TechSNAP 100 Limited Edition Shirt:

Limited time left on our limited run TechSNAP 100 T-shirt!

Adobe releases critical flash update APSB13–04

• CVE–2013–0633 – A buffer overflow allowing remote code execution – reported by Kaspersky Labs – CVSS 9.3
• CVE–2013–0634 – Remote code execution and memory corruption – Reported by Shadowserver Foundation and Lockheed Martin Computer Incident Response Team – CVSS 9.3
• Both vulnerabilities were being exploited in the wild during February 2013
• Both CVE numbers were allocated December 18th, 2012. “The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE”
• Both vulnerabilities were used in malicious SWF code embedded in Microsoft Word documents that users were tricked into opening
• CVE–2013–0634 was also used as a direct attach via SWFs hosted on websites
• Reaction to seeing Lockheed Martin in a vulnerability announcement

ShadowServer Foundation Blog reports on script injection in botnet C&C server

• While analyzing the commands received by bots that were part of a botnet (ShadowServer runs a large honeypot where it monitors the activities of the bots), they noticed a disturbing pattern
• The bot commands included javascript code to inject an iframe causing your browser to load a malicious site that would attempt Java and ActiveX exploits against you
• Once the exploit is successful, it drops a password stealer, which attempts to steal saved credentials from apps such as CuteFTP, FlashFXP, FileZilla, SmartFTP, TurboFTP, Firefox and more
• It then encrypts that information and sends it to a different C&C server
• Researchers at the ShadowServer Foundation originally thought it was a clever attack against researchers, attempting to exploit their scanning and reporting interfaces, which are usually custom built and lack some input sanitization
• It also appeared that the malware that was dropped by the exploit had already been submitted to malware analysis sites such as VirusTotal and Malwr.com
• Searching further, he found that an earlier version of the malware, with a much better detection ratio (number of virus scanners that detect the malware) had been uploaded by the same person a few days previous
• This led to speculation that the author may have been uploading various revisions of his malware and working to make it less detectable
• An update posted later suggestions that it appears to be one Botmaster attempting to exploit another Botmaster and take over his botnet
• It still suggests an interesting concept, where the Botmaster who is being observed, reverses the roles and begins observing the activities of the watcher

Error at Facebook takes out large number of major sites

• Some type of error or mistake in the code for Facebook Connect caused users trying to visit any site with Facebook Connect to be redirected to a Facebook error page that contained nothing but a very generic message “An error occurred. Please try again later.”
• The issue only seemed to affect those who were logged in to Facebook
• Logging out of Facebook seems to have prevented you from being redirected
• The outage caused huge dips in traffic to major sites including:
• ABC, BuzzFeed, Capital.fm, CNN, DailyMail, ESPN, Etsy, Fox News, Gawker, Geico, HBO, Hollywood.com, The Huffington Post, Hulu, InfoWorld, MSNBC.com, NBC News, News.com.au, NFL, OKCupid, People, Pinterest, Reddit, Slate, Smallworlds, SwagBucks, The Sydney-Melbourne Herald, TED, The Los Angeles Times, The New Zealand Herald, The Washington Post, Vulture, Weather.com, WikiAnswers, WordPress, XOJane, Yahoo, and YugaTech
• Additional Coverage
• It just goes to show the risk involved in relying on 3rd party services for basic mechanisms like authentication, and the risk of embedding 3rd party code that can change without notice

