Advisories « The GANSEC Security Weblog

Trendnet home security cam flaw exposes video feeds on net

By Sven Olensky,on February 7th,2012%

Feeds from thousands of Trendnet home security cameras have been breached,allowing any web user to access live footage without needing a password.
Internet addresses which link to the video streams have been posted to a variety of popular messageboard sites.
Users have expressed concern after finding they could view children’s bedrooms,among other locations.
[...]
The author discovered that after setting up one of the cameras with a password,its video stream became accessible to anyone who typed in the correct net address.
Trendnet says it is in the process of releasing firmware updates for its devices
In each case,this consisted of the user’s IP address followed by an identical sequence of 15 characters.
The writer then showed how the Shodan search engine –which specialises in finding online devices –could be used to discover cameras vulnerable to the flaw.
[...] Mr Wood added that the California-based firm estimated that “fewer than 1,000 units”might be open to this threat in the UK,but could not immediately provide an exact global tally beyond saying that it was “most likely less than 50,000″.

Trendnet released patches to be applied to fix this issue. I would recommend you apply them ASAP,unless you want the insides of your homes displayed on the Internet.

Apache-Killer –Denial of Service against your web server –exploit in the wild

By Sven Olensky,on August 28th,2011%

A couple of days ago a script was published on the Full Disclosure mailing list:“Apache Killer”. It exploits a denial of service vulnerability in any recent Apache web server installations and it has been confirmed working. Any web server running current versions of Apache (and older) can be affected by it. So far,no patch has been released,only workarounds to avoid hitting the issue have been published. The caveat is,a lot of web application packages / appliances run the Apache web server,so even if you haven’t directly installed Apache yourself,you may still be vulnerable.

An attack against a vulnerable site can result in a denial of service condition which can render the site unresponsive.

This is the post that contains the exploit as well as an description of the problem:http://seclists.org/fulldisclosure/2011/Aug/175

This is the announcement by Apache:http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox

The posting also includes workarounds for the issue. See the post above for details.

RSA finally admits that SecurID tokens have been compromised

By Sven Olensky,on June 7th,2011%

Too little,too late —they could have admitted that when it first went public –RSA finally admitted that SecurID tokens have been compromised. How many? All of them.

HelpNetSecurity reports:

The admission comes in the wake of cyber intrusions into the networks of three US military contractors –one of them confirmed by the company,others hinted at by internal warnings and an unusual domain name and password reset process.
RSA’s Chairman Art Coviello has stated that the company is offering to virtually all of its customers to replace the SecurID tokens they are currently using or to provide security monitoring services. For financial institutions,RSA is offering to also provide transactions monitoring.
No additional details about what the RSA attackers did steal that allowed them to misuse the tokens,but it seems likely that both the seeds that link every token to a specific account and the algorithm that calculates the numeric sequence generated by the token have been compromised.

If you use RSA SecurID,you will need to request new tokens for your entire organization ASAP.

Playstation Network Hack –Personal Data Stolen

By Sven Olensky,on April 27th,2011%

Well,after 6 days of downtime Sony finally released some information about the Playstation Network Intrusion:personal data of users may have been stolen.. As Kotaku reports,

Among the possible information stolen:
Name
Address (city,state,zip)
Country
Email address
Birthdate
PlayStation Network/Qriocity password and login and handle/PSN online ID.
“While there is no evidence at this time that credit card data was taken,[they] cannot rule out the possibility.”
”If you have provided your credit card data through PlayStation Network or Qriocity,[...] your credit card number (excluding security code) and expiration date may have been obtained,

What should you do?

change your PSN password immediately (well,once you can log back into the network –it is still down and will be down for another couple of days,according to Sony)
check your credit card for unauthorized charges –you may want to consider cutting it up and getting a new one –call your CC company and tell them you have lost it

Check + Fix Browser and Plug-in Vulnerabilities –Neat Tool by Qualys

By Sven Olensky,on February 17th,2011%

Qualys released a new tool,BrowserCheck,that tests your browser for vulnerabilities. It also checks any plugins you may have installed and tests if they are vulnerable and pose a risk to your infrastructure.

