Securing The Kernel via Static Binary Rewriting and Program Shepherding

Abstract: Recent Microsoft security bulletins show that kernel vulnerabilities are becoming more and more important security threats. Despite the pretty extensive security mitigations many of the kernel vulnerabilities are still exploitable. Successful kernel exploitation typically grants the attacker maximum privilege level and results in total machine compromise.

To protect against kernel exploitation, we have developed a tool which statically rewrites the Microsoft Windows kernel as well as other kernel level modules. Such rewritten binary files allow us to monitor control flow transfers during operating system execution. At this point we are
able to detect whether selected control transfer flow is valid or should be considered as an attack attempt. Our solution is especially directed towards preventing remote kernel exploitation attempts. Additionally,many of the local privilege escalation attacks are also blocked (also
due to additional mitigation techniques we have implemented). Our tool was tested with Microsoft Windows XP, Windows Vista and Windows 7 (under both virtual and physical machines) on IA-32 compatible processors. Our apparatus is also completely standalone and does not require any third
party software.

Download: PDF

See also: hardened srv2.sys versus old smb2 exploit

Securing The Kernel via Static Binary Rewriting and Program Shepherding

Abstract: Recent Microsoft security bulletins show that kernel vulnerabilities are becoming more and more important security threats. Despite the pretty extensive security mitigations many of the kernel vulnerabilities are still exploitable. Successful kernel exploitation typically grants the attacker maximum privilege level and results in total machine compromise.

To protect against kernel exploitation, we have developed a tool which statically rewrites the Microsoft Windows kernel as well as other kernel level modules. Such rewritten binary files allow us to monitor control flow transfers during operating system execution. At this point we are
able to detect whether selected control transfer flow is valid or should be considered as an attack attempt. Our solution is especially directed towards preventing remote kernel exploitation attempts. Additionally,many of the local privilege escalation attacks are also blocked (also
due to additional mitigation techniques we have implemented). Our tool was tested with Microsoft Windows XP, Windows Vista and Windows 7 (under both virtual and physical machines) on IA-32 compatible processors. Our apparatus is also completely standalone and does not require any third
party software.

Download: PDF

See also: hardened srv2.sys versus old smb2 exploit

PacketFence v.2.2 Released

PacketFence: Open Source NAC (Network Access Control)

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) system. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, 802.1X support, layer-2 isolation of problematic devices, integration with the Snort IDS and the Nessus vulnerability scanner; PacketFence can be used to effectively secure networks - from small to very large heterogeneous networks.

Changes in V.2.2

PacketFence's captive portal now features network access detection using JavaScript and Kerberos can be used for authentication. The integration with FreeRADIUS 2 has also been greatly simplified and it's now possible to modify and preview remediation pages directly from PacketFence's web interface.

Futhermore, support for new 3Com switches (4200G, E4800G and E5500G in MAC Authentication and 802.1X) and Motorola RF Switches wireless controllers was added. Apache's configuration is automatically adjusted on startup based on system resources to avoid performance degradation on heavy workloads. And finally, new reports were added such as "Nodes per SSID" or "Connection Type".

Download: http://www.packetfence.org

PacketFence v.2.2 Released

PacketFence: Open Source NAC (Network Access Control)

PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) system. Boasting an impressive feature set including a captive-portal for registration and remediation, centralized wired and wireless management, 802.1X support, layer-2 isolation of problematic devices, integration with the Snort IDS and the Nessus vulnerability scanner; PacketFence can be used to effectively secure networks - from small to very large heterogeneous networks.

Changes in V.2.2

PacketFence's captive portal now features network access detection using JavaScript and Kerberos can be used for authentication. The integration with FreeRADIUS 2 has also been greatly simplified and it's now possible to modify and preview remediation pages directly from PacketFence's web interface.

Futhermore, support for new 3Com switches (4200G, E4800G and E5500G in MAC Authentication and 802.1X) and Motorola RF Switches wireless controllers was added. Apache's configuration is automatically adjusted on startup based on system resources to avoid performance degradation on heavy workloads. And finally, new reports were added such as "Nodes per SSID" or "Connection Type".

Download: http://www.packetfence.org

Updates: ZoomIt v4.2, Process Explorer v14.11, ProcDump v3.04, and Mark Live: Zero Day Malware Cleaning with the Sysinternals Tools

ZoomIt v4.2: This update to ZoomIt, a screen magnification and annotation utility, now adjusts the drawing pen size when you enter drawing mode from live zoom to match the static zoom pen size.

Process Explorer v14.11: Process Explorer v14.11 includes the ability to configure network and disk activity icons in the tray.

ProcDump v3.04: This update to ProcDump’s miniplus dump type (-mp) includes heuristics that include thread stack memory.

