February 26, 2015

WP-Slimstat vulnerability exposes WordPress websites to SQL injection attacks

wp-slimstat-plugin-logo(LiveHacking.Com) – A recent security advisory from Sucri has revealed that the popular WordPress plugin WP-Slimstat is vulnerable to SQL injection attacks because of a weak secret key.

If exploited fully the bug could allow hackers to use SQL injection attacks to download sensitive information from a susceptible site’s database, including username, and (hopefully) hashed passwords. According to Sucri it could even be possible, in certain situations, for the attacker to find the WordPress Secret Keys and then takeover the site completely.

The problem is with the secret key used by the plugin to sign data sent to/from the client. The key used is in fact the MD5 hash of the plugin’s installation timestamp. Although it would be impossible to guess the exact date and time of the plugin installation, it might be possible to guess the approximate date and therefore drastically reduce the number of combinations.

Only the correct year is needed to reduce the number of possibilities down to 30 million values, which according to Sucri is computable in around 10 minutes using modern setups. Part of the problem is that MD5 hashes are quite breakable using modern CPU/GPU combinations.

Once the correct MD5 hash has been discovered then fake data can be sent to the plugin. Then, due to a second bug – which allows an attacker to insert arbitrary data into an unserialize() call, the attacker can execute arbitrary SQL queries and allow them  to get any data they want from the database.

“This is a dangerous vulnerability, you should update all of your websites using this plugin as soon as possible,” wrote  Marc-Alexandre Montpas on Sucri’s blog.

WP-Slimstat is an analytics tool. Its listing on WordPress shows it has been downloaded more than 1.3 million times. People who operate websites that use the plugin should update immediately. All versions before 3.9.6 are vulnerable.

Google backpedals on its arbitrary vulnerability disclosure policy

google logo(LiveHacking.Com) – Google has been under fire in the last few weeks for arbitrarily disclosing zero-day vulnerabilities which give hackers the information they need to attack susceptible systems. When Google makes these disclosures it knows full well that it is risking the security and privacy of potentially millions of people.

The positive side of these disclosures is that Google guarantees that vendors, like Microsoft, Apple and Adobe, are informed of zero-day flaws and given enough time to patch those flaws before a disclosure is made. By informing the vendor and yet by giving them a period of time to fix the issue, Google is trying to ensure that both “the need of the public to be informed of security vulnerabilities” and the “vendors’ need for time to respond effectively” are balanced.

However until now Google’s 90 day deadline has been completely arbitrary without any consideration of real-world circumstances. The arbitrary nature of the 90 day rule was highlighted recently when Google published the details of a bug in Windows which Microsoft was scheduled to patch on January 13th, but the 90 days passed on January 11th, so Google just published the details anyway. In this way Google was sticking to the letter of the law rather than the spirit of it.

But now it seems that Google has seen the error of its ways and updated its disclosure policy. From now on:

  • Weekends and holidays. If a deadline is due to expire on a weekend or US public holiday, the deadline will be moved to the next normal work day.
  • Grace period. Google now has a 14-day grace period. If a 90-day deadline will expire but a vendor lets Google know before the deadline that a patch is scheduled for release on a specific day within 14 days following the deadline, the public disclosure will be delayed until the availability of the patch. Public disclosure of an unpatched issue now only occurs if a deadline will be significantly missed (2 weeks+).
  • Assignment of CVEs. CVEs are an industry standard for uniquely identifying vulnerabilities. To avoid confusion, it’s important that the first public mention of a vulnerability should include a CVE. For vulnerabilities that go past deadline, Google will ensure that a CVE has been pre-assigned.

While Microsoft welcomes the changes, it would much rather see Google work more closely with software vendors to apply patches. “When finders release proof-of-concept exploit code, or other information publicly before a solution is in place, the risk of attacks against customers goes up,” Microsoft’s Chris Betz told The Register in an emailed statement. “While it is positive to see aspects of disclosure practices adjust, we disagree with arbitrary deadlines because each security issue is unique and end-to-end update development and testing time varies.”

