After several have leaks in Windows unveiled at a time that no security updates, Google has the same now done with Mac OS X. In total there are three vulnerabilities, allowing an attacker commands as a "system daemon" execute through ' kernel code execution 'root privileges can get or through a Bluetooth device memory corruption can cause.
One of the vulnerabilities has been tested on Mac OS X 10.9.5, while another only at Yosemite is confirmed. Leaks are detected by the "Project Zero Team" of Google, which is looking specifically for vulnerabilities in commonly used software.Once a leak is found will the supplier 90 days to come up with an update, otherwise the details of the vulnerability are automatically made public. Much to the dissatisfaction of Microsoft, which Google called to work better together. Apple has not yet responded to the leak revealed.
A security researcher yesterday evening a leak in different routers manufacturer Asus unveiled the device whereby a local attacker can take over completely and for which no security update is available.The vulnerability is caused by a service called infosvr on UDP port 9999 is listening on the LAN interface.
The service is used by a tool from Asus and should make it easier to set the router to automatically search for routers on the local subnet. Infosvr however shows the MAC address of an application is not good to check. Therefore an attacker to bypass authentication and by sending a packet to UDP port 9999 arbitrary commands to the router.
The vulnerability is present in the Asus RT-AC66U, RT-N66U and other models with the latest firmware. Researcher Joshua Drake discovered the problem advises to remove the ability to remotely execute commands on the router. "Even with strong authentication is sending a password over the LAN is not really desirable." Who still wants to have remote access can do this better over SSH notes the researcher.
Pending to update users have different capabilities. To set David Longenecker for order infosvr service off during startup. via script Eric Sauvageau recommends firewalling port 9999 and Drake gives itself as an option to disable the infosrv service after boot. Something which ironically can be done via the exploit that allows the leak abuse.
Approximately 75% of the PHP installation is unsafe, so the popular scripting language is one of the most unsafe platforms. That suggests Anthony Ferrara , "developer advocate" at Google. Ferrara had recently written an article about what it means to be a responsible developer.
PHP is one of the most popular programming languages and Google employee also wanted to know how many percent of the plant is safe. He used the statistics W3Techs and correlated that with the versions that are managed by well-known Linux distributions. Users can install PHP namely itself or use the version offered by the Linux distribution used.
Then turns out 78.3% of the PHP installations at least include one or more vulnerabilities, while 21.7% identified as being safe. Ferrara says that the percentage of safe installations still high estimated because installations of PHP 5.4.4 on Debian, which is still supported, can not be distinguished from 5.4.4 installations that are not derived from Debian and are no longer supported. The percentage of 21.7% by Ferrara also described as "optimistic".
"It is totally unacceptable. This means that more than 78% have at least one vulnerability of the PHP installations. Sadly," concludes Ferrara. He calls on everyone to monitor his or her PHP installation. "Do not force people to update. Do not accept" if it works, do not fix it .'... You have the power to change it, so change it. Security is a problem for everyone. What is important is how you handle it. "
The investigation of the Google employee received the necessary attention and he decided to out for other platforms run it, as well as PHP, this time with Fedora and PHP 4.5.34 on Debian 7 were counted. Then it appears that 82.3% of the installations of the Perl programming language is safe. In the case of the Python programming language is about 77.6%. Ultimately, the recount of PHP, which Debian 7 extra is included, a slightly higher percentage of secure PHP installations, namely 25.6%. That would still mean that sure 74.4% of the installations is unsafe.
A researcher has managed to execute malicious code on the Facebook servers by uploading a specially prepared Word document. The vulnerability was on Facebooks career website where people who want to work with Facebook to upload their CV as pdf or docx document. Researcher Mohamed Ramadan , however, knew docx files actually are zipped XML files.
He opened his cv.docx with zip utilities 7zip and discovered several XML files. Then he added code so that the server of Facebook connection with his server would. Initially Ramadan thought his code did not work, until he saw that after a quarter of a server Facebook indeed made its server connection.
According to the investigator, he could make use of it in various ways, such as performing a Denial of Service, TCP-scans and other commands. Facebook initially thought there was no problem and that a recruiter file cv.docx had opened and had clicked on the link. However, not much later the social networking site that it indeed was a vulnerability, which has now been resolved. Ramadan received for his bug melding an amount of 6300 dollars.
Researchers at Google have critical vulnerabilities in the Network Time Protocol (NTP) allowing attackers discovered on systems that use NTP can execute code. NTP is a protocol that allows systems to synchronize the time for different services and applications.
It is used among other things on a large scale industrial systems. Neel Mehta and Stephen Roettger of the Google Security Team discovered several vulnerabilities in the protocol. In the worst case, an attacker by sending a single packet to cause a buffer overflow, and it is now possible to carry out on the attacked system code with the rights of the NAP-process. This vulnerability is present in all versions of NTP NTP-4.2.8.
