Responsibility is Everyone's Job

The software developers constantly talk about responsible disclosure.

Responsible disclosure is basically defined as informing the software developer of a vulnerability so that the vulnerability can be researched and fixed. This is compared to full disclosure where the vulnerability is announced to everyone without giving the software developer a chance to fix the vulnerability. Contrast this with the economic pressure for a software developer to reveal a vulnerability, which is none.

The spectrum consists of Full Disclosure (tell everyone), Responsible Disclosure (tell the developer), and Non-Disclosure (tell no one). Without going into details suffice it to say the responsible disclosure is currently mainstream.

The question is how the developers handle fixing the vulnerability. The general thought is that a responsible company would put resources into fixing these as soon as possible, but these comercial developers are, for the most part are in business to make a profit. I am not including open source developers in this post.

Now for two examples of how Microsoft has handeled responsible disclosures.

The ANI exploit, which I wrote about in Vista Smista& ANI Exploit. The vulnerability was disclosed in December of 2006 and not fixed until exploits where released in March. An quote from my previous blog is below and more details are in my other post mentioned above:

In short this was disclosed to Microsoft in December of 2006. Apparently the first report of this vulnerability was used as an exploit was March 28th. Due to the wide spread use of the exploit several third parties released interim patches... Microsoft
reacted, as it tends to do when third party patches are released, and the news
media starts to publish... Microsoft released the official patch out-of-cycle on
Tuesday the 3rd of April (instead of today the 10th of April).

Just recently, the end of May 2007, a vulnerability in Microsoft Web Server IIS 5.X where authentication can be bypassed, was announced. However this vulnerability was discovered December 15th 2005 (no this is not a typo) and was subsiquently responsibly disclosed to Microsoft. Apparently Microsoft finally decide to publically disclose the vulnerability, but without a fix. Unless you consider paying for an upgrade to Windows Server 2003 and IIS 6.0 a patch.

Keeping in mind thath these are just two examples where:

1. Microsoft failed to fix a known vulnerability for several months until an exploit was released.
2. Kept a vulnerability secret for over a year and then releases the information and requires a paid upgrade to the latest code for a fix.

I think Microsoft should re-evaluate their responsibilities as a good citizen or netizen.

Windows Please Phone Home!

I have talked about patching a few times.

I have also discussed how I have found Microsoft Windows systems that where configured for automatic downloading of security patches, but where not patched in Cup of Hot Cocoa: Patch Warfare II.

Now it appears that Microsoft has taken notice and has released patches to fix the problems with the automatic updates, and manually using Microsoft and Windows Update sites for that matter which is great, but except for an announcement on their blog (Welcome to the Microsoft Security Response Center Blog!) it has received very little fanfare. See Two Advisories on Non-Security Updates for details.

Now the scary part is that it is being distributed be the very mechanism that it is designed to fix. If a PC is not getting updates due to the problems these updates fix, then the system will not get the fix! Now to compound the problem these fixes are distributed separately and each one requires a reboot.

In other words the broken update mechanism must download and install the first update. Can you say if your internet connection is down please visit our web site to report a problem... or how about please cal the phone company if your phone is not working...

Then it has to do the same thing for the second update!

Now if Microsoft wanted to be a good internet citizen they would announce this all over the place and encourage users to visit the update sites to download these manually or if that fails to directly download them per the knowledge base articles: Microsoft Security Advisory (927891) and Microsoft Security Advisory (937696).

The One, The Only, The Vulnerable Vista

Lets start this out by saying that Vista was designed to be more secure, and it appears to be headed in the right direction there. Just don't get me started on DRM.

Once again Vista, the impenetrable, that is according to the marketing hype has been proven vulnerable. There was the ANI vulnerability that MS rushed a patch out for last week, and now during the regular update there is a second vulnerability designated as critical by MS for Vista.

Once the all the hype is removed it is just another operating system by Microsoft that has it's flaws. Once is has had time to mature I'll consider adding it to one of my systems. For now I'll only "play" with it as a virtual machine.