Cross Site Scripting vulnerability found in IE 11

hacked-by-deusen-1080x700(LiveHacking.Com) – A new Cross Site Scripting (XSS) vulnerability has been found in IE 11. According to an email sent by David Leo, a researcher with information security company Deusen, to the Full Disclosure mailing list, the vulnerability can allow an attacker to steal anything from a third party domain, and likewise inject anything into a third party domain.

Deusen has also posted a proof of concept which injects the words “Hacked by Deusen” into a third party website, in this case dailymail.co.uk. The disclosure is for Internet Explorer 11 on Windows 7, however I have tried it on Windows 8.1 and the vulnerability is present.

The way the PoC works is once the web page has been opened you need to click on a dialog box to proceed. Then a second window opens showing the dailymail.co.uk website, after a few seconds the contents of dailymail.co.uk are replaced with the hacked message. In a real world scenario the injected code would do something more malicious.

Since IE still shows that the domain is dailymail.co.uk users can be easily tricked into giving up usernames and passwords, or other private information. Imagine if the attacker used paypal.com rather than dailymail.co.uk.

However, phishing isn’t the only worry. The vulnerability also means attackers can access existing authentication cookies. This means that an attacker can masquerade as an already authorized user.

According to Joey Fowler, a Senior Security Engineer at Tumblr, the vulnerability allows hackers to bypass standard HTTP-to-HTTPS restrictions. “It looks like, through this method, all viable XSS tactics are open!” he wrote.

Joey also asked if Microsoft had been informed. David Leo confirmed that Microsoft was notified on Oct 13, 2014. In a statement to iTnews, Microsoft said that there were no known cases of this vulnerability being exploited in the wild. Microsoft is working on a fix.

Apple updates iOS, OS X and Apple TV in monster patch release

ios8-logo(LiveHacking.Com) – Following Google’s disclose of a number of zero day vulnerabilities in OS X, Apple has released a huge set of patches that fix a range of Critical security problems on OS X, iOS, Apple TV, and Safari.

Starting with OS X, Apple’s patches fix 54 separate CVEs including 11 from Google’s Project Zero. Among the fixes are patches for the 3 bugs which Google disclosed last week:

  • An error existed in the Bluetooth driver that allowed a malicious application to control the size of a write to kernel memory.
  • Multiple type confusion issues existed in coresymbolicationd’s handling of XPC messages.
  • A memory access issue existed in the handling of IOUSB controller user client functions.

A security vulnerability in the Intel graphics driver is also credited to Google’s project zero. According to the release notes, multiple vulnerabilities existed in the Intel graphics driver, the most serious of could lead to arbitrary code execution with system privileges.

Another six CVE’s were reported to Apple from another of Google security groups, this time the Google Security Team. Among its catches are a bug in the kernel: Multiple uninitialized memory issues existed in the network statistics interface, which led to the disclosure of kernel memory content.

The security update is available for OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 and v10.10.1. You can read the full details here: http://support.apple.com/en-us/HT1222

Since iOS and OS X share much of the same code (certainly at the lower levels), Apple also released an update to its mobile operating system with many of the same fixes. The iOS update addresses 33 different CVEs and fixes some of the same vulnerabilities from Google’s Project Zero. You can read more about iOS 8.1.3 here: http://support.apple.com/kb/HT204245

Like iOS, Apple TV also uses lots of the same core technologies as OS X. In response to Google’s disclosures and in the light of other security issues, Apple has released Apple TV 7.0.3. It addresses 29 different CVEs including the disclosed problems with XPC: Multiple type confusion issues existed in networkd’s handling of interprocess communication. By sending a maliciously formatted message to networkd, it could be possible to execute arbitrary code as the networkd process.

Apple TV 7.0.3 is available for all 3rd generation and later Apple TV boxes. Full details can be found here: http://support.apple.com/kb/HT204246

To round off this huge security update, Apple has also updated Safari 8.0.3, Safari 7.1.3, and Safari 6.2.3 on OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and OS X Yosemite v10.10.1 to fix a series of memory issues with WebKit. If exploited these vulnerabilities could allow an attacker to run arbitrary code on a victim’s Mac, if tricked into visiting a maliciously crafted website.

