Posts by author:

Paul Henry

Some Holiday Cheer from Microsoft

by Paul Henry on December 13, 2011

in SBN

Think the 12 Days of Christmas jingle:
On this Patch Tuesday before Christmas ….. Microsoft Gave to me ….. 3 critical patches… 10 important ones…and a patch for the Duqu vulnerability…

We initially expected 14 bulletins for this December Patch Tuesday however the much awaited fix for “The Beast” SSL issue was not released today after all. Given the extensive regression testing Microsoft does across various configurations, my assumption is that additional testing is likely required for an issues as complex as this.

Microsoft ended the year with 13 December bulletins and fortunately for all of us, that includes the much needed Duqu patch.

While at first glance 13 bulletins may seem like a large number, only 3 are critical. And while  IT teams will see a needed break on Microsoft vulnerabilities this month, concerns over other, third-party applications should keep them busy through the end of the year.

December Patch Tuesday details:

  • 6 Windows vulnerabilities
  • 1 IE vulnerability
  • 5 Office vulnerabilities
  • 1 Windows Media Player vulnerability

2011 in review

Considering the previous years of Microsoft patches this is not a bad way to end the year.  Microsoft released 17 bulletins on the 2010 December Patch Tuesday. In total, 2011 saw 99 bulletins – down from 2010 when we saw 106.  Clearly Microsoft has dramatically improved its software processes and this is reflected in the continued decline of vulnerabilities considered critical in the current codebase. The numbers speak volumes on the improvements from Microsoft – in 2006 70% of security patches were critical and in 2011 critical vulnerabilities fell to just 30%. In an otherwise volatile threat landscape, this is good news for everyone.

Outside of Microsoft, IT staff is dealing with the Zero Day Adobe vulnerability as previously discussed on the Lumension Blog.  Adobe is only releasing a patch for the Windows versions of the issue because that is the primary platform under attack. A fix for Unix and Mac users will not be available from Adobe until January 12, 2012.  In all, Adobe released 121 bulletins this year, also down from last year.

Another trend worth mentioning is the increased use of Java as an emerging leading threat vector. As with the Adobe issues of the past few years, hackers are taking advantage of users’ failure to patch out dated versions. A recent article in Dark Reading noted that “… since the third quarter of 2010, Microsoft has detected or blocked some 6.9 million exploit attempts on Java each quarter, with a total of 27.5 million attempted exploits during that 12-month period”. 

Critical

MS11-087
Vulnerability in Windows Kernel-Mode Drivers Could Allow Remote Code Execution

MS11-090
Cumulative Security Update for ActiveX Kill Bits

MS11-092
Vulnerability in Windows Media Could Allow Remote Code Execution

Important

MS11-088
Vulnerability in Microsoft Office IME (Chinese) Could Allow Elevation of Privilege
MS11-089
Vulnerabilities in Microsoft Office could allow for Remote Code Execution

MS11-091
Vulnerabilities in Microsoft Publisher could allow Remote Code Execution

MS11-093
Vulnerability in Microsoft Windows OLE32 Could Allow Remote Code Execution
MS11-094
Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution
MS11-095
Vulnerability in Active Directory Could Allow Remote Code Execution
MS11-096
Vulnerability in Microsoft Excel Could Allow Remote Code Execution
MS11-097
Vulnerability in Windows Client/Server Runtime Subsystem Could Allow Elevation of Privilege
MS11-098
Vulnerability in Windows Kernel Could Allow Elevation of Privilege
MS11-099
Cumulative Security Update for Internet Explorer

 

December 2011 Patch Tuesday Security Briefing

by Paul Henry on December 13, 2011

in SBN

Paul Henry, Security and Forensics Analyst for Lumension, discusses the impact of the December 2011 Patch Tuesday releases.

