Microsoft Releases Patch Fixes for Windows Server and PowerPoint

Microsoft fixed bugs in the WINS name server resolution protocol and a file format vulnerability in PowerPoint for its May Patch Tuesday.

 Microsoft addressed two security bulletins in May’s Patch Tuesday release. Security experts said administrators should apply the fixes immediately—because, despite their small size, they address significant threats.

Microsoft fixed a critical vulnerability affecting Windows Server and an important bug in Microsoft Office PowerPoint, according to the Patch Tuesday advisory released May 10. Microsoft also assigned separate “exploitability” scores for newer versions of the software under the “improved” exploitability index ratings.

The team fixed a critical vulnerability (MS11-035) in the WINS component in Windows Server 2003 and 2008. WINS is a name-resolution service that resolves names in the NetBIOS namespace and does not require authentication to use. While usually not available by default in Windows Server, it is commonly used in the enterprise for internal network servers. Administrators who have enabled WINS in Windows Server should apply the patch immediately as attackers could remotely cause a denial of service, according to Wolfgang Kandek, the CTO of Qualys.

“What might make the WINS vulnerability appealing to attackers is that it is a server-side issue,” Joshua Talbot, security intelligence manager, Symantec Security Response, told eWEEK.

Unlike other threats, attackers don’t have to trick a user into doing anything since it’s just a matter of finding a vulnerable server and feeding the machine “a malicious string of data,” according to Talbot. It is also a more serious issue on Windows Server 2003 than on 2008 because Windows Server 2008 has built-in protections such as DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization). However, attackers can still create exploit code to get past those security features, Talbot said.

The other “important” bulletin (MS11-036) addressed a security flaw in all versions of Microsoft Office Power Point except Office 2010. The bug would allow attackers to take full control of the target machine as soon as the user opens a malicious PPT file.

Both WINS and PowerPoint vulnerabilities are fairly significant, according to Tyler Reguly, technical manager of security research and development at nCircle. File-format vulnerabilities are “popular exploits” but WINS is remote code execution, so it was “difficult” to decide which was the “biggest risk today.”

Microsoft listed both vulnerabilities using the new exploitability ratings. The PowerPoint bulletin was rated a “1” for a consistent exploit code likely for older software releases, but 0 for latest software because Office 2010 is not affected. The WINS patch was rated a “2” on both the latest and older versions because it affected all versions.

The updated rating system is intended to make it easier for IT administrators to determine their risk level, according to Microsoft.

“With massive updates such as we had in April, it’s easy to get overwhelmed. Microsoft’s new index simplifies the process, which will help IT administrators to prioritize which patches they tackle first,” said Dave Marcus, director of security research and communications at McAfee Labs.

The small release means administrators should “brace themselves for a larger update” in June, according to Kandek.

To complicate things for IT administrators, a fake Patch Tuesday update is making the rounds, according to security researchers at Websense Security Labs ThreatSeeker network. The malware is spread via a link inside an email message supposedly from “Microsoft Canada Co.” which informs users that Microsoft has issued a “Security Update for Microsoft Windows OS,” wrote Amon Sanniez, associate security researcher at Websense. Clicking on the link downloads the fake patch to the computer and infects the system with a Zeus Trojan variant, according to Sanniez.

It “ties in almost perfectly” with the real Patch Tuesday updates from Microsoft, Sanniez said.

The email looks quite legitimate and shows “some effort” went into the creation, as the message is presented in both English and French, and the display names within the headers actually say the mail originated from Microsoft Canada.

The malicious executable is currently not being detected by most major antivirus products tracked on VirusTotal, so IT managers should be careful that none of their staff members or users click on the link to get the security update. Websense said it is a low-volume threat, possibly aimed at a handful of companies. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Microsoft Releases Patch Fixes for Windows Server and PowerPoint"https://www.voiceofgreyhat.com/2011/05/microsoft-releases-patch-fixes-for.html</a>

Google Deodorizes Sniffable Android Security Flaw

A new round of patching has begun for Android phones, the vast majority of which were found to be vulnerable to hackers if the owner was using it on an open WiFi network. The flaw affected 99.7 percent of all Android smartphones running Android 2.3.3 and earlier versions because they don't use a secure HTTPS connection, according to researchers.

Google (Nasdaq: GOOG) has begun rolling out a patch to fix a security flaw in versions 2.3.3 and earlier of its Android mobile operating system.

That flaw affects all Google services using the ClientLogin authentication protocol.
It lets hackers access any personal data available through Android's application programming interfaces (APIs).
"The flaw is now fixed for all versions of Android worldwide," Google spokesperson Randall Sarafa told LinuxInsider.
The patch is being rolled out in stages over several days, Sarafa said.

