It seems a new, fairly serious flaw has been discovered in Internet Explorer 7 - and as accounts go it’s been around for a couple of months in the underground.
The worrying part is, patch Tuesday was yesterday and after testing it’s been discovered that this flaw WAS NOT patched in the updates.
ISC reports that it’s not currently widely used, but it has been found in the wild.
Microsoft said it is investigating reports that a new exploit is going around that takes advantage of an unpatched security hole in Internet Explorer 7.
The SANS Internet Storm Center, which tracks hacking trends, said today that while the exploit does not appear to be widely in use at the moment, that situation is likely to change soon, since instructions showing criminals how to take advantage of this flaw have been posted online.
SANS emphasizes that this vulnerability is not one that was fixed in the massive bundle of patches that Microsoft issued yesterday. It is not clear what steps users can take to protect themselves against this threat, other than to browse the Web with something other than IE, such as Mozilla Firefox or Opera. This appears to be the type of vulnerability that could be used to give attackers complete control over an affected system merely by convincing users to browse to a specially-crafted hacked or malicious Web site.
It seems the safest thing is not to use IE, which I personally have been doing since about 1998 anyway. But still, some people claim they have problems with Java or JavaScript or AJAX enabled sites with Firefox.
There’s always Opera, or even the new Google Chrome.
This exploit is a serious one as someone only needs to visit the site and remote code can be injected into their OS and executed.
According to SANS, the exploit works against fully-patched Windows XP and Windows 2003 systems with Internet Explorer 7.
In a statement e-mailed to Security Fix, Microsoft said once it is done with its investigation, the company “will take appropriate action to help protect customers. This may include providing a security update through the monthly release process, an out-of-cycle update or additional guidance to help customers protect themselves.”
Once again it’s demonstrated how stupid ‘Patch Tuesday’ is and how half of the people on the Internet are going to be vulnerable to this serious flaw until the first Tuesday in January.
I really hope Microsoft pushes out an emergency patch outside their schedule ASAP.
You can find a list of the sites known to be distributing the code on Shadowserver here.
[Source: Darknet ]
Read more on this article...
I’m sure you’ve heard about the Microsoft IE7 Exploit that allows Remote Code Execution on XP & Vista, it turns out it’s actually much worse than first expected.
The exploit also affects IE5.01, IE6 and IE8 on all OS versions! That’s a pretty worrying turn of events for MS especially as they are seemingly leaving it unpatched.
You can find a clarification of the various workarounds for the IE flaw on Technet here.
Researchers are warning that the unpatched security vulnerability in Microsoft’s Internet Explorer affects more versions of the browser than previously thought, and that steps users must take to prevent exploitation are harder than first published.
According to an updated advisory from Redmond, the bug that’s been actively exploited since Tuesday bites versions 5.01, 6, and 8 of the browser, which is by far the most widely used on the web. A previous warning from Microsoft only said that IE 7 was susceptible to the attacks. IE is susceptible when running on all supported versions of the Windows operating systems, Microsoft also says.
What’s more, while there is some protection from Vista’s User Account Control, the measure doesn’t altogether prevent the attack, according to this post on the Spyware Sucks blog. Microsoft and others have suggested that those who must use IE in the next few weeks set the security level to high for the internet security zone or disable active scripting. These are sensible measures, but they don’t guarantee you won’t be pwned, according to this post from the Secunia blog.
Once again Firefox users for the win, this is a flaw in the whole family of Internet Explorer and must effect a shocking amount of users. I guess setting your Security Zone to high and disabling Active Scripting helps but then it also disables a lot of features on a lot of sites.
So you are losing out on the user experience of the web just to be more secure, mostly because Microsoft doesn’t want to release an ad-hoc patch.
Well Google Chrome final version is out now too, so there’s another option for people.
Secunia goes on to revise what it says is the cause of the vulnerability. Contrary to earlier reports that pinned the blame on the way IE handles certain types of data that use the extensible markup language, or XML, format, the true cause is faulty data binding, meaning exploit code need not use XML.
Microsoft has yet to say whether it plans to issue a fix ahead of next month’s scheduled release. For the moment, the volume of in-the-wild attacks remains relatively modest and limited mostly to sites based in China. But because attackers are injecting exploits into legitimate sites that have been compromised, we continue to recommend that users steer clear of IE until the hole has been closed.