What items are detected by Qualys BrowserCheck?
The Qualys BrowserCheck tool checks your browser as well as browser plugins and add-ons to identify insecure and out-of-date versions that put you at risk. It also checks if your Windows operating system is supported by Microsoft. Microsoft security updates cannot be installed on unsupported operating system versions. These items are detected:
Windows Mac Linux
OS support expiration
(IE,Firefox,Chrome) X
Web Browser used to scan X X X
Adobe Flash Player X X X
Adobe Reader 5.x and above X X X
Adobe Shockwave Player X X
Apple Quicktime X X
BEA JRockit X X X
DivX Web Player X X
Foxit Reader
(IE,Firefox,Chrome) X
Flip4Mac Windows Media plugin X
Microsoft Silverlight X X
Microsoft Windows Media Player
(IE,Firefox,Chrome) X
Novell Moonlight X
Real Player X
Java Runtime X X X
Totem Media Player X
VLC Media Player X X X
Yahoo! BrowserPlus X X
Windows Presentation Foundation plug-in
(Firefox,Chrome) X

If you see any issues,follow the ‘Fix it’links and update your applications.

Kudos to Qualys,very neat.

Check your Stuff Here.

BBC Sites Injected with Malware –You wouldn’t realize you were infected –How to Secure Your PC

By Sven Olensky,on February 17th,2011%

Several sites,one of them Darkreading,reported yesterday that some BBC-owned sites were injected with malware. You would not have to click anywhere to get infected,simply pulling up the site would be enough to get you in trouble.

As Darkreading reports,

Two websites operated by the BBC have been infected by iFrame attacks and could be serving up malware,according to researchers
The BBC-6 Music site and areas of the BBC 1Xtra radio station site are affected,according to a blog by researchers at Websense.
The injected iFrame occurs at the foot of the BBC 6 Music Web page,and loads code from a site in the .co.cc top-level domain,Websense says. The iFrame injected into the Radio 1Xtra Web page leads to the same malicious site.
“If an unprotected user browsed to the site,they would be faced with drive-by downloads,meaning that simply browsing to the page is enough to get infected with a malicious executable,”Websense says.
The payload is delivered to the end user only once,and the initial visit is being logged by the malware authors,Websense says. The code that is delivered to end users utilizes exploits delivered by the Phoenix exploit kit. Only about 20 percent of antivirus products would detect this file,the researchers say.
[...] “The drive-by on the BBC website takes advantage of an exploit against Adobe PDF reader;among other exploits it delivers a drive-by-download that infects users’machines and has them join the Bredolab botnet.”[...]

This shows:

You don’t have to open a ‘bad site’to get infected.
You need to keep your computers always patched up to the most current versions.
Patching Windows alone (through Windows Update) is NOT ENOUGH. You also need to make sure that any other applications on your machines are current as well,as third party vulnerabilities can also lead to a compromise of your infrastructure.

I wrote an article on things to consider in order to keep your computers as safe as possible. Feel free to read it here.

Microsoft Patch Tuesday + Multiple Adobe Updates –patch now!

By Sven Olensky,on February 9th,2011%

The good folks at Sophos have a nice summary of some important patches that were released by Microsoft and Adobe.

They report,

[…] Microsoft published 3 critical and 9 important fixes today.
[…]
Adobe bulletin APSB11-01 resolves 21 vulnerabilities in Shockwave Player. […] download the latest version at http://get.adobe.com/shockwave.
Adobe bulletin APSB11-02 fixes 13 vulnerabilities in Flash Player,[…] can be downloaded from http://get.adobe.com/flashplayer.
Adobe bulletin APSB11-03 addresses 29 vulnerabilities in Adobe’s Reader and Acrobat products. […] get it from http://get.adobe.com/reader.

You should get the latest Windows updates automatically. To doublecheck that you are all set up,in your Internet Explorer,click on ‘Safety’–‘Windows Update’,then check if you have any patches pending. If you do,install them ASAP.

Dozens of important and critical vulnerabilities are being fixed for Windows and Adobe,I highly recommend you patch as soon as you can.

UPDATE:How to enable encryption for your Facebook account –IMPORTANT!

