Aug 292012
 

Researchers: Java Zero-Day Leveraged Two Flaws

KREBS on SECURITY
Wednesday, August 29, 2012




New analysis of a zero-day Java exploit that surfaced last week indicates that it takes advantage of not one but two previously unknown vulnerabilities in the widely-used software. The latest figures suggest that these vulnerabilities have exposed more than a billion users to attack.

 

 

Esteban Guillardoy, a developer at the security firm Immunity Inc., said the underlying vulnerability has been around since July 28, 2011.

“There are 2 different zero-day vulnerabilities used in this exploit,” Guillardoy wrote in a lengthy analysis of the exploit. “The beauty of this bug class is that it provides 100% reliability and is multi-platform. Hence this will shortly become the penetration test Swiss knife for the next couple of years (as did its older brother CVE-2008-5353).”

 

ONE BILLION USERS AT RISK?

How many systems are vulnerable? Oracle Corp., which maintains Java, claims that more than 3 billion devices run Java. But how many of those systems run some version of Java 7 (all versions of Java 7 are vulnerable; this flaw does not exist in Java 6 versions).

To get an idea, I asked Secunia, whose Personal Software Inspector program runs on millions of PCs. Secunia said that out of a random sampling of 10,000 PSI users, 34.2 percent had some version of Java 7 installed. In the same data set, 56.4 percent of users had an update of Java 6 installed. Assuming that Secunia’s 10,000 user sample is representative of the larger population of computer users, more than a billion devices could be vulnerable to attack via this exploit.

 

EXPLOIT WORKS AGAINST OS X, LINUX

Not long after news broke that miscreants were exploiting an unpatched security hole in Java to break into PCs, I began seeing tweets from non-Windows users urging people to switch to Mac OS X or Linux. Unfortunately, this latest Java exploit has been shown to work flawlessly to compromise browsers on all three operating systems.

According to Rapid7, the Java exploit found being used in targeted attacks (CVE-2012-4681) is now available as a plug-in to Metasploit, a free software tool built to test the security of networks. Rapid7 said the exploit has been successfully tested to work against nearly all browser configurations on Windows systems, and against Safari on OS X 10.7.4 and Mozilla Firefox on Ubuntu Linux 10.04.

 

WHO BURNS THROUGH TWO-ZERO DAYS IN ONE SHOT?

On Monday, I interviewed the author of the BlackHole exploit kit, an extremely popular software package sold in the underground that is designed to be stitched into hacked sites and use browser exploits to drop malware on visiting PCs. The BlackHole author said he intended to (and did, it appears) fold the exploit into his kit, but said he was surprised that someone would just leak such a reliable exploit, which he said would fetch at least $100,000 if sold privately in the criminal underground.

 

This stats page, shared by researchers at Seculert, comes from a working BlackHole exploit panel. The success rate of this kit — 21 percent — is roughly double the normal rate thanks to the inclusion of this Java zero-day.

 

But lost in all of the coverage of this vulnerability is the growing body of evidence suggesting this Java exploit was first wielded in targeted espionage attacks of the sort used to extract corporate and government secrets. So who burns through two zero day flaws to execute a targeted attack? In all likelihood, an individual or group motivated by a non-materialistic ideology, or at least a certainty that what will be gained is worth far more than the vulnerability itself.

Experts at Silicon Valley-based AlienVault published an analysis that highlighted some interesting text strings in the exploit (“xiaomaolv” and conglaiyebuqi”) which suggest the initial attacks were paired with Chinese crimeware known as the Gondad Exploit Kit.

Other curious markers in the exploit code indicate that the targeted attacks were carried out using Internet servers that have been connected with other targeted espionage attacks traced back to Chinese threat actor groups. Among the control servers used in this latest attack was “domain.rm6.org,” an Internet address that played a central role in the Nitro attacks of 2011, which according to Symantec and other security firms was a series of Chinese-based espionage attacks directed against at least 48 chemical and defense companies.

Unfortunately, the miscreants involved in these targeted attacks have been finding success using the same resources and tools well into 2010 and earlier. That’s according to a presentation given in 2010 by researchers exploit and malware researchers Val Smith and Anthony Lai, called “Balancing the Pwn Deficit” (PDF).

The paper details the history and methods of Chinese hacking groups, and notes that the two strings found in the most recent Java exploit are a favorite invocation for script variables that are re-used in various attack tools of Chinese origin. The terms “xiaomaolv” and conglaiyebuqi” and several others used, they found, come from lyrics from songs by the artist known as Jay Zhou.

