PDF Malware Using New Tricks to Exploit Vulnerability

Security researchers have identified a new trick in PDF files being sent as email attachments that obfuscate attack code by encoding it inside an image file.

Malicious PDF files are using a new trick to avoid detection by almost all major antivirus scanners on the market, according to security researchers. Researchers from Avast and Sophos independently noticed PDF files making the rounds in March that weren’t being flagged as malicious but had the ability to compromise a machine just by being opened. The originating address was often suspicious, and the attachments accompanied emails purporting to be an order receipt. The attachments themselves often had names containing the supposed order number.
When the attachments were opened under Adobe 8.1.1 or Adobe 9.3, the compromised computer would connect to a remote site and download malware, usually SpyEye, ZBot  or FakeAV, Paul Baccas, a senior threat researcher at Sophos Labs, wrote on the company’s Naked Security blog on April 15.
“The PDFs did not seem to be using any exploit that I could see and yet they were downloading malware,” wrote Baccas.
It turned out these files were using a new trick to re-exploit the CVE-2010-0188 vulnerability Adobe had patched over a year ago on Feb. 16, 2010, according to Baccas.
The exploit is specific to Reader and would not execute in Google Chrome’s PDF Plugin, Jiri Sejtko, a senior virus analyst and researcher at Avast Software, wrote on the company blog April 22. While that’s a good sign, Chrome generally asks users if it should open the file in Reader if it can’t display the file correctly. In this day and age, many users would likely say yes, making them vulnerable, according to Sejtko.
The PDF specifications allow several filters to be used on raw data, either singly or in conjunction with each other, Sejtko said. Anyone can create valid PDF files where the data uses five different filters, or even multiple layers of the same filter. This allows malware authors to embed malicious code deep inside the filters, out of reach of even the most aggressive scanner.
“Our parser was unable to get any suitable content that we could define as malicious,” Sejtko said.
Files exploiting this vulnerability normally use an XML file that contains the raw data for a TIFF image file containing highly obfuscated code, Baccas said. In this case, the attackers were using parameters to control how the filters operate and crafting the attack code embedded in the raw data to conform to these parameters.
The filter being used to encrypt the malicious code was also meant to be used only for black and white images. The exploit detected by Avast researchers combined two filters, one for text and one for images, to hide the payload.
“Who would have thought that a pure image algorithm might be used as a standard filter on any object stream?” Sejtko said. While the “bad guys” are building a specially crafted TIFF image file in the PDF files, the trick can be used to hide special JavaScript and font files, as well.
Compared to other attacks, this attack is seen in “only a very small number” of attacks, Sejtko said, but has also been used in targeted attacks. While the CVE-2010-0188 flaw has been closed in current versions of Adobe Reader, users on older and unpatched versions of the software remain vulnerable to these malicious PDF files.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">PDF Malware Using New Tricks to Exploit Vulnerability"https://www.voiceofgreyhat.com/2011/04/pdf-malware-using-new-tricks-to-exploit.html</a>

Flame -The "Super Spy" Even On Offline Computers Turning Users into Data Mules

Flame -The "Super Spy" Even On Offline Computers Turning Users into Data Mules

The program known as Flame has fascinated the cyber-security industry with its sophistication and versatility as a Swiss-Army knife of cyber-spying. Now researchers have discovered another unexpected tool in its data-stealing arsenal: You.

Malware analysts at the security firm Bitdefender say they’ve found a unique capability within Flame’s code that would potentially allow it to steal data even from computers that aren’t connected to the Internet or to other networked machines. Instead of simply uploading stolen data to a remote server as traditional spyware does, Flame can also move the target information–along with a copy of itself–onto a USB memory stick plugged into an infected machine, wait for an unwitting user to plug that storage device into an Internet-connected PC, infect the networked machine, copy the target data from the USB drive to the networked computer and finally siphon it to a faraway server.

Spreading itself over an infected USB device is hardly a new trick for malware. But Bitdefender’s researchers say they’ve never before seen a cyberespionage program that can also move its stolen digital booty onto the USB stick of an oblivious user and patiently wait for the opportunity to upload it to the malware’s controllers.

“It turns users into data mules,” says Bitdefender senior malware analyst Bogdan Botezatu. “Chances are, at some point, a user with an infected flash drive will plug it into a secure computer in a contained environment, and Flame will carry the target’s information from the protected environment to the outside world…It uses its ability to infect to ensure an escape route for the data. This is is somewhat revolutionary for a piece of malware.”

Flame was designed to use the same .lnk autorun vulnerability first exploited by the NSA-built Stuxnet malware to invisibly install itself on USB devices. To hide its trove of stolen data on the user’s device, Flame copies both itself and its data to a folder labelled with a single “.” symbol, which Windows fails to interpret as a folder name and thus renders as invisible to the user. “What we have here is a little hack/exploit performed on how the operating system is interpreting file names,” Bitdefender’s researchers wrote in a blog post on Flame last week.

When an infected USB is plugged into a networked machine, Flame checks that it can contact its command and control server through that computer. Then it moves its target data off the USB to the PC, compresses it, and sends it to the remote server via HTTPS, according to Bitdefender’s analysis. The researchers found that while Flame is capable of infecting networked PCs for the purpose of exfiltrating its data, the version they analyzed had rendered that infection capability inactive, perhaps to avoid the spyware spreading too far, so that only PCs already infected with Flame would be capable of acting as gateways back to the malware controller’s server. The fact that the spyware’s infection technique was turned off may be evidence that the “data mule” in the Flame operation may in fact have been aware of his or her role as an data smuggler.

Regardless, Botezatu says Flame’s USB-piggybacking trick fits with its profile as a highly sophisticated spying tool meant to steal a target’s most protected secrets–not just another cybercriminal keylogger designed to catch credit card numbers. “Most of the infrastructure it targets is highly contained, often without Internet access,” says Botezatu. “It’s natural for Flame to have a mechanism for moving data from one environment to another that doesn’t rely on Internet or network communications.” For additional details can be found here

-Source (Forbes)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Flame -The "Super Spy" Even On Offline Computers Turning Users into Data Mules"https://www.voiceofgreyhat.com/2012/06/flame-super-spy-even-on-offline.html</a>

Your Car At Risk, Hackers Can Attack Modern Cars Remotely

Hackers could attack modern cars without even touching them, as new car models roll off the line loaded with complex IT systems running millions of lines of software code, it's become evident that hacking a car to gain external control of it is possible. While actual cases in the field are rare, the industry is moving to secure its systems and prevent cars from becoming a major target said by Brian Jackson a security researcher. In the exclusive report he said: An unsuspecting driver opens her door and steps into her new car, placing her smartphone on the dash as it connects with the in-car infotainment system for hands-free features. Little does she know there's a Trojan virus on her phone just waiting to be connected to a car – and it executes malicious code on the vehicle's embedded software. Suddenly a hacker has the ability to track her car, unlock the doors, or even control the climate controls and speaker volume.

