Useful « The GANSEC Security Weblog

LulzSec –Sabu taken down –leadership of LulzSec arrested

By Sven Olensky,on March 6th,2012%

Turns out that Sabu,the leader of LulzSec,was arrested late last year and started working for the FBI since they threatened to take his kids away. Senior leaders of the group were arrested today.

The Guardian reports:

The FBI has struck a major blow against hacking groups after arresting or charging five key members of the LulzSec hacking crew and revealing that the head of the group,who went by the nickname “Sabu”,has been working for it since the middle of 2011.

Hector Xavier Monsegur,known as Sabu,was charged with 12 criminal counts of conspiracy to engage in computer hacking and other crimes in court papers in Manhattan federal court.

Monsegur,an unemployed 28-year-old Puerto Rican living in New York,pleaded guilty to carrying out online attacks against PayPal and Mastercard,documents unsealed in a Manhattan court on Tuesday shows.

The charges were filed via a “criminal information”form,which means the suspect,Sabu,has likely been cooperating with the government.

Five other people – two in the UK,two in Ireland and one in Chicago – were either arrested or charged by the FBI on Tuesday.

Lookout Security App protects your Droid,Blackberry and Windows smartphone

By Sven Olensky,on March 6th,2011%

A free app from Lookout Mobile Security protects your Android,Blackberry and Windows-based smartphone from Malware and Viruses. It received some great mentions and positive reviews (e.g. over at Android Tapp).

Download it at https://www.mylookout.com/download.

Google collecting children’s social security numbers under the guise of an art contest

By Sven Olensky,on February 23rd,2011%

The Huffington Post has an interesting article about Google collecting personally identifiable information about children under the guise of an art contest.

They write,

[...] has been asking parents nationwide to disclose their children’s personal information,including Social Security Numbers,and recruiting schools to help them do it —all under the guise of an art contest. It’s called,“Doodle-4-Google,”a rather catchy,kid-friendly name if I do say so myself. The company is even offering prize money to schools to enlist their help with the promotion. Doesn’t it sound like fun? Don’t you want your kid to enter too?
What could be wrong with filling out a few entry forms?
A national,commercial database of names and addresses of American children,especially one that includes their dates of birth and SSNs,would be worth many millions to marketing firms and retailers.
Of course,data collection is not the reason Google gives for doing this competition. Their FAQ says it’s because “We love to encourage and celebrate the creativity of young people…”etc. If that’s so,then why on earth would the contest’s original Parent Consent Form ask for the child’s city of birth,date of birth and last four digits of the child’s SSN? Along with complete contact info of the parents.
You see what Google knows and many parents don’t know is that a person’s city of birth and year of birth can be used to make a statistical guess about the first five digits of his/her social security number. Then,if you can somehow obtain those last four SSN digits explicitly —voila,you’ve unlocked countless troves of personal information from someone who didn’t even understand that such a disclosure was happening.
This kind of data can be linked with other databases to target advertising. It’s worth many times more than what Google will spend on prizes (each State Finalist gets a T-shirt!).
[...]
So in closing,three simple ideas for you,gentle reader,to take away. (1) City of birth,when coupled with year of birth,can be correlated to social security numbers,so don’t give it out just because a box appears on a form. (2) No public contest should ask for any part of a social security number,especially involving kids. (3) For internet searches,have you tried Yahoo! or Bing lately? You just might find what you’re looking for.

Scary. And yes,what would hold Google back from making this information available to marketers?

Check + Fix Browser and Plug-in Vulnerabilities –Neat Tool by Qualys

By Sven Olensky,on February 17th,2011%

Qualys released a new tool,BrowserCheck,that tests your browser for vulnerabilities. It also checks any plugins you may have installed and tests if they are vulnerable and pose a risk to your infrastructure.

What items are detected by Qualys BrowserCheck?
The Qualys BrowserCheck tool checks your browser as well as browser plugins and add-ons to identify insecure and out-of-date versions that put you at risk. It also checks if your Windows operating system is supported by Microsoft. Microsoft security updates cannot be installed on unsupported operating system versions. These items are detected:
Windows Mac Linux
OS support expiration
(IE,Firefox,Chrome) X
Web Browser used to scan X X X
Adobe Flash Player X X X
Adobe Reader 5.x and above X X X
Adobe Shockwave Player X X
Apple Quicktime X X
BEA JRockit X X X
DivX Web Player X X
Foxit Reader
(IE,Firefox,Chrome) X
Flip4Mac Windows Media plugin X
Microsoft Silverlight X X
Microsoft Windows Media Player
(IE,Firefox,Chrome) X
Novell Moonlight X
Real Player X
Java Runtime X X X
Totem Media Player X
VLC Media Player X X X
Yahoo! BrowserPlus X X
Windows Presentation Foundation plug-in
(Firefox,Chrome) X

If you see any issues,follow the ‘Fix it’links and update your applications.

