Security Corner

November 9, 2009  1:27 AM

Javascript Must Die!

Ken Harthun Ken Harthun Profile: Ken Harthun

At least that’s what Mr. John Graham-Cumming says on his blog–and what he told attendees at Virus Bulletin 2009 in his presentation called, “JavaScript Security: The Elephant running in your browser:”

My thesis is that the security situation with JavaScript is so poor that the only solution is to kill it. End users have very little in the way of protection against malicious JavaScript, major web sites suffer from XSS and CSRF flaws, the language itself allows appalling security holes, and as data moves to the cloud the 14 year old JavaScript security sandbox becomes more and more irrelevant.

I’ve been recommending that everyone use NoScript with Firefox for quite some time. Here’s my article from more than a year ago: Software for Secure Computing: Firefox & NoScript. Recent security updates to Firefox tend to reinforce this view since most of the workarounds for security flaws recommend disabling Javascript.

What do you think? Should Javascript be killed? Would this break 99% of the web sites out there?

Maybe it’s time for a new technology.

November 9, 2009  12:56 AM

If You Never Get on the Internet, You’ll Never Have a Problem

Ken Harthun Ken Harthun Profile: Ken Harthun

So, if all you need to do with your PC is write documents that you’re going to print out locally or balance your checkbook with information that you’ve input offline, you should be safe, right? Wrong. Did you bring home anything from the office, like on a thumb drive, or on an – now obsolete – floppy disk? Do you ever do this? Well, if you do, then you’re not completely safe.

Have you been computing long enough to remember the “Stoned” virus? This little nasty (though it really wasn’t very nasty compared with today’s malware) spread via infected floppy disks. My entire business (8 computers) got hit with it in 1989. We had a “sneaker net” in those days and almost everyone had to work on various documents at some point. The disk got passed around to every computer before I figured out what was going on and neutralized the threat.

It’s true that if you never get on the Internet, you reduce your attack surface significantly, but, really, do you know anyone who isn’t connected to the Internet in some way these days? I think not. So, Houston, we have a problem.

Who do you know who’s willing to unplug their PC from the Internet?

I guess those of us in the security field don’t really have to worry about our jobs, do we?

November 6, 2009  1:22 AM

Free Licenses for Some Good Security Software

Ken Harthun Ken Harthun Profile: Ken Harthun

I just got these in my email from (Gizmo’s Freeware site) and figured I should pass them on. You can’t beat free and these two programs are top-rated. Note that these are time limited offers.

Get a-squared Anti-Malware for Free On Wed 11 November

Emsisoft are releasing their top rated a-squared Anti-Malware program with a free one year license. This offer is valid for 24 hours only commencing at 11:11 (CET) on Wednesday 11th November, 2009.

Get top rated Bullguard Internet Security Suite for Free

Combine the excellent Agnitum Firewall with the excellent BitDefender AV and throw in online support direct from the product user interface and you get the Bullguard Internet Security Suite- one of Europe’s most popular security products. Get a full 12 month license including support on November 5 and 6 only. A Gizmo’s Freeware exclusive.

I highly recommend Gizmo’s site; there’s nothing but the best freeware and it’s the first place I look when I’m trying to find any utility.

October 30, 2009  3:41 PM

A Serious (Not!) Intervention

Ken Harthun Ken Harthun Profile: Ken Harthun

Hey, tomorrow’s Halloween, our annual celebration of all things dark and evil. This video, produced by security firm Comodo is hilarious, yet hides a rather dark truth–quite in the spirit of our creepy holiday.

The video pays homage to the popular A&E Television series “Intervention,” which portrays people whose lives are on a downward spiral, and the redemption of the people who care about them. In this case “Laptop” is infected with malware, and the experts step in.

“We make the point any way we can,” said Melih Abdulhayoglu, CEO of Comodo. “This parody is funny. We hope its humorous approach grabs viewers’ attention and convinces them to install antivirus and firewall software.”

In “Intervention: Laptop (The Banned Episode!),” Laptop is a personal computer struggling with an addiction to malware and viruses. Her loved ones are desperate for help, and have reached out to the Intervention team. Can an intervention set Laptop down the right path, or will she shut down for good? Watch and find out.

Happy Halloween, everybody!

