IT-Security-Links #63

Home Depot overtakes Target: While Target’s breach in December ‘only’ exposed 40 million customer debit and credit card accounts, Home Depot confirms that the recent breach impacted 56 million customers. A malware infected its point-of-sale-network between April and September.
What comes after CVE-2014-9999? The international database for Common Vulnerabilities and Exposures faces its ‘Y2K’ moment. Read more about the syntax change here.
pEp: pretty Easy privacy is a new crowdfunding project based in Switzerland with the aim to simplify encryption for existing communication tools.
IptabLes / IptabLex: Akamai has published a threat advisory (PDF) to warn of attacks where cybercriminals are infecting Linux servers with malware capable of launching powerful DDoS attacks.
Heartbleed: Traffic data collected by researchers on several large networks shows no exploit attempts in the months leading up to the public disclosure of the OpenSSL Heartbleed vulnerability.
US government ordered Yahoo to hand over user data or pay USD 250.000 fine per day!
Do you like Online Security Dashboards? techiehow.com compiled a list.

23/06/2014
by Slavo Greminger 1 Comment

The web is completely broken,

sagt sinngemäss Jeremiah Grossman [1], ein alter Hase im Bereich der Web Application Security. Zwar vertreibt seine Firma auch einen eigenen Webbrowser mit Fokus auf Security und vor allem Privacy, Recht hat er trotzdem: Täglich verwenden wir Technologien, welche das Etikett “Broken by Design” tragen (sollten). In diesem Artikel befassen wir uns mit zwei Themen: Cross Site Request (Forgery) CSR(F) und Certificate Authorities (CA). Die Probleme sind seit Jahren bekannt. Heute wurde gerade wieder ein CSRF-Exploit für WordPress 3.9.1 publiziert. Und ja, das ist die aktuelle WordPress-Version.

CSR(F) – Cross Site Request (Forgery)

Cross Site Request Forgery ist im Gegensatz zu seinem Bruder Cross Site Scripting nur marginal bekannt. Dennoch belegte CSRF 2010 in den OWASP Top Ten Platz 5, und im Jahr 2013 immerhin noch Platz 8. Es handelt sich folglich um eine häufige und durchaus kritische Sicherheitslücke in Webapplikationen. Doch was ist CSRF und was hat das mit “Broken by Design” zu tun?

Viele Webseiten binden externe Ressourcen, beispielsweise Bilder, Javascripts oder Werbung, ein. Das Adjektiv extern verweist hierbei auf eine andere Domäne. Ein Beispiel: Was geschieht, wenn man auf die Webseite einer typischen Schweizer Tageszeitung http://www.typischeschweizertageszeitung.ch/ geht?

Es werden Ressourcen von typischeschweizertageszeitung.ch geladen.
Es werden weitere Ressourcen von beispielsweise adtech.de, cxense.com, cxpublic.com, visualrevenue.com, wemfbox.ch etc. geladen.
Es werden von cxpublic.com wiederum weitere Ressourcen von 2mdn.net, serving-sys.com etc. geladen.

Diese Anfragen für externe Ressourcen nennt man Cross Site Requests. Und jetzt? Zunächst muss man sich fragen, wer denn diese Requests im Auftrag von typischeschweizertageszeitung.ch ausführt: der Browser. Anschliessend muss man verstehen, dass dieser Request unter Verwendung sämtlicher lokal gespeicherter Daten (insbesondere Cookies) für diese externe Domäne abgesetzt wird. Schauen wir uns ein relativ harmloses Beispiel an:

<html>
<head>
<script type="text/javascript">
   function csrf() {
      alert("Auf 192.168.1.1 läuft ein Apache Server unter OpenBSD.");
   }
   function nocsrf() {
      alert("Test fehlgeschlagen, aber vielleicht funktioniert etwas anderes? ...");
   }
</script>
</head>
<body>
   <img src="http://192.168.1.1/openbsd_pb.gif" onload="csrf()" onerror="nocsrf()">
</body>
</html>

Continue reading →

06/06/2014
by Frank Herberg

IT-Security-Links #57

Why antivirus remains a useful approach to security — also if somewhat antiquated and ineffective (Brian Krebs).
The Core Infrastructure Initiative announced their first projects: The Steering Committee has prioritized Network Time Protocol, OpenSSH and OpenSSL (including a security audit) for the first round of funding.
GPG for Journalists: How Edward Snowden explained mail encryption to Glenn Greenwald – a historic video.
You don’t use Gmail because you don’t want to share your e-mails with Google? Fine, but what about your friends?
How to store user passwords safely: What are again the differences between Hashing and Encrypting?
How to detect Google Glass on the local wireless network (and deauthenticate them). A nice little script by Julian Oliver.
And nothing from the big-security-breach-with-stolen-user-information-department? Sure! Ebay. 128 Million users affected.

