Security Alert - Switcher Android Trojan Targets Wireless Routers

The Switcher Android Trojan uses infected Android devices to attack wireless routers by performing brute force attacks on the routers’ admin web interfaces. If the attacks succeed, Switcher hijacks the Domain Name Server (DNS) by changing the IP addresses of the DNS servers in the router settings and then reroutes all DNS queries to the attackers’ servers.  As a result, Switcher is able to redirect all connected users to malicious IP addresses when they enter legitimate domain addresses, thereby exposing them to a broad range of attacks including phishing and malware infection.

There is currently no indication of Switcher infection in Singapore. However, Singapore users should nevertheless adopt the necessary preventive measures to avoid potential infection.

References

1. "Switcher" Android Trojan Hacks Routers, Hijacks Traffic

Kernel Local Privilege Escalation - CVE-2016-5195

Taken from RedHat (https://access.redhat.com/security/vulnerabilities/2706661)

Background Information
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system.


This could be abused by an attacker to modify existing setuid files with instructions to elevate privileges. An exploit using this technique has been found in the wild. This flaw affects most modern Linux distributions.

Red Hat Product Security has rated this update as having a security impact of Important.

Impacted Products:
The following Red Hat Product versions are impacted:
•    Red Hat Enterprise Linux 5
•    Red Hat Enterprise Linux 6
•    Red Hat Enterprise Linux 7
•    Red Hat Enterprise MRG 2
•    Red Hat Openshift Online v2

Attack Description and Impact:This flaw allows an attacker with a local system account to modify on-disk binaries, bypassing the standard permission mechanisms that would prevent modification without an appropriate permission set. This is achieved by racing the madvise(MADV_DONTNEED) system call while having the page of the executable mmapped in memory.

Take Action:All Red Hat customers running the affected versions of the kernel are strongly recommended to update the kernel as soon as patches are available. Details about impacted packages as well as recommended mitigation are noted below. A system reboot is required in order for the kernel update to be applied.

Mitigation:Please reference bug 1384344  - https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c13 for detailed mitigation steps.

Updates for Affected Products:
A kpatch for customers running Red Hat Enterprise Linux 7.2 or greater will be available. Please open a support case to gain access to the kpatch.

For more details about what a kpatch is: Is live kernel patching (kpatch) supported in RHEL 7? - please refer to https://access.redhat.com/solutions/2206511

Beware of Trojanized version of Putty SSH client distributed in the Wild

Summary
Reports of a trojanized version of Opensource SSH PUTTY client is found to the distributed in the wild.

Attacks
 According to the report, if appear to occur in the following manner

1. The victim performs a search for PuTTY on a search engine.
2. The search engine provides multiple results for PuTTY. Instead of selecting the official home page for PuTTY, the victim unknowingly selects a compromised website.
3. The compromised website redirects the user several times, ultimately connecting them to an IP address in the United Arab Emirates. This site provides the user with the fake version of PuTTY to download.

Mitigation

1. Always ensure that you only download the software from the authors/publisher official homepage.
2. Check the Software’s “About Information”. According to the report, the malicious version will show this. 

 References:

1. http://www.net-security.org/malware_news.php?id=3041 
2. http://www.symantec.com/connect/blogs/check-your-sources-trojanized-open-source-ssh-software-used-steal-information

Buffer Overflow vulnerability within the QEMU system emulator

Red Hat Product Security is now aware of a 'buffer overflow' vulnerability within the QEMU system emulator, which is widely installed and used for virtualization purposes on Linux systems. QEMU is also used by Red Hat’s cloud and virtualization products.

The vulnerability is known as VENOM and is assigned the identifier CVE-2015-3456.

This vulnerability affects the Floppy Disk Controller (FDC) emulation implemented in QEMU and could cause VM guests to crash the host's hypervisor and potentially facilitate arbitrary code execution on the host via guests. Even if the guest does not explicitly enable an FDC, all x86 and x86_64 guests are vulnerable.


