ICANN Board Approval of KSK Roll over

According to ICANN millions that will fail after the KSK roll over

LOS ANGELES – 18 September 2018 –The Board of Directors for the Internet Corporation of Assigned Names and Numbers (ICANN) has approved plans for the first-ever changing of the cryptographic key that helps protect the Domain Name System (DNS) - the Internet's address book.

During a 16 September meeting in Belgium, the ICANN Board passed a resolution, directing the organization to proceed with its plans to change or "roll" the key for the DNS root on 11 October 2018. It will mark the first time the key has been changed since it was first put in use in 2010.

"This is an important move and we have an obligation to ensure that it happens in furtherance of ICANN's mission, which is to ensure a secure, stable and resilient DNS" said ICANN Board Chair Cherine Chalaby. "There is no way of completely assuring that every network operator will have their 'resolvers' properly configured, yet if things go as anticipated, we expect the vast majority to have access to the root zone."

Some Internet users might be affected if the network operators or Internet Service Providers (ISPs) have not prepared for the roll. Those operators who have enabled the checking of Domain NameSystem Security Extensions or DNSSEC information (a set of security protocols used to ensure DNSinformation isn't accidentally or maliciously corrupted) are those who need to be certain they are ready for the roll.

"Research shows that there are many thousands of network operators that have enabled DNSSECvalidation, and about a quarter of the Internet's users rely on those operators," said David Conrad, ICANN's Chief Technology Officer. "It is almost certain there will be at least a few operators somewhere across the globe who won't be prepared, but even in the worst case, all they have to do to fix the problem is, turn off DNSSEC validation, install the new key, and reenable DNSSEC and their users will again have full connectivity to the DNS."

The changing of the DNS root key was originally scheduled to happen a year ago, but plans were put on hold after the ICANN organization found and began analyzing some new, last-minute data. That data dealt with the potential readiness of network operators for the key roll.

An analysis ultimately led the organization to believe it could safely proceed with the changing of the key. As a result, the organization, after consultation with the community, developed a new plan that recommends putting the new key into use exactly one year after originally scheduled. In the intervening time, the organization has continued extensive outreach and investigations on how to best mitigate risks associated with the key change.

The ICANN Board, during its 16 September meeting, passed a resolution (https://www.icann.org/resources/board-material/resolutions-2018-09-16-en) approving the plan, and with that, the ICANN org has set in motion its plans to change key at 4PM UTC on 11 October 2018.

"This is the first root key change, but it won't be the last," said Matt Larson, Vice President of Research at ICANN and the organization's point person for the key roll. "This is the first time, so naturally we are bending over backwards to make certain that everything goes as smoothly as possible, but as we do more key rollovers in the future, the network operators, ISPs, and others will become more accustomed to the practice."

The primary source for information about the rollover is: http://www.icann.org/kskroll

Subscribe to the rollover discussion mailing list: https://mm.icann.org/listinfo/ksk-rollover

Read More

Orbitz Travel Booking Company Hacked

Orbitz Travel Booking Company Hacked

Orbitz says a legacy travel booking platform may have been hacked, potentially exposing the personal information of people that made purchases between 2016 Jan 1, and 2017 Dec 22.

The company said Tuesday about 880,000 payment cards were impacted.

Orbitz said data that was likely exposed includes name, payment card information, date of birth, phone number, email address, physical and/or billing address and gender. The company said evidence suggests an attacker may have accessed information stored on this consumer and business partner platform between 2017 Oct 1 and 2017 Dec 22.

The current Orbitz.com website was not involved in the incident. It’s now owned by Expedia Inc. of Belleview, Washington.

Orbitz is offering those impacted a year of free credit monitoring and identity protection service in countries where available.

Read More

AMD Patches For Newly Disclosed Processor 13 Critical Vulnerabilities

AMD Patches for Newly Disclosed Processor 13 Critical Vulnerabilities

AMD has finally acknowledged there's a problem with its Platform Security Processor. Earlier this month Israel-based CTS labs found 13 critical vulnerabilities (including RyzenFall, MasterKey, Fallout and Chimera) with AMD's product, which could allow attackers to access sensitive data, install malware and gain complete access to compromised machines (although doing so would require admin access). Today, AMD has published a statement that largely underplays the threat, but claims that patches will be coming soon.

According to CTS-Labs researchers, critical vulnerabilities that affect AMD's Platform Security Processor (PSP) could allow attackers to access sensitive data, install persistent malware inside the chip, and gain full access to the compromised systems.

Although exploiting AMD vulnerabilities require admin access, it could help attackers defeat important security features like Windows Credential Guard, TPMs, and virtualization that are responsible for preventing access to the sensitive data from even an admin or root account.

Official Statement from Mark Papermaster

On March 12, 2018, AMD received a communication from CTS Labs regarding research into security vulnerabilities involving some AMD products. Less than 24 hours later, the research firm went public with its findings. Security and protecting users’ data is of the utmost importance to us at AMD and we have worked rapidly to assess this security research and develop mitigation plans where needed. This is our first public update on this research, and will cover both our technical assessment of the issues as well as planned mitigation actions.

