Google Open Sources Fuzzing Platform

Google announced this week that it has open sourced ClusterFuzz, the fuzzing infrastructure it built to help finding memory corruption bugs in Chrome.

The platform runs on over 25,000 cores and for two years has been available as a free service to open source projects through the OSS-Fuzz service.

An automated method for detecting bugs in software, fuzzing is effective only if continuous, done at scale, and integrated into the development process of a software project, and ClusterFuzz has been created specifically for that, Google says.

Created more than 8 years ago, ClusterFuzz provides end-to-end automation, including bug detection, deduplication, bisection, reporting, and closure of bug reports.

To date, the platform has found over 16,000 vulnerabilities in Chrome and more than 11,000 vulnerabilities across more than 160 open source projects integrated with OSS-Fuzz. With ClusterFuzz, bugs can be detected within hours after being introduced and the fix verified within a day, Google says.

Now available on GitHub, ClusterFuzz is highly scalable, provides accurate deduplication of crashes, testcase minimization, regression finding through bisection, and statistics for analyzing fuzzer performance and crash rates.

It also has an easy-to-use web interface for management and viewing crashes, and provides support for coverage guided fuzzing (e.g. libFuzzer and AFL) and blackbox fuzzing.

ClusterFuzz can be deployed locally on a compute cluster, although production use is reliant on some key Google Cloud Platform services.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/BwLwaes6QVQ/google-open-sources-fuzzing-platform

Google Spots Attacks Exploiting iOS Zero-Day Flaws

Google security researchers revealed that two of the vulnerabilities patched by Apple on Thursday with the release of iOS 12.1.4 were zero-day flaws exploited in the wild by malicious actors.

iOS 12.1.4 resolves a total of four vulnerabilities. Two are related to the recently discovered FaceTime spying bug, and the other two are memory corruption issues that allow a malicious application to elevate privileges and execute arbitrary code.

One of the flaws, tracked as CVE-2019-7286, impacts the Foundation component in iOS and it allows a malicious application to gain elevated privileges. The second vulnerability, identified as CVE-2019-7287, impacts IOKit and it can be exploited by a malicious app to execute arbitrary code with kernel privileges.

Apple has credited Clement Lecigne of Google Threat Analysis Group, along with Ian Beer and Samuel Groß of Google Project Zero for reporting these issues. An anonymous researcher has also been credited by the tech giant.

Project Zero Team Lead Ben Hawkes revealed on Twitter that both CVE-2019-7286 and CVE-2019-7287 have been exploited in the wild, but no details have been shared about the vulnerabilities or the attacks.

Tweet from Google Project Zero researcher Tavis Ormandy

It’s worth noting that CVE-2019-7286 has also been patched in macOS Mojave with the release of a supplemental update for version 10.14.3, which also resolves the Facetime-related issues.

While it may seem that iOS and macOS vulnerabilities are rarely exploited in attacks, some experts warn that it’s actually not that uncommon.

Zimperium's Adam Donenfeld warns of attacks exploiting Apple flaws

Apple has also released an update for Shortcuts for iOS to address a local information disclosure flaw and a sandbox bypass issue.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/gbOYw1mtriQ/google-spots-attacks-exploiting-ios-zero-day-flaws

Apple Patches FaceTime Spying Vulnerability

Apple has finally released an iOS update that should fully patch the Group FaceTime vulnerability that could have been exploited to spy on users through their device’s microphone and camera.

Apple described the flaw, tracked as CVE-2019-6223, as a logic issue in the handling of Group FaceTime calls. The company says the problem has been addressed with “improved state management.”

The bug allowed an attacker to spy on FaceTime users by calling the targeted user and adding the attacker’s own number to a group chat. While the hacker could hear and possibly even see the victim, on the victim’s side it appeared as if the call still hadn’t been answered.

Interestingly, Apple has credited both Grant Thompson, a 14-year-old from Arizona, and Daven Morris, or Arlington, Texas, for reporting the vulnerability.

