SANS Internet Storm Center, InfoCON: green

SSL: Another reason not to ignore IPv6, (Fri, May 17th)

Fri, 17 May 2013 17:09:08 GMT

Currently, many public web sites that allow access via IPv6 do so via proxies. This is seen as the "quick fix", as it requires minimum changes to the site itself. As far as the web application is concerned, all incoming traffic is IPv4.

The most obvious issue here is logging, in that the application only "sees" the proxies IP address, unless it inspects headers added by the proxy, which will no point to (unreadable?) IPv6 addresses.

But there is another issue: SSL Certificates. If only IPv6 connections are passed via the proxy, you will end up with two different certificate: One for the proxy, and one for the web application (or the IPv4 proxy). It may also happen that the IPv6 and IPv4 site are considered two different hosts on the web server, requiring distinct configurations.

For example, at this point, "www.socialsecurity.gov" uses two different certificates. One for IPv6 and one for IPv4. The IPv6 certifiate is expired, while the IPv4 certificate is valid. This is in particularly painful as some simple comand line tools, like "openssl s_client' are still not able to work over IPv6. For my test, I used gnutls-cli, which works similar to openssl s_client but supports IPv6.

Excerpt from the result:

gnutls-cli -p 443 --x509cafile /opt/local/share/ncat/ca-bundle.crt www.socialsecurity.gov
Processed 291 CA certificate(s).
Resolving 'www.socialsecurity.gov'...
Connecting to '2001:1930:c01::aaaa:443'...
[...]
- subject `C=US,ST=maryland,L=baltimore,O=social security administration,OU=diias,OU=Terms of use at www.verisign.com/rpa (c)05,CN=www.socialsecurity.gov', issuer `C=US,O=VeriSign\, Inc.,OU=VeriSign Trust Network,OU=Terms of use at https://www.verisign.com/rpa (c)10,CN=VeriSign Class 3 Secure Server CA - G3', RSA key 1024 bits, signed using RSA-SHA1, activated `2012-04-05 00:00:00 UTC', expires `2013-04-29 23:59:59 UTC', SHA-1 fingerprint `3286afd908f256947b396dbae88d37b111c9aaaf'
[...]
- Status: The certificate is NOT trusted. The certificate chain uses expired certificate. 
*** Verifying server certificate failed...
*** Fatal error: Error in the certificate.
*** Handshake has failed
GnuTLS error: Error in the certificate.

Next, lets try IPv4. A disadvantage of gnutls-cli is that you are not able to force an IPv4 connection, so I will just fall back to openssl here:

$ openssl s_client -connect www.socialsecurity.gov:443 -CAfile /opt/local/share/ncat/ca-bundle.crt
[....]
subject=/C=US/ST=maryland/L=baltimore/O=social security administration/OU=diias/OU=Terms of use at www.verisign.com/rpa (c)05/CN=www.socialsecurity.gov
issuer=/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Secure Server CA - G3
[...]

And after saving the certificate to a file:

$ openssl x509 -in /tmp/ssa.gov -text
[...]
Validity
        Not Before: Apr 22 00:00:00 2013 GMT
        Not After : Apr 30 23:59:59 2017 GMT
        Subject: C=US, ST=maryland, L=baltimore, O=social security administration, OU=diias, OU=Terms of use at www.verisign.com/rpa (c)05, CN=www.socialsecurity.gov

So in short: two different certificates for the same host name. This isn't always bad, and not uncommon. But all certificates have to be valid!

------ Johannes B. Ullrich, Ph.D. SANS Technology Institute Twitter

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

ISC StormCast for Friday, May 17th 2013 http://isc.sans.edu/podcastdetail.html?id=3314, (Fri, May 17th)

Fri, 17 May 2013 03:37:41 GMT

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

e-netprotections.su ?, (Fri, May 17th)

Fri, 17 May 2013 00:02:07 GMT

Like with .biz, I sometimes have the impression that .su and .cc could be sinkholed in their entirety, because the bad domains seem to vastly outnumber whatever (if any) good is running under these TLDs as well.