The security issues identified by the third-party researchers are not related to the AMD “Zen” CPU architecture or the Google Project Zero exploits made public Jan. 3, 2018. Instead, these issues are associated with the firmware managing the embedded security control processor in some of our products (AMD Secure Processor) and the chipset used in some socket AM4 and socket TR4 desktop platforms supporting AMD processors.

As described in more detail below, AMD has rapidly completed its assessment and is in the process of developing and staging the deployment of mitigations. It’s important to note that all the issues raised in the research require administrative access to the system, a type of access that effectively grants the user unrestricted access to the system and the right to delete, create or modify any of the folders or files on the computer, as well as change any settings. Any attacker gaining unauthorized administrative access would have a wide range of attacks at their disposal well beyond the exploits identified in this research. Further, all modern operating systems and enterprise-quality hypervisors today have many effective security controls, such as Microsoft Windows Credential Guard in the Windows environment, in place to prevent unauthorized administrative access that would need to be overcome in order to affect these security issues. A useful clarification of the difficulties associated with successfully exploiting these issues can be found in this posting from Trail of Bits, an independent security research firm who were contracted by the third-party researchers to verify their findings.

The security issues identified can be grouped into three major categories. The table below describes the categories, the AMD assessment of impact, and planned actions.

Vulnerability Groups	Problem Description & Method of Exploitation	Potential Impact	Planned AMD Mitigation
MASTERKEY and PSP Privilege Escalation (AMD Secure Processor or “PSP” firmware)	Issue: Attacker who already has compromised the security of a system updates flash to corrupt its contents. AMD Secure Processor (PSP) checks do not detect the corruption. Method: Attacker requires Administrative access	Attacker can circumvent platform security controls. These changes are persistent following a system reboot.	Firmware patch release through BIOS update. No performance impact is expected. AMD is working on PSP firmware updates that we plan to release in the coming weeks.
RYZENFALL and FALLOUT (AMD Secure Processor firmware)	Issue: Attacker who already has compromised the security of a system writes to AMD Secure Processor registers to exploit vulnerabilities in the interface between x86 and AMD Secure Processor (PSP). Method: Attacker requires Administrative access.	Attacker can circumvent platform security controls but is not persistent across reboots. Attacker may install difficult to detect malware in SMM (x86).	Firmware patch release through BIOS update. No performance impact is expected. AMD is working on PSP firmware updates that we plan to release in the coming weeks.
“Promontory” Chipset
CHIMERA “Promontory” chipset used in many socket AM4 desktop and socket TR4 high-end desktop (HEDT) platforms. AMD EPYC server platforms, EPYC and Ryzen Embedded platforms, and AMD Ryzen Mobile FP5 platforms do not use the “Promontory” chipset.	Issue: Attacker who already has compromised the security of a system installs a malicious driver that exposes certain Promontory functions. Method: Attacker requires Administrative access.	Attacker accesses physical memory through the chipset. Attacker installs difficult to detect malware in the chipset but is not persistent across reboots.	Mitigating patches released through BIOS update. No performance impact is expected. AMD is working with the third-party provider that designed and manufactured the “Promontory” chipset on appropriate mitigations.

AMD will provide additional updates on both our analysis of these issues and the related mitigation plans in the coming weeks.

Mark Papermaster,
Senior Vice President and Chief Technology Officer

CTS Labs maintains it did the right thing, claiming that they didn't think AMD would be able to fix the problem for "many, many months, or even a year" anyway. CTS Labs' CTO Ilia Luk-Zilberman has also posted a letter on the AMDflaws site in which he explains his gripe with the 90-day response window and why he believes revealing vulnerabilities to everyone at once (consumers and media, as well as the companies in question), puts pressure on the relevant parties to get things fixed.

That certainly appears to be the case with AMD, which says that patch updates can be expected through BIOS updates (without affecting performance) in the coming weeks -- a fair response having been caught so off guard. The issue now, however, would be other security research companies similarly doing away with the 90-day 'rule'. If vulnerabilities were made public the moment they were discovered, they'd never be out of the news, and it would be a real challenge for everyone concerned to know where the risks really were.

 

Read More

Abusing Text Editors Via Third-Party Plugins

Abusing Text Editors Via Third-Party Plugins

Software third-party extensibility mechanisms have proven to be fertile ground for attacks many times in the past.Following recent attacks of such nature, we started examining 6 popular extensible text editors for unix systems, checking their defenses against similar potential abuses.

This research document outlines how some of them can be abused locally for privilege escalation. Mitigating this potential breach can be done in several ways; we provide OSSEC rules for your own convenience.

While there are other known techniques to escalate privileges, specific restrictive circumstances might make this one the preferred choice.

Advanced editors give you more features, ease of use and most importantly for our scope - they offer extensibility. Cutting to the chase, extensibility means running some third-party bits of code. That third party may be yourself, or a developer that made his extension public (published in a web store, git repo...).