Kudos to Qualys,very neat.

Check your Stuff Here.

Patch your Java installations –intrusion prevention systems cannot catch exploits –and they are out there!

By Sven Olensky,on October 18th,2010%

Interesting article on the MS malware research center blog today:exploiting vulnerable Java installations has been trending very high on Microsoft’s radars.

From their article:

What I discovered was [...] an unprecedented wave of Java exploitation. In fact,by the beginning of this year,the number of Java exploits (and by that I mean attacks on vulnerable Java code,not attacks using JavaScript) had well surpassed the total number of Adobe-related exploits we monitored.

Very interesting read. And the lesson out of that is:you need to patch all your installed applications if you want a secure system. First step right now though is:patch your Java installation on all of your computers.

Look at the number of attacks for the top 2 Java vulnerabilities since 2008:

CVE	Attacks	Computers	Description
CVE-2008-5353	3,560,669	1,196,480	A deserialization issue in vulnerable versions of JRE (Java Runtime Environment) allows remote code execution through Java-enabled browsers on multiple platforms,such as Microsoft Windows,Linux,and Apple Mac OS X.
CVE-2009-3867	2,638,311	1,119,191	Another remote code execution,multi-platform issue caused by improper parsing of long file:// URL arguments.
CVE-2010-0094	213,502	173,123	Another deserialization issue,very similar to CVE-2008-5353.

Very troubling indeed.

Facebook apps are leaking your identity to advertisers against your wishes

By Sven Olensky,on October 18th,2010%

The Wall Street Journal reports that Facebook has been involved in a breach of protocol. Applications such as Farmville and others leak user IDs to advertisers and spammers for targeted advertising.

From the article:

Many of the most popular applications,or “apps,”on the social-networking site Facebook Inc. have been transmitting identifying information—in effect,providing access to people’s names and,in some cases,their friends’names—to dozens of advertising and Internet tracking companies,a Wall Street Journal investigation has found.
The issue affects tens of millions of Facebook app users,including people who set their profiles to Facebook’s strictest privacy settings. The practice breaks Facebook’s rules,and renews questions about its ability to keep identifiable information about its users’activities secure.
[...]
The most expansive use of Facebook user information uncovered by the Journal involved RapLeaf. The San Francisco company compiles and sells profiles of individuals based in part on their online activities.
The Journal found that some LOLapps applications,as well as the Family Tree application,were transmitting users’Facebook ID numbers to RapLeaf. RapLeaf then linked those ID numbers to dossiers it had previously assembled on those individuals,according to RapLeaf.

What can you do? I recommend deleting and disabling all the Facebook apps you are using,as a cautionary measure.

Over-hyping and fawning over Stuxnet:Get over it. This is how it is going to be from now on.

By Sven Olensky,on October 2nd,2010%

Everybody is afraid of Stuxnet. The killer worm. The cyber-missile. A weapon that can only have been built by an organisation with nation-state support.

Tell you what:Get over it. This is how it’s going to be from now on. This is just the beginning.

So far we have been in the stone-age of worms,trojans and viruses. Script kiddies using software to build run-of-the-mill malware. Sure,annoying malware that brings down enterprise networks,but it is annoying malware nonetheless. Organisations like the Russian Business Network sponsoring professional hackers to write malware that infects machines to spread SPAM,steal credit card data,etc. Sure. Still.

The more dependency there will be on infrastructure that is online, the more services and systems will be moved online to interconnect them,the more the risk increases that at one point,these services will be impacted by targeted attacks.

Think hospital and pharmacy services (“for hospital chain X on Tuesday,lets switch out all the blood pressure prescriptions that need to be filled with anti-cholesterol medications in the pharmacy system. See what happens”). Think ATMs (“spit out $1 bills instead of $20 bills and watch throngs of customers freak out. Do this for every ATM for Bank X on day Y”). Think turning off power lines,impact power grids (“Stuxnet could impact whole power grids globally“),and so on. The list is endless,the opportunities are numerous.

It is 2010. Wait how it looks like in 2012. or 2014.

This is just the beginning.

In my upcoming posts I will discuss what you can do as a business owner / security professional or a private individual to put up some defenses that will make it at least harder for attackers to gain control over your systems. Some of these measures are fairly simple,some of them are more involved.

Guard against SQL injection attacks:protect your database

By Sven Olensky,on June 9th,2010%

Scott Guthrie over at ASP.net has a really good primer on how to setup your data base to defend against SQL injection attacks. Somewhat dated,but still very applicable,especially in light of today’s findings that apparently a new mass SQL injection campaign is going on (I pointed this out just a minute ago).