Before warn the the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) of the US Government, the US Computer Emergency Readiness Team ( US-CERT ) and the CERT Coordination Center ( CERT-CC ) at Carnegie Mellon University. Administrators also are advised to upgrade to NTP 4.2.8. Furthermore, this version fixes vulnerabilities in the random number generator allow an attacker to retrieve certain information. Exploits that make the leak abuse have been found on the Internet, according to the ICS-CERT
The FBI has used a component of the popular Metasploit hacking tool to identify Tor users. Metasploit is a tool that penetration testers and security experts test the safety of systems and networks. It is now being developed and managed by security company Rapid7.
Wired reports that the FBI in 2012 set in part of Metasploit to successfully identify different Tor users through Adobe Flash Player. The US investigation department made use of an abandoned Metasploit project called " Decloaking Engine ". It was one in 2006 developed experimental concept where multiple tricks were used to identify users of a service such as Tor anonymity via a specially crafted Web site. In case the Tor user had his installation secure he could not be identified through the website. However, if users made a mistake their real IP address is visible.
Flash Player
One of the tricks was the use of a Flash application. Adobe Flash Player can set up a direct connection to the Internet and thus leak the IP address of the user. A known problem and the Tor Project advises users therefore not to install Flash Player. Finally appeared in 2011, a version of the Tor Browser, the software to access the Tor network, allowing users were better protected and the test site that was set up for the Decloacking Engine almost no users identified more.
However, the FBI used Decloaking Engine as a basis for an operation against child pornography sites on the Tor network. The investigation department had access to several of these sites and then let them run Flash programs in visitors' browsers in order to determine their true IP address. A total of 25 users in the United States were identified and an unknown number elsewhere. According to Wired is to use the first time the FBI spyware-like software to all visitors of a website started in place against certain individuals.
Identification
However, it is unknown whether the FBI standard Decloaking Engine has used or a customized version. HD Moore, the original developer of Metasploit and Decloaking Engine, argues that his release could barely identify Tor users. Only suspects with very old Tor version or who had gone to great lengths to install Flash Player would have been at risk.
In this way, the FBI would only have to suspects with the worst operational security-oriented instead of the worst offenders. A few months later, the FBI provided the weather on Tor users. Then there was an exploit for a known Firefox vulnerability used to determine the IP address and MAC address of Tor users. Again it came to users with poor operational security, as it attacked Firefox leak was already in the latest version of Tor Browser solved .
Windows XP users should not use Internet Explorer now there is a new leak was discovered in the browser. That suggests Mikko Hypponen of the Finnish F-Secure. This weekend it was announced that a new leak in IE is present that is deployed. Limited extent in targeted attacks
The vulnerability in Internet Explorer 6 to 11 present, although the attacks were directed only. Against users of IE9, IE10 and IE11 Since Microsoft no longer supports Windows XP, except for organizations with an extended service contract available, run IE users on the platform risk because there is no patch will be released which fixes the leak more.
Symantec also recommends that XP users to use another browser, but notes that this is a temporary measure until Microsoft has released a patch. A notable addition, because most XP users will receive. No more updates For XP users that IE can not do without the use of Microsoft's free Enhanced Mitigation Experience Toolkit (EMET) 4.1 option.
This program adds additional security to the system and also works on Windows XP. The tool prevents attackers newly discovered IE vulnerability to exploit, according to Symantec. Besides XP users also users of other Windows versions can protect themselves through EMET against the vulnerability.
There is a new and critical vulnerability in Internet Explorer discovers that actively used to infect computers with malware and cyber criminals which no update is available from Microsoft. The vulnerability affects Internet Explorer 6 to Internet Explorer 11.
The attacks that were observed, however, were directed against IE9, IE10 and IE11. According to the U.S. security firm FireEye is the exploit of the vulnerability abuse by an APT (advanced persistent threat) group "used in the past more zero-day vulnerabilities used, including Firefox and Adobe Flash Player.
"We think this is an important zero-day, because the vulnerable versions about a quarter of the browser market decide," said analyst Chen Xiaobo. The exploits that attackers use uses a technique known through Adobe Flash Player, the Windows security bypasses to attack the unknown. Leak in IE
Solution
Microsoft vulnerability has also been confirmed and suggests that it is deployed. in targeted attacks only on a limited scalePending a security IE users to take various measures to protect themselves. Enabling the Enhanced Protected Mode in IE10 and IE11 can prevent the attack. IE users on Windows 7 itself should enable this option. Windows 8 Enhanced Protected Mode is enabled only in the "Metro" version of IE. If the desktop version of the browser on Windows 8 should still enable the measure itself used.
Since the exploit Adobe Flash Player as a springboard to attack the causes browserlek to disable the Flash Player plug-in in Internet Explorer ensure that the attack does not work anymore. Finally IE users can protect themselves by installing the Enhanced Mitigation Experience Toolkit (EMET) version 4.1 or 5.0 Tech Preview .
According to the U.S. News Agency Bloomberg NSA was familiar with the Heart Bleed bug for 2 years and she has the vulnerability in OpenSSL frequently used to gather information. Bloomberg cites sources that are "aware of the situation" are.