The Hole in Android

The flaw gained media attention after it was publicized by the University of Ulm.
Here's how it works: When an application wants to get access to Android's APIs, it requests an authentication token through ClientLogin by providing an account name and password.
The system then returns an authorization token, which is good for up to two weeks.
If the token is used in requests sent over unencrypted networks, such as WiFi networks, hackers can steal it. They can then use the token to access any personal data made available through the service API.
The hackers will gain full access to the victim's calendar, contacts information, or private Web-based photo albums. They'll be able to view, delete, or modify any calendar events, contacts, or private pictures, the Ulm University researchers said.
The flaw affected 99.7 percent of all Android smartphones running Android 2.3.3 and earlier versions because they don't use a secure HTTPS connection, the researchers said.
Google's patch forces an HTTPS connection for calendar and contacts sync on Android, Sarafa said.

More on the Flaw

Authentication tokens are widely used for online services such as eBay (Nasdaq: EBAY). They are also used by software and application vendors such as Microsoft (Nasdaq: MSFT) and Splunk, and in Apple's (Nasdaq: AAPL) iOS mobile operating system.
There was a problem with the authentication token on Android because Google's implementation was faulty, Paul Laudanski, director of ESET's cyber threat analysis center, told LinuxInsider.
"The entry point is having an unpatched or vulnerable Android system connecting to Google services using ClientAuth over an unencrypted public WiFi network," Laudanski explained. "The correct implementation is to transmit the authorization token in a secured manner."
Google services transmit the authorization token as an open text message, which can be easily stolen.
If the technology is implemented correctly and the authorization tokens are sent securely, then even if an unencrypted WiFi network is used, the user information would appear as garbage to snoopers, Laudanski pointed out.
Google's implementation of the technology may not have been faulty in and of itself, argues Mike Paquette, chief strategy officer at Top Layer Security.
"The problem appears to be the use of the ClientLogin protocol, allowing these sniffable authentication protocols, combined with a long expiry time," Paquette told LinuxInsider. "This makes exploits practical and even likely," he added.
Android smartphone owners should stay away from heavily used public WiFi hotspots, Paquette warned. "It's likely that attackers would target areas with large numbers of users of public WiFi in order to have the greatest return," he explained.

Old Problems Refreshed

The security flaw in Android was apparently first discovered by Dan Wallach of Princeton University, who blogged about it in February.
In an experiment during his undergraduate security class, he set up a sniffer with fellow students to listen in on his Android smartphone. They used Wireshark and Mallory.
Wireshark is a network protocol analyzer for Unix and Windows. Mallory is a transparent TCP and UDP proxy. It can be used to access network streams and assess mobile Web applications, among other things.
UDP, the User Datagram Protocol, is one of the core members of the Internet Protocol (IP) Suite. It lets applications directly send messages, or datagrams, to other hosts on an IP network.
The team found that Google doesn't encrypt traffic to Google Calendar, although it properly encrypts traffic to Gmail and Google Voice. Eavesdroppers could see victims' calendar transactions and likely impersonate them on Google Calendar, Wallach found.
The University of Ulm researchers built on Wallach's research.
Android smartphone users should apply the same security precautions to their devices as they would do with their laptops, Torsten George, vice president of marketing at Agiliance, told LinuxInsider.
"Smartphones are essentially taking on the role of a regular computer," George pointed out. "Thus, they are just as vulnerable to attack by cybercriminals as regular laptop or desktop computers."
Because they lack built-in security, smartphones "open up a bigger attack surface than traditional computer devices," George added

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Google Deodorizes Sniffable Android Security Flaw"https://www.voiceofgreyhat.com/2011/05/google-deodorizes-sniffable-android.html</a>

Washington D.C. Online Voting System Hacked in Less Than 48 hrs

Washington D.C. Online Voting System Hacked By Researchers Of Michigan University in Less Than 48 hrs

The security functions of a pilot project for online voting in Washington D.C. compromised. Researchers at the University of Michigan have reported that it took them only a short time to crack the security of the whole function. "Within 48 hours of the system going live, we had gained near complete control of the election server", the researchers wrote in a paper that has now been released. "We successfully changed every vote and revealed almost every secret ballot." - Said the researchers.

The hack was only discovered after about two business days – and most likely only because the intruders left a visible trail on purpose. In 2010, the developers of the municipal e-voting system that enables voters living abroad to vote via a web site, invited security experts to conduct tests. The university researchers say that the project was developed in cooperation with the Open Source Digital Voting Foundation (OSDV) and that other US states have also worked on services similar to Washington's "Digital Vote-by-Mail Service". They also praise the system's transparency as exemplary but point out that its architecture has fundamental security weaknesses and was not able to withstand a shell injection and other common hacker techniques. The security experts investigated common vulnerable points such as login fields, the virtual ballots' content and filenames, and session cookies – and found several exploitable weaknesses. Even the Linux kernel used in the project proved to have a well known vulnerability.