It sounds like a scene out of the next James Bond film, but the above scenario could be a reality today. As auto makers look to woo consumers with snazzy in-car technology features, they are also opening up personal vehicles to the underground community of hackers that have long targeted computer users. In-car IT systems such as Ford's Sync or General Motor's OnStar could be opening up exploits that allow hackers to take control of your car without even laying hands on it.

While complex in-car IT systems are so new that actual car hacking cases in the field are virtually non-existent, researchers have demonstrated it's possible. But investigations into car hacking by police may be impossible at this point because of a lack of forensics capability to detect malware. All the more reason for security vendors like McAfee, now a division of Intel Corp., to push car manufacturers to pay serious attention to security.

“It shouldn't be the responsibility of the consumers to have to secure these systems,” says Tim Fulkerson, senior director of marketing at McAfee embedded security group. “Just as manufacturers have built in seat belts and air bags, now that they're moving to software innovation, they need to bring software security into these vehicles.”

Best known for its PC antivirus software, McAfee is now working with car makers to build secure enough systems that consumers won't end up buying virus scan software for their ride. When it comes to car makers and securing IT system, Fulkerson says it “is certainly not their area of expertise.”

Perhaps that's why a team of car-hacking researchers from the University of Washington and the University of California at San Diego have had so much success. Dubbed the Center for Automotive Embedded Systems Security (CAESS), the team demonstrated in May 2010 how a criminal with physical access to a car could implant malware. Then in August 2011, the team showed an external car hacking attack could be mounted through various paths including Bluetooth and cellular radio.

One such attack was executed after the researchers reverse-engineered a car's telematics operating system and found the program responsible for handling Bluetooth functions. From there, they planted a Trojan horse (a piece of malicious software) on an HTC Dream smartphone that monitors for new Bluetooth connections and if it finds a telematics unit, sends the payload.

Researchers were also able to use special hardware to “sniff” the MAC address of the Bluetooth connection needed for pairing new devices with the telematics unit. After cracking the password through brute force, or machine-assisted repeat attempts, the Trojan could be uploaded from a device in the attacker's hands.

But seeing such an attack executed in the wild today is unlikely, according to Patrick Neal, a program coordinator for crime and intelligence analysis at the B.C. Institute of Technology (BCIT). He had his students explore car hacking methods identified by the CAESS group and others. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Your Car At Risk, Hackers Can Attack Modern Cars Remotely"https://www.voiceofgreyhat.com/2011/12/your-car-at-risk-hackers-can-attack.html</a>

Researchers Said Cars Equipped With Computers are Vulnerable to Hacking, Intel Investigating

Researchers Said Cars Equipped With Computers are Vulnerable to Hacking, Intel Investigating 

Security researchers have unveiled that cars equipped with electronic communications systems and computers are vulnerable to hacking and viruses, which could translate to crashes while on the road. According to a report of Reuters a special team employed by Intel is looking into software and hardware vulnerabilities in modern cars that could allow access to hackers to take control of vehicles. Barnaby Jack, a director of research at security consulting firm IOActive Labs, who became famous when he announced that he could make an ATM machine dispense money to anyone and to cause medical equipment to pump lethal doses of insulin to patients, is one of the members of the group.

Another research group demonstrated a simple method of infecting a car with a malware by using nothing but a CD. When the victim plays the CD,  the malware is activated and jumped from the CD to the computer system of the car. While infecting the car radio is not life threatening at all, the code executed after running the CD can gain access to other important systems of the car itself. Researchers also said that car viruses can be utilized for more subtle use. One example they mentioned was to use it to remotely listen on conversations inside the car. It’s like a Hollywood-style trick but could come in handy for use for government spying or corporate espionage. Modern automobiles are already considered “computers on wheels” by security experts and it’s only a matter of time before their vulnerabilities will be exploited widely. Today’s cars are filled with small computers known as electronic control units or ECUs that needs a very sophisticated set of codes to manage interconnected systems like brakes, engines, navigation, entertainment, and lighting. They are also employing technologies common to mobile devices such as Bluetooth headsets and cell phones, making them vulnerable to remote attacks widely known among black hats or criminal hackers.

Security experts fear that terrorists, criminals, and spies will turn their attention to embedded computers, which can be attacked using similar techniques as common computers. One particular issue for concern arises and that is how to fight the transfer of PC viruses that could affect the computers in a car when laptops and other devices are plugged into entertainment systems of cars??

-Source (The Droid Guy)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Researchers Said Cars Equipped With Computers are Vulnerable to Hacking, Intel Investigating"https://www.voiceofgreyhat.com/2012/08/Cars-Equipped-With-Computers-are-Vulnerable-to-Hacking.html</a>

Mobile Network Is Vulnerable, Hacker Can Easily Track Your Location

Mobile Network Is Vulnerable, Hacker Can Easily Track Your Location 

Researchers of University of Minnesota have found that phone towers are leaking location information that can be used to track a mobile phone's exact location. The most interesting thing is to exploit this vulnerability you need not to purchase any kind of hardware gadget only a laptop and a mobile phone is more than sufficient to do that. "Anybody can set up this particular apparatus to be able to listen to broadcast messages from the towers," Kune said. "They don't need any special cooperation from the service provider, don't need to grab any information from the service provider, don't need to connect to the network, they just have to listen to what the cell towers are broadcasting." 

Researchers plugged a mobile phone into a laptop to listen in on transmissions from phone towers. They then dialed the number of the mobile phone they hoped to locate, triggering signals from the tower to the phone that gives away its location within a dozen blocks. The process takes about 10 to 15 minutes. The same techniques could be used to track phones at greater distances if hackers have access to nearby phone towers. 