For more more detailed information, do take a look at Redhat Security Blog: VENOM, don't get bitten 

1. https://access.redhat.com/articles/1444903 
2. https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/

FREAK (Factoring Attack on RSA-EXPORT Keys) Attack

FREAK (Factoring Attack on RSA-EXPORT Keys) Attack

The vulnerability allows attackers to intercept HTTPS connections between vulnerable clients and servers and force them to use ‘export-grade’ cryptography(weak export cipher suites), which can then be decrypted.

 It is recommended to update to the latest software patches. OpenSSL (CVE-2015-0204): versions before 1.0.1k are vulnerable.
For non-OpenSSL, disable support for any export cipher suites and known insecure ciphers on your web server.

Solutions:

1. Use latest version of Chrome/IE/Mozilla instead of the Android Browser and Safari.
2. Check if your site is vulnerable. SSL Labs - https://www.ssllabs.com/ssltest/

References:

1. FREAK Attack - https://freakattack.com/
2. Graham Cluley - https://grahamcluley.com/2015/03/freak-attack-what-is-it-heres-what-you-need-to-know/
3. Recommended Configuration - https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations

Samba Remote Code Execution Vulnerability

An uninitialized pointer use flaw was found in the Samba daemon (smbd). A malicious Samba client could send specially crafted netlogon packets that, when processed by smbd, could potentially lead to arbitrary code execution with the privileges of the user running smbd (by default, the root user)

For more details about the vulnerability or information on updating your Samba connections, see
CVE Page: https://access.redhat.com/security/cve/CVE-2015-0240
KCS Article: https://access.redhat.com/articles/1346913
KCS Solution: https://access.redhat.com/solutions/1351573 

Workaround / Advices
It is recommended to update to the latest software patches.

Other references:
Please refer to the TNAS report 24 February 2015 (Ref: 24022015-02) for additional information
Samba - https://www.samba.org/samba/security/CVE-2015-0240
US-Cert - https://www.us-cert.gov/ncas/current-activity/2015/02/24/Samba-Remote-Code-Execution-Vulnerability
Tripwire - http://www.tripwire.com/state-of-security/vulnerability-management/vert-threat-alert-samba-remote-code-execution/

Intel NIC driver causing multicast flooding (intermittent wired network disconnection)

Symptom:
The symptom can range from random disconnection to slowness in the entire school/building wired network. Eventually, the cause of this problem was found to be due to intel-chipset nic card (Intel I2xx/825xx series) sending out erratic & massive multicast traffic, causing flooding of the network and high CPU on the switches. The below link are some url which describe the same problem faced by other user environment:


Resolution:
The recommended step to resolve this problem is to upgrade the intel nic card driver to version 19.0 and above.


References:

1. IPv6 multicast flood during sleep from i217-LM
2. ICMPv6 'Multicast Listener Report' messages are flooding the local network 
3. ICMPv6 'Multicast Listener Report' messages flooding the local network

HTTP Server Prone To Slow Denial Of Service Attack

1. For Apache HTTPD Server:
Upgrade to the latest version that has "mod_reqtimeout" module support available by default.
Then enable the module "mod_reqtimeout" and configure it to set the timeout and minimum data rate for receiving requests,

See my screenshot below

RequestReadTimeout header=10-20,minrate=500
RequestReadTimeout body=10,minrate=500

For a complete write-up see Using mod_reqtimeout to make HTTP Server less vulnerable for DOS Attack for CentOS

References:

1. Apache Module mod_reqtimeout
2. Using mod_reqtimeout to make HTTP Server less vulnerable for DOS Attack for CentOS

Major browsers to stop accepting SHA-1-based SSL certificates by 2017

Microsoft, Google and Mozilla  have announced their deprecation policy on SHA-1 according to which they will stop accepting SHA-1 certificates in SSL by 2017.


