Net Nanny Brings SSL Connections At Risk

Users of Net Nanny, a popular product for parental control, risk attackers intercept traffic to HTTPS sites and eavesdropping, or that they are undetected to phishing sites so warns the CERT Coordination Center (CERT / CC) at Carnegie Mellon university. To the SSL traffic to monitor computers install Net Nanny a Man-in-the-Middle proxy, as well as their own root CA certificate.

Net Nanny for all installations appears to use the same certificate. In addition, the private key of the certificate directly from the software to retrieve. An attacker could use the private key to generate new certificates that Net Nanny will just trust. A user will be alerted in this case if it goes to a malicious HTTPS site as Net Nanny trust the rogue SSL certificate.

The vulnerability has been found in Net Nanny 7.2.4.2 but other versions may be vulnerable. At present, according to the CERT / CC not yet practical solution. However, users can choose to disable SSL filtering and removing the license or uninstall Net Nanny. The problem is similar to that of Super Fish. The adware that was installed on Lenovo laptops and also installed its own certificate allowing users at risk.

Tor Is Looking For Students Who Want To Develop Privacy Tools

After years of having participated in a Google initiative where students were paid to the development of open source software, have the Tor Project, known from the Tor anonymizing network, and the American civil rights movement EFF now decided to launch an initiative in which students from all over the world are paid for the further development of the Tor privacy tools.

From 2007 to the Tor Project participated last year in the Google Summer of Code . Google paid for several months, students who wanted to contribute to open source software projects. So the students could gain practical experience, while the open source projects could benefit from the extra programming power. The size of the Google initiative has been adjusted, allowing Gate and the EFF not participate this year.

It was then decided to start his own initiative, called Tor Summer of Privacy . Students from all over the world, also from the Netherlands can apply for one of the available spots. For every student is a grant of $ 5,000 available. The idea is that students, under the supervision of a mentor, existing Tor privacy tools or develop their own ideas to improve the software.Registration is possible until April 17th. On 25 May, the Summer of Privacy start to finish then on 1 September.

Google Relaxes Deadline For Revealing Leaks

Google has the deadline that applies to vulnerabilities to reveal something more flexible in the products of other software companies. Since last year, the search giant puts a team of hackers called Project Zero that is actively looking for vulnerabilities in widely used programs.

Once a vulnerability is found getting the informed supplier 90 days to come up with a patch, otherwise Google will automatically reveal the details. Much to the annoyance of Microsoft, which in one case after 92 days came with an update.The software giant Google had asked for the details after the release of the update to disclose, but no reply was given.Therefore users would have run unnecessary risks.

Now, Google announced that it will somewhat lenient policy. If a deadline expires on a weekend or US holidays, the deadline for the next working day will be postponed. In addition, there is a grace period of 14 days. If the deadline of 90 days expires but the supplier in the next 14 days say they come with an update, the details will appear only after the release of the patch.

"The publication of a non-issue patches will now only take place if the deadline is missed more than two weeks," said Chris Evans of the Project Zero team. The new rules apply not only to the research team at Google, but for all the parts and members of the search giant who discover vulnerabilities in software from other parties.

Despite criticism from some parties that the deadline is certainly successful, suggests Evans. Most vulnerabilities Project Zero discovered were found in Adobe Flash Player. All 37 reported vulnerabilities in Adobe were patched within the deadline of 90 days. In total discovered Project Zero 154 vulnerabilities, of which 85% were resolved within the deadline.

In the case of the 73 leaks that were reported to suppliers after October 1, 2014 even it comes to 95%. And as it looks now, there will be no missed deadlines in February. "Deadlines seem to work to improve the patch time and safety for users, especially if they are consistently maintained," Evans says.

CERT / CC Warns BIOS Flaw in Intel Chipsets

The CERT Coordination Center (CERT / CC) at Carnegie Mellon University has warned of a vulnerability in the Intel chipsets making it possible to adjust the BIOS to circumvent Secure Boot and damage the firmware of the motherboard so that the system will not work anymore. In addition, there is also warned of a vulnerability in various UEFI systems. Both vulnerabilities were demonstrated during the recent CCC conference in Hamburg.

The first issue ( pdf ) is located in the Intel chipsets that use a particular way to the BIOS (Basic Input / Output System and the first major software running when you start the computer) to protect against writing. The vulnerability is possible to bypass this protection and yet to make adjustments. A local attacker with access to the system can then write malicious code to the firmware of the computer.

It is also possible if a certain variable is set, which is the case in many implementations, in order to circumvent the security measure Secure Boot. Secure Boot is a feature that only with a valid digital signature software loads on startup. Finally, an attacker could also damage the computer's firmware, so that will not boot.