Plenty of other researchers have weighed in with additional details about the flaw. Links from SANS, Sophos and Hackademix.
I think an imminent danger is if people start using iframe vulnerabilies and XSS to inject this exploit into some more prominent sites - that could cause a huge spread of infections!
Anyway just let people using IE know that this is another reason they shouldn’t be using it! Show them how to download and install Firefox and please teach them to use Tabs!
[Source: Darknet ]
Read more on this article...
Well it has happened before, quite recently in fact - back in October Microsoft rushed out a patch for the RPC exploit, which was the first time in 18 months they had issued an out of band patch.
Now just a couple of months later they are releasing another one (which should be available today - Wednesday December 17th 2008) for the recent remote code execution vulnerability in almost all versions of IE.
It’s the right thing to do though and in terms of PR they had to do it as the mainstream news had gotten hold of this story and they weren’t going to let go.
Microsoft will push out an emergency security patch for Internet Explorer on Wednesday, addressing a critical security hole currently being exploited in the wild.
Redmond issued advanced notice for tomorrow’s fix, describing the out-of-cycle patch as protection from “remote code execution.”
Unscheduled updates are pretty rare for Microsoft, stressing the potentially serious nature of the flaw. Although the last time Microsoft broke it’s update cycle was in late October – it was the first time it had done so in about 18 months.
I guess they caved in after the media pressure and the panic starting amongst consumers as the exploit was actually being used in the wild (even though mostly from China sites) it’s still a risk.
It seems like if a vulnerability allows for remote code execution they will issue an adhoc patch to address the issue.
The latest zero-day vulnerability stems from data binding bugs that allows hackers access to a computer’s memory space, allowing attackers to remotely execute malicious code as IE crashes, Microsoft has said.
Although the exploit was at first contained to warez and porn sites hosted on a variety of Chinese domains, the malicious JavaScript code has since spread to more trusted sites though SQL injection. The flaw is primarily being used to steal video game passwords at present, but could potentially be used to retrieve more critical sensitive data from users as well.
The vulnerability is specifically targeted at surfers running IE 7, but it’s also known to affect versions 5, 6, and 8 of the browser as well. All IE users are advised to install the update.
The patch will become available Wednesday at 1 PM EST from auto-update and the Microsoft Download Center. A separate patch will be made available for those running IE8 Beta 2.
[Source: Darknet ]
Read more on this article...
Nemesis is a command-line network packet injection utility for UNIX-like and Windows systems. You might think of it as an EZ-bake packet oven or a manually controlled IP stack. With Nemesis, it is possible to generate and transmit packets from the command line or from within a shell script. Nemesis is developed and maintained by Jeff Nathan
Nemesis can natively craft and inject packets for:
* ARP
* DNS
* ETHERNET
* ICMP
* IGMP
* IP
* OSPF
* RIP
* TCP
* UDP
Using the IP and the Ethernet injection modes, almost any custom packet can be crafted and injected.
Unix-like systems require: libnet-1.0.2a, and a C compiler (GCC)
Windows systems require: libnetNT-1.0.2g and either WinPcap-2.3 or WinPcap-3.0
[Read More]
[Source: Darknet ] Read more on this article...
Foundstone Blast v2.0 is a small, quick TCP service stress test tool. Blast does a good amount of work very quickly and can help spot potential weaknesses in your network servers.
Features:
/trial switch adds the ability to see how the buffer looks before sending it
/v switch adds verbose option - off by default
/nr switch turns off initial receive after initial connect - HTTP services don’t send and initial response, Mail services do
The /nr switch fixes the effect of HTTP timeouts when sending GET strings
/dr adds double LF/CR’s to buffers(useful for GET requests) off by default
Examples:
blast 134.134.134.4 110 600 680 /t 7000 /d 300 /b user
blast 134.134.134.4 110 600 680 /t 7000 /d 300 /b user /e endchars
blast 134.134.134.4 110 600 680 /noret
/t == timeout delay in milliseconds to wait for server response
/d == delay before each send
/noret means to send raw data with no newline chars that a pop server expects at end
/b is a way to add cust text to begin of buf
/e is an alternate way to end each buf
/v switches on verbose output - off by default
/nr turns off initial receive after initial connect (useful for HTTP GET)
/dr adds double LF/CR’s to buffers (useful for HTTP GET)
Read More & Download - Foundstone Blast v2.0
[Source: Darknet ]
Read more on this article...