Identifying certificates that have a SHA-1 algorithm:
Symantec: https://ssltools.websecurity.symantec.com/checker/views/certCheck.jsp
Digicert: https://www.digicert.com/sha1-sunset/
Thawte: https://ssltools.thawte.com/checker/views/certCheck.jsp

Test for SHA2-compatibility on unique applications:
https://ssltest39.ssl.symclab.com/
https://ssltest8.bbtest.net/ 

References on Deprecation of SHA-1:
https://technet.microsoft.com/en-us/library/security/2880823.aspx
http://googleonlinesecurity.blogspot.sg/2014/09/gradually-sunsetting-sha-1.html
https://bugzilla.mozilla.org/show_bug.cgi?id=942515

Leaked Dropbox Password

Taken from SINGCERT

Online reports have revealed that some Dropbox accounts have been compromised. According to Dropbox’s media statement, the usernames and passwords were stolen from other services and they have since reset the "small number" of affected accounts.

• Change your Dropbox passwords as soon as possible. If other accounts share the same password as your Dropbox account, it's recommended to change the passwords of those accounts as well.
• Enable 2-factor authentication (2FA) for your Dropbox account. For more information on enabling 2FA in Dropbox, please refer to https://www.dropbox.com/help/363
• Be selective of using your Dropbox account to sign in to third party services.

References
https://www.singcert.org.sg/alerts/21-latest/630-singcert-leaked-dropbox-passwords
http://www.cnet.com/news/hackers-hold-7-million-dropbox-passwords-ransom/
http://www.zdnet.com/dropbox-blames-other-services-for-claimed-7-million-password-hack-7000034629/
http://thenextweb.com/apps/2014/10/14/dropbox-passwords-leak-online-alleged-hack/

Security Vulnerability Alert: POODLE SSLv3.0 vulnerability

Description:
On 14/10, Google researchers had release a vulnerability in SSL 3.0, which could allowed malicious user to decrypt the contents that was supposedly encrypted when visiting SSL enabled websites.  Named POODLE attack ( Padding Oracle on Downgraded Legacy Encryption), a padding attack that targets CBC ciphers in SSL V3.

A detail analysis report of the POODLE exploit by the Google researchers can be found here: https://www.openssl.org/~bodo/ssl-poodle.pdf

Impact
Websites that support SSL V3.0 and CBC cipher mode chaining are vulnerable to the attacks, According to the report, The flaw allows attackers to steal secure HTTP cookies and headers, among other sensitive data.

Mitigation

• Google researchers recommend that support for SSL v3.0 be disable either on the end user browser or server end or both as well as others that rely on downgraded connections ( Warning : Doing this may “break” connectivity to web applications that only able to support up to SSL V3.0  and don’t support TLS 1.0, TLS 1.1, TLS 1.2 )
• If the above is not possible, Google recommends implementing support of “TLS FALLBACK SCSV” the Transport Layer Security Signalling Cipher Suite Value that "prevents protocol downgrade attacks." https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-00
  
  “This is a mechanism that solves the problems caused by retrying failed connections and thus prevents attackers from inducing browsers to use SSL 3.0. It also prevents downgrades from TLS 1.2 to 1.1 or 1.0 and so may help prevent future attacks," explained Möller.”

More Information

1. http://thenextweb.com/google/2014/10/15/web-encryption-vulnerability-opens-encrypted-data-hackers/
2. http://googleonlinesecurity.blogspot.sg/2014/10/this-poodle-bites-exploiting-ssl-30.html
3. http://blog.erratasec.com/2014/10/some-poodle-notes.html
4. http://www.theregister.co.uk/2014/10/14/google_drops_ssl_30_poodle_vulnerability/
5. Mozilla Blog - https://blog.Mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/
6. Microsoft - Disabling SSL 3.0 on Servers - http://support.Microsoft.com/kb/187498
7. Mozilla Add-On - Disabling SSL 3.0 on Mozilla Browser - https://addons.mozilla.org/en-US/firefox/addon/ssl-version-control/

VMWARE had release product updates to address the BASH security vulnerabilities

VMWARE had release product updates to address the BASH security vulnerabilities on 01/10/14 .