  

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Washington D.C. Online Voting System Hacked in Less Than 48 hrs"https://www.voiceofgreyhat.com/2012/03/washington-dc-online-voting-system.html</a>

Your Car At Risk, Hackers Can Attack Modern Cars Remotely

Hackers could attack modern cars without even touching them, as new car models roll off the line loaded with complex IT systems running millions of lines of software code, it's become evident that hacking a car to gain external control of it is possible. While actual cases in the field are rare, the industry is moving to secure its systems and prevent cars from becoming a major target said by Brian Jackson a security researcher. In the exclusive report he said: An unsuspecting driver opens her door and steps into her new car, placing her smartphone on the dash as it connects with the in-car infotainment system for hands-free features. Little does she know there's a Trojan virus on her phone just waiting to be connected to a car – and it executes malicious code on the vehicle's embedded software. Suddenly a hacker has the ability to track her car, unlock the doors, or even control the climate controls and speaker volume.

It sounds like a scene out of the next James Bond film, but the above scenario could be a reality today. As auto makers look to woo consumers with snazzy in-car technology features, they are also opening up personal vehicles to the underground community of hackers that have long targeted computer users. In-car IT systems such as Ford's Sync or General Motor's OnStar could be opening up exploits that allow hackers to take control of your car without even laying hands on it.

While complex in-car IT systems are so new that actual car hacking cases in the field are virtually non-existent, researchers have demonstrated it's possible. But investigations into car hacking by police may be impossible at this point because of a lack of forensics capability to detect malware. All the more reason for security vendors like McAfee, now a division of Intel Corp., to push car manufacturers to pay serious attention to security.

“It shouldn't be the responsibility of the consumers to have to secure these systems,” says Tim Fulkerson, senior director of marketing at McAfee embedded security group. “Just as manufacturers have built in seat belts and air bags, now that they're moving to software innovation, they need to bring software security into these vehicles.”

Best known for its PC antivirus software, McAfee is now working with car makers to build secure enough systems that consumers won't end up buying virus scan software for their ride. When it comes to car makers and securing IT system, Fulkerson says it “is certainly not their area of expertise.”

Perhaps that's why a team of car-hacking researchers from the University of Washington and the University of California at San Diego have had so much success. Dubbed the Center for Automotive Embedded Systems Security (CAESS), the team demonstrated in May 2010 how a criminal with physical access to a car could implant malware. Then in August 2011, the team showed an external car hacking attack could be mounted through various paths including Bluetooth and cellular radio.

One such attack was executed after the researchers reverse-engineered a car's telematics operating system and found the program responsible for handling Bluetooth functions. From there, they planted a Trojan horse (a piece of malicious software) on an HTC Dream smartphone that monitors for new Bluetooth connections and if it finds a telematics unit, sends the payload.

Researchers were also able to use special hardware to “sniff” the MAC address of the Bluetooth connection needed for pairing new devices with the telematics unit. After cracking the password through brute force, or machine-assisted repeat attempts, the Trojan could be uploaded from a device in the attacker's hands.

But seeing such an attack executed in the wild today is unlikely, according to Patrick Neal, a program coordinator for crime and intelligence analysis at the B.C. Institute of Technology (BCIT). He had his students explore car hacking methods identified by the CAESS group and others. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Your Car At Risk, Hackers Can Attack Modern Cars Remotely"https://www.voiceofgreyhat.com/2011/12/your-car-at-risk-hackers-can-attack.html</a>

Researchers Said Cars Equipped With Computers are Vulnerable to Hacking, Intel Investigating

Researchers Said Cars Equipped With Computers are Vulnerable to Hacking, Intel Investigating 

Security researchers have unveiled that cars equipped with electronic communications systems and computers are vulnerable to hacking and viruses, which could translate to crashes while on the road. According to a report of Reuters a special team employed by Intel is looking into software and hardware vulnerabilities in modern cars that could allow access to hackers to take control of vehicles. Barnaby Jack, a director of research at security consulting firm IOActive Labs, who became famous when he announced that he could make an ATM machine dispense money to anyone and to cause medical equipment to pump lethal doses of insulin to patients, is one of the members of the group.

