A new issue of our SWITCH Security Report is available!

Attack of the digital dolphins: hacking Alexa, Siri and their friends via ultrasound
The anti-antivirus programme: US government bans agencies from installing Kaspersky software on their computers
A hack of ‘epic proportions’ at Equifax
Science fiction 4.0 – how to hack a computer with a drop of saliva

The Security Report is available in both English and German.

»» Download the english report. »» Download the german report.

Did you miss our previous Security Report? Click here to go to the archive.

A file that wasn’t there

One of our minions (he was introduced in this blog entry a while ago) recently came to us asking for advice: he was about to automate yet another task, by using his Python-fu, and realized that he misses entries in the file system as well as in the registry.

Notably, he only sees this behaviour on 64bit-versions of the Windows operating system:

Windows Explorer (64bit) vs Python application (32bit) — Left: Windows Explorer (64bit) lists several folders and files. Right: Python application (32bit) only lists the folder Microsoft.

The left image shows the folder C:\Windows\System32\Tasks as seen in the Windows Explorer, the right image as seen in a simple 32bit-python application. Only the subfolder Microsoft is listed there. Something is amiss.

Below is the code to produce the right image, when executed in a 32bit-version of Python:

import glob, os
for pathfilename in glob.glob(r"C:\Windows\System32\Tasks\*"):
    print pathfilename

Continue reading “A file that wasn’t there”

IT-Security-Links #66

./lets-encrypt: Mozilla, Akamai, Cisco, the EFF and IdenTrust announced a new Certificate Authority (CA) which will launch in May 2015. The Let’s Encrypt project is aiming to reduce complexity, bureaucracy, and cost of the certificates that HTTPS requires. A short Demo-Video.
Citadel Update: IBM researchers have found signs that the well-known trojan is now being used to attack widely used password managers.
Stuxnet: Even though Stuxnet was discovered more than four years ago, Kaspersky revisited the subject and published new technical information about some previously unknown aspects of the Stuxnet attack.
CryptoPHP: is a new threat that uses backdoored Joomla, WordPress and Drupal themes and plug-ins to compromise webservers on a large scale. Fox-IT published a 52-page whitepaper (PDF).
PWC published their Global State of Information Security Survey 2015. According to the survey total financial losses attributed to security compromises increased 34% over 2013. Here you can download a paper with the key findings.
Maybe the coolest exploit of the year: Space Invaders on a Cisco Catalyst Switch.

German:

Anonip: Die Swiss Privacy Foundation veröffentlicht Tool zur Anonymisierung von Logfiles (für IPv4 und IPv6).

IT-Security-Links #65

Why privacy matters: In this TED talk, Glenn Greenwald makes the case for why you need to care about privacy, even if you’re “not doing anything you need to hide”.
Is your Network Attached Storage (NAS) secure? A proof-of-concept worm was written by security researcher Jacob Holcomb to illustrate how vulnerable such data stores are to malicious attacks.
SSLv3: POODLE (Padding Oracle On Downgraded Legacy Encryption) is a new attack on the legacy SSLv3 protocol which is considered easier to exploit than similar previous attacks against SSL/TLS. A Security Advisory is available here (PDF). To test if your client is vulnerable SANS setup a Poodle test page. And Heise published a good background article (in german).
Shellshock: Michael Smith (Akamai) explains why the Shellshock battle is only beginning: The “long tail” challenge of the recently discovered Bash vulnerability. A Shellshock exploit is aleady included in the Mayhem botnet malware kit.
SandWorm is a zero-day vulnerability impacting all supported versions of Microsoft Windows including Windows Server 2008 and 2012.
Awareness: The US-CERT reminds users to protect against email scams and cyber campaigns using Ebola as a theme.
Beware of the air gap risks! Adi Shamir explains at the opening keynote for the Black Hat Europe conference why air-gapped networks are not as secure as usually anticipated. Have fun!

IT-Security-Links #64

Shellshock I: Shellshock is a term dating from World War I and it refers to the effect of the trauma of battle on troops. But since last week it’s also the name of a serious GNU Bourne Again SHell (Bash) vulnerability, or to be more exact, a series of vulnerabilities (currently CVE-2014-6271,-7169, -7186,-7187,-6277,-6278). Comprehensive technical overviews are available from SANS (PDF) and TrendMicro (PDF).
Shellshock II: Web servers are indeed currently at the highest risk of being exploited, but the command shell exists all over the Internet. For example there’s also an attack vector in OpenVPN. And Shellshock could also be used to hack VOIP systems.
DMCA-Takedowns: Warner Bros. Entertainment must now release key information about its automated scheme to send copyright infringement notices to websites.
WordPress-Security: Security researcher Ryan Dewhurst released the WPScan Vulnerability Database, a one-stop shop for the latest WordPress, plug-in and theme vulnerabilities.
Google and Dropbox launched Simply Secure to improve online security. The newly created organization aims to make security technologies easier to use.
How to deal with old Java-based enterprise applications? Deutsche Bank London helped develop an “application self-defense tool” that sits below the application to detect and prevent attacks and apply virtual patches.

