Saving Private Exploit | TechSNAP 91

Show Notes:

Get TechSNAP on your Android:

• Callisto – Android App
• Jupiter Broadcasting – Android App by ShaneQful

Browser Affiliate Extension:

• Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

New IE exploits affects IE 6, 7 and 8, but not 9 and 10

• Windows XP users cannot upgrade beyond IE 8 and are still stuck
• A number of large organizations and many home users still use Windows XP
• This exploit was used in a Watering Hole attack against the website of think tank The Council on Foreign Relations
• Ever after a high profile attack in the wild, Microsoft Announced that a patch for the exploit will not be available for this weeks patch Tuesday
• Microsoft has issued a temporary Fix-It Solution that can be used to mitigate the exploit until a patch can be released

---

Vulnerability in all versions of Ruby on Rails

• A flaw in the implementation of the ‘finder’ method of the Active Record system could allow SQL injection
• If users can supply a symbol keyed hash as the second parameter to the find_by_* method, they would be able to inject arbitrary SQL
• The very popular Authlogic library is vulnerable in some instances, specifically when the attacker knows the HMAC key that is used to sign cookies
• Authlogic stores session data in a cookie on the users’ computer, and this cookie is cryptographically signed with HMAC to ensure it cannot be tampered with. This works well when the HMAC key is secret, but many examples on github and many open source applications include a default HMAC that is often not changed, resulting in a large install base using publically known HMAC keys, allowing them to be exploited
• CVE–2012–5664
• Ruby on Rails recommends upgrading to the latest version in your desired branch: 3.2.10, 3.1.9 or 3.0.18
• Threatpost Coverage

---

Zero day exploit for nVidia display drivers in windows

• The nVidia driver service listens on a named pipe (\pipe\nsvr) that has a null access control list
• Any user logged on to the machine or any remote user in a domain context (if the machine has file sharing enabled, and the firewall relaxed/disabled) could have access to the service
• The attacker could then trigger a buffer overflow due to a bad memmove operation
• The exploit could be used to escalate privileges and gain full control over the machine
• The exploit is also able to bypass data execution prevention (DEP) and the address space layout randomization (ASLR) feature introduced in Windows Vista
• The exploit was initially made public because the researcher felt that the risk was minimal, however after some pressure from the community and possibly the discovery of additional attack vectors, the exploit was taken down

---

Feedback:

• EuroBSDCon 2012 Talks are now online:
• EuroBSDCon 2012
• Allan Jude – A Fault Aware Global Server Load Balancer in DNS
• Dag-Erling Smørgrav – Challenges in identity management and authentication
• Martin Matuska – Tuning ZFS on FreeBSD
• Michael Dexter – The bhyve Hypervisor In Depth
• John Hixson – FreeNAS system architecture
• All EuroBSDCon 2012 videos

---

• Picking the right VPS
• Another Exchange replacement, Kolab
• A few questions for us
• A few corrections/ideas
• What is the benefit of using a Unix jails?
• Loves Keychain
• nagios check for old SSH Keys

Round-Up:

• Low End Box – Cheap VPS Hosting Providers Listing & Reviews
• Amazon Blames Deleted Data for Christmas Eve Netflix Outage
• Anti-virus products are rubbish, says Imperva
• Exploit for ircd-ratbox 2.0 and Charybdis IRCds take down large swaths of EFNet and other IRC networks
  
• Bug reveals ‘deleted’ Snapchat videos
• Testing Go on the Raspberry Pi running FreeBSD
• Implementing SCTP in GO on FreeBSD
• 3D Android Malware?
• TURKTRUST CA ‘accidently’ grants subordinate CA to *.EGO.GOV.TR who issues fake *.google.com certificates, google moves to blacklist the certificates
• What do people send to SteveBallmer@Outlook.com?
• Facebook patches but that could allow attackers to remotely enable your webcam and post videos to your profile