Another research group demonstrated a simple method of infecting a car with a malware by using nothing but a CD. When the victim plays the CD,  the malware is activated and jumped from the CD to the computer system of the car. While infecting the car radio is not life threatening at all, the code executed after running the CD can gain access to other important systems of the car itself. Researchers also said that car viruses can be utilized for more subtle use. One example they mentioned was to use it to remotely listen on conversations inside the car. It’s like a Hollywood-style trick but could come in handy for use for government spying or corporate espionage. Modern automobiles are already considered “computers on wheels” by security experts and it’s only a matter of time before their vulnerabilities will be exploited widely. Today’s cars are filled with small computers known as electronic control units or ECUs that needs a very sophisticated set of codes to manage interconnected systems like brakes, engines, navigation, entertainment, and lighting. They are also employing technologies common to mobile devices such as Bluetooth headsets and cell phones, making them vulnerable to remote attacks widely known among black hats or criminal hackers.

Security experts fear that terrorists, criminals, and spies will turn their attention to embedded computers, which can be attacked using similar techniques as common computers. One particular issue for concern arises and that is how to fight the transfer of PC viruses that could affect the computers in a car when laptops and other devices are plugged into entertainment systems of cars??

-Source (The Droid Guy)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Researchers Said Cars Equipped With Computers are Vulnerable to Hacking, Intel Investigating"https://www.voiceofgreyhat.com/2012/08/Cars-Equipped-With-Computers-are-Vulnerable-to-Hacking.html</a>

Flashback Trojan Targeting Mac OS X in VMware Fusion

Underscoring the growing sophistication of Mac-based malware, a trojan preying on OS X users has adopted several stealth techniques since it was discovered last month.
Updates to the Flashback trojan, which gets installed by disguising itself as an Adobe Flash update, now prevent the malware from running on Macs that use VMware Fusion. Such virtual machine software is routinely used by security researchers to test the behavior of a malware sample because it's easier to delete a virtual instance when they're finished than it is to wipe the hard drive clean and reinstall the operating system.

According to MAC Security Blog:-

The latest version, Flashback.D, has gotten a bit sneakier. First, it checks to see if the user is running Mac OS X in VMware Fusion. If so, it does not execute. It does this because many malware researchers test malware in virtual machines, rather than infect full installations, as it is easier to delete them and start over with clean copies. This means that security researchers analyzing and looking for this malware need to be running regular Macs.
Next, the installer for the malware downloads the payload when running the postinstall script.

Finally, it no longer installs the easy-to-spot ~/Library/Preferences/Preferences.dylib. Instead, it installs the backdoor inside Safari, and does so in two ways. It adds information to Safari’s info.plist file, with the location of the backdoor, and it adds the actual backdoor module at /Applications/Safari.app/Contents/Resources/UnHackMeBuild.

Even if a user removes the above file (UnHackMeBuild), they need to edit Safari’s info.plist file; if not, Safari will look for the backdoor on launch, and, if it is not found, Safari will quit.

-News Source (Intego Blog, The Register)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Flashback Trojan Targeting Mac OS X in VMware Fusion"https://www.voiceofgreyhat.com/2011/10/flashback-trojan-targeting-mac-os-x-in.html</a>

Google engineers deny Chrome hack exploited browser's code

Several Google security engineers have countered claims that a French security company found a vulnerability in Chrome that could let attackers hijack Windows PCs running the company's browser.

Several Google security engineers have countered claims that a French security company found a vulnerability in Chrome that could let attackers hijack Windows PCs running the company's browser.

Instead, those engineers said the bug Vupen exploited to hack Chrome was in Adobe's Flash, which Google has bundled with the browser for over a year.

Google's official position, however, has not changed since Monday, when Vupen announced it had successfully hacked Chrome by sidestepping not only the browser's built-in "sandbox" but also by evading Windows 7's integrated anti-exploit technologies.

"The investigation is ongoing because Vupen is not sharing any details with us," a Google spokesman said today via email.

But others who work for Google were certain that at least one of the flaws Vupen exploited was in Flash's code, not Chrome's.

"As usual, security journalists don't bother to fact check," said Tavis Ormandy, a Google security engineer, in atweet earlier today . "Vupen misunderstood how sandboxing worked in Chrome, and only had a Flash bug."

"It's a legit pwn, but if it requires Flash, it's not a Chrome pwn," tweeted Chris Evans, a Google security engineer and Chrome team lead, using the security-speak term for compromising an application or computer.

Justin Schuh, whose LinkedIn account also identifies him as a Google security engineer, chimed in with , "No one is saying it's not a legit exploit. The point is that it's not the exploit [Vupen] claimed."

When asked to confirm the source of the vulnerabilities it exploited, Vupen was blunt in its refusal to share any information.

"We will not help Google in finding the vulnerabilities," said Chaouki Bekrar, Vupen's CEO and head of research, in an email reply to questions. "Nobody knows how we bypassed Google Chrome's sandbox except us and our customers, and any claim is a pure speculation."

Last year, Vupen changed its vulnerability disclosure policies when it announced it would no longer report bugs to vendors -- as do many researchers -- but instead would reveal its work only to paying customers.