Earlier today, ISC reader Michael contacted us with information that several PCs on his network had started to communicate with iestats.cc, emstats.su, ehistats.su, e-protections.su and a couple other domains. I was pretty sure that I had seen the latter domain on an earlier occasion in a malware outbreak, but I couldn't find it in our records .. until I only searched for "e-protections", and found e-protections.cc. This domain had been implicated back in October 2012 in a malware spree that was linked to the nasty W32.Caphaw, a backdoor/information stealer. The similarity of the names was too much of a coincidence, and it meant bad news for Michael.

Looking at what was captured by some of our network sensors allowed to reconstruct a (partial) picture of the IPs and ASN's involved in today's malware wave

Domain	IP	AS	Provider	Country
ppetoc.iestats.cc	64.85.161.67	30517	Great Lakes Comnet	USA
ppetoc.iestats.cc	85.25.132.55	8972	PlusServer Intergenia AG	Germany
ppetoc.iestats.cc	173.224.210.244	40676	Psychz Networks	USA
ppetoc.iestats.cc	178.63.172.88	24940	Hetzner Online AG	Germany
ppetoc.iestats.cc	188.95.48.152	57172	Global Layer B.V.	Netherlands

The host name portion for some of the domains looks like it is time dependent (incrementing ascii) whereas other domains use (apparently) random names like d3acofzi7hjft.e-protections.su. Name servers involved today include ns1.abercrombienfr.net (currently 199.68.199.178 - AS1426) and ns1.semi-spa.net (currently 91.227.220.104 - AS50300). I doubt the former has anything to do with the clothing store, the domain was created four months ago.

Closer inspection of Michael's PCs revealed that each infected box was apparently running a slightly different version of the EXE. Anti-Virus coverage is still thin (Virustotal) , but the Heuristics of some products seem to be catching on. This sample looks more like a ransomware trojan than Caphaw, but we'll know more once we analyze all the information gathered so far.

If you have information to add on this particular malware or the domains mentioned, please comment below, or use our contact form.

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Extracting signatures from Apple .apps, (Thu, May 16th)

Thu, 16 May 2013 21:51:14 GMT

As an add-on to ISC Handler Lenny Zeltser's earlier diary on extracting certificates from signed Windows binaries, here's how to do the same on a Mac. Given that today's blog over at F-Secure documents a screenshot-taking Mac spyware that is signed with a developer ID, signed bad .apps might actually be more prevalent than expected.

To verify and extract signatures and certificates on an Apple .app, you can do (example Mail.app)

codesign -dvvvv --extract-certificates /Applications/Mail.app

This will save the certificates in DER format, named codesign0, codesign1, etc. These can then be displayed as usual with OpenSSL

openssl x509 -inform DER -in codesign0 -text

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Cisco TelePresence Supervisor MSE 8050 Denial of Service Vulnerability, (Thu, May 16th)

Thu, 16 May 2013 11:06:27 GMT

Cisco TelePresence Supervisor MSE 8050 contains a vulnerability that may allow an unauthenticated, remote attacker to cause high CPU utilization and a reload of the affected system.

Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130515-mse

-- Joel Esler | http://blog.joelesler.net | http://twitter.com/joelesler

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

ISC StormCast for Thursday, May 16th 2013 http://isc.sans.edu/podcastdetail.html?id=3311, (Thu, May 16th)

Thu, 16 May 2013 01:48:59 GMT

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Call for Papers - 4th annual Forensics and Incident Response Summit EU, (Wed, May 15th)

Thu, 16 May 2013 01:05:53 GMT

http://computer-forensics.sans.org/blog/2013/05/15/sans-eu-dfir-summit-in-prague-call-for-speakers-now-open/

The 4th annual Forensics and Incident Response Summit EU will take place on October 6-13 in Prague, one of the most historical European cities, in the context of the SANS Forensics Prague conference, the biggest Incident Response and Digital Forensics event in Europe to date.