“The fact that there are embedded song lyrics, potentially tells us several things,” they wrote. “One, it helps to confirm that this attack was created in the geographic region assumed. It is unusual for attackers from one country and language, to take lyrics from a popular song in another country and language and embed them in their attacks.”

 

PATCH AVAILABLE?

As I noted earlier this week, Oracle has moved Java to a patch cycle of every four months, and its next security update is not scheduled until October. On Tuesday, I contacted Oracle to find out if they intended to address this problem separately before then, but I have not yet received a response. Nor could I find any mention of this problem on any of the various Java blogs that Oracle inherited when it took control of Java from Sun a few years ago. In fact, most of those Java blogs seem to have gone missing.

In the meantime, it’s a good idea to either unplug Java from your browser or uninstall it from your computer completely.

Windows users can find out if they have Java installed and which version by visiting java.com and clicking the “Do I have Java? link. Mac users can use the Software Update feature to check for any available Java updates.

If you primarily use Java because some Web site, or program you have on your system — such as OpenOffice or Freemind — requires it, you can still dramatically reduce the risk from Java attacks just by disabling the plugin in your Web browser. In this case, I  would suggest a two-browser approach. If you normally browse the Web with Firefox, for example, consider disabling the Java plugin in Firefox, and then using an alternative browser (Chrome, IE9, Safari, etc.) with Java enabled to browse only the site that requires it.

 

For browser-specific instructions on disabling Java, click here.

 

If you want to test whether you’ve successfully disabled Java, check out Rapid7′s page, isjavaexploitable.com.

 

Direct Link:  http://krebsonsecurity.com/2012/08/java-exploit-leveraged-two-flaws/

Aug 292012
 

Attackers Pounce on Zero-Day Java Exploit

KREBS on SECURITY
Monday, August 27, 2012




Attackers have seized upon a previously unknown security hole in Oracle’s ubiquitous Java software to break into vulnerable systems. So far, the attacks exploiting this weakness have been targeted and not widespread, but it appears that the exploit code is now public and is being folded into more widely-available attack tools such as Metasploit and exploit kits like BlackHole.

 

A Metasploit module developed to target this Java 0-day.

 

News of the vulnerability (CVE-2012-4681) surfaced late last week in a somewhat sparse blog post by FireEye, which said the exploit seemed to work against the latest version of Java 7, which is version 1.7, Update 6. This morning, researchers Andre’ M. DiMino & Mila Parkour published additional details on the targeted attacks seen so far, confirming that the zero-day affects Java 7 Update 0 through 6, but does not appear to impact Java 6 and below.

Initial reports indicated that the exploit code worked against all versions of Internet Explorer, Firefox and Opera, but did not work against Google Chrome. But according to Rapid 7, there is a Metasploit module in development that successfully deploys this exploit against Chrome (on at least Windows XP).

Also, there are indications that this exploit will soon be rolled into the BlackHole exploit kit. Contacted via instant message, the curator of the widely-used commercial attack tool confirmed that the now-public exploit code worked nicely, and said he planned to incorporate it into BlackHole as early as today. “The price of such an exploit if it were sold privately would be about $100,000,” wrote Paunch, the nickname used by the BlackHole author.

Oracle has moved Java to a quarterly patch cycle, and its next update is not scheduled until October. In the meantime, it’s a good idea to either unplug Java from your browser or uninstall it from your computer completely.

Windows users can find out if they have Java installed and which version by visiting java.com and clicking the “Do I have Java? link. Mac users can use the Software Update feature to check for any available Java updates.

If you primarily use Java because some Web site, or program you have on your system — such as OpenOffice or Freemind — requires it, you can still dramatically reduce the risk from Java attacks just by disabling the plugin in your Web browser. In this case, I  would suggest a two-browser approach. If you normally browse the Web with Firefox, for example, consider disabling the Java plugin in Firefox, and then using an alternative browser (Chrome, IE9, Safari, etc.) with Java enabled to browse only the site that requires it.

For browser-specific instructions on disabling Java, click here.

If you must use Java, security experts are prepping an unofficial patch for the program that should blunt this vulnerability, but it is being offered on a per-request basis at this point. A number of experts I know and respect have vouched for the integrity of this patch, but installing third-party patches should not be done lightly. Note that regressing to the latest version of Java 6 (Java/JRE 6 Update 34) is certainly an option, but not a very good one either. If you do not need Java, get rid of it, and if you do need it for specific applications or sites, limit your use of Java to those sites and applications, using a secondary browser for that purpose.

If you liked this post, check out the follow-up story,  Researchers: Java Zero-Day Leveraged Two Flaws.

