Internet Kill Switch Humor

"Congress is proposing a bill that would give President Obama a kill switch that he could use to freeze all activity on the Internet if there were a national emergency. The kill switch goes by the top-secret name Microsoft Windows."


-Conan O'Brien

Microsoft's 'Community Watch' Approach to Security

Ars Technica reports:

At the Black Hat security conference today, Microsoft championed a new approach to addressing security issues. The new emphasis is on collaboration between software vendors and security researchers to ensure that customers are kept as safe as possible.

Microsoft likened its approach to Neighborhood Watch schemes—secure computing cannot be achieved with software vendors and researchers all working independently; the landscape is too complex and the attackers are too numerous for this approach to work. Instead, companies must set aside their differences and work together to safeguard customers.

I'm familiar with how neighborhood watches operate. Come with me while I take a jaunty trek through Mr. Ballmer's Neighborhood.

Hey Steve. You left your garage door open.

Yo. Steve-o. Your front door was ajar all night. Again.

Did you know all your Windows are cracked, Steve?

Nice siding and shutters you've got there, Steve. Plan on installing a roof?

Umm, not sure if you noticed, Steve, but Linus Torvald's house seems to have a cloak of invisibility.

Remember, we're all in this together.

Vulnerability in Microsoft Windows Help and Support Function

In the wake of a patch Tuesday that put forth fixes for 34 flaws, Microsoft has issued Security Advisory 2219475 for a publicly-released vulnerability in the help and support center function of Windows XP and Windows Server 2003. Successful exploit could result in remote code execution.

Google security researchers reported the vulnerability to Microsoft on June 5, and publicly released information about the flaw and how it might be used in attacks on June 9.

Microsoft is obviously cranky at Google for the public disclosure, as evidenced by their snarky entry within their Microsoft Security Response Center blog posting:

As always, Microsoft strives to work with security researchers to address vulnerabilities in our software. This helps ensure that customers receive comprehensive, high-quality updates before cyber criminals learn of - and work to exploit - a vulnerability. Responsible disclosure protects the computer ecosystem and individual computer users from harm.

No exploits in the wild have been publicly reported, and its Microsoft's hope that this remains the case while a fix is developed. The suggested workaround is to unregister the HCP protocol.

This isn't the first time flaws in Microsoft's help center have been reported. Thankfully, the vulnerability is not present in Vista and Windows 7 on the client side, or Server 2000 and Server 2008.

Don't expect an out-of-band patch for this one, unless widespread attacks begin popping up. 

Microsoft Security Bulletin for June 2010 Is A Doozy

Hope you weren't planning to take any time off for the next couple of weeks if you're a Windows admin, because Microsoft released their June 2010 patches today, and brother, you've got some work to do.

Ten bulletins addressing 34 separate vulnerabilities make up this month's offering. Products affected include Windows, Office, SharePoint, Internet Explorer, IIS, and the .NET framework. You know - just about everything outside of databases.

Three fixes in particular are worthy of your immediate attention. MS10-033 affects Windows and could allow remote code execution, so prioritize testing and deployment in your environment. MS10-034 is an update for ActiveX Kill Bits and Redmond deems it critical for Windows 2000, XP, Vista, and Windows 7. MS10-035 is a cumulative update for Internet Explorer that addresses six issues, only one of which was publicly known prior to release of the bulletin according to Microsoft.

SANS has a nice breakdown of the patches, associated CVEs, known exploits, and their recommendations for patching prioritization.

The Microsoft Security Response Center blog has Redmond's latest information about this month's bulletin.

As always, test these hotfixes in a dev environment to see if anything breaks before you deploy them into production, and make sure your antivirus and IDS signatures are up to date. It's typical to see the bad guys reverse-engineer certain patches seeking the root vulnerability that they can then exploit before patching can commence.

Home users should ensure that automatic updates are turned on and that your antivirus software is at the latest version with the most updated virus definitions.

Enjoy.

Google vs Microsoft - What's In It For You

Tech blogs are abuzz over Google's recent announcement that they are tossing Windows overboard due to security concerns.

Is this another example of blades of grass (us) suffering when elephants (them) tussle? I don't think so, but let's look at some background.

