Category: Warnings

On Tuesday, a company spokesman declined to specify where Microsoft had found the attack code, saying only that the new warning came after Microsoft became “aware of detailed, reliable, public exploit code.”

“We are aware that people are working to develop reliable public exploit code for the vulnerability,” acknowledged Christopher Budd, a spokesman for the MSRC, in an entry he wrote Sunday.

Previously, Microsoft said that it discovered the vulnerability after a small number of attacks had resulted in infections by an information-stealing Trojan, which it dubbed “Win32/MS08067.gen!A” and third-party anti-virus vendors tagged with their own names. “The malware situation remains the same, as we’ve not seen any self-replicating worms, but instead malware that would be classified as Trojans, specifically the malware we discussed when we released the security update on Thursday.”

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9118341

A few of the more uninformed, but more vocal, readers (less than .2 percent of those who read the story, by the way) howled in protest. Google Analytics does nothing more than aggregate page visitors, they argued. Surely, there’s no way it could give someone outside the Obama camp access to one of the more popular websites in the .gov domain.

To use Google Analytics, webmasters call up a javascript file hosted by Google called urchin.js. Google engineers wrote the program and they control what it does. It is granted precisely the same read and write privileges on Change.gov’s administration page as a piece of code written inhouse. “By referring to javascript that’s hosted elsewhere, you’re basically at the mercy of that other organization, which is in this case Google, to not do evil with it,” says David Campbell, a security consultant and a leader of the Open Web Application Security Project (http://www.owasp.org/) (OWASP). “By Change.gov pointing to javascript from somewhere else, that vulnerability is there.”

Campbell and three other website security experts interviewed for this story say it would be trivial for anyone with control of the urchin.js file to hijack authentication cookies or other session variables used to validate users accessing the Change.gov administration page.

Dinis Cruz, an OWASP board member and director of advanced technologies for source code assessment firm Ounce Labs, says such exploits could prove especially effective if combined with attacks on browsers or network infrastructure. “If that urchin.js can be controlled by somebody with malicious intent (and with the latest DNS exploits (http://www.theregister.co.uk/2008/08/06/kaminsky_black_hat/) they don’t even need to control the google server), then the content of those Obama sites could be manipulated,” he writes in an email to The Register. Besides using a rogue urchin.js to steal session cookies or sniff data typed into forms, Cruz envisions other, more exotic attacks, among them one called a cross site script proxy, which essentially causes the attacker to control a user’s login session. “If I wanted a backdoor into the website, this would be one of the best ways to do it,” Cruz says. “It would allow somebody who knew about this to drop a payload in a way that almost wouldn’t be detected.”

Where the four disagree is how easy it would be for Obama insiders or others to identify a plot as sinister as a rogue urchin.js that steals session details from Change.gov. Because the code would be pushed to anyone using Google Analytics, the malicious payload would surely be noticed by millions of people and quickly reported, Campbell says.

Cruz, along with Jeremiah Grossman, CTO of White Hat Security, a firm that does web application security assessments, isn’t so sure. That’s because execution of the urchin file is automatic and seamless, and there is no easy way to view its source code. “It will probably change regularly to fix bugs and add features and I don’t think anybody notices.”

The real question should be: Why is the future President of the United States building a .gov website that makes such a scenario possible?

Ask 10 security auditors if it’s a good idea to put any third-party company’s javascript on an administrative panel to a website where security is paramount and they’ll all say no.

(We reached out again to Blue State Digital (http://www.bluestatedigital.com/), the firm that built the content management system for Change.gov, but they turned down our request for an interview. The company still hasn’t said whether the system has been audited by an outside security firm.)

“They’re creating additional vulnerability surface and there’s no clear business case for why they’re doing it,” says Campbell.

http://www.theregister.co.uk/2008/11/22/google_analytics_as_security_risk/

“We will continue to monitor the situation and post updates to the advisory and the MSRC blog as we become aware of any important new information,” he said yesterday.

Also on Thursday, Microsoft published its monthly pre-patch notice outlining what would be fixed next week. Although six of the 11 expected updates will affect Windows, and two of those six will affect the editions called out by the April advisory, Microsoft does not provide enough detail prior to patching to determine whether one of those will fix the privilege elevation flaw.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9116924&source=NLT_PM&nlid=8

Sadly, it turns out that many Web sites do not properly set the “Encrypted Sessions Only” property of their cookies.

Because HTTPS cookies are full of tasty authentication information, they can be used to access online banking accounts, Webmail accounts, and the like.

Perry proposes the following test to see whether sites you use are vulnerable: “To check your sites under Firefox, go to the Privacy tab in the Preferences window, and click on ‘Show Cookies.’ For a given site, inspect the individual cookies for the top level name of the site, and any subdomain names, and if any have ‘Send For: Encrypted connections only,’ delete them.

Having tried these steps with two “Encrypted connections only” Google (NSDQ: GOOG) cookies, Google appears to be vulnerable to a CookieMonster attack. A Google spokesperson confirmed this to be the case and said the company’s engineers are working with Perry to eliminate the vulnerability.

http://www.informationweek.com/news/security/vulnerabilities/showArticle.jhtml;jsessionid=2P0R3N2D1VQU4QSNDLPCKH0CJUNN2JVN?articleID=210601197

Visitors to a compromised Web site could find their browser executing a Javascript file — simply named 1.js or 1.htm — embedded in the iframe, leading to another site that would attempt to install keylogging software by exploiting several different vulnerabilities.

“The exploits target Microsoft applications, specifically browsers not patched against the VML exploit MS07-004 as well as other applications,” security firm Websense stated in a research note last week. “At the moment it appears that a small set of people are behind these attacks,” the group said.

http://www.securityfocus.com/brief/729?ref=rss

Web services are typically XML-based, and HTML is the language needed to design Web pages, upon which mashups reside. “You have to explicitly design that in,” he said. “And by explicit, that means you have to design authentication and authorization into the way that the service responds to consumers. Mashups, by their nature as a composition of services, don’t introduce new security issues, Schmelzer said.

“The security issue in composition is the problem of security context in which you have to deal with the fact that composing different systems might mean trying to span different identity domains, which is a significant problem for companies that have not made a prior investment in identity management systems,” he said. That said, the security issue is not a fatal flaw for SAAS, mashups and SOA, Schmelzer said.

Douglas Crockford, a senior JavaScript architect at Yahoo who is know for discovering the JavaScript Object Notation, said there’s been nothing really new done to HTML since 1999, which has led to security problems and security risks down the line for technologies such as mashups. “We’ve been so distracted by XML that HTML has not gotten the attention it needs,” said Crockford, who was on the panel at the show..

Michael Day, founder of YesLogic and the architect of the Prince formatter, said XML does have a future on the Web, if only as a server technology. XML seems to have gone the way of other technologies, such as Java, that started out as client-side technologies and ended up in the server realm, Day said.

http://www.eweek.com/article2/0,1759,2227704,00.asp?kc=EWRSS03119TX1K0000594