Video Demonstration :-

Shellene Johnson, program manager at the Minnesota Coalition for Battered Women, said many victims of domestic violence or stalking rely on mobile phones to find help or call police. "If victims are unaware this is happening — they may be going into a safe location or into a shelter — it gives very easy access to information of her whereabouts," Johnson said. "The tool she's using to hopefully protect herself could be used to harm or possibly kill her."
Carol Arthur, executive director of the Domestic Abuse Project, said knowledge of a person's location is another way that some abusers can maintain control over their victims. "If you have changed your address and you're trying to get away from this person... but all of a sudden they found you, it's like you feel trapped, like you'd never be able to get away from this person," Arthur said.
The university report also speculated that the vulnerability could be exploited by oppressive governments or burglars. The researchers found that they could tap into the locations of phones on T-Mobile and AT&T networks. Kune said it also likely worked on Verizon and Sprint phones, although the tests weren't run on those networks.
The research team proposed fixes to the information leakage to AT&T and phone manufacturer Nokia. Kune said that Nokia has given the researchers feedback on the viability of their fixes. AT&T has not yet responded to the research team, but AT&T spokesman Alex Carey said the company takes all reports of network vulnerabilities seriously.
"If it's something that's identified as a valid threat, we would act on it right away, devote whatever resources we need to combat the threat," Carey said. The research was presented in early February at the Annual Network & Distributed System Security Symposium in San Diego, Calif.

-Source (MPR News)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Mobile Network Is Vulnerable, Hacker Can Easily Track Your Location"https://www.voiceofgreyhat.com/2012/02/mobile-network-is-vulnerable-hacker-can.html</a>

XML Encryption Cracked By Researchers Of Ruhr University

Researchers at the Ruhr University of Bochum (RUB) say they have succeeded in cracking parts of the XML encryption used in web services, thus making it possible to decrypt encrypted data. The official W3C XML encryption specification is designed to allow the secure transmission of information between different e-commerce and financial systems. The attack is limited to where AES is used for encryption in the cipher-block chaining (CBC) mode; other techniques, such as using an RSA key and X.509 certificates, are not susceptible.

According to the researchers, IBM, Microsoft and Red Hat Linux use the standard solution in web service applications for a number of large customers. The researchers say that, based on their findings, the standard should now be considered insecure. They plan to publish details about the problem at the upcoming ACM Conference in Chicago (ACM CCS 2011).

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">XML Encryption Cracked By Researchers Of Ruhr University"https://www.voiceofgreyhat.com/2011/10/xml-encryption-cracked-by-researchers.html</a>

Quantum Encryption Will Stop Hackers -Researchers Claimed

Researchers Developing Quantum Encryption To Stop Hackers

The number of cyber-crime, hacktivism is kissing the sky, there is no doubt that hackers are constantly dominating the entire system & as expected the graph of cyber threat is rising higher & higher. To get rid of these researchers from the University of Toronto and the University of Vigo is developing quantum encryption method to foil hackers. Researchers say quantum encryption is what will finally stop hackers. University of Toronto Professor Hoi-Kwong Lo, a faculty member in The Edward S. Rogers Sr. Department of Electrical & Computer Engineering and the Department of Physics, as well as his team consisting of Senior Research Associate Dr. Bing Qi and Professor Marcos Curty of the University of Vigo, say they have found a new quantum encryption method that can trip up even the most sophisticated hackers. In an exclusive report ZDnet described- Quantum cryptography ensures that any attempt by an eavesdropper to read encoded communication data will lead to disturbances that can be detected by the legitimate user. As a result, quantum cryptography allows the transmission of an unconditionally secure encryption key between user1 and user2, even in the presence of a potential hacker, user3. The encryption key is communicated using light signals and is received using photon detectors. The encryption key in quantum cryptography isn’t some super-long password. Instead, it’s made up of light signals and photo detectors. In previous versions of the quantum key distribution (QKD) method, hackers could alter commercial QKD systems. In other words, the challenge is that user3 can intercept and manipulate the signals. Quantum hacking occurs when light signals subvert the photon detectors, causing them to only see the photons that user3 wants user2 to see.
Now, Professor Lo and his team say they have come up with a solution to the untrusted device problem: the “Measurement Device Independent QKD” method. While a potential hacker may operate the photon detectors and broadcast measurement results, the two users no longer have to trust those measurement results. Instead, they can simply verify the hacker’s honesty by measuring and comparing their own data. This works because when user3 attempts to manipulate the photons that transmit quantum data, he or she also inevitably introduces subtle changes in the data stream. In Measurement Device Independent QKD, the two users send their signals to an untrusted relay, user4, who may or may not be controlled by user3. This fourth party performs a joint measurement on the signals, providing another point of comparison.
“A surprising feature is that [user4]’s detectors can be arbitrarily flawed without compromising security,” Professor Lo said in a statement. “This is because, provided that [user1] and [user2]’s signal preparation processes are correct, they can verify whether [user3] or [user4] is trustworthy through the correlations in their own data following any interaction with [user3/user4].” A proof-of-concept measurement has already been performed. Professor Lo and his team are now developing a prototype, which they expect will be ready within five years.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Quantum Encryption Will Stop Hackers -Researchers Claimed"https://www.voiceofgreyhat.com/2012/04/quantum-encryption-will-stop-hackers.html</a>

Google Deodorizes Sniffable Android Security Flaw

A new round of patching has begun for Android phones, the vast majority of which were found to be vulnerable to hackers if the owner was using it on an open WiFi network. The flaw affected 99.7 percent of all Android smartphones running Android 2.3.3 and earlier versions because they don't use a secure HTTPS connection, according to researchers.

Google (Nasdaq: GOOG) has begun rolling out a patch to fix a security flaw in versions 2.3.3 and earlier of its Android mobile operating system.

That flaw affects all Google services using the ClientLogin authentication protocol.
It lets hackers access any personal data available through Android's application programming interfaces (APIs).
"The flaw is now fixed for all versions of Android worldwide," Google spokesperson Randall Sarafa told LinuxInsider.
The patch is being rolled out in stages over several days, Sarafa said.

The Hole in Android

The flaw gained media attention after it was publicized by the University of Ulm.
Here's how it works: When an application wants to get access to Android's APIs, it requests an authentication token through ClientLogin by providing an account name and password.
The system then returns an authorization token, which is good for up to two weeks.
If the token is used in requests sent over unencrypted networks, such as WiFi networks, hackers can steal it. They can then use the token to access any personal data made available through the service API.
The hackers will gain full access to the victim's calendar, contacts information, or private Web-based photo albums. They'll be able to view, delete, or modify any calendar events, contacts, or private pictures, the Ulm University researchers said.
The flaw affected 99.7 percent of all Android smartphones running Android 2.3.3 and earlier versions because they don't use a secure HTTPS connection, the researchers said.
Google's patch forces an HTTPS connection for calendar and contacts sync on Android, Sarafa said.