The steps he describes are listed below. Navigate over to his blog for the full article:

1) Don’t construct dynamic SQL Statements without using a type-safe parameter encoding mechanism. Most data APIs (including ADO + ADO.NET) have support for allowing you to specify the exact type of a parameter being provided (for example:string,integer,date) and can ensure that they are escaped/encoded for you to avoid hackers trying to exploit it. Always use these features.
For example,with dynamic SQL using ADO.NET you could re-write the code above like below to make it safe:
Dim SSN as String = Request.QueryString(“SSN”)
Dim cmd As new SqlCommand(“SELECT au_lname,au_fname FROM authors WHERE au_id = @au_id”)
Dim param = new SqlParameter(“au_id”,SqlDbType.VarChar)
param.Value = SSN
cmd.Parameters.Add(param)
This will prevent someone from trying to sneak in additional SQL expressions (since ADO.NET above knows to string encode the au_id value),and avoid other data problems (incorrectly type-casting values,etc). Note that the TableAdapter/DataSet designer built-into VS 2005 uses this mechanism automatically,as do the ASP.NET 2.0 data source controls.
One common misperception is that if you are using SPROCs or a ORM you are completely safe from SQL Injection Attacks. This isn’t true –you still need to make sure you are careful when you pass values to a SPROC,and/or when you escape or customize a query with an ORM that you do it in a safe way.
2) Always conduct a security review of your application before ever put it in production,and establish a formal security process to review all code anytime you make updates. This later point is super important. Too often I hear of teams that conduct a really detailed security review before going live,then have some “really minor”update they make to the site weeks/months later where they skip doing a security review (“it is just a tiny update –we’ll code review it later”). Always do a security review.
3) Never store sensitive data in clear-text within a database. My personal opinion is that passwords should always be one-way hashed (I don’t even like to store them encrypted). The ASP.NET 2.0 Membership API does this for you automatically by default (and also implements secure SALT randomization behavior). If you decide to build your own membership database store,I’d recommend checking out the source code for our own Membership provider implementation that we published here. Also make sure to encrypt credit-card and other private data in your database. This way even if your database was compromised,at least your customer private data can’t be exploited.
4) Ensure you write automation unit tests that specifically verify your data access layer and application against SQL Injection attacks. This is really important to help catch the “it is just a tiny update so I’ll be safe”scenario,and provide an additional safety layer to avoid accidentally introducing a bad security bug into your application.
5) Lock down your database to only grant the web application accessing it the minimal set of permissions that it needs to function. If the web application doesn’t need access to certain tables,then make sure it doesn’t have permissions to them. If it is only read-only generating reports from your account payables table then make sure you disable insert/update/delete access.

Good stuff. Thanks Scott.

Vulnerability in iPhone data encryption Or:Do not lose your iPhone because everyone will be able to access it

By Sven Olensky,on May 26th,2010%

Bernd Marienfeldt,security officer at LINX,uncovered a pretty bad vulnerability of the latest iPhone that is out there:even with encryption,set passphrases etc,anyone using Ubuntu LINUX can access certain data you have stored on it. There is no fix for this yet.

More detail on Heise-Online,here is the article.

Excerpt:

.. found that he was able to gain unfettered access to his iPhone 3GS from Ubuntu 10.04. If he connected the device whilst it was turned off and then turned it on,Ubuntu auto-mounted the file system and was able to access several folders despite never having previously been connected to the iPhone. The H’s associates at heise Security have successfully reproduced the problem. An Ubuntu system which had never before communicated with the iPhone immediately displayed a range of folders. Their contents included the unencrypted images,MP3s and audio recordings stored on the device.

UPDATE:Rumors have it that this may also affect the iPad.

Child Safety on the Internet –Some Tips

By Sven Olensky,on January 24th,2010%

Excellent article on Microsoft.com:

