Zero-Day vulnerability in Adobe products enables takeover of system

Looks like there is a new vulnerability out that affects Adobe Flash, Player and Acrobat reader. Exploit is out on the Internet. Attackers are able to take over your system if you open up infected files (flash, PDF etc).

From this Adobe advisory:

A critical vulnerability exists in Adobe Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh, Linux and Solaris operating systems, and the authplay.dll component that ships with Adobe Reader and Acrobat 9.x for Windows, Macintosh and UNIX operating systems. This vulnerability (CVE-2010-1297) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild against both Adobe Flash Player, and Adobe Reader and Acrobat.

There is no fix yet. Stay tuned.

Advertisements

iPhone Vulnerability even worse than assumed – everything exposed when connected to Windows

This is getting worse and worse – the good people over at H Security (here is the article) found out that the iPhone issue first reported by security expert Bernd Marienfeldt is even more significant: You can connect an iPhone to a Windows Vista machine and lo and behold, EVERYTHING is accessible, EVEN passwords.

[…] managed to connect an iPhone with iTunes under Windows and created a full backup, including such sensitive data as passwords in clear text.

However, they state, this does not work if the iPhone was in a locked state before it was shutdown. The article says.

[…] has come to the conclusion that the problem only occurs if the iPhone was shut down from an unlocked state. During the wake up this state is restored and the device is “open” for a short period of time before the Springboard application wakes up and locks it down. This short period is sufficient for a pairing to occur that ensures permanent access. An iPhone that was shut down in a locked state does not accept the pairing – which corresponds to heise Security’s observations. This reduces the risk somewhat, because a lost iPhone in a locked state cannot be tricked into pairing.

Either way, crazy stuff.

Child Safety on the Internet – Some Tips

Excellent article on Microsoft.com:

Age-based guidelines for kids’ Internet use

If your children use the Internet at home, you already know how important it is to help protect them from inappropriate content and contact.

Windows Live Family Safety and the parental controls included in Windows 7 and Windows Vista can help you create a safer online environment for your children.

The American Academy of Pediatricians (AAP) helped Microsoft develop age-based guidance for Internet use with the family safety settings in both of these products. It’s important to remember that these are guidelines only. You know your child best.

Up to age 10

Supervise your children until they are age 10. You can use Internet safety tools to limit access to content, Web sites, and activities, and be actively involved in your child’s Internet use, but Microsoft recommends that you sit with your child when they use the Internet, until the age of 10.

Here are some safety tips to consider when you go online with your 2-10 year old:

  1. It’s never too early to foster open and positive communication with children. It’s a good idea to talk with them about computers and to stay open to their questions and curiosity.
  2. Always sit with your kids at this age when they’re online.
  3. Set clear rules for Internet use.
  4. Insist that your children not share personal information such as their real name, address, phone number, or passwords with people they meet online.
  5. If a site encourages kids to submit their names to personalize the Web content, help your kids create online nicknames that don’t give away personal information.
  6. Use family safety tools to create appropriate profiles for each family member and to help filter the Internet.
    For more information, see Windows Live Family Safety, Windows 7 Parental Controls, or Windows Vista Parental Controls.
    Help protect your children from offensive pop-up windows by using the pop-up blocker that’s built in to Internet Explorer.
  7. All family members should act as role models for young children who are just starting to use the Internet.

Ages 11 to 14

Children this age are savvier about their Internet experience, but it’s still a good idea to supervise and monitor their Internet use to help ensure they are not exposed to inappropriate materials. You can use Internet safety tools to limit access to content and Web sites and provide a report of Internet activities. Make sure children this age understand what personal information they should not give over the Internet.

When your kids are this age it might not be practical to physically supervise their Internet use at all times. You can use tools such as Windows Live Family Safety, Windows 7 Parental Controls, or Windows Vista Parental Controls.

