Spyware, viruses, & security forum: NEWS - June 11, 2012

Exploits for a recently revealed MySQL authentication bypass flaw are now in the wild, partly because the flaw is remarkably simple to exploit in order to gain root access to the database. The only mitigating factor appears to be that it depends on the C library that the MySQL database was built with. The bypass, assigned the vulnerability ID CVE-2012-2122, allows an attacker to gain root access by repeatedly trying to login with an incorrect password. Each attempt has a 1 in 256 chance of being given access. The exploits are mostly variations of looping through connecting to MySQL with a bad password around 300 to 512 times.

The vulnerability, which was detailed in a posting by MariaDB security coordinator Sergei Golubchik, is due to a casting error when checking the results of comparing (with the memcmp function) the password given and the expected password. "Basically account password protection is as good as nonexistent", says Golubchik, adding "Any client will do, there's no need for a special libmysqlclient library". Vulnerable versions of MySQL and MariaDB are those compiled with libraries that return integers outside the -128 to 127 range for memcmp. According to Golubchik the gcc built in memcmp and BSD libc memcmp are safe, but the linux glibc sse-optimised memcmp is not safe.

Continued : http://www.h-online.com/security/news/item/Simple-authentication-bypass-for-MySQL-root-revealed-1614990.html

Also:
Trivial Password Flaw Leaves MySQL Databases Exposed
MySQL flaw allows attackers to easily connect to server
Exploit Available for Trivial MySQL Password Bypass
Flaw in MySQL Allows Attackers to Connect to Server with Incorrect Passwords

See Vulnerabilities / Fixes:
MySQL User Login Security Bypass and Unspecified Vulnerability
MariaDB User Login Security Bypass Security Issue

From SANS ISC:

Published: 2012-06-11,
Last Updated: 2012-06-11 13:11:21 UTC
by Johannes Ullrich (Version: 1)

One of the important features of last weeks Microsoft certificate patch was that the bad certificate was apparently used to subvert the Windows update process. The complex Windows update architecture represents a huge target to any attacker, and it has held up quite well so far. I do not expect any issues related to the lost certificate this week. However, this would be the last chance for the attacker to use these certificates, and it is a good opportunity to talk about patch security on the day before "black tuesday".

I do recommend that you apply the certificate patch released a week ago today if you haven't done so already. This way, no patch signed by the bad certificate should be accepted tomorrow. Patch tuesday is one of the best dates to launch such an attack as you do expect patches anyway. Don't forget the WSUS patch: http://support.microsoft.com/kb/2720211

A couple of rules to harden your patch process:

• Avoid patches while "on the road". Apply them in your home / work network whenever possible. This doesn't eliminate the chance of a "Man in the Middle" (MitM) attack, but it reduces the likelihood. If you are on the road for extended periods of time, use a VPN connection. In particular hotel networks and public hotspots frequently use badly configured HTTP proxies that can be compromised and many users expect bad SSL certificates (because of ongoing MitM attacks... ironic, but well, sadly true) in these environments.

• Always validate patches. For Microsoft, this means using Microsoft update which will validate the digital signature applied to patches. Tthe bad certificate broke this process. But it is still a very difficult hurdle to overcome for an attacker.

Continued : http://isc.sans.edu/diary.html?storyid=13429

Towards the end of 2011, a Chinese company detected the first rootkit ever that targeted computers' BIOS in order to be able to reinfect computers over and over again, even after the hard drive is physically removed and replaced.

This BIOS rootkit was dubbed Mebromi (or MyBios), and targeted only the users who had Award BIOS (used by motherboards developed by Phoenix Technologies) on their computers.

Still, as it came bundled with a MBR toolkit, a kernel mode rootkit, a PE file infector and a Trojan downloader, users who didn't have those motherboards and that BIOS were still not spared an infection.

Fast forward to the present, and a second BIOS rootkit - dubbed Niwa!mem - has been detected by McAfee. Initially a rootkit that infected the Master Boot Record (MBR), its latest variant became a "BIOSkit".

"The malware overwrites the original MBR in sector 0 and writes the file to be dropped (the downloader) in hidden sectors. The DLL copies itself to the Recycle folder and deletes itself. The downloader is dropped and executed every time the system is started," the researchers explain.

Continued : http://www.net-security.org/malware_news.php?id=2143

.. malware attack

Why should malware authors show any creative flair and imagination? There's no need, after all, if tried and trusted methods of infecting computers still work.

Take, for instance, the widespread malware campaign that has been spammed out across the internet today, posing as an email from DHL. [Screenshot - Malware-infected email claiming to come from DHL]

A typical email has a subject line of "DHL Express Parcel Tracking notification [random code]" or "DHL Express Tracking Notification ID [random code]" or "DHL International Notification for shipment [random code]"

The emails read similar to the following:

Hello Dear,

DHL Express Tracking Notification: Mon, 11 Jun 2012 12:14:55 +0200

Custom Reference: 9057425-HRIEI2E4Q8C
Tracking Number: UT09-2041042911
Pickup Date: Mon, 11 Jun 2012 12:14:55 +0200
Service: AIR/GROUND
Pieces: 2

Mon, 11 Jun 2012 12:14:55 +0200 - Processing complete successfully
PLEASE REFER TO ATTACHED FILE FOR DETAILED INFORMATION.

Shipment status may also be obtained from our Internet site in USA under http: //track.dhl-usa.com or Globally under http: //www.dhl.com/track

Please do not reply to this email. This is an automated application used only for sending proactive notifications

Thanks in advance,
DHL Express International Inc.

Attached to each email is a ZIP file, containing the malware. The attached filename can vary, but takes the form DHL_International_Delivery_Details-[random code].zip

Forklift truck. Image courtesy of ShutterstockSophos products detect the Windows malware as Troj/Agent-WMO.

Continued : http://nakedsecurity.sophos.com/2012/06/11/dhl-international-delivery-email-beware-widespread-malware-attack/