IT-Security-Links #63

Home Depot overtakes Target: While Target’s breach in December ‘only’ exposed 40 million customer debit and credit card accounts, Home Depot confirms that the recent breach impacted 56 million customers. A malware infected its point-of-sale-network between April and September.
What comes after CVE-2014-9999? The international database for Common Vulnerabilities and Exposures faces its ‘Y2K’ moment. Read more about the syntax change here.
pEp: pretty Easy privacy is a new crowdfunding project based in Switzerland with the aim to simplify encryption for existing communication tools.
IptabLes / IptabLex: Akamai has published a threat advisory (PDF) to warn of attacks where cybercriminals are infecting Linux servers with malware capable of launching powerful DDoS attacks.
Heartbleed: Traffic data collected by researchers on several large networks shows no exploit attempts in the months leading up to the public disclosure of the OpenSSL Heartbleed vulnerability.
US government ordered Yahoo to hand over user data or pay USD 250.000 fine per day!
Do you like Online Security Dashboards? techiehow.com compiled a list.

The web is completely broken

The web is completely broken,

sagt sinngemäss Jeremiah Grossman [1], ein alter Hase im Bereich der Web Application Security. Zwar vertreibt seine Firma auch einen eigenen Webbrowser mit Fokus auf Security und vor allem Privacy, Recht hat er trotzdem: Täglich verwenden wir Technologien, welche das Etikett “Broken by Design” tragen (sollten). In diesem Artikel befassen wir uns mit zwei Themen: Cross Site Request (Forgery) CSR(F) und Certificate Authorities (CA). Die Probleme sind seit Jahren bekannt. Heute wurde gerade wieder ein CSRF-Exploit für WordPress 3.9.1 publiziert. Und ja, das ist die aktuelle WordPress-Version.

CSR(F) – Cross Site Request (Forgery)

Cross Site Request Forgery ist im Gegensatz zu seinem Bruder Cross Site Scripting nur marginal bekannt. Dennoch belegte CSRF 2010 in den OWASP Top Ten Platz 5, und im Jahr 2013 immerhin noch Platz 8. Es handelt sich folglich um eine häufige und durchaus kritische Sicherheitslücke in Webapplikationen. Doch was ist CSRF und was hat das mit “Broken by Design” zu tun?

Viele Webseiten binden externe Ressourcen, beispielsweise Bilder, Javascripts oder Werbung, ein. Das Adjektiv extern verweist hierbei auf eine andere Domäne. Ein Beispiel: Was geschieht, wenn man auf die Webseite einer typischen Schweizer Tageszeitung http://www.typischeschweizertageszeitung.ch/ geht?

Es werden Ressourcen von typischeschweizertageszeitung.ch geladen.
Es werden weitere Ressourcen von beispielsweise adtech.de, cxense.com, cxpublic.com, visualrevenue.com, wemfbox.ch etc. geladen.
Es werden von cxpublic.com wiederum weitere Ressourcen von 2mdn.net, serving-sys.com etc. geladen.

Diese Anfragen für externe Ressourcen nennt man Cross Site Requests. Und jetzt? Zunächst muss man sich fragen, wer denn diese Requests im Auftrag von typischeschweizertageszeitung.ch ausführt: der Browser. Anschliessend muss man verstehen, dass dieser Request unter Verwendung sämtlicher lokal gespeicherter Daten (insbesondere Cookies) für diese externe Domäne abgesetzt wird. Schauen wir uns ein relativ harmloses Beispiel an:

<html>
<head>
<script type="text/javascript">
   function csrf() {
      alert("Auf 192.168.1.1 läuft ein Apache Server unter OpenBSD.");
   }
   function nocsrf() {
      alert("Test fehlgeschlagen, aber vielleicht funktioniert etwas anderes? ...");
   }
</script>
</head>
<body>
   <img src="http://192.168.1.1/openbsd_pb.gif" onload="csrf()" onerror="nocsrf()">
</body>
</html>

Continue reading “The web is completely broken”

IT-Security-Links #57

Why antivirus remains a useful approach to security — also if somewhat antiquated and ineffective (Brian Krebs).
The Core Infrastructure Initiative announced their first projects: The Steering Committee has prioritized Network Time Protocol, OpenSSH and OpenSSL (including a security audit) for the first round of funding.
GPG for Journalists: How Edward Snowden explained mail encryption to Glenn Greenwald – a historic video.
You don’t use Gmail because you don’t want to share your e-mails with Google? Fine, but what about your friends?
How to store user passwords safely: What are again the differences between Hashing and Encrypting?
How to detect Google Glass on the local wireless network (and deauthenticate them). A nice little script by Julian Oliver.
And nothing from the big-security-breach-with-stolen-user-information-department? Sure! Ebay. 128 Million users affected.