Here are some safety tips to consider when you go online with your 11-14 year old:

  1. It’s a good idea to foster open and positive communication with your children. Talk with them about computers and stay open to their questions and curiosity.
  2. Set clear rules for Internet use.
  3. Insist that your children not share personal information such as their real name, address, phone number, or passwords with people they meet online.
  4. If a site encourages kids to submit their names to personalize the Web content, help your kids create online nicknames that give away no personal information.
  5. Use family safety tools to create appropriate profiles for each family member and to help filter the Internet.
    For more information, see Windows Live Family Safety, Windows 7 Parental Controls, or Windows Vista Parental Controls.
  6. Set family safety tools on the medium security setting, which should have some limitations on content, Web sites, and activities.
  7. Keep Internet-connected computers in an open area where you can easily supervise your kids’ activities.
  8. Help protect your children from offensive pop-up windows by using the pop-up blocker that’s built in to Internet Explorer.
  9. Encourage your children to tell you if something or someone online makes them feel uncomfortable or threatened. Stay calm and remind your kids they are not in trouble for bringing something to your attention. Praise their behavior and encourage them to come to you again if the same thing happens.

Ages 15 to 18

Teens should have almost limitless access to content, Web sites, or activities. They are savvy about the Internet but they still need parents to remind them of appropriate safety guidelines. Parents should be available to help their teens understand inappropriate messages and avoid unsafe situations. It’s a good idea for parents to remind teens what personal information should not be given over the Internet.

Here are some safety tips to consider as you guide your teens online:

  1. Continue to keep family communication as open and positive about computers as you can. Keep talking about online lives, friends, and activities, just as you would about other friends and activities.
    Encourage your teens to tell you if something or someone online makes them feel uncomfortable or threatened. If you’re a teen and something or someone online doesn’t seem quite right, then speak up.
  2. Create a list of Internet house rules as a family. Include the kinds of sites that are off limits, Internet hours, what information should not be shared online, and guidelines for communicating with others online, including social networking.
  3. Keep Internet-connected computers in an open area and not in a teen’s bedroom.
  4. Investigate Internet-filtering tools (such as Windows Vista Parental Controls, Windows 7 Parental Controls, or Windows Live Family Safety ) as a complement to parental supervision.
  5. Help protect your children from offensive pop-up windows by using the pop-up blocker that’s built in to Internet Explorer.
  6. Know which Web sites your teens visit, and whom they talk to. Encourage them to use monitored chat rooms, and insist they stay in public chat room areas.
  7. Insist that they never agree to meet an online friend.
  8. Teach your kids not to download programs, music, or files without your permission. File-sharing and taking text, images, or artwork from the Web may infringe on copyright laws and can be illegal.
  9. Talk to your teenagers about online adult content and pornography, and direct them to positive sites about health and sexuality.
  10. Help protect them from spam. Tell your teens not to give out their e-mail address online, not to respond to junk mail, and to use e-mail filters.
  11. Be aware of the Web sites that your teens frequent. Make sure your kids are not visiting sites with offensive content, or posting personal information. Be aware of the photos that teens post of themselves and their friends.
  12. Teach your kids responsible, ethical, online behavior. They should not be using the Internet to spread gossip, bully, or threaten others.
  13. Make sure your teens check with you before making financial transactions online, including ordering, buying, or selling items.
  • Discuss online gambling and its potential risks with your teens. Remind them that it is illegal for them to gamble online.
  • I would like to add that the most safety is offered through you, the parents. Make sure you communicate with your children. Educate yourself about the Internet.

    Adobe fixes critical holes in Shockwave

    Adobe quietly released a HIGHLY CRITICAL update to Shockwave on Tuesday. Exploiting these vulnerabilities enables an attacked to inject code and – shock – take over your system. Yes, you need to update your Shockwave installation ASAP. And yeah, you even have to uninstall your old version first!

    Adobe advisory is here:

    Critical vulnerabilities have been identified in Adobe Shockwave Player 11.5.2.602 and earlier versions, on the Windows and Macintosh operating systems. The vulnerabilities could allow an attacker, who successfully exploits the vulnerabilities, to run malicious code on the affected system. Adobe has provided a solution for the reported vulnerabilities. It is recommended that users update their installations to the latest version using the instructions provided below.

    […]

    Adobe recommends Shockwave Player users uninstall Shockwave version 11.5.2.602 and earlier on their systems, restart their systems, and install Shockwave version 11.5.6.606.

    Download Patches from here: http://get.adobe.com/shockwave/.

    Patch your Adobe Reader ASAP or get hacked like Google did!

    Go to http://www.adobe.com/support/security/bulletins/apsb10-02.html and get your latest patch.

    The hackers who tried to steal source code from dozens of companies used an exploit in Adobe Reader to get it done..