Apple patches FaceTime vulnerability Thompson and his mother attempted to report the findings to Apple more than 10 days before details of the bug became public, but their attempts were ignored by the tech giant. Apple admitted that it dropped the ball in this case and promised to improve its vulnerability reporting process. It has also promised to pay Thompson a bug bounty, but it’s unclear if Morris will receive a bounty as well.

Apple disabled the Group FaceTime feature after learning of the flaw’s existence. It then implemented a server-side fix and now it has released updates for both iOS and macOS Mojave to fully address the issue. The Group FaceTime service has now been restored.

The iOS update (version 12.1.4) also patches two privilege escalation and code execution vulnerabilities that Google says have been exploited in the wild. One of these flaws has also been resolved in macOS Mojave.

While investigating the FaceTime bug, Apple also discovered an issue related to the Live Photos feature in FaceTime. The flaw, tracked as CVE-2019-7288, has been patched through “improved validation on the FaceTime server.”

The FaceTime bug has caused a lot of problems for Apple. A lawyer from Texas has filed a lawsuit against the company, claiming that the vulnerability was exploited to record a client’s private deposition.

Authorities in New York have launched an investigation into Apple’s slow response, and two lawmakers demand that the company be more transparent about how it handled this incident.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/98itIUHCQGA/apple-patches-facetime-spying-vulnerability

Apple pushes fix for “FacePalm,” possibly its creepiest vulnerability ever

Apple has patched one of its creepiest vulnerabilities ever—a flaw in its FaceTime messenger app that made it possible for people to eavesdrop on audio and video captured by iPhones and Macs.

The bug in Group FaceTime, a feature that allows conference-call-style chats, made it trivial for someone to eavesdrop on someone else simply by initiating a FaceTime call, swiping up and choosing “add person,” and entering their own number to add themselves as a participant in a Group FaceTime call. While people on the receiving end would see a call was coming through, they would have no idea that the person trying to connect could already hear nearby audio and, in many cases, see video.

Two other potentially serious iOS security bugs Apple fixed Thursday have been under active attack in the wild, security researchers with Google’s Project Zero said. One bug indexed as CVE-2019-7287, is a memory corruption flaw in the IOKit. Apple said it may allow apps to execute arbitrary code with kernel privileges. Another memory corruption bug in Foundation, CVE-2019-7286 may allow an application to gain elevated privileges.

The in-the-wild exploits could be severe because based on Apple’s vulnerability description, they fundamentally subvert Apple’s security model, which prevents apps from accessing other apps and from interacting with the security of iOS itself. A Google spokesman declined to provide details about the attacks. An Apple representatives also declined comment.

Apple security under the microscope

Privacy advocates and ordinary users were shocked when details of the eavesdropping vulnerability first broke 10 days ago. When it emerged that the bug was discovered by a 14-year-old and that Apple had failed to act following multiple emails sent by the teen’s mother, people demanded answers. Since then, New York Attorney General Letitia James has launched a probe into the incident, according to Reuters. Some critics now refer to the bug as FacePalm.

On Thursday, Apple issued iOS and macOS updates here and here that fix the bug.

“A logic issue existed in the handling of Group FaceTime calls,” the advisories stated. “The issue was addressed with improved state management.”

Apple introduced Group FaceTime last year after some unexplained delays. Critics said the FacePalm vulnerability is evidence the new feature wasn’t adequately tested prior to going live. The inability of the teenager’s mother to reach someone at Apple who could grasp the seriousness of her son’s discovery has opened Apple’s security and quality assurance process to even more criticism.

Earlier this week, Apple security came under scrutiny again when an 18-year-old named Linus Henze posted a video discussing what he said was a weakness in macOS that needlessly exposes passwords stored in the keychain to malicious apps. While Henze didn’t provide many details, he compared the weakness to a similar one disclosed in 2017 by former National Security Agency hacker Patrick Wardle.

[embedded content]

KeySteal – Stealing your keychain passwords on macOS Mojave.

