Latest Microsoft Security Report

Microsoft’s Security Intelligent Report (SIR) v10 has been released and can be found here.

The key highlights from Microsoft’s own Roger Halbheer:

  • Industry vulnerability disclosure trends continue an overall trend of moderate declines since 2006. This trend is likely because of better development practices and quality control throughout the industry,which result in more secure software and fewer vulnerabilities.
  • Vulnerability disclosures for Microsoft products increased slightly in 2010 but have generally remained stable over the past several periods.

[…]

  • The exploitation of Java vulnerabilities sharply increased in the second quarter of 2010 and surpassed every other exploitation category that the MMPC tracks,including generic HTML/scripting exploits,operating system exploits,and document exploits.
  • The number of Adobe Acrobat and Adobe Reader exploits dropped by more than half after the first quarter,and remained near this reduced level throughout the remainder of the year.

[…]

  • Exploits that affected Adobe Acrobat and Adobe Reader accounted for most document format exploits detected throughout 2010. Almost all of these exploits involved the generic exploit family Win32/Pdfjsc

[…]

  • Microsoft Office file format exploits accounted for between 0.5 and 2.8 percent of the document format exploits that were detected each quarter in 2010.

[…]

  • As in previous periods,infection rates for more recently released Microsoft operating systems and service packs are consistently lower than older ones,for both client and server platforms. Windows 7 and Windows Server 2008 R2,the most recently released Windows client and server versions,respectively,have the lowest infection rates.
  • Infection rates for the 64-bit versions of Windows Vista® and Windows 7 are lower than for the corresponding 32-bit versions of those operating systems. One reason may be that 64-bit versions of Windows still appeal to a more technically savvy audience than their 32-bit counterparts,despite increasing sales of 64-bit Windows versions among the general computing population. Kernel Patch Protection (KPP),a feature of 64-bit versions of Windows that protects the kernel from unauthorized modification,may also contribute to the difference by preventing certain types of malware from operating.

[…]

  • In the first half of 2010,phishers showed signs of targeting online gaming sites with increasing frequency,although this push appeared to have dwindled as social networks came under increased attack. Impressions that targeted gaming sites reached a high of 16.7 percent of all impressions in June before dropping to a more typical 2.1 percent in December.
  • Phishing sites that target social networks routinely receive the highest number of impressions per active phishing site. The percentage of active phishing sites that targeted social networks increased during the final months of the year,but still only accounted for 4.2 percent of active sites in December,despite receiving 84.5 percent of impressions that month. Nevertheless,the number of active sites targeting gaming sites remained relatively high during the second half of the year,which suggests that more campaigns may be coming.

 

Microsoft’s DEP, ASLR: Can’t have one without the other…

There’s an interesting series on the Microsoft Security Research & Defense blog covering ASLR and DEP memory protections found in Windows XP SP3+.

DEP effectiveness (without ASLR)

Summary: DEP breaks exploitation techniques that attackers have traditionally relied upon, but DEP without ASLR is not robust enough to prevent arbitrary code execution in most cases.

ASLR effectiveness (without DEP)

Summary: ASLR breaks an attacker’s assumptions about where code and data are located in the address space of a process.  ASLR can be bypassed if the attacker can predict, discover, or control the location of certain memory regions (particularly DLL mappings).  The absence of DEP can allow an attacker to use heap spraying to place code at a predictable location in the address space.

DEP+ASLR effectiveness

Summary: DEP+ASLR are most effective when used in combination; however, their combined effectiveness is heavily dominated by the effectiveness of ASLR.  Exploits have been developed that are able to bypass DEP+ASLR in the context of browsers and third-party applications.  Nevertheless, the vast majority of exploits written to date do not attempt to bypass the combination of DEP+ASLR.

Windows Anti Forensics Tip of the Day…

I previously wrote about how to have your system automatically clear the pagefile before a reboot or shutdown.  There’s a couple other steps I recommend you make on your system…

Automatically permanently delete (Nuke on Delete)- Normally Delete sends files to the Recycle Bin and a Shift+Delete will permanently delete them.  With the registry tweak below the normal Delete will also behave as a permanent delete. ***Note: Delete does not mean a file is deleted.  It only frees up the file record and clusters so they _could_ be overwritten.

  1. Go to Start -> Run and type Regedit
  2. On the left hand side select the “+” to navigate to the following.
  3. HKEY_LOCAL_MACHINE SOFTWARE Microsoft Windows CurrentVersion Explorer BitBucket
  4. On the right look for NukeOnDelete
  5. Right click it and set the key value for NukeOnDelete to 1

Scheduled Task to Zero out unused disk space – As I mentioned above a deleted file only insures that there is a _chance_ the file will be overwritten.  If you run the below command it will zero out all unused disk space which _should_ be good enough to prevent file content recovery. ***Note: The deleted file name will still be lying around until a new file happens to overwrite it.

>cipher /W:[directory_to_wipe]

Here’s my scheduled task: C:WINDOWSsystem32cmd.exe /c cipher /W:C:

Scheduled Task to Delete Recent Items – Even if you permanently delete a file and or use Eraser there’s a copy of the filename in your Recent directory.  I have the following scheduled task command which clears my Recent items once a day….

Task for Recent Items:

>C:WINDOWSsystem32cmd.exe /c del “c:documents and settings[username]recent*.lnk”

Task for Recent Office Items:

>C:WINDOWSsystem32cmd.exe /c del /Q “C:Documents and Settings[username]Application DataMicrosoftOfficeRecent*.*”

Eraser I highly recommend using this great freeware utility.  One of many things it does is adds a new option in your content menu to permanently delete a file and zero out the contents all at the same time.

Setting up Windows Honey Pot Shares

I recently setup a honeypot share on a Windows server.  I put some very “interesting” files and directories in there (financial information, PII etc) and then enabled audit logging in Windows.  There’s a very powerful but mostly unknown Windows tool called LogParser which can be used to query your System/Security event logs.  It’s possible to write a script that will query your system security log every so often and look for requests to the honey pot.  You can get very sophisticated using LogParser, a few hand written scripts, and the Windows Task Scheduler.

  1. Create the honeypot file share.
  2. Create sexy files in the share: bank_statement.pdf, password_list.txt, 08taxes.pst, gmail.doc, megan13.jpg, etc….
  3. Enable audit logging on shared folder.
  4. Install LogParser.
  5. Learn to use LogParser here: http://128.175.24.251/forensics/logparser.htm

Microsoft’s google killer: Bing

Now that Microsoft’s Bing has been out for a couple weeks I’m wondering everyone’s impression.  I like the simple interface with minimal ad’s and clutter.  Nothing like the MSN search.  It looks awfully similar to Google’s interface.

However, I’m very disappointed with search results.  I’m finding that most of my queries are not returning what I’m looking for.  I find myself returning to google.  This could be because the Bing engine doesn’t have enough information from analytics data to generate better results.  Hopefully with time this will improve; once Bing see’s what pages users are really interested in.