Vista Smista & ANI Exploit

OK, I've gotten it out of my system. I'm not a fan of Vista I have two main issues in regards to Vista:

1. The fact that Digital Rights Management (DRM) has some control over my system, and can degrade or disable viewing "premium content" when someone else feels that there is a potential for me to steal premium content. I'd call that guilty unless proven innocent.
2. Then there is the marketing, I shouldn't call it scam, hype that Vista in invulnerable.

Issue 1 has been beaten to death by many people including myself.

For issue 2 I'll mention Microsoft Security Advisory (935423). This was commonly referred to as the Microsoft ANI vulnerability, and Vista was one of the version that was vulnerable.

ANI Details

In short this was disclosed to Microsoft in December of 2006. Apparently the first report of this vulnerability was used as an exploit was March 28th. Due to the wide spread use of the exploit several third parties released interim patches, including my favorite Zeroday Emergency Response Team (ZERT). Microsoft reacted, as it tends to do when third party patches are released, and the news media starts to publish... Microsoft released the official patch out-of-cycle on Tuesday the 3rd of April (instead of today the 10th of April)

Its a Cold Day on the Internet

No this is not an April fools joke.

Once again the dark side has come out with a nasty, and this one is so bad that the Internet Storm Center (ISC) has raised the threat level to Yellow which ISC describes as:

We are currently tracking a significant new threat. The impact is either unknown or expected to be minor to the infrastructure. However, local impact could be significant. Users are advised to take immediate specific action to contain the impact. Example: 'MSBlaster' worm outbreak.

More information about the various levels are here.

In a nutshell MS has released an advisory 935423 also know as CVE-2007-0038, and before that as CVE-2007-1765. The issue is that animated cursors, yes those cute things, and be used to install malware and compromise your computer. Don't think that just because you don't see a change to your cursor that it has not happened (they can use the same visual effects as standard, and infect your computer).

What I find maddening is that this vulnerability was first reported to MS back in December 20, 2006, MS skipped last months updates and there is no patch from Microsoft yet. I will note that there was no evidence of the vulnerability being exploited until recently, but way to go MS.

Now there is a patch available from Zeroday Emergency Response Team (ZERT) which is detailed here. Personally I'm using it and have used their patches in the past when MS has been slow to get an official fix out for a really nasty, shall I call it a malware epidemic.

ZERT is not know for casually creating unofficial patches, but was formed by a group of well known security experts to provide a quick response for nasty widespread zeroday exploits.

UPDATE: I just ran across the following information posted on April 1st, but it appears to be real. MS is apparently planning on releasing a patch for this a week early on April 3rd announced o their security blog, and on their Microsoft Security Bulletin Advance Notification. This appears to be the truth and not a April Fools joke. I will not that this states planned, and this is not the first time that a third party patch has embarrassed MS into releasing a security patch out-of-cycle.

No this is not an April fools joke.

The Band-aid Approach

There was a comment posted asking why I was against the approach of shuffling buffers around in my post entitled Exploit Longevity (http://sec-soapbox.blogspot.com/2007/03/exploit-longevity.html).

Before I can answer I need to make sure that we have a common understanding of buffers and buffer overflows.

What is a Buffer?

A buffer is a portion of memory where a program stores information that changes. Every time a web site address is typed into a web browser the address is stored in a buffer.

What is a Buffer Overflow?

Buffers do not have an unlimited size, and that fact can be exploited. By providing too much information to the program and overflowing the buffer. When a buffer is overflowed one of two things happen the program crashes or runs what the perpetrator wants it to.

When the program crashes that is a Denial of Service (DoS) attack.

When the program executes what the attacker intended that is an exploit. For a little more meat, e.g. technical explanation. The attacker will usually uses a series of NoOp* instructions to create a "NoOp slide"before the exploit code. Once the program tries to execute the code that was after the buffer it will "slide down" the NoOps to the exploit.

Is Moving the Buffer a Cure?

Consider finding out that someone with the right tool, a "slim jim," can open your car door and steal the car. The manufacture sends has all the cars modified to move the "weak link" over 5 inches, but not protect it. Since everyone knows the fix it simply takes car thieves a short time to adjust and continue stealing cars.

Of course its different with software patches... Not.

For the exploiter the patch is simply the instruction manual for finding the new location of the buffer.

In essence this type of patch is a band-aid not a cure.