While potentially serious, both keychain vulnerabilities can or could be exploited only after malicious software is already installed on a machine. This, in itself, is a high burden for most attackers. Apple fixed the vulnerability Wardle reported, but it’s not clear if the newer vulnerability will ever be fixed. So far, Henze has declined to provide technical details to Apple, a move the teen says is intended to protest the company not having a bug-bounty program that covers macOS.

Update now

Once word of the FacePalm vulnerability became public, Apple disabled Group FaceTime on its servers. The move likely prevented anyone from further eavesdropping on unwitting users. Still, out of an abundance of caution, iOS and MacOS users should install the updates as soon as practical.

Updates are by default installed automatically but often not right away. Those who want to do so on iOS can choose Settings > General > Software Update and then choose Download and Install. To manually install a macOS update, choose System Preferences > Software Update > and Download.

Post updated to add details about in-the-wild exploits.

https://arstechnica.com/?p=1453011

Zero-day Vulnerability Highlights the Responsible Disclosure Dilemma

A zero-day vulnerability found in a video-conferencing system and responsibly disclosed led to the response, “Our developers are aware of some known vulnerabilities with the systems, development for these devices has slowed significantly as they are End of Life. For devices that are still under support, we may target future releases.”

This left the vulnerability finder — Trustwave SpiderLabs’ researcher Simon Kenin — with a quandary: make public the vulnerability so that users would be aware of the threat and attackers might use it, or just sit on it. Shodan shows there are 372 Lifesize devices in universities around the world. The Lifesize website claims, “Tens of thousands of organizations around the world use Lifesize.”

The vulnerability, amounting to multiple command injection flaws, is trivial to exploit and was found in all versions of four Lifesize products: Team, Room, Passport and Networker. It requires access to the firmware, which can only be obtained with a valid serial number. However, with that serial number, an attacker can obtain the firmware. The attack requires access to the Lifesize support function, but the device comes with a default support account.

The Lifesize problem is nothing more than a lack of sanitization: user provided input is passed direct to the PHP shell_exec function, which executes system commands as the webserver user. The value to the attacker is limited, but nevertheless gets him a foothold on the server.

However, by combining this new command injection vulnerability with a separate — and also unfixed — privilege escalation bug, Kenin blogged he “could achieve root privileges on the Lifesize product’s system and have full persistence on the device and its underlying corporate network.” He wrote a full python PoC exploit and provided it with his disclosure to Lifesize in November 2018.

He had no reply from Lifesize. In January 2019 he tried again — and this is when he was told there would be no fix. “It is always a dilemma when you go public with an advisory after a responsible disclosure process that does not result in a fix,” he wrote. “On one hand, I could simply trash my work on this research and keep attention off of it… But,” he added, “for all we know, a malicious attacker could already have in their possession the same knowledge that I do and may be actively using this exploit to infiltrate corporate networks.”

With no sign of a patch, he decided he would have to go to full disclosure — but this story has a happy ending. The day before he was due to publish his findings, Lifesize issued a statement: “We encourage all customers using Lifesize 220 Series systems to contact Lifesize support for a hotfix. Our support teams can be reached by telephone, email or by opening a support ticket.”

Kenin decided to publish his findings (Advisory TWSL2019-001), but withhold publishing the exploit for two weeks (it will be appended to the advisory).

“We will hold the PoC for two weeks until Thursday, February 21st in order to give users a chance to apply the hotfix,” wrote Kenin. “At that time we will release the PoC code to provide users, administrators and network security professionals with the technical details and tools to validate whether they are still vulnerable. This PoC will be added directly to the advisory.”

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/RZUmjTqqAQs/zero-day-vulnerability-highlights-responsible-disclosure-dilemma

Critical Flaws Allow Hackers to Take Control of Kunbus Industrial Gateway

Several serious vulnerabilities have been identified in a gateway made by Kunbus, including flaws that can be exploited to take complete control of a device.

Germany-based Kunbus offers connectivity solutions for industrial networks. The company’s gateway products, which are used by various types of organizations around the world, are designed to provide continuous and reliable communications between different networks and systems.