Today's Twitter back-and-forth between Google's engineers and Bekrar grew heated at times.

"When it comes to critical vulnerabilities, all software vendors/devs (including Google) always try to downplay the findings," Bekrar said on Twitter .

"I was thinking something similar about researchers who inflate their accomplishments," Schuh replied , also on Twitter, to Bekrar.

The point made by Ormandy, Evans and Schuh was that Vupen didn't exploit a bug in Chrome's own code, but in Flash, which has been partially sandboxed in the stable version of the browser since early March 2011 .

While the Google engineers seemed to acknowledge that a bug in Flash was involved in Vupen's exploit, they also defended the sandbox technology -- meant to isolate Flash from the rest of the computer -- even as it apparently failed to prevent an attack.

"The Flash sandbox blog post went to pains to call it an initial step," said Evans. "It protects some stuff, more to come. Flash sandbox [does not equal] Chrome sandbox."

The blog Evans referred to was published in December 2010 , where Schuh and another Google developer, Carlos Pizano said, "While we've laid a tremendous amount of groundwork in this initial sandbox, there's still more work to be done."

Chrome's Flash sandbox is currently available only in the Windows version of the browser; Google has promised to implement it in the Mac and Linux editions, but has not yet done so.

While Bekrar later hinted that Vupen's exploit did leverage a Flash vulnerability, he said the attack code also took advantage of at least one other bug. "[Chrome's] built-in plug-ins such as Flash are launched inside the sandbox which was created by Google, so finding and exploiting a Flash or a WebKit vulnerability will fall inside the sandboxes and will not circumvent it," he wrote. "A sandbox bypass exploit is still required."

Chrome has a reputation as a secure browser, in large part because of its sandbox technology. Chrome is the only browser to have escaped unscathed at the last three Pwn2Own hacking contests, the annual challenge hosted by the CanSecWest conference in Vancouver, British Columbia, and sponsored by HP TippingPoint's bug bounty program.

In March 2011, no one took on Chrome at Pwn2Own, even though Google had offered a $20,000 prize to the first researcher who hacked the browser and its sandbox.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Google engineers deny Chrome hack exploited browser's code"https://www.voiceofgreyhat.com/2011/05/google-engineers-deny-chrome-hack.html</a>

Next Generation Mobile Security Solution For Android By Trend Micro Mobile Security

Trend Micro, Inc. (tyo:4704) a global cloud security leader and long-time innovator in mobile security, today announced the latest addition to Trend Micro's Mobile arsenal, Trend Micro(TM) Mobile Security Personal Edition, a solution designed to protect both Android smartphones and tablets that includes a free app scanner, lost device protection and enhanced security to block threats while surfing the Web, calling or texting.
In January 2011, Trend Micro introduced Trend Micro(TM) Mobile Security for Android(TM) during CES in Las Vegas, NV. Early features included:

• Safe surfing

• Parental controls

• Download protection

• Call and text filtering

As Android devices gain in popularity so does its use from cybercriminals. Trend Micro's threat researchers have tracked new threats targeting Android devices growing at 800% since February 2011. In this version, which also follows the release of Trend Micro's Enterprise solution, Trend Micro Mobile Security 7, a consumer's mobile devices will be better protected based on the new data that has been discovered over the last six months. New and enhanced features include:
New App Scanner: Designed to block infected apps from installing and stealing your personal information
New Lost Device Protection: From a personal online portal, you can locate a lost device, trigger an alarm, remotely lock it or even wipe it clean to protect your personal information.
Enhanced Surf, Call, and Text Security: Designed to block online threats like banking scams, blocks unwanted calls and text messages and designed to block inappropriate websites to protect your children. "We believe mobile users need to be protected against malicious applications. To help protect as many people as possible and stifle criminal attempts to steal personal and financial information we are offering our anti-malware scanner for free." said Carol Carpenter, General Manager, Consumer Business at Trend Micro.
Additional enhancements offer a secure Web-based portal that enables users to remotely find a lost device on a Google map and set off an alarm, even if the device is set to silent. If the device can't be found it can be locked from the portal and if all else fails the user can wipe the contents by triggering a factory reset. As a safeguard, if the SIM card is removed the device is also automatically locked. The Web-based portal provides an easy user experience for those who may be in a state of panic over the whereabouts of their device. They just need to remember http://www.TrendMicro.com/ilostmyandroid .
With the sheer amount of personal information now being stored and transacted via these devices it is imperative that misplaced devices be recoverable or the sensitive information deleted. Not only do these devices allow a 3rd party to run up phone and data bills, but they could potentially grant access to online banking, social networking and in some cases even provide access to home automation systems including doors and alarms.
"With over 200,000 devices currently protected with prior or Beta versions of the solution, and Trend Micro's history of protecting mobile platforms since the middle of last decade. We are confident in our ability to provide a range of solutions that enable people to live out their digital lives in a safe and secure fashion." concluded Ms Carpenter.
Trend Micro Mobile Security Personal Edition also gives users the ability to protect their web surfing, calls and texts. Leveraging the power of the Trend Micro(TM) Smart Protection Network infrastructure, which blocks over 5 billion threats daily, all websites visited on the device browser are checked against the same reputation databases that protect Trend Micro's global customer base. Parents can set web surfing policies to block inappropriate content. And calls and text message scan be blocked to avoid time wasting, costly and unwanted contact. Trend Micro Mobile Security Personal Edition is available via the Android Market and major retail stores. While the app scanner is free, the premium services, including Lost Device Protection and Surf, Call, Text Security are available for USD$29.99 for a 1 year license.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Next Generation Mobile Security Solution For Android By Trend Micro Mobile Security"https://www.voiceofgreyhat.com/2011/09/next-generation-mobile-security.html</a>

