to obey the law.

Ethical Hackers Kick A Whole In Microsoft Security Shield

In late December, Microsoft researchers responding to publicly posted attack code that exploited a vulnerability in the FTP service of IIS told users it wasn’t much of a threat because the worst it probably could do was crash the application.

Thanks at least in part to security mitigations added to recent operating systems, attackers targeting the heap-overrun flaw had no way to control data that got overwritten in memory, IIS Security Program Manager Nazim Lala blogged. It was another victory for Microsoft’s defense-in-depth approach to code development, which aims to make exploitation harder by adding multiple security layers.

However, it turned out that wasn’t the case. White-hat hackers Chris Valasek and Ryan Smith of security firm Accuvant Labs soon posted screenshots showing they had no trouble accessing parts of memory in the targeted machine that the protection – known as heap exploitation mitigation – should have made off limits. With that hurdle cleared, they had shown the IIS zero-day bug was much more serious than Microsoft’s initial analysis had let on.

“The point was proven that you could actually start to execute code, as opposed to them saying: ‘Don’t worry about it. It can only crash your server’,” Valasek, who is a senior research scientist for Accuvant, told The Register.

Up until now, their technique for bypassing the heap protection has been a mystery outside of a small circle of researchers. On Saturday, Valasek and Smith, the latter who is Accuvant’s chief research scientist, shared their secret at the Infiltrate security conference in Miami Beach.

Heap-exploitation mitigation made its Microsoft debut in Service Pack 2 of Windows XP, and has since been refined in later OSes. It works by detecting memory that’s been corrupted by heap overflows, and then terminating the underlying process. The technology was a significant advance for Microsoft. Practically overnight, an entire class of vulnerabilities that once allowed attackers to take full control of the targeted operating system were wiped out.

Running on the newer operating systems, the same exploits could do nothing more than crash the buggy application.

Valasek and Smith were able to bypass the mitigation because Microsoft’s reworked heap design also included a new feature known as LFH, or low fragmentation heap, which aims to improve speed and performance by providing a new way to point applications to free locations of memory. And for reasons that remain unclear, the new feature didn’t make use of the heap-exploitation mitigations.

“They opened up a new path for attackers, so it was great for attackers but bad for the end user,” Smith said. “The back door is locked, so we go in the front door.”

The LFH isn’t turned on by default, and it turns out that it often requires a lot of work for an attacker to enable it. In the case of December’s IIS vulnerability, they turned it on by invoking several FTP commands in a particular way. With that out of the way, they had no trouble controlling the memory locations on the targeted machine.

Valasek and Smith are quick to point out that bypassing the mitigations requires considerably more effort and skill on the part of the attacker. Five or 10 years ago, it was frequently possible for exploit developers to recycle huge amounts of code when writing a new script. That’s not the case now.

“Unlike other exploitation techniques of the past, you need to know more about the underlying operating system and the application that’s being run to figure out how to enable [LFH] and how to use it to your advantage,” Valasek said. “You can’t blindly go about your business.”

The talk is the latest reminder of the spy-versus-spy nature of security work, in which new protections developed by whitehats are constantly being defeated by blackhats, which then requires whitehats to come up with still newer protections. Researchers have similarly figured out ways to bypass other security mitigations, with techniques such as “JIT-spraying” for address space layout randomization and return oriented programming for data-execution prevention.

Still, the researchers said the mitigations are an essential part of software development – as long as engineers recognize their inherent limitations and don’t become complacent.

“As long as the mitigations are there to protect the end user and not to protect the company from having to patch, then they’re a good thing because it does make the job harder,” Smith said. “It’s a way to buy time.

Attacks on IE drive-by bug go wild

Microsoft on Tuesday warned that attackers have begun exploiting a critical vulnerability in Internet Explorer and rolled out a temporary fix until a permanent patch is issued.

The vulnerability in IE versions 6, 7 and 8, which involves the way the browser handles cascading style sheets, allows adversaries to perform drive-by malware attacks by luring victims to booby-trapped webpages. The exploits are triggered by recursive CSS pages, in which style sheets include their own addresses.

Microsoft confirmed the security flaw in late December. On Tuesday, it updated its advisory to reflect “reports of limited attacks attempting to exploit a vulnerability in all supported versions of Internet Explorer.”

Redmond also issued a workaround that large organizations can implement to protect themselves until a patch is released. It comes in the form of a Fix it that causes IE to reject CSS pages that contain the same URL as a style sheet that’s trying to load it.

“This change causes Internet Explorer to refuse to import a CSS style sheet if it has the same URL as the CSS style sheet from which it is being loaded,” Microsoft Security Response Center’s Keven Brown explained here. “Simply put, the workaround inserts a check to see if a style sheet is about to be loaded recursively, and if it so, it aborts the load of the style sheet.”

For the workaround to be effective, all existing security updates, particularly MS10-090 released on December 14, must be installed. The temporary fix causes a minor performance decrease – adding about 150 milliseconds to the browsers’ startup time – so it should be uninstalled once a patch is put in place. Third-party apps that work with IE should be thoroughly tested before putting the workaround into effect.

The workaround came on the first Patch Tuesday of 2011. As part of the regularly scheduled update release, Microsoft also issued two updates, one in the Windows Backup Manager and the other in Microsoft Data Access Components.

While it was one of the smallest Patch Tuesdays ever, it failed to address at least known vulnerabilities that put Microsoft users at risk. One of them allows attackers to remotely execute malicious code on machines running the XP, Server 2003, Vista, and Server 2008 versions of Windows. Exploit code for it is publicly available. The other, disclosed by Google researcher Michal Zalewski, leads to what he said was a “clearly exploitable crash.” ®

Ballmer Proposed $15bn Facebook Acquisition

Microsoft’s reported to have conceded it once tried to buy Mark Zuckerberg’s Facebook for $15bn.

Steve Ballmer, Microsoft’s chief executive, made two trips meet Zuckerberg at the company’s HQ in Palo Alto, California, where he popped the proposal during a long walk.

The tease Zuckerberg rebuffed Ballmer, as he wanted to keep control of Facebook according to a report here on TechCrunch.

Microsoft instead settled for a $240m investment in Facebook in October 2007, giving it 1.6 per cent of the company and the “opportunity to further collaborate as advertising partners.” Facebook at the time was calculated to be headed towards revenue of $150m.

Fritz Lanman, Microsoft’s senior director of corporate strategy and acquisitions, detailed the story on stage during discussion at the Le Web 2010 in Paris, France.

Lanman is the first person from Microsoft to confirm the company had tried to buy Facebook, a tale first told in David Kirkpatrick’s book The Facebook Effect.

Today, Microsoft has added Facebook to its Bing search engine and offered a version of web-based Word to Facebook users that’s called Docs.com.

You can soak up the full account of what went down on the long but frustrating walk here. ®