Microsoft: ‘Consistent exploit code likely’ for IE vulnerabilities

Microsoft today shipped four bulletins with patches for at least 8 documented security vulnerabilities affecting Windows users and warned that “consistent exploit code could be easily crafted” to launch attacks via the Internet Explorer browser.

The Patch Tuesday batch includes fixes for a pair of code execution holes in IE, two bugs in the Microsoft Exchange Server, a remote code execution issue in the Microsoft SQL Server, and three separate flaws haunting users of Microsoft Office Visio.

The Internet Explorer bulletin (MS09-002) should be treated with urgency because the flaws can be exploited to launch drive-by download attacks.

* This security update is rated Critical for Internet Explorer 7 running on supported editions of Windows XP and Windows Vista. For Internet Explorer 7 running on supported editions of Windows Server 2003 and Windows Server 2008, this security update is rated Moderate.

The Microsoft warning that consistent exploit code was likely suggests that it’s very easy for an attacker to host a specially crafted Web site and attack unpatched users who surfed to the rigged Web site.

* The attacker could also take advantage of compromised Web sites and Web sites that accept or host user-provided content or advertisements. These Web sites could contain specially crafted content that could exploit this vulnerability.

Enterprise administrators will also want to pay special attention to the Microsoft Exchange update (MS09-003) which covers two different vulnerabilities that expose users to code execution or denial-of-service attacks.

Microsoft explains:

* The first vulnerability could allow remote code execution if a specially crafted TNEF message is sent to a Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could take complete control of the affected system with Exchange Server service account privileges. The second vulnerability could allow denial of service if a specially crafted MAPI command is sent to a Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could cause the Microsoft Exchange System Attendant service and other services that use the EMSMDB32 provider to stop responding.

The company says it expects to see “inconsistent exploit code” published for this bulletin. However, nCircle director of security operations Andrew Storms says this is a very serious problem.

“This vulnerability means that any cybercriminal sending a well crafted email attachment to an enterprise could gain complete control over the server and gaining one of the keys to the kingdom,” Storms said.

“All kinds of highly confidential and proprietary information pass through an Exchange server every day. Gaining control over it and its content would be a gold mine to any cyber criminal,” he added.

A TCP stack design vulnerability could put Internet services everywhere at major DoS risk

Researchers from the Swedish security company Outpost24 have discovered a major flaw in the design of TCP stacks which could put TCP-enabled devices at risk. According to their findings, which they kept secret for three years, performing DoS attacks through this vulnerability would require little bandwidth and the attacked devices would need rebooting in order for proper functionality to be restored.

The researchers discovered this vulnerability back in 2005 and they claim it affects most, if not all, TCP stack implementations out there. With every TCP-enabled device being at risk, this affects everyone on the Internet, ranging from billions of home users to ISPs, hosting and other companies. Due to the deep implications of this vulnerability, the researchers decided to keep it secret and try to find applicable solutions. Because they did not succeed in coming up with an answer for mitigation, they decided to go public and search for input and feedback from the security community.

They did not disclose full details to the general public, but they teamed up with the Finnish CERT and started providing information to various vendors world-wide, which include major OS developers and router/firewall manufacturers. Along with information regarding several different attack types, the researchers provided the vendors with a stress test kit which they developed and named Sockstress. “They're still trying to do triage and understand the individual attack types that we've identified for them. We're still trying to get them to back up a step. It's a class of attack, not necessarily individual things that the vendors need to be focusing on," said Robert E. Lee, Chief Security Officer at Outpost24.

The researchers tested their attacks on 15 different TCP stacks and all proved vulnerable. "We haven't found anybody who has a TCP stack that runs TCP based services that isn't vulnerable. If they make a TCP stack then it's probably still going to be vulnerable to one or all of these attacks because this is something fundamental in how TCP works," commented Mr. Lee for The Register.

Even if, at this point, there is some skepticism coming from the security community regarding the seriousness of the vulnerability, this is explainable through the lack of detailed technical information or confirmation from other parties. “My immediate reaction is skepticism: things like this tend to be hype. However, after listening to their audio interview, I believe they are probably right. They have been working deep within TCP stacks. If such problems exist, then they would have certainly come across them,” wrote on his blog Robert Graham, the CEO of Errata Security.

A new DoS attack technique

From what little information is available in an interview with Robert E. Lee, Chief Security Officer at Outpost24, the exploitation of this flaw consists of essentially tricking the TCP stack into not closing the TCP connections. By opening numerous such connections that are never dropped, the max limit of simultaneous connections that the stack can handle is eventually reached. This uses up all the available resources and causes a denial of service situation.

This actually works backwards compared to the classic distributed DoS (DDoS) attacks where, by using the combined bandwidth of multiple compromised machines (botnets), the attacker opens numerous connections and sends numerous packets in order to force the device into using up all its resources by attempting to process them. With such classic DoS attacks, there is a direct proportionality between the resources available to the attacked device and the bandwidth required to crash it successfully. However, in one of the new attacks described by the Mr. Lee, the concept is to trick the device into thinking that your connection is getting slower. In fact, the slower, the better.