The problem is at least in American Megatrends Incorporated (AMI) and Phoenix Technologies. These are manufacturers whose BIOS / UEFI software is used by a large number of computers. Or manufacturers such as Asus, Dell, HP, Intel, Sony and Toshiba are vulnerable is unknown. The CERT / CC currently has no concrete solution for owners of an affected system.

Unified Extensible Firmware Interface (UEFI)

In addition to the above problem, researchers found Corey Kallenberg and Rafal Wojtczuk a vulnerability ( pdf ) in UEFI firmware of many computers. UEFI is a new model for the interface between the computer's operating system and firmware of the platform. It is used in almost all modern computers. A vulnerability in the UEFI firmware allows a local attacker to access the "boot script" can get to then bypass the write protection.

After this it is possible to bypass Secure Boot or modify the firmware of the computer, even if that just signed firmware to accept. Like the problem with the Intel chipsets may now be corrupted firmware so that the computer will not start. This problem is at least in AMI, Intel and Phoenix Technologies. Again given no concrete action perspective and highlights the CERT / CC for information from the respective vendors.

Google discovered critical vulnerability in UnZip

A researcher of the Google Security Team has a critical vulnerability in UnZip discovered, an open source tool to tackle them from files. Due to an error in the cyclic redundancy check (CRC), it is possible to cause a buffer overflow that may allow an attacker to run arbitrary code on the computer. CRC is correct a check for detecting errors.

To carry out the attack, an attacker the victim or a specially prepared zip file via the command unzip -t leave open. Google adheres next to the search for vulnerabilities in their own software too busy checking open source software. The leak was reported on December 3 by researcher Michele Spagnuolo.

On the same day, there appeared the UnZip administrator update, followed by a second update later that day. A week later warned were all affected suppliers using UnZip, after yesterday's advisory appeared online. The leak is present in UnZip 6.0 ​​and older. The last update of the program dates from April 2009.

The Ins and Outs of ransomware

Malware researcher Bart Blaze has published an extensive article about ransomware on his blog. In the article he interviews a number of anti-malware experts who give their opinion on the current trends and the evolution of ransomware.

The following experts shared their insights:

• Malware researcher Malekal
• Adam Kujawa - Malwarebytes Head of Malware Intelligence
• Fabio Assolini - Kaspersky Senior Security Researcher
• Fabian Wosar - Emsisoft GmbH Administration / Development
• Hendrik Adrian - MalwareMustDie Security Research Group

Experts

The experts will discuss, among other things: their first acquaintance with ransomware, the psychological aspect of ransomware, how ransomware spreads, how effective it is in practice, and last but not least, how can one protect against this specific type of malware.

The experts agree on one thing: the first versions of ransomware were quite primitive but very effective. Over the years it has evolved greatly ransomware and cybercriminals are earning millions of dollars with it. The reason that this type of malware is so fast becoming popular is the fact that ransomware savings than "rogueware" (fake antivirus software), and in particular the variants encrypt files, such as Crypto Locker more money.

"Ransomware as Crypto Locker is currently more efficient than the FBI called Ransomware because almost everyone knows this form now. When the FBI was everyone thought it was legitimate, variant first spotted" explains Adam Kujawa out. "I can not give you exact percentages because I do not have it, but the golden rule is that when a particular attack vector of attack strategy is reused, meaning that the tactic is effective and therefore works. We now identify malware like Prison Locker (or Power Locker ) due to the success of Crypto Locker, just as we saw hundreds of variants and families of the FBI Ransomware in 2012. "

Recommendations

The article also contains several recommendations for both end users and companies. How can one protect against ransomware and what can one do when a computer is infected.

End users

For end users, it comes down to the following: keep all your software up to date, install an antivirus program, remove unused software (eg Java), install security add-ons such as NoScript in the browser (and update it also ), no download applications via spam or suspicious or unknown websites and make backups (and disconnect the external drive after taking the backup).

Companies

For companies, the recommendations are as follows: Use strong passwords for servers, RDP switch off if possible, use a spam filter, using group policies, limit the rights of users, instruct your users and also applies here: make backups.

Never pay

Victims of ransomware should certainly never proceed to payment. There is no guarantee that the cyber criminals the files or accessing the computer will recover. Maybe you even more vulnerable to a new attack, the cyber criminals will know after all that you will pay. By following the recommendations, however, you reduce the chance of becoming a victim already drastically.

Do you want more information, detailed advice and tips, then read the article at Blaze's Security Blog.