Vulnerability in libcurl POP3 and SMTP protocll handlers

• libcURL is a library for handling HTTP URLs and many other web protocols
• It is very commonly found on web servers and in php scripts where it is used to access remote sites via protocols such as HTTP(S), FTP(S), SSH, SCP/SFTP, POP3/SMTP, IMAP, RTSP, RTMP
• The problem stems from the way cURL handles certain headers in the POP3 protocol while negotiating SASL DIGEST-MD5 authentication
• cURL reads the response into a fixed length buffer, assuming that the response will be no longer than 128 bytes, however a malicious server could return a longer response, allowing it to overwrite memory outside of the buffer, possibly leading to remote code execution
• The most common vector for the attack is that by default cURL follows HTTP redirects, so when cURL attempts to load a URL (possibly provided by the user/attacker), it receives an HTTP redirect to pop3://username:password@evil.pop3-server.com/. and then gets exploited
• If you don’t expect to ever receive a redirect, you can tell cURL or libcURL not to follow redirects, or you can tell it to follow follow redirects for a list of protocols via CURLOPT_REDIR_PROTOCOLS
• An updated version of cURL/libcURL has been released to resolve this vulnerability
• Vulnerability Announcement
• Affected versions: < 7.26.0 and >= 7.29.0

Feedback:

• How Redhat hires people
  • Redhat is looking to hire almost 1000 more software engineers, technical support engineers, and salespeople this year
• SSL @ home
  • OpenSSL comes with a perl script for managing your own CA

• “Correct horse battery staple” really a strong password?

• Whiteboard Wednesday – Password Security

• Bought a domain for us!

• Backing up Gmail?

• NoPriv.py – Easy IMAP email backup to HTML archive. – Raymii.org

• A few questions…

• FreeBSD 9.1 bsdinstall hardware issues

• Getting started with OwnCloud

• Zero to ownCloud in Minutes!

• Download | ownCloud

• OwnCloud Webdav on GoDaddy shared Linux hosting

Round-Up:

• Researchers: Zero-day PDF exploit affects Adobe Reader 11, earlier versions

• CISPA is back.

• Deloitte suggests you’ll need longer passwords going forward, 8 characters is an insufficent minimum in 2013

• In a recent study of six million actual user-generated passwords, the 10,000 most common passwords would have accessed 98.1 percent of all accounts

• Tesla tears down NYT Model S review with car’s own logs

• Welcome to the Malware-Industrial Complex | MIT Technology Review

• Hackers break into Montana TV Emergency Alert System; zombie threat hoax aired

• Hacker exposes Bush family e-mails, photos revealing the 43rd President’s hidden talent as an amateur artist

• W3C rules DRM is ‘in-scope’ for HTML 5

• Google Chrome drops support for RHEL 6 because it doesn’t have GCC 4.6

• TPB AFK: The Pirate Bay Away From Keyboard – YouTube

• Get your TechSNAP 100 t-shirt before they are gone

The post Battle of the Bots | TechSNAP 97 first appeared on Jupiter Broadcasting.

Barracuda Networks devices contain multiple undocumented SSH users

• Vulnerable products include:
• Barracuda Spam and Virus Firewall
  • Barracuda Web Filter
  • Barracuda Message Archiver
  • Barracuda Web Application Firewall
  • Barracuda Link Balancer
  • Barracuda Load Balancer
  • Barracuda SSL VPN
• The issue was fixed in Security Definitions 2.0.5, it is highly recommended that all devices be upgraded
• These devices contain undocumented backdoor accounts with static passwords including:
  • root*
  • build* (uid 0)
  • shutdown
  • product
  • ca
  • support
  • websupport
  • qa_test*
• Only Items marked with a * were not able to be cracked with a short wordlist
• These users and their easily cracked passwords can be used to login at the terminal, the user ‘product’ is given a full bash shell
• Some additional users were also set up no password but with authorized ssh keys to allow remote access:
  • remote (uid 0)
  • cluster
• Both of these users also have full bash shells
• Once a user has a shell, they are able to access the local MySQL database (root@localhost with no password) and can add new users with administrative privileges
• A shell also could allow the user to enable debugging that could allow them to compromise the device
• The Barracuda devices use iptables to restrict access via SSH, however in addition to allowing SSH via the internal network, they also allow incoming SSH connections from two remote /24s on the internet
• Timestamps on the iptables rules file suggests they ips have been allowed in to every device since 2003
• These ranges belong to two different ISPs, Layer42.net which appears to host the colocation for Barracuda networks, and XO.net, which does not appear to be used by Barracuda Networks (it may have been in the past) and the IPs appear to belong to a number of unrelated parties, including a small IT firm that offers remote management, some voip servers, and a number of poorly maintainted websites (some not updated since 2007)
• If any of these sites or servers were compromised, they could be used to gain access to all public facing Barracuda Networks devices
• Most of these devices are public facing, because they are firewalls, web filter and spam filters
• A user may be able to spoof their ip via the local network to appear to be coming from one of the two internet ranges that have been whitelisted
• As part of the 2.0.5 update, Barracuda has disabled the product user, and all other users except for ‘cluster’ (ssh key only), ‘remote’ (uid 0, ssh key only, key is possessed by Barracuda Networks) and ‘root’ (password, likely crackable)
• According to Barracuda Networks, these accounts are critical for customer support and will not be removed
• Barracuda has done nothing to address the statically defined whitelisted ranges of IPs
• Because of the risk, it is recommended to place the Barracuda Networks devices behind a proper firewall
• Customers can contact Barracuda Networks Support for instructions on enabling ‘expert mode’ in order to disable the SSH daemon
• Barracuda Networks – Tech Alerts

