Just when you thought it was safe again
December 16, 2008
Forget about it. Events like this and other zero days will forever put data at Risk. Of course Im talking about the new 0-day vulnerability that promises to pwn systems the world over, unless you use another browser such as the excellent Firefox and wind up getting pwned by some other exploit. These are called drive-bys but don’t leave your physical body red and bloody, just your bank account and identity and you sense of personal well being and place in this world. At least there are some that can rapidly respond with intelligence and sympathy. Im speaking about the excellent analysis that is available from the researchers at Websense and other organizations who consistently provide the detail for enlightened understanding.
Here is what they have come up with… on …DruUUUm roll please… The IE7 0-day! It exploits a library function in IE to exploit XML functionality with a ofuscated Javascript delivered by still more SQL injection attacks. The actual shell code is pretty awesome and can pwn Vista as well due to the evolution of exploits utilizing HeapSpray techniques instead of typical and rapidly becoming exinct buffer overflows via the stack. From this point it can deliver to a host system any manner of malware as seen here and here.
Heh, I just confirmed that one of our clients got exploited on the 11th/12th which means that its pretty prevalent. That was like 4 days ago!
Milw0rm already has posted the Exploit code POC so its only a matter of time till mass chaos. At this point Microsoft doesnt have a patch yet. And Metasploit has already added a universal exploit for it in the excellent engine of mass destruction.
On another note, peeps should be using the Microsoft Malicous Software Removal Tool (MSRT) as it removes a ton of malware from their systems monthly. You can read up on the malware it removes here which gives pretty good descriptions of the nastiness out there today.
Inject mah data with special sauce
August 8, 2008
So a primary attack vector these days is seeding legitimate websites with links to malicous websites that exploit browsers and drop malware to users. This attack vector is called SQL injection which is a take off of the ages old technique of exploiting systems that do not sanitize and validate user input.. Sound Familar? It basically inserts SQL language code into websites with database backends and makes modifications to the website content. Think modification of every single page on the site to host an invisible obfuscated Javascript with an Iframe in it.
In a YA(for fun and profit paper) the guys at Gothan Digital Science present a good rollup on these issues and what you can do with them. NGSsoftware also has great stuff and tools for these problems.