    From Wired:

    A hack attack that targeted Google in December also hit 33 other companies, including financial institutions and defense contractors, and was aimed at stealing source code from the companies, say security researchers at iDefense.

    The hackers used a zero-day vulnerability in Adobe Reader to deliver malware to the companies and were in many cases successful at siphoning the source code they sought, according to a statement distributed Tuesday by iDefense, a division of VeriSign. The attack was similar to an attack that targeted other companies last July, the company said.

    A spokeswoman for iDefense wouldn’t name any of the other companies that were targeted in the recent attack, except Adobe.

    Adobe acknowledged on Tuesday in a blog post that it discovered Jan. 2 that it had been the target of a “sophisticated, coordinated attack against corporate network systems managed by Adobe and other companies.”

    The company didn’t say whether it was a victim of the same attack that struck Google. But Adobe’s announcement came just minutes after Google revealed that it had been the victim of a “highly sophisticated” hack attack originating in China in December.

    Neither Google nor Adobe provided details about how the hacks occurred. Google said only that the hackers were able to steal unspecified intellectual property from it and had focused their attack on obtaining access to the Gmail accounts of human rights activists who were involved in China rights issues.

    But according to iDefense, whose customers include some of the 33 companies that were hacked, the attacks were well targeted and “unusually sophisticated” and aimed at grabbing source code from several hi-tech companies based in Silicon Valley as well as financial institutions and defense contractors.

    The hackers gained access to the company networks by sending targeted e-mails to employees, which contained a malicious PDF attachment. The malicious code exploited a zero-day vulnerability in Adobe’s Reader application.

    Don’t get hacked! Patch now.

    How to secure your Windows machine.

    A recent statistic I read stated that over 70% (SEVENTY PERCENT) of new infections come from surfing to legitimate sites that are infected. A recent case was the New York Times (full story here):

    Here’s a front-page story the New York Times (NYT) would rather not be running: The paper is warning readers to be aware of bogus ads running on its Web site. The paper says “some readers” have seen unauthorized pop-up ads promoting antivirus software on NYTimes.com, and warns visitors who see the ad not to click on it but to restart their browsers instead. While the Times doesn’t spell this out, the newspaper has likely had its site hijacked by a “malware” scammer who is trying to trick visitors into installing pernicious software onto their hard drives

    Thus, to get infected, it is perfectly enough to just hit your legitimate web sites. You do not have to browse to any questionable content anymore to get compromised.

    In light of this, lots of people have been asking me what in my opinion is to reliably secure a Windows machine and protect it from the threats that are out there – viruses, worms, trojans, etc.

    I recommend multiple layers of defense to be setup on a Windows machine. Below items are listed in order of importance, highest listed first.

    1. Keep your Windows machine current with the latest patches.
    Ensure that Windows Update is turned on and configured to automatically download and install patches. Make sure that when you put your machine into standby mode (instead of turning it off every day), that you pay attention to whether patches need to be installed and the machine need to be rebooted. I encounter a lot of installations that never get turned off, where the patches never get installed (although they are downloaded and ready to go).

    2. Install a Anti-virus scanner.
    This can be one of the big names out there: AVG (free), Norton, Trend Micro, McAfee. Get one of their package offerings that include phishing protection, link scanning, encrypted password storage. DO NOT BELIEVE that this is the only thing you need. Although they want to make you think that this is all you ever need, it is not true. Even the best AV scanners cannot keep up with the ever-changing strains of viruses that are out there (strains change hundreds or even thousands of times a day), therefore you need to have multiple layers of scanners to get a higher rate of protection.

    Make sure that the ‘auto-protect’ features are turned on, i.e. the AV scanner runs ‘resident’ in memory. That means that live protection is turned on and viruses do not make it through.

    IMPORTANT: YOU STILL NEED TO DO WEEKLY FULL SYSTEM SCANS.

    Some people believe that they can leave auto-protect on but never scan their systems. The caveat with this is that auto-protect may miss a new strain of a virus and let it through. While the signatures get updated, auto-protect never detects it.

    Therefore, a scan then may find it, but you need to make sure to run these scans.

    Product-wise, I have been using Norton Internet Security for a long time, but I will let the license expire and try out a different AV scanner next year. Norton has disappointed me recently with the failure rate it has, i.e. viruses that do not get caught by it. Ideally, you use at least 2 different virus scanners, but this may get costly if you are looking to purchase solutions.

