Cybercriminals add new exploit for recently patched Java vulnerability to their arsenal

IDG News Service - Cybercriminals were quick to integrate a newly released exploit for a Java vulnerability patched in June into a tool used to launch mass attacks against users, an independent malware researcher warned.

Java vulnerability

The exploit targets a critical vulnerability identified as CVE-2013-2465 that affects all Java versions older than Java 7 Update 25 and can enable remote code execution. The vulnerability was patched by Oracle in its June Critical Patch Update for Java.

The exploit was released Monday by security research group Packet Storm Security, which originally acquired it through its bug bounty program as a zero-day exploit -- an exploit for an unpatched vulnerability -- from a researcher whose name was not disclosed. Packet Storm publishes the exploits it acquires 60 days after it receives them, with permission from their authors, so other security professionals can use them to perform penetration tests and security risk assessments.

Two days after its release, the CVE-2013-2465 exploit was already integrated into so-called exploit kits, attack tools that infect computers with malware by exploiting vulnerabilities in outdated software when users visit compromised websites.

An independent malware researcher who uses the online alias Kafeine found a live installation of the Styx exploit kit, previously known as Kein, that is using the exploit.

Cybercriminals add new exploit for recently patched Java vulnerability to their arsenal | Network World

Hyperloop: riding sound’s density peak to exploit the drag equation

Hyperloop is Elon Musk’s proposed means of travel that could enable a trip between San Francisco and LA in 30 minutes (which would mean you travel at roughly the speed of sound). He is supposed to be revealing an “alpha” design in August. Charles thinks he has finally worked it out what it will be, and passengers should find themselves travelling at exactly the speed of sound.

Hyperloop

The method Charles Alexander proposes would enable extremely low drag (i.e. air resistance) at sea-level altitude without doing anything that has to affect the air across the whole loop (e.g. evacuating the entire tube or circulating the entire column of air). The key is a combination of a scaling property of the high-velocity drag equation and a clever way to exploit it by traveling within the density peak of an intense low-frequency sound wave.

Hyperloop: riding sound’s density peak to exploit the drag equation | Charles Alexander Blog

Exploit for Android signing hole published

Android exploit

An exploit for the Android code signing hole, which was revealed a few days ago by Bluebox in advance of a presentation at the BlackHat conference, has now been published on GitHub. It allows its user to manipulate the files within APK format packages without the operating system being able to detect that the APK package has tampered with.

A package's manifest file has a hash for each file, but by saving both the modified and original file in the APK package, the checking of that hash can be fooled. The system checks the latter, original, file and passes it as valid but when it installs the package it installs the former, modified version of the file.

Exploit for Android signing hole published | The H Security

Facebook pays $20K for easily exploitable flaw that could have led to account hijackings

Facebook has paid out $20,000 for a serious bug that could have allowed an attacker to hijack anyone's account with ease, with no user interaction on the part of the victim.

Facebook fixes serious bug

Jack Whitten, the UK-based application-security engineer (by day) and security researcher (by night) who discovered the flaw, said in a post mortem on Wednesday that he reported the hole to Facebook on 23 May and that it was fixed by 28 May.

The exploit was enabled by manipulating the way that Facebook handles updates to mobile phones via SMS.

Facebook bug fixed | Naked Security

Botnet using Plesk vulnerability and takedown

Parallels Plesk

Today while investigating the Plesk/Apache Remote Code Execution vulnerability disclosed by Kingcope, we uncovered what appeared to be a sizeable botnet leveraging this vulnerability to infect webservers with a malicious IRC bot written in Perl; a loosely modified version of a publicly known tool.

A large list of hosts believed to be infected was generated from the data gathered, and probed in an automated fashion for vulnerable Plesk installations. Over 900 hosts attempting to connect were running vulnerable Plesk installations, confirming our suspicion that the Plesk exploit was how this malware was spreading; based on our estimates, about 40 hosts were being infected an hour, which we found intolerable.

Source

Supposed zero-day exploit for Plesk

Plesk

The hacker known as KingCope has taken to the security mailing list Full Disclosure to publish what seems to be a zero-day exploit for Plesk, the hosting software package made by Parallels. KingCope says that the exploit uses specially prepared HTTP queries to inject PHP commands and that he has successfully tested it on Plesk 9.5.4, 9.3, 9.2, 9.0 and 8.6 on Red Hat, CentOS and Fedora. Version 11.0.9 is apparently not affected.


The hacker seems to have found a way to use a POST request to launch the PHP interpreter with any configuration parameters that an attacker may want; the interpreter can then be made to carry out any command at will. The exploit uses the requested URL to start the interpreter with the desired parameters (say, "safe_mode=off"), and the PHP code that is to be executed is in the data portion of the request.

Source »

Mac OSX Server DirectoryService buffer overflow

Proof of Concept

A memory corruption vulnerability was found in Mac OSX Directory Service. By sending a maliciously crafted message, a remote attacker could cause the directory server to terminate or execute arbitrary code with system privileges. The issue existed in the directory server's handling of messages from the network.

Continue to the article »

Multiple XSS in Apache modules

Apache HTTP Server

Cross-site scripting (XSS) flaws were found in the mod_proxy_balancer module's manager web interface. If a remote attacker could trick a user, who was logged into the manager web interface, into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the context of the user's manager interface session. (CVE-2012-4558)

Continue to the article »

Google researcher discloses zero-day exploit for Windows

Google security expert Tavis Ormandy has discovered a security vulnerability in Windows which can be exploited by any user on the system to obtain administrator privileges. Rather than reporting the vulnerability to Microsoft, he posted details to the Full Disclosure security mailing list in mid-May and has now published an exploit to the same mailing list.

With this latest vulnerability, Ormandy once more opted for full disclosure on the mailing list of the same name. After discovering a bug in the Windows kernel's EPATHOBJ::pprFlattenRec function, he wrote to the list: "I don't have much free time to work on silly Microsoft code" and solicited ideas on how to successfully exploit the bug. With the help of user progmboy, Ormandy then developed a privilege escalation exploit which he shared with the mailing list, noting that another exploit was already in circulation.

Continue to the article »

Hacking Routers for Fun and Profit – Virgin Superhub CSRF Exploit

This could be quite an dangerous attack if used on a high profile page, (particularly in the UK where superhubs are used). Attackers could gain access to many routers.

Source