The Summit will focus on high quality and extremely relevant content as well as panel discussions in Digital Forensics and Incident Response. In addition, we encourage you to take every opportunity to make the most of this event from attending the Summit to registering for one or more of the post-summit training classes taught by SANS' top-rated instructors and course authors. Additional events such as DFIR Netwars, evening talks and the SANS Community Night will be taking place during that week too. This event promises to bring together the leading minds in digital forensics and incident response in the EU, as well as many other practitioners from a wide cross section of industries and company sizes. You will be able to share with all of them your challenges and find out new solutions that work, techniques and approaches you didn't even know existed. Call for Speakers - Now Open The 4th annual Forensics and Incident Response Summit Call for Speakers is now open.

If you are interested in presenting or participating on a panel we are looking for user-presented case studies with communicable lessons. The Forensics Summit offers speakers opportunities for exposure and recognition as an industry leader. If you have something substantive, challenging, and original to offer, you are encouraged to submit a proposal.

Benefits of Speaking

Promotion of your speaking session and company recognition via the Forensic conference website and all printed materials
Visibility via the Forensic post-conference presentation email link for many months following the conference
Full conference badge to attend all Summit sessions
Private speaker lunch

Submission Guidelines

Title
Author Name(s)
Author Title
Company
Speaker Contact Information: Address, phone number, email address
Biography
Your biography should be approximately 160 words. You may include your current position, titles, areas of professional expertise, experience, awards, degrees, personal information, etc.
Abstract
The presentation abstract should outline your presentation and what attendees will learn. All content must be strictly educational.
The presentation should be relevant to: Media Exploitation Analysts, Legal, Incident Response Teams, Security Operations and Law Enforcement professionals.

Speaking Options:

Presentation: 45 minutes
Question & Answer: 10-15 minutes Submit your submissions to callforpapers-prague@sans.org by June 15, 2013 with the subject "SANS DFIR Summit EU CFP 2013."

Thank you for your interest in presenting

-- Joel Esler | http://blog.joelesler.net | http://twitter.com/joelesler

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

ISC StormCast for Wednesday, May 15th 2013 http://isc.sans.edu/podcastdetail.html?id=3308, (Wed, May 15th)

Wed, 15 May 2013 01:01:46 GMT

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Microsoft May 2013 Black Tuesday Overview, (Tue, May 14th)

Wed, 15 May 2013 00:12:31 GMT

Overview of the May 2013 Microsoft patches and their status.

