Java Releases Patch Addressing Vulnerability Used By McRat Trojan

Subject: General Tech | March 5, 2013 - 06:26 AM | Tim Verry
Tagged: security, patch, mcrat trojan, Java, exploit

Java developer Oracle recently released a patch to its Java Platform Standard Edition client to address two exploits used by attackers to install the McRAT trojan onto users machines. Specifically, Oracle is issuing the patch for vulnerabilities CVE-2013-1493 and CVE-2013-0809.

The vulnerabilities were related to Java running in a web browser. When users visit a malicious web site with vulnerable versions of Java installed, attackers are able to remote execute the McRAT trojan. That trojan was subsequently used to download additional malware to further compromise the machines in question. According to Oracle, the vulnerability was first discovered on February 1st, 2013 but did not make it in time to be rolled into that month’s scheduled update. As a result, Oracle slated it for inclusion in the Java platform update on April 16, 2013, but reconsidered after seeing exploits using these vulnerabilities in the wild. While servers and standalone Java installations are not affected, consumers will need to apply the patch via Java SE’s automatic updater or by manually installing the patch from this page. Currently, all Java SE versions prior to this patch are affected, including JDK and JRE 7 Update 15, 6 Update 41, and 5.0 Update 40 (or earlier).

Oracle states that the patch is a critically important update, and users should update as soon as possible. If you have not already applied the update (or given up on Java and uninstalled it completely--heh), start up Java and check for updates to grab the patch.

McAfee always checks the sandbox for feline footprints

Subject: General Tech | February 26, 2013 - 01:45 PM | Jeremy Hellstrom
Tagged: mcafee, security, RSA 2013, sandbox

McAfee has been showing off their stuff at RSA 2013 specifically the new heuristic malware detection capabilities which they will be using instead of their current malware signature database which has over 113 million core samples.  That signifies a huge change for the antivirus company as it moves to real time monitoring of all the processes on your machine for suspicious activity instead of matching patterns directly.  While this could lead to some interesting side effects for verification software such as you find in some games, McAfee claims 100% effectiveness against current rootkits on Intel hardware compatible with Deep Defender, though they did not give many specifics about that test to The Register.

That is not all they are up to, McAfee just purchased Validedge's sandboxing technology to allow them to watch malware as it arrives and infects a machine to allow them to study its patterns.  Strangely, The Inquirer mentions that they will be recording the signature so it is possible that it is an exaggeration that they are completely abandoning their signature database altogether and will be using a hybrid database and heuristic monitoring.  The first software using this new option will be available in the second half of this year.  Also briefly mentioned in the story is a suggestion that McAfee will be able to repair infected computers automatically via the ePO Agent.

"Signature-based malware identification has been around since the dawn of the computer security industry, but McAfee has said it's dumping the system – or rather, adapting it – in an upgraded security suite which will (it claims) virtually eliminate susceptibility to botnets."

Here is some more Tech News from around the web:

Tech Talk

• Altera signs up to use Intel's upcoming 14nm process node @ The Inquirer
• HP offloads WebOS to LG for use in televisions @ The Inquirer
• Internet Explorer 10 for Windows 7 @ [H]ard|OCP
• Samsung, Visa in pay-by-bonk tie up @ The Register
• Not so fast, BlackBerry. Now Samsung wants your tasty biz mobe pie @ The Register
• Hacking the International Space Station with a toothbrush @ Hack a Day
• Super single-photon source for quantum computers @ nanotechweb

Want some Raspberry Pi with a side of hashes?

Subject: General Tech | February 15, 2013 - 01:27 PM | Jeremy Hellstrom
Tagged: WPAD, security, Raspberry Pi, fud

On this weeks Podcast, Ryan wondered what he could do with his new Raspberry Pi and Hack a Day has an idea for him, though it is a wee bit nefarious.  It seems that Travis over at MADSEC is using a Raspberry Pi in penetration testing, using the NetBIOS Name Service to get responses from the Web Proxy Auto-Discovery Protocol (WPAD); responses which can include LM hashes from Windows machines.  With the use of Rainbow tables you can crack those hashes and take control of existing accounts on the PCs.  This type of attack is well know, but automating the attack on something as small and easily modifiable as a Raspberry Pi adds a new layer.  Whether you use it for good or evil, you can read more about it at Hack a Day.

"Plug in the power and Ethernet and this Raspberry Pi board will automatically collect Windows hashes from computers on the network. With a couple of RPi boards on hand [Travis] was searching for more hacks to try with them. This made a great little test to see how the board performs with the well established attack."

