Microsoft yanks botched patch KB 2949927, re-issues KB 2952664

Four more botched Microsoft patches: KB 3000061, KB 2984972, KB 2949927, KB 2995388

Man in the Middle

Excerpt from: http://iamsteve.in/08/2013/what-are-man-in-the-middle-attacks-arp-spoofing/

If we ever share a WiFi network, chances are I can intercept what you’re doing.

‘Man in the middle’ attacks have been around for about as long as the Internet itself, and so those familiar with network security will already be well aware of the threat posed by ‘ARP spoofing’ or ‘poisoning’. The thing is, most people aren’t familiar with the basics of protecting their communications online, and even those who are don’t always take the precautions that they know in theory they should be.



Wifi Pineapple What is a ‘man in the middle’ attack?

Without going into the technical details of how these attacks actually work, a ‘man in the middle’ attack essentially stick their hand up first when your device is looking for an appropriate router to connect to, and pretends to be where you actually want to gain access to.
Essentially, instead of connecting to the network through the route you might expect (like a wireless router) you get redirected via another device first. This means that all of your traffic is flowing through an additional step before getting onto the Internet, and allows anybody in control of that piece of equipment access to it.

This is incredibly easy to do, there are many real world examples of this in the field. One of the more infamous comes in the decidedly fruity shape of the ‘WiFi’ pineapple… a rogue device that convinces network traffic to connect to it rather than the intended, legitimate source. However, even this is bulky in comparison to the possibilities that are now on offer through mobile phone apps… which are harder to find or identify if they are ever detected.
What are the dangers?

It should hopefully be pretty obvious why you wouldn’t want wee Davey sitting in the corner of Starbucks intercepting everything that you’re doing online, but even if you’re not all that concerned about anybody knowing which websites you visit and when, there are other, more potent dangers that the man in the middle poses.

Whilst SSL is widely used for financial transactions (such as over PayPal), in practice, it’s far from perfect. Many websites still do not offer SSL connections by default, requiring you instead to specifically turn them on. Many simply require encryption for the login process, and not anything afterwards (which we’ll get to in the next section). Even those that do default to a secure connection, often still run the insecure service as well. It wasn’t too long ago that Facebook were operating precisely in this fashion.

Since most people take this for granted, it is fairly easy to redirect a computer under the spell of this sort of poisoning attack to the non-SSL version of a website, without it ever occurring to the user to check.

How can I protect myself?
Without a doubt, these attacks are something that everybody should be aware of, but most people aren’t – partly because of the technical nature of the problem. However, there are some simple things you can do to avoid this type of attack.

HTTPS Everywhere
HTTPS Everywhere is a plugin for Google Chrome and Firefox which automatically forces the browsers to go to the secure version of a website where available, and send all of the traffic over SSL. No need to fiddle about with the settings of individual settings on different services, or working out where offers SSL and where doesn’t. HTTPSEverywhere does the work for you.

Further Securing against the man in the middle
Using an encryption services will keep the data you transmit over a network secure, which is the primary concern of man in the middle attacks. However, they won’t necessarily stop the denial of service attack that was explained above. Whilst there isn’t many, there are a few utilities that Android, Windows, and Mac users can make use of to kill off an attempt completely, or at least be notified of it happening. If anybody is aware of any other effective utilities – especially for Windows/the iPhone – please get in touch!

Be vigilant
There is no single way to completely prevent man in the middle attacks from impacting your network connectivity. Most of the advice that is given from people who skim the surface of this topic boils down to “don’t use open wireless networks”. Uhh, right. Nice idea pal, but not a practical reality. As we rely more and more on disparate WiFi networks, we all need to be aware of the dangers of insecure communications, and take steps to reduce the risks. These aren’t limited solely to open networks, but any that are shared – such as in a workplace or University. Just because they are secured with a keyphrase, doesn’t mean they are any more secure than a public hotspot in an Internet cafe. Some types of wireless network are more secure than others, but it’s up to you to ensure the integrity of your own data.

If you only do one thing after reading this blog, then sign up for a VPN service and start using it on shared networks. Make sure you check that you’re connected to websites in SSL when you expect to be, and if something doesn’t seem right, disconnect and login somewhere else. It’s a first step towards keeping your personal information safe.

See more at http://iamsteve.in/08/2013/what-are-man-in-the-middle-attacks-arp-spoofing/

HIPAA and Windows XP

This topic can seem very Ickie and cloudy as it depends on your interpenetration to the rules. I would like to go on the record as saying that it is not wise to use any software that cannot and will not be updated for security vulnerabilities. I have read over the HIPAA compliance rules and many blogs and articles from experts, and although if you were to ask; "Does the Security Rule mandate minimum operating system requirements for the personal computer systems used by a covered entity?" you may find the answer at http://www.hhs.gov/ocr/privacy/hipaa/faq/securityrule/2014.html to be:

• No. The Security Rule was written to allow flexibility for covered entities to implement security measures that best fit their organizational needs. The Security Rule does not specify minimum requirements for personal computer operating systems, but it does mandate requirements for information systems that contain electronic protected health information (e-PHI). Therefore, as part of the information system, the security capabilities of the operating system may be used to comply with technical safeguards standards and implementation specifications such as audit controls, unique user identification, integrity, person or entity authentication, or transmission security.  Additionally, any known security vulnerabilities of an operating system should be considered in the covered entity’s risk analysis (e.g., does an operating system include known vulnerabilities for which a security patch is unavailable, e.g., because the operating system is no longer supported by its manufacturer).