Technical users will occasionally need to edit root-owned flies, and for that purpose they will open their editor with elevated privileges, using “sudo”. There are many valid reasons to elevate the privileges of an editor.

SafeBreach Labs examined several popular editors for unix environments. Our research shows how extensible text editors can be used locally as another way to gain privilege escalation on the machine. We will demonstrate how our method succeeds regardless of the file being opened in the editor, so even limitations commonly applied on sudo commands might not
protect from it.

The set of editors that were put to the test include some of the most highly ranked ones (according to http://lifehacker.com/fve-best-text-editors-1564907215). 

1. Sublime 

2. Vim 

3. Emacs 

4. Gedit 

5. pico/nano

AS A PRIVILEGE ESCALATION METHOD

What SafeBreach Labs found about most of the applications that we examined is that when it comes to loading plugins, their separation of the two modes-- regular and elevated--is not complete. Their folder permissions integrity is not kept well and that opens the door for an attacker with regular user permissions to get elevated execution of arbitrary code.

Imagine a startng point where an atacker has the ability to run code, not elevated. The user that he runs under is a sudoer (Linux), but running without elevated status. All he or she has to do is write a malicious plugin to the user folder of the editor that’s in use, and wait for the editor to be invoked in elevated status, where the user will enter his root password. Depending on the user profile, the attacker might only need to wait for hours. In some cases he may wait forever, but there are plenty of situations that require users to open flies using sudo.

THE ATTACK

Assumptons

For the privilege escalation to work, we assume the following:

• We have regular (not elevated) execution using a sudoer user (a user that’s in /etc/sudoers) • The user occasionally invokes the editor in elevated status - common amongst linux users, especially when the machine is a server. 

• The initial user the attacker takes use of has no malicious intentions. He or she has no intentions to exploit his or her sudo permissions to hack or break. If he or she was an insider threat, then of course this method is redundant. 

• Alternatively, the user may have malicious intentions, but the system administrator has restricted his sudo privileges to only specific commands and files.

Azouri from SafeBreach Labs suggests Unix users can use an open-source host-based intrusion detection system, called OSSEC, to actively monitoring system activity, files integrity, logs, and processes.

Users should avoid loading 3rd-party plugins when the editor is elevated and also deny write permissions for non-elevated users.

Azouri from SafeBreach Labs advised developers of text editors to change the folders and file permission models to complete the separation between regular and elevated modes and if possible, provide a manual interface for users to approve the elevated loading of plugins. 

Source 

https://go.safebreach.com/rs/535-IXZ-934/images/Abusing_Text_Editors.pdf

Read More

RottenSys malware found pre-installed on chinese Android devices

RottenSys malware found pre-installed on chinese Android devices

A new strain of malware named RottenSys has been discovered targeting users for fraudulent ad revenues.

Experts at Checkpoint said that the malware has already infected around 5 million devices since 2016 and since the beginning of February 2018 attackers have been discovered testing a new botnet campaign via the same C&C server.

“The Check Point Mobile Security Team has discovered a new widespread malware family targeting nearly 5 million users for fraudulent ad-revenues. They have named it ‘RottenSys’ for in the sample we encountered it was initially disguised as a System Wi-Fi service.”

Researchers discovered the malware after finding an unusual self-proclaimed system Wi-Fi service (系统WIFI服务) on a Xiaomi Redmi phone which does not provide any secure Wi-Fi related service to users. Instead, it asks for various android permissions such as accessibility service, silent download permission, and user calendar access permissions.

The RottenSys malware operates using two evasive technique. The first one is postponing its operation for a set time to avoid the connection between the malicious app and the malicious activity.

The second evasive technique uses a dropper component which at first does not display activity. Once the device is active, it installs the dropper and contacts the command and control server. Then C&C server sends the list of additional components required for its activity.

These additional components consist of actual malicious codes which are downloaded from the command and control server after the dropper receives the list.

The malware uses two open-source projects called Small and MarsDaemon. Small is Android application virtualization framework which allows all components to run in parallel at the same time.

MarsDaemon is used to keeps the processes alive. It helps attackers to inject add even if the user closes them.

Researchers said that the botnet will have features such as silently installing additional apps and UI automation. “Interestingly, a part of the controlling mechanism of the botnet is implemented in Lua scripts. Without intervention, the attackers could re-use their existing malware distribution channel and soon grasp control over millions of devices.”

The malware began infecting from September 2016 and has infected 4,964,460 devices till March 12.

At the time the malware was seen only targeting Chinese users. The top brand models impacted by the malware are  Honor, Huawei, Xiaomi, Oppo, Vivo, and Meizu.

According to the analysis the malware has earned around $115k for last ten days alone. The calculated the revenue from these impressions and clicks according to the conservative estimation of 20 cents for each click and 40 cents for every thousand impressions.

To check if your device is infected with RottenSys, go to Android system settings→ App Manager, and then look for the following possible malware package names:

• com.android.yellowcalendarz
• com.changmi.launcher
• com.android.services.securewifi
• com.system.service.zdsgt

If any of above is in the list of your installed apps, simply uninstall it.

Read More