TechSNAP 100 Limited Edition Shirt:

Limited time left on our limited run TechSNAP 100 T-shirt!

Zendesk servers compromised, affects Twitter, Tumblr and Pinterest users

• Zendesk is a SaaS (Software as a Service) that provides a ticket system, knowledge base and help desk for a monthly fee
• It is quite popular, and used by large online services such as Twitter, Tumblr, Pinterest, Vodafone, 20th Century Fox, Denver Broncos, eLance, Fiverr, Gawker, Groupon, New Zealand Post, Rackspace Cloud, Scribd, Sears Canada, Sony Music, Xerox, and Yousendit
• Zendesk’s blog post says they believe only 3 of their customers were affected (not named, but other sources and the end users who received emails about the issue suggest it was Twitter, Tumblr and Pinterest)
• Apparently the attackers got access to a database with all of the email addresses of users who contacted those Zendesk customers for support, in addition to the email subject lines, apparently the body of the emails was not disclosed
• A help desk is likely to contain sensitive information, especially when used for billing inquiries and password resets, but could also contain API keys, vulnerability disclosures, internal comments, and other information that should not get out
• Self-hosting vulnerable software could leave you just as exposed, so the question comes down to, do you trust a 3rd party to do a better job of protection your customers than you will?
• Additional Coverage

sshd rootkit in the wild

• The sshd rootkit actually targets libkeyutils rather than the sshd binary itself, because previous sshd binary rootkits, have been defeated by updates to the sshd binary
• It is not yet clear what the original attack vector is, that allows the attackers to compromise the libkeyutils in the first place
• Seems to targets Red Hat and other RPM Based Distros, not clear if other distros are vulnerable
• The rootkit does a number of things, including allowing an attacker with a specific password to gain root access, open a listener, and steal all of the credentials that have been used to login to the infected sshd
• cPanel support server compromised, seemingly via sshd rootkit
• the cPanel support system often requests users enter the root credentials for their servers, so support staff can login and assess/fix problems. These credentials must be stored in a format that can be returned to plain text (rather than being hashed), because the support staff need the original password to login. Encrypting the password (normally not what you want) might work here, but the keys to decrypt would need to be accessible to either all support staff (a key management nightmare) or to the system itself (so it can decrypt the passwords for the users)
• Many cPanel customers report that their servers were compromised after they provided their credentials to cPanel support staff, this correlation may be how cPanel determined that they had been compromised, and spawned the investigation

Adi Shamir (the S in the RSA algorithm) says we need to prepare for a post-cryptography world

• Speaking at the RSA Conference in San Francisco this week as part of a panel Adi Shamir (of the Weizmann Institute of Science in Israel) spoke about the failure of traditional security mechanisms, including restricting access, virus scanners and IDS (Intrusion Detection Systems) to thwart APT (Advanced Persistent Threat) attacks.
• “It’s very hard to use cryptography effectively if you assume an APT is watching everything on a system, We need to think about security in a post-cryptography world.”
• The panel also included:
• Ron Rivest of MIT (the R in the RSA algorithm)
• Whitfield Diffie of ICANN (of the Diffie-Hellman-Merkle key exchange algorithm)
• Dan Boneh of Stanford University
• Ari Juels of RSA Labs
• Rivest also talked about the problems with the current PKI systems, especially Certificate Authorities (the Comodo and DigiNotar compromises), as well as the more recent problems with TurkTrust, the Turkish CA who gave out signing certificates to a government contractor that used them to create valid but fake google certificates
• Rivest suggests a new system with more tolerance for failures and where users have more control over whom they trust, especially in light of the growing trend where governments pressure CAs to fail, behave strangely or issue certificates they shouldn’t

Feedback:

• Resources for Learning More about FreeBSD?

• What’s so bad about a double NAT?

• What are intermediate SSL Certs?

• Fed Requirements Sometimes Force Equipment Online

• Internships, Learning, Training up while working 40+ Hours a week? CAN IT BE DONE?

• Last week we had a question of uPNP and pfSense – The pfSense blog has the official answer – pfSense uses an updated version of miniupnp, and has always done so, the vulnerable ones are more than 2 years old. Additionally, even if a new vulnerability in upnp is found, In order for your system to be vulnerable, you’d have had to manually add a firewall rule allowing access to upnp from the Internet.

Round Up:

• Sergey Brin says using a smart phone makes him feel like a girl
• HTML5 Bug in all major browsers except Firefox allows a remote site to fill your hard drive
• Microsoft suffers from same hacking attack as Apple, Facebook, small number of computers infected
• Time Warner CFO says no one wants gigabit internet a home
• How paid apps will work on Firefox OS phones – The start of a ‘buy it once, use it everywhere’ store?
• Symantec Finds Older Version of Stuxnet Dating Back to 2005
• Chrome 25 fixes 9 criticial vulnerabilities
• Comcast Punishes BitTorrent Pirates With Browser Hijack
• Security Explorations finds 2 more vulnerabilities in Java, even after u15
• Court orders UK ISPs to block more piracy sites
• Adobe pushes yet another Flash update, fixes 2 critical vulnerabilities being used in the wild
• Bitcoin reaches an all-time trading high of over $33
  • Current trading a CAVirtEx is $34.30/BTC

The post How I Met Your SSH | TechSNAP 99 first appeared on Jupiter Broadcasting.