It is found at http://www.vmware.com/security/advisories/VMSA-2014-0010.html

Reports have shown using their honeypots system  that Malicious individuals are currently actively scanning for vulnerable and un-patch system and what commands they are attempting  to execute by simply passing URL/command  parameters.

https://www.alienvault.com/open-threat-exchange/blog/attackers-exploiting-shell-shock-cve-2014-6721-in-the-wild
http://blog.sucuri.net/2014/09/bash-shellshocker-attacks-increase-in-the-wild-day-1.html

Additional Information - Critical Security Vulnerability: Bash Code Injection Vulnerability, aka Shellshock (CVE-2014-6271)

Security advisories had been released by the key vendors with regards to the BASH vulnerabilities affecting  their products.
Kindly refer to the link for more detailed information

i). Cisco
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash

ii) Oracle
http://www.oracle.com/technetwork/topics/security/alert-cve-2014-7169-2303276.html

iii) Juniper
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648

iv)    Apple
No official  patch release – Coming soon
http://www.imore.com/apple-working-quickly-protect-os-x-against-shellshock-exploit

Critical Security Vulnerability: Bash Code Injection Vulnerability, aka Shellshock (CVE-2014-6271)

A critical vulnerability in the Bourne again shell commonly known as Bash that is  present in most Linux and UNIX distributions as well as Apple’s Mac OS X, had been found and administrators are being urged to patch and remediate immediately. Do read https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

The flaw discovered allows an attacker to remotely attach a malicious executable to a variable that is executed when Bash is invoked. 

Operating systems with updates include:
CentOS
Debian
Redhat
More info: https://access.redhat.com/articles/1200223

Proof-of-concept code for exploiting Bash-using CGI scripts to run code with the same privileges as the web server is already floating around the web. A simple Wget fetch can trigger the bug on a vulnerable system.

http://www.theregister.co.uk/2014/09/24/bash_shell_vuln/
http://www.wordfence.com/blog/2014/09/major-bash-vulnerability-disclosed-may-affect-a-large-number-of-websites-and-web-apps/

Diagnostic Steps
To test if your version of Bash is vulnerable to this issue, run the following command:

$ env x='() { :;}; echo vulnerable'  bash -c "echo this is a test"
If the output of the above command looks as follows:
vulnerable
this is a test

If you are using a vulnerable version of Bash. The patch used to fix this issue ensures that no code is allowed after the end of a Bash function. Thus, if you run the above example with the patched version of Bash, you should get an output similar to:

$ env x='() { :;}; echo vulnerable'  bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

WordPress 3.9.2 Security Release

WordPress 3.9.2 is now available as a security release for all previous versions. We strongly encourage you to update your sites immediately.

This release fixes a possible denial of service issue in PHP’s XML processing, reported by Nir Goldshlager of the Salesforce.com Product Security Team. It  was fixed by Michael Adams and Andrew Nacin of the WordPress security team and David Rothstein of the Drupal security team. This is the first time our two projects have coordinated joint security releases.

For more information, do take a look at http://wordpress.org/news/2014/08/wordpress-3-9-2/

Security Issue: RHEL glibc based privilege escalation (CVE-2014-5119, Important)

Issue:
There is a flaw in glibc that can allow a local unprivileged user to gain root on Red Hat Enterprise Linux machines.


A public exploit has been released on August 25th. This issue is tracked as CVE-2014-5119 in the MITRE Common Vulnerabilities and Exposures (CVE) database. The issue can not be blocked by our security technologies (such as SELinux). This issue affects the version of glibc as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Resolution:
Please update your glibc to the latest version. Check the errata RHSA-2014:1110-1 for the glibc that matches your operating system version.

Reference:
See this KCS article for more detail: https://access.redhat.com/solutions/1176253

RedHat Alert: OpenSSL CCS Injection Vulnerability (CVE-2014-0224) Alert

Taken from OpenSSL CCS Injection Vulnerability (CVE-2014-0224) Alert which came out yesterday.