Here is some more Tech News from around the web:

Tech Talk

• Traceroute reveals Star Wars Episode IV 'crawl' text @ The Register
• Your own head-mounted display for under two bills @ Hack a Day
• Apple: iOS 6.1 network overload caused by our Exchange SYNC OF DOOM @ The Register
• Doped nanotubes boost lithium battery power three-fold @ The Register
• SSDs at the Office – Trials, Tribulations and Still Worth It @ Techgage
• Nvidia revenues fight the PC tide, but annual profits pinched @ The Register
• Valve releases its Steam client for Linux @ The Inquirer

Bad day for cellphone security

Subject: General Tech | February 14, 2013 - 01:47 PM | Jeremy Hellstrom
Tagged: Android, iOS 6, apple, security, FROST

Two different mobile phone security concerns were revealed today, one for devices using iOS 6.1 and one for Androids.  DailyTech has posted text instructions as well as linking to a video which shows how an iPhone 5's password protection can be completely bypassed and allow anyone with physical access to your phone to log into the phone with full access.  The second vulnerability, tested with Android 4.0 but possibly wide spread, was discovered by a team at the Friedrich-Alexander University in Germany, and it allows you to recover  information from a phone which has used the Android disk encryption.  They used both a freezer to drop the temperature of the phone and a trick with the battery which puts the phone into 'fastboot' mode and allows the loading of a custom image via a Linux PC which installs their Forensic Recovery Of Scrambled Telephones tool, aka FROST.  As you can see from the images below, that gives you the ability to get the encryption key or even brute force some passwords. 

"First part:
-Go to emergency call, push down the power button and tap cancel.
-Dial 112 and tap green and inmediately red.
-Go to lock screen.

Ok...ready for second part:
-Go to passcode screen.
-Keep pushing down the power button ...1...2...3...seconds and before showing the slider "turn off"...tap the emergency call button and ...voilá!
-Then without releasing the power button press the home button and ready..."

Here is some more Tech News from around the web:

Tech Talk

• Intel's new TV box to point creepy spy camera at YOUR FACE @ The Register
• Toshiba announces a noise cancelling chip @ The Inquirer
• 555-timer charges lead acid batteries @ Hack a Day
• Micron glues DDR4 RAM to flash, animates the 256GB franken-DIMM @ The Register
• Futuremark 3DMark Review @ Neoseeker
• Hacking a Coffee Machine for a Better Brew @ Hack a Day
• Cern shuts down LHC after three years of operations @ The Inquirer
• NVIDIA/AMD OpenGL Benchmarks Of Unigine Valley @ Phoronix
• Win an AverMedia RECentral Live Gamer HD Capture Card @ eTeknix
• Funky Kit Presents: Mod-my-Box™ Spring 2013 - Official Launch

That safe and secure Foxit plugin you use?

Subject: General Tech | January 14, 2013 - 02:00 PM | Jeremy Hellstrom
Tagged: pdf, foxit, security, fud

The Register has some bad news about that PDF reader you prefer to Adobe's software, a new vulnerability which does not even stem from booby-trapped document but from a long link name.  It seems that you can cause a buffer overflow in Foxit simply by copying the entire URL into a fixed-sized buffer when the user clicks on a PDF which "pretty much lets you write to a memory location of your choice".  5.4.4.1128 and older version are vulnerable and we have yet to hear from the creators of Foxit.  Looks like no PDF reader is safe at this point.

"A new security bug in the popular Foxit PDF reader plugin for web browsers allows miscreants to compromise computers and install malware. There's no patch for this zero-day vulnerability.

Italian security researcher Andrea Micalizzi discovered that the latest version of the software crashes if users are tricked into clicking on an overly long web link. The plugin is kicked into action by the browser to handle the file and promptly bombs."

Here is some more Tech News from around the web:

Tech Talk

• Weekend Project: Linux For Beginners @ Linux.com
• HP Photosmart 5520 Review @ TechReviewSource
• Tech Reports's big CES 2013 digest
• We drop a Corsair Survivor 16GB pen drive from 10th floor hotel room at CES on video - does it survive? @ Tweaktown
• TechwareLabs CES 2013 Coverage: Part 2
• Bjorn3D CES 2013 Coverage
• CES 2013: Kingston HyperX 10-Year Anniversary Party & Starcraft II Tournament @ Legit Reviews
• CES 2013 Report @ Neoseeker
• Ten stars of CES 2013: Who made the biggest splash? @ The Register

A light in the quantum cryptography tunnel

Subject: General Tech, Networking | November 21, 2012 - 02:15 PM | Jeremy Hellstrom
Tagged: quantum encryption, security

One of the biggest hurdles to implementing quantum cryptography has been vaulted, with researchers finding a way to transmit the key over a non-dedicated connection.  Previously because of the inherent noise in a fibre channel transmitting general data the key would be lost and so a separate fibre channel was needed which only the keys were able to transmit but thanks to researchers at Toshiba’s Cambridge Research Laboratory it is now possible to send the keys on existing fibre which also carries other data.  They have created a detector which can open for a mere 100 millionths of a micro-second and receive the key, with the detection window being so quick there is not time for noise to interfere and the wrong photon be detected as the key.  The Register reports they can transmit keys over a line running at 500kbps for 50km and still have the key properly detected.

