Independent – Page 230 – Computer Security Articles

Credit to Author: SSD / Maor Schwartz| Date: Mon, 27 Nov 2017 08:12:04 +0000

漏洞概要以下安全公告描述了在Linux内核的AF_PACKET中存在的一个UAF漏洞，成功利用该漏洞可能导致权限提升。 AF_PACKET套接字”允许用户在设备驱动层发送或者接收数据包”。例如，用户可以在物理层之上实现自己的协议，或者嗅探包含以太网或更高层协议头的数据包。漏洞提交者一名独立的安全研究人员发现并向 Beyond Security 的 SSD 报告了该漏洞。厂商响应更新一 CVE:CVE-2017-15649 “该漏洞很可能已经通过以下方式修复了： packet: 重新绑定fanout hook时保持绑定锁定 – http://patchwork.ozlabs.org/patch/813945/ 与此相关，但未合并的是 packet:在packet_do_bind函数中，使用bind_lock测试fanout – http://patchwork.ozlabs.org/patch/818726/ 我们验证了在v4.14-rc2上不会触发该漏洞，但在第一次commit(008ba2a13f2d)上测试成功。” 漏洞详细信息该UAF漏洞是由于fanout_add(来自setsockopt)和AF_PACKET套接字之间竞争条件导致的。即使已经从fanout_add()创建了一个packet_fanout，竞争也会导致来自packet_do_bind()的__unregister_prot_hook()将po-> running设置为0。这允许我们绕过packet_release()中的unregister_prot_hook()的检查，从而导致即使packet_fanout已经被释放，但是仍然可以从packet_type链接列表引用。漏洞证明 [crayon-5a1c8f5b84fe1712795706/] 崩溃日志 [crayon-5a1c8f5b84fea292617098/] 我们知道已经被释放的是一个kmalloc-4096对象： [crayon-5a1c8f5b84ff4648568286/] 当通过af_packet.c中的register_prot_hook()的dev_add_pack()进行注册时，它的prot_hook成员在packet handler中被引用： [crayon-5a1c8f5b84ff7247098366/] 结构体packet_type内部的函数指针，保存在一个大的slab分配器（kmalloc-4096）中，这使得堆喷射变更容易和更可靠，因为内核较少使用较大slab分配器。我们可以使用常规的内核堆喷射来替换被释放的packet_fanout对象的内容，例如用sendmmsg()或其它函数。即使分配的内存空间不是永久的，但仍然可以替换packet_fanout中的目标内容（例如函数指针），并且由于kmalloc-4096非常稳定，所以我们的payload几乎不可能被其它分配破坏。当使用dev_queue_xmit()发送一个skb时会调用id_match()，通过AF_PACKET套接字上的sendmsg可以到达该路径。如果dev_queue_xmit参数非NULL，它通过调用id_match()的包处理程序列表进行循环。因此，可以通过下述方式进行漏洞利用。一旦知道了内核的代码段，我们就可以把内核栈转换成我们伪造的packet_fanout对象和ROP。第一个参数ptype包含我们伪造对象的prot_hook成员的地址，这使得我们知道在哪里跳转。一旦进入ROP，我们可以跳转到native_write_c4(x)去关闭SMEP/SMAP，然后跳回到用户空间执行我们真正的payload，通过调用commit_creds(prepare_kernel_cred(0))，将我们权限提升至root 。

Independent Securiteam

November 27, 2017 admin

SSD安全公告–Ikraus Anti Virus 远程代码执行漏洞

Credit to Author: SSD / Maor Schwartz| Date: Mon, 27 Nov 2017 07:50:39 +0000

漏洞概要以下安全公告描述了在Ikraus Anti Virus 2.16.7中发现的一个远程代码执行漏洞。 KARUS anti.virus“可以保护你的个人数据和PC免受各种恶意软件的入侵。此外，反垃圾邮件模块可以保护用户免受垃圾邮件和电子邮件中的恶意软件攻击。选择获奖的IKARUS扫描引擎，可以有效保护自己免受网络犯罪分子的侵害。 IKARUS是世界上最好的扫描引擎，它每天都在检测未知和已知的威胁。漏洞提交者一位独立的安全研究人员向 Beyond Security 的 SSD 报告了该漏洞厂商响应更新一 CVE: CVE-2017-15643 厂商已经发布了这些漏洞的补丁。获取更多信息： https://www.ikarussecurity.com/about-ikarus/security-blog/vulnerability-in-windows-antivirus-products-ik-sa-2017-0001/ 漏洞详细信息网络攻击者（中间人攻击）可以在运行Ikraus反病毒软件的计算机上实现远程代码执行。 Windows版的Ikarus AV使用明文HTTP和CRC32校验进行更新，以及用于验证下载文件的一个更新值。另外，ikarus检查更新版本号，通过增加更新的版本号，以推动更新进程进行更新。在ikarus中执行更新的可执行文件是guardxup.exe guardxup.exe，通过端口80，发送更新请求如下： [crayon-5a1c8f5b8564c832670696/] 服务器响应如下： [crayon-5a1c8f5b85655113594378/] 通过代理，我们可以修改响应，将“update”值加1，并将响应转发给客户端。然后，客户端将通过此URL请求更新：http://mirror04.ikarus.at/updates/guardxup001005048.full ikarus服务器将返回404： [crayon-5a1c8f5b8565a461056357/] 但我们可以用IKUP格式修改上述响应： [crayon-5a1c8f5b8565f465486246/] 然后，我们将修改过后的响应转发到客户端，在那里用我们的可执行文件替换guardxup.exe。漏洞证明安装mitmproxy 0.17 – pip install mitmproxy == 0.17 要使用这个脚本，在透明代理模式下，通过中间人80端口转发客户端的通信流量。设置你的防火墙规则以拦截8080端口上的通信流量： [crayon-5a1c8f5b85664388983146/] 然后执行如下脚本： ./poc.py file_to_deploy.exe [crayon-5a1c8f5b85668324361117/]

