InfoSec Daily Podcast Episode 656 for April 30, 2012. Tonight's podcast is hosted by Rick Hayes, Dave Kennedy, Boris Sverdlik, Beau Woods and Karthik Rangarajan.
Announcements
GraniteSec (formerly The New England InfoSec Tweetup)
When: May 19, 2012
Where: Veasey Memorial Park, Groveland, MA
http://granitesec4.eventbrite.com
When: May 19, 2012
Where: Veasey Memorial Park, Groveland, MA
http://granitesec4.eventbrite.com
AIDE 2012
When: May 21-25, 2012
Where: MU Forensic Science Center - Huntington, West Virginia
http://www.appyide.org/
When: May 21-25, 2012
Where: MU Forensic Science Center - Huntington, West Virginia
http://www.appyide.org/
Security 504: Hacker Techniques, Exploits & Incident Handling – Matt Romanek
When: June 20 – 27, 2012
Where: Courtyard Seattle Federal Way, WA
http://www.sans.org/mentor/details.php?nid=28014
When: June 20 – 27, 2012
Where: Courtyard Seattle Federal Way, WA
http://www.sans.org/mentor/details.php?nid=28014
Social Engineering Training
When: July 21-24, 2012
Where: Black Hat Vegas
Where: Black Hat Vegas
When: August 20-24, 2012
Where: Bristol, UK
Where: Bristol, UK
When: November 12-16, 2012
Where: Columbia, MD
http://www.social-engineer.com/social-engineer-training
Where: Columbia, MD
http://www.social-engineer.com/social-engineer-training
Inside and Out of the Social-Engineer Toolkit (SET)
When: July 21 – 22, 2012
When: July 23 – 24, 2012
Where: Black Hat Vegas
http://blackhat.com/html/bh-us-12/training/courses/bh-us-12-training_social_engineer_toolkit.html
When: July 21 – 22, 2012
When: July 23 – 24, 2012
Where: Black Hat Vegas
http://blackhat.com/html/bh-us-12/training/courses/bh-us-12-training_social_engineer_toolkit.html
DerbyCon 2012 – The “Deuce” Reunion
When: September 27-30, 2012
Where: Louisville, KY
http://www.derbycon.com
When: September 27-30, 2012
Where: Louisville, KY
http://www.derbycon.com
Please consider making your Amazon purchases through our affiliate link. If you’re not familiar with the affiliate link it is locate the Affiliate Program link on the right hand side.
or simply use our QR Code Links.
Amazon:
Amazon UK:
Stories
If you are a user of the messaging software Skype, you know that you can see the location of your contacts in the Skype interface. What you probably do not know is that there is currently a way to display a Skype user’s remote and local IP address as well.
A script has been uploaded to Github that offers these options. According to the page, it can be used to lookup IP addresses of online Skype accounts, and return both the remote and the local IP of that account on a website.
This blog post reveals how the script works. It basically starts an add a Skype contact request but does not complete it. The log file will display the local and remote IP of that Skype user, even if the user is not added to the list of contacts in Skype.
The script is for instance available on this site. Just enter the user name of a Skype user, fill out the captcha, and click the search button to initiate the lookup. You will receive the user’s remote IP and port, as well as the local IP and port.
This works only if the Skype user is online at the time of the lookup, and not if the user is offline. The IP address can reveal the user’s country of origin, and maybe even the town or district. This can be done with the help of tools such as this one. Just enter a public IP address in the form, and you will receive information about the provider of the IP address.
You can also use a tool like IP on Map to display the real world location of an IP address on a map.
….
We Reported a 0-Day Vulnerability in Hotmail, which allowed hackers to reset account passwords and lock out the account's real owners. Tamper Data add-on allowed hackers to siphon off the outgoing HTTP request from the browser in real time and then modify the data. When they hit a password reset on a given email account they could fiddle the requests and input in a reset they chose.
Microsoft spokesperson confirmed the existence of the security flaw and the fix, but offered no further details: “On Friday, we addressed an incident with password reset functionality; there is no action for customers, as they are protected.”
Later Today another unknown hacker reported another similar vulnerabilities in Hotmail, Yahoo and AOL. Using same Tamper Data add-on attacker is able to Reset passwords of any account remotely. This is somewhat a critical Vulnerability ever exposed, Millions of users can effected in result.
….
Instructions on how to exploit an unpatched Oracle Database Server vulnerability in order to intercept the information exchanged between clients and databases were published by a security researcher who erroneously thought that the company had patched the flaw.