How the Grinch Stole Christmas – with an Adobe Zero Day

by Paul Henry on December 6, 2011

in SBN

Yet another dangerous Adobe Zero Day in the wild

Adobe has posted a Security Advisory for a Day Zero vulnerability that is currently actively targeting Adobe Reader 9.4.6 on the Windows platform. According to the advisory, the vulnerability (CVE-2011-2462) will be addressed first on the current target platform the week of December 12 and, because the risk is lower for Unix and Mac users, a patch will not be released there until the regularly scheduled patch cycle on January 12, 2012.

This vulnerability could cause a crash and potentially allow an attacker to take control of the affected system. Adobe further advises users who are still running Adobe Reader or Acrobat 9 and older versions to upgrade to Adobe Reader or AcrobatX, which is not impacted by the current issue.

As recent as 2009, Adopbe earned the title of “most hacked software of the year” when malicious PDF files accounted for more than 80% of all exploits for the year. Be on guard this holiday season – PDF files have long been a popular vehicle to transport obfuscated malware in Spear Phishing Attacks and this vulnerability makes that task even easier.

In light of the never ending stream of issues with Adobe Reader and Acrobat, users may want to consider achieving a little “security by obscurity” with any one of more than a dozen Adobe alternates for PC and Mobile platforms, such as:

Sumatra PDF
Foxit Reader
Cool PDF Reader
Nitro Reader
PDF-XChange Viewer
Skim
Quick PDF
Gnostice (multiple PDF tools)
eXpert PDF Reader
Evince
Okular
STDU Viewer
GoodReader
Chrome PDF Viewer Plug-In
ePDFView
Perfect PDF Reader

Top 5 Predictions for 2012

by Paul Henry on December 5, 2011

in SBN

Back in April, I wrote 2011 had the potential to be a really bad year for securing our networks. I was right and I’m not happy about it.

From ever-growing numbers of malware to an evolving endpoint environment that now includes countless mobile devices, IT security has never been more challenging. And important. Here are what I believe will be key issues in 2012.

More Malware

From a vulnerability perspective we will see more of the same.  In fact, McAfee’s Q3 report forecasts 75 million malware samples in 2011. IT continues to focus on primary applications and they don’t patch third party applications or browser add-ons. It is no wonder this remains our primary threat vector.

While many APT incidents to-date have relied upon unsophisticated attack tools, there is a clear advantage for our foes in the use of DLL Injection malware. Expect its use to grow in 2012. Our ability to respond with traditional incident response techniques also leaves us exposed as the malware never touches the hard drive.

BYOD Security Mis-steps

Enterprises will increasingly rely on Bring Your Own Device (BYOD) yet the improved productivity and efficiencies that makes mobility a hot trend will also come with little, if any, regard to security. Simultaneously, Google’s Android OS will un-seat Apple as the pre-dominate Mobile OS. Together, these two trends create a perfect storm for hackers.  Unlike Apple, the Android market place does not screen applications for security. Juniper recently reported that Android Malware saw a 472% increase since July.

If enterprises continue to focus their security efforts on the gateway, they are leaving endpoints and mobile devices as low hanging fruit for the bad guys.

Slow Adoption of Virtualization

The move to virtualization is slowing but risks are increasing partly due to the lack of security offerings that can apply policy within a private and public cloud environment. While the shift to virtualization offered the promise to correct security mistakes made in the early physical computing days, it looks like we will continue to make the same mistakes and take shortcuts with the basics. Meaning – there are no allowances in a virtual environment for configuration management and server hardening, there continues to be a narrow (at best) focus on flaw remediation, signature based defenses continue to disappoint and we still have misplaced reliance on gateway / perimeter defenses.

Loss of Trust in SSL Ecosystem

Our entire SSL ecosystem is in critical need of overhaul. This became painfully apparent after the 2011 failure of Dutch certificate authority DigiNotar after millions of users were exposed to the threat of Man-In-The-Middle attacks. We will see more people question just how much trust can be afforded to SSL – further undermined with the issues discovered in websites using SSL version 3 and TLS version 1.0 and earlier. New tools have even been released that are capable of decrypting and obtaining the authentication tokens and cookies used in many websites’ HTTPS requests.

