Downclimb

2014.11.14

RSS feed

Downclimb: Summit Route’s Weekly Infosec News Recap
2014.11.07 – 2014.11.14: https://SummitRoute.com

Quotes

“If I didn’t love hilarious bugs so much, I think I’d be worried how thoroughly f***ed literally everything is :-)” halvarflake

Top stories

Stay protected

Patch Tuesday happened this week and a new version of EMET was released. EMET 5.1 improves compatibility issues with some common applications, improves resiliency against some attacks against EMET itself, and added Local Telemetry[1,2].

  1. http://support.microsoft.com/kb/3015976
  2. http://blogs.technet.com/b/srd/archive/2014/11/10/emet-5-1-is-available.aspx

Darkhotel

Kaspersky reports on a threat actor that targets businesses professionals using hotel wifi. The group may be only targeting specific people when they logon to hotel wifi. The malware is signed with certificates that appear to have come from legitimate vendors who were not compromised, but rather these vendors’s certificates are cryptographically weak, allowing the attackers to duplicate the certificates.

  • http://securelist.com/blog/research/66779/the-darkhotel-apt/

Microsoft open-sourcing .NET, new version of Visual Studio

Microsoft had previously open-sourced a big chunk of .NET, but it will now be open-sourcing the compiler, run-time, and all libraries. Microsoft released a tech preview of Visual Studio 2015 which has support for compiling for Android via clang and the LLVM, and will also support iOS. They also are phasing out the Visual Studio Express editions (the free version of Visual Studio) for what they are calling Community Edition (which is free), with the main improvement being that it allows plugins now (something the free Express editions didn’t).

  • .NET open-sourced: http://arstechnica.com/information-technology/2014/11/microsoft-open-sources-net-takes-it-to-linux-and-os-x/

Explanation of American Fuzzy Lop

lcamtuf explains his AFL project by having it transform a file that simply says “hello” into a valid JPEG. AFL fuzzes executables by monitoring what branches are taken in the executable, and changing the input automatically in order to explore as many branches as possible.

  • http://lcamtuf.blogspot.com/2014/11/pulling-jpegs-out-of-thin-air.html

Exploitation modelling

One of problems new bug hunters run into is they don’t think through their exploit scenarios very well. The “flaws” they find might require full access to the user’s computer first, which means the attacker can do anything, including whatever it is the bug hunter found. This also affects a lot of attention grabbing news you see about things like auto hacking, where the attacker first needs physical access to the vehicle and then can turn on the turn signal or something, when they could have just as easily planted a bomb. This is discussed well in the following articles.

  • http://lcamtuf.blogspot.com/2014/11/exploitation-scenarios-matter-more-than.html
  • https://sites.google.com/site/bughunteruniversity/improve/writing-the-perfect-attack-scenario
  • https://sites.google.com/site/bughunteruniversity/nonvuln

Mobile Pwn2Own

HP ZDI’s mobile pwn2own competition took place in Tokyo this week[1,2], where the following were successfully exploited:

  • Apple iPhone 5S via the Safari browser
  • Samsung Galaxy S5 via NFC via two different techniques
  • LG Nexus 5 via forced BlueTooth pairing
  • Amazon Fire Phone via it’s browser
  • Windows Phone Lumia 1520 via the browser (exfiltrated cookies but did not escape the sandbox for full system control).
  • Nexus 5 running Android via wifi (however, did not elevate privs)

It’s safe to say at this point that phones and other mobile devices are just as exploitable as “normal” computers.

  1. http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Mobile-Pwn2Own-2014-The-day-one-recap/ba-p/6669592#.VGYdifk1r3Q
  2. http://h30499.www3.hp.com/t5/HP-Security-Products-Blog/HP-TippingPoint-Mobile-Pwn2Own-Day-2/ba-p/6670636#.VGTfrvn8D3Q

Software is not written, it is composed

Discussion involving HP’s Security Research and how many vulnerabilities are not in software that was written by the developers of a product, but rather is in a component used in that product.

  • http://www.computerweekly.com/blogs/quocirca-insights/2014/11/the-problem-of-buggy-software.html

Other reads