Technitium MAC Address Changer allows you to change Media Access Control (MAC) Address of your Network Interface Card (NIC) irrespective to your NIC manufacturer or its driver. It has a very simple user interface and provides ample of information regarding each NIC in the machine. Every NIC has an MAC address hard coded in its circuit by its manufacturer. This hard coded MAC address is used by windows drivers to access Ethernet Networks (LAN). This tool can set a new MAC address to your NIC, bypassing the original hard coded MAC address. Technitium MAC Address Changer is a must tool in every security professionals tool box.
Features
+= Changes MAC address of Network Interface Card (NIC) including Wireless LAN Cards, irrespective of its manufacturer or its drivers.
+= Has list of all known manufacturers (with corporate addresses) to choose from. You can also enter any MAC address and know which manufacturer it belongs to.
+= Allows you to select random MAC address from the list of manufacturers by just clicking a button.
+= Restarts your NIC automatically to apply MAC address changes instantaneously.
+= Allows you to create and edit Configuration Presets, which saves all your NIC settings and makes it very simple to switch between many settings in just a click and hence saves lot of time.
+= Has command line interface which allows you to perform all the tasks from the command prompt or you can even create a DOS batch program to carry out regular tasks.
+= Allows you to export a detailed text report for all the network connections.
+= Displays all information you would ever need about your NIC in one view like Device Name, Configuration ID, Hardware ID, Connection Status, Link Speed, DHCP details, TCP/IP details etc.
+= Displays current data transfer speed per second.
+= Allows you to configure IP Address, Gateway and DNS Server for your NIC quickly and instantaneously.
+= Allows you to enable/disable DHCP instantaneously.
+= Allows you to Release/Renew DHCP IP address instantaneously.
+= Displays DHCP lease obtained and lease expires time.
+= Allows you to configure Interface Metric instantaneously.
+= Quick keyboard shortcuts for most operations.
+= Supports all Microsoft(R) Windows(TM) NT based versions in all languages.
+= All reported bugs in previous 4.0 version removed. (Thanks to all your feedbacks)
Read More
[Source: Darknet ]
Read more on this article...
SQLiX, coded in Perl, is a SQL Injection scanner, able to crawl, detect SQL injection vectors, identify the back-end database and grab function call/UDF results (even execute system commands for MS-SQL). The concepts in use are different than the one used in other SQL injection scanners. SQLiX is able to find normal and blind SQL injection vectors and doesn’t need to reverse engineer the original SQL request (using only function calls). Documentation and examples are here: [Source: Darknet ]
SQLiX is a SQL Injection scanner which attempts to fill the gap between what commercial software available on the market can do and what can really be done to detect and identify SQL injection.
Current injection methods used by commercial web assessment software are based on error generation or statement injections.
The error generation method is quite simple and is based on meta characters like single quotes or double quotes. By injecting these characters in the original SQL request, you generate a syntax error which could result in an SQL error message displayed in the HTTP reply. The main issue with this technique is the fact that it’s only based on pattern matching. There is no way to handle multiple languages or complex behaviors when the error message is filtered by the server-side scripts.
Statement Injection
The second method used is statement injection. Let’s look at an example:
The target URL
http://target.example.com/news.php?id=25.
The scanner will try to compare the HTML content of the original request with the HTML content of
http://target.example.com/news.php?id=25%20or%201=1
http://target.example.com/news.php?id=25%20or%201=0
If the request (1) provides the same result as request (0) and request (2) doesn’t, the scanner will conclude that SQL injection is possible. This method works fine, but is very limited by the syntax of the original request. If the original request contains parentheses, store procedures or function calls, this method will rarely work. Worse, if the variable is used by multiple SQL requests, all with different syntaxes, there is no automatic way to make them all work simultaneously.
Another global issue concerning SQL injection is the fact that pen testers frequently conclude that a given SQL injection vulnerability can’t be exploited. By concluding this incorrect statement they are inviting their customers to not patch the vulnerability.
Free Download
OWASP - SQLiX Project - SQL Injection Scanner
Read more on this article...
