Chinese researchers inadvertently release IE7 exploit code

Chinese security researchers have admitted that they inadvertently released code that might be misused to exploit an unpatched Internet Explorer 7 vulnerability. (as well as these systems) System: WINDOWS XP WINDOWS XP, WINDOWS 2003 WINDOWS 2003, WINDOWS VISTA WINDOWS VISTA Browser: IE5,IE6,IE7,IE8 Scripts to pull off the trick were already on sale in underground forums before the inadvertent release.

Even so, anything that increases the likelihood of digital delinquents getting their hands on the exploit is unwelcome. VeriSign\'s iDefense security division reports that attack code was up for sale at prices of up to $15,000 through underground forums. Prices are likely to slide following the escape of assault code from labs run by KnownSec. Posted in Anti-Virus, 11th December 2008

Security tools firm eEye reckons the flaw has been the target of exploitation since 15 November. According to iDefense, KnownSec made the code available after failing to realise that last Tuesday\'s Microsoft bulletins failed to fix the underlying vulnerability behind the bug, which revolves around IE7\'s handling of malformed XML tags.

A explanation of what happened by KnownSec (in Mandarin) can be found here- translated to english. http://translate.google.com/translate?u=ht...en&ie=UTF-8 The flaw affects XP and Vista users, and creates a means to load Trojans or other forms of malware onto even fully patched Windows boxes simply by tricking surfers into visiting maliciously constructed websites.

Thus far the attack method has been restricted to delivering game password stealers, the Internet Storm Centre reports. Microsoft is investigating reports of attacks and considering its options. The timing of the attack in the run up to the holiday period and just after a bumper batch of eight bulletins suggests an out of sequence patch might be on order before the next scheduled Patch Tuesday, on 13 January.

Hackers Successfully Install Linux on a Potato

“Amsterdam, Netherlands – Hackers from the LinuxOnAnything.nl Web site successfully installed Linux on a potato. It’s the first time the operating system has been successfully installed on a root vegetable” - [bbspot]


After weeks of trying the group got a Linux kernel specially modified for a potato loaded, and were able to edit a small text file in vi. Linux was loaded onto the potato using a USB thumb drive and commands were sent in binary to the potato using a set of red and black wires.

The LOA group is a part of a growing group of hackers attempting to get Linux loaded on anything. It started on electronic devices like Gameboys and iPods, but recently groups have taken on tougher challenges like light bulbs and puppies.

The LOA group was in a race with another hacker group, the Stuttering Monarchs, to be the first to bag the potato. “The potato has been the vegetable that everyone has been gunning for, because it’s so versatile like Linux itself. You can boil ‘em, mash ‘em, stick ‘em in a stew,” said Piest. “You’d think we’d get some sort of reward for this, but it’s all about bragging rights for us.

Trojan In Mass DNS Hijack

Researchers have identified a new trojan that can tamper with a wide array of devices on a local network, an exploit that sends them to impostor websites even if they are hardened machines that are fully patched or run non-Windows operating systems.

The malware is a new variant of the DNSChanger, a trojan that has long been known to change the domain name system settings of PCs and Macs alike. According to researchers with anti-virus provider McAfee's Avert Labs, the update allows a single infected machine to pollute the DNS settings of potentially hundreds of other devices running on the same local area network by undermining its dynamic host configuration protocol, or DHCP, which dynamically allocates IP addresses.

"Systems that are not infected with the malware can still have the payload of communicating with the rogue DNS servers delivered to them," McAfee's Craig Schmugar writes here of the new variant. "This is achieved without exploiting any security vulnerability."

The scenario plays out something like this:

* Jill connects a PC infected by the new DNSChanger variant to a coffee shop's WiFi hotspot or her employer's local network.

* Steve connects to the same network using a fully-patched Linux box, which requests an IP address.

* Jill's PC injects a DHCP offer command to instruct Steve's computer to rout all DNS requests through a booby-trapped DNS server.

* Steve's Linux box can no longer be trusted to visit authoritative websites. Although the address bar on his browser may show he is accessing bankofamerica.com, he may in fact be at an impostor website.

The only way a user might know the attack is underway is by manually checking the DNS server his computer is using (e.g. by typing "ipconfig /all" at a Windows command prompt). There are several countermeasures users can take, Schmugar said, the easiest being hard-coding a DNS server in a machine's configuration settings.