October 30, 2009  3:11 PM

Hacking Skills Challenge – Level 8

Ken Harthun Ken Harthun Profile: Ken Harthun

So far, we’ve explored the first 7 basic missions at The difficulty of these challenges increases at each level, but this one is not too tough if you look at the clues. Here’s the challenge:

The password is yet again hidden in an unknown file. Sam’s daughter has begun learning PHP, and has a small script to demonstrate her knowledge. Requirements: Knowledge of SSI (dynamic html executed by the server, rather than the browser).

Sam remains confident that an obscured password file is still the best idea, but he screwed up with the calendar program. Sam has saved the unencrypted password file in /var/www/

However, Sam’s young daughter Stephanie has just learned to program in PHP. She’s talented for her age, but she knows nothing about security. She recently learned about saving files, and she wrote an script to demonstrate her ability.

Did you catch that key phrase in the description above? It’s “…executed by the server…” and it’s PHP. That’s what tipped me off. We should be able to execute a simple PHP script from the input box, don’t you think? In PHP you can execute commands with a simple structure. Let’s see what happens if we type in the ls command like this:

[<]!–#exec cmd=”ls”–[>] (brackets to allow proper display only–don’t use them)

That give us some output, but not what we’re looking for, I’m afraid:

Your file has been saved. Please click here view the file.

That output is at ../level8.php. If you click the link to view the file, you’ll see this at ../tmp/[random filename].shtml:

Hi, tshngmww.shtml hipykpqu.shtml ztxdhjxn.shtml…[and a lot more].

That’s not what we’re looking for.

Oh, wait. We just did a listing of the current directory, /var/www/; We want to go up one level to /var/www/ Let’s try that command again so we list the parent directory:

[<]!–#exec cmd=”ls ..”–[>] (again, don’t use the brackets)

Voila! Now we get this as the output when we click the link to view:

Hi, au12ha39vc.php index.php level8.php tmp!

The file au12ha39vc.php looks like the one. Plug it into the browser and you get the password: 40087506.

Mission accomplished!

October 30, 2009  2:02 PM

Updating the Anti Virus Bootable Thumb Drive

Ken Harthun Ken Harthun Profile: Ken Harthun

My recent post, Convert Any Live CD to a Bootable Thumb Drive in Minutes, referred to the Kaspersky rescue CD as one possible way to make an anti virus bootable USB thumb drive. A lot of people over at my Ask the Geek site have done that and had success with it. However, I have been getting a lot of questions about the updating function, most of them along the line of how to force a static IP address. This should clear it all up.

The Question: Hey Geek, As with the other commenters, thank you so much for this guide and utility. It could potentially be a life saver.

I do however have a few questions:

1) I am guessing the networking side of things works via dhcp, i have looked through the files, but am no linux expert so wondered if there is a way of setting a static ip?

2) Where are the virus deffinition updates saved to? I ran the update on my laptop (dhcp) then plugged the usb drive to a machine with no dhcp and it said the deffinitions were out of date, I would have hope it updated them on the usb key?

My answer: 1. Yes, it works via DHCP. Normally, you would be able to set a static ip address by using the procedure below. You’ll want to get into the linux command console. I believe the rescue disk UI has a link for that. You can then assign a static ip address:

ifconfig eth0 <ip address> up netmask
route add default gw <gateway router address>
ifconfig eth0 down
ifconfig eth0 up
route add default gw <gateway router address>

You can verify the ip address by typing ifconfig with no parameters. It
should show the address you set for eth0.

2. The updates are saved to memory, so they go bye-bye when you reboot.
It’s better to update every time you use it anyway, so you always have
the current definitions. I’ll investigate the ../etc/conf file and see
if I can resolve this.

Hope this helps anyone here who has had similar questions.

October 29, 2009  1:16 AM

18 Nigerian Spammers Headed for the Slammer

Ken Harthun Ken Harthun Profile: Ken Harthun

Nigeria’s Economic and Financial Crimes Commission (EFCC) says that their “Operation Eagle Claw” has so far seen members of 18 syndicates arrested and 800 scam websites shut down. The chairman of the anti-scam force, Mrs. Farida Waziri said:

We expect that Eagle Claw as conceived will be 100% operational within six months and at full capacity, it will take Nigeria out of the top 10 list of countries with the highest incidence of fraudulent e-mails.

At the moment, Eagle Claw has delivered the following results:

Over 800 fraudulent e-mail addresses have been identified and shut down. The EFCC is fine tuning security modalities with Microsoft and upon full deployment, the capacity to take down fraudulent e-mails will increase to 5,000 monthly. Further it is projected that advisory mails to be sent to victims and potential victims will be about 230,000 monthly.