Oracle's April 2012 Critical Patch Update (CPU) advisory, published on April 17, credited security researcher Joxean Koret for a vulnerability he reported through cyberintelligence firm iSIGHT Partners.
In an email sent to the Full Disclosure mailing list on April 18, Koret revealed that the vulnerability is located in the Oracle TNS Listener, a component that routes connections from clients to Oracle database servers depending on which database they are trying to reach.
TNS Listener has a default feature, introduced in 1999, that allows clients to register a database service or database instance remotely without authentication, Koret said.
The client sends a remote registration request to the TNS Listener and defines a new service name, its IP address, the database instances under it, and other settings. The TNS Listener then starts routing all client requests that include that service name or database instance.
However, TNS Listener also allows the remote registration of a database instance or service name that is already registered, Koret said. "The TNS listener will consider this newer registered instance name a cluster instance (Oracle RAC, Real Application Clusters) or a fail over instance (Oracle Fail over)," he said.
….
British web hosting outfit UK2.NET was on the business end of a distributed denial-of-service attack last night that took down customers' websites.
The company's chief operating officer, Martin Baker, told The Register that UK2 had never seen a DDOS attack on this scale before.
"There was a botnet attack last night on our DNS servers. It was intermittent for people so they might see some sites up or down depending on when they're making the requests for pages," he explained. "We saw around 10 million apparently unique IPs attack us."
UK2 saw the peak of the attack at around midnight although customers first started seeing problems with their websites yesterday afternoon.
"We took various actions to trace this back to the IP addresses that they were attacking from so once we identified that we were able to put in mitigating activities to reduce it down and managed to get it off our network by about 3am," Baker said.
"The scale [of the attack] just took us longer than usual to mitigate," he added.
This isn't the first time UK2 has fended off a DDoS attack as the company is seen as a prospective target due to its size, Baker said. He added that customer websites might still be having problems today, but it should all be cleared up by late tonight.
"The way that DNS works is that it's cached elsewhere across the internet so it will take the time that it takes those servers to get refreshed by the internet [to totally clear up], so it could take up to 24 hours for it to refresh all the way through," he said.
Punters had, of course, taken to Twitter to express their outrage as their websites fell off the net, although not in large numbers. Some complained that UK2's service status page wasn't kept up to date.
….
Source: http://blogs.wsj.com/tech-europe/2012/04/30/religious-sites-are-worst-for-malware-report-finds
The most harmful websites in terms of risk from malware infection aren’t, as you might imagine, pornography, but rather religious sites, according to Symantec’s Internet Security Threat Report.
The average number of threats found on religious sites was 115 (mostly fake antivirus software). By contrast, pornographic sites had less than a quarter, at around 25 threats per site. Of course, the number of pornographic sites is vastly greater than religious sites.
According to Greg Day, Symantec’s security CTO for Europe, the Middle East and Africa, while trojans may seem more serious, “if you have installed fake AV you may think you are protected, when in reality you are open to all sorts of attacks.”
Reports about malware infection produced by companies that sell anti-malware software are always going to have an inherent conflict of interest. That said, Symantec’s report, the 17th, has established itself as authoritative within the industry.
Otherwise, the report confirms mostly what we already know:
-
The threat to mobile devices, almost exclusively on Android, continues to grow, although tiny compared to the PC threat. There are 403 million PC threats, and about 4,000 on mobile.
-
Targeted attacks are no longer limited to large organizations. Some 50% of such attacks target organizations with fewer than 2,500 employees, and almost 18% target companies with fewer than 250 employees.
-
Spam is down, largely due to the closure of a Russian spam network, by 20%. However, malware attacks via social networks are up.
-
The threat overall has continued to grow hugely, mainly due to the commoditization of malware. There was an 81% increase in malicious attacks compared with a year earlier. The number of unique malware variants increased to 403 million.
Mr. Day drew attention to the increased threat to small and medium enterprises from persistent attacks. “When Stuxnet was uncovered in 2010 we saw about three targeted attacks that year. We are now seeing on average 94 a day, and in December 2011 that figure was 154 a day,” he said.
He said there was a misconception that it is senior executives who were targeted. “We are seeing a lot more attacks against people in sales, or HR.” Likewise, the purpose of the attacks is changing. “They could be going for IP, customer contacts, prices and future plans. It is easier to steal than to innovate.”
….
[end]
