SANS vLive!: Automating Compliance & Windows Domain Audits with David Hoelzer

Based on the positive feedback we received from the vLive! course we promoted with SANS recently, we’re doing it again!

Everyone has a Microsoft Windows system, and most of us have a lot of them.  How can you know whether or not your systems are configured securely?  How do you know that users are following security policies that apply to systems in your domain?  How can you manage the security of thousands of systems at the same time?

In this two hour class David Hoelzer, SANS’ IT Audit Curriculum Chair, will cover fundamentals that will get you up and running with automated security compliance.  You will learn how to scale important tests out to thousands of systems in an effective way and how to produce useful reports.  Additionally, David will provide tips on how to automatically generate useful alerts from the data collection processes that are covered.

The course will be on Tuesday, March 16th 2010 from 5:00 PM – 7:00 PM EDT.

Register at http://www.sans.org/vlive/details.php?nid=21568 and use coupon code BIT20 to save $175 on this course!  You will pay only $20!

David Hoelzer will also be teaching Audit 507: Auditing Networks, Perimeters, and Systems, a 36-hr course, on vLive! beginning March 29.  https://www.sans.org/vlive/details.php?nid=20748

Vulnerability Roundup

Another week, another Adobe security problem, this time in Adobe’s Download Manager.  The Adobe Download Manager (DLM) used to download updates from Adobe’s site, but Aviv Raff discovered a vulnerability which would force the Download Manager to download a file of an attacker’s choosing.  DLM is supposed to remove itself from a system after a reboot, but as Aviv points out this is still a dangerous problem.  In what may be their quickest turnaround that I can remember, Adobe has released a patch and an advisory.

Mozilla released Firefox 3.5.8 and 3.0.18 which fix multiple vulnerabilities, but the same day Intevydis dropped 0-day for Firefox 3.6 for the VulnDisco add-on for Immunity’s Canvas. There seems to be some debate on the validity of the exploit, so keep that in mind.  It does not appear that Mozilla has officially responded to this yet or provided a patch.

Cisco has released a trio of advisories for Firewall Services Modules, ASA 5500 appliances and the Cisco Security Agent. The FWSM advisory is for a DoS attack when Skinny Client Control Protocol inspection is enabled.  The ASA and Security advisories both list multiple vulnerabilities, including SQLi, DoS, and Auth Bypass.

Updates are also available for OpenOffice and Google’s Picasa to close holes in file handling bugs among other vulnerabilites.

In other vulnerability news, 2X Software, who sell thin client/server/terminal software appear to have become accidental security researchers, as they claim to have found a vulnerability in Windows (according to them Windowas 2000 and up) which can be exploited for a DoS.  There is controversy around this, as other security researchers (non-accidental ones) argue that the same can be done without an exploit, and that the announcement is a publicity stunt and Microsoft appears to have this listed more as a bug than a feature, er vulnerability.  I’ve provided a few links so you can decide for yourself.

Practical Exploitation

I’d like to take a minute and pimp out Rob Fuller’s (mubix) new project, called Practical Exploitation.  He takes a no-nonsense approach to showing us how to do things in security and so far I am enjoying it.

His latest video is Metasploit Tricks 1.  Check it out!

We’re looking forward to more videos, and if you don’t learn something every time, make sure to punch him at the next conference :)

Vulnerability Roundup

While they were absent from last week’s roundup, Adobe has returned with advisories in 3 of their products, not surprisingly Flash and Reader, and also BlazeDS which is included in some of their server offerings.  The Flash and Reader vulnerabilities share a CVE (CVE-2010-0186) which can allow an attacker to subvert domain sandboxing.  The Reader update is also out-of-band for Adobe, and addresses a vulnerability which would allow an attacker to execute code in the context of Reader.  Interestingly enough, the second vulnerability is credited to a Microsoft researcher.

Cisco has also posted updates, this set for their IronPort Appliances.  It looks like there are some serious vulnerabilities covered here, including accessing files on the appliance, as well as executing malicious code.

In the world of hardware hacking a researcher named Christopher Tarnovsky has managed to extract the encryption keys from the Trusted Computing Module.  There’s a lot of different chemicals, hardware and a Focused Ion Beam microscope involved.  Very impressive.

Google has released a new version of Chrome which fixes a large number of security issues, including one which earned some cash from the new Chrome bug bounty.  Of course there has been a lot of talk about privacy (or the lack thereof) in Google’s new Buzz service, but RSnake posted what appears to be a vulnerability in the service.

In an update to last week’s vuln roundup, some people have been having problems with update MS010-15, causing some XP machines to BSoD. Turns out, those with the BSoD may also have another problem; a rootkit.  In other Microsoft matters, I’ve included an article on using Windows Communication Foundation services to perform a remote portscan, but which may also lead to other types of attacks against internal hosts.

Closing things out, TippingPoint’s Zero Day Initiative has announced the 2010 version of its Pwn2Own contest at the CanSecWest conference.  The targets of choice for this year are Web Browsers and Smart Phones.  I’m sure you’ll be reading about the outcome, or the patches from the outcome, after March 24th.

Shmoocon 2010 Podcasters Meetup – NSFW!!!!!!

This is the audio from the 2010 podcasters meet up.  This is UNEDITED and completely raw.  This file is NOT safe for work.  You have been warned!

SecuraBit Episode 50: Interview with Rob Lee!

SecuraBit Episode 50: Interview with Rob Lee!

  • What is SANS vLive?
  • Forensics
  • DOD Cyber Crime
  • How the forensics classes are structured.
  • 508 course and how it’s changed. Divided up into essentials and then follow on courses. 6 total courses for all of the info.
  • APT – Advanced Persistant Threat
  • Q & A from the IRC

If you havent taken the Security 508 course yet we have an excellent opportunity for you!  Rob will be teaching the SEC508 (Forensics) course  via the SANS vLive! platform beginning 3/23/2010. Classes will occur  every Tuesday and Thursday until 4/29/2010 from 7-10PM EDT.