Vulnerabilities in Kunbus gateway Nicolas Merle, a researcher with industrial cybersecurity firm Applied Risk, discovered that Kunbus’ PR100088 Modbus gateway is affected by a total of five flaws. The issues impact devices running version 1.0.10232 of the software – and likely earlier versions as well – and most of them have been resolved by the vendor with the release of version 1.1.13166 (Security Update R02).

Of the five vulnerabilities, Applied Risk has classified two as “critical” and two as “high severity.”

One of the critical flaws is related to the fact that the gateway’s web application fails to verify that the user is logged in when the password is changed. If an administrator accesses the web interface at some point and the device has not been restarted, an unauthenticated attacker can go to the password changing page and set their own password, even if the legitimate admin is no longer logged in.

The flaw, tracked as CVE-2019-6527, allows malicious actors to take complete control of the device and lock legitimate admins out, Applied Risk says.

Learn More About ICS Flaws at SecurityWeek’s 2019 ICS Cyber Security Conference

Another critical vulnerability, identified as CVE-2019-6533, can be exploited to read and modify the registers used to store Modbus values. This can be done without authentication and it can allow an attacker to cause a denial-of-service (DoS) condition by rebooting the device.

Merle also discovered that when a user authenticates, an HTTP GET request containing their password in clear text is sent to the device. This enables an attacker who can intercept traffic to easily obtain the password.

The researcher also found that an attacker can launch a DoS attack against a device by sending a long request (with a length greater than 256 characters) to the FTP service.

Also related to FTP, the service can be used to retrieve user credentials stored on the device in clear text in an XML file.

The software update released by Kunbus should patch all of these vulnerabilities, except for the last issue, which the vendor expects to fix with Security Update R03 in late February.

In addition to releasing patches, Kunbus recommends that users ensure the devices are used in protected industrial networks, as intended, rather than on public networks.

Advisories describing these vulnerabilities have been published by Applied Risk, ICS-CERT and Kunbus.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/rAUgEUK4V1k/critical-flaws-allow-hackers-take-control-kunbus-industrial-gateway

LibreOffice and Apache OpenOffice vulnerable to same bug; only one is fixed

LibreOffice, an open source clone of Microsoft Office, has patched a bug that allowed attackers to execute commands of their choosing on vulnerable computers. A similar flaw in Apache OpenOffice remains unfixed.

Austrian researcher Alex Inführ publicly reported the vulnerability on Friday, shortly after it was fixed in LibreOffice. His disclosure included a proof-of-concept exploit that successfully executed commands on computers running what was then a fully patched version of LibreOffice. The only interaction that was required was that the target user hover over an invisible link with a mouse. On Wednesday, researcher John Lambert provided additional PoC samples.

The chief vulnerability exploited is a path traversal that allowed the attack code to move out of its current directory and into one that contained a sample Python script that LibreOffice installed by default. That allowed Inführ to invoke the cmd command on the vulnerable computer. The researcher then exploited a separate weakness that allowed him to pass parameters of his choice to the command.

Here’s a video of his proof-of-concept in action.

[embedded content]

LibreOffice ODT PoC

Inführ chose to open the computer’s calculator, but a malicious attacker could have picked more nefarious things.

The researcher privately reported the vulnerability to LibreOffice developers, and they fixed it in versions 6.1.4.2 and 6.0.7.

The same path-traversal vulnerability remained unpatched in Apache OpenOffice at the time this post went live. In fairness, Inführ’s PoC exploit didn’t work against Apache OpenOffice, because it was unable to pass malicious parameters. It’s not clear yet if there might be other ways to use the traversal flaw to execute malicious code. Neither Inführ nor Apache OpenOffice developers responded to emails seeking comment for this post.

Attackers have been exploiting code-execution vulnerabilities in Microsoft Office for more than a decade. Inführ’s work demonstrates that open source clones aren’t likely to be much less susceptible to determined hackers. Malwarebytes has more about the vulnerabilities here.

https://arstechnica.com/?p=1452457

macOS Mojave Zero-Day Allows Theft of Keychain Passwords

A researcher has disclosed the existence of a zero-day vulnerability in macOS Mojave that can be exploited by malware to steal plaintext passwords from the operating system’s Keychain. The flaw has not been reported to Apple, but its details have not been made public.