A TCP stack will attempt to determine the maximum speed of a connection and adjust the speed at which it sends the packets in order to prevent packets from being dropped. So, if successfully tricked into thinking that your speed is getting so slow that it will take, for example years for the transfer to complete, the stack will keep the connection open for a very long period of time. Then, it's just a matter of opening enough such connections up to the point where the stack can't handle any more and becomes unresponsive. But, while a device can recover on its own within minutes from a classic DDoS attack, with this new technique, the only solution is to reboot the device. "It basically self thrashes, and the only recovery after about two to four minutes worth of attack flow, even after the attack stops, is to reboot the machine," explains Mr. Lee.

Another Internet architecture design flaw

This TCP resource leak vulnerability is the second major Internet architecture design flaw made public in 2008. A few months ago, security researcher Dan Kaminsky discovered a critical flaw in the design of DNS (domain name system). That vulnerability allowed for an attacker to poison the cache of DNS servers with fake entries. Just like this flaw is supposed to affect all TCP stack implementations, the DNS one affected all DNS server platforms. That posed a great mitigation problem, but Mr. Kaminsky silently worked with several major affected vendors and companies that offer Internet-based services and eventually a patch was developed.

Facing pressure from the security community, Dan Kaminsky decided to make the technical details public after the patch was deployed on most of the DNS servers world-wide. He revealed at the time that the flaw also affects services like e-mail. Not long after, Russian physicist Evgeniy Polyakov presented a proof of concept exploit demonstrating that the patch only increases the time required to compromise a DNS server and that it doesn't really block attacks.

Miscreants like phishers and malware developers have already adopted the DNS vulnerability and complex attacks have been carried out. While a permanent solution is still being devised, the U.S. government announced plans to implement DNSSEC, an encryption-based DNS service, on their network by December 2009. All this puts into perspective what could happen if the TCP stack flaw issue is not properly addressed.

Chromium Memory Usage

Memory Usage Backgrounder
Chromium Memory Usage

Here is some background information if you are measuring memory in Chromium.

Multi-Process Model Background
To understand Chromium's memory usage, let's understand the multi-process model. Unlike other browsers, Chromium is divided into multiple processes. When Chromium starts up, it will initially have two processes. One process is the browser process which controls the main browser functionality, and the other is the initial renderer process, which runs the WebKit rendering engine and JavaScript (V8). Each time you open a new tab in Chromium, you'll likely get a new renderer process. With typical browsing, it is common to see 5-7 chrome.exe processes active. Further, if the pages you have open contain plugins, those plugins will also execute within independent processes. All of Chromium's processes, whether it is a browser process, a renderer process, or a plugin process, will show under the Task Manager as "chrome.exe".

Here is a screenshot of what you might see from Windows Vista running Chromium:


Read more

Web Attacks Through SQL Injection - A New Solution to Increase SQL Based Applications Security

The management of relational databases is performed by using SQL (Structured Query Language) that helps
you to manipulate data inside a collection of tables. Practically, at the web level, SQL language represent the bridge of communication between a web application and a database. In the same manner, the user interacts with the database at a certain point in a given database driven application.

SQL injection represents a hacking method that is based on the security vulnerabilities of web applications having a database backend. It has many implementation forms and basically it consists of malicious SQL code (or non-intended to be used in a given application) that, after execution, could determine the complete destruction of a database, the revealing of secret informations from the database records and more.

The most vulnerable to SQL injection attacks are web forms. For example, if next SQL code is used in a login system, a username could be selected from the usersname table due to the fact that the boolean value of the code 'a'='a' is true in any situation:


CODE
SELECT * FROM usersname WHERE name = 'John' OR 'a'='a';

In the case presented earlier, a hacker could bypass the authentication system or even more, to compromise the database with a DROP TABLE statement. Fortunately, solutions to increase the general security of web applications back-ended with relational databases exist.

Martin Bravenboer presents a new methods to avoid the security leaks in database driven applications in his Ph.D. Thesis entitled "Exercises in Free Syntax-Syntax Definition, Parsing, and Assimilation of Language Conglomerates". The techniques of totally removal of the SQL insecurities is based on the usage of an API (application programming interface) in combination with easy strings manipulation.

The method of embedding the syntax of SQL language into a host language like Java or PHP is generalized for many pairs host-guest type programming languages. The content of the Ph.D thesis is available on-line as PDF document and can help you to better understand the mechanisms of SQL injection and respectively the recommended coding procedures.

Hackers attack businesses, blogs and Web 2.0 sites, reveals Sophos Security Threat Report

IT security and control firm Sophos has published new research into the first six months of cybercrime in 2008.

The Sophos Security Threat Report examines existing and emerging security trends and has identified that criminals are increasingly using creative new techniques in their attempt to make money out of internet users.