More on the Flaw

Authentication tokens are widely used for online services such as eBay (Nasdaq: EBAY). They are also used by software and application vendors such as Microsoft (Nasdaq: MSFT) and Splunk, and in Apple's (Nasdaq: AAPL) iOS mobile operating system.
There was a problem with the authentication token on Android because Google's implementation was faulty, Paul Laudanski, director of ESET's cyber threat analysis center, told LinuxInsider.
"The entry point is having an unpatched or vulnerable Android system connecting to Google services using ClientAuth over an unencrypted public WiFi network," Laudanski explained. "The correct implementation is to transmit the authorization token in a secured manner."
Google services transmit the authorization token as an open text message, which can be easily stolen.
If the technology is implemented correctly and the authorization tokens are sent securely, then even if an unencrypted WiFi network is used, the user information would appear as garbage to snoopers, Laudanski pointed out.
Google's implementation of the technology may not have been faulty in and of itself, argues Mike Paquette, chief strategy officer at Top Layer Security.
"The problem appears to be the use of the ClientLogin protocol, allowing these sniffable authentication protocols, combined with a long expiry time," Paquette told LinuxInsider. "This makes exploits practical and even likely," he added.
Android smartphone owners should stay away from heavily used public WiFi hotspots, Paquette warned. "It's likely that attackers would target areas with large numbers of users of public WiFi in order to have the greatest return," he explained.

Old Problems Refreshed

The security flaw in Android was apparently first discovered by Dan Wallach of Princeton University, who blogged about it in February.
In an experiment during his undergraduate security class, he set up a sniffer with fellow students to listen in on his Android smartphone. They used Wireshark and Mallory.
Wireshark is a network protocol analyzer for Unix and Windows. Mallory is a transparent TCP and UDP proxy. It can be used to access network streams and assess mobile Web applications, among other things.
UDP, the User Datagram Protocol, is one of the core members of the Internet Protocol (IP) Suite. It lets applications directly send messages, or datagrams, to other hosts on an IP network.
The team found that Google doesn't encrypt traffic to Google Calendar, although it properly encrypts traffic to Gmail and Google Voice. Eavesdroppers could see victims' calendar transactions and likely impersonate them on Google Calendar, Wallach found.
The University of Ulm researchers built on Wallach's research.
Android smartphone users should apply the same security precautions to their devices as they would do with their laptops, Torsten George, vice president of marketing at Agiliance, told LinuxInsider.
"Smartphones are essentially taking on the role of a regular computer," George pointed out. "Thus, they are just as vulnerable to attack by cybercriminals as regular laptop or desktop computers."
Because they lack built-in security, smartphones "open up a bigger attack surface than traditional computer devices," George added

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Google Deodorizes Sniffable Android Security Flaw"https://www.voiceofgreyhat.com/2011/05/google-deodorizes-sniffable-android.html</a>

Flashback Trojan Targeting Mac OS X in VMware Fusion

Underscoring the growing sophistication of Mac-based malware, a trojan preying on OS X users has adopted several stealth techniques since it was discovered last month.
Updates to the Flashback trojan, which gets installed by disguising itself as an Adobe Flash update, now prevent the malware from running on Macs that use VMware Fusion. Such virtual machine software is routinely used by security researchers to test the behavior of a malware sample because it's easier to delete a virtual instance when they're finished than it is to wipe the hard drive clean and reinstall the operating system.

According to MAC Security Blog:-

The latest version, Flashback.D, has gotten a bit sneakier. First, it checks to see if the user is running Mac OS X in VMware Fusion. If so, it does not execute. It does this because many malware researchers test malware in virtual machines, rather than infect full installations, as it is easier to delete them and start over with clean copies. This means that security researchers analyzing and looking for this malware need to be running regular Macs.
Next, the installer for the malware downloads the payload when running the postinstall script.

Finally, it no longer installs the easy-to-spot ~/Library/Preferences/Preferences.dylib. Instead, it installs the backdoor inside Safari, and does so in two ways. It adds information to Safari’s info.plist file, with the location of the backdoor, and it adds the actual backdoor module at /Applications/Safari.app/Contents/Resources/UnHackMeBuild.

Even if a user removes the above file (UnHackMeBuild), they need to edit Safari’s info.plist file; if not, Safari will look for the backdoor on launch, and, if it is not found, Safari will quit.

-News Source (Intego Blog, The Register)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Flashback Trojan Targeting Mac OS X in VMware Fusion"https://www.voiceofgreyhat.com/2011/10/flashback-trojan-targeting-mac-os-x-in.html</a>

Android Vulnerability- Hacker Can Gains Complete Control Into Your SmartPhone

Android Vulnerability- Hacker Can Gains Complete Control Into Your SmartPhone  

 

Security experts have discovered a serious flaw in a component of the operating system of Google Inc’s widely used Android smartphone that they say hackers can exploit to gain control of the devices. Researchers at startup cyber security firm CrowdStrike said they have figured out how to use that bug to launch attacks and take control of some Android devices.
CrowdStrike, which will demonstrate its findings next week at a major computer security conference in San Francisco, said an attacker sends an email or text message that appears to be from a trusted source, like the user’s phone carrier. The message urges the recipient to click on a link, which if done infects the device. At that point, the hacker gains complete control of the phone, enabling him or her to eavesdrop on phone calls and monitor the location of the device, said Dmitri Alperovitch, chief technology officer and co-founder of CrowdStrike.
Google spokesman Jay Nancarrow declined comment on Crowdstrike’s claim. Alperovitch said the firm conducted the research to highlight how mobile devices are increasingly vulnerable to a type of attack widely carried out against PCs. In such instances, hackers find previously unknown vulnerabilities in software, then exploit those flaws with malicious software that is delivered via tainted links or attached documents. He said smartphone users need to prepare for this type of attack, which typically cannot be identified or thwarted by mobile device security software.
“With modifications and perhaps use of different exploits, this attack will work on every smartphone device and represents the biggest security threat on those devices,” said Alperovitch, who was vice president of threat research at McAfee Inc before he co-founded CrowdStrike.
Researchers at CrowdStrike were not the first to identify such a threat, though such warnings are less common than reports of malicious applications that make their way to online websites, such as Apple’s App Store or the Android Market.
In July 2009, researchers Charlie Miller and Collin Mulliner figured out a way to attack Apple’s iPhone by sending malicious code embedded in text messages that was invisible to the phone’s user. Apple repaired the bug in the software a few weeks after the pair warned it of the problem.
The method devised by CrowdStrike currently works on devices running Android 2.2, also known as Froyo. That version is installed on about 28 percent of all Android devices, according to a Google survey conducted over two weeks ending February 1. Alperovitch said he expects to have a second version of the software finished by next week that can attack phones running Android 2.3. That version, widely known as Gingerbread, is installed on another 59 percent of all Android devices, according to Google. CrowdStrike’s method of attack makes use of a previously unpublicized security flaw in a piece of software known as webkit, which is built into the Android operating system’s Web browser.

