PayPal vulnerability finally closed

On Wednesday night, payment processor PayPal closed the security hole in its portal that had been publicly known for five days. The company had been aware of the vulnerability for about two weeks. The hole was a critical one: it allowed attackers to inject arbitrary JavaScript code into the PayPal site, potentially enabling them to harvest users' access credentials.

Why PayPal took so long to fix the hole is incomprehensible – the information required to exploit the hole has been circulating on the net since last week and there was an urgent need for immediate action. In similar cases, affected companies tend to respond within 24 hours.

Another cause for irritation is that, even as late as Tuesday, a PayPal spokesperson told The H's colleagues at heise Security that "at this moment, there is no indication" that PayPal customer data is at risk – despite heise Security providing proof to the contrary by embedding their own login form into the HTTPS-secured PayPal site. Attackers with a little more criminal motivation could have injected a phishing page that, at first glance, looked identical to the original.

The vulnerability was discovered by Robert Kugler, a 17-year-old student, who originally wanted to report it via the bug bounty program that the company launched last year. When PayPal didn't allow him to participate in the program because he wasn't yet 18, the student released the details of his discovery on the Full Disclosure security mailing list, but only after giving PayPal a week's period of grace, which the company allowed to pass. 

Kugler reports that he received another email from PayPal yesterday in which the company said: "the vulnerability you submitted was previously reported by another researcher", which suggests that the company knew of the problem for more than two weeks before moving to fix the issue. PayPal says it is for this reason that they are not paying Kugler the bug bounty and chastises Kugler for disclosing the issue to the public. The company is, though, offering to send the young researcher a "Letter of recognition" for his investigation.

read more

Windows zero day vulnerability publically exposed by google engineer

A Google security expert who has clashed with Microsoft in the past over how it discloses Windows security flaws is at it again. 

Tavis Ormandy, an information security engineer at Google, has found what he's calling "a pretty obvious bug" in Windows 7 and Windows 8.

On Monday, Ormandy posted detailed information about it to Full Disclosure, a mailing list for security experts. That could be used to crash PCs or gain additional access rights. The issue is less critical than other flaws as it's not a remotely exploitable one.

Ormandy said on Full Disclosure, "I don't have much free time to work on silly Microsoft code, so I'm looking for ideas on how to fix the final obstacle for exploitation.

Ormandy said he's written code that hackers could use to take advantage of the Windows flaw—known in security circles as a "working exploit".

He isn't releasing it to the public, but is making it "available on request to students from reputable schools." This means other security researchers, not college students. 

Ormandy first published details about the Windows bug on Github, a site that lets developers collaborate on projects, in March. But he hasn't said whether he's reached out to Microsoft, which is standard procedure in these situations. 

Microsoft says it's aware of Ormandy's latest Windows flaw and is investigating.

"We have not detected any attacks against this issue, but will take appropriate action to protect our customers," Dustin Childs, a group manager in Microsoft's Trustworthy Computing unit, told Business Insider in an email. 

We've reached out to Ormandy to see if he contacted Microsoft before his May 17 post to the Full Disclosure list. We've also reached out to Google for comment. 

As Windows security flaws go, this isn't a major one because hackers can't use it to take control of machines over an Internet connection. Still, because so many people use Windows, Microsoft will probably fix this bug soon. 

Security researchers usually contact the vendor first before they talk publicly about a bug they've found. But Ormandy and Microsoft have a rocky history. 

In 2010, Ormandy discovered a previously unknown bug in Windows XP's Help and Support Center, and posted a working exploit to the web five days after telling Microsoft about it.

Hackers quickly figured out how to use it, and began attacking Windows XP PCs. 

Microsoft, which released an emergency fix for the bug, wasn't pleased. This sparked a big IT industry debate about how long researchers should wait after informing a vendor about a security flaw before going public with it. 

Ormandy, in a post to his personal blog last week, warned security researchers that Microsoft typically reacts to bug reports with "great hostility" and is "very difficult" to work with. They should only submit reports anonymously, he said.

read more

Critical Linux vulnerability imperils users, even after “silent” fix

For more than two years, the Linux operating system has contained a high-severity vulnerability that gives untrusted users with restricted accounts nearly unfettered "root" access over machines, including servers running in shared Web hosting facilities and other sensitive environments. Surprisingly, most users remain wide open even now, more than a month after maintainers of the open-source OS quietly released an update that patched the gaping hole.

