Battle of the Bots | TechSNAP 97

Show Notes:

Get TechSNAP on your Android:

• Callisto – Android App
• Jupiter Broadcasting – Android App by ShaneQful

Browser Affiliate Extension:

• Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox





TechSNAP 100 Limited Edition Shirt:

Limited time left on our limited run TechSNAP 100 T-shirt!

Adobe releases critical flash update APSB13–04

• CVE–2013–0633 – A buffer overflow allowing remote code execution – reported by Kaspersky Labs – CVSS 9.3
• CVE–2013–0634 – Remote code execution and memory corruption – Reported by Shadowserver Foundation and Lockheed Martin Computer Incident Response Team – CVSS 9.3
• Both vulnerabilities were being exploited in the wild during February 2013
• Both CVE numbers were allocated December 18th, 2012. “The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE”
• Both vulnerabilities were used in malicious SWF code embedded in Microsoft Word documents that users were tricked into opening
• CVE–2013–0634 was also used as a direct attach via SWFs hosted on websites
• Reaction to seeing Lockheed Martin in a vulnerability announcement

---

ShadowServer Foundation Blog reports on script injection in botnet C&C server

• While analyzing the commands received by bots that were part of a botnet (ShadowServer runs a large honeypot where it monitors the activities of the bots), they noticed a disturbing pattern
• The bot commands included javascript code to inject an iframe causing your browser to load a malicious site that would attempt Java and ActiveX exploits against you
• Once the exploit is successful, it drops a password stealer, which attempts to steal saved credentials from apps such as CuteFTP, FlashFXP, FileZilla, SmartFTP, TurboFTP, Firefox and more
• It then encrypts that information and sends it to a different C&C server
• Researchers at the ShadowServer Foundation originally thought it was a clever attack against researchers, attempting to exploit their scanning and reporting interfaces, which are usually custom built and lack some input sanitization
• It also appeared that the malware that was dropped by the exploit had already been submitted to malware analysis sites such as VirusTotal and Malwr.com
• Searching further, he found that an earlier version of the malware, with a much better detection ratio (number of virus scanners that detect the malware) had been uploaded by the same person a few days previous
• This led to speculation that the author may have been uploading various revisions of his malware and working to make it less detectable
• An update posted later suggestions that it appears to be one Botmaster attempting to exploit another Botmaster and take over his botnet
• It still suggests an interesting concept, where the Botmaster who is being observed, reverses the roles and begins observing the activities of the watcher

---

Error at Facebook takes out large number of major sites

• Some type of error or mistake in the code for Facebook Connect caused users trying to visit any site with Facebook Connect to be redirected to a Facebook error page that contained nothing but a very generic message “An error occurred. Please try again later.”
• The issue only seemed to affect those who were logged in to Facebook
• Logging out of Facebook seems to have prevented you from being redirected
• The outage caused huge dips in traffic to major sites including:
• ABC, BuzzFeed, Capital.fm, CNN, DailyMail, ESPN, Etsy, Fox News, Gawker, Geico, HBO, Hollywood.com, The Huffington Post, Hulu, InfoWorld, MSNBC.com, NBC News, News.com.au, NFL, OKCupid, People, Pinterest, Reddit, Slate, Smallworlds, SwagBucks, The Sydney-Melbourne Herald, TED, The Los Angeles Times, The New Zealand Herald, The Washington Post, Vulture, Weather.com, WikiAnswers, WordPress, XOJane, Yahoo, and YugaTech
• Additional Coverage
• It just goes to show the risk involved in relying on 3rd party services for basic mechanisms like authentication, and the risk of embedding 3rd party code that can change without notice

---

Vulnerability in libcurl POP3 and SMTP protocll handlers

• libcURL is a library for handling HTTP URLs and many other web protocols
• It is very commonly found on web servers and in php scripts where it is used to access remote sites via protocols such as HTTP(S), FTP(S), SSH, SCP/SFTP, POP3/SMTP, IMAP, RTSP, RTMP
• The problem stems from the way cURL handles certain headers in the POP3 protocol while negotiating SASL DIGEST-MD5 authentication
• cURL reads the response into a fixed length buffer, assuming that the response will be no longer than 128 bytes, however a malicious server could return a longer response, allowing it to overwrite memory outside of the buffer, possibly leading to remote code execution
• The most common vector for the attack is that by default cURL follows HTTP redirects, so when cURL attempts to load a URL (possibly provided by the user/attacker), it receives an HTTP redirect to pop3://username:password@evil.pop3-server.com/. and then gets exploited
• If you don’t expect to ever receive a redirect, you can tell cURL or libcURL not to follow redirects, or you can tell it to follow follow redirects for a list of protocols via CURLOPT_REDIR_PROTOCOLS
• An updated version of cURL/libcURL has been released to resolve this vulnerability
• Vulnerability Announcement
• Affected versions: < 7.26.0 and >= 7.29.0

---

Feedback:

• How Redhat hires people
  • Redhat is looking to hire almost 1000 more software engineers, technical support engineers, and salespeople this year
• SSL @ home
  • OpenSSL comes with a perl script for managing your own CA

• “Correct horse battery staple” really a strong password?

• Whiteboard Wednesday – Password Security

• Bought a domain for us!

• Backing up Gmail?

• NoPriv.py – Easy IMAP email backup to HTML archive. – Raymii.org

• A few questions…

• FreeBSD 9.1 bsdinstall hardware issues

• Getting started with OwnCloud

• Zero to ownCloud in Minutes!

• Download | ownCloud

• OwnCloud Webdav on GoDaddy shared Linux hosting

Round-Up:

• Researchers: Zero-day PDF exploit affects Adobe Reader 11, earlier versions

• CISPA is back.

• Deloitte suggests you’ll need longer passwords going forward, 8 characters is an insufficent minimum in 2013

• In a recent study of six million actual user-generated passwords, the 10,000 most common passwords would have accessed 98.1 percent of all accounts

• Tesla tears down NYT Model S review with car’s own logs

• Welcome to the Malware-Industrial Complex | MIT Technology Review

• Hackers break into Montana TV Emergency Alert System; zombie threat hoax aired

• Hacker exposes Bush family e-mails, photos revealing the 43rd President’s hidden talent as an amateur artist

• W3C rules DRM is ‘in-scope’ for HTML 5

• Google Chrome drops support for RHEL 6 because it doesn’t have GCC 4.6

• TPB AFK: The Pirate Bay Away From Keyboard – YouTube

• Get your TechSNAP 100 t-shirt before they are gone