(In Windows, this can be done by going to Start > Control Panel > Network Connections and right clicking on Local Area Connection and choosing properties. Scroll down to Internet Protocol (TCP/IP) and click the Properties button. Then type in the primary and secondary for your DNS service. We're partial to OpenDNS, whose settings are 208.67.222.222 and 208.67.220.220.)

In an interview, Schmugar said the DHCP attack doesn't exploit a vulnerability in either user machines or network hardware, allowing it to work with a wide variety of home and enterprise routers. It involves a ndisprot.sys driver that is installed on the infected box. Once there, it monitors network traffic for DHCP requests and responds with bogus offers that contain the IP address to the rogue DNS server.

DNSChanger has already been viewed exploiting router weaknesses to change DNS settings, but the ability to poison other machine's DHCP connections appears to be new, said Eric Sites, VP of research at Sunbelt Software. For the moment, the new variant doesn't appear to be widely circulated, but the prospect of a trojan that can poison other machines' DHCP connections suggests this one is worth watching.

History Of Hacking

Hacking has been around for more than a century. In the 1870s, several teenagers were flung off the country's brand new phone system by enraged authorities. Here's a peek at how busy hackers have been in the past 35 years.

Early 1960s

University facilities with huge mainframe computers, like MIT's artificial intelligence lab, become staging grounds for hackers. At first, "hacker" was a positive term for a person with a mastery of computers who could push programs beyond what they were designed to do.

Early 1970s

John Draper
John Draper
John Draper makes a long-distance call for free by blowing a precise tone into a telephone that tells the phone system to open a line. Draper discovered the whistle as a give-away in a box of children's cereal. Draper, who later earns the handle "Captain Crunch," is arrested repeatedly for phone tampering throughout the 1970s.

Yippie social movement starts YIPL/TAP (Youth International Party Line/Technical Assistance Program) magazine to help phone hackers (called "phreaks") make free long-distance calls.

Two members of California's Homebrew Computer Club begin making "blue boxes," devices used to hack into the phone system. The members, who adopt handles "Berkeley Blue" (Steve Jobs) and "Oak Toebark" (Steve Wozniak), later go on to found Apple Computer.

Early 1980s

Author William Gibson coins the term "cyberspace" in a science fiction novel called Neuromancer.

In one of the first arrests of hackers, the FBI busts the Milwaukee-based 414s (named after the local area code) after members are accused of 60 computer break-ins ranging from Memorial Sloan-Kettering Cancer Center to Los Alamos National Laboratory.

The Hacker Quarterly cover Comprehensive Crime Control Act gives Secret Service jurisdiction over credit card and computer fraud.

Two hacker groups form, the Legion of Doom in the United States and the Chaos Computer Club in Germany.

2600: The Hacker Quarterly is founded to share tips on phone and computer hacking.

Late 1980s

The Computer Fraud and Abuse Act gives more clout to federal authorities.

Computer Emergency Response Team is formed by U.S. defense agencies. Based at Carnegie Mellon University in Pittsburgh, its mission is to investigate the growing volume of attacks on computer networks.

At 25, veteran hacker Kevin Mitnick secretly monitors the e-mail of MCI and Digital Equipment security officials. He is convicted of damaging computers and stealing software and is sentenced to one year in prison.

First National Bank of Chicago is the victim of a $70-million computer heist.

An Indiana hacker known as "Fry Guy" -- so named for hacking McDonald's -- is raided by law enforcement. A similar sweep occurs in Atlanta for Legion of Doom hackers known by the handles "Prophet," "Leftist" and "Urvile."

Early 1990s

After AT&T long-distance service crashes on Martin Luther King Jr. Day, law enforcement starts a national crackdown on hackers. The feds nab St. Louis' "Knight Lightning" and in New York grab Masters of Deception trio "Phiber Optik," " Acid Phreak" and "Scorpion." Fellow hacker "Eric Bloodaxe" is picked up in Austin, Texas.

Operation Sundevil, a special team of Secret Service agents and members of Arizona's organized crime unit, conducts raids in 12 major cities, including Miami.

A 17-month search ends in the capture of hacker Kevin Lee Poulsen ("Dark Dante"), who is indicted for stealing military documents.

Hackers break into Griffith Air Force Base, then pewwwte computers at NASA and the Korean Atomic Research Institute. Scotland Yard nabs "Data Stream," a 16-year-old British teenager who curls up in the fetal position when seized.

A Texas A&M professor receives death threats after a hacker logs on to his computer from off-campus and sends 20,000 racist e-mail messages using his Internet address.

