What a massive mother-load of patches Microsoft has unleashed on this month patching more than 34 security vulnerabilities including the fairly high profile vulnerability exploited at the Pwn2Own contest earlier this year in April.

Good news as long as all the average Internet users actually use Windows Update and install the latest patches, which somehow I find extremely unlikely. It’s also good news for corporates stuck using Microsoft solutions as long as they have a good patch management solution for their network.

Microsoft on Tuesday patched at least 34 security holes in a wide range of software, including a bug in its Internet Explorer browser that fetched a researcher $10,000 at a hacker contest in April. In all, Microsoft released 10 bulletins, three of which were rated “critical” because they allowed attackers to remotely install malware on victim machines. Other affected products include Windows, Office, Internet Information Services, and SharePoint.

The IE update fixes a vulnerability that fetched Peter Vreugdenhil, a researcher with Netherlands-based Vreugdenhil Research, $10,000 during the Pwn2Own contest at the CanSecWest security conference in Vancouver. He was able to take full control of the Windows 7 machine despite protections known as DEP, or data execution prevention, and ASLR, or address space layout randomization.

It’s pretty rare there’s 3 critical vulnerabilities in one shot, but well we are talking about Microsoft aren’t we. They seem to getting their act together when it comes to patching, perhaps the pressure from Firefox fixing things so quickly is getting to them.

Even Safari is kicking their ass when it comes to fixing problems. But that’s the inherent problem with Microsoft, they have so many projects and platforms, so much spaghetti code and legacy issues it prevents them from releasing stable patches in a timely manner.

They are designed to mitigate the severity of software bugs by randomizing the memory locations of code and preventing code loaded into memory from being able to be executed. Vreugdenhil was able to bypass those protections by combining two separate vulnerabilities.

The Microsoft fixes came the day after Apple fixed almost 50 vulnerabilities in its Safari browser, including a decade-old history leak that still plagues all other browsers. Microsoft has a summary here.

Safari also unleashed a massive update this past Monday including fixing the history leak we wrote about recently.

There’s also a very details report from SANS here detailing each patch, the relevant KB article and CVE number.

June 2010 Microsoft Black Tuesday Summary

Source: The Register

Now this should be interesting, perhaps they should turn it into a hacking based reality TV show? From the description though it looks more centered around defense than offense and perhaps should be called ‘System Administrator Idol’.

Not quite so catchy though is it.

Well at least they doing something to try and nurture talent in the security arena, even if it is a little misguided.

The UK government has launched plans to find the best young hackers through a talent competition.

Would-be cyberdefenders will be rated on their abilities to thwart attacks and hack into websites. Winners will be offered courses by the respected SANS Institute and assigned mentors.

University course and work placements also form part of the putative programme, due to take its first intake late next year, The Times reports.

Hack Idol may be a catchy concept, and it’s easy to see how eccentric security minister Lord West – who famously reckons reformed naughty-boy hackers might play an important role in Britain’s cyber-defence – might get sold on the idea.

The prizes are pretty good for anyone into infosec, courses from SANS, uni courses and possible work placement.

It would be a great start to a security career for the average hacker nerd currently doing his A-Levels at college.

I guess as well as building the security industry, they are also trying to entice the more blackhat students to defect to the white side – or at least be a little more grey than black.

In addition, there’s a precedent from across the Atlantic. The UK scheme resembles the much larger US Cyber Challenge programme which is “looking for 10,000 young Americans with the skills to fill the ranks of cyber security practitioners, researchers, and warriors”.

The winner of the first US Cyber Challenge was Michael Coppola, 17, of Connecticut, who gained plaudits for breaking into the scoring system and awarding himself extra points – a move straight out of cult haxploitation flick WarGames.

Sounds like good fun, but the idea of taking the now-ubiquitous TV talent show/glorified karaoke concept and applying it to computer security to find the next Neo sounds more than a little wrong-headed.

It definitely does have some similarities to the US program, which as new as it is hasn’t really proved anything yet either.

It’s something to watch out for, we’ll have to see where it goes.

Source: The Register

For those of you who are not familiar with DShield (where have you been? under a rock?) it’s a Cooperative Network Security Community. Basically what that means is they collect firewall logs and map out the trends.

Like when there was a worm going around that bruteforced SSH2 you could see a spike in port 22 traffic, to quote the about page.