IPV6

Many governments – the U.S. included – target 2012 for IPV6 implementation. This will become a problem as few security products actually fully support IPV6 and worse yet many are using technologies to encapsulate IPV6 on top of IPV4. Given this, 2012 could be the dawn of IPV6 malware poised to take advantage of this clear weakness.

I’d like to think 2012 is the year we get serious about security. But time will tell.

Microsoft Doesn’t Drop Any Turkeys This Patch Tuesday

by Paul Henry on November 8, 2011

in SBN

There may be a Black Friday this month, but there’s also a happy Tuesday from Microsoft with just 4 bulletins this period. Only one of the bulletins is critical; however its exploitability rating is only a 3 and Microsoft suggests it is not likely this patch will be used. The additional patches include 2 important and 1 moderate. All 4 patches will impact Windows platforms and will require a reboot.
 

Details:

MS11-083 Vulnerability in TCP/IP Could Allow Remote Code Execution
Critical - Remote Code Execution

MS11-084 Vulnerability in Microsoft Windows Could Allow Remote Code Execution
Important - Remote Code Execution

MS11-085 Vulnerability in Windows Mail and Windows Meeting Space Could Allow Remote Code Execution
Important - Remote Code Execution

MS11-086 Vulnerability in Active Directory Could Allow Elevation of Privilege
Important - Elevation of Privilege

Of course, the real question on everyone’s mind is Duqu (or the son of Stuxnet). While many dispute the threat imposed by this malware, no one disputes the risk of the Day Zero Vulnerability in Microsoft software that it takes advantage of. The vulnerability is exploited through a malicious Word document – when the user opens the document, a Zero Day Kernel Vulnerability is taken advantage of to execute malicious code. Microsoft did not issue a patch this cycle but has released a temporary fix using their “Fix It” solution http://support.microsoft.com/kb/2639658#FixItForMe

All in all, it seems the primary threat vector of late is browser and third party add-ons. A recent report noted that malicious domains have increased by 89% year over year. Simply put, hackers recognize that users simply do not patch their third party add-ons and as always, they capitalize on that weakness to compromise our environments.

 Social media continues to be a risk to the enterprise as well. After insisting there was no concern, Facebook reportedly corrected an issue that allowed a user to send another user an executable attachment using message capability. This created an easy platform for launching Spear Phishing attacks.
 
In addition, an issue in WordPress may have compromised up to one million blogs. A problem in the popular tool TimThumb, that when used in WordPress blogs to access photo sites, can cause users to be redirected to malicious websites.
 
And let’s not forget the cloud. Security issues continue to cause problems this Patch Tuesday period. Thankfully, Amazon is on top of it and corrected an issue that could allow hackers to hijack Amazon customer accounts.
 

 

November 2011 Patch Tuesday Security Briefing

by Paul Henry on November 8, 2011

in SBN

Paul Henry, Security and Forensics Analyst for Lumension, discusses the impact of the November 2011 Patch Tuesday releases.

Keys to the Kingdom

by Paul Henry on October 28, 2011

in SBN

For hackers, social media is the top malware delivery vehicle of choice right now. And why not? Social networking sites are where the people are – and their information is readily available. Sadly, many unsuspecting people fail to realize that by creating a Facebook page, they are literally handing bad guys all the necessary needed to hack their bank account.

It’s a problem growing in significance for both individuals and their employers. A new study by Websense shows that 52 percent of organizations have experienced an increase in virus and malware attacks as a result of employees’ use of social media in the workplace.

How does this happen?

