Foxit Reader has released updates for multiple vulnerabilities. By convincing a user to open a malicious PDF file, an attacker may be able to execute code or cause a vulnerable PDF viewer to crash. The PDF could be emailed as an attachment or hosted on a website.US-CERT encourages users to review the Foxit Security Bulletin and Vulnerability Note VU#251793 and apply any necessary updates.
The Foxit Security Bulletin describes the issues:
Two Security Vulnerabilities Fixed in Foxit Reader 3.0 and JPEG2000/JBIG2 Decoder
Here is detailed information about the vulnerabilities:
1. Fixed a problem related to negative stream offset (in malicious JPEG2000 stream) which caused reading data from an out-of-bound address. We have added guard codes to solve this issue.
2. Fixed a problem related to error handling when decoding JPEG2000 header, an uncaught fatal error resulted a subsequent invalid address access. We added error handling code to terminate the decoding process.
I recommend that all Foxit Reader users update their Foxit Reader 3.0, available here: http://www.foxitsoftware.com/downloads/. Then, be sure to go to Help>Check for updates and download the stream decoder update.
In Part 1 of this series, I introduced you to the concept of date/time coincidence and we explored five registry keys that are useful to the forensic examiner. This time, I’ll show you how data can be encrypted and hidden in the registry.
If you’re involved in data security, you’re familiar with cryptography in some fashion and you know that ciphers – algorithms for performing encryption and decryption – are what do the work. You probably also know that there are a few quick-and-dirty algorithms for encrypting data. One such algorithm is known as the Caesar Cipher, or ROT-13, a simple algorithm that encrypts data by shifting each character 13 places in the alphabet while leaving non-alpha characters untouched. It’s so simple that you can decrypt it manually, but it’s enough to fool the casual observer. Anyone coming across something like cnffj beqsb egurf rperg svyrf vfcnf fjbeq, is naturally going to assume it’s encrypted; in fact, it’s ROT-13 for password for the secret files is password. I broke it up into five-character groups to make it more convincing.
For whatever reason, Microsoft uses ROT-13 to encrypt data in some registry keys. One such key is: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist. Here’s an example: “HRZR_EHACNGU:P:\AFYBBXHC.RKR.” Decrypted, that’s “UEME_RUNPATH:C:\NSLOOKUP.EXE.” (We’ll look at the UserAssist key in Part 3.) A better way to hide data is to encode text-based information in binary format and store it in binary form as a string in registry values of type REG_SZ. Given that binary data is common in the registry, the technique would make it extremely difficult to retrieve the hidden information.
In addition to using ROT-13 and binary encoding to obfuscate data, a suspect could take advantage of a flaw in the registry editor to also make the data invisible to anyone but a forensics examiner who knows about the flaw. From “Forensic Analysis of the Windows Registry:”
The Windows 2000 and XP Registry Editor (regedit.exe or regedt32.exe) have an implementation flaw that allows hiding of registry information from viewing and editing, regardless of users access privilege (Secunia, 2005). The flaw involves any registry values with name from 256 to 259 (maximum value name) characters long. The overly long registry value (regardless of type) not only hides its own presence, but also subsequently created values (regardless of type) in the same key (Franchuk, 2005). The editor stops displaying the remaining of the values thinking the overly long value as the last value in that key. Suspect could exploit such Registry Editor flaw to hide information.
The Windows console registry tool (reg.exe) can display these overly long registry values so the hidden data can be recovered as evidence; however, given the sheer number of entries in the registry, this process is not trivial.
I hope this series is giving you some insight, perhaps even piqueing your interest, in cyber forensics. Hit the comment button and tell me what you think.
In Part 3, we’ll explore some keys that can tell us where a suspect has been storing files.
My new eBook, “14 Golden Rules of Computer Security” is almost complete and will be ready for downloading shortly. Written with the non-technical person in mind, the book is packed with proven, practical advice on how to stay safe on the Wild, Wild Web including bonus articles about creating strong, easy-to-remember passwords and email security tips. I give you tons of links to free and low-cost tools as well as special discounts for software and services by some of the best computer security companies in the business. It’s a must-have for every computer owner.
Based upon my popular “How to Secure Your Computer” series of web articles and fully updated with late-breaking information on safe searching and social networks, “14 Golden Rules of Computer Security” will help you help your clients develop their own secure computing practices and save you from the hassle of dealing with unpleasant malware attacks.
All Security Corner readers are eligible for a free copy. Sign up by clicking here and you’ll be sent a download link when I release the book.