-Source (MyBoradband, Google, CrowdStrike)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Android Vulnerability- Hacker Can Gains Complete Control Into Your SmartPhone"https://www.voiceofgreyhat.com/2012/02/android-vulnerability-hacker-can-gains.html</a>

Chinese Hackers Eavesdropping European Diplomats Before G20 Summit

Researchers At FireEye Found -Chinese Hackers Snitching  Europeans Before G20 Summit 

Story of cyber espionage by Chinese hackers used to remain one of most highest pick of breakneck. Yet again another breathtaking issue of  eavesdropping by Chinese hackers get spot light, when  California-based renounced computer security firm FireEye Inc have figured out that a group of Chinese hackers eavesdropped on the computers of five European foreign ministries before last September's G20 Summit, which was dominated by the Syrian crisis. From the detailed analysis we came to know that the hackers have infiltrated the ministries' computer networks by sending emails to staff containing tainted files with titles such as "US_military_options_in_Syria," which sells virus fighting technology to companies. Whenever the targeted recipients opened those documents, they loaded malicious code on to their personal computers. Researchers of FireEye said that they were able to monitor the "inner workings" of the main computer server used by the hackers to conduct their reconnaissance and move across compromised systems for about a week in the late August. But suddenly they lost access to the hackers after they moved to another server shortly before the G20 Summit in St. Petersburg, Russia. 

Though the company has declined in open press to identify the nations whose ministries were hacked, although it said they were all members of the European Union. But FireEye informed the FBI about the whole issue in details. FireEye also confirmed that the hackers where from China, but they did not find evidence which may link those hackers to the Chinese government. Not surprisingly and obviously like earlier the Chinese government has distanced itself from any claim that it might have hacked foreign governments for data. FireEye also successfully monitor several dozen hacking groups operating in China, most of which they suspect of having ties to the government. The firms also suspect the hacking groups of stealing intellectual property for commercial gain. The researchers had been following the hackers behind the Syria-related attack for several years, but this is the first time the group's activities have been publicly documented. The company calls the group "Ke3chang," after the name of one of the files it uses in one of its pieces of malicious software. "The theme of the attacks was U.S. military intervention in Syria," said FireEye researcher Nart Villeneuv. 

On reaction Chinese Foreign Ministry spokesman Hong Lei said- "U.S. internet companies are keen on hyping up the so-called hacker threat from China, but they never obtain irrefutable proof, and what so-called evidence they do get is widely doubted by experts. This is neither professional nor responsible," 

While talking in this story of Chinese eavesdropping, I also want to dig some points from decent parts where we all became very habituated of seeing Europe & U.S. countries blaming China for engaging cyber attacks; and China also do the same for accusing U.S. like vice versa. I am reviving your memories of last few years where If you look at the story of major cyber attacks of this year we will find that the name of China has been involved several times for engaging cyber attacks against several high profile websites and organization of U.S. including New York Times, Twitter, NBC and so on. And if you refresh our memory then then we will find the scenario of big cyber attack and espionage by Chinese hackers have been spotted several times. In 2012 Chinese hackers had  breached Telvent's corporate network & gained control of US Power Grid. Also in the middle of last year, we have seen that Chinese hackers have broken into Indian Navy's Computer System & stolen sensitive data. Few months before this hack, Tokyo based computer security firm Trend Micro confirmed that Chinese hackers were responsible for biggest cyber-espionage in India, Japan & Tibet. Also the director of National Security Agency (NSA) General Keith Alexander confirmed that hackers from China was responsible for the serious attack on one of the leading IT security & cyber security company RSA. Also in 2011 China was responsible behind the attack on US Chamber of Commerce, Satellite System of U.S, Nortel Network & so on.  But few days ago National Computer Network Emergency Response Coordination Center of China (CNCERT/CC), China's primary computer security monitoring network claimed that China fallen victim of one of biggest cyber attacks originated from US, Japan & South Korea. We must have to say that this statement is truly irrelevant. Cyber crime investigator have found that China was directly responsible for the hack into Japan's Biggest Defense Contractor Mitsubishi, Japan Aerospace Exploration Agency (JAXA) & Parliament of Japan. In case of South Korea  more than 13 Million of MapleStory players data has been stolen, there also hackers from China was responsible.  

Before I conclude, I request you to closely look at the above mentioned stories, you will find China majorly responsible for eavesdropping & security breach. On the same side China also been effected by the same way. So in conclusion, we cant put a full stop in this chain of cyber attacks, hacking & eavesdropping, as it comes from both end. So this exciting episode will be continued like it does. If you want to stay updated then don't forget to stay tuned with VOGH. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Chinese Hackers Eavesdropping European Diplomats Before G20 Summit "https://www.voiceofgreyhat.com/2013/12/china-eavesdropping-europeans-before-G20-summit.html</a>

PayPal Announced Paid “Bug Bounty” Program for Security Researchers

PayPal Announced  Paid “Bug Bounty” Program for Security Researchers

Giant in payment services provider PayPal recently announced the launch of a new paid bug bounty program where PayPal will reward security researchers who will discover vulnerabilities in its website with handsome amount of money. In the official blog PayPal's Chief Information Security Officer Michael Barrett said- "The security of our customers’ data is our number one priority" Its very obvious and clear that while enhancing more security PayPal took this step because we all know that PayPal is listed among those sites where cyber-criminals always kept their eyes. 

If you are a security researcher, and you've discovered a site or product vulnerability, please forward your details to sitesecurity@paypal.com. We also like to give you reminder that before PayPal- Facebook, Google & many other has already started this paid bug bounty program.

