Just a friendly reminder to make sure you’re only allowing port 80, 443, and maybe 8080 outbound from your network. According to this recent US CERT alert advanced attackers are using email attachments to leverage legitimate Microsoft Office functions to retrieve a document from a remote server using the Server Message Block (SMB) protocol. This sends the user’s credential hash to the remote server prior to retrieving the requested file. (Note: It is not necessary for the file to be retrieved for the transfer of credentials to occur.) The threat actors then likely used password-cracking techniques to obtain the plaintext password.
TCP ports 445 or 139 and UDP ports 137 or 138 (SMB) should only be allowed internally !!!
There’s a great summary of the government’s case against Microsoft concerning the subpoenaing ability of data (email) residing in an overseas data center controlled by a US company. The crux of the dispute is the territorial reach (and territorial applicability) of the Stored Communications Act (SCA), a subset of the Electronic Communications Privacy Act (ECPA) that governs law enforcement access to communications data.
The dispute arose when the Justice Department brought a warrant to Microsoft – issued based upon probable cause under the SCA (18 U.S.C. § 2703) – asking for the details and contents of an email account believed to be associated with a suspected drug trafficker.
Microsoft produced the transactional records it held on its data centers in the United States, but declined to produce the customer’s emails that it said were stored on a data center in Ireland.
Sysinternals Autoruns is a great way to view persistent WMI subscriptions for an online system. What tools are available to scan for WMI subscriptions against offline images?
A technical solution has finally been proposed to avoid locking out Linux and other OS vendors from UEFI shipped motherboards. A couple of months ago Microsoft made waves by announcing their Windows 8 support for UEFI. Open source supports took notice that this security mechanism could prevent other operating systems from booting on UEFI compatible hardware.
The Linux Foundation has released a paper with a possible solution:
papers suggest that all platforms which enable Secure Boot should ship in “setup mode” which would give the system owner control of the Secure Boot system. Initial startup of an operating system should then detect that setup mode and install a KEK (key-exchange-key) and PK to enable Secure Boot. The system would then securely boot that operating system. When a user needed to take control of their system’s secure boot, a “reset” option for UEFI’s keys would allow those keys to be cleared and a different operating system installed. Microsoft’s Windows 8 could also be pre-installed in the same way; the UEFI reset would then unlock the machine for other operating systems.
Microsoft also recently released an eye catching paper aptly named that discusses the validity of security reports. Far from being broadly-based estimates of losses across the population, the cyber-crime estimates that we have appear to be largely the answers of a handful of people extrapolated to the whole population.
Sex, Lies and Cybercrime Surveys
Microsoft’s Security Intelligent Report (SIR) v10 has been released and can be found here.
The key highlights from Microsoft’s own Roger Halbheer:
- Industry vulnerability disclosure trends continue an overall trend of moderate declines since 2006. This trend is likely because of better development practices and quality control throughout the industry,which result in more secure software and fewer vulnerabilities.
- Vulnerability disclosures for Microsoft products increased slightly in 2010 but have generally remained stable over the past several periods.
- The exploitation of Java vulnerabilities sharply increased in the second quarter of 2010 and surpassed every other exploitation category that the MMPC tracks,including generic HTML/scripting exploits,operating system exploits,and document exploits.
- The number of Adobe Acrobat and Adobe Reader exploits dropped by more than half after the first quarter,and remained near this reduced level throughout the remainder of the year.
- Exploits that affected Adobe Acrobat and Adobe Reader accounted for most document format exploits detected throughout 2010. Almost all of these exploits involved the generic exploit family Win32/Pdfjsc
- Microsoft Office file format exploits accounted for between 0.5 and 2.8 percent of the document format exploits that were detected each quarter in 2010.
- As in previous periods,infection rates for more recently released Microsoft operating systems and service packs are consistently lower than older ones,for both client and server platforms. Windows 7 and Windows Server 2008 R2,the most recently released Windows client and server versions,respectively,have the lowest infection rates.
- Infection rates for the 64-bit versions of Windows Vista® and Windows 7 are lower than for the corresponding 32-bit versions of those operating systems. One reason may be that 64-bit versions of Windows still appeal to a more technically savvy audience than their 32-bit counterparts,despite increasing sales of 64-bit Windows versions among the general computing population. Kernel Patch Protection (KPP),a feature of 64-bit versions of Windows that protects the kernel from unauthorized modification,may also contribute to the difference by preventing certain types of malware from operating.
- In the first half of 2010,phishers showed signs of targeting online gaming sites with increasing frequency,although this push appeared to have dwindled as social networks came under increased attack. Impressions that targeted gaming sites reached a high of 16.7 percent of all impressions in June before dropping to a more typical 2.1 percent in December.
- Phishing sites that target social networks routinely receive the highest number of impressions per active phishing site. The percentage of active phishing sites that targeted social networks increased during the final months of the year,but still only accounted for 4.2 percent of active sites in December,despite receiving 84.5 percent of impressions that month. Nevertheless,the number of active sites targeting gaming sites remained relatively high during the second half of the year,which suggests that more campaigns may be coming.