Of Killbits and BlackWorm - 30 January 2006

Sûnnet Beskerming Security researchers have achieved another remarkable success in the last few days. Over the weekend, news started appearing via US-CERT, the ISC and SecurityFocus, of a problem with Internet Explorer's method for deactivating vulnerable ActiveX components. Basically, the 'killbit' method used by Microsoft to disable the calling of certain ActiveX controls could be bypassed through the use of a malicious web page. Sûnnet Beskerming provided this information to the Sûnnet Alert mailing list subscribers in mid September 2005, along with updated releases as more information came to hand, more than four months before it was noticed by other agencies.

ActiveX controls can be malicious due to their ability to hook into the underlying Operating System and can be commanded fully by the remote attacker, providing an easy means to compromise a system without the need to download additional files.

An 'average' computer worm infection might result in the victim's computer being controlled through IRC to send spam and have various pieces of malware installed to capture logins and passwords, and is probably the most significant threat to face Windows PC users. Recently, a new worm has emerged, originally dubbed 'Nyxem', but now commonly known as 'BlackWorm', which uses standard mechanisms to spread and infect systems, but which possesses a payload which will cause major problems for infected users.

Designed to delete or modify DOC, XLS, MDB, MDE, PPT, PPS, ZIP, RAR, PDF, PSD and DMP files on all available (including network) drives, the worm activates this nasty capability on the third of February, and repeats on the third of every subsequent month. While this sort of activity will be distressing for users who are infected on standalone systems, businesses that are infected could face a catastrophic outcome if the worm manages to penetrate their network.

The nasty payload has seen a massive coordination effort from security companies, malware researchers and ISPs to identify and notify infected clients. For such a destructive worm, the global rate of infection is still in the low hundreds of thousands (at the time of writing), although the counter being used to track infections shows over 4 million, due to a suspected Denial of Service attempt from one or more individuals.

The ISP which hosts the counter has been supplying logs to the coordination effort, and it has provided an unique look at the nature of the infection spread. While less than a thousand Australian systems have been infected, countries such as Malaysia (over 7,000), Mexico (over 2,000), China (over 2,000), Greece (over 4,000), Turkey (over 15,000), and the United States (over 15,000) have been hit worse. Italy, Peru and India appear to have been worst hit, with over 22,000, 54,000 and 80,000 infections, respectively. It is possible to surmise that some countries with smaller online populations which have high infection levels are involved with the original outbreak, and others which have a number of significant infection clusters (such as Government departments uniformly infected).

With the increased reporting on the worm, the active efforts from anti-malware providers, and the coordinated effort to identify, notify and quarantine infected systems, the spread of BlackWorm is expected to slow significantly. Should the coordinated notification effort be ceased, there is a fair chance that infection rates will rise, and there is a question of resource effectiveness should multiple new worms / malware threats arrive which have similar malicious payloads, or which do not report as easily to a single central location.

BlackWorm isn't the only new oddity to appear via email over the last couple of weeks, with numerous reports being seen of empty emails. These appear in inboxes as completely empty emails, with no sender, no subject, and no body. As there is no content to check against, some spam filtering software will not prevent the transmission of these empty messages, and they have been an interesting addition to many email inboxes. The first of these empty messages started to appear in late 2005, and it is believed that it might be the result of misconfigured, or otherwise poorly created, automated spamming software.

It has been another bad week for identity theft / loss of privacy data cases, with several moderate sized data losses. Notre Dame University discovered that a system which had been used to manage fundraising efforts had been compromised, exposing the credit card details and Social Security Numbers of numerous donors. While the compromise alone is a problem, it may have been actively compromised since November without being identified.

A three month period where compromise may have taken place almost appears reasonable, as Kansas State University found recently. They discovered that a system that was being used to handle applications for Student Housing had been actively compromised for more than four years. This exposed Social Security Numbers and other sensitive information about applicants.

Identity theft cases didn't just affect American Universities, with more than 350,000 people in the states of Oregon and Washington having their medical histories stolen following a car break in. The records were being stored on backup tapes and disks, and were being stored in the vehicle as part of the affected company's disaster recovery planning. While the tape data was encrypted, the much easier to read disk data was not. In addition to patient personal data, specific medical and insurance data was part of the record. Almost 250,000 of the patient records also had Social Security Numbers recorded, and some even had financial information.

Sick people and students can take comfort in knowing that almost 250,000 customers and financial advisors linked to Ameriprise Financial (a financial services company spun off from American Express) had their records stolen when a laptop containing the data was stolen from an Ameriprise employee's car in December 2005. Ameriprise considers it unlikely that the theft was targeting the information, and the subsequent risk of exposure is low. The US state of Rhode Island is also facing difficulties after more than 50,000 credit card details were discovered on a Russian site. Details which had been stolen from an online Government services gateway.