Google blames Microsoft for the Operation Aurora attacks in which Google systems were compromised and key data stolen, allegedly at the behest of Chinese government officials. In particular, a Microsoft Internet Explorer zero-day exploit was leveraged in the attacks, and Google spent much time and expense cleaning up and securing their environment after the incident.

Microsoft products enjoy a significant, if dwindling, saturation point among both home users and the enterprise. In fact, Google's launch of the Chrome browser and Android mobile platform, along with their upcoming operating system, will result  in Google snatching more market share from Microsoft than from Apple or Linux.

So it makes sense for Google to peel away from Microsoft for all sorts of business reasons outside of security concerns. Internet Explorer is eminently buggy and continually vulnerable, and its percentage of the browser market was dropping even before Chrome was released as users moved to alternatives like Firefox and Opera. Aside from Google developers keeping Internet Explorer around to ensure their products are compatible and render correctly for IE users, there's no compelling reason for anyone other than the coders to have it on their desktops.

The same rationale can be posited from an operating system perspective. If Google's upcoming OS is indeed ready for prime time, Google employees should be using it. Period. Call it the "school of eating your own dog food" if you like, but if you want to convince casual users, application developers, and large companies that your product is worthy of their dollars, you'd better be willing to be a living, breathing use-case.

Speaking as a security guy, there are two concerns I have with Google's announcement. First, the operating system is just one of a myriad of attack vectors available for hackers and exploit frameworks. Secondly, consolidating on a single platform for an enterprise makes life easier for the bad guys.

Let's examine the operating system angle Five years ago, targeting the OS was easy, because Microsoft had a 98% deployment share and, let's face it, their code had more holes in it than Swiss cheese.

As time went on and Microsoft slowly began to execute on their Trustworthy Computing initiative, it became a bit more difficult to penetrate the operating system directly. Part of the solution was the implementation of UAC in Vista and Windows 7 which segregated some of the core kernel functions from direct access, but the enforcement lacks some of the rigor of similar Linux-based controls, and users can dumb down UAC to the point where it isn't all that effective.

Coupled with weak UAC, attackers also stopped breaking down the door and started looking for unlocked windows, pardon the pun, and they found them in peripheral applications like Adobe Reader & Flash, QuickTime, and Microsoft Office. Since these apps also suffer from readily exploitable vulnerabilities and are available in versions that sit atop various operating systems, Google moving away from Windows on the desktop and server is a lesser security achievement than the folks in Palo Alto are trumpeting.

Given that the second most popular attack vector - after peripheral applications - is web-based applications vulnerable to cross-site scripting and SQL injection attacks, it's difficult to believe much protection is gained by switching. Again, regardless of the operating system, you're still at risk if you have poor application development practices that allow such attacks to succeed.

What about moving from a heterogeneous IT environment to a homogeneous shop? Well, there are downsides to that approach, too.

Single platform infrastructures can be a security and resiliency concern. Attackers typically use fingerprinting techniques to systemically profile an organization's IT blueprint. Over time, it becomes apparent what products and versions are in use, and what preventative and detective security controls are in place. This is much easier for attackers when everything is based off of the same underlying code.

Similarly, when a weakness is found, it can be leveraged across the whole enterprise. That can increase both the impact of any attack (or unanticipated failure) and the subsequent time and resources needed to recover and resume normal operations. Having a multi-platform environment lessens that risk, but increases the complexity of an enterprise infrastructure. Few organizations take the resources saved from an uncomplicated, homogeneous environment and pour them back into hardening the underlying backbone.

Google may be firing a marketing shot across Microsoft's bow with their announcement. From a technical perspective, Microsoft is playing catch-up, having lost the cool kids to Apple and Google already. Losing the enterprise customer would be the final nail in Redmond's coffin, and if Google can demonstrate to Fortune 500 companies that they can provide a cost-effective, feature-rich replacement for Windows and Office, they'll be happy to hand businesses the hammer.

Images via Wikimedia Commons

Microsoft Security Intel Report Released

The latest installment of Microsoft's Security Intelligence Report has been released, with a breakdown of threat assessment by country.

Redmond reports that malware was discovered on 7.8 of every 1000 computers scanned in the US, which seems surprisingly low. By comparison, Russia scored a 9.8, while Korea came in at 16.0 per 1000.

