December 18, 2018

In Brief: Microsoft, Google and Mozilla all block digital certificate issued by intermediate certificate authority of TURKTRUST

turktrust_logo(LiveHacking.Com) –  Microsoft, Google and Mozilla have all removed the trust of certificates issued by an intermediate certificate authority (CA) linking back to TURKTRUST Inc. What has happened is that TURKTRUST Inc. incorrectly created two subsidiary CAs (*.EGO.GOV.TR and e-islem.kktcmerkezbankasi.org), the first of which was used to issue a fraudulent digital certificate for *.google.com.

Intermediate CA certificates carry the same authority as CA, so anyone who has one can use it to create a certificate for any website. Fraudulent certificate can be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks.

“TURKTRUST told us that based on our information, they discovered that, in August 2011, they had mistakenly issued two intermediate CA certificates to organizations that should have instead received regular SSL certificates,” wrote Google.

Google is also considering an update to Chrome which will no longer indicate Extended Validation status for certificates issued by TURKTRUST. Mozilla has suspended the TURKTRUST root certificate. TURKTRUST subsequently asked Mozilla to include a newer root certificate and their request was initially approved. However, due to the mis-issued  intermediate CA certificates, Mozilla has decided to suspend inclusion of the new root certificate for now.

Ex-black hat hacker claims to have full backup for one of Yahoo’s domains

(LiveHacking.Com) –  A reformed black hat hacker, who now works as an ethical security researcher and penetration tester, has found zero-day vulnerabilities in several online services including some provided by Adobe, Microsoft, Yahoo, Google, Apple and Facebook. Since the tester, who goes by the name Virus_HimA, ceased black hat activities he started reporting the vulnerabilities to the vendors instead. According to his post on Pastebin, companies like Google reacted quickly to the reported flaws, but others like Adobe and Yahoo moved very slowly and in some cases didn’t even bother to reply to the disclosure emails they were sent.

As a result Virus_HimA has declared his intention to “teach both of them a hard lesson to harden their security procedures.” This is the better of two evils acording to the ex-hacker. “It would make a disaster if such companies vulnerabilities was privately used in the underground and they never know about it! not only their customers been affected but the vendors themselves also suffer from such exploits,” he wrote.

As part of his penetration activities, Virus_HimA claims to have access to:

  • Full files backup for one of Yahoo domains
  • Full access to 12 of Yahoo Databases
  • Knowledge of a reflected-XSS (Cross Site Scripting) vulnerability

The researcher has promised never to use, share, sell or publish any of the Adobe or Yahoo data and exploits anywhere, but rather is keen to establish his reputation. To this end when he released a small sample of data from Adobe, he specially chose to publish critical email addresses including those with a .mil  ending. This got Adobe’s attention which quickly started investigating the case, shut-down the vulnerable web site and emailed him asking for vulnerability details. Apparently Adobe are now working on a patch.

Analysis

This isn’t the first time a frustrated researcher has resorted to public exposure to get a large online business to move quicker with regards to security issues. Back in November PayPal were embroiled in a dispute with a security researcher who reported errors under PayPal’s security bounty scheme. A few weeks later Skype had to move quickly to fix an account hijacking flaw after it was posted online. The problem was that Skype had been made aware of the flaw some three months before hand.

The ethicality of such public exposure is questionable, however until some of the big online companies start to take these private disclosures more seriously they will continue to happen.

Google updates Chrome to fix a Critical vulnerability and update Flash

(LiveHacking.Com) –  Google has released a new version of Chrome for Windows, Mac and Linux. Chrome 23.0.1271.97 fixes several non-security related bugs along with at least one Critical level security vulnerability. The new version also includes an updated version of Flash following Adobe’s security update.

The Critical level bug is a crash in the history navigation. It was found by Michal Zalewski of the Google Security Team. The other security related bugs, along with the money awarded to the bounty hunter by Google under the Chromium security rewards scheme, are:

  • [$1500] [158204] High CVE-2012-5139: Use-after-free with visibility events. Credit to Chamal de Silva.
  • [$1000] [159429] High CVE-2012-5140: Use-after-free in URL loader. Credit to Chamal de Silva.
  • [160456] Medium CVE-2012-5141: Limit Chromoting client plug-in instantiation. Credit to Google Chrome Security Team (Jüri Aedla).
  • [160926] Medium CVE-2012-5143: Integer overflow in PPAPI image buffers. Credit to Google Chrome Security Team (Cris Neckar).
  • [$2000] [161639] High CVE-2012-5144: Stack corruption in AAC decoding. Credit to pawlkt.

