Archive for July, 2013

Microsoft has announced Patch Tuesday for this July Month, with seven bulletins. Out of that, one is important kernel privilege escalation flaw and six critical Remote Code Execution vulnerabilities.
Patch will address vulnerabilities in Microsoft Windows, .Net Framework, Silverlight and will apply to all versions ofInternet Explorer from IE6 on Windows XP to IE10 on Windows 8.

Often targeted by attackers to perform drive-by malware download attacks, remote code execution flaws allow an attacker to crash an application and launch malware payloads often without any sort of notification or interaction form the user.

The Windows 8 maker is also patching a kernel vulnerability disclosed at the beginning of June by Google researcher Tavis Ormandy. The issue is to do with Windows kernel’s EPATHOBJ::pprFlattenRec function (CVE-2013-3660) and after Ormandy released the exploit code, Metasploit module was developed to exploit the bug.

Advertisements

Q-CERT team found a critical vulnerability that allows the attacker to bypass the two-factor authentication in the most popular file sharing service ‘DropBox’.

Two Factor Authentication is an extra layer of security that is known as “multi factor authentication” that requires not only a password and username but also a unique code that only user can get via SMS or Call.If an attacker already knows the username and password of the victim’s Dropbox account, which is protected by two-factor authentication, it is still possible to hack that Dropbox account using following explained technique.

DropBox does not verify the authenticity of the email addresses used to Sign up a new account, so to exploit this flaw hacker just need to create a new fake account similar to the target’s account and append a dot (.) anywhere in the email address.

In Next step, enable 2-factor authentication for the fake account, and save the emergency code generated at the end of the process. This emergency code feature is provided, in case user lost his phone, then using this backup code user can disable two factor authentication from his account.

Next, logout from the the fake account created by attacker and login into the victim’s account using the real credentials (attacker already have using any keylogger or phishing technique).Because 2-Factor authentication was enabled for victim’s account, so website will ask to enter the OTP code. Leave it, just choose “I Lost My Phone” from the same screen. You will be prompted to use the “Emergency Code”, that can disable the 2-Factor authentication.

That’s it ! Use the emergency code generated from the fake account to disable 2-Factor authentication for the victim’s account and enjoy full access.

Researchers say they have found a cryptographic flaw that could allow almost any Android phone to be hijacked.

The undisclosed vulnerabilities allow attackers to silently turn legitimate applications malicious by modifying the apk code without breaking the app’s cryptographic signature.

Attackers could exploit the flaw to gain full access to an Android device allowing data theft, access to enterprise networks, or the ability to form a botnet from mobile devices.

Baseband modified

Baseband modified

 

“The [trojan] application then not only has the ability to read arbitrary application data on the device, retrieve all stored account and service passwords, [but] can essentially take over the normal functioning of the phone and control any function thereof,” BlueBox chief technology office Jeff Forristal said.

“Finally, and most unsettling, is the potential for a hacker to take advantage of the always-on, always-connected, and always-moving [and] therefore hard-to-detect nature of these zombie mobile devices to create a botnet.”

Most at risk were devices that ran applications such as Cisco’s AnyConnect VPN which were granted special privileges like access to System UID by device manufacturers.

The bug could affect any Android phone released in the last four years or operating firmware above version 1.6 (Donut), Forristal said, declaring 99 percent of devices vulnerable. Google has activated 900 million phones to date.

Forristal said discrepancies in how Android applications were cryptographically verified and installed meant APK code could be modified without breaking the cryptographic signature that checked the legitimacy of Android apps.

“This vulnerability makes it possible to change an application’s code without affecting the cryptographic signature of the application – essentially allowing a malicious author to trick Android into believing the app is unchanged even if it has been,” Forristal said.

BlueBox reported the bug to Google in February but it would be left to device manufacturers to push out firmware updates, a feat they were notoriously lax in.

He said enterprises should force users to update their phones connected to the corporate network and should move to focus on deep device integrity checking. Individual users should be “extra cautious” in identifying app publishers.

Source : scmagazine.com.au