Worms and trojans were highlighted as the predominant threats in many of the countries in the report, with password stealers and other trojans/droppers also heavily utilized.

For more details and the full report, check out the Microsoft Security Intelligence Report Volume 8.

Image via Wikimedia Commons

Microsoft Security Bulletin for April 2010

Microsoft has released the April 2010 Security Bulletin, and it's a doozy!

It's imperative that you install MS10-022 now. The vulnerability in VBScript Engine is being actively exploited in the wild, and there's not a lot of time to waste on this one.

MS10-020 should be next on your list, as exploit code has been made public and there's sure to be attacks that leverage this particular SMB vulnerability.

Several others are rated as critical by Microsoft, so if you're prioritizing your deployment schedule, MS10-019, MS10-026, and MS10-027 should be next in line, as "consistent" exploit code is likely, according to Redmond.

In all, twenty-five vulnerabilities in various platforms and applications are addressed in this bulletin.

So much for the Trustworthy Computing initiative, eh? The only thing on which we can count is the high number of patches requiring deployment each month.

Microsoft Offers Temp Measure for Most Recent IE Flaw

While the IT world grinds its teeth waiting for Redmond to issue a permanent fix to close the weaknesses in Internet Explorer noted in Security Advisory 981374, the software giant has released two "Fix It" solutions to hopefully limit the impacts of the exploits currently being noted in the wild.

Microsoft claims that the first stopgap is a "solution for peer factory in iepeers.dll," while the second fix enables Data Execution Prevention (DEP) for those versions of Internet Explorer that happen to support DEP.

Both measures can be downloaded to a USB flash drive and run on affected machines one at a time. That's helpful for home users or a small IT shop, but it's not particularly scalable to the enterprise environment, and there doesn't seem to be any mention of automated deployment methods.

Read the updated advisory to get the details regarding which IE/Windows versions are at risk and to download the "Fit It" code, and make sure you have a plan to roll back the changes if you notice anything not working properly after you run the fix.

No word yet on when Microsoft plans on formally releasing a patch, but with exploit code being posted online, the pressure is on to get something out quickly. We'll see if this means another out-of-band critical patch release.

Microsoft Releases Security Advisory 981374 for Internet Explorer 6/7

If Microsoft Tuesday wasn't enough Microsoft news for you, Redmond has also released Security Advisory 981374 for a publicly disclosed vulnerability in Internet Explorer 6 and 7.

Microsoft's solution? Upgrade to IE8!


Redmond confirms that they are seeing targeting attacks against IE6, but no mention of IE7 except for the following:

Internet Explorer Protected Mode in Internet Explorer 7 running on Windows Vista helps to mitigate the impact of this issue.

Now, that's not quite the same thing as saying you're safe if you're running IE7. More to come, certainly.

The Microsoft Security Response Center blog entry is here.

Microsoft Patch Tuesday for March 2010

Microsoft has taken pity on us and released only two patches this month. This duo of fixes is associated with 8 CVEs.

MS10-016 maps to CVE-2010-265 and impacts Windows Movie Maker. No big deal there, so move this down your prioritization list.

MS10-017 involves a bunch of CVEs related to Microsoft Excel, but there are no known exploits in the wild at this time. This is a wide-ranging vulnerability, affecting all versions of Excel, Office 2004 and Office 2008 for Mac, the Open XML File Format Converter for Mac, Excel viewer, and SharePoint 2007. As is typical, a user would need to open a specially-crafted malicious file in order to get into trouble, but we all know that users click on anything that drops into their inbox, so patch this one sooner rather than later.

The Microsoft Security Response Center blog entry has more details, and the advisory can be found here.

Microsoft Users, Don't Press F1

If you're running any of the older versions of the Windows platform - Windows 2000, XP, or Server 2003 - and you're using Internet Explorer 6,7, or 8, it would be a bad idea to follow any pop-up prompts to press the F1 key.

Microsoft has released Security Advisory 981169 that details a zero-day vulnerability that could allow malicious code to be installed on your PC:

The vulnerability exists in the way that VBScript interacts with Windows Help files when using Internet Explorer. If a malicious Web site displayed a specially crafted dialog box and a user pressed the F1 key, arbitrary code could be executed in the security context of the currently logged-on user.