DHS & US-CERT Recommended to Disable Java in Web Browsers

DHS & US-CERT Recommended to Disable Java in Web Browsers Unless It's Absolutely Necessary

The running time is proving to be the worst period for Java, as it has been walking under serious security issues. Yet again security researchers have pointed out a zero-day security vulnerability in the Java program that hackers are exploiting. The exploit takes advantage of a vulnerability left open in Java 7 Update 10, released in October last year. It works by getting Java users to visit a website with malicious code that takes advantage of a security gap to take control of users' computers. Thus how Java is being used by cyber criminals to infect computers with malware. Oracle, hasn't specified the number of users who have downloaded Java 7 Update 10. However, Java runs on more than 850 million computers and other devices. When Oracle released Update 10, so it is predictable that more than 850 million devices run by Java is under threat. The exploit was first discovered by French researcher Kafeine, who claimed to have found it running on a site registering hundreds of thousands of page views daily. From that site, immediately that vulnerability and a large number of effected devices has been spotted in the wild. In Java 7 Update 10 the creator of Java, Oracle added several security control and fixed older bugs and promised more security enhancement, but its very unfortunate that Oracle failed to keep their promise. What ever after this newly discovered 0-day hole spotted wildly, Oracle Security Alert CVE-2013-0422 states that Java 7 Update 11 addresses this (CVE-2013-0422) and an equally severe, but distinct vulnerability (CVE-2012-3174). Immunity has indicated that only the reflection vulnerability has been fixed and that the JMX MBean vulnerability remains. Java 7u11 sets the default Java security settings to "High" so that users will be prompted before running unsigned or self-signed Java applets. It "strongly recommends" that Java SE 7 users upgrade immediately to avoid all kind of security hazards. 

After seeing all the drama, many of you have failed to keep trust in Java, and you all will be relieved when you will gone through the security advisory of CERT (Computer Emergency Response Team) where they have clearly instructed to disable Java in your popular web-browser. In their official release CERT said "Unless it is absolutely necessary to run Java in web browsers, disable it as described below, even after updating to 7u11. This will help mitigate other Java vulnerabilities that may be discovered in the future."

You will see similar advice in the advisory posted on the official DHS US-CERT website where DHS also suggested to disable Java until and unless it is that much necessary. "To defend against this and future Java vulnerabilities, consider disabling Java in web browsers until adequate updates are available. As with any software, unnecessary features should be disabled or removed as appropriate for your environment." - said U.S. CERT in their advisory. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">DHS & US-CERT Recommended to Disable Java in Web Browsers"https://www.voiceofgreyhat.com/2013/01/DHS-US-CERT-Recommended-to-Disable-Java.html</a>

Chinese Hackers Eavesdropping European Diplomats Before G20 Summit

Researchers At FireEye Found -Chinese Hackers Snitching  Europeans Before G20 Summit 

Story of cyber espionage by Chinese hackers used to remain one of most highest pick of breakneck. Yet again another breathtaking issue of  eavesdropping by Chinese hackers get spot light, when  California-based renounced computer security firm FireEye Inc have figured out that a group of Chinese hackers eavesdropped on the computers of five European foreign ministries before last September's G20 Summit, which was dominated by the Syrian crisis. From the detailed analysis we came to know that the hackers have infiltrated the ministries' computer networks by sending emails to staff containing tainted files with titles such as "US_military_options_in_Syria," which sells virus fighting technology to companies. Whenever the targeted recipients opened those documents, they loaded malicious code on to their personal computers. Researchers of FireEye said that they were able to monitor the "inner workings" of the main computer server used by the hackers to conduct their reconnaissance and move across compromised systems for about a week in the late August. But suddenly they lost access to the hackers after they moved to another server shortly before the G20 Summit in St. Petersburg, Russia. 