#	Affected	Contra Indications - KB	Known Exploits	Microsoft rating(**)	ISC rating(*)
#	Affected	Contra Indications - KB	Known Exploits	Microsoft rating(**)	clients	servers
MS13-037	The usual monthly MSIE cumulative patch, adding fixes for 11 more vulnerabilities. All but one are use after free vulnerabilities. The odd one is about vbscript allowing read access to JSON data related to another domain. Replaces MS13-028.
MS13-037	MSIE CVE-2013-0811 CVE-2013-1297 CVE-2013-1306 CVE-2013-1307 CVE-2013-1308 CVE-2013-1309 CVE-2013-1310 CVE-2013-1311 CVE-2013-1312 CVE-2013-1313 CVE-2013-2551	KB 2829530	No publicly known exploits	Severity:Critical Exploitability:1	Critical	Important
MS13-038	The anticipated IE8 fix. Note that IE9 is listed as affected as well, but it's not given a rating "because the known attack vectors for the vulnerability discussed in this bulletin are blocked in a default configuration." Note that this is not the cumulatieve IE patch, nor is the fix part of the cumulative patch this month. The bulletin states there is no need to uninstall the MSFT Fix-it released earlier for this vulnerability.
MS13-038	MSIE CVE-2013-1347	KB 2847204	Publicly discussed and exploit code available. Security advisory 2847140	Severity:Critical Exploitability:1	PATCH NOW	Important
MS13-039	A vulnerability in the handling of HTTP headers in the HTTP stack allows a Denial of Service.
MS13-039	HTTP.sys CVE-2013-1305	KB 2829254	No publicly known exploits.	Severity:Important Exploitability:3	Important	Important
MS13-040	Incorrect validation of signed XML files allows for failing to detect changes in said files and an authentication bypass allowing unauthenticated access. The impact of these vulnerabilities high depends on what applications make use of these features. Replaces MS10-041.
MS13-040	.NET CVE-2013-1336 CVE-2013-1337	KB 2836440	Microsoft claims the vulnerability CVE-2013-1337 was publicly disclosed.	Severity:Important Exploitability:?	Important	Important
MS13-041	A memory corruption vulnerability allows random code execution in the context of the current user. Note the lync user level install of Lync 2010 Attendee is only available from the Microsoft Download Center - not via automatic updates. Replaces MS12-066.
MS13-041	Lync CVE-2013-1302	KB 2834695	No publicly known exploits.	Severity:Important Exploitability:2	Critical	Important
MS13-042	A multitude of vulnerabilities in Publisher allow random code execution. Replaces MS11-091.
MS13-042	Publisher CVE-2013-1316 CVE-2013-1317 CVE-2013-1318 CVE-2013-1319 CVE-2013-1320 CVE-2013-1321 CVE-2013-1322 CVE-2013-1323 CVE-2013-1327 CVE-2013-1328 CVE-2013-1329	KB 2830397	No publicly known exploits	Severity:Important Exploitability:1	Critical	Important
MS13-043	Incorrect handling of shape data in word allows random code execution with the rights of the logged on user. Note that when word is used to read incoming email messages, it can be affected merely via previewing incoming emailed RTF data!
MS13-043	Word CVE-2013-13335	KB 2830399	No publicly known exploits	Severity:Important Exploitability:2	Critical	Important
MS13-044	A problem in handling XML files that references external files in Visio allows information leak and read access with the rights of the logged-on user. Replace MS11-060 and MS13-023.
MS13-044	Visio CVE-2013-1301	KB 2834692	No publicly known exploits.	Severity:Important Exploitability:3	Important	Important
MS13-045	Windows Writer - part of the Windows Essentials package - is a client to manage blogs. The vulnerability allows overriding proxy settings and overwriting files accessible to the logged-on user.
MS13-045	Windows Essentials CVE-2013-0096	KB 2813707	No publicly known exploits	Severity:Important Exploitability:3	Critical	Important
MS13-046	Multiple vulnerabilities in Kernel Mode Drivers allow privilege escalation. Replaces MS13-036 and MS13-031.
MS13-046	Kernel Mode Drivers CVE-2013-1332 CVE-2013-1333 CVE-2013-1334	KB 2840221	No publicly known exploits	Severity:Important Exploitability:1	Imporant	Important

We will update issues on this page for about a week or so as they evolve.
We appreciate updates
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY

(*): ISC rating

We use 4 levels:
- PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
- Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
- Important: Things where more testing and other measures can help.
- Less Urgent: Typically we expect the impact if left unpatched to be not that big a deal in the short term. Do not forget them however.
The difference between the client and server rating is based on how you use the affected machine. We take into account the typical client and server deployment in the usage of the machine and the common measures people typically have in place already. Measures we presume are simple best practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threat for affected systems. The rating does not account for the number of affected systems there are. It is for an affected system in a typical worst-case role.
Only the organization itself is in a position to do a full risk analysis involving the presence (or lack of) affected systems, the actually implemented measures, the impact on their operation and the value of the assets involved.
All patches released by a vendor are important enough to have a close look if you use the affected systems. There is little incentive for vendors to publicize patches that do not have some form of risk to them.

(**): The exploitability rating we show is the worst of them all due to the too large number of ratings Microsoft assigns to some of the patches.

--
Swa Frantzen -- Section 66

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.