Sit tight and wait for Redmond to issue a fix. Sound familiar?

Microsoft Ends Support for Vista, XP SP2 Soon

If you're using Windows Vista with no additional service packs, or Windows XP with Service Pack 2, the support clock is ticking.

Microsoft will be dropping support for plain Vista on April 13, and XPSP2 on July 13.

It's time to install the latest service packs for these two products, or lose security update support, which is not a good idea in this vulnerability and malware-infested universe.

More at the Microsoft Support Lifecycle Blog.

Windows 3.1 Replica

Some of us lived and breathed Windows 3.1 back in when it was first released.

Ah, the 16-bit wonder. And Minesweeper.

If you'd like to transport yourself back to that time in technology - and apparently, quite a few people would like that very much - there's now a JavaScript powered website that allows you to party like it's 1992.

We were so deprived back then. But we were also rich beyond our dreams.

Via Dvice

Image by John Mayson's Picasa Web Album

Another Reason Not To Use Internet Explorer

Not a big surprise, but a zero-day Internet Explorer vulnerability was leveraged in the attacks against Google and 30+ corporate networks.

There have been so many holes in IE that I don't understand how it didn't collapse under it's own weight years ago.

From an attackers perspective, it makes perfect sense - corporations make extensive use of Internet Explorer in their infrastructure due to standardization and interoperability strategies, so the attack surface is quite large. Compromise the browser, add in a little remote code execution, and you own the computer the browser is sitting on, which you can leverage to compromise other assets on the network.

Newer versions of IE are less susceptible to these kinds of malicious activity, although it's still a pretty large target. You'd be better off running Firefox with the NoScript extension installed.

If you have to stay on Internet Explorer, at least upgrade to the latest version. There's still a lot of IE6 out there, which makes no sense at all, and it's one of the more risky browser choices. Move to IE7 at a minimum, with IE8 being your best option.

And good Lord, make sure your antivirus is up to date and that you're running Microsoft Update every month - hopefully via Automatic Updates.

For your peripheral applications - many of which have seen attacks and updates of late (hello, Adobe Reader), it makes sense to install Secunia PSI for home machines to let you know when you have vulnerable or end-of-life software that's a problem.

Let's be careful out there.

Microsoft Comments on IIS Vulnerability

Security blogs and websites have been reporting a previously unknown vulnerability in Microsoft IIS that could lead to remote code execution.

From The Register:

The bug stems from the way IIS parses file names with colons or semicolons in them, according to researcher Soroush Dalili. Many web applications are configured to reject uploads that contain executable files, such as active server pages, which often carry the extension ".asp." By appending ";.jpg" or other benign file extensions to a malicious file, attackers can bypass such filters and potentially trick a server into running the malware.

Microsoft has responded via their Microsoft Security Response Center blog in very carefully crafted language that essentially notes they are still investigating this "claim", that they aren't aware of any "active attacks", and that the only systems at risk are in non-default, unsafe configurations that fail to follow Redmond's best-practice guidelines. There's the usual boilerplate language where Microsoft whines that the existence of the flaw was not "responsibly disclosed," which means the researcher didn't call Redmond with the details and give Microsoft coders a year to sit on the vulnerability before doing something about it.

Since it's likely that not every web server admin is following Microsoft's guidelines, and fewer still are security experts, odds are good that the number of sites vulnerable to exploit is large, and the clock is ticking on the bad guys launching attacks configured with the appended file suffix.

If you're not following the best practices outlined in Microsoft's blog posting, you should reexamine your web configs and begin testing in advance of any forthcoming patch. Running unsafe configurations is asking for trouble, and even if Microsoft releases a fix for this particular flaw, your web presence remains at risk until it's hardened.

Microsoft Security Bulletin for December 2009

Hi there, all you Microsoft kiddies. It's Microsoft Tuesday, and you know what that means!

Today Microsoft released six bulletins that reportedly address twelve vulnerabilities in various flavors of Windows, Internet Explorer, and Office.