0-Day exploit for Linksys routers found

• Researchers at DefenseCode have discovered a remote root access exploit for default installations on Linksys routers
• When the researchers contacted Cisco and shared the vulnerability as well as Proof of Concept code, Cisco originally claimed that the vulnerability had already been fixed in the latest firmware release, however this turned out the be incorrect
• The current Linksys firmware (4.30.14) and all previous versions are vulnerable to this remote root exploit
• DefenseCode published a youtube video showing them using the exploit against a Linksys WRT54GL router, and getting busybox shell
• It is not clear what if other models of Linksys routers are also vulnerable
• Sales figures say Linksys has shipped over 70 million routers
• Cisco expects to have a firmware update available before the full research is published in less than two weeks

Java saga continues, patches that don’t fix everything and new exploits

• Researchers at Immunity Products looked at the Java 7u11 patch and found that it only fixed one of two vulnerabilities
• They say that this means that the next 0-day exploit could cause all the same problems over again
• Security Explorations, the firm with a reputation for discovering Java vulnerabilities reports that Oracle has still not addressed issues they reported in April and September of 2012
• The September vulnerability , as with the one fixed in Java 7u11 allows an attacker to bypass the java security sandbox and remotely execute code
• Metaploit’s HD Moore says Java could take years to fix
• the next scheduled Java security release is Feb. 19

Red October – Cyber Espionage campaign dating back to 2007

• In October 2012 Kaspersky labs was contacted by a partner (who wishes to remain anonymous, likely a government or defense contractor), and was asked to investigate some malware samples
• This week, they started publishing the results of the attack they found, called Rocra (short for ‘Red October’)
• Researchers did not find any evidence of links between Rocra and other major malware platforms such as: Stuxnet, Duqu, Flame, Tilded and Gauss
• The exploits appear to have been created by Chinese hackers
• Some of the Rocra malware modules appear to have been created by Russian-speaking operatives
• In addition to exploits for MS Excel and MS Word, the Red October attacks also used exploits for Java 6 and 7 as part of the attack
• The malware would check for an internet connection by attempting to connect to legitimate addresses at microsoft (windows update, support.microsoft.com), likely to avoid detection of unusual network traffic. If a connection was not found, some information would still be collected and stored locally, possibly to be copied via file sharing to a machine that did have internet access
• The attack was used to gain access to secured systems and lift files, especially files with these extensions:
  • txt, csv, eml, doc, vsd, sxw, odt, docx, rtf, pdf, mdb, xls, wab, rst, xps, iau,
    cif, key, crt, cer, hse, pgp, gpg, xia, xiu, xis, xio, xig, acidcsa, acidsca,
    aciddsk, acidpvr, acidppr, acidssa
  • Of particular interest are the files with the acid extensions, likely created by “Acid Cryptofiler", which is known to be used by NATO and others in the European Union
• The attack was also an ‘advanced persistent threat’, doing things such as:
• Extract saved passwords for Web sites, FTP servers, mail and IM accounts from various applications
• Send Windows account password hashes to the C&C server for offline cracking
• Copy configurations from exposed network devices (Switches and routers with default passwords)
• Enumerate visible windows shares and report to the C&C server (probably for future document exfiltration)
• Scan connected USB drives for interesting files, the attack even included its own file system parser to copy deleted files
• Copy data from connected Nokia and Apple iPhones copy address books, call history, calendar, SMS messages, and browsing history
• Infecting Windows Mobile phones with a special mobile version of the Rocra virus
• Watch for specially crafted Microsoft Office or PDF documents and execute their malicious payload without user interaction, allowing the attackers to exploit future vulnerabilities to keep control over exploited machines even as old exploits were patched
• Standard key logging and screenshots, send back to C&C servers
• Execute additional encrypted payload modules according to a pre-defined schedule
• Copy all e-mail messages and attachments from Microsoft Outlook and from any mail servers found on the network that were accessible with the previously obtained credentials
• Targets Infographic
• Detailed Analysis:
  • Red October – Introduction Blog Post
  • Red October – Diplomatic Cyber Espionage Investigation
  • Red October – Stage One – Exploits and Components
  • Red October – Stage Two – Modules and Recon
  • Red October – Stage Two – Passwords, Email and Physical
  • Red October – Stage Two – Persistence and Spreading
  • Red October – Stage Two – Mobile and Exfiltration
• Digital Undergrounds podcast – Interview with Red October researchers

Feedback:

• Reminder: The deadline to submit proposals for talks at BSDCan 2013 is Friday January 18th
• What do you think is the best way to configure an array of let’s say 14 drives?
• ZFS De-Dupe Inside a VMDK?
  • VMWare Virtual Disk Format (VMDK) – Forensics Wiki
• Is my ZIL Helping? And force FreeBSD to scan the SATA Bus?
• Rotate System Account Passwords?
• XP on my ATM? WTF!
• Picking the right switch for iSCSI
• Control Panel for Nginx on Kickstarter
• MoinMoin’s strange name

Round-Up:

• I conceal my identity the same way Aaron was indicted for
• Microsoft ‘fix-it’ solution for IE 6–8 users by passed. Full patch finally released
• Bitcoin exchange hacked via Ruby On Rails exploit, funds stolen
• HRSDC loses data on student loans from 2000 thru 2006 when unencrypted external drive goes missing
• Internet 2012 in numbers
• ICS-CERT responds to Power plants where both common and sophisticated malware were found in Industrial Control Systems
• Security audit finds dev OUTSOURCED his JOB to China to goof off at work
• While SSDs got 35–45% cheaper across 2012, Q4 actually saw prices go up, as OCZ backed off its strategy of using lower prices to win market share, reducing price pressure on all manufacturers
• DHS tries to force medical device manufacturers to improve security after FDA fails to do so
• Intel to introduce silicon photonics (thin fibre optics) to motherboards, possible to the rack level (100G Infiniband)

The post Red October Hunts You | TechSNAP 93 first appeared on Jupiter Broadcasting.