The decision of the NSA to keep the secret bug in the framework of national security interests, the debate about the role of computer experts from the U.S. government, revived considerably. Again
Heart Bleed seems one of the biggest leak in the history of the Internet to have. As many as two-thirds of the world's websites is touched. The discovery and the advisory that five days ago was published by researchers has led to massive consumers have changed their passwords, the Canadian government has postponed the electronic tax return and that large technology companies such as Cisco Systems and Juniper Networks patches for their systems released. There are also a lot of new SSL certificates issued.
The Heart Bleed bug quietly adding to the arsenal, the NSA has been able to obtain. Passwords and other important information The price for this was high. Millions of ordinary users are left to their own and all that time was vulnerable to attack by secret services and cyber criminals.
Jason Healey, director of the "cyber statecraft initiative at the Atlantic Council" and a former Air Force officer explains: "The security community will not chip them really leave after this revelation."
The NSA has just been denied before the vulnerability became public last week. Bleed Heart of informed on twitter
Programmers create code and hackers find errors in it and use them. Discovered a hole in the most widespread cryptographic the OpenSSL could potentially lead to data theft almost all Internet users.
Seventh of April came security bulletin CVE-2014-0160, from which it became aware of the continued existence of a critical vulnerability in the cryptographic package OpenSSL.
Found that implementation algorithms TLS and SSL are used today in most versions of OpenSSL properly handle expansion packs Heartbeat (because of what the error was called HeartBleed). This allows hackers to gain remote access to confidential information from RAM active network process outside the buffer.
An error in the system has learned the Finnish-American company Codenomicon, what hastened to inform the world through a special website heartbleed.com. Heart Bleed - is the name given error experts, loosely translated it means "bleeding heart."
Such dramatic name was not chosen randomly. An error was detected in the package heartbeat (heart beat, heart rate) used for fault detection and resource management server cluster. The result was a play on words in the heart of the leak occurred.
Surprisingly, the critical vulnerability did not notice for two years. It affects all versions from 1.0.1 to OpenSSL 1.0.1f inclusive and 1.0.2-beta1.
As a result of that error in them is not checked in the recording of the actual length of SSLv3. This allows you to read without authorization to 64 Kbytes of RAM process on the connected client or server for each request. In many cases this is enough to get the keys, passwords or other sensitive data. Vulnerable versions of OpenSSL cryptographic package from March 2012 are included in many distributions and BSD OS family of almost all branches of the Linux Debian, RedHat and Slackware.
The first error affects servers Apache, nginx, project Tor (via the web server https://www.torproject.org), as well as many websites that use the HTTPS, even if access to them is carried out by VPN.
Unlike all the other "helpers hackers» Heart Bleed intercepts encryption keys - the cornerstone of secure connections, which encrypts the data transmission between servers. By themselves, the captured data is not worth anything, because the same encrypted PIN bank card might look like, «dkgh # k87u». Without the key, which will allow to decipher the code, it's just a set of symbols. But if the key will be in the hands of criminals, then get the raw data for them there is no trouble.
The greatest danger lies in the fact that this hack does not leave absolutely no trace in the case of data theft is not possible to know about this.
It would seem, what's this, because such errors are almost every day. However encryption package OpenSSL - the most widespread in the world. It is used mostly in the Apache web server and nginx. According to research company Netcraft, on these architectures employ about 66% of all sites on the Internet. Thus, only every third site does not represent a potential threat in terms of data theft. Among the endangered sites include such popular services like Twitter, Dropbox, Yahoo!, Steam and others. OpenSSL packages are used to everything else for the operation of e-mail servers and diverse client software.
To determine the degree of risk of error Codenomicon tried to kidnap their own data as it would make professional hackers.
As a result, they managed to make an attack on their own servers, without leaving any traces. Using only a hole in the system, Codenomicon received encryption keys. Using them, experts have collected from servers usernames and passwords, correspondence employees through messengers and email, as well as confidential company records stored on your computer.
Of course, such a dangerous hole could not remain uncovered. As a result, on April 7 was released a new version of OpenSSL, in which the error is no longer present. However, a simple upgrade package is not enough. If criminals have stolen encryption keys, they can use them in the same way as in the previous version, and for security administrators need to get a new security certificates and to generate new keys.
Of course, for large projects should not worry, because the price of their negligence administrators too great. It can be assumed that the relevant work already done on the servers.
In Codenomicon even see the positive side of Heart Bleed: because administrators can not ignore the fact that hole detection, they have to update the system data encryption on their servers. Along with them are likely to be installed, and other updates that have been postponed for a certain period.
While common in the bulletin and news reports officially recommend the following steps:
Install a patched version of OpenSSL 1.0.1g or 1.0.2-beta2 or recompile OpenSSL package with key OPENSSL_NO_HEARTBEATS;
reissue the SSL-certificate;
lures (honeypot), simulating the presence of a vulnerable server package OpenSSL, and check to connect to them.
We recommend that if you do not use in public places WiFi network, then try to put this kind of functionality is temporarily closed. Personal use of computers when not readily allow strangers remote control of their computer to prevent personal information from being stolen. Once the leakage of information to remind consumers to timely remedy, keep relevant evidence, take the initiative to safeguard their rights.