Red Hat was recently notified of a vulnerability affecting all versions of OpenSSL shipped with Red Hat products. CVE-2014-0224 could allow for a man-in-the-middle attack against an encrypted connection.
SSL/TLS connections typically allow for encrypted traffic to pass between two parties where only the intended senders and recipients can decrypt data. In the event of a man-in-the-middle attack, an attacker could intercept an encrypted data stream allowing them to decrypt, view and then manipulate said data.
The vulnerability can only be exploited if both server and client are vulnerable to this issue. In the event that one of the two is vulnerable, there is no risk of exploitation.

NOTE: This vulnerability cannot be used to extract server or client side key material. This means that existing signed certificates do not need replacement once software is updated.

How does this impact systems

This issue affects products using OpenSSL in one of two scenarios:

OpenSSL version 1.0.1 and higher

Products Affected:
Red Hat Enterprise Linux 6.5, Red Hat Storage 2.1, Red Hat Enterprise Virtualization
All users running OpenSSL 1.0.1 and higher are impacted. It is recommended that all users of this version update to the latest release in order to remediate this vulnerability.

OpenSSL below 1.0.1

Products Affected:
Red Hat Enterprise Linux 6.4 and earlier, Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 4, Red Hat JBoss Middleware
The vulnerability only affects the OpenSSL clients. Servers running OpenSSL versions below 1.0.1 are not vulnerable to this issue. Clients using OpenSSL versions below 1.0.1 connecting to servers running OpenSSL versions 1.0.1 and higher are vulnerable and should be updated.

Frequently Asked Questions

This FAQ is for the vulnerability CVE-2014-0224 in OpenSSL, also known as "CCS Injection"

Is this issue the same as HeartBleed?

No, this a new issue discovered in OpenSSL that could result in a man-in-the-middle attack. See the explanation above for full details

Is this issue worse than HeartBleed?

HeartBleed allowed anyone on the internet to exploit vulnerable servers. This issue requires an attacker to intercept and alter network traffic in real time in order to exploit the flaw. This reduces the risk that this vulnerability can be exploited but does not make it impossible, updating should be a primary remediation focus regardless of the difficulty in leveraging the exploit.

Do I need to regenerate any certificates?

No, this issue does not result in certificate or private key information leaking.

How can I tell if I'm vulnerable to this issue? Is it possible to test remotely for the presence of this issue?

All versions of OpenSSL are vulnerable to this issue. Review the relevant solution for your product:
Red Hat Enterprise Linux
Red Hat Enterprise Virtualization
Red Hat JBoss Middleware
Red Hat Storage
Red Hat Access Labs has released the CCS Injection Detector to you validate your systems have been patched against this vulnerability.

How can I verify the update is working properly?

You can use the Access Labs CCS Injection Detector to verify the update has been applied successfully.

Is there a way to mitigate this issue without an update?

There is no known mitigation for this issue. The only way to fix it is to install updated OpenSSL packages and restart affected services.

Does this issue affect other TLS libraries?

Red Hat has reviewed the NSS and GnuTLS libraries for this issue. We have determined that these libraries are not affected by this specific issue.

Do I need to update my OpenSSL package, even if I am not running version 1.0.1?

Red Hat suggests everyone updates their OpenSSL packages regardless of the version they are using. See above for further details

Is this issue being exploited in the wild?

At the time the issue was made public, we were not aware of any public exploits for this issue or that it is being exploited in the wild. We believe an exploit could be written for this issue, however exploitation requires the attacker to intercept and alter network traffic in real time.

When did Red Hat find out about this issue?

The OpenSSL team was notified about this issue on May 1, 2014, and contacted Red Hat and other OS distributions on June 2, 2014. This issue was made public on June 5, 2014.

What can an attacker actually do with this issue?

This issue could allow an attacker to conduct a man-in-the-middle attack against a vulnerable OpenSSL client communicating with a vulnerable OpenSSL server. The attacker could then potentially view or modify the secured traffic. The attacker would need a way to access network traffic between the communicating parties and alter it. This OpenSSL issue alone does not provide such level of access to network traffic.