Apple has also updated its web plug-in blocking mechanism to disable all versions prior to Flash Player 16.0.0.296 and 13.0.0.264.

Google discloses three more zero-day vulnerabilities, this time for OS X

Apple-logo(LiveHacking.Com) – Google recently came under some heavy criticism when it disclosed a zero-day vulnerability in Windows just days before Microsoft was scheduled to release a fix. Now the search giant as done it again. But this time Google shows that it is truly non-partisan because the disclosures aren’t for Windows, but for OS X.

The first vulnerability allows an attacker to pass arbitrary commands to the networkd OS X system daemon in XPC  messages. XPC provides a lightweight mechanism for basic interprocess communication. The problem is that the daemon uses the values from  xpc_dictionary_get_value and xpc_array_get_value without subsequent checking of the type of the returned value. Google posted proof-of-concept (POC) code that allows a shell command to be executed as networkd on OS X 10.9.5. The POC uses a specially crafted XPC message which results in “touch /tmp/hello_networkd” being executed. That is a benign command, but it can be replaced with something more malicious.

The second vulnerability in IOKit IOService allows an attacker to  execute code on an OS X machine with root privileges through a null pointer dereferencing. The third flaws also relates to IOKit, this time in the Bluetooth subsystem. To exploit it the machine needs to have a Bluetooth device attached, for example a Apple Bluetooth keyboard. Once exploited it allows an attacker to write into kernel memory, potentially allowing them to create a denial of service situation or to access private data.

The security flaws were reported to Apple in October 2014. All three advisories were subsequently published by Google after the expiration of the 90-day grace period give under Project Zero.

Microsoft to fix Windows vulnerability that Google publicly disclosed last week

microsoft logo(LiveHacking.Com) – Microsoft will be issuing a series of security bulletins today (Patch Tuesday) to address security vulnerabilities in its products. One of these fixes will be for a vulnerability that Google intentionally disclosed to the public last week.

Security experts at Google found a bug which could allow an attacker to gain elevated privileges on a Windows 8.1 machine. After the vulnerability was found, Microsoft was informed of the problem, which was dubbed Windows Elevation of Privilege in User Profile Service.

According to Google standard security policy the bug was subject to a 90 day disclosure deadline. “If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public.” On October 13th 2014 Microsoft was told about the bug and the 90 day clock started ticking.

Then on November 11th Microsoft contacted Google and told it that a patch would be ready for the vulnerability in February 2015. The cryptic comment attached to the bug report read, “Microsoft confirmed that they are on target to provide fixes for these issues in February 2015. They asked if this would cause a problem with the 90 day deadline.”

Google told Microsoft that “the 90 day deadline is fixed for all vendors and bug classes and so cannot be extended. Further they were informed that the 90 day deadline for this issue expires on 11th Jan 2015.”

Microsoft further replied that it would release a patch in January. This demonstrates the power and need for the 90 day disclosure deadline. It forced Microsoft to act quicker. That is the purpose of the deadline.

But there is another problem, Microsoft’s update process is known by everyone in the security industry. It releases security fixes on the second Tuesday of the month, Patch Tuesday. The release of patches for operating systems and software applications that are used by millions of people is a heavy task. These releases require lots of testing and a top notch change management system.

The whole of Microsoft’s security engineering is geared towards Patch Tuesday. The problem is that for January, Patch Tuesday falls on January 13, but Google insisted on disclosing the details of the vulnerability on January 11, exactly 90 days after Microsoft was told of the problem.

According to Chris Betz from the Microsoft security response center, “Google has released information about a vulnerability in a Microsoft product, two days before our planned fix on our well known and coordinated Patch Tuesday cadence, despite our request that they avoid doing so.”

“Specifically, we asked Google to work with us to protect customers by withholding details until Tuesday, January 13, when we will be releasing a fix,” he added.