The new version also fixes the following non-security related bugs

  • Some texts in a Website Settings popup are trimmed (Issue: 159156)
  • Linux: <input> selection renders white text on white bg in apps (Issue: 158422)
  • some plugins stopped working (Issue: 159896)
  • Windows 8: Unable to launch system level chrome after self destructing user-level chrome (Issue: 158632)

In Brief: Google releases Chrome 23.0.1271.95 and gives Pinkie Pie $7331

(LiveHacking.Com) –  Google has released a new version of its Chrome browser (23.0.1271.95) just three days after releasing the previous version. This new update is a purely security related release and it fixes two high rated security vulnerabilities.

In Google speak, High means that the vulnerability could let an attacker read or modify confidential data belonging to other web sites. Also vulnerabilities that interfere with browser security features are also high severity.

The first vulnerability fixed, found by Jüri Aedla of the Google Chrome Security Team, was a bug in file path handling. The second, found by Pinkie Pie, was a use-after-free in media source handling. Pinkie Pie’s bug earned the researcher $7331.

Chrome 23.0.1271.91 fixes some High risk security vulnerabilities but nothing Critical

(LiveHacking.Com) – Google has released Chrome 23.0.1271.91 for Windows, Mac and Linux. The release fixes several bugs including an audio problem with Flash when the speaker configuration was set to Quadraphonic, however more importantly it fixes several High risk security vulnerabilities, but nothing ranked as Critical.

This release fixes three vulnerabilities with the  High rating. High in this context means that the vulnerability could let an attacker read or modify confidential data belonging to other web sites. Also vulnerabilities that interfere with browser security features are also high severity.

Under the Chromium security rewards scheme, Justin Drake was given a special reward for finding a bug in OS X which was sufficiently severe or particularly hard to workaround that it affects Chrome indirectly. In this case the High level vulnerability was a connected with a corrupt rendering in the Apple OSX driver for Intel GPUs.

Miaubiz was also hard at work and is credited with finding a High risk use-after-free bug in the SVG filters. Use-after-free bugs are good potential candidates for a full exploit. The other High rated vulnerability was a buffer underflow in libxml. The credit for fining that one goes to Jüri Aedla of the Google Chrome Security Team.

The full list of bugs is as follows:

  • [$1000] [152746] High CVE-2012-5131: Corrupt rendering in the Apple OSX driver for Intel GPUs. Credit to Justin Drake.
  • [$1000] [156567] High CVE-2012-5133: Use-after-free in SVG filters. Credit to miaubiz.
  • [$500] [148638] Medium CVE-2012-5130: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.
  • [155711] Low CVE-2012-5132: Browser crash with chunked encoding. Credit to Attila Szász.
  • [158249] High CVE-2012-5134: Buffer underflow in libxml. Credit to Google Chrome Security Team (Jüri Aedla).
  • [159165] Medium CVE-2012-5135: Use-after-free with printing. Credit to Fermin Serna of Google Security Team.
  • [159829] Medium CVE-2012-5136: Bad cast in input element handling. Credit to Google Chrome Security Team (Inferno).

It is worth noting that Google keep the referenced bugs private until a majority of Chrome users are up to date with the fixes.

Google releases Chrome 23 with some unique security bug fixes

(LiveHacking.Com) – Google has released Chrome 23 with some new features, like the option to send a ‘do not track’ request to websites, as well as some interesting security fixes. A “normal” Chrome update includes a variety of bug fixes found by Google itself and by outside security researchers who are reward (in cash) by Google for their efforts. However this time things are slight different.

First of all Google has issued a special reward to  miaubiz for non-Chrome related bug which is very severe and/or Google are able to partially work around the issue. In this case it was a way to defend against wild writes in buggy graphics drivers on Mac OS X. miaubiz got $1000 for his efforts!

This then also led to another $1000 for miaubiz for an integer bounds check issue in GPU command buffers, again only on Mac OS X.

Finally there is a out-of-bounds array access bug in v8 which was found by Atte Kettunen of OUSPG. This particular bug only affected Linux 64-bit systems only.