It is estimated that the total number of unique malware samples in existence now exceeds 11 million, with Sophos currently receiving approximately 20,000 new samples of suspicious software every single day - one every four seconds. The firm’s report reveals that most attacks are now designed to try and out-fox traditional security systems such as email-scanning.

The first half of 2008 has seen an explosion in threats spread via the web, the preferred vector of attack for financially-motivated cybercriminals. On average, Sophos detects 16,173 malicious webpages every day - or one every five seconds. This is three times faster than the rate seen during 2007.

Over 90 per cent of the webpages that are spreading Trojan horses and spyware are legitimate websites (some belonging to household brands and Fortune 500 companies) that have been hacked through SQL injection.

The chart for top malware hosted on the web is dominated by infections related to SQL injection attacks.
SQL injection attacks exploit security vulnerabilities and insert malicious code into the database running a website. Companies whose websites have been struck by such an attack often clean-up their database, only to be infected again a few hours later. Users who visit the affected websites risk having their computer taken over by hackers, and their personal banking information stolen by identity thieves.

Sophos has identified that the number one host for malware on the web is Blogger (Blogspot.com), which allows computer users to make their own websites easily at no charge. Hackers both set up malicious blogs on the service, and inject dangerous web links and content into innocent blogs in the form of comments. Blogspot.com accounts for 2 percent of all of the world’s malware hosted on the web.

Thousand of webpages belonging to Fortune 500 companies, government agencies and schools have been infected, putting visiting surfers at risk of infection and identity theft. High profile entertainment websites such as those belonging to Sony PlayStation, Euro 2008 ticket sales companies, and UK broadcaster ITV are amongst the many to have suffered from the problem.

Sophos experts note that with the continuing popularity of Web 2.0 social networking sites, including Facebook and LinkedIn, among business users, cybercriminals who have already gained access to user profiles, may begin to use these as corporate directories, noting new employees and launching spear-phishing attacks specifically aimed at stealing information from new and unsuspecting members of staff.

To guard against this risk, all organizations should ensure employees are fully educated about the dangers of posting too much information on these sites, and of accepting unsolicited friend requests.

“Businesses need to bite the bullet and take better care of securing their computers, networks and websites. They not only risking having their networks broken into, but are also putting their customers in peril by passing on infections,” said Graham Cluley, senior technology consultant at Sophos. “But office workers must realise it’s not just the business fat cats who need to worry about this. Visiting an infected website from your work PC, or sharing too much personal or corporate information on sites like Facebook, could lead to you being the criminal’s route into your company.”

Although most attacks are now taking place via infected websites, email continues to present a danger. It is common for cybercriminals to spam out links to compromised websites, often using a subject line and message to tempt computer users into clicking through the promise of a breaking news story or a lewd topic.

Attacks via email file attachments, however, have reduced in 2008. Only one in every 2,500 emails examined in the first six months of 2008 was found to contain a malicious attachment, compared to one in 332 in the same period of 2007.

Malware which disguises itself as naked photos of Angelina Jolie or Nicole Kidman dominates the chart of top malware spreading via email attachment.

The Pushdo Trojan dominated the chart of most widespread malware spreading via email, accounting for 31 percent of all reports. Pushdo has been spammed out during the year with a variety of disguises. Some for example, have claimed to contain nude photographs of Hollywood stars Nicole Kidman and Angelina Jolie.

Much more information about the latest trends in malware, spyware and spam can be found in the latest Sophos Security Threat Report.

Research on Browser Weaknesses Triggers Attacks

IBM’s X-Force says cyber-criminals are using public research on Web browser weaknesses to launch attacks before most users are even aware of their vulnerability.

The mid-year report from the security group indicates that organized criminals are adopting new automated techniques and strategies that allow them to exploit vulnerabilities much faster than ever before.

According to the X-Force report, 94 percent of all browser-related online exploits occurred within 24 hours of a vulnerability being officially disclosed. These attacks, known-as “zero-day” exploits, are on the Internet before people even know they have a vulnerability that needs to be patched in their systems.

Many security researchers have routinely posted the code needed to exploit a weakness as part of a security advisory. According to the X-Force report, these disclosed vulnerabilities are twice as likely to trigger zero-day exploits.

“The two major themes in the first half of 2008 were acceleration and proliferation,” said X-Force Operations Manager Kris Lamb. “We see a considerable acceleration in the time a vulnerability is disclosed to when it is exploited, with an accompanying proliferation of vulnerabilities overall. Without a unified process for disclosing vulnerabilities, the research industry runs the risk of actually fueling online criminal activity. There’s a reason why X-Force doesn’t publish exploit code for the vulnerabilities we have found, and perhaps it is time for others in our field to reconsider this practice.”

The latest X-Force report also found that browser plug-ins are the newest target-of-choice. In the first six months of 2008, roughly 78 percent of web browser exploits targeted browser plug-ins.