Cybercriminals add new exploit for recently patched Java vulnerability to their arsenal

IDG News Service - Cybercriminals were quick to integrate a newly released exploit for a Java vulnerability patched in June into a tool used to launch mass attacks against users, an independent malware researcher warned.

Java vulnerability

The exploit targets a critical vulnerability identified as CVE-2013-2465 that affects all Java versions older than Java 7 Update 25 and can enable remote code execution. The vulnerability was patched by Oracle in its June Critical Patch Update for Java.

The exploit was released Monday by security research group Packet Storm Security, which originally acquired it through its bug bounty program as a zero-day exploit -- an exploit for an unpatched vulnerability -- from a researcher whose name was not disclosed. Packet Storm publishes the exploits it acquires 60 days after it receives them, with permission from their authors, so other security professionals can use them to perform penetration tests and security risk assessments.

Two days after its release, the CVE-2013-2465 exploit was already integrated into so-called exploit kits, attack tools that infect computers with malware by exploiting vulnerabilities in outdated software when users visit compromised websites.

An independent malware researcher who uses the online alias Kafeine found a live installation of the Styx exploit kit, previously known as Kein, that is using the exploit.

Cybercriminals add new exploit for recently patched Java vulnerability to their arsenal | Network World

Advanced Exploitation of Windows Kernel Privilege Escalation (CVE-2013-3660 / MS13-053)

Recently, a very interesting Windows privilege escalation vulnerability was discovered and publicly disclosed by Tavis Ormandy (and he deserves a Pwnie Award 2013 for it!), it was later patched by Microsoft as part of MS13-053. The vulnerability affects the Win32k.sys "EPATHOBJ::pprFlattenRec()" function, and allows an unprivileged user to gain SYSTEM permissions. 

While a few codes taking advantage of this vulnerability were published by other researchers, our aim was to create a reliable and universal exploit working on both 32bit and 64bit versions of Windows 8, Windows 7, Vista, and XP. We had then to find another exploitation method which works on Windows 8 and prior and which provides instant privilege escalation without suffering from the race condition limitations and/or side effects.

Advanced Exploitation of Windows Kernel Privilege Escalation | Vupen.com

Integrating Vulnerability Management Into The Application Development Process

Software developers are only human, which means that complex application code will include errors and bugs. This means that scanning and combing new application code for security flaws are part of virtually every software development process. But not all developers approach vulnerability discovery the same way -- and very few of them catch all of their code vulnerabilities on the first try.

The application development process

The effects of coding errors can be crippling. In 2003, a bug in General Electric's monitoring software cut off power to an estimated 50 million people. More recently, Knight Capital's computers erroneously executed a series of automatic stock orders that brought the company to the edge of bankruptcy, while HTC America has had to settle a civil suit with the Federal Trade Commission after a modification to the software on its Android- and Windows-based phones introduced numerous security vulnerabilities.

The pressure to get new products ready for market imposes accelerated timetables on developers, resulting in even more mistakes. When first released, Apple's Maps app, for example, was plagued with errors, damaged Apple's reputation and cost the executive held responsible his job. (It also led to a very public apology from Apple CEO Tim Cook.)

Integrating Vulnerability Management Into The Application Development Process | The Dark Reading

SIM cards vulnerable to hacking, says researcher

Millions of mobile phones may be vulnerable to spying due to the use of outdated, 1970s-era cryptography, according to new research due to be presented at the Black Hat security conference.

SIM cards vulnerable to hacking

Karsten Nohl, an expert cryptographer with Security Research Labs, has found a way to trick mobile phones into granting access to the device's location, SMS functions and allow changes to a person's voicemail number.

Nohl's research looked at a mobile phones' SIM (Subscriber Identification Module), the small card inserted into a device that ties it to a phone number and authenticates software updates and commands sent over-the-air from an operator.

More than 7 billion SIM cards are in use worldwide. To ensure privacy and security, SIM cards use encryption when communicating with an operator, but the encryption standards use vary widely.
A mobile communication trade group, the GSM Association, said in a statement that only a "minority" of SIM cards that use older encryption standards would appear to be vulnerable.

"There is no evidence to suggest that today's more secure SIMs, which are used to support a range of advanced services, will be affected," GSMA said.

SIM cards vulnerable to hacking, says researcher | Network World

Critical vulnerabilities in numerous ASUS routers

ASUS routers

According to a report by security expert Kyle Lovett on the Bugtraq mailing list, critical security vulnerabilities exist in numerous ASUS routers and can be remotely exploited to take complete control of the router. The weak point is the AiCloud media server. If AiCloud is activated, unauthorised users can access critical system files over the internet – including files containing access credentials for the router in plain text format.


Attackers can use these credentials to access personal files stored on any devices connected to the router's USB ports. Attackers may also be able to use AiCloud to access network shares on other computers on the router's network.