For the rest it was security bug squashing as normal:

  • [$3500] [157079] Medium CVE-2012-5127: Integer overflow leading to out-of-bounds read in WebP handling. Credit to Phil Turnbull.
  • [$1000] [143761] High CVE-2012-5116: Use-after-free in SVG filter handling. Credit to miaubiz.
  • [$1000] [154055] High CVE-2012-5121: Use-after-free in video layout. Credit to Atte Kettunen of OUSPG.
  • [145915] Low CVE-2012-5117: Inappropriate load of SVG subresource in img context. Credit to Felix Gröbert of the Google Security Team.
  • [149759] Medium CVE-2012-5119: Race condition in Pepper buffer handling. Credit to Fermin Serna of the Google Security Team.
  • [154465] Medium CVE-2012-5122: Bad cast in input handling. Credit to Google Chrome Security Team (Inferno).
  • [154590] [156826] Medium CVE-2012-5123: Out-of-bounds reads in Skia. Credit to Google Chrome Security Team (Inferno).
  • [155323] High CVE-2012-5124: Memory corruption in texture handling. Credit to Al Patrick of the Chromium development community.
  • [156051] Medium CVE-2012-5125: Use-after-free in extension tab handling. Credit to Alexander Potapenko of the Chromium development community.
  • [156366] Medium CVE-2012-5126: Use-after-free in plug-in placeholder handling. Credit to Google Chrome Security Team (Inferno).
  • [157124] High CVE-2012-5128: Bad write in v8. Credit to Google Chrome Security Team (Cris Neckar).

Since adobe has released a new version of its ubiquitous Flash Player to address vulnerabilities that could cause a crash and potentially be exploited by an attacker to infect a PC with malware, Chrome 23 includes the updates version of Flash Player.

Google updates Chrome after successful exploit at Pwnium 2

(LiveHacking.Com) – Google has released a rapid update to its Chrome web browser after it was successfully exploited at the Google run Pwnium 2 hacking competition. Chrome 22.0.1229.94, which is available for Windows, Mac, and Linux, fixes a SVG use-after-free and IPC arbitrary file write bug that was successfully used by Pinkie Pie to fully exploit Chrome. The prize money was $60,000 which is the top amount awarded for a full Chrome exploit on a fully patched Windows 7  PC using only bugs in Chrome itself.

“We’re delighted at the success of Pwnium 2, and anticipate additional hardening and future improvements to Chrome as a result of the competition,” wrote Jason Kersey from Google’s Chrome team.

The official bug list is as follows:

  • [$60,000][154983][154987] Critical CVE-2012-5112: SVG use-after-free and IPC arbitrary file write. Credit to Pinkie Pie.

PinkiePie (aka PwniePie) is no stranger to exploiting Chrome. Back in March he also received $60,000 after successfully demonstrating an exploit at the first Pwnium competition. Shortly after Google issued 17.0.963.79 to fix the vulnerability used. At the time, Jason Kersey from the Google Chrome team is quoted as calling the exploit “a beautiful piece of work.”

Google updates Chrome to fix Critical security vulnerability in audio device handling

(LiveHacking.Com) – Google has released Chrome 22.0.1229.92 to fix several security related bugs, including a Critical security vulnerability in its audio device handling, and to update the built-in Adobe Flash player. Google paid out over $4000 to Atte Kettunen of OUSPG for his help in finding the audio related bug and a crash in Skia text rendering.

The list of security fixes are:

[$1000] [138208] High CVE-2012-2900: Crash in Skia text rendering. Credit to Atte Kettunen of OUSPG.
[$3133.7] [147499] Critical CVE-2012-5108: Race condition in audio device handling. Credit to Atte Kettunen of OUSPG.
[$500] [148692] Medium CVE-2012-5109: OOB read in ICU regex. Credit to Arthur Gerkis.
[151449] Medium CVE-2012-5110: Out-of-bounds read in compositor. Credit to Google Chrome Security Team (Inferno).
[151895] Low CVE-2012-5111: Plug-in crash monitoring was missing for Pepper plug-ins. Credit to Google Chrome Security Team (Chris Evans).

It is worth noting that Google keep the referenced bugs private until a majority of Chrome users are up to date with the fixes.

Also included in Chrome 22.0.1229.92 is the latest version of the Adobe Flash Player which was just updated to address vulnerabilities that could cause a crash and potentially allow an attacker to take control of the affected system. The new versions in Chrome are 11.4.31.110 for Windows and Linux, and 11.4.402.287 for Macintosh.

Google releases Chrome 22 with $28,500 worth of security fixes and a workaround for a Windows kernel memory corruption

(LiveHacking.Com) – Google has released Chrome 22 with a variety of new features including a new Mouse Lock API (used mainly by 3D games) and some very important security fixes including a Critical level fix for a Windows kernel memory corruption. Under its reward scheme, which pays security researchers real money for their efforts in finding vulnerabilities in Chrome, Google paid out $28500 for vulnerabilities fixed in Chrome 22, one of which (the Windows kernel memory corruption) was award $10,000 while two UXSS  vulnerabilities earned Sergey Glazunov $15,000.