-:PayPal Bug Bounty Program In Details:-

• PayPal security team will determine the bounty amount and all decisions are final. 

• Bounty is awarded to the first person that discovers the previously unknown bug.

• The bug bounty program is subject to change or to cancellation at any point without notice.

• Bug bounty is valid for the following site: www.paypal.com.

• Payment is paid out through a verified PayPal account, once the bug is fixed.

• For all submissions, do not send personal information in your report and please use PayPal's PGP key to encrypt your email.

• Individuals from sanctioned countries are not allowed to participate in this program.

• eBay Inc. employees, contractors and their immediate relatives are not allowed to participate in the program.

Vulnerabilities That Are in Scope:

• XSS
• CSRF/XSRF
• SQLi
• Authentication bypass

Note: While "Logout CSRF" is a well-acknowledged issue, there are other techniques  like "cookie forcing" and "cookie bombardment" that can make it futile to defend against this attack. Also, PayPal's web sessions are relatively short lived and hence the Bug Bounty panel will not consider reports of the ability to log out users from PayPal as qualifying for the reward.

In Your Bug Submission Email, Please Include The Following:

• Your email address
• Your PayPal account (in order to receive the bounty)
• Vulnerability type (i.e., XSS, CSRF, SQLi, etc.)
• Vulnerability Scope: Domain(s), URL(s) and Parameter(s) impacted
• Steps to reproduce bug

Guidelines for Responsible Disclosure

• Share the security issue with us before making it public on message boards, mailing lists, and other forums.
• Allow us reasonable time to respond to the issue before disclosing it publicly.
• Provide full details of the security issue.

Terms for Participation :- As between eBay Inc. and the Submitter, as a condition of participation in the PayPal Bug Bounty program, the Submitter grants eBay Inc., its affiliates and customers a perpetual, irrevocable, worldwide, royalty-free and non-exclusive license to use, reproduce, adapt, modify, publish, distribute, publicly perform, create derivative work from, make, use, sell, offer for sale and import the Submission for any purpose. Submitter represents and warrants that the Submission is original to the Submitter and Submitter owns all rights, title and interest in and to the Submission. Submitter waives all other claims of any nature, including express contract, implied-in-fact contract, or quasi-contract, arising out of any disclosure of the Submission to eBay. In no event shall eBay be precluded from discussing, reviewing, developing for itself, having developed, or developing for third parties, materials which are competitive with those set forth in the Submission irrespective of their similarity to the information in the Proposal, so long as eBay complies with the terms of participation stated herein. 

For additional information click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">PayPal Announced Paid “Bug Bounty” Program for Security Researchers"https://www.voiceofgreyhat.com/2012/06/paypal-announced-paid-bug-bounty.html</a>

BBC Server Compromised! Russian Hackers Broke Into FTP & Tried to Sell Unauthorized Access

BBC Server Compromised! Russian Hackers Hacked Into FTP & Tried to Sell Unauthorized Access on The X-Mass Evening 

Earlier we have seen world renowned media houses like CNN, NBC, Fox News, Washington Post, NY Times, NDTV and so on have fallen victim to hackers and cyber criminals. Now it was the turn for world’s largest and oldest broadcaster -British Broadcasting Corporation, widely known to us as BBC. Sources revealed that cyber criminals have managed to breach the security system of BBC and secretly took over a computer server at the BBC and then launched a Christmas Day campaign to convince other cyber criminals to pay him for access to the system. The attack was first identified by a cyber security firm named Hold Security LLC, in Milwaukee that monitors underground cyber crime forums in search of stolen information. However, it is still not clear whether the hacker stole any information or data or caused any damage to the site. In conversation with press Alex Holden, founder and Chief Information Security Officer of Hold Security told -"So far Hold Security researchers have found no evidence the conversations led to a deal or that data was stolen from the BBC.” So far the identity of hacker has not been confirmed, but the firm researchers observed a notorious Russian hacker known by the monikers "HASH" and "Rev0lver," attempting to sell access to the BBC server on December 25. However, BBC's security team managed to secure the site on Saturday, claims a person close to clean up efforts. One of the BBC spokesman refused to comment on the issue, he said, “We do not comment on security issues.” On the other hand, Justin Clarke, a principal consultant for the cyber security firm Cylance, said that while "accessing that server establishes a foothold within BBC's network which may allow an attacker to pivot and gain further access to internal BBC resources.” So far Hold Security researchers have found no evidence the conversations led to a deal or that data was stolen from the BBC. But we all know that  ftp systems are typically used to manage the transfer of large data files over the Internet. That's why the chances of data breach cant not be denied at this time. For updates on this piece of news and other hot information of the cyber & tech world stay tuned with VOGH. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href="> BBC Server Compromised! Russian Hackers Broke Into FTP & Tried to Sell Unauthorized Access "https://www.voiceofgreyhat.com/2014/01/bbc-ftp-server-hacked-by-russian-hackers.html</a>

Exclusive Threat Report on Mobile Security Breach By IBM X-FORCE TEAM

The number of mobile security exploits is on track to double year over year between 2010 and 2011. “For years, observers have been wondering when malware would become a real problem for the latest generation of mobile devices,” said Tom Cross, a manager at IBM’s X-Force security research arm. “It appears that the wait is over.”
X-Force security experts research and evaluate vulnerabilities and security issues, develop assessment and countermeasure technology and educate the public about emerging web and mobile threats. In a new report on mobile and general Internet security, X-Force researchers found that the combination of new vulnerabilities and more sophisticated phone-hacking technology has led to a huge spike in the number of security exploits on mobile phones.
Add to that the fact that more people are storing more information worth stealing on their phones — including corporate information, since more smartphones and tablets are appearing in the workplace — and you have a perfect storm for criminally focused mobile hacking. The X-Force Mid-Year Trend and Risk Report, released today, is based on data gathered through IBM’s research of public vulnerability disclosures as well as the team’s monitoring and analysis of around 12 billion security events daily since the beginning of the year.
Among the report’s findings is the fact that in 2011, mobile users will experience twice the number of mobile exploit releases than last year. Much of this is due to the fact that, as X-Force researchers observed, “many mobile phone vendors do not rapidly push out security updates for their devices.”

The report urges consumers to be cautious about downloading apps that don’t come from an official app store. Third-party app stores or off-market apps are more likely than officially sanctioned apps to contain malicious (and highly monetizable) software.