As part of plans to improve the laws related to Computer and electronic data security in the United Kingdom, the proposed revised Police and Justice Bill seems to have erred too far on the side of caution. In what is believed to have been an attempt to make possession of certain software tools the equivalent to being in possession of a safecracking set, the proposed laws include elements designed to stop the development, distribution and possession of 'hacker tools'. What is a 'hacker tool' is not explained, but should the relevant section of the proposal make it into law, then it will make a lot of System Administrators, Networking Administrators and Security Researchers very worried.

Complaints are being seen from UK researchers who claim that this will prevent them from understanding how the hackers are attacking their systems, and what the capabilities are that the tools provide to the hacker. Network and system defences will become reactionary, forced to respond to attack, rather than researched vulnerabilities. A lot of the tools in use by hackers and legitimate users are the same, it is just a matter of permission and ownership of the systems they are being used on.

A number of countries are currently evaluating the possibility of establishing national ID card systems, including the UK and Australia. Supporters of both sides of the argument have been quite vocal with publicizing their opinions, and an interesting voice has been added to the mix in the argument over the UK's proposed ID card. The Register has reported on the UK's IT trade association, Intellect, which has come out with a fairly pointed press release which calls on the Government to pay more attention to components of the IT services and product delivery chain which have routinely suffered in the past.

One interpretation of the report is that it is a damning accusation that the Government is to blame for the recent spate of public IT expenditure failures, and risks the same happening with the ID card implementation. This statement also comes after the industry has borne most of the public condemnation for previous failures.

What was surprising about Apple's recent announcement of Intel based Macintosh systems being available for purchase now was that it was less than 12 months since the initial announcement of the shift to Intel (although the rumoured Marklar OS X Intel version was confirmed as having existed for several years), and a lot earlier than anyone expected, given that the initial announcement was that the systems would be available in 2006. A number of review sites have already received their systems and have been putting them through their paces.

Early results suggest that the initial round of system delivery is not comprised of production machines, given the relatively poor internal hardware layout when compared to pretty much any production Macintosh from the first Mac. Difficulties have been reported by reviewers who have attempted to install Microsoft Windows for a dual boot experience, reporting that the Windows boot media isn't responding to the various boot methods available to the machines.

Privacy Matters - 16 January 2006

The recent problems with the WMF image format, which led to Microsoft releasing an out of cycle patch a couple of weeks ago, have impacted on Microsoft's next operating system, Vista, even though it hasn't been released yet. Patches have been released for the Beta users of Vista, to help keep their installations secure from the image handling vulnerability. The previous information available about the flaw did not mention Vista as being vulnerable, and it is an early bloody nose for the new Operating System, which is said to be the most secure that Microsoft has ever developed.

The lack of a patch for Windows 9x derived Operating Systems for the same vulnerability has concerned some users, given that they have various requirements to keep older systems running on deprecated software. Microsoft have explained their lack of patching by explaining that the only exploitation route for these older systems is to require a user to print a document / image which makes calls to the vulnerable functions, and that it can not be called from other system actions.

An article was published last week in which it was claimed that the original WMF vulnerability was an intentional backdoor installed by Microsoft into their systems to allow certain parties unrestricted access to systems. Unfortunately for this argument there are several facts which negate it. If it is a backdoor into a system, it is somewhat odd as it requires the user to have some level of interaction with the vulnerability in order for any exploit to take effect (that is, it can not be fully automated). Secondly, software which recreates a number of Windows APIs under Linux, such as WINE, also demonstrate the WMF vulnerability. This negates the original claims because the WMF support in the software was developed from the original API specification. This means that the root cause for the vulnerability lies in the API specification, which is somewhere that is not normal for hidden backdoors to be specified.

Good news, however, for users of Microsoft's current Consumer / Pro Operating System Windows XP, with publication of information on Microsoft's extension of support for their current Operating System version (XP). Normally mainstream support would have ended on December 31, 2006, but due to the delays that have been encountered with releasing the next version of Windows (Vista), this date has been extended to an unconfirmed date two years after the release of Vista. Mainstream support means Microsoft will continue to supply security patches and hotfixes for the software until the end date, and Extended support for business users will continue for another five years beyond that (continuing to supply hotfixes).

A US High School student has discovered to his detriment that certain forms of online pranking can have serious real world outcomes. The student is being charged with a felony for encouraging other students to continually refresh their school's public website in their Internet browser, in order to deny service to other site visitors (or even to cause the site to crash). Ultimately, what the student encouraged was a distributed Denial of Service (dDoS), whereby numerous requests are sent from a wide variety of Internet addresses, ultimately preventing legitimate users access to a website. Due to the large number of source IP addresses, this sort of attack is very difficult to prevent against.