* A single byte machine code that performs no operations. Originally used to remove code from machine code with out having to rewrite major portions of the program.

What is a buffer overflow

What prevents a buffer overflow

Why moving a buffer isn't a fix

With securely written programs buffer overflows can't happen.

Exploit Longevity

Ever notice how some exploits just seem to stay around forever?

There is actually a simple, but in my opinion ugly, explanation for this. As usual an example can be worth a thousand words, and I’m going to use rpc18.c as an example:

//////////////////////////////////////////////////////
//
// Windows RPC DCOM Remote Exploit with 18 Targets
// by pHrail and smurfy + some offsets by teos
//
// Targets:
// 0 Win2k Polish nosp ver 5.00.2195
// 1 Win2k Polish +sp3 ver 5.00.2195
// 2 Win2k Spanish +sp4
// 3 Win2k English nosp 1
// 4 Win2k English nosp 2
// 5 Win2k English +sp1
// 6 Win2k English +sp2 1
// 7 Win2k English +sp2 2
// 8 Win2k English +sp3 1
// 9 Win2k English +sp3 2
// 10 Win2k English +sp4
// 11 Win2k China +sp3
// 12 Win2k China +sp4
// 13 Win2k German +sp3
// 14 Win2k Japanese +sp2
// 15 WinXP English nosp ver 5.1.2600
// 16 WinXP English +sp1 1
// 17 WinXP English +sp1 2
// 18 WinXP English +sp2
//
/////////////////////////////////////////////////////////

Notice targets 3-10 are all English versions of Windows 2000 and 16-18 are all Windows XP. Now each target has a different patch level so it must be exploiting the exact same issue, but wait there is more. The next section below shows the offset where the exploit is located.

The text on each line in quotes is the location where the exploit is located in the program. The troubling issue is that for each patch level the location has changed. In other words instead of fixing the problem with the patch the location of the vulnerability is moved, and obviously, as rpc18.c shows, this is not an effective method.

/* Myam add OFFSETS*/
char win2knosppl[] = "\x4d\x3f\xe3\x77"; /* polish win2k nosp ver 5.00.2195*/
char win2ksp3pl[] = "\x29\x2c\xe4\x77"; /* polish win2k sp3 - ver 5.00.2195 tested */
char win2ksp4sp[] = "\x13\x3b\xa5\x77"; /* spanish win2k sp4 */
char win2knospeng1[] = "\x74\x16\xe8\x77"; /* english win2k nosp 1 */
char win2knospeng2[] = "\x6d\x3f\xe3\x77"; /* english win2k nosp 2 */
char win2ksp1eng[] = "\xec\x29\xe8\x77"; /* english win2k sp1 */
char win2ksp2eng1[] = "\x2b\x49\xe2\x77"; /* english win2k sp2 1 */
char win2ksp2eng2[] = "\xb5\x24\xe8\x77"; /* english win2k sp2 2 */
char win2ksp3eng1[] = "\x7a\x36\xe8\x77"; /* english win2k sp3 1 */
char win2ksp3eng2[] = "\x5c\xfa\x2e\x77"; /* english win2k sp3 2 */
char win2ksp4eng[] = "\x9b\x2a\xf9\x77"; /* english win2k sp4 */
char win2ksp3chi[] = "\x44\x43\x42\x41"; /* china win2k sp3 */
char win2ksp4chi[] = "\x29\x4c\xdf\x77"; /* china win2k sp4 */
char win2ksp3ger[] = "\x7a\x88\x2e\x77"; /* german win2k sp3 */
char win2ksp2jap[] = "\x2b\x49\xdf\x77"; /* japanese win2k sp2 */
char winxpnospeng[] = "\xe3\xaf\xe9\x77"; /* english xp nosp ver 5.1.2600 */
char winxpsp1eng1[] = "\xba\x26\xe6\x77"; /* english xp sp1 1 */
char winxpsp1eng2[] = "\xdb\x37\xd7\x77"; /* english xp sp1 2 */
char winxpsp2eng[] = "\xbd\x73\x7d\x77"; /* english xp sp2 */

Cup of Hot Cocoa: Patch Warfare II

What to do?

