This week’s set of DHS reports makes it clear to
me that information security professionals worldwide should be reading the
report every day or the synopsis published at http://dhs-daily-report.blogspot.com/. Should you have your doubts, read the
following weekly summary and determine whether you are up-to-date on each of
the items discussed.
The DHS Daily Open Source
Infrastructure Report covers the publicly reported material for the preceding
day(s) not previously covered. This weekly summary provides a selection
of those items of greatest significance to the InfoSec professional.
Week Ending: Friday, July 17, 2009
Infrastructure Report for 13 July 2009
Do
you allow Twitter? If you do, you should
read the following!
42. July 10, IDG News Service – (International) Twitter suspends accounts of users with infected computers. Twitter is suspending the accounts of some users whose computers have fallen victim to a well-known piece of malicious software that has targeted other sites such as Facebook and MySpace. The malware, Koobface, is designed to spread itself by checking to see if person is logged into a social network. It will then post fraudulent messages on the person’s Twitter account trying to entice friends to click the link, which then leads to a malicious Web site that tries to infect the PC. The popular microblogging service has had a strong impact as a new communication platform. Bis also being targeted by fraudsters and hackers, who are using it as a way to infect people’s PCs with malicious software. Twitter is the latest site to be targeted by a Koobface variant, said a senior security advisor for Trend Micro. Other sites have included Bebo, Hi5, Friendster and LiveJournal, according to the U.S. Computer Emergency Readiness Team. Source: http://www.pcworld.com/businesscenter/article/168201/twitter_suspends_accountssers_with_infected_computers.html
Infrastructure Report for 14 July 2009
Have you applied Microsoft’s July
patches? No! Perhaps you should reconsider.
40. July 13, Computerworld – (International) Researcher says IE bug could spread quickly. A critical ActiveX vulnerability used by hackers to exploit Microsoft Corp.’s Internet Explorer browser is a prime candidate for another Conficker-scale attack, security experts said. On July 6, just hours after security companies reported that thousands of compromised sites were serving up exploits, Microsoft acknowledged the flaw in the ActiveX control that can be accessed using IE. The bug has been used by hackers since at least June 9. Microsoft said it will issue a patch for the flaw on July 14. The vulnerability “exposes the whole world and can be exploited through the firewall,” said the chief research officer at security software vendor AVG Technologies USA Inc. “That’s better than Conficker, which mostly did its damage once it got inside a network.” Conficker exploited a Windows flaw that Microsoft had thought dire enough to fix outside its usual update schedule in October 2008. The worm exploded into prominence in January, when a variant infected millions of machines that remained unpatched. Microsoft confirmed the latest flaw shortly after security researchers at Danish firms CSIS Security Group AS and Secunia said that thousands of hacks of legitimate Web sites over the July 4 weekend had exploited the bug. The hackers took advantage of the bug to reroute users to a malicious site, which in turn downloads and launches a multiexploit hacker tool kit. Source: http://www.computerworld.com/s/article/340930/Researcher_Says_IE_Bug_Could_Spread_Quickly?taxonomyId=17
Infrastructure Report for 15 July 2009
Could
a similar attack be successful in the private sector?
28. July 13, Softpedia –
(International) DDoS worm starts damaging infected systems. The malware
responsible for the recent denial of service attacks against many U.S. and
South Korean government and commercial websites has received an update to
damage the computers it infected. Starting with July 10, the worm began to
rewrite HDD Master Boot Records (MBR), leaving the zombie computers unbootable.
Recently, it was reported that serious distributed denial of service (DDoS)
attacks had affected the stability of many websites operated by large
organizations or the governments of United States and South Korea. Experts
later concluded that a botnet of over 60,000 computers, infected with an updated
Mydoom variant, had been used to launch the attacks. Security researchers from
FireEye warn that, even though the DDoS has stopped, the impact of this malware
might prove to be a lot bigger. Everything started with a DDoS component being
shipped to computers infected with a particular strain of Mydoom, a worm dating
back to the beginning of 2004. The attackers planned for the DDoS to start on
July 4 (Independence Day) and to end on July 10. The worm drops a file called
mstimer.dll and loads it as a windows service named “MS Timer Service.” The
purpose of this component is to check the date and if it matches July 10 to
execute yet another file, called wversion.exe. Originally, wversion.exe
contained instructions to uninstall the timer service, suggesting that its
authors intended for it to self-destroy. However, a malware researcher at
FireEye explains that another, much more destructive version of wversion.exe
was deployed shortly before July 10. The new version features a three-step plan
to destroy data on the infected computers. First, it rewrites 512 bytes of
every hard disk in the system, not only the one used to boot from. The first
512 bytes of a hard disk are used to store the Master Boot Record and Volume
Boot Record, which are employed to store information about the file system and
partitions. The new data written over the MBR and VBR includes a string reading
“Memory of the Independence Day.” The second destructive step targets the
personal files and documents stored on the hard disks. The component searches
for files with one of 37 extensions, including .pdf, .doc, .ppt, and proceeds
to compressing and password-protecting every one of them. Source: http://news.softpedia.com/news/DDoS-Worm-Starts-Damaging-Infected-Systems-116551.shtml
Infrastructure Report for 16 July 2009
And, just how safe is your
BlackBerry today?
38. July 14, The Register – (International) BlackBerry update bursting with spyware. An update pushed out to BlackBerry users on the Etisalat network in the United Arab Emirates appears to contain remotely-triggered spyware that allows the interception of messages and emails, as well as crippling battery life. Sent out as a WAP Push message, the update installs a Java file that one curious customer decided to take a closer look at, only to discover an application intended to intercept both email and text messages, sending a copy to an Etisalat server without the user being aware of anything beyond a slightly excessive battery drain. It was, it seems, the battery issue that alerted users to something being wrong. Closer examination seems to indicate that all instances of the application were expected to register with a central server, which could not cope with the traffic — thus forcing all the instances to repeatedly attempt to connect while draining the battery. A more phased reporting system might have escaped detection completely. The update is labelled: “Etisalat network upgrade for BlackBerry service. Please download to ensure continuous service quality.” The signed JAR file, when opened, reveals an application housed in a directory named “/com/ss8/interceptor/app”, which conforms to the Java standard for application trees to be named the reverse of the author’s URL. No one from Etisalat, RIM, or SS8 is saying anything about the issue, despite the fact that the application appears remarkably difficult to remove. Source: http://www.theregister.co.uk/2009/07/14/blackberry_snooping/
Infrastructure Report for 17 July 2009
Have you applied the latest
Microsolf patches? If no, perhaps you
should!
39. July 15, Enterprise Security Today – (International) Researchers rate all six Microsoft patches as critical. Microsoft on July 14 released six bulletins as part of its monthly patch cycle. Three of the bulletins cover critical flaws, including two unpatched zero-day vulnerabilities. Three other bulletins address important risks that security researchers said can quickly escalate to critical. The CTO of Qualys said Microsoft’s advisories should be addressed immediately because they allow an attacker to take complete control of a victim’s computer. Microsoft proxy server ISA 2006 has a vulnerability rated as important that allows remote unauthenticated users to access the server. However, paired with a knowledge of the administrator’s username, attackers can take full control of the server. Because administrator usernames are often easy to guess, the CTO said, this vulnerability deserves special attention if IT organizations are using ISA with the Radius configuration. Likewise, MS09-030 is an advisory for the Publisher component in the MS Office 2007 suite rated as important, but can be used to take full control of a system if the victim is logged in as administrator. If an organization uses Publisher or has it installed as part of Office 2007, this should be treated as critical as well, the CTO said. Source: http://www.enterprise-security-today.com/story.xhtml?story_id=67785
Note: The DHS only maintains the last ten days
of their reports online. To obtain copies of earlier reports or complete
summaries, go to:
http://dhs-daily-report.blogspot.com/