Archive | January, 2012

Automated SQLi Attack Hijacks Over 1 Million Websites

In past, malicious web sites seemed relegated to the “bad neighborhoods” of the Internet. If you weren’t surfing piracy, pornography, or hacking sites, you probably wouldn’t have randomly encountered websites serving malicious code back then. Unfortunately, that has changed.

Over the years, legitimate web sites have increasingly been hijacked, and booby-trapped with malicious code. If you visit such a site with an unpatched system, your computer may automatically and silently download and install some nasty malware. Lately, attackers have often hijacked thousands of web sites at once. What’s to blame for these mass web hijacks? More often than not; automated SQL Injection (SQLi).

According to researchers at SANS, an automated SQL injection (SQLi) attack dubbed Lilupophilupop has infected over one million websites (the strange name is based on a malicious domain the attack references). This latest bout of automated SQLi attacks targets Microsoft web frameworks (IIS servers using ASP.NET, with a MSSQL backend), and first surfaced in early December. Back then, the attack had only affected a handful of sites. However,  SANS’ latest research shows that it has spread to just over a million web sites today.

If you’d like to know more about this attack, you can find details about it, including the malicious SQL string it uses, in SANS’ early December post. That post also shares tips to help IIS administrators and web developers identify vulnerable pages on their site. It’s well worth a read.

In general, the best way to protect yourself from these sorts of web application attacks (whether automated or not)  is to have your developers learn how to follow secure coding practices for web applications. The Open Web Application Security Project (OWASP) is a fantastic resources for web developers to learn these practices. That said, sometimes the web frameworks you rely on will have their own vulnerabilities, which you can’t avoid (until you can patch). That’s why having a security appliance that can do application-layer security inspection, and has strong IPS, doesn’t hurt either.

As an aside, SQLi is a class of attack that many IT professionals have heard of conceptually, but some may not really get technically. Below, I’ve posted a demo video I created for one of my security presentations. It illustrates a very simple, manual SQLi attack. I use this simple SQLi example to help illustrate the concept behind them. You should check it out if you want a better idea how they can work.  Do know, however, today’s modern websites don’t suffer from such obvious examples of SQLi vulnerability as the one I demonstrate in this video. Modern websites still often suffer from SQLi flaws,they are just found in more complex places within today’s web applications. — Corey Nachreiner, CISSP (@SecAdept)

 

Wi-Fi Protected Setup (WPS) Undermines Wireless Security

Over the years, we’ve had to deal with vulnerabilities and weaknesses in wireless security protocols, such as the deprecation of the WEP protocol due to design flaws.  Now, a standard that was designed to make wireless security easier, actually makes it less secure.

For those of you who haven’t heard of Wi-Fi Protected Setup (WPS) — which frankly included me until recently — it is a standard created by the Wi-Fi Alliance to make it easier for home users to configure security settings on their access points, making the task less foreboding for the non-technical.

In concept, I think this is a great idea. I know many average home users that run open access points simply because they find the tech lingo (WPA2, PSK, AES, TKIP, etc.) too overwhelming, or because they can’t be bothered with strong passwords. Making wireless security easier for the average Joe is noble goal. However, in practice WPS will make your WAP less secure.

According to research by Stefan Viehböck (also discovered independantly by another researcher as well), technical flaws in WPS make it embarrassingly simple to brute force a WPS PIN. Without going into too much technical detail, the WPS protocol responds to failed authentication attempts in a way that will both tell you if the first four digits of the PIN are correct, as well as disclose the eighth digit of the PIN. This severely reduces the number of guesses necessary to learn a WPA PIN. Rather than providing the 100,000,000 possible combinations (108) that an eight digit pin should offer, this flaw allows attackers to find the PIN with only 11,000 guesses (104 + 103). Computers can go through 11,000 combinations in no time. Furthermore, many devices that use WPS apparently don’t lockout failed authentication attempts. If an attacker knows your wireless router’s WPS PIN, he can use it to retrieve the router’s wireless network password. So if you use WPS, you should expect  any attacker within range of your Wi-Fi signal can access your network.

The good news is that WPS is not an industry-wide standard. Only some wireless routers and access points use it. If you’d like more details on this issue, US-CERT has released a coordinated alert about it, including some of the router brands that are affected. This includes some well know consumer brands like Belkin, Netgear, D-Link, and others. Since this is a protocol level design flaw, there is no fix. If you use a wireless router that leverages WPS, you should stop using WPS.

By the way, if any WatchGuard wireless appliance owners are concerned with our devices, we do not use WPS and are not affected by this issue.

UPDATE: Researchers have posted a working Proof-of-Concept attack tool for this WPS attack. If you have a device that uses WPS, I highly recommend you disable it, or apply any vendor updates related to this issue. — Corey Nachreiner, CISSP (@SecAdept)

Security Stories You May Have Missed Over the Holidays

If your office gets quiet around the week leading up to Christmas and New Years, as many seem to, you may have missed a few interesting security stories during this lull. Let me catch you up in one fell swoop.