Are you? It’s not necessarily a derogatory term. Neither is “geek.” But what does “hacker” really mean? Here’s one opinion:
Someone that is looking to work outside the normal parameters. The media grabs the term and turns it into something bad. Like all hackers are evil and looking to steal your identity, your money and bring down the system in some [sort of] anti-government/corporate protest. Sure there are always extremist[s] on the either side of nearly any issue…For a true hacker, statements like, "Never do this…" or "one use only" or even better the golden "authorized users only" tend to get us thinking. What is behind that interface, that door, that piece of tape that will void my warranty if removed you are trying to keep me from learning.
Folks, I’m a hacker. I hack computers and networks—it’s part of my job—I don’t do anything malicious, but I dig into things I probably shouldn’t. I’ve always been the kind of guy who takes things apart to see what makes them tick. Usually, I get them back together the way they were. Sometimes, I break them; but, I always come away with a better understanding of how things work.
If more people were “hackers,” if more people knew how things work, if more people *understood* how this universe is put together, if more people even cared to look, this world would be a better place.
I’m a hacker. Are you?
Enter “screensavers” into any major search engine and there’s better than a fifty percent chance that any result you click on will land you on a malicious website. According to McAfee’s recently released report “The Web’s Most Dangerous Search Terms,“ that search term carries a maximum risk of 59.1 percent. Furthermore, lyrics and anything that includes the word “free” have a high risk of exposing users to malicious or fraudulent web sites. Health-related search terms have the lowest risk profile. Check out The Web’s most dangerous keywords to search for on ZDNet.com.
One of the biggest problems is that the bad guys, using Black Hat SEO techniques, grab onto the trending search terms of the moment and use their popularity to get links to compromised sites placed high in the search engine rankings. This, coupled with the fact that 77% of Websites carrying malicious code are legitimate sites, make for an increasingly dangerous environment for the casual surfer.
This is yet another reason to continue to beat my drum: If you use IE, disable scripting and ActiveX (IE8 has increased security, so consider upgrading). Better yet, switch to Firefox and use the NoScript plugin. Tell the users who trust you to do the same, will you? And make sure they have the latest security patches on their systems. Most people are trusting souls; on the web, they shouldn’t be. Let’s instill the “trust no one” (except for us white hats, of course) mentality into everyone we can.
A new, free service offered by ID Analytics, www.myidscore.com, validates my Identity Exposure Index concept I proposed last month (What’s Your Identity Exposure Index?). While the results of the iEi investigation give you an index between 0 and 5, the MyIDScore.com results range from 0 to 1000. In both tests, the higher the score, the more at risk you are.
I compared iEi results for myself and my wife with those obtained from myidentityscore.com and was a bit surprised at the correlation: my iEi is exactly 4 times my wife’s; my My ID Score is 3.9 times my wife’s. I consider that a pretty strong case for my method. ID Analytics’ technology is patented, but they do reveal that they rely on real-time, cross-industry compilation of identity information, some other identity-specific analytics, and a database of reported identity frauds.
I don’t question the validity of their method and it’s certainly easier to go to their web site and enter a few pieces of basic information than it is to figure out your iEi, but it sure is interesting that my little “invention” appears to be just as valid.
You be the judge; do your own test and please let me know what you find.
I recently completed the free SANS mini-course on cyber forensics (see my post, Free Mini-courses from SANS). That course could not have shown up at a more opportune time as I had just been asked to see if I could determine whether a client’s former employee had stolen their customer list. I learned a bit about looking in some nooks and crannies–specifically, the Windows registry–that I hadn’t considered before and was able to determine with reasonable certainty that the employee had not saved any sensitive information to any external storage media.
I’m no expert in this subject, but I’m confident that I now have a good idea of how to conduct a quick and dirty preliminary forensic examination based upon information found in the Windows registry. When you consider that virtually everything you or a program does in Windows refers to or is recorded into the registry, it stands to reason that it will reveal most anything from minor mischief to major mayhem to the examiner who knows where to look. In this first part, we’ll take a look at how to examine the registry and explore a few of the more common registry entries that have potential forensic value.
Let me first introduce you to the concept of date/time coincidence. All the evidence in the world means little unless it can be shown that it coincides with the time window of the specific incident in question. Therefore, it’s very important that you examine the “LastWrite” time of each key you examine. While this property doesn’t tell you what value was written, knowing the LastWrite time of a key can allow you to infer the date/time coincidence of an event. You can determine the LastWrite time by right-clicking any key, selecting “Export” and then saving it in .txt format. When you open the .txt file, you’ll see something similar to this:
Key Name: HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
Class Name: <NO CLASS>
Last Write Time: 5/27/2009 – 12:29 PM
Here are five keys that can give you a quick overview of the activity on a given system and will tell you if it’s worth your effort to dig deeper. The fact that you’re investigating in the first place means that you have some idea of what you’re looking for and if you’re dealing with a non-technical user, it’s a good bet you’ll find something among these.