It does seem foolish of Google to behave in such a way. Google also understands the problems of releasing patches to software applications, services and operating systems, and it should (but doesn’t seem to) understand that the protection of consumers is the primary goal.

The idea behind the 90 day disclosure is to ensure that vendors actually take security seriously, but to disclose a vulnerability just two days before a major corporation releases the required patches is officious bureaucratic behavior. In these cases the spirit of the principle needs to be applied and not the letter.

Apple updates OS X’s NTP server to address recently disclosed NTP vulnerabilities

12-54-on-digitial-clock-300px(LiveHacking.Com) – Apple has released a patch for OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and OS X Yosemite v10.10.1 to update the included NTP server to  fix the recently disclosed  vulnerabilities. The standard, open source Network Time Protocol (NTP) daemon (ntpd) contains multiple vulnerabilities which were publicly disclosed a few days ago. The vulnerabilities not only affect OS X, but also other Unix-type operating systems like Linux and FreeBSD.

ntpd version 4.2.7 and before, have several to buffer overflow issues. If exploited they could allow malicious code to be executed. Also, ntp-keygen prior to version 4.2.7p230 has been found to use a non-cryptographic random number generator when generating symmetric keys. These vulnerabilities affect ntpd acting as a server or client.

The full list of vulnerabilities is as follow:

  • CWE-332 – If no authentication key is defined in the ntp.conf file, a cryptographically-weak default key is generated.
  • CWE-338 – ntp-keygen before 4.2.7p230 uses a non-cryptographic random number generator with a weak seed to generate symmetric keys.
  • CWE-121 – A remote unauthenticated attacker may craft special packets that trigger buffer overflows in the ntpd functions crypto_recv() (when using autokey authentication), ctl_putdata(), and configure(). The resulting buffer overflows may be exploited to allow arbitrary malicious code to be executed with the privilege of thentpd process.
  • CWE-389 – A section of code in ntpd handling a rare error is missing a return statement, therefore processing did not stop when the error was encountered. This situation may be exploitable by an attacker.

Apple’s release notes state that “a remote attacker may be able to execute arbitrary code” due to the vulnerabilities. The security bulletin goes on to say that “Several issues existed in ntpd that would have allowed an attacker to trigger buffer overflows. These issues were addressed through improved error checking.”

You can read more about APPLE-SA-2014-12-22-1 here and you can read CERT’s note on the issue here. You can download the latest (patched) version of NTP from here.

Microsoft fixes 24 security vulnerabilities in December’s Patch Tuesday

Windows-Vista-command-prompt(LiveHacking.Com) – As part of December’s Patch Tuesday, Microsoft has released seven security updates, three of which Microsoft has rated Critical, while the other four are rated Important in severity. These seven patches to address 24 security vulnerabilities in Microsoft Windows, Internet Explorer (IE), Office and Exchange.

The first of the Critical patches is a cumulative update for IE. The patch resolves fourteen privately reported vulnerabilities in Internet Explorer. The most severe of these vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. The update applies to IE 6 to IE 11, on Windows Server 2003 to Windows 81, depending on the version of IE.

The second Critical patch applies to Microsoft Word and Microsoft Office Web Apps, to fix two privately reported vulnerabilities. The vulnerabilities could allow remote code execution if a user opens or previews a specially crafted Microsoft Word file in an affected version of Microsoft Office software.

The Critical patch resolves a privately reported vulnerability in the VBScript scripting engine in Microsoft Windows. The vulnerability could allow remote code execution if a user visits a specially crafted website.

Microsoft has also re-released and updated two security bulletins related to Internet Explorer. The first, MS14-065, is a cumulative security update for Microsoft’s default browser, while the second relates to the browser’s built-in version of Flash. Adobe also released  a security update for Adobe Flash Player for Windows.