02/05/2014
by Frank Herberg

IT-Security-Links #55

Verizon published their 60-page “2014 Data Breach Investigations Report“. They identified nine patterns that together describe 92% of the confirmed data breaches they collected in 2013.
FireEye identified a new Internet Explorer (IE) zero-day exploit used in targeted attacks. In the meantime a fix is available from Microsoft, also for Windows XP.
What not to do in a Cyberattack: An article on How to keep calm and avoid common mistakes in an incident response operation.
ENISA Cyber Security Exercise: More than 400 Cyber security professionals from 29 countries and 200 organisations are involved in a biannual cyber exercise coordinated by the European Union Agency for Network and Information Security (ENISA).

German:

Der 30-seitige Jahresbericht zur Nationalen Strategie zum Schutz der Schweiz vor Cyber-Risiken (PDF) ist online verfügbar. Inside-IT bericht darüber.
OpenDataCity hat eine Visualisierung der Kommunikations- und Standortdaten des schweizerischen Nationalrats und grünen Fraktionspräsidenten Balthasar Glättli erstellt.

17/04/2014
by Frank Herberg

IT-Security-Links #54

First of all: The coolest Heartbleed-Memory-Dump so far.
How to avoid a heart attack: After the first rush of Heartbleed patching, people should investigate which of their other services or devices are vulnerable as well.
The German Aerospace Centre (DLR) in Cologne has been the victim of a targeted attack carried out by state-sponsored hackers.
The fingerprint sensor in the Samsung Galaxy S5 is as insecure and poorly implemented as the one in the iPhone 5S.
Crimeware or APT? Malware’s “Fifty Shades of Grey”: Security experts from FireEye have been monitoring the activities of a cybercrime group that uses various types of malware in its operations.
Results of the TrueCrypt source code audit: No critical flaws or intentional backdoors.
The Economics of Security: How can you quantify the true value of a security investment?
After the Heartbleed experience it’s time to admit it: We have a library security problem.

11/04/2014
by Frank Herberg

IT-Security-Links #53

This week the IT-Security world was busy with 3 important things: Heartbleed, Heartbleed and Heartbleed. It’s a serious vulnerability in the very widespread OpenSSL cryptographic software library. The bug has been introduced while implementing the Heartbeat extension in December 2011. When exploited it leads to the leak of memory contents, which might be secret keys or credentials.
Next week the IT-Security world will probably be busy with “the other side of Heartbleed”: Client Vulnerabilities or Reverse Heartbleed. And the question, which services and products are also affected.
2nd major data theft in Germany this year: 18 Million email addresses and passwords have been stolen. Among them also 38.000 which are registered in Switzerland.
WinXP in SCADA systems: Never change a running system? This computer wisdom of the 80th is still reality in critical infrastructure environments.
Android Security: Collin Mulliner compiled a list of Android Hardening Tools.
Security Researcher have to think out-of-the-box: A five-year-old boy worked out a security vulnerability on Microsoft’s Xbox Live service. And has been officially thanked by the company.

13/02/2014
by Frank Herberg

IT-Security-Links #48

DDoS: A ‘record-breaking’ NTP reflection DDoS attack peaked at 400 Gbit/s, which is about 100 Gbit/s more than the largest previously seen DDoS attack against Spamhaus…
…and in this blog article from Cloudflare ntpd- and Network-Operators learn how to mitigate NTP-based DDoS attacks.
NSA: The German government and the German Federal Intelligence Service are facing legal action because they allegedly aided the U.S. National Security Agency data collection program. The German Chaos Computer Club filed a criminal complaint together with the International league for human rights.
ENISA published a flash note about the risks of using discontinued software.
Arbor Networks released their annual Worldwide Infrastructure Security Report. A presentation of key findings and infographics are also available.
Most vulnerable operating systems and applications in 2013: Cristian Florian compiled the data from the US National Vulnerability Database (NVD) to a report.
NIST Cybersecurity Framework: The US National Institute of Standards and Technology released the first version of a Framework for Improving Critical Infrastructure Cybersecurity, a 41-page PDF file with standards, guidelines and practices to promote the protection of critical infrastructure.

SWITCH Security-Blog

SWITCH-CERT IT-Security Blog

Category Archives: Background

IT-Security-Links #63