One of the four vulnerabilities rated “critical” from yesterday’s MS patchday,
that is
MS10-063,
has an interesting “Workarounds” section as for MS Internet Explorer. There it’s
stated:
“Disabling the support for the parsing of embedded fonts in Internet Explorer
prevents this application from being used as an attack vector.”
which, according to the advisory, should/can be done by setting the “Font
Downloading” parameter to “Disable”.
Which is exactly what
this document
suggests. So taking a preventive approach, once more, might have saved some
concerns (“Will we be targeted by this one”) and patch/testing time…
Recently I noticed
this news
titled “New email worm on the move”. At roughly the same time I received an
email from a senior security responsible from a large customer asking for
mitigation advice as they got “hit pretty hard” (by this exact piece of
malware).
Given I’m mainly an infrastructure and architecture guy usually I’m not too
involved in malware protection stuff (besides my continuous ranting that – from
an architectural point of view – endpoint based antivirus has a bad security
benefit vs. capex/opex ratio). So I’m by no means an expert in this field. Still
I keep scratching my head when I read the associated announcements (like
this,
this
or
this)
from major “antivirus”, “malware protection” or “endpoint security” vendors – to
save typing, in the remainder of the post I call them SNAKE vendors (where
“SNAKE” stands for “Smart Nimble APT Kombat Execution”… or sth equally ingenious
of the valued reader’s choice… 😉
This is currently the most frequent search term leading Internet users to the
Troopers website.
Probably Sheran Gunasekera’s great presentation “Bugs & Kisses – Spying on BlackBerry users for fun”
is the piece they are after. Whatever they look for, this search term may help
to shed light to an aspect that seems a bit overlooked in the ongoing debate
about governments (U.A.E., Saudi Arabia, India) trying to get their hands on
communication acts performed with BlackBerries in their countries.
[For those interested in that discussion
this blog entry of Bruce Schneier
may serve as a starting point.]
For those of you who missed it: Microsoft released the
associated advisory
yesterday, together with a hotfix
introducing a new registry key that allows users to control the DLL search path
algorithm. For a detailed explanation of the problem we refer to
the excellent article on Ars Technica.
For the record: no, AV (anti-virus software) will – in most cases – not protect
you from security problems related to this one. And, no, there is no easy patch
for this one either.
Just wanted to let you know that we sent out
ERNW Newsletter 32
end of last week. As we
promised
it includes the results of research regarding the question “Is browser
virtualization a valid security control in order to mitigate browser based
security risks?”.
Simon did a great job with writing the latest newsletter. It’s a 30-page
document which should help you to have a basis for well-informed decisions when
it comes to the deployment of an application virtualization technology.
Everybody who is interested in our newest tool ‘Loki’ is welcomed to head over
to ERNW’s tool section and
download it. Take this monster for a spin and let us know in the comments how
you like it. Loki’s coding father Daniel is more than happy to answer your
questions and criticism.
You don’t even know what Loki is?
In short: An advanced security testing tool for layer 3 protocols.
One of the biggest pains in the ass of most ISOs – and subsequently subject of
fierce debates between business and infosec – is the topic of “Browser
Security”, i.e. essentially the question “How to protect the organization from
malicious code brought into the environment by users surfing the Internet?”.
Commonly the chain of events (of a typical malware infection act) can be broken
down to the following steps:
1.) Some code – no matter if binary or script code – gets transferred (mostly:
downloaded) to some system “from the Internet”, that means “over the network”.
… recently published
here.
While
I certainly agree with those comments stating that there’s a fishy element in
the – conspiracy theory nurturing – story itself, this reminds me that Graeme
Neilson (who gave the
“Netscreen of the Dead”
talk at Troopers, discussing modified firmware on
Juniper and Fortinet devices) and I plan to give a talk on “Supply Chain
(In-)Security” at this year’s Day-Con event. We still
have to figure out with Angus if it fits into the agenda (and if we have enough
material for an interesting 45 min storyline ;-)) though. Stay tuned for news on
this here.
Back on track as for one of our favorite rant subjects: desktop security.
This stuff,
commonly called the “LNK vulnerability”, has gained quite some momentum in the
last days, including the release of
a Metasploit module
and a temporary raise of SANS Internet Storm Center‘s
Infocon level to yellow (it’s back on green in the interim).
CVE-2010-2568 has been assigned and some technical details can be found
here
and here.
To give you a rough idea how this piece works, here’s a quote from the
US-CERT advisory:
According to
SANS NewsBites Vol. XII, Issue 53
recently published there’s a lack of 3rd party developer support for some
security features Microsoft introduced already years ago. We at ERNW have made
similar observations when performing security assessments of COTS [commercial
off-the-shelf] software. We therefore created a methodology, a
proof of concept tool
and a metric to test and to rate closed source software, where (amongst other
approaches) these security features are checked and their (non-) presence
contributes to an overall evaluation as for the trustworthiness of the
applications in question. The concept “How to rate the security in closed source
software” was presented to the public at Troopers10
and at Hack in the Box 2010 in Amsterdam.
The slides can be found
here.
