Another day, another set of cracking tools.
Cryptography specialist Moxie Marlinspike released tools at Defcon today for easily cracking passwords in wireless and virtual private networks that use a popular encryption protocol based on an algorithm from Microsoft called MS-CHAPv2, news that will no doubt worry many a network administrator.The tools crack WPA2 Wi-Fi Protected Access and VPN passwords used by corporations and organizations running networks that are protected by the PPTP Point-to-Point Tunneling Protocol, which uses MS-CHAPv2 for authentication.ChapCrack captures the MS-CHAPv2 handshakes, or SSL Secure Sockets Layer negotiation communications, and converts them to a token that can be submitted to CloudCracker.It takes less than a day for the service to return results in the form of another token that is plugged back into ChapCrack where the DES Data Encryption Standard keys are cracked. With that data, someone can see all of the information traveling across the Wi-Fi network, including sensitive corporate e-mails and passwords, and use passwords that were revealed to log in to corporate networks.The tools are designed for penetration testers and network auditors to use to check the security of their WPA2 protected networks and VPNs, but they may well be used by people who want to steal data and get unauthorized access to networks.
Yet another reason for businesses that haven’t done so yet to move beyond PPTP and Windows XP
- Stronger password hashing in .NET with Microsoft’s universal providers (troyhunt.com)
- Wireless Internet Security (techhelpertoday.wordpress.com)
If you haven’t applied the patch yet beware. If your still using IE 6, upgrade.
Starting late Wednesday, researchers at antivirus vendor Symantec‘s Security Response group began spotting dozens of Web sites that contain the Internet Explorer attack, which works reliably on the IE 6 browser, running on Windows XP. The attack installs a Trojan horse program that is able to bypass some security products and then give hackers access to the system, said Joshua Talbot, a security intelligence manager with Symantec.
Once it has infected a PC, the Trojan sends a notification e-mail to the attackers, using a U.S.-based, free e-mail service that Symantec declined to name.
As of midday Thursday, Symantec had spotted hundreds of Web sites that hosted the attack code, typically on free Web-hosting services or domains that the attackers had registered themselves.
The IE flaw being leveraged in these attacks was also used to hack into Google‘s corporate network last December. It has been linked to similar incidents at Adobe Systems and 33 other companies. Microsoft patched the vulnerability in an emergency security update Thursday morning.
The Google attack hit IE 6 on Windows XP, but over the past week hackers have found ways to exploit the flaw on more recent versions of the browser as well. These latest techniques do not appear to be used on the Web sites Symantec has uncovered. They use the IE 6 exploit code, Talbot said.
Still, with IE 6 still being widely used, the move to more widespread attacks is worrying. “It may be an indication that attackers have finally ramped up their attack toolkits and are now ready to launch widespread attacks,” Talbot said.
Phishing is being used to gain victims.
He believes that the criminals are tricking victims into visiting their Web sites by sending spam e-mail or instant messages with links to sites.
On Thursday, Websense published some sample e-mails used in targeted attacks that exploit the IE bug. A typical subject line is “Helping You Serve Your Customers.” The e-mail reads, “I just heard the news: Helping you serve your customers” and includes a link to the malicious Web site.
The e-mails contain spoofed e-mail addresses, designed to fool victims into thinking that they were sent by a colleague. The malicious Trojan used in the attack is not the same one that was used in the Google attack, however.
Websense has seen these e-mails sent to targeted companies in the U.S. and the U.K., said Patrik Runald, a security research manager with Websense. “These attacks are actually continuing; they happened today; they happened yesterday and they happened the day before.”
However, Websense believes that the e-mails it has tracked are part of a small-scale targeted attack, similar to those used on Google and Adobe in attacks that are ongoing. Websense has counted only about 25 malicious Web sites to date, but the number is rising fast, Runald said. (Source: InfoWorld)
Related articles by Zemanta
- Widespread attacks exploit newly patched IE bug (computerworld.com)
- Microsoft Plugs Security Hole Used in December Attacks (bits.blogs.nytimes.com)
- 5 More Reasons Why IE6 Must Die (mashable.com)
Microsoft has released 10 security updates fixing a record number of Patch Tuesday holes, including one for a critical hole in Internet Explorer 8 that was exploited as part of a hacking contest at CanSecWest in March.
The bulletin addresses 31 vulnerabilities. “It’s the most since Microsoft started releasing updates on a regular schedule of the second Tuesday of every month in October 2003,” a Microsoft spokesman said.
The June security Patch Tuesday bulletin resolves eight vulnerabilities in IE, the more severe of which could allow remote code execution if a user views a specially crafted Web page. The IE8 vulnerability does not affect Windows 7 RC (build 7100), but does affect Windows 7 beta.
The updates also plug two critical holes in implementations of Active Directory on Windows 2000 Server and Windows Server 2003, and Active Directory Application Mode installed on Windows XP Professional and Server 2003, the worse of which could allow an attacker to take control of a system remotely.
The security update fixes three critical vulnerabilities in Windows Print Spooler that could allow remote code execution if an affected server received a specially crafted RPC (remote procedure call) request.
Several vulnerabilities in Office Word and Excel are addressed in the update that could allow an attacker to remotely run code or take control of the machine using a specially crafted Word or Excel file. The update fixes the PowerPoint vulnerability Microsoft warned in April was being exploited in limited, targeted attacks that was fixed in the Windows version last month.
“We didn’t see any in-the-wild exploitations of the (IIS WebDav) vulnerability but typically when Microsoft releases those alerts they’re doing it because a customer” has alerted them to an exploit,
said Steve Manzuik, senior manager of security research at Juniper Networks.
Also fixed is a critical vulnerability in Microsoft Works Converters, important vulnerabilities in RPC and Windows Kernel. And Microsoft fixed a moderate vulnerability in Windows Search that could allow
information disclosure if a user performs a search that returns a specially crafted file as the first result, or if the user previews a malicious file from the search results. By default, the Windows Search component is not preinstalled on Windows XP and Server 2003.
Other affected software includes Office Excel Viewer; Office Word Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats; Works 8.5 and 9.0; and Office SharePoint Server. (Source: Microsoft issues patches – CNET News-Security)
Second up was Adobe with it’s first quarterly update.
In a security advisory, Adobe said that the vulnerabilities would cause applications to crash and potentially enable an attacker to take control of an affected system. None of the flaws are being actively exploited, according to Adobe.
The advisory said that users of Reader and Acrobat should update their products to versions 9.1.2, 8.1.6, or 7.1.3. The updates apply to Windows and Macintosh, but updates for Adobe Reader on UNIX platforms will have to wait until June 16.
Specifically, the updates address issues such as stack overflow, memory corruption and heap overflow vulnerabilities that could potentially lead to code execution. (Source: Adobe patches Reader and Acrobat for “critical vulnerabilities – SC Magazine US)
If you haven’t already done so it would be wise to apply the released patches.
Related articles by Zemanta
- Microsoft issues patches, including one for IE exploit (thaibrother.com)
- Microsoft, Adobe warn of critical security flaws (canada.com)
- Companies still dragging their feet with patches (computerworld.com)
- Week in Microsoft: it’s all about IE8 (and Silverlight 3) (arstechnica.com)