 

Direct Link:   http://krebsonsecurity.com/2012/08/attackers-pounce-on-zero-day-java-exploit/

Aug 282012
 

Former Marine fired for tattoo quoting Mattis

 

 Marine Corps Times
By Bethany Crudele / Staff writer
Aug 27, 2012

 

A former Marine says his ink got him canned from his civilian railroad job.

What was so offensive that his superiors could not stand for it? A quote from one of the Marine Corps’ most revered generals.

Union Pacific Railroad fired conductor Carl Newman of Kansas City, Mo., in 2010 because his tattoo violated the company’s “Violence in the Workplace” policy, according to a complaint filed in federal court Aug. 9.

The words were spoken by Gen. James Mattis, now head of U.S. Central Command, when he led Marines in Iraq in 2003.

Mattis, then a tough-talking major general known as “the Warrior Monk,” commanded 1st Marine Division during the invasion. According to Washington Post reporter Thomas E. Ricks’ book “Fiasco,” Mattis sent his tanks and artillery home after the successful invasion. He met with Iraqi tribal leaders and said, “I come in peace. I didn’t bring artillery. But I am pleading with you, with tears in my eyes: If you f— with me, I’ll kill you all.”

Newman, who served on active duty from 1997 to 2001, had Mattis’ statement tattooed on his arm before joining Union Pacific. The complaint states that a fellow employee photographed his arm. According to the complaint, Union Pacific Railroad’s policy is not to discipline people for offensive tattoos unless they are directed to cover the ink and fail to comply, and Newman was never asked to cover up his tattoo.

But the complaint also makes the case that the railroad company used the tattoo as an excuse to fire him in retaliation for whistle-blowing phone calls to the company’s safety hotline about hazards along the tracks. According to a report by the Occupational Safety and Health Administration, Newman called the hotline hundreds of times.

The complaint alleges that Newman was discouraged from making formal reports to the Union Pacific Railroad hotline.

Newman first filed a complaint with OSHA in September 2010. Following an OSHA investigation in 2011, the Department of Labor found reasonable cause that Union Pacific Railroad was in violation of the Federal Railroad Safety Act, which protects employees who report violations of railroad safety.

“Workers have the right to report work-related injuries and safety concerns without fear of retaliation,” said Assistant Secretary for OSHA David Michaels in a news release.

Nearly two years after he was fired, Newman continues to fight his termination. Holtsclaw & Kendall, LC, the Kansas City firm representing Newman, declined comment on his behalf because the case is pending.

Mark Davis, director of corporate relations and media for Union Pacific Railroad, also declined to respond to Newman’s accusations.

“I cannot comment any further than telling you the facts of this case will be presented to the court,” he said.

Newman is seeking a jury trial and compensation for loss of pay and benefits, incurred medical expenses, mental anguish, punitive damages and legal fees.

 

Direct Link:  http://www.marinecorpstimes.com/news/2012/08/marine-fired-mattis-quote-tattoo-082712/

Aug 282012
 

U.S.: We hacked the enemy in Afghanistan

 

 Marine Corps Times
The Associated Press
Friday Aug 24, 2012

The U.S. military has been launching cyber attacks against its opponents in Afghanistan, a senior officer says, making an unusually explicit acknowledgment of the oft-hidden world of electronic warfare.

Marine Lt. Gen. Richard P. Mills’ comments came last week at a conference in Baltimore during which he explained how U.S. commanders considered cyber weapons an important part of their arsenal.

“I can tell you that as a commander in Afghanistan in the year 2010, I was able to use my cyber operations against my adversary with great impact,” Mills said. “I was able to get inside his nets, infect his command-and-control, and in fact defend myself against his almost constant incursions to get inside my wire, to affect my operations.”

Mills, now a deputy commandant with the Marine Corps, was in charge of international forces in southwestern Afghanistan between 2010 and 2011, according to his official biography. He didn’t go into any further detail as to the nature or scope of his forces’ attacks, but experts said that such a public admission that they were being carried out was itself striking.

“This is news,” said James Lewis, a cyber-security analyst with the Washington-based Center for Strategic and International Studies. He said that while it was generally known in defense circles that cyber attacks had been carried out by U.S. forces in Afghanistan, he had never seen a senior officer take credit for them in such a way.

“It’s not secret,” Lewis said in a telephone interview, but he added: “I haven’t seen as explicit a statement on this as the one” Mills made.

Pentagon spokesman Lt. Col. Damien Pickart declined to elaborate on Mills’ comments, saying in an email that “for reasons of security . we do not provide specific information regarding our intentions, plans, capabilities or operations.”