Critical vulnerabilities in numerous ASUS routers The H Security

Oracle ships giant raft of patches - but none of them for Java

Oracle's latest Patch Tuesday has come and gone, with the database-and-more behemoth putting out patches for 89 vulnerabilities.
Twelve products sets in the Oracle stable get from 1 to 21 patches each. These squash a total of 45 RCEs, or Remote Code Execution vulnerabilities.

Oracle ships giant raft of patches

In Oracle's own words, which are actually well chosen and plainly put, RCEs are defined as:

vulnerabilities [that] may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

Oracle ships giant raft of patches - but none of them for Java | Naked Security

Can you spot the security implications/vulnerability of a small change to an ASP.NET MVC 3.0+ Model Binder?

This post contains an example of a serious security vulnerability that is common on ASP.NET MVC applications. There are two versions of a Model Binder (CartModelBinder) class shown below, one or both are vulnerable.

Note 1: The vulnerability shown in this post is a variation of real-world vulnerability that I helped to find a couple weeks ago (on an UK-based financial services company).

Note 2: I’m yet to to look/review/see a large MVC application that doesn’t have similar vulnerabilities (on both ASP.NET MVC or Spring MVC)

Note 3: the code is from the http://sportsstoremvc3.codeplex.com/ sample application, which is used as an ‘real-world application’ example by the Pro ASP.NET MVC 4 book (the code was compiled using .NET 4.0 and executed using the ASP.NET MVC 3.0 and ASP.NET MVC 4.0 versions).

Spot the security implications/vulnerability | Dinis Cruz Blog

Scan your device for the Android “MASTER KEY” vulnerability

Bluebox have released a free app to help consumers and enterprises manage the risk around the “Master Key” vulnerability. The Bluebox Security Scanner app produced by their research team allows you to directly check if your Android device has been patched for this vulnerability without the hassle of having to contact the device manufacturer or mobile carrier. It will also scan devices to see if there are any malicious apps installed that take advantage of this vulnerability. Once the bug is discovered The Bluebox Security set out to create a tool to help individuals to evaluate their risk and that app is now available for free at both Google Play and Amazon AppStore for Android.

The Bluebox Security Scanner

Scan your device for the Android “MASTER KEY” vulnerability | Bluebox

Major app vulnerability that could affect 99% of Android devices unearthed

Major app vulnerability

A vulnerability that could affect 99 percent of the world’s Android-powered phones and tablets has been unearthed within the Google-owned platform. Since more than 900 million Android devices have been activated, we’re filing this in the ‘major vulnerability’ folder.

Bluebox Security says it found ‘the Android master key’ which could allow a hacker to turn virtually any Android app into a malicious “zombie”. In other words, malware could allow hackers to remotely capture data and control functions on a device — such as calls and messages — all without raising the attention of the phone owner, Google or the app developer.

Major app vulnerability could affect 99% of Android devices unearthed | The Next Web

Uncovering Android master key that makes 99% of devices vulnerable

The Bluebox Security research team – Bluebox Labs – recently discovered a vulnerability in Android’s security model that allows a hacker to modify APK code without breaking an application’s cryptographic signature, to turn any legitimate application into a malicious Trojan, completely unnoticed by the app store, the phone, or the end user. The implications are huge! This vulnerability, around at least since the release of Android 1.6 (codename: “Donut” ), could affect any Android phone released in the last 4 years1 – or nearly 900 million devices2– and depending on the type of application, a hacker can exploit the vulnerability for anything from data theft to creation of a mobile botnet.

Uncovering Android master key

While the risk to the individual and the enterprise is great (a malicious app can access individual data, or gain entry into an enterprise), this risk is compounded when you consider applications developed by the device manufacturers (e.g. HTC, Samsung, Motorola, LG) or third-parties that work in cooperation with the device manufacturer (e.g. Cisco with AnyConnect VPN) – that are granted special elevated privileges within Android – specifically System UID access.

Uncovering Android master key | Bluebox Security

Ruby update fixes SSL man-in-the-middle vulnerability

The OpenSSL implementation bundled with Ruby has been found to be vulnerable to having its hostname check bypassed. 

Ruby update fixes SSL vulnerability

The flaw, rooted in the lack of proper handling of alternate X509 names with null bytes in them, could allow an attacker to present a certificate for "www.ruby-lang.org\0example.com" which when read by the Ruby client library, would be interpreted as "www.ruby-lang.org". That result would be handed over to the certificate verfication routines which would cause the certificate would be identified as coming from "www.ruby-lang.org". If an attacker could get a certificate where thesubjectAltName included such a null byte, they could use that certificate to interpose themselves between a victim and the site.

Ruby update fixes SSL man-in-the-middle vulnerability | The H Security

Critical Ruby on Rails bug exploited in wild, hacked servers join botnet

Attackers are exploiting an extremely critical vulnerability in the Ruby on Rails framework to commandeer servers and make them part of a malicious network of hacked machines, a security researcher said.

Source

PayPal denies teenager reward for finding website bug

A 17-year-old German student contends PayPal has denied him a reward for finding a vulnerability in its website.

Source