    I am currently trying out the new Microsoft Essentials ‘AV and Malware’ scanner that was released on 9/30/09. I believe that AV and Malware protection should be free and included in a Operating System, but the MS AV scanner still may need some tuning to be comparable to any $$- solution.

    3. Install a separate Malware scanner. This is important.

    You NEED to have a backup scanner to whatever AV solution you are using. This increases the rate of detection and your total exposure significantly.

    I recommend Malwarebytes’ Anti-Malware for this. It has worked well for me. There is a freeware and a commercial version for it. The major difference between the freeware and the paid version is that in the free version you have to run manual scans and it does not run in the background protecting you from new threats. I recommend you spend the $25 and purchase it. It is worth it. The interface is simple and structured in a no-nonsense kind of way, focusing on scanning, updating its database and showing you results of the last scans.

    If you do not want to shell out the money to buy the full version, I recommend you use the Windows Task Scheduler to run this software daily to update the database and at least weekly to do a full scan of your system. It supports command-line arguments. Shoot me an email at info (AT) gansec.com if you want to have instructions on how to do that.

    4. Install Secunia Personal Inspector to keep your applications up to date

    Install Secunia PSI to keep your third party applications (Adobe PDF Reader, Flash Player, Shockwave, Real Audio Player, any other stuff you use besides Microsoft Software) current. It scans your system and matches it up with an always current database of new versions for the applications you use. It is an extremely handy tool that you will not want to miss once you get used to it. You would not believe how many third party applications can severely compromise your system security if exploits are used against vulnerabilities that they have (example). Secunia PSI is Freeware.

    5. Install a firewall on your Windows machine.

    This usually comes with Windows (Windows Firewall) or with one of the ‘Internet Suites’ of the commercial AV vendors. This is to block annoying connection attempts, Malware that tries to communicate outbound across other ports than your standard web port (80), potential inbound hacking attempts. Make sure it is enabled. When you first enable a firewall you may have to permit standard ports (e.g. outbound Web for iexplore.exe, firefox.exe, etc), but this will settle down after the initial turn-up. Yes, it is extra work, but you need to invest it.

    6. Keep backups.

    Keep backups of your Windows installation. You can burn the data on DVDs or external storage solutions. If you would like to look into external storage (especially important if you own a small business), I recommend Netgears’ ReadyNAS storage solution: About $1K for a fully redundant 1 TeraByte of storage. It is extremely trivial to setup (takes about 10 minutes to configure it to be ready for backups from the time you turn it on). Data will not be lost on this one.

    These are 6 simple steps to get going on Windows Security. It takes some work to get there, but believe me, it beats the ‘man, my system is lost because of infections, I lost my documents, my bank account information got stolen and people write checks in my name via my Online-Banking access‘ by far.

    – Sven Olensky.

    Vulnerability in Adobe Reader and Flash Player – remote break-ins possible

    Be careful when you use Flash Player to watch videos on the Internet or in your E-mail; also don’t open PDF files from unknown sources. There is currently an exploit in the wild that makes use of a new vulnerability, which essentially can result in an attacker taking over your system. There is currently no patch for this; Adobe is working hard to get one out next week. Until then, be cautious!

    See the details on Adobe’s site: 
http://www.adobe.com/support/security/advisories/apsa09-03.html

    […] A critical vulnerability exists in the current versions of Flash Player (v9.0.159.0 and v10.0.22.87) for Windows, Macintosh and Linux operating systems, and the authplay.dll component that ships with Adobe Reader and Acrobat v9.x for Windows, Macintosh and UNIX operating systems. This vulnerability (CVE-2009-1862) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild via limited, targeted attacks against Adobe Reader v9 on Windows.
    […]
    We are in the process of developing a fix for the issue, and expect to provide an update for Flash Player v9 and v10 for Windows, Macintosh, and Linux by July 30, 2009 (the date for Flash Player v9 and v10 for Solaris is still pending). We expect to provide an update for Adobe Reader and Acrobat v9.1.2 for Windows, Macintosh and UNIX by July 31, 2009 […] Flash Player users should exercise caution in browsing untrusted websites. Adobe is in contact with Antivirus and Security vendors regarding the issue and recommend users keep their anti-virus definitions up to date.