Below, I quickly highlight a menagerie of interesting security stories, which you may have missed over the past two weeks:

  • Unpatched Vulnerability in Windows Win32k.sys Component – According to reports, a “researcher” calling himself webDEViL found a memory corruption flaw in Windows’ win32k.sys component. By enticing you to a web site containing malicious code, an attacker could exploit this flaw to execute malicious code on your computer, with your privileges. So far, webDEViL has only been able to exploit the flaw via Safari, which isn’t a very popular web browser for Windows systems. That said, it does affect fully patched Windows 7 64-bit systems, thus poses a fairly severe risk to Windows-based Safari users. Microsoft has not released a patch yet, but I will  follow up when they do. For more information, see Secunia’s advisory.
  • Siemens Accused of Security Cover-up – Siemens has received a lot of attention from the security industry lately. It first started with the infamous Stuxnet malware, which owned Siemens-based software and equipment, and opened many peoples eyes to the possibility of digital SCADA and ICS attacks. Since then, many researchers have focused on SCADA system vulnerabilities, including a recent example where a researcher found a SCADA system exposed on the internet with only a three character password. The latest drama comes from a security researcher’s blog, where he accuses Siemens of lying about a security flaw in one of their products. In short, Billy Rios (the researcher) is unhappy that a Siemens PR person claimed there are no open issues regarding authentication bypass bugs in Siemens products. As a result, Rios decided to publicly disclose just such an issue.
  • Free iPad 2 Offer Lures Gaga Fans – As they say on the Internet (and Star Wars), “It’s a trap!” According to PC Advisor, many users following Lady Gaga on Twitter and Facebook almost had their credentials stolen by following links about a free iPad 2 promotion.
  • Anonymous Still Up to No Good - During the holiday, Anonymous breached Stratfor, a “global intelligence” company in Texas. They reportedly stole 200GB of email, and a client list of 4000, including credit cards info. In the last week, Anonymous has also threatened to attack Sony and Nintendo due to their support of SOPA. As I predicted for 2012, I expect to continue to see these sort of Anonymous-related hacktivism incidents throughout the year.
That’s a small taste of some of the security stories that surfaced over the last few weeks. In general, we’re seeing more security stories a week than we have in years past. I expect 2012 to busy year for security professionals and the unprotected. — Corey Nachreiner, CISSP (@SecAdept)

Microsoft Releases Out-of-Cycle .NET Framework Security Update

Summary:

  • These vulnerabilities affect: All versions of Microsoft’s .NET Framework
  • How an attacker exploits it: Multiple ways, including sending specially crafted web requests or enticing users to click maliciously crafted links
  • Impact: Various. In the worst case, an attacker can log in to your web application as another user, without having  that user’s password
  • What to do: Install the proper .NET Framework update immediately, or let Windows Update do it for you.

Exposure:

Last week — following the holiday weekend — Microsoft released a blog post and Security Advisory about a new, publicly disclosed ASP.NET Denial of Service (DoS) vulnerability.

A few days later, they released an out-of-cycle Security Bulletin fixing that .NET Framework vulnerability, and three others. Whether you manage a public web server with ASP.NET applications, or host such .NET applications internally, we highly recommend you download, test, and deploy the appropriate .NET Framework updates as soon as possible.

Microsoft’s out-of-cycle .NET Framework security bulletin describes four vulnerabilities, including the publicly disclosed DoS vulnerability mentioned above. The vulnerabilities have different scopes and impacts. I detail two of the more relevant issues below, in order of severity:

  • ASP.NET Forms Authentication Bypass Flaw – ASP.NET doesn’t properly authenticate specially crafted usernames. If an attacker has (or can create) an account on your ASP.NET application, and knows the username of a victim, the attacker can send a specially crafted authentication request that gives him access to the victim’s account without needing a valid password. However, your ASP.NET web site or application is only vulnerable to this when you’ve enabled “Forms Authentication.”
  • ASP.NET HashTable Collision DoS Vulnerability – Without going into great technical detail, ASP.NET suffers from a flaw involving the way it hashes specially crafted requests. In short, by sending specially crafted ASP.NET requests to you web application, an attacker can fill ASP.NET’s hash table with colliding hashes, which can greatly degrade the performance of your ASP.NET application or web site. If you are technically inclined, and would like more details, we recommend reading n.run’s advisory concerning this flaw.
Microsoft’s bulletin also fixes a less severe privilege escalation vulnerability, as well as an insecure URL redirect flaw. For more details on these two flaws, see the “Vulnerability Information” section of Microsoft’s bulletin.

Solution Path:

Microsoft has released .NET Framework updates to fix these vulnerabilitie. If you have web servers or clients that use the .NET Framework, you should download, test and deploy the corresponding updates immediately.

Due to the exhaustive and varied nature of .NET Framework installations (1.1, 2.0, 3.5.x, and 4.0 running on many Windows platforms), we will not include links to all the updates here. We recommend you visit the “Affected and Non-Affected Software” section of Microsoft’s bulletin for those details.

If possible, we also recommend you use Windows Update to automatically download and install the appropriate .NET Framework on client computers. That said, you may still want to keep production servers on a manual update process, to avoid upgrade-related problems that could affect business-critical machines.

For All Users:

This attack typically leverages normal looking HTTP requests, which you must allow for users to reach your web application. Therefore, Microsoft’s patches are your primary recourse.

Status:

Microsoft has released updates to correct this vulnerability.

References:

This alert was researched and written by Corey Nachreiner, CISSP.

Follow

Get every new post delivered to your Inbox.

Join 7,384 other followers

%d bloggers like this: