Clampi Virus

As the world deal with the swine flu virus, there is an equally destructive virus / trojan that affects the computing world. It is known as Clampi  and it is one of the deadliest trojans that is making the rounds on the Internet, According to a report, it is operated by a serious and sophisticated organized crime group from Eastern Europe and has been implicated in numerous high-dollar thefts from banking institutions.

Typically, trojans such as this gets installed when people open infected attachments or even by simply visiting a web page using a vulnerable browser or other applications such flash, pdf, etc. Such web sites that people visit could be intentionally or they may be taken to those web sites unintentionally by clicking on some links on a regular / normal site and that site may have some XSS or other types of vulnerabilities.

In any case, once the trojan gets installed it copies itself as one of the system executable such as svchosts.exe or event.exe in one of the folders. These are legitimate looking applications, so if you look in task manager, it is difficult to identify. However, the key here is that these files gets installed in a folder other than "C:\WINDOWS\system32" (in Windows XP). There are various tools such as "tlist" to identify which application (with the path) launched a process. The Trojan also make many registry changes, so understanding the registry structure and monitoring for changes is key here.

The Trojan then makes connections to various web sites that act as command and control centers and downloads tools that are required for 1) spreading to other machines 2) grab personal information from the machine, encrypt it and send it back the command and control center. One such tool it downloads is psexec, which is used to make connection to other machines in the network and then install the trojan there. In order to identify this behavior, security practitioners should have a good understanding of the normal behavior on the network and block unusual or unnecessary outbound connections from the internal network.

Some of the other key takeaways are:

• Don't use or provide administrative credentials to the regular users, use of administrative credentials enable the ability to install programs.
• Block all or unnecessary outbound access.
• Monitor unusual traffic on the network, should have a good understanding of the baseline traffic.
• Keep open file shares to a minimum or remove it altogether if possible. Periodically scan for open shares and audit it thoroughly.
• Users should be made aware of the dangers of visiting unknown web sites, clicking on unknown links, and downloading unknown files.
• Patch. Follow a strict vulnerability management process.
• Keep the antivirus signatures up to date. Automate identification of infected machines
• Be ready for incidents like this, practice incident response skills

Read some of the interesting write-ups on the Clampi virus / trojan.

http://www.secureworks.com/research/threats/clampi-trojan/?threat=clampi-trojan

http://voices.washingtonpost.com/securityfix/2009/07/clampi_trojan_the_rise_of_matr.html?wprss=securityfix

Vulnerabilities in Visual Studio Active Template Library

Microsoft released an out-of-band security bulletin to address security bugs in the Active Template Library. Microsoft strongly recommends that developers who have built controls or components with Active Template Library take immediate action to evaluate their controls for exposure to a vulnerable condition and follow the guidance provided to create controls and components that are not vulnerable. Many versions of Visual Studio application are affected.

What is Active Template Library?

The Active Template Library is a set of template-based C++ classes with which you can easily create small, fast Component Object Model (COM) objects such as ActiveX controls.

More details are here:

http://www.microsoft.com/technet/security/bulletin/ms09-035.mspx http://www.microsoft.com/technet/security/advisory/973882.mspx http://msdn.microsoft.com/en-us/visualc/ee309358.aspx http://blogs.msdn.com/sdl/archive/2009/07/28/atl-ms09-035-and-the-sdl.aspx

http://blogs.technet.com/bluehat/archive/2009/07/27/black-hat-usa-atl-killbitbypass.aspx

http://msdn.microsoft.com/en-us/library/727z646z%28VS.71%29.aspx

Another large data breach involving credit cards

A breach at Network Solutions exposed a large number of credit card information. According to various reports, hackers inserted code on Network Solutions’ servers that sniffed customer credit card number and personal information. The breach affected accountholders of Network Solutions domain registration and Web services, as well as numerous online retailers that utilize the company’s hosting and online payment services.


After Heartland Payment Systems breach early this year, this is another payment gateway, which shows that hackers are increasingly targeting such organizations and credit card information in general.


More information is available here

SQL Injection videos

Along with XSS, SQL injection is one of the most dangerous and the most exploited web application vulnerability, I wrote about it here.

Many organizations and individuals struggle with differentiating network wide and data centric attacks and proving that Firewall and traditional perimeter security does not prevent many such attacks. Demonstrating data centric attacks is a great way to make them understand these types of threats and how to defend against them.

Just as a refresher, relational databases such as Oracle, MS SQL, Sybase, MySQL store data in the form of related tables of records. Such records can be accessed, queried, or modified by specially formatted statements. The standard format for these types of queries are made using a standard called Structured Query Language or SQL. With the need to access these records from a web front end, SQL injection attacks became popular. So, SQL injection is nothing but a set of SQL commands.

Folks at imperva have put together great educational videos on this and other web application security areas, go check it out.

http://blog.imperva.com/2009/04/sql-injection-demonstration-vi.html

http://blog.imperva.com/2009/05/sql-injection-demonstration-vi-1.html

http://blog.imperva.com/2009/05/sql-injection-demonstration-vi-2.html

http://www.youtube.com/user/ImpervaChannel

CISSP sample tests

Many CISSP aspirants ask me this question, what is the best source of free sample tests? Here is a great source, they have many sample tests covering CISSP domains, check it out.

http://www.freepracticetests.org/quiz/quiz.php

Nmap 5

A new version of Nmap is out, some of the new features include: Addition of Ncat tool for data transfer, redirection, and debugging. This helps in interacting with web servers, mail servers or malware infected machines.

Addition of Ndiff tool to aid in the comparison of Nmap scans. It takes two Nmap XML output files and prints the differences between them.

Improved scripting engine (it was introduced in 4.5 version). This allows users to create simple scripts to automate a wide variety of networking tasks. Nmap added 32 more scripts, they are available here

Improved Zenmap Gui (also introduced in 4.5 version), which is a GUI version of Nmap. It comes with the capability to map a network then save as an .svg file (scalable vector graphic) for visual labeling, or documentation. These files can be used with the open source vector graphic tools like like Inkscape.


I grabbed the latest GUI version and ran a scan against my Linksys Router, here is the output:

If you want to learn more about Nmap, Fydor's book is the best hands down. Part of that book is available for free here

End of Milworm

A very sad day for information security professionals. One of the web sites that helped many incident responders, security researchers, PenTesters, and script kiddies alike is shutting down.


Here are some of the alternatives

http://metasploit.com:55555/EXPLOITShttp://www.governmentsecurity.org/forum/index.php?showforum=23

http://www.securiteam.com/exploits/

http://packetstormsecurity.com/

http://www.secwatch.org/exploits/http://inj3ct0r.com/ A Milworm clone

Milworm Tarball


Update: The creator of Milworm, with the help of many others will keep the site up and continue to do the great work.

Twitter security problems

Are you a twitter user? If yes, you need to consider the many worms and other issues that affect twitter, here are some of the recent ones.


http://www.twitpwn.com/2009/07/motb-01-multiple-vulnerabilities-in.html

http://www.techcrunch.com/2009/05/26/warning-twittercut-worm-plays-on-peoples-desire-for-more-followers

http://blogs.zdnet.com/security/?p=3669

http://blogs.zdnet.com/security/?p=3451

http://blog.twitter.com/2009/04/unauthorized-access-update-on-security.html

http://netnewsdaily.com/2009/04/12/twitter-attacked-by-stalkdaily-worm/

Apart from the many worms and exploits listed above, as early as last month it's SSL page was using MD5 hashing with RSA encryption, it has been corrected now. If you remember, back in December 2008, a group of researchers identified a problem with MD5 collision, which affects SSL sites signed with MD5 hash. The exact problem is described in the Microsoft security blog,

"An MD5 hash collision allows a malicious user to potentially generate a rogue certificate derived from a valid one. This user can then impersonate a valid site or person since both certificates look legitimate because the certificate hashes are the same. An attacker will have to lure a user to initiate an SSL/TLS connection, then the certificate will be validated by the client and it will seem valid. Thus, the user will think that it is establishing a safe connection with site or person when in fact it is connecting with the attacker."


Another method to verify this is using the "SSL Blacklist" Firefox add-on

Secunia PSI

Check my earlier post on this topic.

Secunia PSI is one of my favorite programs, a new release is out with some new features, check it out

Information Security Policies

While doing some research, I came across this Cisco study.

There are two interesting policy findings,

• Majority of businesses (77 percent) have security policies in place.
• More than half of the employees surveyed admitted that they do not always adhere to corporate security polices.

So, what are the reasons for it? In my view there are many possibilities,

• Policies are not defined correctly
• Users are not able to understand it
• It is not aligned with the business processes
• It does not have management's and business leader's buy-in
• It is not communicated properly
• There are no monitoring mechanisms in place to verify compliance
• There are no action taken in case of policy violations