The email said that the Pentagon’s cyber operations were properly authorized and that they took place within the bounds of international law and the “confines of existing policy.”

U.S. defense planners have spent the past few years debating that policy, asking how and under what circumstances the Pentagon would launch a cyber attack against its enemies, but it’s only recently become apparent that a sophisticated program of U.S.-backed cyber attacks is already under way.

A book by The New York Times reporter David Sanger recently recounted how President Barack Obama ordered a wave of electronic incursions aimed at physically sabotaging Iran’s disputed atomic energy program. Subsequent reports have linked the program to a virus dubbed Flame, which prompted a temporary Internet blackout across Iran’s oil industry in April, and another virus called Gauss, which appeared to have been aimed at stealing information from customers of Lebanese banks. An earlier report alleged that U.S. forces in Iraq had hacked into a terrorist group’s computer there to lure its members into an ambush.

Herbert Lin, a cyber expert at the National Research Council, agreed that Mills’ comments were unusual in terms of the fact that they were made publicly. But Lin said that the United States was, little by little, opening up about the fact that its military was launching attacks across the Internet.

“The U.S. military is starting to talk more and more in terms of what it’s doing and how it’s doing it,” he said. “A couple of years ago it was hard to get them to acknowledge that they were doing offense at all — even as a matter of policy, let alone in specific theaters or specific operations.”

Mills’ brief comments about cyber attacks in Afghanistan were delivered to the TechNet Land Forces East conference in Baltimore on Aug. 15, but they did not appear to have attracted much attention at the time. Footage of the speech was only recently posted to the Internet by conference organizers.

 

Direct Link:   http://www.marinecorpstimes.com/news/2012/08/ap-we-hacked-enemy-afghanistan-cyberwar-082412/

Aug 232012
 

Hurricane Andrew at 20: Miami Herald Reporters Remember

Miami New Times
By Chuck Strouse
August 22, 2012

 

 

 

>>>>   See the Slide Show of 80 Heart Breaking Pictures from Hurricane Andrew’s Devastation! <<<<

 

Hours after Hurricane Andrew leveled Miami 20 years ago this Friday, the farmland of South Dade’s Redland was desolate. No one for miles. No running water. Little electrical power. Few phones.

I slalomed my rusty Chevy pickup down a strip of black asphalt littered with shingles and downed trees. Then, in the middle of the road, there was a washing machine. It had been plucked from a home far away and dropped there whole. I steered to miss it, and my truck suddenly jerked from 30 mph to a dead stop. Bang. I would have been dog meat if it weren’t for the seat belt. No cell phones back then. No way to call for help.

I flopped out to find a power line thick as a wrist jammed in the suspension. I stripped off my shirt as insulation, wrapped it around a metal wrench, and touched the cable. No juice. Then I lay down, scorched my back on the pavement, and began tugging. It didn’t move. Not a hair.

So I grabbed a tiny pair of pliers and began snipping, one strand at a time. Three hours and a gallon of sweat later, I started her up and hurried to a trailer in Homestead. I was a Miami Herald reporter then, and I typed out the story, barely making deadline on an interview with a guy who had escaped a home that Andrew blew away and then found temporary refuge in another, also demolished by the worst wind.

Amid this week’s remembrances of the storm that cost the United States more than $25 billion, claimed 26 lives, and left more than 250,000 people homeless, little has been said of the reporters who covered it. The Herald, then a much larger paper, won a Pulitzer Prize Gold Medal for its journalists’ coverage.

 

 

That storm shaped how the media covered Katrina, 9/11, this year’s drought, and myriad other disasters. So I asked some former Herald reporters for their memories.

Ana Menendez (then a Broward reporter, now an author of two novels and two short-story collections): Two days before the storm, I was on rotation in the Hollywood bureau. I had been scheduled to cover some firefighter event, but the editor on duty said, with a trace of contempt, that the Sun-Sentinel had made a big deal about some storm out there, so I should probably head over to Publix instead and see if people were stocking up. At the store, no one I interviewed knew anything about an impending hurricane. Finally, I ran into an elderly man with a shopping cart full of water and canned goods. He knew all about Andrew, was tracking the coordinates, and was taking no chances. Soon we were all going to become that elderly fellow. We just didn’t know it.

Marty Merzer (then a senior writer, now a North Florida freelancer and grandpa): As an intensifying Andrew approached, I was tapping away like crazy about the first hurricane to threaten South Florida in decades, when assistant managing editor Ileana Oroza walked by. She stopped for a second, smiled impishly, and said, “As you write, don’t even think about the fact that you’re writing the story that every Herald reporter has waited to write for the last 30 years.”