It is reported that the student's intent was to cause an outage of the school's website, but it is debatable whether he should have been charged with a felony for the case (perhaps a stern warning and a suspension from school would have been better). Online rights activists are all riled up over the case, with many claiming that by simply refreshing a webpage (which many would do anyway), it now makes them a criminal.

The above case alone wouldn't have stood out, except for new laws being passed in the United States which makes various forms of online stalking illegal. While the concept is well intentioned, the implementation probably doesn't take into account some of the finer points of how the Internet works. Even posting to a newsgroup or web forum could become illegal under these new laws.

To finish up the concerns over privacy, an ex-NSA employee went public about surveillance programs that the US was said to be running against its own citizens. With claim and counterclaim being thrown about with regards to the veracity of the ex-employee's claims, the mere publication of them throws up a range of concerns about the information gathering capabilities of a range of three letter agencies and also how those capabilities have been used against the people they are meant to protect. Some observers have even gone so far as to claim that a new form of McCarthyism has started to emerge amongst the agencies and Governments monitoring online activities.

Although the ex-employee claims that what he has released is at an appropriate classification level, observers who subscribe to the 'tip of the iceberg' approach were sent into a flurry of speculation as to what else the NSA is currently capable of doing, and what it is actually doing.

In the latest loss of identity data from a hotel group (following on from the Marriott losses), the Atlantis Resort in the Bahamas has disclosed that 50,000 identity records were stolen from a hotel database. No timeframe is given for when the compromise took place, but the resort has committed to providing 12 months of credit monitoring for affected individuals, has commenced notifying each person who was affected, and is working with law enforcement agencies to investigate the matter.

An attack directly against a target can net better results sometimes. A Credit Union in the United States had its website hacked recently, resulting in the theft of tens of thousands of US Dollars from Credit Union clients. The hack was achieved by redirecting the login script on the official site to a site in Greece which had been setup to mimic the look and feel of the legitimate banking solution. Because the implicit trust was already there (having logged on through the legitimate Credit Union site), clients were more inclined to believe the site even though it didn't appear exactly as the official site did.

The Credit Union was forced to take down their site while the issue was being resolved, and has also taken a credibility hit over the attack. Information Security company, Sunbelt, have also provided in depth details of some malware which redirects requests for a number of financial institutions to an excellent forgery of the sites (would be very difficult to determine), while still appearing as legitimate in the URL address bar.

Finally, the first Apple Macintosh machines with Intel chips powering them are scheduled for shipping in February. Although Apple has said that they will not prevent anyone from dual booting Windows and OS X on the Intel-based machines, and Apple and Microsoft have agreed to a five year arrangement where Microsoft will continue to develop software for OS X, the first warning shot may have been fired back by Microsoft. Microsoft have announced that they are to cease development of the Windows Media Player for OS X. In its place, they have provided a link to a third party provider who has specialised in providing additional support for OS X users who require to play back Windows media content.

An Inauspicious Start - 02 January 2006

Although attacks and threats are beginning to rise in number and severity again, the Christmas period, and a few days either side, was observed with a minimum of fuss and arrival of new attacks. That pattern was disrupted in a bad way only a few days after Christmas, and it is likely to cause major headaches for Information Technology personnel long into the New Year.

As reported by CNN Money, the Ford Motor Company in the US has discovered that a system with identity information for up to 70,000 current and former employees has been stolen. Containing the names and Social Security Numbers, the information from the system is not believed to have made it yet into the market for Identity Theft. Ford has offered to pay for the affected individuals to obtain credit-monitoring services, and has involved the US Secret Service and the FBI in the investigation. The theft was believed to have taken place in late November.

The loss of information from Ford was not the only major Identity related data loss to happen at the end of 2005. The Marriott hotel chain has disclosed that they have lost track of a number of backup tapes which hold identity related information, including credit card data and Social Security Numbers, for more than 200,000 people who were partners, employees and customers of their Marriott Vacation Club International (MVCI) group. It is not known where the tapes were lost from (transit, storage or other), but the Hotel has offered to pay for credit monitoring services for the affected individuals (at $100 USD per individual, a cost of over $20,000,000 USD).

Identity theft wasn't the only Information Security issue to attract attention over the latter weeks of 2005. A small number of unique phishing attacks were launched which could have interesting outcomes.

