Lawman Technology and Consulting Group LLC

Microsoft is planning to release an out of band patch addressing the Shortcut vulnerability. The patch is scheduled for release on Monday, August 2nd, at 10am PDT.
As confirmed by Microsoft, a number of malware families started incorporating the vulnerability in their exploit repertoire. For more details, see the Microsoft Technet blog post [1]

[1] http://blogs.technet.com/b/msrc/archive/2010/07/29/out-of-band-release-to-address-microsoft-security-advisory-2286198.aspx
------

Johannes B. Ullrich, Ph.D.

SANS Technology Institute

Twitter (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

----------- Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot org (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

Wireshark released an update to fix multiple vulnerabilities in version 1.2.0. to 1.2.9. This release fixes several bugs. Wireshark indicated that It may be possible to make Wireshark crash, hang, or execute code by injecting a series of malformed packets onto the wire or by convincing someone to read a malformed packet trace file.
References for the 1.2.x branch:
Release announcement is available here.
Release Notes and bug fixes is available here.
Reference for the 1.0.x branch:
Release announcement is available here.
-----------
Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot org (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

httpry is a tool specialized for the analysis of web traffic. The tool itself can be used to capture traffic (httpry -o file) but other other tools are better suited for that such as tcpdump, Snort, Sguil. When it comes to finding out if certain types of files were downloaded via http, this tool does a super job. It can be used in combination with regular expressions (Regex) to find if a file, a script or a malware was downloaded from site or by a host and will ignore everything else. Whether the http traffic is using port 80, 443, 8080, etc, it will parse and display all the web traffic using this simple command:
httpry -i eth0
If you are working with a large pcap file and want to filter on a particular IP or network, httpry support libpcap filters to zoom in on the web traffic you want to analyze. This libpcap filter will show all the web traffic associated with host 192.168.5.25 using this filter:
httpry -r file 'host 192.168.5.25'
07/28/2010 18:00:02 192.168.5.25 216.66.8.10 GET www.symantec.com /enterprise/security_response/threatexplorer/threats.jsp HTTP/1.0 - -

07/28/2010 18:00:02 216.66.8.10 192.168.5.25 - - - HTTP/1.0 301 Moved Permanently

07/28/2010 18:00:02 192.168.5.25 216.66.8.16 GET www.symantec.com /business/security_response/threatexplorer/threats.jsp HTTP/1.0 - -

07/28/2010 18:00:03 216.66.8.16 192.168.5.25 - - - HTTP/1.0 200 OK

07/28/2010 18:00:03 192.168.5.25 67.97.80.71 GET vil.nai.com /VIL/newly_discovered_viruses.aspx HTTP/1.0 - -

07/28/2010 18:00:03 192.168.5.25 67.97.80.71 GET vil.nai.com /VIL/newly_discovered_viruses.aspx HTTP/1.0 - -

07/28/2010 18:00:03 67.97.80.71 192.168.5.25 - - - HTTP/1.1 200 OK

07/28/2010 18:01:48 74.125.157.101 192.168.5.25 - - - HTTP/1.1 200 OK

07/28/2010 18:01:48 192.168.5.25 173.194.15.95 GET safebrowsing-cache.google.com /safebrowsing/rd/ChNnb29nLW1hbHdhcmUtc2hhdmFyEAEYlZQCIJaUAioFFooAAAEyBRWKAAAB HTTP/1.1 - -

07/28/2010 18:01:48 173.194.15.95 192.168.5.25 - - - HTTP/1.1 200 OK


If you are checking for a particular file extension such as.exe, .js, .msi, .jpg, etc, if you combined your search with grep, httpry can be used to find if any binaries (i.e. malware) were downloaded from a certain site or by a particular client using a pcap captured files. In this example we grep for all the JavaScript transffered by host 192.168.5.25.
httpry -r file 'host 192.168.5.25' | grep \.js
07/28/2010 10:57:08 192.168.5.25 69.192.143.238 GET www.quickquote.lincoln.com /static/com/forddirect/presentation/constants/SkinConstants_lincoln.js HTTP/1.1 - -

07/28/2010 10:57:08 192.168.5.25 69.192.143.238 GET www.quickquote.lincoln.com /yui/yahoo-dom-event/yahoo-dom-event.js HTTP/1.1 - -

07/28/2010 10:57:08 192.168.5.25 69.192.143.238 GET www.quickquote.lincoln.com /static/com/forddirect/application/bp20/metrics/s_code.js HTTP/1.1 - -


The httpry website is here. The tarball can be download here and a freeBSD port here.