IT-Security-Links #55

Verizon published their 60-page “2014 Data Breach Investigations Report“. They identified nine patterns that together describe 92% of the confirmed data breaches they collected in 2013.
FireEye identified a new Internet Explorer (IE) zero-day exploit used in targeted attacks. In the meantime a fix is available from Microsoft, also for Windows XP.
What not to do in a Cyberattack: An article on How to keep calm and avoid common mistakes in an incident response operation.
ENISA Cyber Security Exercise: More than 400 Cyber security professionals from 29 countries and 200 organisations are involved in a biannual cyber exercise coordinated by the European Union Agency for Network and Information Security (ENISA).

German:

Der 30-seitige Jahresbericht zur Nationalen Strategie zum Schutz der Schweiz vor Cyber-Risiken (PDF) ist online verfügbar. Inside-IT bericht darüber.
OpenDataCity hat eine Visualisierung der Kommunikations- und Standortdaten des schweizerischen Nationalrats und grünen Fraktionspräsidenten Balthasar Glättli erstellt.

IT-Security-Links #54

First of all: The coolest Heartbleed-Memory-Dump so far.
How to avoid a heart attack: After the first rush of Heartbleed patching, people should investigate which of their other services or devices are vulnerable as well.
The German Aerospace Centre (DLR) in Cologne has been the victim of a targeted attack carried out by state-sponsored hackers.
The fingerprint sensor in the Samsung Galaxy S5 is as insecure and poorly implemented as the one in the iPhone 5S.
Crimeware or APT? Malware’s “Fifty Shades of Grey”: Security experts from FireEye have been monitoring the activities of a cybercrime group that uses various types of malware in its operations.
Results of the TrueCrypt source code audit: No critical flaws or intentional backdoors.
The Economics of Security: How can you quantify the true value of a security investment?
After the Heartbleed experience it’s time to admit it: We have a library security problem.

IT-Security-Links #53

This week the IT-Security world was busy with 3 important things: Heartbleed, Heartbleed and Heartbleed. It’s a serious vulnerability in the very widespread OpenSSL cryptographic software library. The bug has been introduced while implementing the Heartbeat extension in December 2011. When exploited it leads to the leak of memory contents, which might be secret keys or credentials.
Next week the IT-Security world will probably be busy with “the other side of Heartbleed”: Client Vulnerabilities or Reverse Heartbleed. And the question, which services and products are also affected.
2nd major data theft in Germany this year: 18 Million email addresses and passwords have been stolen. Among them also 38.000 which are registered in Switzerland.
WinXP in SCADA systems: Never change a running system? This computer wisdom of the 80th is still reality in critical infrastructure environments.
Android Security: Collin Mulliner compiled a list of Android Hardening Tools.
Security Researcher have to think out-of-the-box: A five-year-old boy worked out a security vulnerability on Microsoft’s Xbox Live service. And has been officially thanked by the company.

IT-Security-Links #48

DDoS: A ‘record-breaking’ NTP reflection DDoS attack peaked at 400 Gbit/s, which is about 100 Gbit/s more than the largest previously seen DDoS attack against Spamhaus…
…and in this blog article from Cloudflare ntpd- and Network-Operators learn how to mitigate NTP-based DDoS attacks.
NSA: The German government and the German Federal Intelligence Service are facing legal action because they allegedly aided the U.S. National Security Agency data collection program. The German Chaos Computer Club filed a criminal complaint together with the International league for human rights.
ENISA published a flash note about the risks of using discontinued software.
Arbor Networks released their annual Worldwide Infrastructure Security Report. A presentation of key findings and infographics are also available.
Most vulnerable operating systems and applications in 2013: Cristian Florian compiled the data from the US National Vulnerability Database (NVD) to a report.
NIST Cybersecurity Framework: The US National Institute of Standards and Technology released the first version of a Framework for Improving Critical Infrastructure Cybersecurity, a 41-page PDF file with standards, guidelines and practices to promote the protection of critical infrastructure.