The Application Layer is Where the Action Is…

Posted on by
Reply

I thought this particular “hacker” article was pretty interesting. Thanks to Dr. Anton Chuvakin’s “Security Warrior” blog for pointing it out.

Once you look beyond the manifesto hype, you can really get a feel for what it represents. It represents a call to action to remind security professionals that the game has changed. The network and systems that it is composed of remain but a part of the security equation. The real target of the attackers that represent the REAL THREAT is the data that the network and systems hold.

Attackers have definitely moved up the stack. They do not care that most organizations are still focused on the network layer and more than a few are still trying to get the basics of that right. In fact, it simply empowers them more.

Today, attackers are focused on the application. That is true whether you look at holes like SQL injection and XSS or at the browser vulnerabilities that are at the root of a majority of malware and bot-net activity today. Today’s attackers have excellent tools for exploit development that have seriously changed the security landscape. More attackers understand the deeper nuances of computer science than ever before. Man security teams and professionals are lagging behind in knowledge, resources and capability.

One of the big reinforcers of this ideal to me was a presentation I gave a few weeks ago about application security. During the research for it, I found that according to several sources, a HUGE amount – roughly a third – of all reported security incidents last year involved SQL injection and XSS. Almost 2/3s of all reported incidents were web-application focused. Clearly, there is no denying that the attackers have moved up the security stack – the question is – have the defenders…

What are you, your security team and your security partners doing today to ensure that your data is protected tomorrow?

Symantec Internet Security 2008 Vulnerable ActiveX

Posted on by
Reply

There appears to be two vulnerable ActiveX controls in Symantec Internet Security 2008. The following ActiveX controls are vulnerable:

Progid: SymAData.ActiveDataInfo.1

Clsid: 3451DEDE-631F-421c-8127-FD793AFC6CC8

File: C:\PROGRA~1\COMMON~1\SYMANT~1\SUPPOR~1\SymAData.dll

Version: 2.7.0.1 

  Clsid: 3451DEDE-631F-421c-8127-FD793AFC6CC8
  File: C:\PROGRA~1\COMMON~1\SYMANT~1\SUPPOR~1\SymAData.dll
  Version 2.7.0.1


These ActiveX are marked safe for scripting by Symantec. According to Symantec, although they are marked safe for scripting, they will only run from the “symantec.com” domain. Successful exploitation would require the use of XSS or DNS poisoning techniques, but could allow for complete control over a users system simply by viewing a malicious page. Symantec has issued updates to fix these vulnerabilities.

					

		
		
	


				
					
	

		

						
Quicktime and Opera Multiple Vulnerabilities

			
						

				Posted on   by  			

			
						

				Reply			

					


				

			

Multiple vulnerabilities have been announced for Apple Quicktime. I counted 11 different vulnerabilities in the advisory, ranging in criticality from disclosure of personal information to buffer overflows. Apple has released an update, version 7.4.5, that fixes these vulnerabilities.


Opera versions prior to 9.27 are vulnerable to multiple issues. These vulnerabilities could allow for the execution of code on the local host. Users should update to version 9.27.

					

		
		
	


				
					
	

		

						
Patent Wierdness and the Security Market

			
						

				Posted on   by  			

			
						

				Reply			

					


				

			

CrowdedMarket.jpeg


So I was doing some patent research today and I have to say that some of the patents out there for information security are pretty weird.


I found patent applications for wireless access points that turn on radio jammers in response to attacks (thus blocking even legitimate users), ethernet cables that can be colored with special markers depending on the security of the system they are attached to, a physical key-based device that controls an ethernet air-gap and even a patent application that was denied for patenting the word “security”.


I had no idea that so many things had been patented, or attempted to be patented. Maybe I am not a “patent insider” – but a lot this sounds like junk, bad infomercials and “seen on TV” security products.


I think I should find a VC and maybe patent the special “security gnomes” that some software vendors believe protect their software from well-known exploits. Or the “magic security dust” that some managers believe allows them keep their data protected without investing in any real security staff or initiatives. If those don’t work, maybe I will patent some sort of “cyber-ninja” that seeks out and destroys cross-site scripting vulnerabilities and SQL injections. Why not? It might be as effective a control as colored ethernet cables…


For a couple of years now, Allan and I have been talking about just how noisy the information security market has become. Even after a large consolidation phase, there are still a bunch of vendors, some selling solutions and some selling snake oil. The average IT manager is probably getting 10+ calls a day from vendors selling them everything from firewalls to NAC and from AV software to USB blockers. No wonder average security consumers are having so much trouble knowing the real from the hype!


