Once again it’s a slow security news week, so time to tackle the next hacking skills challenge level. So far, we’ve explored the first 6 basic missions at HackThisSite.org. The difficulty level is supposed to increase at each level, but this one is only difficult if you don’t know Linux. Here’s the challenge:
This time Network Security Sam has saved the unencrypted level7 password in an obscurely named file saved in this very directory.
In other unrelated news, Sam has set up a script that returns the output from the UNIX cal command.
This one is so easy you don’t even have to look at the source code. But you do have to know about chaining commands in Unix.
If you enter a year, you’ll get a full 12-month calendar with all weeks beginning on Sunday displayed on the resulting output page. This is default behavior of the cal command. It looks like all the script does is execute the command, taking your input as a parameter. We can prove this by leaving the field blank; the script returns the current month and year, i.e., default behavior.
The key to cracking this one is the phrase “…obscurely named file saved in this very directory.” We know the permissions are good to run commands on that directory, so let’s just chain the ls — list directory contents — command and see what happens. (You chain commands in Linux using && between them.) Enter the following in the text box: && ls and click the View button. Here’s the output:
October 2009 Mon Tue Wed Thu Fri Sat Sun 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 . .. level7.php cal.pl index.php k1kh31b1n55h.php perl5.8.9.core
Looks to me like k1kh31b1n55h.php is our file. Stick it in the URL and open it up. Voila! The password, f866d6b9, is revealed.
Interesting study. It seems that spam content received is constant across all industries and the majority of it is pharmaceutical related. This could mean one of two things: either very few spammers are responsible (likely); or, a lot of men fall for the v-i-AGR*A spam. Anyway, check it out:
Panda Security has just completed a 3-month long study of spam across 11 different industries, exposing that automotive industry is most heavily targeted. The study found that 99.89 percent of all e-mail received by the automotive industry is spam, with just .11 percent being legitimate messages. The automotive industry was closely followed by the electronics industry and governmental sector as the top spam targets.
When analyzing the survey, Panda found it particularly interesting that while industries are targeted in different ratios, the content of the spam they receive (the majority of which is pharmaceutical related) is constant across all industries.
View the full press release online here: http://www.pandasecurity.com/usa/homeusers/media/press-releases/viewnews?noticia=9906
Panda has posted a breakdown of how each industry is affected to its Flickr page: http://www.flickr.com/photos/panda_security/4026424134/
I’m not going to rant, I promise–I don’t have to because this doesn’t affect me. Several years ago, I abandoned the bloated, insecure and extremely resource-intensive Acrobat Reader in favor of the smaller and more secure Foxit Reader. Once again, here is more evidence that I’m right to have switched. Brian Krebs of The Washington Post wrote:
Adobe Plugs 29 Critical Reader, Acrobat Holes
Adobe Systems Inc. on Tuesday issued a new version of both Adobe Acrobat and its free Adobe PDF Reader to fix at least 29 separate security vulnerabilities in these products.
If you have either (or both) of these programs installed, take a moment to update them. Adobe warns that hackers already are exploiting at least one of the flaws to break into vulnerable systems.
No! Don’t update. Shrink your attack surface and switch to Foxit Reader and their other PDF software. Not only are Foxit Software’s products more secure, they’re also cheaper.
When I fired up my laptop the other day, I was greeted with this pop-up box:
If you’re running Firefox, you may have already seen it yourself. Recall that these add-ons were installed into Firefox without the user’s permission, causing quite an uproar in the Mozilla user community. Brian Krebs of The Washington Post wrote:
In May, I wrote about a Windows patch for the Microsoft .NET package that silently installed the Microsoft .NET Framework Assistant add-on into Firefox. The package also included an associated plug-in for Firefox called the Windows Presentation Foundation plug-in. The Mozilla user community was up arms over not just the fact that Microsoft was introducing unwanted components that could potentially weaken the security of Firefox, but that Redmond had made the thing almost impossible to remove.
Mike Shaver, Mozilla’s vice president of engineering, wrote Friday on the Mozilla Security Blog:
Because of the difficulties some users have had entirely removing the add-on, and because of the severity of the risk it represents if not disabled, we contacted Microsoft today to indicate that we were looking to disable the extension and plugin for all users via our blocklisting mechanism. Microsoft agreed with the plan, and we put the blocklist entry live immediately.
At least Microsoft agreed with Mozilla’s action to block the insecure add-on, but shame on them for blatantly compromising the security of a browser they don’t even own.
Conspiracy theorists: Do you have an opinion on this?
How often, when you log into a site that requires a username and password, to you check to see if the connection is secure? You probably don’t give it a second thought. Most people don’t. For many sites, like newspapers, online magazines, etc., it probably doesn’t matter much. Who cares if someone logs into a news site with your credentials? They’re not going to gain anything by doing so and there’s no identity or personal financial information at stake.
For any sites where you are accessing or entering sensitive identity or financial information such as bank account or credit card numbers or government program IDs such as Social Security numbers, State identification numbers or the like, you are seriously at risk of identity theft if you trust this information to a form that is served as “http://[URL].” It’s true that the Submit button may invoke transmission of the information using https:// (SSL), but there is no guarantee that this will happen, so you risk sending your information “in the clear.”
Best practice: change all of your bookmarks pointing to financial and other sensitive site login pages to read “https:// [URL of site].”
Security software firm SOPHOS (I’ve tested their products in the past) sent me an email yesterday offering a free encryption tool. I tested it this evening and I’m impressed. It’s very simple to use and is definitely a cure for the absentminded:
Whether you lose your laptop, misplace a CD or leave your USB drive in the coffee shop, if it’s encrypted you don’t have to worry about
becoming tomorrow’s headline!
Get the FREE Sophos encryption tool now and you can lose your data without losing your mind.