By Sven Olensky,on January 28th,2011%

UPDATE:

Facebook is slowly rolling this out to the user base. If you haven’t been able to set this yet,try again and keep checking back on it in 24 hour intervals.

The good folks at Sophos created a video that shows you how you can enable SSL encryption for your Facebook sessions. That way your sessions cannot be monitored anymore,and your account information cannot be stolen via tools like Firesheep.

The video is here.

Basically,in your Facebook browser window,execute the following steps:

1. Navigate to Account (top right) –Account Settings –Account Security

This is in the process of being rolled out,so you may not see the next option just yet,if you do not,check back in half a day or so:

2. Under ‘Secure Browsing (https)’,check ‘Browse Facebook on a secure connection (https) whenever possible’.

3. Hit ‘Save’.

4. Log out of your Facebook session via ‘Account’–‘Logout’or close your browser (via ‘Quit’).

5. From now on,navigate to https://www.facebook.com to log in,not ‘http://www.facebook.com’.

That’s it!

NOTE:THIS DOES NOT PROTECT YOU FROM KEYLOGGERS AND VIRUSES THAT ARE INSTALLED ON YOUR MACHINE. It is NOT RECOMMENDED to hit up the Internet from public terminals that you do not control yourself. Attackers can still infect those machines and steal your information! Always use your own laptop/device to connect to public sites,especially if you have to submit log-in information at any point.

Vodafone Customer Database Breached –Millions Leaked

By Sven Olensky,on January 9th,2011%

Vodafone announced that it believes that its customer database has been breached and millions of records have been exposed.

As this article reports:

Vodafone has confirmed it believes its secure customer database has been breached by an employee or dealer who has shared the access password,revealing the personal details of millions of customers.
Vodafone chief executive,Nigel Dews,says he became aware the password to the online portal had been shared when the company was tipped-off on Saturday by a newspaper reporter.
He says an internal investigation is underway to work out who breached the system and how.
Passwords will also be reset.

They apparently have been having some other security related issues as well:

Others have also obtained logins to check their spouses’communications.
The details are reportedly accessible from any computer because they are kept on an internet site rather than Vodafone’s internal system.
Mobile phone dealers have also admitted that anyone with full access to the system can look up a customer’s bills and make changes to accounts.

I don’t know about you,but I would consider switching away from that provider. Apparently they don’t care too much about security.

Facebook –“My 1st Status”Scam spreading

By Sven Olensky,on January 6th,2011%

The good people at Sophos report that the messages you started seeing on Facebook about seeing your ‘First ever status update’are a scam making some people some good money.

They write:

Thousands upon thousands of Facebook users have been hit by a new survey scam spreading virally across the social network.
Messages claiming to be users’first ever Facebook status updates are being posted on users’walls by a rogue application,designed to earn revenue for the scammers behind the attack.
[...]
Every survey which is completed earns them some commission. In some cases they might also ask for your mobile phone number in order to sign you up for an expensive premium-rate service.
And you? Well,you’ll find that the rogue application has meanwhile taken the opportunity to post a message on your Facebook page,which is now being seen by all of your online friends. When I deliberately infected a test account with the rogue application it got my first status message incorrect,as well as the date that I first posted to the Facebook account.
[...]

Sophos created a Youtube video that shows how you can clean up your Facebook settings if you were hit by this,it can be viewed here.

Needless to say,if you see somebody ‘posting their first status’and invites you to do so as well,DO NOT CLICK ON IT.

The GANSEC Security Weblog

Trendnet home security cam flaw exposes video feeds on net

Apache-Killer –Denial of Service against your web server –exploit in the wild

RSA finally admits that SecurID tokens have been compromised

Playstation Network Hack –Personal Data Stolen

Check + Fix Browser and Plug-in Vulnerabilities –Neat Tool by Qualys

What items are detected by Qualys BrowserCheck?

BBC Sites Injected with Malware –You wouldn’t realize you were infected –How to Secure Your PC

Microsoft Patch Tuesday + Multiple Adobe Updates –patch now!

Vodafone Customer Database Breached –Millions Leaked

Facebook –“My 1st Status”Scam spreading

DarkReading

Blog Archive

SANS News

Recent Posts

Post Overview