MRU is the abbreviation for “most recently used.” This key contains a list of files that were recently opened or saved via the Windows Explorer common dialog boxes. Note that this does not apply to Microsoft Office documents. The subkey * contains the file paths to the 10 most recently opened/saved files.
Similar to the OpenSaveMRU key, but it also contains the name of the program executable file that was used to open/save the document as well as the path to the file. All of the information is in binary format.
This key has a similar arrangement to OpenSaveMRU. Only the filename in binary format is stored here and it contains both network and local files recently opened.
Here you’ll find a list of entries with full file paths and commands that have been executed using the Start>Run command. This is useful to determine whether your suspect has been messing around in the registry, using the cmd shell or any management consoles.
A listing of the 25 recent URLs or file paths typed into the IE or Windows Explorer address bar. Useful to determine what websites your suspect has been surfing, but this key is cleared if IE’s Clear History option is invoked. Still, some people may not know about it and some may forget. It’s a good way to disprove the I-have-no-idea-where-that-came-from excuse.
Next time, we’ll look into how data can be encrypted and hidden in the registry.
Just received SANS NewsBites’ May 19, 2009 issue (Vol. 11, Num. 39) and one article caught my eye. Seems that the sponsors of these Cyber Challenges need some help in naming them:
…a week from Friday…three national cyber games will be announced at a Center for Strategic and International Studies (CSIS) luncheon. The competitions are part of a huge talent search and talent development program to find and nurture the young people who have the skills to become the next generation of great security professionals… But we are trying to agree on a name for the SANS competition. Please pick the one, two or three you like best and send them back to firstname.lastname@example.org. Thanks in advance.
SANS War Games
SANS NetAttack Games
SANS King of the Hill Challenge
SANS Security Challenge
SANS InfoSec Challenge
SANS Challenge Net
SANS Security Warrior Competition
SANS Capture the Flag Student Tournament
SANS War Game Challenge
SANS War Games Challenge
SANS InfoSec Faceoff
It’s a great idea and sounds like loads of fun. How about we help them out? I chose SANS War Games, SANS Security Challenge, and SANS InfoSec Faceoff.
Last month, I posted “What’s Your Identity Exposure Index?” I’ve had some interesting feedback. This one stood out:
I was really interested in your article about online identity exposure. Since I’m on the web most of the day – for my job, Twittering, creating a brand for my jewelry business – a Google search for my name delivers all accurate results on the first page. However, after taking your suggested test, my iEi was still only 1.6, which made me feel a little better. Do you have any suggestions for lowering that score…or is the damage already done once it’s done?
I’m still researching this issue, but I can tell you from personal experience that once something is on the web, it’s likely to be there for a very long time. I have managed to get some erroneous public records removed from the web, but some very old USENET postings have resisted my efforts at removal.
Public records are just that, public; but governments are prohibited from revealing, willy-nilly, sensitive information about their citizens. This means that if a “public” record somehow shows up on the Internet with sensitive information revealed (SSN, police reports, legal information, e.g.), a complaint on the proper channels will usually get the record removed.
I’ll give you the best solution I know, one that I’ve been using for some years now: If you are on line regularly, do everything you can to post and reveal the information that you *want* people to find. A blog is great for this. Using my blogs, over the past five years I’ve managed to push the junk well beyond the third page of most search engine results. I can live with that.
Depending on whose reports you view, spam accounts for from 85 to 95 percent of all emails sent. This may hold true over the Internet at large, but as with any other statistical data, there are local and regional variations. My own inbox is an exception to the general rule; I get far more legitimate emails than spam.
The company I work for provides spam filtering for several SMBs, so I have to hand real data that I can evaluate. Based on last week’s numbers, we processed nearly 100,000 messages in our filters. Of those messages, nearly 70,000–70%–were spam; nearly 30,000–30%–were accepted as legitimate. Our data has its own wild variations: one set is very low with only 18% spam; another set reaches a high of 92% spam.
I’m not a statistician, but it’s easy for me to see how big a problem spam has become. I’m not ready to say email is dead as a business communication medium, but it certainly needs an overhaul.