Think about it for a moment; all that is typically necessary to reset a user’s online bank account password are the answers to a small number of secret questions. And all of the information necessary to answer these secret questions can usually be easily found within the users’ (or shall we call them victims?) Facebook pages and wall postings. The most common tactics used by hackers today include:

  •  Click jacking –  this tactic usually tricks users into revealing personal information with a sensational message or with transparent .gifs that hover over the “Like” button found on many company pages.
  • Spear phishing – emails that seem to come from someone you know asking for information like passwords; this technique now makes up 23 percent of all social media attacks.
  • Password sniffing – if a hacker is able to access your password, his ability to steal more information only increases when people rely on the same password across multiple accounts. Case in point: password research on the data associated with the Sony Breach. It’s shocking to see the number of people who use the very same password across multiple accounts, including social media sites and their bank account.
  •  Secret questions – are your secret questions really any secret at all? A study by IEEE in 2009 found that 28 percent of those that simply knew and trusted an individual could often guess that person’s answers to their account secret questions.

Given the significant threat to security brought on by social networking sites, IT often tries to ban their use from within the organization’s network all together. But rarely does that fly. Remember, for some positions, there are very legitimate reasons for relying on social networking while at work.

So what can be done?

Educate users

Your first step should be to educate your organization’s employees on what they should and should not do online. While critically important, it’s obviously easier said than done. Start with these simple measures:

1. Teach them how to recognize a secure webpage.

  • There is a de facto standard among web browsers to display a “lock” icon somewhere in the window of the browser (NOT in the webpage display area!)  For example, Microsoft Internet Explorer displays the lock icon in the lower-right corner of the browser window. As another example, Mozilla’s FireFox Web Browser displays the lock icon in the lower-left corner.

2. Remind them that by default, most social media applications do not encrypt the communications between the user and the website and this allows a malicious person to easily capture their user account credentials.

  • To change the default connection to encrypted communications, on Facebook, for example) tell employees to change their account settings via this page: HTTPS Account>Account Settings>Account Security. Once there, they should select the secure browsing / HTTPS checkbox, so that their Facebook visits, including their login will be encrypted.

3. Caution them about phishing emails by reminding them to never share their credentials over email.

  •  Social media can make a phishing email appear like it is  from a trusted friend by using information actually harvested from the user’s Facebook page – making users think only a trusted friend would have known that information.

4. Explain the difference between weak and strong passwords and remind employees not to reuse them across other accounts.

5. Explain that the issue of using the same answers to “Secret Questions” can be a recipe for disaster and is perhaps just as big of a risk as using the same password across multiple accounts.

Put policies in place

Create simple policies where implementation is reasonable:

1. Ask that employees use their personal email address on social media sites rather than their work email address.
2. Do not allow downloading of content from these sites.

The most important thing here is of course policy enforcement. From my perspective, I would also implement technology tools that block downloading.

Patching

Your first line of defense should always be up-to-date patching. And the key here is expanding your patching efforts beyond Microsoft. More than 2/3 of today’s vulnerabilities come from non-Microsoft applications. Third-party applications are increasingly targeted by hackers and you need to have a proactive patch strategy in place that covers all vulnerabilities, not just the critical ones.

In the fight against cyber crime, the most important thing to remember is security is not JUST a technology problem. While effective software (in my opinion, a comprehensive suite solution that encompasses multiple layers of security like patching, application control, antivirus and device control works best) is important, so are people (translation: users) and policy. You must address all three areas to get a leg up on the bad guys (before they have one up on you).

October 2011 Patch Tuesday Security Briefing

by Paul Henry on October 11, 2011

in SBN

VIDEO: Paul Henry, Security and Forensics Analyst for Lumension, discusses the impact of the October 2011 Patch Tuesday releases.

Some Tricks and Some Treats from Microsoft

by Paul Henry on October 10, 2011

in SBN

The Treat: October’s bulletins resolve several issues: 2 critical and 6 important, covering a range of products, including Microsoft .NET Windows, IE, Forefront and MS Host Integration Server.
 