Though the company has declined in open press to identify the nations whose ministries were hacked, although it said they were all members of the European Union. But FireEye informed the FBI about the whole issue in details. FireEye also confirmed that the hackers where from China, but they did not find evidence which may link those hackers to the Chinese government. Not surprisingly and obviously like earlier the Chinese government has distanced itself from any claim that it might have hacked foreign governments for data. FireEye also successfully monitor several dozen hacking groups operating in China, most of which they suspect of having ties to the government. The firms also suspect the hacking groups of stealing intellectual property for commercial gain. The researchers had been following the hackers behind the Syria-related attack for several years, but this is the first time the group's activities have been publicly documented. The company calls the group "Ke3chang," after the name of one of the files it uses in one of its pieces of malicious software. "The theme of the attacks was U.S. military intervention in Syria," said FireEye researcher Nart Villeneuv. 

On reaction Chinese Foreign Ministry spokesman Hong Lei said- "U.S. internet companies are keen on hyping up the so-called hacker threat from China, but they never obtain irrefutable proof, and what so-called evidence they do get is widely doubted by experts. This is neither professional nor responsible," 

While talking in this story of Chinese eavesdropping, I also want to dig some points from decent parts where we all became very habituated of seeing Europe & U.S. countries blaming China for engaging cyber attacks; and China also do the same for accusing U.S. like vice versa. I am reviving your memories of last few years where If you look at the story of major cyber attacks of this year we will find that the name of China has been involved several times for engaging cyber attacks against several high profile websites and organization of U.S. including New York Times, Twitter, NBC and so on. And if you refresh our memory then then we will find the scenario of big cyber attack and espionage by Chinese hackers have been spotted several times. In 2012 Chinese hackers had  breached Telvent's corporate network & gained control of US Power Grid. Also in the middle of last year, we have seen that Chinese hackers have broken into Indian Navy's Computer System & stolen sensitive data. Few months before this hack, Tokyo based computer security firm Trend Micro confirmed that Chinese hackers were responsible for biggest cyber-espionage in India, Japan & Tibet. Also the director of National Security Agency (NSA) General Keith Alexander confirmed that hackers from China was responsible for the serious attack on one of the leading IT security & cyber security company RSA. Also in 2011 China was responsible behind the attack on US Chamber of Commerce, Satellite System of U.S, Nortel Network & so on.  But few days ago National Computer Network Emergency Response Coordination Center of China (CNCERT/CC), China's primary computer security monitoring network claimed that China fallen victim of one of biggest cyber attacks originated from US, Japan & South Korea. We must have to say that this statement is truly irrelevant. Cyber crime investigator have found that China was directly responsible for the hack into Japan's Biggest Defense Contractor Mitsubishi, Japan Aerospace Exploration Agency (JAXA) & Parliament of Japan. In case of South Korea  more than 13 Million of MapleStory players data has been stolen, there also hackers from China was responsible.  

Before I conclude, I request you to closely look at the above mentioned stories, you will find China majorly responsible for eavesdropping & security breach. On the same side China also been effected by the same way. So in conclusion, we cant put a full stop in this chain of cyber attacks, hacking & eavesdropping, as it comes from both end. So this exciting episode will be continued like it does. If you want to stay updated then don't forget to stay tuned with VOGH. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Chinese Hackers Eavesdropping European Diplomats Before G20 Summit "https://www.voiceofgreyhat.com/2013/12/china-eavesdropping-europeans-before-G20-summit.html</a>

Two Young Researchers Found Vulnerability in Microsoft Windows Live Which Could Lead ID-Theft

Two Young Researchers Found Security Flaws in Microsoft Windows Live Which Could Lead Identity Theft

Recently two young security researchers of Morocco named Abdeljalil S'hit and Yasser Aboukir discovered a serious vulnerability in Microsoft's Windows Live service. The vulnerability has been reported to Microsoft, but unfortunately the software giant neither gave compastion nor  did any comment about the said topic. In a report ZDNet said the vulnerability in question leveraged Cross-Site Scripting (XSS) to execute a malicious script. 

More specifically, the two researchers managed to cause an error on the Windows Live login page (as you can see above), and once the victim clicked on the "Continue" button, their malicious script would be executed. XSS flaw means that an attacker could impersonate a Windows Live user by gaining full control of the victim's cookies. Combined with social engineering, this technique could be used to steal a victim's Windows Live identity with ease. 