There have been 18 arrests of high profile syndicates operating cyber crime organizations.

When it [Eagle Claw] is fully deployed, it will afford the EFCC the option of either monitoring or shutting down all fraudulent email addresses. The EFCC would also have identified victims and potential victims and advised them that their email has been compromised.

Does this mean we won’t be getting anymore of those touchy-feely emails from Mrs. Farzad Arubi (or whatever bogus names they use these days) who really needs our help to move a million dollars from her late (murdered) husband’s estate?

Not likely, but it’s good see some of the perpetrators taking it on the chin.

October 28, 2009  12:15 AM

Hacking Skills Challenge – Level 7

Ken Harthun Ken Harthun Profile: Ken Harthun

Once again it’s a slow security news week, so time to tackle the next hacking skills challenge level. So far, we’ve explored the first 6 basic missions at The difficulty level is supposed to increase at each level, but this one is only difficult if you don’t know Linux. Here’s the challenge:

The password is hidden in an unknown file, and Sam has set up a script to display a calendar. Requirements: Basic UNIX command knowledge.

This time Network Security Sam has saved the unencrypted level7 password in an obscurely named file saved in this very directory.

In other unrelated news, Sam has set up a script that returns the output from the UNIX cal command.

This one is so easy you don’t even have to look at the source code. But you do have to know about chaining commands in Unix.

If you enter a year, you’ll get a full 12-month calendar with all weeks beginning on Sunday displayed on the resulting output page. This is default behavior of the cal command. It looks like all the script does is execute the command, taking your input as a parameter.  We can prove this by leaving the field blank; the script returns the current month and year, i.e., default behavior.

The key to cracking this one is the phrase “…obscurely named file saved in this very directory.” We know the permissions are good to run commands on that directory, so let’s just chain the ls — list directory contents — command and see what happens. (You chain commands in Linux using && between them.) Enter the following in the text box: && ls and click the View button. Here’s the output:

       October 2009
Mon Tue Wed Thu Fri Sat Sun
              1   2   3   4
  5   6   7   8   9  10  11
 12  13  14  15  16  17  18
 19  20  21  22  23  24  25
 26  27  28  29  30  31



Looks to me like k1kh31b1n55h.php is our file. Stick it in the URL and open it up. Voila! The password, f866d6b9, is revealed.

Mission accomplished!

October 21, 2009  7:08 PM

Panda Security Finds Automotive Industry Hit Hardest by Spam

Ken Harthun Ken Harthun Profile: Ken Harthun

Interesting study. It seems that spam content received is constant across all industries and the majority of it is pharmaceutical related. This could mean one of two things: either very few spammers are responsible (likely); or, a lot of men fall for the v-i-AGR*A spam. Anyway, check it out:

Panda Security has just completed a 3-month long study of spam across 11 different industries, exposing that automotive industry is most heavily targeted. The study found that 99.89 percent of all e-mail received by the automotive industry is spam, with just .11 percent being legitimate messages. The automotive industry was closely followed by the electronics industry and governmental sector as the top spam targets.

When analyzing the survey, Panda found it particularly interesting that while industries are targeted in different ratios, the content of the spam they receive (the majority of which is pharmaceutical related) is constant across all industries.

View the full press release online here:

Panda has posted a breakdown of how each industry is affected to its Flickr page:

October 20, 2009  12:12 AM

Acrobat Reader Users Should Switch to Foxit Reader, Shrink Their Attack Surface

Ken Harthun Ken Harthun Profile: Ken Harthun

I’m not going to rant, I promise–I don’t have to because this doesn’t affect me. Several years ago, I abandoned the bloated, insecure and extremely resource-intensive Acrobat Reader in favor of the smaller and more secure Foxit Reader. Once again, here is more evidence that I’m right to have switched.  Brian Krebs of The Washington Post wrote:

Adobe Plugs 29 Critical Reader, Acrobat Holes

Adobe Systems Inc. on Tuesday issued a new version of both Adobe Acrobat and its free Adobe PDF Reader to fix at least 29 separate security vulnerabilities in these products.

If you have either (or both) of these programs installed, take a moment to update them. Adobe warns that hackers already are exploiting at least one of the flaws to break into vulnerable systems.

No! Don’t update. Shrink your attack surface and switch to Foxit Reader and their other PDF software. Not only are Foxit Software’s products more secure, they’re also cheaper.

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: