×

Announcing: Slashdot Deals - Explore geek apps, games, gadgets and more. (what is this?)

Thank you!

We are sorry to see you leave - Beta is different and we value the time you took to try it out. Before you decide to go, please take a look at some value-adds for Beta and learn more about it. Thank you for reading Slashdot, and for making the site better!

Comments

msm1267 hasn't commented recently.

Submissions

top

Misfortune Cookie Home Router Vulnerability Discovered

msm1267 msm1267 writes  |  3 days ago

msm1267 (2804139) writes "More than 12 million devices running an embedded webserver called RomPager are vulnerable to a simple attack that could give a hacker man-in-the-middle position on traffic going to and from home routers from just about every leading manufacturer.

Mostly ISP-owned residential gateways manufactured by D-Link, Huawei, TP-Link, ZTE, Zyxel and several others are currently exposed. Researchers at Check Point Software Technologies reported the flaw they’ve called Misfortune Cookie, to all of the affected vendors and manufacturers, and most have responded that they will push new firmware and patches in short order.

The problem with embedded device security is that, with consumer-owned gear especially, it’s up to the device owner to find and flash new firmware, leaving most of the devices in question vulnerable indefinitely.

In the case of the RomPager vulnerability, an attacker need only send a single packet containing a malicious HTTP cookie to exploit the flaw. Such an exploit would corrupt memory on the device and allow an attacker to remotely gain administrative access to the device."

Link to Original Source
top

Manufacturer Backdoor Found on Popular Chinese Android Smartphones

msm1267 msm1267 writes  |  4 days ago

msm1267 (2804139) writes "A popular Android smartphone sold primarily in China and Taiwan but also available worldwide, contains a backdoor from the manufacturer that is being used to push pop-up advertisements and install apps without users’ consent.

The Coolpad devices, however, are ripe for much more malicious abuse, researchers at Palo Alto Networks said today, especially after the discovery of a vulnerability in the backend management interface that exposed the backdoor’s control system.

The CoolReaper backdoor not only connects to a number of command and control servers, but is also capable of downloading, installing and activating any Android application without the user’s permission. It also sends phony over-the-air updates to devices that instead install applications without notifying the user. The backdoor can also be used to dial phone numbers, send SMS and MMS messages, and upload device and usage information to Coolpad.

The manufacturer has also taken steps via modifications to its version of Android to keep the backdoor hidden from users and security software that could be installed on the phone. For example, Olson said Coolpad has disabled the long-press system that allows a user to find out what application generated an pop-up advertisement or notification, for example."

Link to Original Source
top

Shellshock Worm Exploiting Unpatched QNAP NAS Devices

msm1267 msm1267 writes  |  about a week ago

msm1267 (2804139) writes "A worm exploiting network attached storage devices vulnerable to the Bash flaw is scanning the Internet for more victims.

The worm opens a backdoor on QNAP devices, but to date it appears the attackers are using the exploit to run a click-fraud scam, in addition to maintaining persistence on owned boxes.

“The goal appears to be to backdoor the system, so an attacker could come back later to install additional malware,” said Johannes Ullrich, head of the Internet Storm Center at the SANS Institute.

QNAP of Taiwan released a patch in October for the Bash vulnerability in its Turbo NAS products. Like many other vulnerable products and devices, owners may not be aware that Bash is present and exposed. Bash was among a litany of Internet-wide vulnerabilities uncovered this year; the flaw in Bash, or Bourne Again Shell, affects Linux and UNIX distributions primarily, but also Windows in some cases. Bash is accessed, often quietly, by any number of functions which makes comprehensive patching difficult even though all major Linux distributions and most vendors have issued patches."

Link to Original Source
top

'Lax' Crossdomain Policy Puts Yahoo Mail At Risk

msm1267 msm1267 writes  |  about two weeks ago

msm1267 (2804139) writes "A researcher disclosed a problem with a loose cross-domain policy for Flash requests on Yahoo Mail that put email message content, contact information and much more at risk. The researcher said the weakness is relatively simple to exploit and puts users at high risk for data loss, identity theft, and more.

Yahoo has patched one issue related to a specific .swf file hosted on Yahoo’s content delivery network that contained a vulnerability that could give an attacker complete control over Yahoo Mail accounts cross origin. While the patch fixed this specific issue, the larger overall configuration issue remains, meaning that other vulnerable .swf files hosted outside the Yahoo CDN and on another Yahoo subdomain could be manipulated the same way."

Link to Original Source
top

Destover Malware Signed with Legit Sony Certificate

msm1267 msm1267 writes  |  about two weeks ago

msm1267 (2804139) writes "Researchers have discovered a new version of the Destover malware that was used in the recent Sony Pictures Entertainment breaches, and in an ironic twist, the sample is signed by a legitimate certificate stolen from Sony.

