In the wake of all of the stories about the Windows DLL hijacking bug, it appears that certain Linux distributions may be vulnerable to a similar problem related to the way that Linux handles a specific variable in some cases. The bug apparently was introduced via a Debian patch last year.
By Oliver LaveryIt’s been
interesting watching DLL hijacking grow from interesting phenomena to a full-on snowball of hype and FUD over
the last few days. As of this writing Google turns up 152 news articles on the
subject. The vast majority
of coverage is calling this a “new class of attack” and pointing out how “over
30 zero-day vulnerabilities have been found so far!”. The only way to
paraphrase many of the headlines is: “Panic!”
ED: Malcon Conference hopes to bring malware writers out of the shadowsDEK: Malcon, a new, Mumbai-based conference, says that the security community can benefit from what malware authors have to teach. The computer security community is used to vilifying the hackers and malware authors who choose to use their talents for evil, instead of good. Now a new hacking conference is trying to bring malware authors out of the shadows and wondering, in the words of Rodney King, if we “all just can’t get along.” Malcon, a security show scheduled for December in Mumbai, India, is billed as the first of its kind: a “common platform” for the world’s most talented Virus authors, exploit writers and toolkit creators — and the security pros who spend careers trying to thwart or apprhenend them. The conference is the brainchild of Rajshekhar Murthy, a Mumbai-based IT security expert, and head of Information Security at an Indian telecommunications firm. (Murthy asked Threatpost to withold the name of his employer.)In a phone interview with Threatpost, Murthy said the Malcon conference was in the spirit of DEFCON, the now (in)famous hacking conference that is held each year in Las Vegas. Like Defcon, Malcon is intended to raise the level of security awareness within the IT community by fostering more direct interactions between malware authors and the security pros hired to thwart them. “We’re having tremendous problems with malware and cybercrime,” Murtha said. “But we don’t do a good job of detecting malware. We’re too focused on reaction.”Inviting malware authors to the table will give security professionals a better understanding of how malware works and help to engender more proactive defenses, he said. Murthy was careful to say that the conference didn’t condone the creation of malicious programs. “We know there’s a lot of anger – people say that ‘malcoders are bad.’ We agree with that. Those guys are bad. The point is, we can’t ignore them,” he told Threatpost. However, there was no harm in trying to coax malware authors out of the shadows and giving them a forum to contribute what they know to the white hat security community, he argued. Murthy said that any malicious programs or proof of concept code revealed at Malcon would be shared with the security community immediately so that signatures could be created for it. He said he hoped the conference might help to change attitudes in his native India, where even well-intentioned security and vulnerability research has historically been frowned upon. “Software development counts for 80 percent of India’s revenue. But if developers in India aren’t ready for security or create loose or insecure products, its bad for our reputation.” “While Murthy isn’t sure his new show will have the pull to draw top malware authors from North America, China, Russia and Eastern Europe, he hopes it provides a venue for young, talented and curious computer scientists in India. He wouldn’t disclose how many individuals had registered for the Malcon show so far, but said it may take a few years to establish the show. “I hope that, five years down the road, we’ve helped to create a culture of security research.”The issue of legitimizing malicious code authoring has historically been a prickly topic in the IT industry. In 2003, the University of Calgary in Canada got into hot water after it offered a class to students in virus writing. Several anti malware vendors at the time pledged not to hire students who had taken the course. Attitudes have softened since then, as penetration testing and ethical hacking have come to be perceived as important tools in network defense and product design. Still, within the antivirus community, there’s little tolerance for anyone who tries to blur the lines between malware authors and the researchers who analyze their creations. “I think they’re coming from a nieve standpoint,” said Kurt Baumgartner, a senior security researcher at Kaspersky Lab. (Note: Threatpost.com is an online publication of Kaspersky Lab.) “I don’t really expect the Koobface gang to show up and sit around singing kumbaya and cooperating in malcode writing together,” he said. “The profit motivation is really the only motivation for (malware authors) a lot of the time.” The computer security community already has forums for offensive security research, where “responsible” experts from security and anti malware companies share knowledge about attacks and exploits, he said. He also took exception with the comparisons to the DEFCON conference. “It seems like DEFCON is encouraging people to push the envelope, but not to break the law,” Baumgartner said. Malcon, a new hacking conference planned for Mumbai, India, argues that the security community can benefit from what malware authors have to teach. Not everyone is convinced.
With Web based software vulnerabilities on the rise, Google displaces HP on the list of vendors with the most reported software holes in the first half of 2010.software vulnerabilities.
The list of applications known to be vulnerable to the Windows DLL-hijacking bug is growing by the hour, with some sites listing more than 30 vulnerable applications right now. A large portion of the known vulnerable apps belong to Microsoft, including PowerPoint 2010 and Microsoft Live Email.
The UK operation of Zurich Insurance has been fined £2.27m by the Financial Services Authority (FSA) for losing personal details of 46,000 customers. It is the highest fine levied on a single firm for data security failings. Read the full article. [BBC News]
Researchers have found a very simple method for evading the Android licensing scheme that Google uses to ensure that paid applications in its Android Market are correctly licensed.
According to the developers, the latest release of the free SSH
connectivity tools include a number of bug fixes and several new
features. Read the full article. [The H Security]
In this video, the folks at Offensive Security demonstrated exactly how the Windows DLL-hijacking vulnerability can exploited using Metasploit and a benign PowerPoint slide.
Three years after the United Nations’ website
was defaced by activist hackers using a SQL injection attack, the site
still contains multiple instances of these vulnerabilities. Read the full article. [Dark Reading]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