The ISC uses the DShield distributed intrusion detection system for data collection and analysis. DShield collects data about malicious activity from across the Internet. This data is cataloged and summarized and can be used to discover trends in activity, confirm widespread attacks, or assist in preparing better firewall rules.

Currently the system is tailored to process outputs of simple packet filters. As firewall systems that produce easy to parse packet filter logs are now available for most operating systems, this data can be submitted and used without much effort.

If you want to know how to submit you can find out here.

Anyway to get back to the point, with the trend for development moving towards web applications DShield has come out with a Web Honeypot project.

The overall idea is to build something like DShield (which collects firewall logs) for webapps.

The goal of the project is to collect quantitative data measuring the activity of automated or semi-automated probes against web applications. First of all, we will not just look for “attacks”. We look for “probes”. If they are malicious or not can only be determined in context.

We will not look for 0-day style or targeted attacks. Maybe we will get lucky and catch one. But in order to detect them, we would need sensors in specific networks. What we are after is more the “background noise”.

How does it work?
A: The Web Honeypot is made up of 3 elements: a client, a set of templates and a logging system. All web requests destined for the honeypot are passed to the honeypot client. The client attempts to match the specific web application requested to one of the templates installed in the honeypot. If a suitable template is found then it is sent back to the requester. If there is no template available, a default web page is returned. In both cases the specific web application request is logged and sent to a central DShield database.

Should I run this on my production environment?
A: That depends on your risk tolerance. If your organization is willing to approve it, then the program itself is designed so that it can run as a virtual host under apache. You could assign unused IP addresses to the honeypot virtual host.

Can I run this at home?
A: Several people already are. If you can forward port 80 to your honeypot machine, then it will work.
Installation:

Will the Web Honeypot work on my OS?
A: Currently the Web Honeypot works on Windows (2000 or later) and Linux OS with install packages available for: Debian, Redhat, openSUSE and Mac OSX.

Does it run on Windows/IIS/PHP?
A: It should with some minor modifications. IIS does not support the same redirection of all requests that apache does.

You can download the Web Honeypot here:

webhoneypot-alpha.tgz

Or read more here.

Secure programming is a huge issue and it’s the lack of it that causes all the problems we have with vulnerabilities and the exploits associated with them. If everywhere developers followed secure programming practices we wouldn’t have buffer overflow issues or unsanitized parameters leading to SQL Injection.

The NSA (National Security Agency), working with MITRE, SANS, and dozens of industry experts from many other organizations, has published a valuable list of the top 25 most dangerous programming errors.

I hope more companies take notice of this and train their developers properly, rather than squeezing maximum efficiency and LOC out of them – teach them to code properly and securely too!

The 2009 CWE/SANS Top 25 Most Dangerous Programming Errors is a list of the most significant programming errors that can lead to serious software vulnerabilities. They occur frequently, are often easy to find, and easy to exploit. They are dangerous because they will frequently allow attackers to completely take over the software, steal data, or prevent the software from working at all.

The list is the result of collaboration between the SANS Institute, MITRE, and many top software security experts in the US and Europe. It leverages experiences in the development of the SANS Top 20 attack vectors (http://www.sans.org/top20/) and MITRE’s Common Weakness Enumeration (CWE) (http://cwe.mitre.org/). MITRE maintains the CWE web site, with the support of the US Department of Homeland Security’s National Cyber Security Division, presenting detailed descriptions of the top 25 programming errors along with authoritative guidance for mitigating and avoiding them. The CWE site also contains data on more than 700 additional programming errors, design errors, and architecture errors that can lead to exploitable vulnerabilities.

The main goal for the Top 25 list is to stop vulnerabilities at the source by educating programmers on how to eliminate all-too-common mistakes before software is even shipped. The list will be a tool for education and awareness that will help programmers to prevent the kinds of vulnerabilities that plague the software industry. Software consumers could use the same list to help them to ask for more secure software. Finally, software managers and CIOs can use the Top 25 list as a measuring stick of progress in their efforts to secure their software.

It’s good to see such a comprehensive project being published on the Internet for free, the aim behind this is just to make more secure code. There’s no hidden commercial agenda or aim to sell services or software packages on the back of this.

If you know anyone in the development field I suggest you forward the list to them and tell them to send it to anyone involved in software development (same goes for commercial and non-commercial projects).

There’s no excuse for insecure code!