"Traditionally it has been necessary to use dedicated fibre to send the single photons (particles of light) that are required for Quantum Key Distribution (QKD). This has restricted any applications of quantum cryptography technology to specialist and small-scale systems in banks and high-level government, essentially because of the extra inconvenience and cost required in allocating a dedicated fibre strand for quantum key distribution."

Here is some more Tech News from around the web:

Tech Talk

• Cloudy admin? Here's how to ward off Call of Duty-playing teens @ The Register
• Media Center Key Accidentally Gives Pirates Free Windows 8 Pro License @ Slashdot
• How-to: installing Windows 8 without product key @ Hardware.info
• The Rise and Fall of AMD @ Techspot
• Newer Technology Power2U USB Charging Wall Outlet @ Funky Kit
• Mozilla previews Facebook integration with Firefox 17 @ The Inquirer
• Tiger Direct First Annual Holiday Bash @ TechwareLabs
• Enter to win a Radeon HD 7770 CrossFire team and game bundle @ The Tech Report

Apple No Longer Updating Safari for Windows, Users Should Switch To A More Secure Browser

Subject: General Tech | August 6, 2012 - 05:55 AM | Tim Verry
Tagged: windows, webkit, security, safari for windows, safari, browser, apple

The Apple-developed Safari is one of the least popular webkit-based browsers on Windows. Even so, it still commands 5% marketshare (across all platforms), and that is a problem. You see, many sites are reporting that Apple has dropped support for Safari on Windows. Windows users will not get the update to Safari 6–the new version available to Mac OS X 10.6 and 10.7 Mountain Lion users. As well, it seems that Apple has removed just about every reference to ever having a Windows version of any Safari browser from its website.

Image Credit: MacLife

The issue is that the final version that Windows users are stuck with–version 5.1.7–has a number of documented security vulnerabilities that are never going to get patched by Apple. According to Maximum PC, there are at least 121 known security holes listed in Apple’s own documentation. And as time goes by, it is extremely likely that the number of unpatched security holes will increase. Running an outdated browser is not good security practice, and running a browser that is EOL and has known vulnerabilities is just asking for trouble.

While the number of PC Perspective readers running Safari for Windows is likely extremely small, I would advise that you be on the lookout next time you are doing tech support for your friends and relatives, and if they managed to get roped into using Safari thanks to Apple’s Itunes software updater convince them to move to a (dare I say better) more secure browser like Google’s Chrome, Opera, or Firefox. At least those are still getting updates, and some are even automatically done in the background.

Have you ever used Apple’s Safari for Windows browser? What would you recommend as the best alternative? Let us know in the comments below.

Firefox 12 will be able to bypass UAC and possibly corporate security settings

Subject: General Tech | April 24, 2012 - 01:01 PM | Jeremy Hellstrom
Tagged: UAC, security, firefox

One of the causes of the adoption of Google's Chrome browser in the workplace is that for the most part, since it installs under your user directory it can bypass the limited permissions on most business computers, letting the user install something without consulting IT.  This is a minor security concern as Chrome runs with limited permissions and is certainly not more inherently vulnerable than the old corporate standby, IE6.

According to The Inquirer Firefox will be starting to do something similar but with larger repercussions.  FireFox 12 will be whitelisted on UAC, allowing system level access to the program.  While this does mean that if they are successful users will be running up to date software and not require IT resources to upgrade FireFox every month or so, it also introduces a powerful attack vector for infections.  A silent FireFox update might not be from Mozilla and could instead be from malware online, creating a system vulnerability that the user is completely unaware of until obvious symptoms start to show, by which time it could be too late to stop the spread of an infection to the network or to clients machines.  The update is due out today, so keep a close eye on your FireFox installation for now.

"SOFTWARE DEVELOPER Mozilla will bypass Windows' user account control (UAC) to implement silent updating in its Firefox 12 web browser.

Mozilla's Firefox 12 is expected to be released today, and the outfit claims it will bypass Windows UAC in order to enable silent updating. Since Mozilla put Firefox on its rapid release schedule, it has put out new versions of the web browser every six weeks, leading some users to complain about the number of releases."

Here is some more Tech News from around the web:

Tech Talk

• HTC plans to develop customized processors @ DigiTimes
• ARM profits rise 22 per cent as margins increase @ The Inquirer
• Windows 8 Release Preview is coming 'first week of June' @ The Inquirer
• Microsoft lobs out first Skype for Windows Phone @ The Register
• Plumbers of the interwebs vow to kill IP hijacking @ The Register
• AMD Confirms Drop of Monthly Driver Support for Radeon HD 2000-4000 Series @ NGOHQ
• Sophos study finds that one fifth of Macs carry malware @ The Inquirer
• The TR Podcast 110: The lowdown on Ivy Bridge and her mobos