-----------
Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot org (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

Fellow handler Kevin points us to new developments on this case, announced here ==www.fbi.gov/pressrel/pressrel10/mariposa072810.htm
(c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

New versions of Snort (Beta and Production)are both out. Release notes are here == http://www.snort.org/news/2010/07/28/snort-2-8-6-1-and-snort-2-9-beta-released/



New features that I'm finding interesting in 2.9 (Beta):

A Data Acquisition API (DAQ) is introduced in this version
A byte extract option that bears some investigation - this allows extracted values from one rule to be used in subsequent rule options
Some welcome updates for IPv6
Support for Intel's QuickAssist for use in pattern matching. This is by far the most interesting feature in the bunch (to me at least) - support for hardware based acceleration (on boxes that have this feature). QuickAssist uses FSB attached FPGAs for this, so builds on previous FPGA work. Attaching the FPGAs to the server FSB overcomes previous limitations in FPGA I/O rates (talk about the sledgehammer approach!), this likely raises the maximum throughput for Snort considerably!

More info on Quck Assist, and Snort's integration with it can be found here == http://www.intel.com/technology/platforms/quickassist/

and here ==http://download.intel.com/embedded/applications/networksecurity/324029.pdf

If anyone has used the new QuickAssist feature and has formal or informal benchmarks, please feel free to comment !
=============== Rob VandenBrink, Metafore =============== (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

Paul wrote in to tell us about the new version of NoScript just out ==http://noscript.net/
The main new feature is protection against the Craig Heffner's DNSrebinding attack that's getting some press, which will be presented at Blackhat.this week ==http://www.blackhat.com/html/bh-us-10/bh-us-10-briefings.html#Heffner
The protection is pretty simple - look up the public ip of the workstation, and place it in the LOCALpseudo list. It uses a public site https://secure.informaction.com/ipecho for this - I can't comment at this time if this is a safe site to use for this or not.
If anyone has more info on this please feel free to comment.
=============== Rob VandenBrink Metafore =============== (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

This year's data breach report continues this valuable narrative. This years report is based on a larger case sample than in previous years, thanks to a partnership with the United States Secret Service, who contributed information on a few hundred of their cases this year. Many of the findings echo those of previous years (excerpts below).


Who is behind Data Breaches?

70% resulted from external agents

48% caused by insiders

11% implicated business partners

27% involved multiple parties



How do breaches occur?

48% involved privilege misuse

40% resulted from hacking

38% utilized malware

28% involved social tactics

15% comprised physical attacks



What commonalities exist? (this was the interesting section for me)

98% of all data breached came from servers

85% of attacks were not considered highly difficult

61% were discovered by a third party

86% of victims had evidence of the breach in their log files

96% of breaches were avoidable through simple or intermediate controls

79% of victims subject to PCI DSS had not achieved compliance



Come on! Not only don't folks seem to be implementing some basic protections, but when they're told that they've been compromised (in their log files), no-one is listening! I guess this isn't much different than in previous years, but it'd be nice to see a positive trend here.



I'm not sure that I believe the low numbers for government data breaches (4%). I guess the report can only summarize data from cases that are seen by the incident handlers.
Find the full report here ==http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf
Take a few minutes to read it over coffee this morning - Ifound it a good read, and just about the right length for that first cup !
=============== Rob VandenBrink, Metafore ===================== (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

(c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

According to this announcement:

http://secunia.com/advisories/40780/

The problem is that passwords may in certain cases be logged to /var/log/messages while running GNOME Display Manager in debug mode (disabled by default)



This was originally reported on 02-15-2009 here:

https://bugzilla.gnome.org/show_bug.cgi?id=571846

A patch was issued the same day. A supported patch was issued 05-14-2010.



The secunia advisory did not have many details.

The sunblog link provided did not have very much information.

http://blogs.sun.com/security/entry/cve_2010_2387_password_disclosure



The CVE is reserved and not available yet.

The rest of the information is apparently in the Customer Are.



Does this mean we can count on a no public disclosure policy for SUN products now that Oracle owns them?