The good news is that Redmond released MS09-072 for Internet Explorer that addresses four privately-reported and one publicly-reported vulnerabilities in IE. Exploit code for IE6 and IE7 has been floating around in the wild for awhile now, and it's certain that malicious code targeting IE8 will result once this patch is reverse-engineered. Right now, it's significantly more difficult to attack IE8 since DEP is enabled by default if you're running IE8 on XPSP3, Vista SP1 or later, Server 2008, or Windows 7. Which reminds me - why are you still using Internet Explorer, for crying out loud?

MS09-073 targets a critical vulnerability in Wordpad which is unlikely to see widespread exploitation, since it involves someone sending you a specially-crafted .doc file created in legacy Wordpad 8 format, and you would also need to open it using Wordpad or Word.

Unless you're running wireless authentication via IAS using PEAP, there's not much to worry about with MS09-071, and if you don't use Microsoft Project, MS09-074 isn't applicable to you.

There's the obligatory vulnerability targeting LSASS (MS09-069) and another flaw in Microsoft IIS (MS09-070) that leverages a weakness in ADFS, so get to them sooner rather than later, but they can be toward the bottom of your priority list.

Microsoft Security Bulletin Summary for December 2009

IE6 and IE7 0-Day Vulnerability Confirmed

Updated 5:20 PM 11/26/09: Microsoft has released v1.1 of this advisory, updated to include some mitigation steps. This is especially important given the types of exploits being noted in the wild.


Updated 9:45 PM 11/23/09: Microsoft has released Security Advisory 977981 concerning this issue.

Original post: SANS has reported and Symantec has confirmed a flaw in Microsoft Internet Explorer that could allow attackers to compromise a vulnerable system.

According to VUPEN Security:

A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by attackers to compromise a vulnerable system. This issue is caused by a dangling pointer in the Microsoft HTML Viewer (mshtml.dll) when retrieving certain CSS/STYLE objects via the "getElementsByTagName()" method, which could allow attackers to crash an affected browser or execute arbitrary code by tricking a user into visiting a malicious web page.

According to Symantec, the current exploit shows poor reliability, but that's expected to change and the reliability is expected to rapidly improve.

Recommendations are the same as always when Internet Explorer is involved - make sure your antivirus is up to date, disable JavaScript, and only visit trusted sites until Redmond rolls out a patch.

An alternative is to use a browser with a lower attack footprint, such as Firefox with the NoScript add-on.

Microsoft Security Bulletin for November 2009

Since it's so close to Thanksgiving in the US, it seems appropriate for me to express my gratitude that I don't run Microsoft products as a rule and therefore can pass along the November security bulletin for others to implement.

The monthly update includes six patches claimed to address fifteen vulnerabilities in Windows, Windows Server, and Office (Word & Excel). Only one patch, MS09-065, is rated as "critical" by Microsoft with an Exploitability Index of 1 (Consistent exploit code likely). Two others, MS09-063 and MS09-064, are rated as "critical" with an Exploitability Index of 2 (Inconsistent exploit code likely).

SANS seems to disagree with Redmond, rating 3 patches as critical for servers and 4 as critical for clients. Obviously, several of the root vulnerabilities involved are likely to see exploit code released in the wild shortly, and if you've got vulnerable machines without compensating controls, the consistency of the exploit code matters very little.

Similarly, if you aren't blocking ports that aren't required at the firewall, either at the network or client level, then you probably deserve a good dose of exploit code.

The Microsoft Security Response Center blog has all the color detail, including their exploitability matrixes.

Overall, November is a very light month given the activity to which we've come to expect from Redmond, but fear not. There's still plenty of time for fill your stockings with work before the end of the year.

Microsoft Buries Consumers with Avalanche of Vulnerabilities

In the six years since Microsoft stopped pelting us with security fixes willy-nilly and implemented a monthly bulletin format, home and enterprise customers have been entombed by fixes for a soul-crushing 745 vulnerabilities, nearly half rated as "critical" by Redmond.

So laments Jaikumar Vijayan, writing in the Security Smart section of Network World.

The number of announced flaws in the last two years is double what it was in 2004 & 2005, which would seem to suggest that Microsoft's Trustworthy Computing initiative has done more to repair a leaky ship in motion than to build a seaworthy vessel in the first place. That flies in the face of the highly-publicized security mission, which promised a more secure computing environment out of the box.