The Top 25 list was developed at the end of 2008. Approximately 40 software security experts provided feedback, including software developers, scanning tool vendors, security consultants, government representatives, and university professors. Representation was international. Several intermediate versions were created and resubmitted to the reviewers before the list was finalized. More details are provided in the Top 25 Process page

To help characterize and prioritize entries on the Top 25, a threat model was developed that identifies an attacker who has solid technical skills and is determined enough to invest some time into attacking an organization. More details are provided in Appendix B.

Weaknesses in the Top 25 were selected using two primary criteria:

• Weakness Prevalence: how often the weakness appears in software that was not developed with security integrated into the software development life cycle (SDLC).
• Consequences: the typical consequences of exploiting a weakness if it is present, such as unexpected code execution, data loss, or denial of service.

Prevalence was determined based on estimates from multiple contributors to the Top 25 list, since appropriate statistics are not readily available.

It’s assumed the attacker has some strong technical skills, is intent on data theft or theft of resources and is willing to spend an estimate 20 hours per software module. This is not realistic and in a blackhat situation you could bet they would be willing to spend much more than 20 hours.

Even if you aren’t directly involved in software development, it’s an interesting study and for people doing pen-tests/code audits and web application assessments it’s a goldmine of information to research further on.

If you get your techniques down on each of these 25 vulnerabilities you should be able to pretty much break anything open.

Source: CWE

It’s that time of the year, our annual christmas present – the Sans Top 20 Vulnerabilities for 2007.

The SANS Top 2007 list is not “cumulative.” We include only critical vulnerabilities from the past year or so. If you have not patched your systems for long time, it would be wise to patch the vulnerabilities listed in the Top 20 2006 list as well as those in the prior lists. At the end of this document, you will find a short FAQ (list of frequently asked questions) that answers questions you may have about the project and the way the list is created.

This year’s list of top risks diverges from lists in past years that focused on very specific technical vulnerabilities that could be fixed by tweaking a configuration or applying one patch. Because attackers are moving so quickly today, such point-fixes are outdated almost immediately. For that reason, this year’s list of top risks focuses more on the areas that attackers are targeting and where organizations need to enhance their security processes to ensure consistent application of technical fixes.

Read the full list here:

Sans Top 20

Forgot to post this earlier. I received this email from SANS Institute sometime in April. They seem to be having two of their training sessions in singapore in August. Those who live in Asia or anywhere near the region and are interested can look it up. SANS Institute has one of the best trainers and also very good training materials.

Dear [Insert name here],

Discounts are available for early registration, so don’t delay

Apologies for the lack of updates for the past few days, I had to go abroad for an important assessment ;)

It’s sad how people can pray on things as terrible as disasters to make a quick buck, but well we have to face the facts that they do, and will.

And as it seems, they will use anything, we’ve already seen a trojan targetting world cup fans.

For example, consider what we witnessed last year following the Katrina and Rita hurricanes that struck the southern coast of the USA. Within 24 hours of landfall, the Internet Storm Center observed a dramatic increase in fraudulent web sites aimed at good-hearted people wanting to donate to charities or relief efforts. We can predict with fairly high certainty that the same thing is going to happen again this year. We are monitoring DNS registrations and have seen several new names appear in the last few weeks with the strings “alberto”, “beryl”, “donation”, or “hurricane” in them. (Alberto and Beryl are the first two names on the list for 2006.) Are they all legitimate? Well, let’s see what happens as soon as the first storm forms and makes landfall.

People have even gone to the length of pre-registering domains for hurricanes that haven’t even HAPPENED yet, amazing eh?

We really need to focus on the so called ‘layer 8′ protection, beef up the wetware, educate and inform! The world cup will trigger all kinds of tricks, we can pretty much guarantee that, so we have to be on our guards.

In fact, one of our observant readers (thanks, George!) wrote us to say, “I work in a government research lab with a very diverse user population, including many soccer fans. The last World Cup led to a malware spike. I expect another spike this year, but with a potential for more sophisticated attacks.” So George is keeping an eye out for a potential rise in malware attacks, basing his prediction on the fact that during the World Cup many fraudsters and pranksters will likely launch specially crafted emails and set up bogus web sites designed to lure in sports fans around the world.

At least if we are ready, we can thwart the attacks before they happen in most cases, perhaps just a mass e-mail warning people will suffice.

Source: SANS