Author Archives: Adam Hostetler

SPAM Backscatter

Posted on by
Reply

We are getting many reports of mail servers under heavy load because of SPAM backscatter. This happens when a spammer uses a company’s email address to forge the “FROM” field in the email. When mail servers get these spam emails and reject them because they are sent to a user that doesn’t exist, the SPAM targeted mail server will send a bounce back message to the forged “FROM” field. Now as you might imagine, when a spammer sends out over a million emails it’s very likely that many of those will go to addresses that no longer exist, and innocent company in the “FROM” field gets blasted by thousands of bounce backs.

What can we do about this though? Unfortunately if you’re the one getting the backscatter, not a whole lot. However, you can help to prevent backscatter for others. We recommend that email servers be configured to REJECT bad email during the initial transaction instead of accepting it and creating a bounce back reply. Also consider not using “out of office” email replies. This also creates backscatter when the vacationed user receives spam. This could also land you on a spam blacklist, if whoever got the backscatter happened to report your mail server as a backscatter sender.

Microsoft Patch Tuesday

Posted on by
Reply

It’s that time of the month again, it’s release day for the Microsoft patch cycle. This month there were 11 new updates. Six of those eleven carry ratings of “critical”. The updates patch several things, and finally include an update for IE that corrects six vulnerabilities. Some of the other critical updates fix vulernabilities in Microsoft Office. As usual, test these updates and roll them out as soon as possible.

Bank of America Laptop Stolen

Posted on by
Reply

Another company gets a laptop stolen with customer data on it. Fortunately this time it appears that all of the sensitive data was encrypted. They’re not sure of the number of customers but affected, but said it was “a very small number”. This is just another incident in a long list of stolen and lost customer information. This time they were prepared, and it’s probably going to save people some grief. If one of your company’s laptops get stolen, will you be just as prepared?

Ruby Vulnerabilities

Posted on by
Reply

Several vulnerabilities have been identified and subsequently patched in the newest version of Ruby. If you are a Ruby developer, make sure you download this as it contains an important update. A fix for the DNS logic within the resolv.rb script. The update implements randomized source ports, in order to help protect from spoofing attacks. Upgrade to 1.8.6-p286, or 1.8.7-p71, to mitigate this and other issues identified.

Malware Emails

Posted on by
Reply

There’s a couple malware emails making the rounds right now. One claims to be from the UPS, and the other said to come from CNN.com. The UPS email claims that they tried to deliver a package but the recipient address was wrong. The email contains an attachment invoice which it explains you need to print out and take it to their office. The CNN email contains a subject of “CNN.com Daily Top 10” and includes links that attempt to entice a user to click on them. If you follow the link, you’re redirected to a site and prompted to install an updated flash player. In both cases, of course, the executables are not what they say they are. Usually these emails are fairly easy to pick out due to grammatical and spelling errors. It’s also a good idea to not open any unexpected attachments, even if you believe they’re from a reputable source.

Oracle Exploit

Posted on by
Reply

Oracle has released a patch out of cycle in response to an exploit going public yesterday. The flaw allows remote code execution without being authenticated in WebLogic Server and WebLogic Express. Every version of WebLogic from version 6.1 to 10 are vulnerable. This is a critical vulnerability and the patch needs to be rolled out immediately. If for some reason that is not possible, Oracle believes there are two workarounds. The first is using the Apache LimitRequestLine Parameter, or you man also use the Apache mod_security module. Full details of the vulnerability and the workarounds are available here.


Trend Micro OfficeScan Exploit

Posted on by
Reply

An exploit has been released that takes advantage of a vulnerability in OfficeScan 7.3. The vulnerability is within the ActiveX control. Exploitation of this vulnerability allows arbitrary code execution. Trend Micro has already patched this issue, and version 8 of OfficeScan is not vulnerable. So if you are vulnerable, apply the update or upgrade to verson 8.

Exploits For DNS Issue

Posted on by
Reply

An exploit for the recent DNS issue has been released in a popular attack framework (Metasploit). This is going to make running the exploit trivial for any would be malicious user that has enough skill to download Metasploit. The exploit claims to only work against Bind 9, but I would be very surprised if it doesn’t work against all the other vulnerable DNS implementations. This issue isn’t just going to go away and hide in a corner somewhere. So, if you haven’t yet patched, DO IT NOW!!.

OS X Privilege Escalation

Posted on by
Reply

Apple Mac OS X 10.5 and 10.4 ARDagent (Apple Remote Desktop) contains a vulnerability that allows local users to gain root privileges through an AppleScript command. This issue was first presented last month, but now there are indications that this vulnerability is being actively exploited to install malicious software on target systems. Because this vulnerability is so easy to exploit, and allows root access, there is a potential for a lot of bad things to land on the system, such as rootkits.

At this time there has been no patch provided by Apple. Users are cautioned to only run trusted AppleScripts, and only install trusted applications.

Microsoft Patches For July 2008

Posted on by
Reply

Tomorrow, Microsoft is releasing four security updates for multiple issues affecting Windows, Microsoft SQL Server and Microsoft Exchange Server. All four updates carry a rating of “important”, no “critical” updates on this round. Surprisingly, there’s no update for recent IE vulnerabilities. As usual, these updates should be tested and rolled out as soon as possible.