It seems the recent QuickTime vulnerabilities are receiving a lot of attention. Exploits are popping up fast, and there are now working exploit frameworks to attack both Windows and OSX. Since the exploit can be embedded in websites, it’s harder to avoid it. Even the practice of avoiding untrusted websites may not be 100% effective. Other things that may be tried include blocking the rstp:// protocol at the firewall if you have the capability, or better yet uninstall the QuickTime browser controls, or disable file associations for QuickTime files. Apple is still working on an patch for this issue.

Are spammers getting desperate? Recently we’ve seen spammers switch from text based spam, with random paragraphs to images, and then to pdf, which seemed like the new hot spam format. But this morning I had a couple interesting spams get through the spam filter.

One of them looked like this:

H,E_R’E WE GO AGAIN.!

T.H_E B*I-G O.N+E BE_FORE T*H+E SEPTEMBER.R ALLY’!

T*H-E MAR KET IS ABO,UT TO P*O_P’, A’N+D SO IS E X,M’T+!

T ick: —-

5-d+ay po.tentia.l: 0.. 4’0

Firm : EXCHA*NG,E ——- (Ot+her O.T-C*: —–.P K)

A+s+k_: 0..+1+0 (+.25.0.0%) UP TO 2*5.% in 1 day

N*o.t o,n,l*y d’o e+s t,h,i_s f i*r’m h-a v’e gr*eat fu-ndamen’tals,

b u t getti*ng t-h.i s opp+ortunit,y at t,h e righ,t t-i.m e-,

righ_t bef.ore t_h e ra*lly is w+h-a-t m,akes t.h i s d.e a l so sw*eet!

T+h-i.s a gr eat o.,pportunity to at leas,t do’uble up!

I can barely make out what that says, it’s harder to read than 1337 5p34k mxd w/ AOL spk. The PDF spam, while effective at getting through, required the end user to actually open the pdf and read it, but it was actually, you know, readable. I would really like to know who is still making sending out spam like this worthwhile. Do people sit around and decipher it because they think they’re going to get some secret thing nobody else does? Is it still cost effective for spammers to buy email lists from the black market? Ah, If only I had the time to do research on spam. Maybe somebody already did it for me.

A big name entering the cell phone market is likely to put mobile device vulnerabilities in the spotlight.  Of course I’m referring to Apple’s iPhone. The long awaited and highly anticipated entry into the mobile market for Apple. This isn’t a review about the iPhone though, but a short look at the impact it’s going to have on mobile security.

Just 3 days after the iPhone release date, researchers have already found a few vulnerabilities in the iPhone. One of the vulnerabilities is an overflow issue in Safari, which could lead to a code execution issue. A denial of service vulnerability was also identified in the Bluetooth module. Fuzzing the Bluetooth interface causes the phone to become unresponsive.

There are already many vulnerabilities known in existing phones, including smartphones running Windows mobile. At the current moment they are fortunately not exploited in great numbers. Carriers have also been very slow at updating the phones, to such an extent that it’s estimated that as many as 90% of all smartphones are currently vulnerable to at least one exploitable issue.

Apple has smartly kept the iPhone very close to them. Apple’s update track record is much better than any mobile carriers, and the iPhones are designed to update periodically. Hopefully vulnerabilities identified in the iPhone will wake up the other manufactures and carriers, and get them to updating their phones as well.

I recently came back across a prank that was pulled some years ago against a local news station. Some college students had found out that the school and business tickers that you are probably familiar with, accepted input directly from the news website. All that was required was to sign up, and put in your business, contact, and hours opened/closed. Now one might think that somebody would check these before they go on live TV, but that’s exactly what didn’t happen in this case. The students proceeded to sign up humorous businesses, and have them displayed on live TV. This happened numerous times before someone at the station caught on and disabled the feature.

What I’m getting at here, is that this could have easily been turned into an attack to harm a company’s reputation. They could have easily posted that Joe Shmoe Inc. was doing something illegal, and potentially caused an HR and legal nightmare for that company. Might even be possible to “Denial of Service” the company! Word spreads that there was no work today, nobody shows up, and no work gets done.

The lesson this shows is that user input should never be trusted. When “user input” is described, usually we think about bad characters in input fields, SQL injections, or cross site scripting. But this example goes to show that those issues are not the only things to be considered.

Do you check file integrity when you download open source software? This is normally accomplished by the software developer providing MD5 sums for the files. An MD5 sum is a computed signature for the chosen file. By providing you this signature, you are able to verify the integrity of the file by computing the signature on your own system and comparing it against the sum that was downloaded with the file. Many developers have recently started including GPG signed sums, which is even better, and prevents creating fake sum files in the event that the system that contains the software and sum files is compromised.

The reason I bring this up is that a popular open source application was recently compromised. An attacker was able to access a server that contained the downloadable distribution and changed some of the files to contain malicious code that could be exploited remotely. The altered files were found by a user that had downloaded the files and found a discrepancy in the sums, potentially saving many that had downloaded the altered software.

Doing this may sound like an inconvenience, but it is really easy to do, and helps ensure that you are getting software that was not tampered with. To do your part, you just need to acquire an MD5 digest generating program. Many distributions of Linux include one, and you can download them for virtually any OS. You could even create one, if you want. Now you just need to run the MD5 generating program against the files you downloaded. Compare your output against the MD5 sum provided by the developer.

If you have GPG and the developer provides signed MD5 sums, you can check that the MD5 sums were actually created by the developer.