Independent Krebs

November 27, 2017 admin

Who Was the NSA Contractor Arrested for Leaking the ‘Shadow Brokers’ Hacking Tools?

Credit to Author: BrianKrebs| Date: Mon, 27 Nov 2017 17:01:26 +0000

In August 2016, a mysterious entity calling itself “The Shadow Brokers” began releasing the first of several troves of classified documents and hacking tools purportedly stolen from “The Equation Group,” a highly advanced threat actor that is suspected of having ties to the U.S. National Security Agency. According to media reports, at least some of the information was stolen from the computer of an unidentified software developer and NSA contractor who was arrested in 2015 after taking the hacking tools home. In this post, we’ll examine clues left behind in the leaked Equation Group documents that may point to the identity of the mysterious software developer.

ComputerWorld Independent

November 27, 2017 admin

Microsoft Thanksgiving turkeys: One patch disappears, another yanked

Credit to Author: Woody Leonhard| Date: Mon, 27 Nov 2017 06:37:00 -0800

For those of us keeping track of Windows patches, the long four-day weekend in the U.S. felt like another instantiation of Mr. Toad’s Wild Ride. Here are the developments, in more or less chronological (which is to say, not logical at all) order.

While many of you were sneaking out the door early on Wednesday, Microsoft released KB 4055038, a fix for bugs that clobbered Epson dot matrix printers, introduced in this month’s Patch Tuesday security patches. I talked about the bug two weeks ago. In short, a bug in all of this month’s Windows security patches caused Epson dot matrix printer drivers to fail. The bug appeared in:

To read this article in full, please click here

ComputerWorld Independent

November 27, 2017 admin

What keeps IT administrators up at night? Ransomware, for one | Salted Hash Ep 8

A solid backup policy and frequent awareness training can reduce the risk of ransomware, but unintentional breaches by insiders are still a worry for administrators. Watch as Steve Ragan and Michael Nadeau talk security strategy.

ComputerWorld Independent

November 25, 2017 admin

Why we can’t trust smartphones anymore

Credit to Author: Mike Elgan| Date: Sat, 25 Nov 2017 02:00:00 -0800

Your smartphone may contain secret “features” that leave you vulnerable.

I’m not talking about accidental design flaws that hackers might exploit. Security issues have always existed. They represent a cat-and-mouse game between malicious actors, who try to break smartphone security, and the smartphone industry, which tries to identify and fix the accidental vulnerabilities that make phones susceptible to hackers. Nothing new about that.

What I’m talking about is a new phenomenon — a trend we’ve learned about only in the past few weeks.

I’m talking about design decisions made by smartphone companies that cause phones to do things invisibly, behind the scenes and behind your back, that make phones potentially less secure.

To read this article in full, please click here

Independent Krebs

November 24, 2017 admin

Name+DOB+SSN=FAFSA Data Gold Mine

Credit to Author: BrianKrebs| Date: Fri, 24 Nov 2017 12:55:03 +0000

KrebsOnSecurity has sought to call attention to online services which expose sensitive consumer data if the user knows a handful of static details about a person that are broadly for sale in the cybercrime underground, such as name, date of birth, and Social Security Number. Perhaps the most eye-opening example of this is on display at fafsa.ed.gov, the Web site set up by the U.S. Department of Education for anyone interested in applying for federal student financial aid.

Independent Securiteam

November 23, 2017 admin

SSD Advisory – Linux Kernel XFRM Privilege Escalation

Credit to Author: SSD / Maor Schwartz| Date: Thu, 23 Nov 2017 06:59:02 +0000

Vulnerability Summary The following advisory describes a Use-after-free vulnerability found in Linux kernel that can lead to privilege escalation. The vulnerability found in Netlink socket subsystem – XFRM. Netlink is used to transfer information between the kernel and user-space processes. It consists of a standard sockets-based interface for user space processes and an internal kernel … Continue reading SSD Advisory – Linux Kernel XFRM Privilege Escalation