The new sample is essentially identical to an earlier version of Destover that was not signed. Destover has been used in a variety of attacks in recent years and it’s representative of the genre of malware that doesn’t just compromise machines and steal data, but can destroy information as well. The attackers who have claimed credit for the attack on Sony have spent the last couple of weeks gradually releasing large amounts of information stolen in the breach, including unreleased movies, personal data of Sony employees and sensitive security information such as digital certificates and passwords.

The new, signed version of Destover appears to have been compiled in July and was signed on Dec. 5, the day after Kaspersky Lab published an analysis of the known samples of the malware."

Link to Original Source
top

DOJ Launches New Cybercrime Unit, Claims Privacy Top Priority

msm1267 msm1267 writes  |  about two weeks ago

msm1267 (2804139) writes "Leslie Caldwell, assistant attorney general in the criminal division of the Department of Justice announced on Thursday the creation of a new team within its Computer Crime and Intellectual Property Section (CCIPS) during a talk at a Georgetown Law conference titled, “Cybercrime 2020: The Future of Online Crime and Investigations.” Known as the Cybercrime Unit, the team is tasked with enhancing public-private security efforts.

A large part of the Cybersecurity Unit’s mission will be to quell the growing distrust many Americans have toward law enforcement’s high-tech investigative techniques. Even if that lack of trust, as Caldwell claimed, is based largely on misinformation about the technical abilities of the law enforcement tools and the manners in which they are used.

“In fact, almost every decision we make during an investigation requires us to weigh the effect on privacy and civil liberties, and we take that responsibility seriously,” Caldwell said. “Privacy concerns are not just tacked onto our investigations, they are baked in.""

Link to Original Source
top

Regin Attack Platform Targets GSM Networks Too

msm1267 msm1267 writes  |  about a month ago

msm1267 (2804139) writes "Researchers have uncovered a complex espionage platform reminiscent of Duqu that has been used since at least 2008 not only to spy on and extract email and documents from government agencies, research institutions and banks, but also one that targets GSM network operators in order to launch additional attacks.

Kaspersky Lab published a report this morning that explains this aspect of the Regin attack platform, which has been detected on the Windows computers of 27 victimized organizations in 14 countries, most of those in Asia and the Middle East. In addition to political targets, Kaspersky Lab researchers identified Belgian cryptographer Jean Jacques Quisquater as one of its specific victims, along with an unnamed research institution that was also infected with other dangerous espionage malware including Mask/Careto, Turla, Itaduke and Animal Farm."

Link to Original Source
top

Open Source Detekt Antispyware Tool Exposes Surveillance

msm1267 msm1267 writes  |  about 1 month ago

msm1267 (2804139) writes "Human rights workers, political activists and journalists working in oppressed parts of the world now have an open source detection tool that helps them triage their computers and scan for the worst of the worst state-sponsored spyware.

Detekt, built by independent white hat Claudio Rainieri in partnership with the EFF, Amnesty International and others, scans for FinFisher and HackingTeam spyware, as well as the most prevalent remote access Trojans, such as BlackComet and Extreme.

It's not meant as a substitute for antivirus, but more about giving someone under state surveillance--a desperate, emergency situation--a free utility to figure out what's happening on their machine and how to proceed next."

Link to Original Source
top

Microsoft Releases Emergency Patch for Kerberos Bug Under Attack

msm1267 msm1267 writes  |  about a month ago

msm1267 (2804139) writes "Microsoft today released an out-of-band security bulletin patching a critical vulnerability in Kerberos implementations that is being exploited in targeted attacks. The vulnerability enables a hacker to escalate privileges on a compromised computers to domain administrator.

Originally, Microsoft planned to release the patch for this vulnerability, MS14-068, on Nov. 11, with the rest of the month’s Patch Tuesday fixes. However, the patch was not included in that release. No reason was given for the omission, but in the past Microsoft has delayed patches that weren’t ready yet or caused problems in testing. The MS14-068 vulnerability is rated critical and the company is urging users to install the patch right away."

Link to Original Source
top

Internet Voting Hack Alters PDF Ballots in Transmission

msm1267 msm1267 writes  |  about a month ago

msm1267 (2804139) writes "Threats to the integrity of Internet voting have been a major factor in keeping the practice to a bare minimum in the United States. On the heels of the recent midterm elections, researchers at Galois, a computer science research and development firm in Portland, Ore., sent another reminder to decision makers and voters that things still aren’t where they should be.

Researchers Daniel M. Zimmerman and Joseph R. Kiniry published a paper called “Modifying an Off-the-Shelf Wireless Router for PDF Ballot Tampering” that explains an attack against common home routers that would allow a hacker to intercept a PDF ballot and use another technique to modify a ballot before sending it along to an election authority.

The attack relies on a hacker first replacing the embedded Linux firmware running on a home router. Once a hacker is able to sit in the traffic stream, they will be able to intercept a ballot in traffic and modify code strings representing votes and candidates within the PDF to change the submitted votes."

Link to Original Source
top

Microsoft Patches OLE Zero-Day Vulnerability

msm1267 msm1267 writes  |  about a month ago

msm1267 (2804139) writes "Microsoft today released a patch for a zero-day vulnerability under active exploit in the wild. The vulnerability in OLE, or Microsoft Windows Object Linking and Embedding, enables a hacker to remotely execute code on an infected machine, and has been linked to attacks by the Sandworm APT group against government agencies and energy utilities.

Microsoft also issued a massive Internet Explorer patch, but warned organizations that have deployed version 5.0 of its Enhanced Mitigation Experience Toolkit (EMET) to upgrade to version 5.1 before applying the IE patches. Version 5.1 resolves some compatibility issues, in addition to several mitigation enhancements."

Link to Original Source
top

WireLurker Mac OS X Malware Shut Down

msm1267 msm1267 writes  |  about a month and a half ago

msm1267 (2804139) writes "WireLurker is no more. After causing an overnight sensation, the newly disclosed family of Apple Mac OS X malware capable of also infecting iOS devices has been put to rest. Researchers at Palo Alto Networks confirmed this morning that the command and control infrastructure supporting WireLurker has been shut down and Apple has revoked a legitimate digital certificate used to sign WireLurker code and allow it to infect non-jailbroken iOS devices.

Researchers at Palo Alto Networks discovered and dubbed the threat WireLurker because it spreads from infected OS X computers to iOS once the mobile device is connected to a Mac via USB. The malware analyzes the connected iOS device looking for a number of popular applications in China, namely the Meitu photo app, the Taobao online auction app, or the AliPay payment application. If any of those are found on the iOS device, WireLurker extracts its and replaces it with a Trojanized version of the same app repackaged with malware.

Patient zero is a Chinese third-party app store called Maiyadi known for hosting pirated apps for both platforms. To date, Palo Alto researchers said, 467 infected OS X apps have been found on Maiyadi and those apps have been downloaded more than 350,000 times as of Oct. 16 by more than 100,000 users."

Link to Original Source
top

Researcher Takes Wraps Off Undisclosed Bash Vulnerabilities

msm1267 msm1267 writes  |  about 3 months ago

msm1267 (2804139) writes "The Bash bug has kept Linux and UNIX administrators busy deploying a half-dozen patches, worrying about numerous Shellshock exploits in the wild, and a laboring over a general uncertainty that the next supposed fix will break even more stuff.

Researcher Michal Zalewski, a longtime bug-hunter, has been front and center on some of the Bash research and last week said he had found two additional bugs in the Bourne Again Shell, details of which he’d kept to himself until yesterday.

Zalewski took the wraps off the vulnerabilities, one of which, CVE-2014-6278, mimics the original vulnerability reported Sept. 24 but affects only systems patched against the original Bash vulnerability, CVE-2014-6271.

Like the original vulnerability, CVE-2014-6278 allows an attacker to remotely drop executable code by exploiting a weaknesses in environment variables in Bash, which is the most common command line shell used by Linux, UNIX and Mac OS X servers."

Link to Original Source
top

SNMP DDoS Scans Spoof Google DNS Server

msm1267 msm1267 writes  |  about 3 months ago

msm1267 (2804139) writes "The SANS Internet Storm Center is seeing SNMP scans spoofed from Google’s public recursive DNS server seeking to overwhelm vulnerable routers and other devices that support the protocol with DDoS traffic.

“The traffic is spoofed, and claims to come from Google’s DNS server. The attack is however not an attack against Google. It is likely an attack against misconfigured gateways,” said Johannes Ullrich, dean of research of the SANS Technology Institute and head of the Internet Storm Center.

Ullrich said the ISC is still investigating the scale of the possible attacks, but said the few packets that have been submitted target default passwords used by SNMP. In an update posted last night, Ullrich said the scans are sequential, indicating someone is conducting an Internet-wide scan looking for vulnerable routers and devices that accept certain SNMP commands."

Link to Original Source
top

Inside a Critical Webmin Vulnerability

msm1267 msm1267 writes  |  about 3 months ago

msm1267 (2804139) writes "The University of Texas information security office yesterday disclosed the details on a critical vulnerability in Webmin that was patched in May, days after it was reported.