Germany-based Linus Henze has published a video showing how a malicious application installed on a system running the latest release of Apple’s macOS Mojave operating system (10.14.3) can extract passwords from the local Keychain password management system.

According to Henze, the malicious app and the user account on which it is running don’t require admin privileges for the attack to work. However, passwords can only be obtained from that user’s Keychain – other Keychains are likely inaccessible due to the fact that they are typically locked and the attack only works against unlocked Keychains.

The researcher says he has not reported his findings to Apple due to the lack of a bug bounty program for macOS. Apple does have a bug bounty program, with rewards of up to $200,000, but it only covers hardware, iCloud and iOS hacks.

Henze says he has been contacted by Apple’s product security team after publishing the video, but he claims he will not share full details of the attack with the tech giant without a bounty.

While the details of the vulnerability have not been made public to prevent abuse, researcher Patrick Wardle, who in 2017 discovered a similar vulnerability in macOS High Sierra, has confirmed for Forbes that the vulnerability found by Henze exists and the exploit works.

Henze claims the vulnerability impacts macOS Mojave and earlier versions. A video published by the researcher shows his proof-of-concept (PoC) tool in action:

[embedded content]

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/XEcLGMaa4tU/macos-mojave-zero-day-allows-theft-keychain-passwords

Check-in Links Sent by Several Airlines Expose Passenger Data

The check-in links sent to customers by several major airlines from around the world can allow hackers to obtain passengers’ personal information and possibly make changes to their booking, mobile security firm Wandera warned on Wednesday.

Members of Wandera’s threat research team noticed in December that the links sent by Air France to customers through the company’s e-ticketing system are not protected by any type of encryption. These links are typically sent by companies via email or SMS and they are used to initiate the check-in process.

Further analysis revealed that similarly unprotected links were sent out by other major airlines as well, including Southwest in the US, KLM and Transavia in the Netherlands, Vueling and Air Europe in Spain, Jetstar in Australia, and Thomas Cook in the UK.

The problem is that the check-in links sent by these airlines to their customers initiate a connection over HTTP instead of HTTPS.

The link itself, as Wandera VP of Product Michael Covington told SecurityWeek, includes a record locator, the origin of the flight and its destination, and, in some cases, the passenger’s name. Airlines use this data to identify each passenger and provide access to details of their reservation.

Airlines send unencrypted check-in links

An attacker who can intercept a user’s traffic – for example, by compromising a public Wi-Fi connection – can leverage these credentials to gain access to the targeted user’s online check-in page.

Depending on the airline, the check-in service can provide access to data such as email address, name, gender, passport information, nationality, phone number, partial payment card information, booking reference, flight details (flight number, seating data), and even the complete boarding pass. In some cases, the attacker could also make changes to the data provided by the legitimate user.

“Boarding procedures vary from airport to airport and can be more or less secure. The most concerning aspect of this vulnerability is that in some cases a hacker or criminal can print a victim’s boarding pass and could even attempt to board a scheduled flight,” Wandera researchers explained.

The security firm pointed to a recent news report claiming that a man traveling from the UK to Poland boarded the wrong airplane and ended up in Malta. The incident raised concerns about boarding pass screening as the man had a ticket for Poland.

Wandera believes airlines should encrypt communications during the check-in process, they should implement additional authentication mechanisms for processes that involve access to personal information (especially if that information can be edited), and use one-time tokens for direct links delivered via email or SMS.

SecurityWeek has asked Wandera if it’s possible that a single e-ticketing platform is used by all the impacted airlines, but the security firm believes the weakness is not introduced by a single platform.

“Based on my assessment of the data and conversations I’ve had with the airlines, I’m fairly confident that this vulnerability impacts more than one platform,” Covington explained. “While a subset of the airlines may use a common platform, there are sufficient variations in how these systems communicate that I believe there to be several e-ticketing systems involved.”