Mark Live: Zero Day Malware Cleaning with the Sysinternals Tools: Join Mark on Saturday, July 23 live or via webcast for a deep dive into key Sysinternals tools, including Process Explorer, Process Monitor and Autoruns, that focuses on their features and functionality useful for malware analysis and cleaning.

Source: http://blogs.technet.com

Updates: ZoomIt v4.2, Process Explorer v14.11, ProcDump v3.04, and Mark Live: Zero Day Malware Cleaning with the Sysinternals Tools

ZoomIt v4.2: This update to ZoomIt, a screen magnification and annotation utility, now adjusts the drawing pen size when you enter drawing mode from live zoom to match the static zoom pen size.

Process Explorer v14.11: Process Explorer v14.11 includes the ability to configure network and disk activity icons in the tray.

ProcDump v3.04: This update to ProcDump’s miniplus dump type (-mp) includes heuristics that include thread stack memory.

Mark Live: Zero Day Malware Cleaning with the Sysinternals Tools: Join Mark on Saturday, July 23 live or via webcast for a deep dive into key Sysinternals tools, including Process Explorer, Process Monitor and Autoruns, that focuses on their features and functionality useful for malware analysis and cleaning.

Source: http://blogs.technet.com

AntiXSS v.4.0 Released

Microsoft Anti-Cross Site Scripting Library V4.0

The Microsoft Anti-Cross Site Scripting Library V4.0 (AntiXSS V4.0) is an encoding library designed to help developers protect their ASP.NET web-based applications from XSS attacks. It differs from most encoding libraries in that it uses the white-listing technique -- sometimes referred to as the principle of inclusions -- to provide protection against XSS attacks. This approach works by first defining a valid or allowable set of characters, and encodes anything outside this set (invalid characters or potential attacks). The white-listing approach provides several advantages over other encoding schemes. New features in this version of the Microsoft Anti-Cross Site Scripting Library include:- A customizable safe list for HTML and XML encoding- Performance improvements- Support for Medium Trust ASP.NET applications- HTML Named Entity Support- Invalid Unicode detection- Improved Surrogate Character Support for HTML and XML encoding- LDAP Encoding Improvements- application/x-www-form-urlencoded encoding support

Download: http://www.microsoft.com

AntiXSS v.4.0 Released

Microsoft Anti-Cross Site Scripting Library V4.0

The Microsoft Anti-Cross Site Scripting Library V4.0 (AntiXSS V4.0) is an encoding library designed to help developers protect their ASP.NET web-based applications from XSS attacks. It differs from most encoding libraries in that it uses the white-listing technique -- sometimes referred to as the principle of inclusions -- to provide protection against XSS attacks. This approach works by first defining a valid or allowable set of characters, and encodes anything outside this set (invalid characters or potential attacks). The white-listing approach provides several advantages over other encoding schemes. New features in this version of the Microsoft Anti-Cross Site Scripting Library include:- A customizable safe list for HTML and XML encoding- Performance improvements- Support for Medium Trust ASP.NET applications- HTML Named Entity Support- Invalid Unicode detection- Improved Surrogate Character Support for HTML and XML encoding- LDAP Encoding Improvements- application/x-www-form-urlencoded encoding support

Download: http://www.microsoft.com

ESET NOD32 Antivirus comes to Linux

ESET NOD32 Antivirus has long been one of the antivirus software available for Microsoft Windows platforms rated by its speed and reliability, and has just appeared in Linux. Does anyone expect?

Each such notice is required to repeat the same old question: Why do we need an antivirus on Linux? Well, maybe many do they need it and as many other, especially those using mixed

Nmap, scans your computer ports

Nmap is a security tool used, among other things, show open ports of a team. It is also possible to "request" Nmap to show us additional information on each port as well as the operating system itself.

As Nmap is included in the Ubuntu repositories, so installation is simple:sudo apt-get install nmapOnce installed, you can do the most basic test:

As you can see, on my computer I have 3 ports

YARA v.1.5 released

A malware identification and classification tool

YARA is a tool aimed at helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families based on textual or binary patterns contained on samples of those families. Each description consists of a set of strings and a Boolean expression which determines its logic.
YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension.

This version provides some new features, including:
* Process memory scanning
* Support for ELF files
* Faster regular expressions by using RE2 instead of PCRE

Download and more info: http://code.google.com

YARA v.1.5 released

A malware identification and classification tool

YARA is a tool aimed at helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families based on textual or binary patterns contained on samples of those families. Each description consists of a set of strings and a Boolean expression which determines its logic.
YARA is multi-platform, running on Windows, Linux and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the yara-python extension.