The severity of the bug, which resides in the Linux kernel's "perf," or performance counters subsystem, didn't become clear until Tuesday, when attack code exploiting the vulnerability became publicly available (note: some content on this site is not considered appropriate in many work environments). The new script can be used to take control of servers operated by many shared Web hosting providers, where dozens or hundreds of people have unprivileged accounts on the same machine. Hackers who already have limited control over a Linux machine—for instance, by exploiting a vulnerability in a desktop browser or a Web application—can also use the bug to escalate their privileges to root. The flaw affects versions of the Linux kernel from 2.6.37 to 3.8.8 that have been compiled with the CONFIG_PERF_EVENTS kernel configuration option.

"Because there's a public exploit already available, an attacker would simply need to download and run this exploit on a target machine," Dan Rosenberg, a senior security researcher at Azimuth Security, told Ars in an e-mail. "The exploit may not work out-of-the-box on every affected machine, in which case it would require some fairly straightforward tweaks (for someone with exploit development experience) to work properly."

The fix to the Linux kernel was published last month. Its documentation did not mention that the code patched a critical vulnerability that could jeopardize the security of organizations running Linux in highly sensitive environments. This lack of security advisories has been standard practice for years among Linus Torvalds and other developers of the Linux kernel—and has occasionally been the subject of intense criticism from some in security circles.

Now that a fix is available in the kernel, it will be folded into all of the affected stable kernel releases offered by kernel.org, which maintains the Linux core code. Individual distributions are expected to apply the fix to their kernels and publish security updates in the coming days.

Additional details of the bug are available here, here, here, and here. People running vulnerable machines with untrusted user accounts should check with their distributors to find out when a patch will be available and what steps can be taken in the meantime. One user of a Red Hat Linux distribution posted temporary mitigation steps here, although at time of writing, Ars was unable to confirm that they worked. Readers are encouraged to post other mitigation advice in comments.

read more

Firefox 21 Fixes 3 Critical Flaws, Introduces New Health Report

Mozilla fixed eight vulnerabilities, three critical, in the 21st build of its flagship Firefox browser yesterday.

One of the fixes remedies an Address Sanitizer memory corruption flaw (MFSA 2013-48) that could’ve allowed remote code execution. The other two critical flaws could’ve also led to arbitrary code execution and deal with fixing memory safety bugs (MFSA 2013-41), and a video resizing bug (MFSA 2013-46) in Firefox and Thunderbird.

For a complete list of the bugs fixed by Firefox 21, all 681 of them, head to Bugzilla.

The latest version of the browser also introduces something Mozilla is calling the Firefox Health Report, a tool that aims to give users a comprehensive look into the browser’s health and usage. The report will breakdown any insecure and unstable plugins it blocks throughout the day and will also document crash history and malware attack history, according to a post on Mozilla’s Future Releases blog by Jonathan Nightingale, the company’s Vice President of Engineering.

Users can choose whether they want the tool to share data Mozilla gathers about their browser with the company. If shared, the information will be aggregated and anonymized and used to help Firefox’s security team improve the browser. Users can change their preferences in the Data Choices section of the browser’s Options menu.

The update also brings expanded social API and Do Not Track options to help users better customize their privacy settings.

The social API opens the browser up to sidebar and toolbar providers like Cliqz, msn NOW and Mixi, while the Do Not Track update tweaks an already existing setting in the browser. The new default privacy setting doesn't tell websites anything about the users’ tracking preferences. Users can change that and choose whether they want to tell sites if they want to be tracked (Do Track, Do Not Track, No Preference) in the settings.

The updates are being pushed to Firefox users via the browser’s automatic update system, per usual. Those who don’t have that set up can download them through both the Firefox and Thunderbird download pages.

read more

90+ Pakistani websites Vulnerable to SQL injection, found by "Jai Bhavani Hacker"

Hacker named as "Jai Bhavani Hacker"  found SQL Injection Vulnerabilities in more than 90 pakistani websties including government sites and education sites.

Pakistan Science Foundation ,Laureate Business School ,Business center and more sites vulnerable to the sql  injection. An attacker can exploit this vulnerability and compromise the database.

List of some vulnerable websites

http://swissbusinesscouncil.com.pk/pages.php?pageid=7'&id=4'

http://www.amch.edu.pk/page_detail.php?page_id=61'

http://www.amch.edu.pk/page.php?page_id=34'

http://www.arttechniques.com.pk/page.php?page_id=21'

http://www.mb.com.pk/products.php?id=28%27'

http://www.jsm.com.pk/products/details?pr=9'

http://prcs.org.pk/page.php?pg_id=52'

http://www.prcs.org.pk/faq.php

http://finance-mansehra.gov.pk/hospitals.php

http://www.hangal.com.pk/quickLinks.php

Click here to see more

read more

IT websites in India top targets for phishers

Phishers have already made their mark in the financial sector by causing more than 130 crore (2.4 Billion USD) loss to Indian banks in the last 3 years due to various sophisticated attacks, news reports have stated.
While the country is still feeling the heat of the advancement and exponential rise in phishing attacks, the Symantec Intelligence Report on phishing sites in India reveals Information Technology sites to be the most vulnerable amongst the targeted websites by the Phishers last year.

