Wednesday, November 8, 2006

Google Accidentally Sends Out Kama Sutra Worm. Google Accidentally Sends Out Kama Sutra Worm. Staffers mistakenly e-mail the virus to subscribers of the Video Blog mailing list. [PC World: Latest Technology News] 11:06:35 PM

Exploit Released for Unpatched Apple Wi-Fi Flaw. Exploit Released for Unpatched Apple Wi-Fi Flaw. Update, 4:35 p.m. ET: Lynn Fox over at Apple called back with the following statement: "We were recently made aware of this security issue in our first generation AirPort card, which has not shipped since October 2003. This issue affects a small percentage of previous generation AirPort enabled Macs and does not affect currently shipping or AirPort Extreme enabled Macs. We are currently investigating the issue." Original Post From Earlier Today: Security researcher HD Moore today released computer code showing how attackers can exploit an unpatched flaw present in the wireless drivers in some Apple Macintosh computers. "With all the hype and buzz about the now infamous Apple wireless device driver bugs (brought to attention at Black Hat, by Johnny Cache and David Maynor, covered up and FUD'ed by others), hopefully this will bring some light (better said, proof) about the existence of such flaws in the Airport device drivers," said LMH (the alias of the hacker who runs the Kernelfun blog) -- referring to an Apple wireless driver issue covered by Security Fix earlier this year (the links in the quote are his). Moore said he tested the exploit on a 1.0Ghz PowerBook running Mac OS X 10.4.8 with the latest updates (Halloween, 2006). "The fastest way to trigger this bug is to place the card into active scanning mode. This can be accomplished by launching Kismac [a wireless network scanning program] with the active scanning driver, or by using the 'airport' utility provided with OS X." While Apple released updates in September to fix at least three problems in its wireless drivers, there is currently no fix available from Apple for the flaw detailed by Moore. I exchanged a series of e-mails with Moore today to ask about some of this exploit's more technical details, which can be viewed here for anyone interested. In a nutshell, he says the exploit is somewhat unreliable as written, but that it could be made more so if someone spent a bit more time finessing it. He also said "it may be possible to make this exploit reliable by hammering the Airport driver with requests while triggering the bug." Moore has since folded the exploit into Metasploit 3.0, a free software tool built to help users exploit security flaws against a variety of operating systems and third-party software applications. The vulnerability is the first in a series of daily bug details to be released over the next 29 days as part of the "Month of Kernel Bugs" project. LMH said we can expect at least five more Apple kernel bugs to be detailed in the coming days, as well as kernel flaws in Linux, BSD, and Solaris 10 systems. The "kernel" is probably the most vital and fundamental area of any computer system, as it handles the transfer of information between hardware and software on a machine, among other things. Kernel flaws are serious vulnerabilities, but kernel flaws that are exploitable remotely are extremely dangerous, because an attacker can use them to completely subvert the security of the target machine, usually regardless of the presence of security software or the system privileges of the user account the victim happens to be running at the time. I put a call in to Apple spokeswoman Lynn Fox and will update this post if I hear back from the company. I also pinged David Maynor from SecureWorks to determine if this was related to the exploit I saw at the BlackHat security conference in Las Vegas this summer, but I've not yet received a response from him either. I did catch up with Maynor's co-presenter, Johnny "Cache" Ellch, who said the bug Moore released today is unrelated to the flaw detailed at Black Hat. [Security Fix] 8:58:53 PM

Microsoft Warns of More "Zero-Day" Exploits. Microsoft Warns of More "Zero-Day" Exploits. Microsoft Corp. is warning Windows users to be on guard against a couple of unpatched security holes in its products that criminal hacking groups are actively exploiting. According to an advisory issued on Friday, Microsoft's implementation of XML contains a flaw that bad guys can use to compromise Windows machines just by getting them to visit certain Web sites with Internet Explorer. The other problem, covered by an advisory released last Tuesday, resides in Microsoft's Visual Studio 2005 and is similarly exploitable. Microsoft has had a tough time this year with so-called "zero-day" (or 0day) attacks -- those in which the bad guys leverage a previously undocumented software security hole to compromise computers hooked up to the Internet. Last year, Microsoft had to deal with just four zero-day attacks. From January through October of 2006, the company has had to chase down no fewer than 14 such attacks by my count, with most surfacing just after Microsoft's regularly scheduled monthly software patch release. Now it looks like we can add two more to that number. Last week, Security Fix wrote about the "Month of Kernel Bugs" project, which promises to present proof of a new, undocumented security hole for each day of November. Today's bug is one that was actually reported to Microsoft back in Oct. 2004, according to Cesar Cerrudo from Argeniss, the guy credited with discovering the vulnerability. [Security Fix] 8:45:59 PM

Malicious Code Injection: Itís Not Just for SQL Anymore. Malicious Code Injection: It's Not Just for SQL Anymore. Bryan Sullivan contributes this paper discussing injecting data beyond SQL, LDAP and XPath as examples, and what one can do to protect themselves. By Bryan Sullivan. [Infosec Writers Latest Security Papers] 8:44:08 PM

© Copyright 2006 Paul Hardwick. Last update: 12/6/06; 5:31:59 AM.