CyberSecurity Institute – Page 83 – Security News Curated from across the world

Critical denial-of-service flaw in BIND software puts DNS servers at risk

Posted on March 29, 2013December 30, 2021 by admini

A flaw in the widely used BIND DNS (Domain Name System) software can be exploited by remote attackers to crash DNS servers and affect the operation of other programs running on the same machines. BIND versions 9.7.x, 9.8.0 up to 9.8.5b1 and 9.9.0 up to 9.9.3b1 for UNIX-like systems are vulnerable, according to a security advisory published Tuesday by the Internet Systems Consortium (ISC), a nonprofit corporation that develops and maintains the software.

The vulnerability can be exploited by sending specifically crafted requests to vulnerable installations of BIND that would cause the DNS server process—the name daemon, known as “named”—to consume excessive memory resources.

“However, at the time of this advisory, BIND 10 is not ‘feature complete,’ and depending on your deployment needs, may not be a suitable replacement for BIND 9.”

“It took me approximately ten minutes of work to go from reading the ISC advisory for the first time to developing a working exploit,” a user named Daniel Franke said in a message sent to the Full Disclosure security mailing list on Wednesday. Franke is not the only one possible, and that operators of *ANY* recursive *OR* authoritative nameservers running an unpatched installation of an affected version of BIND should consider themselves vulnerable to this security issue,” Wright said. … Franke’s comment, which is that the required complexity of the exploit for this vulnerability is not high, and immediate action is recommended to ensure your nameservers are not at risk.”

This bug could be a serious threat considering the widespread use of BIND 9, according to Dan Holden, director of the security engineering and response team at DDoS mitigation vendor Arbor Networks.

…Several security companies said earlier this week that a recent distributed denial-of-service (DDoS) attack targeting an anti-spam organization was the largest in history and affected critical Internet infrastructure.

“If operators are relying on inline detection and mitigation, very few security research organizations are proactive about developing their own proof-of-concept code on which to base a mitigation upon,” Holden said.

Link: http://www.computerworld.com/s/article/print/9238002/Critical_denial_of_service_flaw_in_BIND_software_puts_DNS_servers_at_risk?taxonomyName=Malware+and+Vulnerabilities&taxonomyId=85

Java-based attacks remain at large, researchers say

Posted on March 28, 2013December 30, 2021 by admini

Within the digital attack space, crimeware kits — which can be purchase for as little as $200 — often come supplied with Java-based exploits.

Over 75 percent of browsers are using Java versions which are at least 6 months old, whereas nearly two-thirds are a year out of date, and 50 percent of Java versions in use are over two years behind the times in respect to Java vulnerabilities.

All in all, the researchers say that the vulnerable population of browsers is pegged at a staggering 93.77 percent.

Link: http://www.zdnet.com/java-based-attacks-remain-at-large-researchers-say-7000013131/?s_cid=e550

Antivirus apps knocked in malware report

Posted on March 28, 2013December 30, 2021 by admini

“Our analysis shows that of the more than 26,000 malware samples analysed, 70 per cent retained distinct identifiers or behaviours that can be useful for real-time control and blocking,” the report said.

The report said web-based applications were significantly more successful at avoiding traditional antivirus and remaining unknown for extended periods of time.

Link: http://www.scmagazine.com.au/News/337908,antivirus-apps-knocked-in-malware-report.aspx?utm_source=feed&utm_medium=rss&utm_campaign=SC+Magazine+News+feed

Antivirus apps knocked in malware report

Posted on March 28, 2013December 30, 2021 by admini

“Our analysis shows that of the more than 26,000 malware samples analysed, 70 per cent retained distinct identifiers or behaviours that can be useful for real-time control and blocking,” the report said.

The report said web-based applications were significantly more successful at avoiding traditional antivirus and remaining unknown for extended periods of time.

Link: http://www.scmagazine.com.au/News/337908,antivirus-apps-knocked-in-malware-report.aspx?utm_source=feed&utm_medium=rss&utm_campaign=SC+Magazine+News+feed

AWS Launches CloudHSM App To Bolster Data Security In The Cloud

Posted on March 27, 2013December 30, 2021 by admini

You retain full control of the keys and the cryptographic operations performed by the HSM(s) you create, including exclusive, single-tenant access to each one. Your cryptographic keys are protected by a tamper-resistant HSM that is designed to meet a number of international and US Government standards including NIST FIPS 140-2 and Common Criteria EAL4+.”

Users who sign up for the service will be provided with administrator credentials, allowing them to create user accounts, create and manage encryption keys, and perform other cryptographic-related tasks using their accounts.

It can be accessed via a number of standard APIs once provisioned, including Microsoft Cryptography API (CAPI), PCKS #11 (Cryptographic Token Interface Standard) and Java JCA/JCE (Java Cryptography Architecture / Java Cryptography Extensions).

Even so, it’s certainly not the cheapest solution around, with AWS demanding a cool $5,000 to provision a single CloudHSM, on top of the $1.88 hourly fee it charges (about $1,373 per month, on average).

Link: http://siliconangle.com/blog/2013/03/27/aws-launches-cloudhsm-app-to-bolster-data-security-in-the-cloud/

BIGGEST DDoS ATTACK IN HISTORY hammers Spamhaus

Posted on March 27, 2013December 30, 2021 by admini

Things remained calm for a few days before kicking off again with even greater intensity – to the extent that collateral damage was seen against services such as Netflix, the New York Times reports.

A blog post by CloudFlare, written last week before the latest run of attacks, explains the mechanism of the attack against Spamhaus and how it can be usde to amplify packet floods.

The basic technique of a DNS reflection attack is to send a request for a large DNS zone file with the source IP address spoofed to be the intended victim to a large number of open DNS resolvers. … The attackers’ requests themselves are only a fraction of the size of the responses, meaning the attacker can effectively amplify their attack to many times the size of the bandwidth resources they themselves control.

…The requests were likely approximately 36 bytes long (e.g. dig ANY ripe.net @X.X.X.X +edns=0 +bufsize=4096, where X.X.X.X is replaced with the IP address of an open DNS resolver) and the response was approximately 3,000 bytes, translating to a 100x amplification factor. “Because the attacker used a DNS amplification, the attacker only needed to control a botnet or cluster of servers to generate 750Mbps – which is possible with a small sized botnet or a handful of AWS instances,” it explains.

Link: http://www.theregister.co.uk/2013/03/27/spamhaus_ddos_megaflood/