Who remembers when Redmond shut down development in an effort to educate their architects and developers in the ancient practice of secure coding? I do. Made for some late software launches, as I recall, honking off people with certain licensing agreements, but it was an easier pill to swallow if the result was a modicum of protection from the forces of evil.

And there are some barely-used bridges in Washington state available for pocket change, too.

It's a perfect storm - Microsoft has created a monster in the form of feature-laden, highly-usable ubiqitous software offerings, which has led them to two parallel issues: Any security hardening will inevitably break the free-flow of usability consumers have come to expect, and maintaining depth in feature sets (and securing them) invariably leads to an increase in coding complexity that makes trusted computing all the more daunting a task.

When Vista first launched, one of the more trumpeted security features - UAC - also became one of the most hated. Microsoft attempted to add a thin layer of security into the computing experience, and it was obvious that they also tried to match it to existing usability and customer experience paradigms. It didn't work, because it was a jolting interruption of the seamless Windows pillow-ride that Microsoft had been marketing to us for years.

Linux and UNIX users don't whine much when prompted for admin credentials or root anytime they try to do anything that messes with the core operating system because it's basically been there from the beginning. Plus, it makes sense - a simple step to validate that some chunk of malware isn't trying to make an unauthorized system change. It's a small price to pay for avoiding the horrors of malicious code.

Redmond has essentially hoisted themselves on their own petard. It's like a parent that feeds their child a steady diet of junk food and sugar, and when the kid turns out a tad portly, the dinner plate is suddenly filled with quinoa and Brussels sprouts. What's a chunky lad to do?

This quandry is soon to be faced by the Apple crowd, too. As Macs begin to pick up market share, users will begin to be targeted by the bad guys as they are identified as a target-rich environment. With roughly 10% of computers sold, it's still not as attractive to craft exploits for Mac code as it is for the dominant Windows environment that garners more than 80% of the pie, especially given the ongoing security struggle the 745 vulnerabilities represents.

As Microsoft hopes and prays that XP users shut down forever and the world becomes populated with Vista and Windows 7 users biding time until they convert to Windows 8, their only salvation will be their ability to move users to a more secure environment one tiny step at a time.

The great unknown is whether people are willing to walk that path, and as John Hodgman learns in the newest Mac vs. PC commercials, there's a lot to be said for making a clean break to a new OS if there's going to be pain involved anyway.

Image via Wikimedia Commons

Microsoft Security Bulletin for October 2009

Ladies and gentlemen, we have a new record. Microsoft's Security Bulletin for October 2009 consists of a whopping 13 patches that address 34 outstanding vulnerabilities.

I suppose the good news is that the SMB flaw that's had exploit code in the wild for the last month is included in the patch release, so we'll finally have some closure on that.

Two critical patches target Windows 7, making them the first fixes officially released by Microsoft for their newest platform. While not scheduled for consumer release until the end of the month, Windows 7 has been available since the summer for corporate clients who hold volume licensing agreements.

Redmond is again patching holes in GDI+, and it's been a favorite target of attackers in the past, so don't be surprised if some of the exploit frameworks do some reverse engineering of this newest offering to craft some creative exploits to roll out before the patch hits a wide install base.

If I had to pick a couple of patches to prioritize, I would choose:

• MS09-050, the SMBv2 flaw. There's exploit code already out there, so enough said.
• MS09-052, Windows Media Player - way too easy to exploit with specially-crafted media files, plus there is at least one public exploit out there.
• MS09-053, FTP Service on IIS - two different CVEs for this, both having known exploits in the wild
• MS09-054, Internet Explorer. Firefox or Opera, anyone?
• MS09-062, the aforementioned GDI+ vulnerabilities.

If you're primarily worried about clients instead of servers, MS09-055 deals with the ActiveX killbits, so you'll want to roll that out pretty soon, and MS09-061, involving the .NET Common Language Runtime, has known exploits, so move them up on your list.

All in all, this release will be an enormous pain in a sysadmin's ass due to the sheer size and complexity of the changes introduced. Significant testing will need to be performed against critical systems and applications, not just for the individual patches, but also for the fixes in combination with each other. It's a good thing not many people take vacation time in October.

All of the gruesome details, including the monthly Severity and Exploitability Index, are available at the Microsoft Security Response Center blog.

Image via Robert Scoble's photostream on flickr