Kevin Mitnick
Kevin Mitnick [photo / AP ]
In a highly publicized case, Kevin Mitnick is arrested (again), this time in Raleigh, N.C., after he is tracked down via computer by Tsutomu Shimomura at the San Diego Supercomputer Center.

Late 1990s

Hackers break into and deface federal Web sites, including the U.S. Department of Justice, U.S. Air Force, CIA, NASA and others.

Report by the General Accounting Office finds Defense Department computers sustained 250,000 attacks by hackers in 1995 alone.

A Canadian hacker group called the Brotherhood, angry at hackers being falsely accused of electronically stalking a Canadian family, break into the Canadian Broadcasting Corp. Web site and leave message: "The media are liars." Family's own 15-year-old son eventually is identified as stalking culprit.

Hackers pierce security in Microsoft's NT operating system to illustrate its weaknesses.

Popular Internet search engine Yahoo! is hit by hackers claiming a "logic bomb" will go off in the PCs of Yahoo!'s users on Christmas Day 1997 unless Kevin Mitnick is released from prison. "There is no virus," Yahoo! spokeswoman Diane Hunt said.

1998

Anti-hacker ad runs during Super Bowl XXXII. The Network Associates ad, costing $1.3-million for 30 seconds, shows two Russian missile silo crewmen worrying that a computer order to launch missiles may have come from a hacker. They decide to blow up the world anyway.

In January, the federal Bureau of Labor Statistics is inundated for days with hundreds of thousands of fake information requests, a hacker attack called "spamming."

Hackers break into United Nation's Children Fund Web site, threatening a "holocaust" if Kevin Mitnick is not freed.

Hackers claim to have broken into a Pentagon network and stolen software for a military satellite system. They threaten to sell the software to terrorists.

The U.S. Justice Department unveils National Infrastructure Protection Center, which is given a mission to protect the nation's telecommunications, technology and transportation systems from hackers.

Hacker group L0pht, in testimony before Congress, warns it could shut down nationwide access to the Internet in less than 30 minutes. The group urges stronger security measures.

source name:-- ROBERT TRIGAUX

Google Sponsored Ads Spread Malware

Researchers from Websense Security Labs, who track all sorts of Internet threats, have issued a warning that malicious websites pushing malware are spammed through Google´s sponsored links that are embedded into the search results.


The complex scheme makes use of legit online services and fakes popular websites in order to push malware, which in turn promotes rogue security applications. The Websense analysts uncovered the malicious Google ads while researching another online scam involving malware. ´We thought that this scam could present a good case study to show how the reputations of legitimate and popular applications and online services are being abused to serve and help malware authors to spread malicious software,´ Elad Sharf writes on the Websense Security Labs blog.

When searching for WinRAR, a popular compression utility, Google displayed a sponsored link promoting a free version of the archiver. The link directed to a page imitating a well known download website, which was hosted on a domain in China. The application offered for download on the page was indeed installing the legit WinRAR, but also had a malicious file attached.

An infected explorer.exe, which is dropped into the system32 folder, makes changes to the hosts file in order to redirect requests to popular websites towards a rogue IP, and also prompts the user with alerts once every minute. Trying to visit any website hijacked through the Windows hosts file redirects them to a fake Microsoft Security Center page that claims that the system is infected.

In addition, the page offers a download link to an alleged Anti-spyware application. The prompts that show up on the desktop every minute have the purpose of convincing the users that they have picked up an infection. The download link takes them to a professionally looking page that offers the fake anti-spyware program for sale.

Social engineering tactics, such as scaring individuals into buying useless software, are becoming a popular method of increasing profits for cyber-crooks. The number of such applications has significantly increased in 2008, and this even prompted Microsoft to react. Recently, the Federal Trade Commission has filed a complaint against several individuals and companies behind a major scareware advertising operation.

´This raises some questions,´ Elad Sharf notes. ´Is this problem Google´s fault for not checking whether advertised links actually serve malware? Is it the miseducated user´s fault for getting infected?,´ he asks. The search giant responded through a spokesman who announced that the company was actively working to clean its advertising network of such websites, and stressed that it was committed to protecting its users and customers.

Brian Krebs, reporter for the Washington Post, notes on his Security Fix blog that searching for other popular applications such as Firefox revealed more malicious sponsored links. In addition, he makes the observation that he came across two other such links pointing to malware-related websites while searching for WinRAR, which were different from the one encountered by Websense.

Security Fix Blog
Websence Security Lab report

Source: Softpedia