Sony hack shows that the company kept passwords stored in a folder called “Password”

SONY PICTURES LOGO(LiveHacking.Com) – Sony Pictures Entertainment has been hacked and it has been hacked hard. Over 40GB of data has been released on the Internet. The trove of data includes scripts and documents about salaries and film budgets. It is being described as “probably the worst corporate hack in history.” A group called Guardians of Peace, which may be affiliated with North Korea, has claimed responsibility for the cyber attack. It is thought that North Korea is upset at Sony Pictures’ new movie The Interview, which satirizes the country’s dictator Kim Jong Un.

As experts and journalists are continuing to pour over the data, one bizarre item has been found. According to Buzzfeed, the latest data dump included a folder called “Password.” In it there were 139 Word documents, Excel spreadsheets, zip files, and PDFs containing thousands of login credentials for Sony Pictures’ internal computers, social media accounts, and web services accounts. The files used very convenient naming conventions like “password list.xls” or “YouTube login passwords.xlsx.”

Among the passwords were details of SPE’s social media accounts including Facebook, YouTube, and Twitter. One thing is for sure, SPE is going to need to change a lot of passwords, and it needs to do it fast! There are also documents which contain passwords for a variety of other services including Amazon, FedEx, Lexis/Nexis, and Bloomberg.

The situation could get worse for Sony over the next few days. The hackers have indicated that this latest dump is only the start of a series of planned data dumps to the Internet. The hackers claim to have taken over 100TB of data from SPE, of which we have only seen a fraction so far.

The seriously troubling thing about this latest hack is that it isn’t the first time that Sony has been targeted. Sony Pictures Entertainment websites were breached in 2011 by a group known as LulzSec. As a result of the breach LulzSec published the names, birth dates, addresses, emails, phone numbers and passwords of thousands of people who had entered contests promoted by Sony. That breach occurred only a few weeks after Sony confirmed a breach to its PlayStation Network that exposed millions of personal user records. Then last, but not least, in 2012 hackers claimed to have accessed Sony’s servers and downloaded Michael Jackson’s entire back catalog, worth some $253 million.

Apple patches security flaws in iOS 8, OS X 10.10 and Apple TV 7

Apple-logo(LiveHacking.Com) – Apple has released new versions of three of its major software products. The new versions of iOS, OS X and Apple TV address multiple security vulnerabilities. iOS 8.1.1, which is available for the iPhone 4s and later; the iPod touch (5th generation) and later; and the iPad 2 and later; addresses nine separate vulnerabilities. Apple TV 7.0.2, which is available for Apple TV 3rd generation and later, addresses four vulnerabilities, all of which are common with the iOS release. OS X 10.10.1 patches four flaws, two of which are common with the iOS release and two which are specific to OS X.

The common fixes are as follows:

  • iOS and OS X: A privacy issue existed where browsing data could remain in the cache after leaving private browsing. (CVE-2014-4460)
  • iOS and OS X: The initial connection made by Spotlight or Safari to the Spotlight Suggestions servers included a user’s approximate location before a user entered a query. (CVE-2014-4453)
  • iOS and Apple TV: A state management issue existed in the handling of Mach-O executable files with overlapping segments. (CVE-2014-4455)
  • iOS and Apple TV: A malicious application may be able to execute arbitrary code with system privileges due to a validation issue that existed in the handling of certain metadata fields in IOSharedDataQueue objects. (CVE-2014-4461)
  • iOS and Apple TV: Due to multiple memory corruption issues in WebKit, visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. (CVE-2014-4452 and CVE-2014-4462)

The iOS specific fixes are:

  • In some circumstances, the failed passcode attempt limit was not enforced. (CVE-2014-4451)
  • The Leave a Message option in FaceTime may have allowed viewing and sending photos from the device. (CVE-2014-4463)
  • A permissions issue existed with the debugging functionality for iOS that allowed the spawning of applications on trusted devices that were not being debugged. (CVE-2014-4457)

The OS X only patches are:

  • The request made by About This Mac to determine the model of the system and direct users to the correct help resources included unnecessary cookies. (CVE-2014-4458)
  • Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution due to a use after free issue existed in the handling of page objects. (CVE-2014-4459)

More information about all these patches can be found on Apple’s Security Updates web site: http://support.apple.com/kb/HT1222