 

According to Symantec February Intelligence report, the global phishing rate increased by 0.018 percentage points, taking the global average rate to one in 466.3 emails (0.214 percent) since January 2013. In the month of January, the number of phishing URLs associated to Indian brands accounted for 0.15 percent of the global phishing statistics.

 

This implies a new wave of phishing attacks among various organizations as the cyber criminals become highly sophisticated and targeted. Phishers continue to pursue Indian sites across many disciplines to host their phishing pages. The most targeted Indian sites are classified in various categories - Information Technology (14.40%), Education (11.90%), Product Sales and Services (9.80%), industrial and manufacturing (7.30%), and Tourism, Travels and Transport (5.80%).

The figures for secure websites such as Government, Telecommunication, and ISP were low and at the bottom of the list. This offers evidence that phishers opt to target more vulnerable websites

read more

Pak web domain .pk remains vulnerable to cyberattacks

PKNIC - a shared registry system that manages the .pk domain name space (DNS) for Pakistani websites - which was hacked twice in the last three months, remains vulnerable to basic-level cyberattacks.

Though the company has thwarted the recent attack, it is still investigating the security breach, reports The Express Tribune.

PKNIC, which hosts 23,000 users of the .pk domain, including national-level websites, was attacked this Monday after a group of hackers penetrated and defaced several websites, including those of Pakistan's famous newspapers.

The hackers - ZombiE_KsA, Z3r0Byt3, Xploiter and Dr Freak - criticised PKNIC for being unable to fix the vulnerabilities in its DNS servers.

This was the second successful attack on PKNIC, a private company based in California, United States.

In November 2012, Eboz, a Turkish hacker, entered PKNIC servers, taking down about 284 websites with the .pk domain including google.com.pk. Later on, PKNIC issued a statement, claiming it had fixed the vulnerabilities and the website was secured.

PKNIC has not mentioned what measures it is considering to protect its website from attacks in future.

The attack on DNS is considered a very basic hacking technique in cyberworld, according to Barrister Zahid Jamil, an expert in assessing cyber crime. Jamil believes that the recent attack was the result of security flaws in the clients' own websites.

Rafay Baloch, a professional white hat who recently bagged $10,000 in Paypal's bug bounty programme after exposing a critical vulnerability in the website, also called it a basic-level attack.

However, he said it is believed across many online forums that PKNIC is also vulnerable to SQL injection - the most powerful cyberattack, according to Open Web Application Security Project (OWASP). OWASP is the world's largest organisation in terms of web application security and penetration testing.

At present, there are no laws in Pakistan to govern this type of cybervandalism.

read more

Buffer Overflow vulnerability in VLC media player

VideoLAN recently published a security advisory warning of a buffer overflow vulnerability in versions 2.0.5 and earlier of VLC Media Player, which might be exploited to execute arbitrary code. This vulnerability was reported by Debasish Mandal.

Buffer Overflow vulnerability in VLC media playerThe vulnerability is caused due to an error in the "DemuxPacket()" function (modules/demux/asf/asf.c) when processing ASF files and can be exploited to cause a buffer overflow via a specially crafted ASF file. To exploit the vulnerability, a user must explicitly open a specially crafted ASF movie.

Successful exploitation may allow execution of arbitrary code, but requires tricking a user into opening a malicious file.

VideoLAN advises users to refrain from opening files from untrusted locations and to disable the VLC browser plug-ins until the issue is patched. A patch will be included in VLC 2.0.6, the next version of the media player, which is only available for testing purposes at the moment.

read more

Critical vulnerability warned in Cloudstack

The Apache Foundation and Citrix have warnedof critical configuration vulnerability in the current version of the open source cloud infrastructure management software, CloudStack.

The vulnerability affects all versions of Cloudstack, including Citrix commercial version.

The issue could allow execution of arbitrary Cloudstack API calls, such as deletion of all virtual machines in a system.

No recognized exploits have been released for the vulnerability.

Mitigation against the vulnerability is possible by logging into the Cloudstack MySQL database, disabling the system user and setting a random password.

Cloudstack is one of the largest open source cloud infrastructure management systems together with Open Stack and Eucalyptus.

Incubated by the Apache Software foundation, Cloudstack counts over 50 large organisations such as Intel, BT, Alcatel-Lucent, Active State and Tata Communications among its technology partners.

In March this year, Citrix announcedthat it would abandon its OpenStack distribution in favour of the CloudStack operating system.

 

read more