The bug in the UNIX remote management tool provided remote root access to a host server. Authenticated users would then be able to delete files stored on the server. Researcher John Gordon published a report yesterday on the UT ISO website explaining that the problem was discovered in the cron module’s new environment variable. Gordon wrote that an attacker would have been able to use directory traversal and null byte injection techniques to force Webmin to delete any file stored on the system.

The vulnerability, Gordon said, likely cannot be flipped into an attack granting someone remote shell access or code execution on a standard Linux server, for example."

Link to Original Source
top

Research Finds No Large Scale Heartbleed Exploit Attempts Before Disclosure

msm1267 msm1267 writes  |  about 3 months ago

msm1267 (2804139) writes "In the days and weeks following the public disclosure of the OpenSSL Heartbleed vulnerability in April, security researchers and others wondered aloud whether there were some organizations–perhaps the NSA–that had known about the bug for some time and had been using it for targeted attacks. A definitive answer to that question may never come, but traffic data collected by researchers on several large networks shows no exploit attempts in the months leading up to the public disclosure.

Researchers from the University of Michigan, the University of Illinois, the University of California at Berkeley , Purdue University and the International Computer Science Institute took a comprehensive look at the way that the Heartbleed vulnerability affected the Internet as a whole in the months since it was disclosed in April, focusing mainly on the response by organizations to patch vulnerable servers and revoke certificates. As the scope and effect of the Heartbleed vulnerability set in, security teams scrambled to determine which of their servers were vulnerable to the issue and whether they needed to begin revoking a bunch of SSL certificates, as well. Many of the top sites on the Internet were patched almost immediately after the disclosure, but that didn’t extend to the rest of the vulnerable server population."

Link to Original Source
top

Mozilla 1024-Bit Cert Deprecation Leaves 107,000 Sites Untrusted

msm1267 msm1267 writes  |  about 4 months ago

msm1267 (2804139) writes "Mozilla has deprecated 1024-bit RSA certificate authority certificates in Firefox 32 and Thunderbird. While there are pluses to the move such as a requirement for longer, stronger keys, at least 107,000 websites will no longer be trusted by Mozilla.

Data from HD Moore's Project Sonar, which indexes more than 20 million websites, found 107,535 sites using a cert signed by what will soon be an untrusted CA certificate. Grouping those 107,000-plus sites by certificate expiration date, the results show that 76,185 certificates had expired as of Aug. 25; of the 65 million certificates in the total scan, 845,599 had expired but were still in use as of Aug. 25, Moore said."

Link to Original Source
top

Enumerating Android Apps Failing to Validate SSL

msm1267 msm1267 writes  |  about 4 months ago

msm1267 (2804139) writes "A growing compilation of close to 350 Android applications that fail to perform SSL certificate validation over HTTPS has been put together by the CERT Coordination Center at the Software Engineering Institute at Carnegie Mellon University.

Researcher Will Dormann created a large spreadsheet hosted on the CERT/CC site listing Android applications found on both the Google play and Amazon stores that fail to validate digital certificates, leaving them exposed to man-in-the-middle attacks.

Dormann said the spreadsheet is a living document and more applications are currently being tested and will be added to the list. Most of the apps on the list are currently available in the respective app stores. The apps ran the gamut from games, to music, productivity and everything in between. If available, a CVE number is provided for each app, as well as a notation of whether credentials are weak or are otherwise at risk."

Link to Original Source
top

IEEE Guides Software Architects Toward Secure Design

msm1267 msm1267 writes  |  about 4 months ago

msm1267 (2804139) writes "The IEEE's Center for Secure Design debuted its first report this week, a guidance for software architects called "Avoiding the Top 10 Software Security Design Flaws." Developing guidance for architects rather than developers was a conscious effort the group made in order to steer the conversation around software security away from exclusively talking about finding bugs toward design-level failures that lead to exploitable security vulnerabilities.
The document spells out the 10 common design flaws in a straightforward manner, each with a lengthy explainer of inherent weaknesses in each area and how software designers and architects should take these potential pitfalls into consideration."

Link to Original Source
top

Tor Browser Security Under Scrutiny

msm1267 msm1267 writes  |  about 4 months ago

msm1267 (2804139) writes "The keepers of Tor commissioned a study testing the defenses and viability of their Firefox-based browser as a privacy tool. The results were a bit eye-opening since the report’s recommendations don’t favor Firefox as a baseline for Tor, rather Google Chrome. But Tor’s handlers concede that budget constraints and Chrome’s limitations on proxy support make a switch or a fork impossible."
Link to Original Source

Journals

msm1267 has no journal entries.

Slashdot Login

Need an Account?

Forgot your password?