The Trick: nearly all require a restart which will cause widespread disruptions across both Internet-connected servers and user community desktops.
 
The Details:

MS11-081: Critical Internet Explorer patches that correct 8 vulnerabilities with typical attack vectors and one involving Java Script. None of the patched issues are related to active exploits; however users are urged to patch this as a high priority. It’s important to note that many of the fixes are related to improving defense in depth to strengthen the browser.

MS11-078: Critical .NET issue, which also impacts SilverLight. Users of .NET Client and SilverLight are urged to apply this patch as a high priority.

MS11-075: Important Windows Active Accessibility that corrects a DLL Injection issue.

MS11-076: Important Media Center Issue, correcting a DLL Injection Issue.

MS11-077: Important patch that resolves a Win32l Kernel Mode Drivers Issue that involves font rendering, which is a low risk with Microsoft IE (as the font would not be rendered), but could be a high risk with third party browsers (that would render the font).

MS11-080: Important Ancillary Function Driver Issue that provides for an escalation of privilege.

MS11-079: Important Forefront UAG Issue, resolving a perimeter firewall XSS issue.

MS11-082: Important Host Integration Server, resolving a DoS issue for the service.

Also released today was SP 3 for Office 2007 and SharePoint 2007. SP3 includes a roll up of previously patched issues, as well as newly discovered issues from the lifecycle of SP2.
 
Yet again vulnerabilities have proven not to be an issue exclusive to Microsoft – third party products and add-ons are our Achilles Heel again this period. The ever increasing integration of mobile devices with little if any regard to security of our enterprise networks, along with the seemingly non-stop release of vulnerabilities from Android and other vendor is placing us in a precarious situation. 

The recently disclosed Android Smart Phone issue can be exploited by third party applications and can effectively render all phone-based protections ineffective.
http://www.theinquirer.net/inquirer/news/2114308/android-vulnerability-renders-antivirus-products-ineffective
 
Also, a Chrome update was released to address several security issues. This period Google paid bounties totaling $8,000 to researcher Glazunov and an additional $2,000 to Miaubiz. Outside of the bounty program, a severe vulnerability discovered by Google’s own security team in audio node handling was also addressed. It’s important to note that one of Google’s fixed issues for Chrome was a buffer overflow that allowed a malicious attacker to arbitrarily execute code on a Chrome user’s computer.
http://news.cnet.com/8301-1009_3-10035720-83.html
 
In addition, a vulnerability in Apache that provides a DoS vector has been patched in release 2.2.20 and users are encouraged to upgrade to the current version to mitigate the risk of exploitation.
http://httpd.apache.org/security/vulnerabilities_20.html
 
Finally, just a week after the quarterly patch update from Adobe, an out of band patch was released to address 6 issues including a zero-day vulnerability.
http://www.eweek.com/c/a/Security/Adobe-Patches-ZeroDay-XSS-Vulnerability-in-Flash-Player-10-787685/
 
Not only are patches of concern but now we are facing a BEAST, both literally and figuratively. Last week, researchers demonstrated software they created called the BEAST (Browser Exploit Against SSL/TLS) that can decrypt parts of an encrypted data stream and can be used in what is known as a “man-in-the-middle” (MITM) type of attack. Browser makers have been a mixed bag on responding to this very real threat. Google is treating it as a serious issue for Chrome and Microsoft released an advisory, whereas Firefox did not issue and update but asked users to disable Java.
 
With respect to the SSL issues and “The BEAST” we are perhaps seeing just the tip of the iceberg in focusing our attention only on browsers. Several other products, such as VoIP phones and SCADA systems that also use SSL, are perhaps more at risk due to expected long term delays in patching them.

 

September 2011 Patch Tuesday Security Briefing

by Paul Henry on September 13, 2011

in SBN

Paul Henry, Security and Forensics Analyst for Lumension, discusses the impact of the September 2011 Patch Tuesday releases.



← Previous Entries

Next Entries →