Spyware, viruses, & security forum: NEWS - January 03, 2013

The Ruby on Rails developers are warning of an SQL injection vulnerability that affects all current versions of the web framework. New releases of Ruby on Rails - 3.2.10, 3.1.9 and 3.0.18 - are now available. It is recommended that all users update immediately. For users unable to update, there are patches available for supported versions 3.2 and 3.1 and older versions 3.0 and 2.3.

The problem, according to the advisory, is that, because of the way dynamic finders in ActiveRecord extract options from method parameters, a method parameter can be used as a scope and by carefully manipulating that scope, users can inject arbitrary SQL. Dynamic finders use the method name to determine what field to search, so calls such as:

Post.find_by_id(params[:id])

would be vulnerable to an attack. The original problem was disclosed on the Phenoelit blog in late December where the author applied the technique to extract user credentials from a Ruby on Rails system, circumventing the authlogic authentication framework.

http://www.h-online.com/security/news/item/SQL-injection-vulnerability-hits-all-Ruby-on-Rails-versions-1776203.html

Also:
SQL Injection Flaw Haunts All Ruby on Rails Versions
Ruby on Rails security updates address SQL injection flaw
All Ruby on Rails versions affected by SQL injection flaw

See Vulnerabilities & Fixes: Ruby on Rails Method Parameters SQL Injection Vulnerability

The operators of Chinese warez portals have found a sly way of offering pirated iOS apps for Apple devices that haven't been jailbroken. iOS normally only launches apps that have been approved and signed by Apple. Most signed apps originate from the App Store and have been permanently associated with a purchaser's Apple account using Apple's FairPlay DRM system. If the DRM protection is removed, the app's signature becomes invalid; for such a program to start, the signature check must be disabled by jailbreaking the device.

The operators of the illegal download portals appear to have chosen a bolder approach. They don't remove the DRM in the first place. Heise Security, The H's German associates, downloaded a number of test apps and found the original app buyers' plain-text names. The programs still seemed to be linked to their accounts. iOS does allow users to install apps that weren't bought via the Apple account that is associated with the device, but to do so, it is usually necessary to log in with the appropriate account.

Continued : http://www.h-online.com/security/news/item/Pirated-iOS-apps-without-jailbreaking-1776354.htm

The hacktivist group Izz ad-Din al-Qassam Cyber Fighters claims that its second phase of distributed-denial-of-service attacks has affected nine banks since Dec. 11, and it warns that more attacks are on the way.

"Rulers and officials of American banks must expect our massive attacks! From now on, none of the U.S. banks will be safe from our attacks," the hacktivists write in a Jan. 1 post on Pastebin.

The group says its DDoS strikes waged since the kickoff of its second campaign in early December have targeted JPMorgan Chase, Bank of America, Citigroup, Wells Fargo, U.S. Bancorp, PNC Financial Services Group, BB&T Corp., Suntrust Banks and Regions Financial Corp. (see 5 Banks Targeted for New DDoS Attacks.)

The group claims its attacks against U.S. banks will continue until a YouTube video deemed offensive to Muslims is removed.

December Attacks

On a Dec. 10 post, Izz ad-Din al-Qassam Cyber Fighters announced plans for its second campaign, targeting PNC, U.S. Bank, BofA, Chase and SunTrust. Since then, the group has posted two subsequent threats and, as indicated in its Jan. 1 post, has apparently hit a total of nine banks.

Continued : http://www.bankinfosecurity.com/ddos-hacktivists-no-us-bank-safe-a-5401