I didn’t start this blog post to be a rant or anything, but the oddity of the patent searches really left me in awe. The security space is crowded, noisy and a lot like a downtown Delhi market. There are exotic spices, rarities and a number of arcane items everywhere you look. Hopefully, there are also some honest to goodness, back to basics solutions mixed in too. Your mission, should you accept it, is to sort them out…

					

		
		
	


				
					
	

		

						
HP OpenView NNM 0day, lightthpd DoS

			
						

				Posted on   by  			

			
						

				Reply			

					


				

			

An exploit has been published for HP OpenView Network Node Manager (NNM). This exploit is preauthentication and can be exploited remotely. From what I’ve read it looks to be exploited over the HTTP port of OpenView and is exploiting the OVAS.exe service. No references to updates or fixes were found. Users should restrict network access to machines running this software.


There’s a vulnerability in lightttpd that can be exploited to cause a denial of service. The issue exists in the SSL error queue where a single connection could be exploited to deny all other SSL connections. This has been fixed in the SVN repository, available at:


http://trac.lighttpd.net/trac/changeset/2136

http://trac.lighttpd.net/trac/changeset/2139

					

		
		
	


				
					
	

				
					
	

		

						
InstallShield ActiveX Vuln, WP-Download SQL Injection

			
						

				Posted on   by  			

			
						

				Reply			

					


				

			

There’s a SQL injection in a the Wordress Download plugin. Data passed to wp-download.php is not properly sanitized before being processed by SQL. This could result in a SQL injection attack that could lead to the disclosure of usernames and passwords. WordPress admin’s should update to version 1.2.1.


There’s a major vulnerability in and activex control installed by Macrovision InstallShield InstallScript One-Click Install (OCI). The control gets installed via webpages prompting to install software. A large user base is likely affected by this. Basically, when the activex control is initiated it loads several DLL’s that are not sanity checked. These DLL’s could execute arbitrary code when loaded. This vulnerability has been confirmed in version 12.0. The following are the properties associated with the activex:


 File: %WINDIR%\Downloaded Program Files\setup.exe


 CLSID: 53D40FAA-4E21-459f-AA87-E4D97FC3245A


Macromedia has released a hotfix for this issue, available along with the KB entry for this vulnerability, at http://knowledge.macrovision.com/selfservice/microsites/search.do?cmd=displayKC&externalId=Q113640

					

		
		
	


				
					
	

		

						
A Very Good Idea – Open Source SQL Application Firewall

			
						

				Posted on   by  			

			
						

				Reply			

					


				

			



A few weeks ago I ran across this project, called GreenSQL. It is an open source database firewall to help organizations mitigate application vulnerabilities due to common SQL attacks like SQL injection and such.


It is a list-based heuristic proxy firewall that you can use to filter SQL traffic between the web server and the database server. This is a pretty powerful tool, even being list-based. As this project evolves, perhaps it will also include more powerful approaches such as anomaly-based analysis.


For now though, black listing, white listing and their approach to transaction risk weighting is a very powerful approach and much better than nothing.


That said, MSI has has not tested the application or performed any formal review, we just liked the idea that they were working on. Perhaps, in the future we will donate some lab cycles to a review and some testing, but we wanted to help them at least get the word out about their project.


If you are using MySQL for your web-based applications, it might be a good thing to spend some time looking at this project and testing the capabilities of the tool for your environment. Eliminating SQL attacks from web-applications will reduce a significant amount of risk from their deployment. By some estimates, that risk could be as high as 25% of the aggregate risk an application causes. No matter the metrics, this project is certainly a step forward.

					

		
		
	


				
					
	

		

						
CA Products ActiveX Vuln, VMWare Update Fixes DoS

			
						

				Posted on   by  			

			
						

				Reply			

					


				

			

Multiple CA products containing the DSM ListCtrl ActiveX Control are vulnerable to buffer overflow. Exploit code has been posted to a public area for this issue. This could allow attackers to cause a denial of service or execute code in the context of the user running the browser. Some mitigating factors taken from the original advisory:


” Mitigating Factors: For BrightStor ARCserve Backup for Laptops &

Desktops, only the server installation is affected. Client

installations are not affected. For CA Desktop Management Suite,

Unicenter Desktop Management Bundle, Unicenter Asset Management,

Unicenter Software Delivery and Unicenter Remote Control, only the

Managers and DSM Explorers are affected. Scalability Servers and

Agents are not affected.”


CA has posted an update for the affected software.


VMWare has issued an update for VMWare ESX. This update fixes a vulnerability that could cause a denial of service. Users/Administrators should apply ESX 2.5.5 Upgrade Patch 6.

					

		
		
	


				
					
	

		

						
TFTP Vulnerabilities

			
						

				Posted on   by  			

			
						

				Reply			

					


				

			

It appears that possibly a new tool to find vulnerabilities in tftp servers may be floating around. In the last several days 3 different TFTP programs have had 0Day exploits released. We’re not sure of the similarities in the exploits yet, but being across multiple products shows that there is some underlying issue. The currently affected TFTP servers are Quick TFTP, PacketTrap Networks TFTP Server, and TFTP Server for Windows. If you happen to use any of these, update as soon as possible. If you are using other TFTP server software, keep an eye out for updates.