Use code SB508 to get a free GCFA certification attempt with the  purchase of the full course.
Chat with us on IRC at  irc.freenode.net #securabit

Hosts:
Anthony Gartner – @anthonygartner
Christopher Mills – @thechrisam
Chris Gerling – @chrisgerling
Jason Mueller – @securabit_jay
Andrew Borel – @andrew_secbit

Guests:
Rob Lee – @robtlee

Links:
http://phishme.com/
http://phishtank.com/

SecuraBit live tonight with Rob Lee!

Join us tonight as we interview Rob Lee where he’ll be discussing his upcoming SANS vLive! course as well as other happenings in the security world….APT.

We should be live around 8pm EST tonight, join us on IRC or listen in live at this link!

If you haven’t taken the Security 508 course yet we have an excellent opportunity for you!  Rob will be teaching the SEC508 (Forensics) course via the SANS vLive! platform beginning 3/23/2010.  Classes will occur every Tuesday and Thursday until 4/29/2010 from 7-10PM EDT.

Chris Gerling has taken the 508 course and recommend anyone who is interested in computer forensics take it as well.  Even if you aren’t a full-time forensic examiner, the information you take away from the class will help you in all aspects of information security.  Understanding how file systems and memory work can be crucial.

Please check out the course and register at this link!  Use code SB508 to get a free GCFA certification attempt with the purchase of the full course.

Vulnerability Roundup

So last month’s Patch Tuesday was pretty quiet on the Microsoft front.  Not so lucky this month with a total of 13 bulletins, 5 critical, 7 important.  And one for MS Paint.  That’s right, Paint.  Looks like I’ll have to put down the little spray paint tool for a bit. The others include patches for Office (2 of them), SMB (2 more), an update of ActiveX killbits, IPv6 stack vulnerabilities, Hyper-V, ShellExecute, Client/Server Run-time, Kerberos and the Windows Kernel.

Oracle has also released an out-of-band patch this week for a problem with their WebLogic Node Manager.  Also in the Oracle world, David Litchfield demonstrated a 0-day against Oracle’s 11g database server.  It doesn’t appear there is a patch available yet, so check the links for mitigation info.

Samba also has a post regarding a zero day attack for a directory traversal issue via symlinks.  I’ve included both a post on the vulnerability and a link to a post by the Samba developers.  On one hand, yes it does look a configuration error by an admin.  At the same time, it is the default configuration.  I’ll leave it to you to decide.  Besides, it never hurts to double check those smb.conf’s.

In an ongoing theme of malware in App Stores, or Market Places, or Galleries, it looks like two pieces of malware made it onto the Add-on site.  One is a password sniffer disguised as video downloader, and the other contained a backdoor.

Additionally there are some updates available for LANDesk Management Gateway which fixed a problem which allows an attacker to run commands as root.

Adobe JavaScript Blacklisting

The JavaScript implementations in Adobe Reader and Acrobat have been a sore spot for Adobe (as well as administrators) for a while now.  To help make the world a safer place, Adobe has added a feature to Reader (versions 9.2 and 8.1.7) to allow administrators to blacklist certain functions in the JavaScript API.  Many times when 0days are released for Reader, the recommendation for administrators is to disable JavaScript in Reader while a patch is readied.  The problem is that in many organizations PDF forms are used extensively, so disabling JavaScript can mean that these forms stop working, so disabling it may not be practical.  In addition, if it is disabled while waiting for a patch, that period of time may be long, as Adobe has switched to a quarterly update schedule, and has cited this schedule in the past as a reason for delaying patches.

The new JavaScript Blacklist Framework for Reader and Acrobat uses some configuration settings (registry on Windows, Preferences on MacOS).  Instead of using one area for the settings, the Framework has two.  The first is for administrators, and it appears the second is for Adobe to use in conjunction with the new silent update feature they have rolled out in beta versions of Reader.  This means that the updates will not trample over administrator preferences.

Of course, there will always be cases where organizations know of a vulnerability in a particular function of the JavaScript API which is used by business documents, Adobe has also added a way to add “trusted locations” (by URL or path), as well as certificate management so that particular documents and be exempted from blacklisting.

There are some drawbacks, such as limitations to what can be blacklisted (not all JavaScript functions are eligible, nothing from the 3D JavaScript API, if a blacklisted function is called, all scripts in a document will stop working), but it is a good start.

SourceFire’s VRT has a post on some of their testing with the framework, and is nice enough to supply some suggestions for blacklisting candidates, as well as sample PDFs which can be used for testing.

Adobe Reader and Acrobat JavaScript Blacklist Framework

Managing JavaScript Execution in the Acrobat Family of Products (PDF)

Enhanced Security and Trusted Locations (PDF)

Vulnerability Roundup

Another week, another Adobe advisory.  This time, it’s not reader, but ColdFusion 9 which shipped with a service someone forgot to lock down to the localhost which would allow an attacker to view system information as well as mess with search indexes.

Two advisories from Cisco as well this week, covering two different products and a few different vulnerabilities (XSS, SQLi, and escalation of privilege among them).  Updates are also available for the iPhone OS for iPhones and iPod Touch devices which resolve vulnerabilities in different aspects of the OS.  In many cases visiting or viewing malicious content could cause overflows, which may allow for code execution.  An update for VMWare’s vCenter with more than 50 CVE’s covered, is also listed.

Some Open Source applications are also listed, one of the interesting ones is the e107 CMS, which was found to have a backdoor which was later used to compromise the project’s site before they applied their own patch (more details on that here).