Age-based guidelines for kids’Internet use
If your children use the Internet at home,you already know how important it is to help protect them from inappropriate content and contact.
Windows Live Family Safety and the parental controls included in Windows 7 and Windows Vista can help you create a safer online environment for your children.
The American Academy of Pediatricians (AAP) helped Microsoft develop age-based guidance for Internet use with the family safety settings in both of these products. It’s important to remember that these are guidelines only. You know your child best.
Up to age 10
Supervise your children until they are age 10. You can use Internet safety tools to limit access to content,Web sites,and activities,and be actively involved in your child’s Internet use,but Microsoft recommends that you sit with your child when they use the Internet,until the age of 10.
Here are some safety tips to consider when you go online with your 2-10 year old:
It’s never too early to foster open and positive communication with children. It’s a good idea to talk with them about computers and to stay open to their questions and curiosity.
Always sit with your kids at this age when they’re online.
Set clear rules for Internet use.
Insist that your children not share personal information such as their real name,address,phone number,or passwords with people they meet online.
If a site encourages kids to submit their names to personalize the Web content,help your kids create online nicknames that don’t give away personal information.
Use family safety tools to create appropriate profiles for each family member and to help filter the Internet.
For more information,see Windows Live Family Safety,Windows 7 Parental Controls,or Windows Vista Parental Controls.
Help protect your children from offensive pop-up windows by using the pop-up blocker that’s built in to Internet Explorer.
All family members should act as role models for young children who are just starting to use the Internet.
Ages 11 to 14
Children this age are savvier about their Internet experience,but it’s still a good idea to supervise and monitor their Internet use to help ensure they are not exposed to inappropriate materials. You can use Internet safety tools to limit access to content and Web sites and provide a report of Internet activities. Make sure children this age understand what personal information they should not give over the Internet.
When your kids are this age it might not be practical to physically supervise their Internet use at all times. You can use tools such as Windows Live Family Safety,Windows 7 Parental Controls,or Windows Vista Parental Controls.
Here are some safety tips to consider when you go online with your 11-14 year old:
It’s a good idea to foster open and positive communication with your children. Talk with them about computers and stay open to their questions and curiosity.
Set clear rules for Internet use.
Insist that your children not share personal information such as their real name,address,phone number,or passwords with people they meet online.
If a site encourages kids to submit their names to personalize the Web content,help your kids create online nicknames that give away no personal information.
Use family safety tools to create appropriate profiles for each family member and to help filter the Internet.
For more information,see Windows Live Family Safety,Windows 7 Parental Controls,or Windows Vista Parental Controls.
Set family safety tools on the medium security setting,which should have some limitations on content,Web sites,and activities.
Keep Internet-connected computers in an open area where you can easily supervise your kids’activities.
Help protect your children from offensive pop-up windows by using the pop-up blocker that’s built in to Internet Explorer.
Encourage your children to tell you if something or someone online makes them feel uncomfortable or threatened. Stay calm and remind your kids they are not in trouble for bringing something to your attention. Praise their behavior and encourage them to come to you again if the same thing happens.
Ages 15 to 18
Teens should have almost limitless access to content,Web sites,or activities. They are savvy about the Internet but they still need parents to remind them of appropriate safety guidelines. Parents should be available to help their teens understand inappropriate messages and avoid unsafe situations. It’s a good idea for parents to remind teens what personal information should not be given over the Internet.
Here are some safety tips to consider as you guide your teens online:
Continue to keep family communication as open and positive about computers as you can. Keep talking about online lives,friends,and activities,just as you would about other friends and activities.
Encourage your teens to tell you if something or someone online makes them feel uncomfortable or threatened. If you’re a teen and something or someone online doesn’t seem quite right,then speak up.
Create a list of Internet house rules as a family. Include the kinds of sites that are off limits,Internet hours,what information should not be shared online,and guidelines for communicating with others online,including social networking.
Keep Internet-connected computers in an open area and not in a teen’s bedroom.
Investigate Internet-filtering tools (such as Windows Vista Parental Controls,Windows 7 Parental Controls,or Windows Live Family Safety ) as a complement to parental supervision.
Help protect your children from offensive pop-up windows by using the pop-up blocker that’s built in to Internet Explorer.
Know which Web sites your teens visit,and whom they talk to. Encourage them to use monitored chat rooms,and insist they stay in public chat room areas.
Insist that they never agree to meet an online friend.
Teach your kids not to download programs,music,or files without your permission. File-sharing and taking text,images,or artwork from the Web may infringe on copyright laws and can be illegal.
Talk to your teenagers about online adult content and pornography,and direct them to positive sites about health and sexuality.
Help protect them from spam. Tell your teens not to give out their e-mail address online,not to respond to junk mail,and to use e-mail filters.
Be aware of the Web sites that your teens frequent. Make sure your kids are not visiting sites with offensive content,or posting personal information. Be aware of the photos that teens post of themselves and their friends.
Teach your kids responsible,ethical,online behavior. They should not be using the Internet to spread gossip,bully,or threaten others.
Make sure your teens check with you before making financial transactions online,including ordering,buying,or selling items.
Discuss online gambling and its potential risks with your teens. Remind them that it is illegal for them to gamble online.

I would like to add that the most safety is offered through you,the parents. Make sure you communicate with your children. Educate yourself about the Internet.

The GANSEC Security Weblog

LulzSec –Sabu taken down –leadership of LulzSec arrested

Lookout Security App protects your Droid,Blackberry and Windows smartphone

Check + Fix Browser and Plug-in Vulnerabilities –Neat Tool by Qualys

What items are detected by Qualys BrowserCheck?

Patch your Java installations –intrusion prevention systems cannot catch exploits –and they are out there!

Guard against SQL injection attacks:protect your database

Vulnerability in iPhone data encryption Or:Do not lose your iPhone because everyone will be able to access it

DarkReading

Blog Archive

SANS News

Recent Posts

Post Overview