Cross gives these six tips for consumers to protect themselves from the threat of a mobile attack:-

• Make sure you protect access to your phone with a password or PIN to keep intruders out if your phone is lost or stolen.

• Don’t download applications from third-party application markets.

• Make sure you install system updates as prompted.

• Back up your data on a regular basis.

• Have the ability to track your phone and remotely wipe all its data if it is stolen. You can easily find an app that will allow you to do so.

• Download and run anti-malware applications.

The X-Force team said the number of critical, non-mobile security vulnerabilities has tripled in 2011, and researchers particularly noted the practice of “whaling.” As opposed to “phishing,” a technique that casts a wide net to capture sensitive information, whaling implies that the criminal or criminals behind the attack are zeroing in on a “big fih,” a high-profile target. Phishing has lately been on the decline, but whaling, which targets those positioned in high levels of an organization with access to critical data, is on the rise.

“Although we understand how to defend against many of these attacks on a technical level, organizations don’t always have the cross-company operational practices in place to protect themselves,” said Cross.

Full commentary Report of Cross (IBM X-FORCE TEAM):-

-News Source (IBM X-Force Team & Mobile Beat)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Exclusive Threat Report on Mobile Security Breach By IBM X-FORCE TEAM"https://www.voiceofgreyhat.com/2011/09/exclusive-threat-report-on-mobile.html</a>

Auto industry taking steps against hacking

Could modern cars operating with the help of internal computers be vulnerable to hackers? Could someone tamper with your software-controlled brakes or stop the engine from afar?

The familiar problem for personal computers is being studied in automobiles as internal computer networks become as critical to vehicles as tires and engines, and as auto companies push to bring the Internet to motorists.

Two researchers demonstrated the ability last year to hack into the internal networks that operate a car’s brakes and engines. While there is no evidence that anyone has hacked into auto computer systems to compromise safety or steal vehicles, industry groups are studying the issue in hopes of getting ahead of future cyber-attacks.

“When people first started connecting their PCs to the Internet, there wasn’t any threat and then over time it manifests,” said Stefan Savage, a University of California, San Diego, computer science professor who conducted the research. “The automotive industry, I think, has the benefit of the experience of what we went through.”

As vehicles are increasingly computerized, researchers and industry officials consider it inevitable that cars will face the same vulnerabilities as PCs. Internal computer networks monitor and control everything from brakes, engines and transmissions to air bags and keyless entry functions. Wireless connections, meanwhile, are becoming more common in reporting a vehicle’s position or providing information about the car’s functions. Some auto companies are creating applications to allow users to control some features in their car with their smart phone.

In a paper presented at a computer security conference last year, Savage and Yoshi Kohno, a computer science professor at the University of Washington, described how research teams were able to “bypass rudimentary network security protections within the car” and “adversarially control a wide range of automotive functions and completely ignore driver input — including disabling the brakes, selectively braking individual wheels on demand, stopping the engine and so on.” The research team also showed how an attack could embed malicious code in a vehicle and then erase any evidence of its presence after a crash.

In a new study, they found ways to compromise security remotely, through wireless interfaces like Bluetooth, mechanics’ tools and even audio files. In one example, a modified song in a digital audio format could compromise the car’s CD player and infect other systems in the vehicle. They were also able to “obtain complete control” over the car by placing a call to the vehicle’s cell phone number and playing an audio signal that compromised the vehicle.

Other reviews have raised similar red flags. Research teams at Rutgers University and the University of South Carolina showed vulnerabilities of in-car wireless networks that operate tire pressure monitoring systems that tell motorists if their tire needs more air. From a distance of 40 meters, they bypassed security to tap into information identifying the tire and tire pressure of cars driving down the road.

The auto industry has taken notice. Jack Pokrzywa, who manages ground vehicle standards for the Society of Automotive Engineers International, said the industry formed a panel to investigate the issue and hopes to develop common standards and ways to address hacking within the next year. “The industry is certainly concerned about this,” Pokrzywa said.

“Things can be done, if there is a mindset to do this, and with all the electronic devices and the software running them, it’s kind of inevitable that someone will find a way,” Pokrzywa said. “These systems are not built with firewalls upon firewalls.”

The United States Council for Automotive Research, a group funded by Detroit’s auto companies, is also forming a task force to study the issue, said spokeswoman Susan Bairley.

Researchers say they do not want to be alarmist and note that in many cases it required coordinated efforts to bypass the security systems. Kohno said their research was the result of two years of work.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Auto industry taking steps against hacking"https://www.voiceofgreyhat.com/2011/04/auto-industry-taking-steps-against.html</a>

Java-Based Multi-platform Backdoor Targeting Windows, Mac & Linux Computers

Java-Based  Multi-platform Backdoor Targeting Windows, Mac & Linux Computers 

Security researcher at Kaspersky Lab have revealed a new java-based web vulnerability which is targeting Windows, Linux & Mac computers while installing backdoor. Mainly the whole thing is a Web-based social engineering attack that relies on malicious Java applets. According to security researchers from antivirus vendors F-Secure - the attack was detected on a compromised website in Colombia. When users visit the site, they are prompted to run a Java applet that hasn't been signed by a trusted certificate authority.

If allowed to run, the applet checks which operating system is running on the user's computer -- Windows, Mac OS X or Linux -- and drops a malicious binary file for the corresponding platform.

The JAR file checks if the user's machine is running in Windows, Mac or Linux then downloads the appropriate files for the platform. All three files for the three different platforms behave the same way. They all connect to 186.87.69.249 to get additional code to execute. The ports are 8080, 8081, and 8082 for OSX, Linux, and Windows respectively.

The files are detected as:
Trojan-Downloader:Java/GetShell.A (sha1: 4a52bb43ff4ae19816e1b97453835da3565387b7)
Backdoor:OSX/GetShell.A (sha1: b05b11bc8520e73a9d62a3dc1d5854d3b4a52cef)
Backdoor:Linux/GetShell.A (sha1: 359a996b841bc02d339279d29112fe980637bf88)
Backdoor:W32/GetShell.A (sha1: 26fcc7d3106ab231ba0ed2cba34b7611dcf5fc0a)

However, since F-Secure researchers began monitoring the attack, the remote control server hasn't pushed any additional code. It appears that the attack uses the Social Engineer Toolkit (SET), a publicly available tool designed for penetration testers, Aquino said Tuesday via email. However, the chances of this being a penetration test sanctioned by the website's owner are relatively low.