However, i would like to point out, as many of my counterparts would do also, the following from the above:

• Additionally, any known security vulnerabilities of an operating system should be considered in the covered entity’s risk analysis

I think we all could agree since Windows will no longer patch, or update, and security vulnerabilities  on XP, we could see that a HIPAA compliance test on any XP computer would fail, and cost the company. in an article by Mike Semmel from the blog 4Medapproved.com/HITSecurity; He really does a good job of telling us all how important it truly is to get off of these old, outdated systems. 

Within the electronic code of Federal regulations or e-CFR(found at www.ecfr.gov), Title 45, part 164 subpart c, 

§164.308(5)(a)(1) states: 

• Security reminders (Addressable). Periodic security updates.

and §164.308(1)(i):

• Standard: Security management process. Implement policies and procedures to prevent, detect, contain, and correct security violations.

and §164.308(1)(A):

• Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.

So i would say with this evidence and the ever decreasing prices of computers, that any company would be farther ahead to pay three to five hundred dollars to replace the computer rather then the fines that could be imposed for the HIPAA Violations.

SandWorm: MICROSOFT WINDOWS ZERO-DAY VULNERABILITY (CVE-2014-4114) USED BY RUSSIAN ESPIONAGE GROUP

reference: http://www.isightpartners.com/2014/10/cve-2014-4114/

An update that just cannot be missed this time around is MS14-060, this is a zero day exploit that can give an attacker remote access to your computer through the use of a Malicious Office Document.

This affects all supported versions of Microsoft Windows and Windows Server 2008 and 2012 has been discovered and announced by iSIGHT Partners in collaboration with Microsoft. A patch has been made available for the vulnerability as of Tuesday, October 14.

MS14-060: Vulnerability in Windows OLE Could Allow Remote Code Execution (3000869) — An attacker who convinced a user to open a malicious Office document could gain remote code execution.

Visible Targets 

Visibility into this campaign indicates targeting across the following domains. It is critical to note that visibility is limited and that there is a potential for broader targeting from this group (and potentially other threat actors) using this zero-day. 

• NATO Ukrainian government organizations 
• Western European government organization 
• Energy Sector firms (specifically in Poland) 
• European telecommunications firms 
• United States academic organization

The group has also reportedly used at least five other older vulnerabilities in their attacks with many times chaining exploits as they move through networks.

So far the actual zero-day vulnerability is successfully exploited through PowerPoint, or other attachments. There has not been any indication that the initial exploit attack vector is remote, so it relies on social engineering or tactic to get a file with the malicious code to execute.

 - See more at: http://www.isightpartners.com/2014/10/cve-2014-4114/#sthash.kmiaLDli.dpuf

October Patch Update

               

USB’s and what makes them Bad

When we talk about a USB device or call something USB we are actually talking about the way a computer peripheral (including keyboards, pointing devices, digital cameras, printers, portable media players, disk drives and network adapters), connects to a computer or system to either communicate or supply electrical power.  In today’s world we all have something we use daily that uses a USB connection or cable; whether it is our smart phone or a mass storage device, an IPod or maybe even a webcam. This Universal standard makes it easy for us to connect all sorts of devices to our computers for easy use as all computers today have USB ports that come standard.

So how can something soo good become bad?

Simply because of opportunity, and hackers. Hackers are described as anyone who seeks to exploit weaknesses in a computer system or network (http://en.wikipedia.org/wiki/Hacker_ (computer_security)). Hackers look for any opportunity that either they can find or may present itself to take control and compromise a system or network. The hackers were able to find such an opportunity in USB device firmware. A USB device firmware hack called BadUSB was presented at Black Hat USA 2014 conference, demonstrating how a USB flash drive microcontroller can be reprogrammed to spoof various other device types in order to take control of a computer, exfiltration data, or spy on the user (http://www.wired.com/2014/07/usb-security/).

So what is BadUSB?

In an article from hacknigpost.com described it “in short, every USB drives has a microcontroller in it which is a small chip that acts as an interface between the device (keyboard, or  flash drive) and the host (PC). This small chip often has firmware that can be reprogrammed to do notorious things, such as logging your keystrokes and infect your Personal computer with malware, or something much worse. BadUSB is really very dangerous because of one factor which is “It is Undetectable”, even if scanned by Antivirus program.” According to Wired Magazine, this BadUSB vulnerability is practically unpatchable because it exploits the very way that USB device is designed. If once infected, each USB drive will infect anything it’s connected to.

So what is the impact of BadUSB?

Once the device is compromised, the USB devices can reportedly:
• Log keystrokes
• alter folders & files
• infect other devices & systems
• spoofs a network card to change the computer’s DNS setting
• Install malware & Control Keyboard

So how do you stay protected?

The best protection against BadUSB vulnerability and other similar exploits is good security practices. Always Keep your software updated & never open any files which you don’t recognize, and don’t plug any devices into your computer unless you know where they’ve been.