The last update we got from Microsoft is saying - "We quickly addressed the vulnerability in question to help keep customers protected and appreciate the researchers using Coordinated Vulnerability Disclosure to assist in us working toward a fix in a coordinated manner"

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Two Young Researchers Found Vulnerability in Microsoft Windows Live Which Could Lead ID-Theft"https://www.voiceofgreyhat.com/2012/07/two-young-researchers-found.html</a>

Android Browser Injection Vulnerability Found By IBM Researchers

Researchers with IBM have discovered what could be a very serious flaw in the Android operating system. The flaw is billed as allowing hackers to intercept web browser operations by injecting JavaScript code into the system.
According to Roee Hay and Yair Amit of IBM's Rational Application Security Research Group, this means that a malicious, non-privileged application could break into the browser URL loading process and its allied sandbox to inject JavaScript.
This is potentially very serious, Infosecurity notes, as the sandbox element of the browser environment seen on Android is supposed to defend the smartphone/tablet platform against this type of attack.

The researchers note that the vulnerability "has the same implications as global XSS, albeit from an installed application rather than another website."
The IBM security researchers go on to say that Android 2.3.5 and 3.2 have been released and which incorporate a fix for this bug.
Patches are also available for Android 2.2 and will, they note, be released at a later date.

The Researchers have also posted a video about this vulnerability:-

For more information Click Here

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Android Browser Injection Vulnerability Found By IBM Researchers"https://www.voiceofgreyhat.com/2011/08/android-browser-injection-vulnerability.html</a>

SpyEye is Becoming A Big Threat For Cyber Security

SpyEye, a potentially dangerous hacking tool, has become widely available for anyone to buy, giving rise to concerns about the threat posed by cyber attacks.
According to an article on USA Today, security researchers have predicted a large rise in the number of attacks orchestrated using SpyEye for the rest of the year.
The toolkit, which is far more dangerous and sophisticated than ZeuS, was previously used by a group of elite hackers and was sold for as much as $10,000.
However, after a group of French security researchers managed to crack the toolkit’s activation key, its entire source code has been laid bare for hackers to replicate and sell for as low as $95, making it available for virtual anyone with malicious intent. "SpyEye is very dynamic and versatile," Amit Klein, chief technical officer of Trusteer warns.

“Every level of criminal, from the lowest to the highest rungs, can now use one of the deadliest Swiss Army knife hacking toolkits in the world,"  Sean Bodmer, senior threat intelligence analyst at network security firm Damballa, told USA Today.

Ever since the toolkit was released online, 14 cyber gangs have taken advantage of it, sending commands to thousands of botnet PCs in the United States.

-News Source (ITPro Portal)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">SpyEye is Becoming A Big Threat For Cyber Security"https://www.voiceofgreyhat.com/2011/08/spyeye-is-becoming-big-threat-for-cyber.html</a>

FBI says it is "reviewing" PSN security breach

The Federal Bureau of Investigation (FBI) is currently "reviewing" a recent security breach that compromised user data and downed the PlayStation Network (PSN) for over a week.

"The FBI is aware of the reports concerning the alleged intrusion into the Sony on line game server and we have been in contact with Sony concerning this matter," special agent Darrell Foxworth told Kotaku.

"We are presently reviewing the available information in an effort to determine the facts and circumstances concerning this alleged criminal activity."

Meanwhile, at least two dozen state AG's have kicked off their own investigation of the incident, with the FTC confirming it could theoretically claim jurisdiction in a case that involved loss of customer data via a securitybreach. 



"The fact that sensitive information was apparently accessed without authorization makes me especially concerned about the possibility of financial fraud and targeted phishing scams," Connecticut Attorney General George Jepsen wrote in an official letter to SCE CEO Jack Tretton.

"What is more troubling is Sony's apparent failure to promptly and adequately notify affected individuals of this large-scale breach."

As expected, a number of other countries aside from the United States have expressed concern over the embarrassing and damaging security lapse.

For example, the city of Taipei (Taiwan) is apparently demanding that Sony provide satisfactory details about the leak within 10 days or face heavy fines for alleged breaches of local consumer protection laws. 

"Manufacturers and service providers should take responsibility for their customers' reasonable expectations of security, including personal information security," Taiwan capital's Law and Regulation Commission said in a letter obtained by PC World.

"This incident [is said to] involve leaks of consumer names, e-mails, birth dates and even credit card information."



Indeed, security researchers say stolen credit card information may already be up for sale on various Internet forums.

"The hackers that hacked PSN are selling off the DB. They reportedly have 2.2 million credits cards with CVVs," Trend Micro security expert Kevin Stevens claimed in a tweet.

"Supposedly the hackers selling the DB says it has: fname, lnam, address, zip, country, phone, email, password, dob, ccnum, CVV2, exp date... It is not a rumor, it was a conversation on a criminal forum. [Still], I never saw the DB so I can't verify if it is real."

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">FBI says it is "reviewing" PSN security breach"https://www.voiceofgreyhat.com/2011/04/fbi-says-it-is-reviewing-psn-security.html</a>