Kaspersky's researchers are in the process of analyzing the backdoor-type malware downloaded by the malicious shell code on Windows and Linux. "The Win32 backdoor is large, about 600KB; the Linux backdoor is over 1MB in size, both appear to contact very complex code which communicates encrypted with other servers."

-Source (CW & F-Secure) 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Java-Based Multi-platform Backdoor Targeting Windows, Mac & Linux Computers"https://www.voiceofgreyhat.com/2012/07/java-based-multi-platform-backdoor.html</a>

Vulnerability in Apple MacBooks Which Could ruin Batteries

One prominent security researcher has discovered a vulnerability in the batteries of Apple's MacBook line of portable computers that could allow hackers to ruin the batteries or install malware on them that could corrupt a Mac.
Charlie Miller, a renowned white-hat hacker who works for security firm Accuvant, plans to reveal and offer a fix next month for a MacBook battery vulnerability he has discovered, Forbes reports. Miller uncovered default passwords, which are used to access the microcontroller in Apple's batteries, within a firmware update from 2009 and used them to gain access to the firmware.

Apple and other laptop makers use embedded chips in their lithium ion laptop batteries to monitor its power level, stop and start charging and regulate heat.
During the course of his tests, the researcher "bricked" seven batteries, rendering them unusable by rewriting the firmware. Of more concern is the possibility that hackers could use the vulnerability to install difficult to remove malware, or, in a worst case scenario, cause the batteries to explode.

“These batteries just aren’t designed with the idea that people will mess with them,” he said. “What I’m showing is that it’s possible to use them to do something really bad.” According to him, IT few administrators would think to check the battery, providing hackers with an opportunity to hide malicious software on a battery that could repeatedly implant itself on a computer.

Miller admitted that he hasn't tried to blow up any batteries, but he did say it might be possible. "You read stories about batteries in electronic devices that blow up without any interference,” he noted. “If you have all this control, you can probably do it.”
another researcher, Barnaby Jack, who works for antivirus software maker McAfee, also looked into the battery issue a couple years ago, but said he didn't get as far as Miller did.

Miller, who is a regular winner of security contests demonstrating Mac, Safari and iPhone exploits, has notified Apple and Texas Instruments of the issue. Despite requests from several other researchers not to proceed, he plans to unveil the vulnerability, along with a fix he calls "Caulkgun," at the Black Hat security conference next month.
"Caulk Gun" will change a battery's default passwords to a random string of characters. While the fix will prevent hackers from breaking into the battery, it would also block any future firmware updates from Apple.

In spite of the battery vulnerability that he uncovered, Miller believes Mac OS X security is better than ever before. According to him, Apple engineers made few security-related changes in the jump from Leopard to Snow Leopard, but they made substantial improvements in Mac OS X 10.7 Lion, which was released on Wednesday.
"Now, they've made significant changes and it's going to be harder to exploit,” he said, as noted by The Register.
“It's a significant improvement, and the best way that I've described the level of security in Lion is that it's Windows 7, plus, plus,” said noted security consultant Dino Dai Zovi.
Apple offered security researchers, including Miller and Dai Zovi, an unprecedented early look at Lion in order to get their feedback.
According to researchers, Lion's biggest security improvement is Lion's support for Address Space Layout Randomization. ASLR randomizes the location of critical system components to reduce the risk of attack. Apple also added sandboxing security measures in Safari that will isolate potential bugs or malware. Finally, the newly revamped File Vault now allows an entire drive to be encrypted.

-News Source (Appleinsider)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Vulnerability in Apple MacBooks Which Could ruin Batteries"https://www.voiceofgreyhat.com/2011/07/vulnerability-in-apple-macbooks-which.html</a>

Researchers Found Flaws On The IPv6 Handling System Of Windows 7

Researchers have found a flaw in the way Windows 7 handles IPv6, one of the key protocols underlying the internet, saying attackers could use the vulnerability to crash PCs.
The security firm Barracuda Labs said on Tuesday that someone would have to make a targeted denial-of-service attack to exploit the vulnerability, but exploitation could cause failure in a PC's network connectivity, applications and sound system.
Microsoft has acknowledged and reported the flaw, but has said it will not patch it in a security update, because exploiting the vulnerability requires local network access.
According to Barracuda Labs researcher Thomas Unterleitner, the vulnerability lies in the way Windows 7's remote procedure call (RPC) function handles malformed DHCPv6 requests — DHCP (Dynamic Host Configuration Protocol) being the automatic configuration protocol that lets servers allocate IP addresses to clients at start-up.
DHCPv6 is part of IPv6, the new version of the internet protocol that is being slowly rolled out. 128-bit IPv6 addressing can handle a vastly greater number of connected network devices than 32-bit IPv4, which was introduced in 1981 and is now running out of address space.

Intercept DHCPv6 traffic:-

"To exploit this vulnerability, an attacker would need to intercept DHCPv6 traffic," Unterleitner wrote. "Once a DHCPv6 request has been intercepted, the corresponding reply would have to be modified to contain the malformed Domain Search List option. On reception of this malformed packet, RPC on the remote machine would fail. Exploiting this vulnerability would cause the RPC service to fail, losing any RPC-based services, as well as the potential loss of some COM functions."
Unterleitner told ZDNet UK on Wednesday that a successful attack would "crash the RPC service from the Windows operating system, and without this service Windows 'collapses' slowly — no sound, no IP and so on".
 

Barracuda Labs confirmed the DHCPv6 vulnerability on both 32-bit and 64-bit versions of Windows 7 Ultimate with Service Pack 1, and said it was "very likely" that other versions of Windows 7, and possibly earlier versions of Windows, are also affected.
After the security researchers warned Microsoft of the flaw, the company replied in late July, saying it had replicated the vulnerability. However, Microsoft said that executing a man-in-the-middle attack or establishing a rogue DHCPv6 server to exploit the flaw would require local access, so the flaw would only be fixed in the next version of Windows.
Unterleitner said an incorrectly-configured or buggy Linux DHCP server could also trigger similar effects on the client PC, but the method described by Barracuda Labs is the easiest way for a "pinpoint denial-of-service" attack to compromise a client.
ZDNet UK has asked Microsoft for comment on the vulnerability, but had received none at the time of writing.

-News Source (ZDNet)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Researchers Found Flaws On The IPv6 Handling System Of Windows 7"https://www.voiceofgreyhat.com/2011/08/researchers-found-flaws-on-ipv6.html</a>