Barracuda Networks SSL-VPN devices vulnerable to authentication bypass

• Unauthenticated users are able to set arbitrary Java system properties to arbitrary values, allowing an attacker to perform a Denial of Service attack against the device, or allowing them to break the applications security mechanisms
• By using the above vulnerability, an attacker is able to access the API functionality of the appliance, and is then able to download the device configuration, dump the SQL database (including passwords), reset the passwords of all superusers, disclose local files on the appliance (possibly secret keys), and restart or shutdown the device entirely.
• Barracuda Networks has issued ‘Security Definition 2.0.5’ that resolves these issues

Just because your password is long, does not mean it cannot be cracked

• A researcher from Carnagie Mellon University has developed a new password cracking tool that considers grammatical correctness to reduce the search space
• Based on a survey of 1434 user selected passwords of 16 characters or more, 18% of users voluntarily chose passwords that were grammatically correct (such as “abiggerbetterpassword” or “longestpasswordever”)
• The survey also found other structions, including postal addresses, URLs, and email addresses
• The password search space is significantly reduced when you move away from considering random combinations of characters, and instead consider dictionary words, and reduced further when you consider words only in combinations that are grammatically correct
• If a password consists of 3 words, applying the rules of grammar reduces the search space to 96.90%. However, if the password consists of 5 words, the search space is reduced to 46.95%, and 8 words lowers the search space to 0.99% of its original size
• Consider this when you are selecting passwords XKCD style
• Full Paper

Feedback:

• New viewer with some troubles!

• Pen Testing

• Some First Time ZFS Questions

• Removable ZIL
  • Removing a ZIL has only been available in ZFS Zpool v19+, which is only FreeBSD 8.3 and 9.0, FreeNAS before November 2012 does not support ZIL removal

• Setting up an Internet Radio

• Google Caching akismet password change page

• ZFS Problems Solved!

• Hall of Shame – Match.com

• How to Secure SSH with Google Authenticator’s Two-Factor Authentication – Submited by techsnapp

Round-Up:

• FOLLOWUP: The UK Information Commissioner’s Office has fined Sony 250,000 GBP (~$400,000) for the PlayStation Network breach. Finds that the attack could have been prevented if the software had been up to date and if proper password hashing had been implemented
• Arch gnu/linux on BSD kernel – just for Allan
• Polish researchers find 2 MORE sandbox bypass vulnerabilities in the lastest version of Java
• Cracking tool milks weakness to reveal some Mega passwords (Updated)
• Google’s VP of Security to publish paper on ways to replace passwords
• Student expelled for hacking Quebec college system gets job offers
• Traffic and BGP analysis suggests that Cuba has activated an undersea fibre optical cable connecting it to Venezuela
• Attention shoppers: Retailers can now track you across the mall
• SEA-ME-WE 3 – a submarine fibre optic link between Australia and Singapore was damaged last week, not expected to be repaired until mid-February, traffic routed via other cables

The post Barricade Your Barracuda | TechSNAP 94 first appeared on Jupiter Broadcasting.