A take on the security news, week 39
Monday
OS X Keychain Extraction Tool
A new tool for analysing the OS X keychain. One of the issues exploited is the fact that the masterpassword is stored in memory (to avoid user to enter their password every time). If you have root access to the osx machine the tool will dump the memory, scan for memory used by the keychain and try to find interesting data.
Lots of details on how the osx keychain works in this paper.
Internet of things security, Heatmiser WiFi thermostat vulnerabilitites
As more and more devices in our home are connected to the Internet, I want to focus on Internet of things security.
This appliance in this article has vulnerabilities which is possible to exploit remotely, but there is no way to update the appliance from the net. So exploiting is easy, patching is hard. You have to connect a programmer to the appliance to upload the patched firmware. If you see scan on port 8068 it might be someone looking for a vulenable thermostat.
The articles list a lot of issue with this appliances, like open to csfr attacks, default web credentials, in browser santising of inputs and more.
http://cybergibbons.com/security-2/heatmiser-wifi-thermostat-vulnerabilities/
Tuesday
October is the 2014 Cybersecurity month
For this October the community pinpointed on the agenda the following weekly NIS topics:
1st week: Training employees, targeting public and private organizations;
2nd week: PC and mobile security protection and updates, targeting all digital users;
3rd week: Coding, targeting students
4th week: Cyber security exercises, targeting technical expertise;
5th week: ePrivacy, targeting all digital users
iOS 7 Exploit released
The exploit comes in the form of a malformed PDF, which would usually be delivered as an image inside an HTML page. The exploit triggers an memory corruption which can lead to remote code execution. Upgrade to iOS 8 if you have the possibility to do so.
https://isc.sans.edu/forums/diary/iOS+7+1+x+Exploit+Released+CVE-2014-4377+/18693
Wednesday
jQuery.com Malware attack
Credential stealing malware was detected as a drive-by-download from jquery.com. This is problematic due to the fact that it iss many enterprise webadministrators and developers visiting jquery.com. This is people which often have priviliged access to servers and services. Lesson to be learned: Keep your normal account separated from your priviliged administrator account.
Another aspect of this attack is that many sites relies on jQuery by linking to the library that is hosted on jquery.com (instead of download and link it locally). This make sites vulnerable to an attack on the jquery.com hosted version of the libraries (which is not proven to be the case in this attack). Lesson to be learned: Dont rely on remotely hosted code, but create a copy and host the bits & pieces yourself.
Microsoft Expanding Bug Bounty
A lot of online services are now subject to bug bounty submissions.
http://technet.microsoft.com/en-US/security/dn800983
iPhone 6 Fingerprint Sensor as (in)secure as the previous one
https://blog.lookout.com/blog/2014/09/23/iphone-6-touchid-hack/
Thursday
Critical update for bash
If a attacker can set an environment variable, he can use this to execute code. For the exploit to work you need to access to the server, so its not a big deal for most normal bash users. The biggest problem here is all the webservers that runs cgi-bin scripts.
This bug affects bash on most platforms (Linux, OSX, FreeBSD +++).
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-6271
jQuery 2nd compromise
A new attack was launched against jQuery's site today. This attack seems to be unrelated to the first one, and was trying to deface the website. Lesson learned: Its now time to start hosting your jQuery libraries instead of downloading them from their content delivery network.
http://blog.jquery.com/2014/09/24/update-on-jquery-com-compromises/
Friday
An update on the bash bug, now named shellshock
The first patch issued was not complete, but hopefully the second patch did the job. The proof-of-concept exploit is at least patched now. It is also discovered that attackers can use DHCP servers as an attack vector.
https://isc.sans.edu/forums/diary/Update+on+CVE-2014-6271+Vulnerability+in+bash+shellshock+/18707
https://isc.sans.edu/forums/diary/Webcast+Briefing+Bash+Code+Injection+Vulnerability/18709/1#32107
Critical NSS update from Mozilla
Mozilla has issued an update to the Network Security Services (NSS). It was discovered that NSS is vulnerable to a signature forgery attack previously published by Daniel Bleichenbacher. This means that a user can connect to a site with a forged RSA SSL certificate without being warned.
The bug affects: Firefox, Firefox ESR, Thunderbird, Seamonkey and NSS.
https://www.mozilla.org/security/announce/2014/mfsa2014-73.html