There are no details yet on the Windows kernel memory corruption or the nature of the Universal XSS flaws as Google (wisely) keeps the bug details private until a majority of users have updated. The Critical flaw in Windows (146254 / CVE-2012-2897) is credited to Eetu Luodemaa and Joni Vähämäki, both from Documill.

The UXSS errors are rated has High:

  • [143439] High CVE-2012-2889: UXSS in frame handling. Credit to Sergey Glazunov.
  • [143437] High CVE-2012-2886: UXSS in v8 bindings. Credit to Sergey Glazunov.

Other security related bugs fixed (along with the related rewards) are:

  • [$2000] [139814] High CVE-2012-2881: DOM tree corruption with plug-ins. Credit to Chamal de Silva.
  • [$1000] [135432] High CVE-2012-2876: Buffer overflow in SSE2 optimizations. Credit to Atte Kettunen of OUSPG.
  • [$1000] [140803] High CVE-2012-2883: Out-of-bounds write in Skia. Credit to Atte Kettunen of OUSPG.
  • [$1000] [143609] High CVE-2012-2887: Use-after-free in onclick handling. Credit to Atte Kettunen of OUSPG.
  • [$1000] [143656] High CVE-2012-2888: Use-after-free in SVG text references. Credit to miaubiz.
  • [$1000] [144899] High CVE-2012-2894: Crash in graphics context handling. Credit to Sławomir Błażek.
  • [Mac only] [$1000] [145544] High CVE-2012-2896: Integer overflow in WebGL. Credit to miaubiz.
  • [$500] [137707] Medium CVE-2012-2877: Browser crash with extensions and modal dialogs. Credit to Nir Moshe.
  • [$500] [139168] Low CVE-2012-2879: DOM topology corruption. Credit to pawlkt.
  • [$500] [141651] Medium CVE-2012-2884: Out-of-bounds read in Skia. Credit to Atte Kettunen of OUSPG.
  • [132398] High CVE-2012-2874: Out-of-bounds write in Skia. Credit to Google Chrome Security Team (Inferno).
  • [134955] [135488] [137106] [137288] [137302] [137547] [137556] [137606] [137635] [137880] [137928] [144579] [145079] [145121] [145163] [146462] Medium CVE-2012-2875: Various lower severity issues in the PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.
  • [137852] High CVE-2012-2878: Use-after-free in plug-in handling. Credit to Fermin Serna of Google Security Team.
  • [139462] Medium CVE-2012-2880: Race condition in plug-in paint buffer. Credit to Google Chrome Security Team (Cris Neckar).
  • [140647] High CVE-2012-2882: Wild pointer in OGG container handling. Credit to Google Chrome Security Team (Inferno).
  • [142310] Medium CVE-2012-2885: Possible double free on exit. Credit to the Chromium development community.
  • [143798] [144072] [147402] High CVE-2012-2890: Use-after-free in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.
  • [144051] Low CVE-2012-2891: Address leak over IPC. Credit to Lei Zhang of the Chromium development community.
  • [144704] Low CVE-2012-2892: Pop-up block bypass. Credit to Google Chrome Security Team (Cris Neckar).
  • [144799] High CVE-2012-2893: Double free in XSL transforms. Credit to Google Chrome Security Team (Cris Neckar).
  • [145029] [145157] [146460] High CVE-2012-2895: Out-of-bounds writes in PDF viewer. Credit to Mateusz Jurczyk of Google Security Team, with contributions by Gynvael Coldwind of Google Security Team.

The new mouse lock API included in Chrome 22 allows 3D applications, such as first-person games, to offer users control of the in-game 3D perspective using the mouse, without moving outside the window or bumping into the edge of their screen. Google recommends this first-person shooter demo created by Mozilla.

In brief: Google adds OAuth 2.0 support for IMAP/SMTP and XMPP

(LiveHacking.Com) – Google has been a long time proponent of using OAuth 2.0 for its services and APIs. Now it has extended its use of the open standard authorization mechanism by adding OAuth 2.0 support for IMAP/SMTP and XMPP.

It was just over a year ago that Google announced its recommendation that OAuth 2.0 become the standard authentication mechanism for itsAPIs. Using it has several security benefits including access to Google’s two-factor authentication process.

“When clients use OAuth 2.0, they never ask users for passwords. Users have tighter control over what data clients have access to, and clients never see a user’s password, making it much harder for a password to be stolen. If a user has their laptop stolen, or has any reason to believe that a client has been compromised, they can revoke the client’s access without impacting anything else that has access to their data,” said Ryan Troll from Google’s Application Security Team.

Google has alos announced that it will deprecate the older authentication mechanisms such as XOAUTH for IMAP/SMTP and X-GOOGLE-TOKEN and SASL PLAIN for XMPP.