Marie Dillon (then an assistant state editor, now a Chicago Tribune editorial writer): As the storm approached the Herald building, we couldn’t stop ourselves from watching out the windows over the bay, even though everyone kept telling everyone else to stand back from the glass. The water was sometimes churning up so high it washed over the bridge. Once in a while, a lone car would come flying over the bridge, carrying a driver who, I assume, had decided not to try to ride it out on the island after all.

Later, as I settled in on the state desk, I looked across at my boss, John Pancake, and said, “Is this building hurricane-safe?”

He gave me his wry little smile and said, “We don’t know.”

 

http://i.huffpost.com/gadgets/slideshows/242230/slide_242230_1409153_free.jpg?1345602018000

 

Lizette Alvarez (then a reporter, now a New York Times Miami bureau chief) and Don Van Natta (then a reporter, now a senior reporter for ESPN the Magazine and Lizette’s husband): When Hurricane Andrew hit the coast, we thought the storm had bypassed us altogether. We were at the Comfort Inn in Florida City, one of several cities randomly chosen by editors who hoped to have reporters on the ground when the storm hit. From our rooms, we heard a stream of radio reports of people describing vicious, house-rattling winds from their bathrooms and closets. Every five minutes or so, we would open our motel door, walk out, and feel nothing but stillness and disappointment.

Just as we settled in for a night of boredom, Andrew spun our way, launching us on a game of hide-and-seek that would last all night. The winds hit the Comfort Inn so abruptly we were forced to dash from room to room as the roof flipped off in chunks. We met up with a dozen or so tourists during this race to outrun the motel’s demolition. The hotel manager saved all our lives by warning us that the winds would shift after the eye of the storm and we should head for the intact rooms facing north.

Then, at the tail end of the storm, a group of us was trapped in one room. The air pressure outside wouldn’t let us open the door. The roof rattled, and the walls started to buckle. We dragged a mattress to the bathroom and tried to shield our heads. One woman started crying. A couple of us kept racing to the door to force it open, but it wouldn’t budge. I stepped into the bathtub with several others and we started to pray.

Don and another man pushed up on the bathroom roof with all their brawn. The roof lifted and slammed back down. It did it again and again. The howls were so deafening it was hard to stay calm.

Somebody ran to the door again — and this time it finally opened. By the time we rushed out of the room, it was cracking open.

We waited out the storm a few more hours and then found a German tourist, terrified but unscathed, under a mattress in a room that had been torn to shreds. When the sun finally peeped over the horizon, we stood on an untouched slice of balcony and looked out. Florida City was unrecognizable.

 

 

Joe Tanfani (then a reporter, now a Los Angeles Times Washington bureau reporter): I was considered a tiny, dwarfish talent and pretty much stuck in the office after the first day. One thing they had me doing was trying to track down the estimable Dade County mayor, Steve Clark. I wrote this story that pretty much said he was missing in action, and some time later, he chewed me out: “You know what I was doing? I was trying to get the water turned on at the Herald building!”

Ileana Oroza (then an assistant managing editor, now a University of Miami instructor): I spent the night on the floor in my office, and my visiting nephew was with me. I had just managed to fall asleep around 3 or 4 a.m. when the phone rang. It was a journalist from Israel wanting a report on the hurricane. After the storm, we gathered around the copy desk to plan our next move. It was about 8 a.m. when the phone rang. One of the editors answered, and after a few seconds, said in a pleading voice: “Sir, we just had a hurricane.” The caller was an annoyed reader asking why his newspaper hadn’t been delivered.

Andrew Innerarity (then a staff photographer, now a freelancer): When the storm hit, I was on a three-month leave of absence to backpack Europe. I came back a week after the storm with no idea how serious the whole thing was. The flight from London to MIA landed at night, and on approach, I’ll never forget seeing a huge line of emergency vehicles, lights flashing someplace in Southwest Dade.

Once back at work in early September, I headed to Homestead every day for months. At city hall, the smell from the tons of donated clothing, which had been rained on daily, was unreal. The devastation was so thorough I could hardly recognize anything in the region.

I remember an Airborne soldier telling me how trashed the Air Force base was. He said the devastation was so complete that if the military “had attacked the place, the only thing [it] would have done different was crater the runway.”

 

Direct Link:   http://www.huffingtonpost.com/2012/08/21/hurricane-andrew-20-reporters-remember_n_1819897.html