Why do Red Hat's security advisories list multiple CVE IDs?

OpenSSL is fixing several issues with their latest update. Red Hat's updates fix the issues as relevant to our various versions of OpenSSL. This issue has been singled out as the most serious and we are providing additional information.

Zero Day Vulnerability in Internet Explorer Could Allow Remote Code Execution

e-Cop has received reports about a zero-day vulnerability in Internet Explorer allowing remote code execution being targeted in the wild.

The vulnerability, CVE-2014-1776, is a remote code execution vulnerability. The vulnerability exists in the way that Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated. The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website. This vulnerability has been reported to affect all current versions (IE6 through IE11) of Internet Explorer.

Workaround/ Advices:
Microsoft is currently investigating this issue and no patches are yet available (as of the time of this email was sent).

Microsoft has offered Workarounds and Suggested Actions at the following advisory:
-          https://technet[dot]microsoft[dot]com/en-US/library/security/2963983

OpenSSL Release Critical Security Update to Fix "Heartbeat' Vulnerability

Summary:
A serious vulnerability in the popular OpenSSL cryptographic library has been discovered that allows attackers to steal information unnoticed. Known as the Heartbleed bug,

Impact:
The vulnerability allows anyone on the Internet to read the memory of systems that run vulnerable versions of OpenSSL, revealing the secret authentication and encryption keys to protect the traffic.
User names, passwords and the actual content of the communications can also be read.
According to the report, The exploit leave no trace that your server had been scanned and sensitive information leaked. 

If you had use the vulnerable version of the OpenSSL to generate encryption keys to secure your web traffic, your site is likely be affected.

In addition, tools had been released and out on the internet for users to scan sites that are vulnerable.

Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1.

Solution:
OpenSSL 1.0.1g has been released to address this vulnerability.
Any keys generated with a vulnerable version of OpenSSL is likely be considered compromised and regenerated and deployed after the patch has been applied.

For more information: please refer to the links below

• https://www.openssl.org/ 
• https://www.openssl.org/news/secadv_20140407.txt 
• http://www.itnews.com.au/News/382211,admins-scramble-to-plug-giant-openssl-security-hole.aspx?eid=1&edate=20140409&utm_source=20140409_AM&utm_medium=newsletter&utm_campaign=daily_newsletter
• http://www.us-cert.gov/ncas/alerts/TA14-098A

References:

• CVE-2014-0160
• NCSC-FI case# 788210
• http://www.openssl.org/news/secadv_20140407.txt  
• http://blog.cloudflare.com/staying-ahead-of-openssl-vulnerabilities 
• http://www.ubuntu.com/usn/usn-2165-1/ 
• http://www.freshports.org/security/openssl/ 
• https://blog.torproject.org/blog/openssl-bug-cve-2014-0160 
• https://rhn.redhat.com/errata/RHSA-2014-0376.html 
• http://lists.centos.org/pipermail/centos-announce/2014-April/020249.html 
• https://lists.fedoraproject.org/pipermail/announce/2014-April/003205.html 
• http://www.kb.cert.org/vuls/id/720951 
• https://www.cert.fi/en/reports/2014/vulnerability788210.html 
• https://www.cert.at/warnings/all/20140408.html 
• http://www.circl.lu/pub/tr-21/

Risks of Using the Intelligent Platform Management Interface (IPMI) - (TA13-207A)

Systems Affected
Any system connected to the internet running the Intelligent Platform Management Interface (IPMI) may be affected. IPMI is resident on many server platforms, and provides low-level access to a system that can override operating system controls.

Overview
Attackers can easily identify and access systems that run IPMI and are connected to the Internet. It is important to restrict IPMI access to specific management IP addresses within an organization and preferably separated into a separate LAN segment.

For more detail information, see Alert (TA13-207A) - Risks of Using the Intelligent Platform Management Interface (IPMI)