First

Either update you machines religiously on every Black Tuesday (the second Tuesday of the month when Microsoft releases security patches). I don't trust Microsoft update. I have seen too many machines that have it running and are still unpatched days after new patches are released. I know many of these machines where left running over night to update. So my conclusion is the the Microsoft update services are overwhelmed by the shear numbers to properly serve all the machines clamoring for update.

Third Party Software

Microsoft has no mechanism to update non-Microsoft programs, and who doesn't have those? These must be kept up to date as well. Some offer automatic silent updates, automatic notices of updates or nothing at all. Oh I almost forgot about the automated update notice that is broken... I ran in to this with several versions of Sun Java JRE.

Well there is an option for some of the more popular software out there. Secunia Software's fee online assessment which I wrote about in How to Find Bad Apps (http://sec-soapbox.blogspot.com/2007/02/how-to-find-bad-apps.html) will scan your computer for vulnerable non-Microsoft applications.

Cruft

Not all applications clean up after themselves. Sun Java for one leaves old versions in place, which can be usefule for those few who actually need multiple versions. For the rest of us it leaves security holes on our systems and takes up disk space. I have more details including how to automate the install and de-installation of Sun Java posted here: Do you Java? (http://sec-soapbox.blogspot.com/2007/01/do-you-java.html).

Stay tuned for the next "Cup of Hot Cocoa" episode where I discuss default.

Cup of Hot Cocoa: Patch Warfare

Back in the day...

In the PC world patches where a rare thing. You purchased a program and then when the next version came out you either upgraded or didn't end of story.

As programs became more complex and we actually began to use more of the growing set of features. We found bugs and software companies began to supply patches. If I recall correctly (IIRC) most patches where actually a whole new install that you didn't have to pay for... well maybe a small fee for the media (5 1/4 inch floppies) and shipping.

Most people and companies didn't bother installing patches unless they experienced an error that required the patch to be resolved.

Time and the world moved on and before we knew it people actually started to break into computers. A whole new breed of patches. Security patches.

As the "dark side" evolved their techniques patch management went from an anomaly, to a necessity, to the current arms race.

• Vulnerabilities (http://www.answers.com/main/ntquery?s=vulnerability&gwp=13) are announced.

• Exploits (http://www.answers.com/topic/zero-day-exploit) are found in the wild, or sold on "underground" auctions.

Patch warfare has become a reality. Companies must balance between breaking business applications and vulnerable systems. Leaving systems unpatched is simply not an option anymore Windows Survival Time (http://www.dshield.org/survivaltime.html) tracks the length of time unpatched systems avoid infection by malware, and for Windows the "sweet spot" tends to be 40-60 minutes once connected.

The there is a paper Windows XP: Surviving the First Day (http://www.sans.org/reading_room/whitepapers/windows/1298.php) that has advice on how to patch a new system prior to connecting it to the world, and no it is doubtful the system will survive long enough to finish the windows on-line patch process before it is infected. I personally have had luck with this DIY Service Pack: Installing Windows updates without an internet connection (http://www.heise-security.co.uk/articles/80682/0) for updating new systems and ones that are missing patches.

Why is Windows Insecure?

Consider the following quote for a minute:

Securing an environment of Windows platforms from abuse - external or internal - is akin to trying to install sprinklers in a fireworks factory where smoking on the job is permitted.
— Gene Spafford (in e-mail to organizers of a workshop on insider misuse)

I' say reactions for this statement cove the whole range. From "Them's fight'in words" to laughter to agreement.

The fact of the matter is that Windows was born at a different time. To a proud papa that wanted the whole world to love his offspring. Windows was taught to be polite and play with others. Even if Windows had to play dumb so that they could understand it.

Now back to reality. Windows was designed to be backwards compatible, who wants to buy something that breaks everything else, and easy to setup and use. Ever break out of the password prompt on a Windows 9X machine and do what ever you want. How about break out of an kill the password protected screen saver on the same machine? Both these where trivial exploits that only required physical access.

Windows Vista is the first attempt to drop the legacy weakness and create a secure operating system from the start Microsoft.

I consider XP Service Pack 2 to be Microsoft's first real attempt to secure any Windows version, and XP is still the most exploited abused operating system know to man.