(c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

The Google Online Security Blog posted a brief article on their opinion the full vs responsible disclosure debate... likely in the wake of the controversy of one of their researchers publishing a security vulnerability. The debate on publishing security vulnerabilities has been and remains a hot one. Almost all vendors support responsible disclosure(a term that I absolutely detest) where a researcher discloses the bug only to the software vendor who then (hopefully) patches the bug. Full disclosure is publishing the vulnerability publicly once it is discovered (or in some cases, once a PRfirm has been hired to manage the hype).
There are pros and cons to both approaches. Responsible disclosure really only works when there is responsible software development. However, if the good guys have the vulnerability, the bad guys have it and at least 12 more. With the exception of the few vendors which buy vulnerabilities, responsible disclosure does not allow the security community to develop counter-measures to protect against the threat while a patch is being developed. For instance, it took about a week for software to be developed to detect the LNKvulnerability and there are still problems with it. On the other hand, full disclosure hands the details to the bad guys in public so they can immediately exploit the vulnerability. It does, however, get vendors and researchers to move quickly.
What are your thoughts on how disclosure should be handled?
--

John Bambenek

bambenek at gmail /dot/ com (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

(c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

SophosLabs has just released a free tool that provides detection against the Windows shortcut exploit that we published last week here and here. Sophos has indicated it works with any antivirus software and it works with Windows XP/Vista/7 but not 2000. When Windows tries to display an icon with a shortcut, the tool will intercept the request in order to validate it and give back control to the user if not found to be malicious.
SophosLabs has made a video available on what is the exploit and how the tool works here and the tool is available for downloaded here.
Update 1: This tool currently only protects against LNK files and does not protect against PIF based exploits. It also does not protect against LNK files or targets stored on the local disk. Thanks to ISC reader Gerrit for the additional information.
-----------
Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot org (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

I've been out of touch the last month or two with special projects and vacation so today was my day to catch up on some old email. One item that caught my interest is an update to one of Mandiant's free tools, Web Historian to version 2.0. If you are an incident responder or forensic investigator Web Historian may be of interest to you.
Web Historian is a great tool for collecting and analyzing web browsing history information. The original version of this software dates back a few years to when Mandiant was still RedCliff and was showing a little rust. The new version is a complete rewrite and redesign of this popular tool. This version of Web Historian has a bunch of new features and supports Firefox 2/3+, Chrome 3+, and Internet Explorer versions 5 through 8.
For more information about Web Historian 2.0 see the Mandiant Blog.
To download and try Web Historian 2.0 go to the download page.

-- Rick Wanner - rwanner at isc dot sans dot org - http://rwanner.blogspot.com/ (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

There is nothing new on the issue of unsecured sensitive data traveling across the network in plain-text. In fact, many popular websites use SSL to crypt information because they became aware of the man in the middle attack, soowners secured their webpages to avoid the attack.
Unfortunately, there are many companies that thinks nothing will happen if they use plain-text to send logon information. You can say there is noproblem with hashed passwords, but they are not enough. Rainbow tables are widely used so if a hash is grabbed from the network, it will be cracked in no time.
Delivering SSL and authenticating both ends might be a cheap and reliable solution for this. Yes, I know SSL is vulnerable to Man-in-the-middlleattacks,but it you authenticate certificates on both ends and pay attention when something like this appears, the risks is adecuately minimized:


How many of us have clicked directly into continue to this website without paying attention on what is the error in the certificate?
I have seen universities where students capture professor's usernames and passwords and start to sell grade changes. I have seen many hijacked e-mail accounts on ISPs that doesn't crypt logon information.
These controls are easy to deploy: IIS hasSSLclient certificate authenticationand Apache also implements it. If you use all the available security functionality you have in your IT infrastructure,you will minimize many information security risks like this one.
-- Manuel Humberto Santander Pelez | http://twitter.com/manuelsantander| http://manuel.santander.name| msantand at isc dot sans dot org (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

-- Rick Wanner - rwanner at isc dot sans dot org - http://rwanner.blogspot.com/ (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

-- Rick Wanner - rwanner at isc dot sans dot org - http://rwanner.blogspot.com/ (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

gpgsm is a tool similar to gpg designed to provide digital encryption and signing services on X.509 certificates and the CMS protocol. There is a bug with this tool when importing a X509 certificate with more than 98 subject alternate names or implicitly while verifying a signature.

Version 2.0.16 is affected and older versions should be affected as well. More information at http://lists.gnupg.org/pipermail/gnupg-announce/2010q3/000302.html
-- Manuel Humberto Santander Pelez | http://twitter.com/manuelsantander| http://manuel.santander.name| msantand at isc dot sans dot org (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

Wewould like to clarify something to our readers because of an e-mail received today.There are two types of diary: One-liners where we tell you things you should know and where we don't have anything else to add and full diarieswhere we discuss a subject. For example, we use one-liners to talk about many updates on popular software.We just pointyou to the link.These are not advertisement to other companies :)
-- Manuel Humberto Santander Pelez | http://twitter.com/manuelsantander| http://manuel.santander.name| msantand at isc dot sans dot org (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.

(c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.