“I suspect this boils down to an industry-wide decision to make online check-in easy; they’ve essentially prioritized usability over security. The entire problem goes away if they simply made the e-mail/SMS links one-time use,” he added.

Wandera notified each of the impacted airlines in December 2018 and January 2019, and said it had also shared its findings with government agencies in charge of airport security.

“Some have responded and indicated that they are investigating the issue,” Covington told SecurityWeek. “Unfortunately, we have not been able to verify that any fixes have been implemented. Our researchers have confirmed that some of the e-ticketing systems are still exposing data, so the problem has not been resolved.”

Other researchers revealed recently that a vulnerability affecting a reservation system provided by Spain-based Amadeus, which is used by hundreds of airlines worldwide, could have exposed the details of millions of passengers.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/EoTE4p17xps/check-links-sent-several-airlines-expose-passenger-data

RDP Servers Can Hack Client Devices: Researchers

More than two dozen vulnerabilities have been discovered by security experts in popular implementations of the remote desktop protocol (RDP), including flaws that allow a malicious RDP server to hack a device running the client RDP software.

RDP allows users to remotely connect to other devices on the network. The protocol was originally developed by Microsoft for Windows, but there are also several open source implementations that can be used on Linux and Unix systems.

The FBI warned recently that attacks involving RDP have been on the rise in the past couple of years, fueled by RDP access sold on the dark web.

Researchers at Check Point Software Technologies have conducted a detailed analysis of FreeRDP, rdesktop, and the Remote Desktop Connection software shipped with Windows. They have identified a total of 25 security holes, including 16 that have been described as “major.”

A manual code audit of the open source rdesktop tool led to the discovery of 19 vulnerabilities (mostly heap-based buffer overflows), including 11 with a major impact. Some of these flaws can be exploited by an attacker controlling an RDP server to remotely execute code on an RDP client connecting to it.

FreeRDP was found to be more secure and researchers have only discovered six flaws, five of which have major impact. Similar to rdesktop, FreeRDP has vulnerabilities that allow a malicious RDP server to execute arbitrary code on a client.

In the case of Microsoft’s RDP software, Check Point experts say it’s much better built and far more secure. However, they did find a weakness related to the fact that the client and the server share clipboard data – this feature is enabled by default.

If a client connects to a malicious RDP server and the user copies any file, the attacker can paste their own files – in addition to the files copied by the user – to an arbitrary location on the client device. For example, an attacker can drop a malicious file into the Windows “Startup” folder so that it would get executed every time the system is booted.

The types of attacks demonstrated by Check Point can be highly useful to malicious actors. For instance, an attacker can escalate privileges and gain further access to the network if a member of the targeted organization’s IT team connects to an RDP server they control. Hackers could also leverage these methods against security researchers.

“[The method can be used for] attacking a malware researcher that connects to a remote sandboxed virtual machine that contains a tested malware. This allows the malware to escape the sandbox and infiltrate the corporate network,” Check Point explained.

The company reported its findings to the developers of the impacted RDP tools in October 2018. FreeRDP developers pushed a patch to their GitHub repository less than a month after being notified. Rdesktop developers rolled out a fix in mid-January.

As for Microsoft, the tech giant confirmed the researchers’ findings, but decided not to release a patch or assign a CVE identifier, claiming that the issue “does not meet our bar for servicing.” Nevertheless, there is a way for users to protect themselves against the attacks described by Check Point: disable the clipboard sharing feature.

“Although the code quality of the different clients varies, as can be seen by the distribution of the vulnerabilities we found, we argue that the remote desktop protocol is complicated, and is prone to vulnerabilities. As we demonstrated in our PoCs for both Microsoft’s client and one of the open-sourced clients, a malicious RDP server can leverage the vulnerabilities in the RDP clients to achieve remote code execution over the client’s computer,” the security firm concluded.

Check Point has published a blog post describing its findings, along with a video showing how the clipboard attack works:

[embedded content]

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/bJKo9ls5gqw/rdp-servers-can-hack-client-devices-researchers