Sophos FREE Encryption:
an easy to use tool that encrypts your files, folders and emails.
I suggest you download this immediately and pass it on to everyone you know. Combine this with the LAlarm software and you have an unbeatable combination.
Here’s the download link: http://www.sophos.com/mk/get?_EC=2LMC0U-c476w3xDfL8K5RQ
Let me know what you think.
What’s a ROBAM? you ask. Check out this post: Protecting Your Business from Online Banking Fraud. SANS says, “The number one recommended mitigation [to online banking fraud caused by infostealer infections] is to use a read-only bootable alternative media (ROBAM) as an isolated environment for financial transactions.”
You can use a USB thumb drive instead of a CD if you do the following:
1. Download your alternative Linux OS choice (I prefer Ubuntu or Knoppix) in .iso format
2. Download UNetbootin from http://unetbootin.sourceforge.net/
3. Create a bootable USB thumb drive using UNetbootin
4. Set the properties of the drive to “read only”
This should have the same effect as using a Linux live CD.
I haven’t tried this, so comments welcome.
Picture this: Someone tries to steal your laptop off your desk and as soon as they pull the plug from the wall, your latpop emits a screaming siren that won’t quit until your password is entered to unlock the laptop and disable the alarm.
There’s another scenario: You take one of your old USB thumb drives (maybe the one you used to make an anti virus bootable scanner) attach a chain to it and secure it to your desk; if someone tries to move your laptop, unplugging the USB thumb drive in the process, the alarm goes off.
This is possible because of an interesting piece of software called “LAlarm.” It’s free for personal use and there’s a nominal fee for commercial use. Download LAlarm from this link: http://www.lalarm.com/en/index.htm.
I tested this software by installing it on my Dell laptop. It works. You simply install the software, configure the options you want and restart your laptop. To set the alarm, you just press Windows key + L to lock the workstation. If anyone pulls the plug or removes the thumb drive, the alarm sounds.
There’s much more to the software than just an alarm. You can set the software to destroy your data in selected folders in the event of a theft. You can also set zones based on IP addresses and cause an alarm to sound if the IP address changes.
The theft alarm is not affected by the system volume control setting–it’s screaming loud no matter how you have your volume set.
It’s a very cool tool.
I’m pleased to see some professionals with clout advocating a security practice I have often recommended to my clients. Brian Krebs of The Washington Post and SANS Institute are both pushing the use of Linux live CDs for online banking. Krebs’ latest article, “Avoid Windows Malware: Bank on a Live CD,” starts off by recommending people NOT use Microsoft Windows for online banking:
An investigative series I’ve been writing about organized cyber crime gangs stealing millions of dollars from small to mid-sized businesses has generated more than a few responses from business owners who were concerned about how best to protect themselves from this type of fraud.
The simplest, most cost-effective answer I know of? Don’t use Microsoft Windows when accessing your bank account online.
Krebs has reported frequently about some of the more prominent online banking fraud incidents, including the hack against Bullitt County, Ky. and two California firms that lost a combined total of more than half a million dollars, both of which were using two-factor authentication requiring the use of a security token.
The credential-stealing Trojans used in these attacks were designed to avoid detection by normal anti-malware software, so the victims had no clues that they had been infected. With the huge amounts of money involved, it’s likely the cybercriminals have evolved their programming skills to the point where it will be difficult for security firms to keep up.
It’s not surprising, then, that SANS, as a direct result of Krebs’ reporting, issued a challenge to its students to create a white paper to determine the most effective methods for small and mid-sized businesses to mitigate the threat from these types of attacks. The report, “Protecting Your Business from Online Banking Fraud,” addresses the issue. Here’s that report’s Abstract:
Recently, small and medium businesses have lost millions of dollars from fraudulent electronic financial transactions. This paper reviews the threat and provides guidance for mitigating the threat. These crimes typically begin with a phishing email targeted at the comptroller or other staff in the finance department. After the comptroller’s computer is compromised, sophisticated malware is used to eavesdrop on the comptroller’s activity and account credentials for financial systems. Once the attackers have the required information, they begin to steal money with fraudulent transactions in amounts below $10,000. These smaller amounts fly under the laundering detection mechanisms in the US Bank Secrecy Act. In many cases, repeated transactions have added up to hundreds of thousands of dollars lost by individual organizations. The paper provides a number of possible ways to mitigate these types of attacks. A defense in depth approach is used to provide multiple mitigation recommendations. The number one recommended mitigation is to use a read-only bootable alternative media (ROBAM) as an isolated environment for financial transactions. [emphasis added] The mitigation steps also include protecting the email address of the comptroller, network protection, endpoint protection, virtual machines, awareness training, policy changes and monitoring financial transactions.
I highly recommend that everyone responsible for security in their organization read this paper.
Microsoft Security Response Center’s October 2009 Bulletin Release Advance Notification:
For October we are releasing 13 bulletins (eight critical and five important), addressing 34 vulnerabilities, affecting Windows, Internet Explorer, Office, Silverlight, Forefront, Developer Tools, and SQL Server. Most of these updates require a restart so please factor that into your deployment planning.
Ten of the 13 bulletins–which include all eight critical vulnerabilities–involve patches for remote code execution vulnerabilities. All versions of Windows and Windows Server, including Windows 7 (scheduled for release on Oct. 22) are affected.
This sets a new record for Microsoft. The previous record was set in June when the company issued 31 updates. I’m not too sure how to take this. I’m certainly glad that Microsoft is addressing its security problems, but the trend is a bit disturbing: 28 patches in December, 2008; 31 patches in June, 2009; and, 34 patches this month. We still have the better part of 3months left in 2009. Will we see another record set before year end?
What do you think? Does this mean that Microsoft is being more security conscious or are there more bugs than ever?
Hit the comments and weigh in.