Of interest are attacks against the National Australian Bank (NAB), and a Saudi Arabian bank. The NAB has implemented one of the better transaction verification procedures in Australia, using SMS messages to provide users with a code which is to be used to complete online transactions, but this hasn't stopped it being a target of an attack which not only attempts to trick victims into supplying their banking login details, but also downloads and installs a keylogger onto the victim's computer. The Saudi Arabian phishing attempt had several noteworthy elements, including messages composed in Arabic, a reasonable URL derived from the original bank, and an explanation that it was linking to a proposed online IPO for an Industrial firm.

According to Netcraft, statistics gathered from their Netcraft Toolbar Community suggest that more than 450 phishing attacks in 2005 used SSL in one form or another to improve the efficiency of the phishing attacks. While this is something which Sûnnet Beskerming has been warning about for some time, and something which Netcraft suggests has been happening for quite a bit of time, the first step in educating users about phishing attacks is to get them to look for the https at the start of the URL, and to look for the lock icon in the corner of the browser window. The reasoning behind this is that the provision of SSL certificates by Certificate Authorities requires authentication of legitimate business details, which would remove phishers and other scammers from the process. In addition to the acquisition of SSL certificates, Netcraft identifies the use of XSS and browser vulnerabilities as other primary methods to allow phishing attacks to appear to have SSL validity.

Moving away from phishing and Identity theft, and one of the most interesting figures from the last twelve months has resigned from their post. The CIO of the US state of Massachusetts has resigned his position following what appears to have been a smear campaign against him. The CIO, Peter Quinn, gained fame for being instrumental in the state's move towards supporting the OpenDocument format over other proprietary formats for electronic storage of official state documentation. The state is expected to still implement support for the standard by 2007, but it not known how the plan is going to move forward following the CIO's resignation. A poorly researched article in the Boston Globe that sought to get an official investigation launched into the CIO's travel claims, which were later shown to be legitimate, was said to be the primary factor behind the resignation.

The biggest threat to come out of the last few days, however, was the release of a new vulnerability affecting all Windows Operating Systems.

All versions of the Windows Operating System (including all Service Packs and patches) are vulnerable to complete compromise through the simple act of previewing, viewing or indexing a malicious image file. This vulnerability is currently being actively exploited through numerous websites (including through Internet banner advertisements on legitimate websites), spam email, and has started to spread to Instant Messaging services. Although the user is required to view / preview the file for the attack to work (such as in a webpage), automated indexing by Windows (or additional software) will automate the attack without user intervention. There are no solutions guaranteed to protect a system. There is no indication from Microsoft when this issue will be resolved.

Originally thought to be an Internet Explorer specific vulnerability, it has now been confirmed as a full Windows vulnerability, affecting all applications which make use of the specific GDI library (shimgvw.dll) to render images. This includes applications such as Internet Explorer, Outlook, Firefox, Opera, and Lotus Notes.

Although the particular vulnerability is for .wmf (Windows Meta File) type images, it has been observed that a range of image extensions (BMP, DIB, EMF, GIF, ICO, JFIF, JPE, JPEG, JPG, PNG, RLE, TIF, TIFF and WMF) have been used to carry the vulnerability onto systems. This technique works because Windows identifies a .wmf file type by certain 'magic bytes' towards the start of the actual file data, and not the file extension itself.

Working exploit code has been publicly released on the Internet, and multiple variations of the attack are already appearing, including one which can specifically avoid the majority of workaround / defences at this time. This latter variant appears to be very well designed, and may become the most prolific version over the next few days. It is also confirmed that this vulnerability is not related to the .wmf issues patched in the recent MS05-053 security patch.

Users who are infected may notice their Windows Picture and Fax Viewer application opening up to display a file (one of the first indications for some infection vectors). The issue has been deemed serious enough for the Internet Storm Centre to move to Yellow alert twice within the last five days (they only went to yellow once for the Zotob worms in August), and is drawing a lot of attention and concern from Information Security firms globally.

This is a major issue as it is currently unpatched and the workarounds being provided are not guaranteed to work. The end of the Christmas - New Year holiday period this coming week for many businesses and schools (mainly Northern Hemisphere), which means that a large number of vulnerable systems are going to be connecting to the Internet and are more likely to engage in risky behaviour. As the vulnerability is being exploited by a range of methods including websites, banner advertisements, spam, images embedded in documents, P2P, and Instant Messaging (AIM, Jabber, MSN) there are numerous infection vectors possible.

Infection results are varied, but manual removal of infected software will most likely be extremely difficult, if not impossible to achieve. The safest course of action is to reinstall Operating System software following the release of an official patch, don't connect to the Internet in the meantime, and consider the use of an alternate Operating System which is not affected (such as Linux or OS X).