XP Service Pack 2 was a step in the right direction. The jury is still out on Vista, although it may shape up into a hanging jury. ;-)

Light at the End of the Tunnel?

...or do I hear a train coming?

Microsoft has announced (http://www.microsoft.com/technet/security/bulletin/advance.mspx) that there will be no Black Tuesday (no security patches) this month. Have we finally turned the tide? I think not.

SANS Internet Storm Center keeps a list of knows security vulnerabilities that are not patched "The missing Microsoft patches." (http://isc.sans.org/diary.html?storyid=1940&dshield=5dcab42dbdd98865096b12b60165295c) So if it was a light month why not catch up on unpatched vulnerabilities before another one becomes critical?

In my opinion Microsoft is giving battered IT workers a break due to their Daylight Savings Time (DST) patch requirements. The new US DST starts this weekend (three weeks earlier than previously).

The real problem is the herculean tasks required to up grade all but the latest Microsoft products (Windows XP, 2003 Server and Exchange 2007). As an example Windows 2000 requires manual registry settings, but that is not as bad as Exchange.

For any version prior to Exchange 2007, and how many ran out and updated to that yet? Microsoft supplies utilities that must be run against every Exchange users mailbox. Now these utilities are resource intensive and have been causing total outages on Exchange while running the utility at worst, and apparently intermittent outages on some servers.

While I don't claim to have insider information on all the companies running Exchange what I have seen and heard all point to companies scrambling this week to be prepared for the time change.

You might think shame on the companies for waiting for the last minute, but on the other hand think about:

• Lean and mean IT departments
• Microsoft must be coming out with a less painful method...

Right now I don't know if I condone or condemn Microsoft's actions, But I do think in a perfect world a better course of action would have been to delay Black Tuesday by a week.

Black Tuesday, Wednesday, Thursday, etc.

MS Patching

Officially called Patch Tuesday is the second Tuesday of the month, and is the date that Microsoft released their patches for the month.

Many users, and small companies, have set their computer to automatically update. These computers will daily check for updates, and apply them as they are releases. Or not...

It appears that the shear volume of computers attempting to check for updates causes timeouts. Which, again apparently, the computer treats as there are no updates available.

Same Bat Time, Same Bat Place...

MS automated updates all default to the same time, and most people never change the defaults. So each time zone pounds on the MS update servers , basically, in unison.

The Consequences

This is understandable from a programming perspective, but this results in large numbers of computers set for automatic updates vulnerable after Patch Tuesday.

Wherever I find this issue I automatically manually run updates, and I have found this issue 3 and 4 days after Patch Tuesday.

Its the second Wednesday of the month do you know where your computer's patches are...

The Register on Vista Security

The Register has a good blow-by-blow article on Vista Security (http://www.theregister.co.uk/2007/02/20/vista_security_oversold/). As you would hope for it covers the good, the bad and the ugly. This is true despite an inflammatory remark, especial if taken out of context as it is here:

In a nutshell, Windows is single-handedly responsible for turning the internet into the toxic shithole of malware that it is today.

I explains IE7s sandbox techniques and then shows,what I will term bugs, where it violates the sandboxed environment.

There is of course the touted User Account Control (UAC) which is a good concept... gone bad.

The quote below gives a good description:

And there's the catch: "Windows needs your permission to install this cleverly-disguised Trojan nifty program. Click Yes to get rooted continue."

I have more details in a previous post near the end "The ultimate Vista malware is... Setup.exe" (http://sec-soapbox.blogspot.com/2007/02/6-million-dollar-os-or-new-prey-in-town.html)

Then there is "Data hygiene:"

Finally, it's fixed.

Oh wait; it's not fixed. In fact, things just got a lot worse.

...

The worst part of this is that by offering the option to disable the list of recent files, MS has given users a false sense of privacy and security. The reality is that privacy and data hygiene are even more difficult than before. What a blunder.

The summary of the summary

So, what have we got here... We have got... a slightly more secure version than XP SP2... good features... good ideas... implemented badly.

How to Find Bad Apps

Every month Windows or Microsoft Update will download patches and fixed to your computer, but what about all the other non-Microsoft software?

To check on upgrades for popular and multimedia software simply use the Secunia Software Inspector(http://secunia.com/software_inspector/).