This version provides some new features, including:
* Process memory scanning
* Support for ELF files
* Faster regular expressions by using RE2 instead of PCRE

Download and more info: http://code.google.com

Preventing XSS Attacks

Cross Site Scripting (XSS) attacks are amongst the most common types of attacks against web applications. XSS attacks all fall under the same category however a more detailed look at the techniques employed during XSS operations reveals a multitude of tactics that exploit a variety of attack vectors. A detailed look at XSS attacks can be found in the following article; Cross-Site Scripting attack.

This article guides you through the most common and useful XSS prevention mechanisms which are Filtering and Escaping.

More: http://www.acunetix.com

Preventing XSS Attacks

Cross Site Scripting (XSS) attacks are amongst the most common types of attacks against web applications. XSS attacks all fall under the same category however a more detailed look at the techniques employed during XSS operations reveals a multitude of tactics that exploit a variety of attack vectors. A detailed look at XSS attacks can be found in the following article; Cross-Site Scripting attack.

This article guides you through the most common and useful XSS prevention mechanisms which are Filtering and Escaping.

More: http://www.acunetix.com

Credit Card skimming and PIN harvesting in an EMV world

Chip & PIN is definitely broken

At the CanSecWest security conference held in Vancouver last week, four security researchers demonstrated the practicability of chip card skimming attacks – both with an insecure class of chip (SDA) and with a class that has been considered secure (DDA). EC and credit cards chipped according to EMV specifications are designed to hamper "skimming", an attack method which involves intercepting a user's card and PIN data.

Skimming attacks aren't an altogether new idea and can also be carried out via such devices as keyboard attachments. In their presentation, entitled "Credit Card skimming and PIN harvesting in an EMV world" , however, the four researchers describe how a flat circuit board inside the card slot can be used to intercept and manipulate the communication between terminal and chip in order to obtain a user's PIN. A circuit board is far more discrete than a wobbly, glued-on attachment.

Source: http://www.h-online.com

Download: PDF

Credit Card skimming and PIN harvesting in an EMV world

Chip & PIN is definitely broken

At the CanSecWest security conference held in Vancouver last week, four security researchers demonstrated the practicability of chip card skimming attacks – both with an insecure class of chip (SDA) and with a class that has been considered secure (DDA). EC and credit cards chipped according to EMV specifications are designed to hamper "skimming", an attack method which involves intercepting a user's card and PIN data.

Skimming attacks aren't an altogether new idea and can also be carried out via such devices as keyboard attachments. In their presentation, entitled "Credit Card skimming and PIN harvesting in an EMV world" , however, the four researchers describe how a flat circuit board inside the card slot can be used to intercept and manipulate the communication between terminal and chip in order to obtain a user's PIN. A circuit board is far more discrete than a wobbly, glued-on attachment.

Source: http://www.h-online.com

Download: PDF

Book - Configuring IPCop Firewalls

IPCop is a powerful, open source, Linux based firewall distribution for primarily Small Office Or Home (SOHO) networks, although it can be used in larger networks. It provides most of the features that you would expect a modern firewall to have, and what is most important is that it sets this all up for you in a highly automated and simplified way.

This book is an easy introduction to this popular application.
Read more »

Tip: Solution to Bug in Flash on YouTube

I do not know if I passed, but the Flash update caused a problem on YouTube by making the videos they saw in pink. And nothing could be seen.

To fix this, this post showing the solution.sudo mkdir /etc/adobe
sudo bash -c "echo 'OverrideGPUValidation = 0' >> /etc/adobe/mms.cfg"Restart your browser, And ready!

How To install ESET NOD32 Antivirus 4 for Linux

ESET has released a final version of the MacOS X of NOD32 antivirus, and for GNU/Linux is in the process (for now, is currently in beta).

They have released these versions for Mac and Linux in particular to protect Windows computers, as is spreading the use of Linux on netbooks and this leads to that when things are passed from one to another, get virus from Linux to Windows (Linux being immune

OWASP AntiSamy v.1.4.4 Released

The OWASP AntiSamy project is an API for safely allowing users to supply their own HTML and CSS without exposure to XSS vulnerabilities.

The biggest move of this release is to officially change the default parser/serializer from the DOM engine to the SAX engine. We’ve had two engines for the past few versions, but maintaining two engines concurrently is kinda crazy. The SAX version is twice as fast and much better on memory. Even though all of our test cases pass for both engines, I still anticipate some growing pains in the SAX version, which is why I think most critical applications should stick to 1.4.3 for now.

Changelist:
-fixed error message not sanitizing CDATA payloads when encountered (should only concern you if you use error messages + exactly version 1.4.3)
-tags that are allowed to be empty are no longer hardcoded and can be set in the policy file (), with a safe default list if none are provided
-continued to try to make SAX and DOM version semantically if not literally identical output
-added test cases to regression
-fixed Julian Cohen’s privately reported stack exhaustion bug by applying a tree depth check (the max depth of a DOM tree is now 250)
-no longer Java 1.4 compatible

Download: http://code.google.com