[SecurityRatty] tag: severity

Exploitability Index - More Information for Customers

Wed, 06 Aug 2008 12:20:56 +0000

Yesterday at Black Hat 2008, along with some other stuff, we announced that we will be adding some new information to Security Bulletins - an "Exploitability Index" for each of the vulnerabilities addressed by the bulletin.

Based upon talking with Microsoft customers over the past five years, they are always looking for that little bit of extra information to help make prioritization decisions. An obvious example of this is the severity attached to the vulns. However, as explained by Mike Reavey of the the Microsoft Security Response Center (MSRC) over on the Ecostrat blog today, customers are also very interested in which vulnerabilities already have exploit code or sample exploits available.

According to our analysis in the most recent Security Intelligence Report (SIR), only about 30 percent of the vulnerabilities we fix each year have exploit code released. Why is it not 100% ? Some are not interesting to attackers, sure, but some are simply more challenging to develop a consistent exploit against. It seems like it would be practically useful if this sort of information could be analyzed and published for customers.

How does one come up with an Exploitability Index?

The MSRC will analyze the vulnerability and explore what it would take to exploit it, with the support of our Security Vulnerability Research & Defense (SVRD) team. This will include leveraging methodologies from the broad researcher community.
We will also ask security researcher members of the Microsoft Active Protections Program (MAPP) (download FAQ) to review the vulnerabilities and check our analysis before releasing the index.

The idea of the Exploitability Index is to provide more information to help customers prioritize Microsoft security updates. This Index will reflect our best estimate, scrutinized by MAPP partners, of the likelihood of a functional exploit being developed for a given vulnerability.

If you are interested, I did an interview with Mike Reavey a while back, where we discuss what sort of information customers want that isn't yet in Security Bulletins. FYI, the video is about 15 minutes long and the early part focuses on Mike, how he got into security and how he ended up at Microsoft before we get to the Security Bulletin discussion ... if you want to get right to the Security Bulletin discussion, skip forward to about 08:40.

If you like these sorts of videos, click on
SecurityGuy 001 - Interview with MSRC Leader Mike Reavey and it'll take you to the edge.technet.com site and you can check out the related videos.

Regards ~ Jeff

Vulnerabilities in Antivirus Software - Conflict of Interest

Thu, 24 Jul 2008 00:38:07 +0000

Vulnerabilities within security solutions -- antivirus software in this case -- are a natural event, however, the conflict of interests and failure of communication between those finding them and those failing to acknowledge them as vulnerabilities in general, harms the customer. How they get count, and how is their severity measured in a situation where a vulnerability bypassing the scanning method of an antivirus software allowing malware to sneak in, is less important than a remote code execution through the antivirus software, is a good example of short sightedness. Here's a related development regarding a recent study regarding vulnerabilities in antivirus software - "McAfee debunks recent vulnerabilities in AV software research, n.runs restates its position" :

"Several days after blogging about a research conduced by n.runs AG that managed to discover approximately 800 vulnerabilities in antivirus products, McAfee issued a statement basically debunking the number of vulnerabilities found, and providing its own account into the number of vulnerabilities affecting its own products :

“A recent ZDnet blog discusses a large number of vulnerabilities German research team N.Runs says it found in antimalware products from nearly every vendor. The ZDNet posting includes scary graphs to frighten users of security products. We researched the N.Runs claims by analyzing the raw data and found their claims to be somewhat exaggerated. We will discuss our findings (and make available our source data) in the attached document. We have also provided our source data for anyone who wishes to examine it.”

Today, n.runs AG has issued a response to McAfee’s statement, providing even more insights into the vulnerabilities they’ve managed to find, how they found them, and why are the affected antivirus vendors questioning the number of flaws in general."

Consider going through the interview with Thierry Zoller as well.

Related posts:
0bay - how realistic is the market for security vulnerabilities?
Was the WMF vulnerability purchased for $4000?!
Where's my 0day, please?
Scientifically Predicting Software Vulnerabilities
Zero Day Initiative "Upcoming Zero Day Vulnerabilities"
Delaying Yesterday's "0day" Security Vulnerability
Shaping the Market for Security Vulnerabilities Through Exploit Derivatives
Zero Day Vulnerabilities Market Model Gone Wrong
Zero Day Vulnerabilities Auction
The Zero Day Vulnerabilities Cash Bubble

DNS Hole Doesn't Go Unnoticed

Mon, 14 Jul 2008 01:23:20 +0000

A security flaw in the DNS protocol didn't get Microsoft's top severity rating when the company and other vendors issued patches for it. But that belies the amount of attention being paid to the cache-poisoning vulnerability.

Summarizing June's Threatscape

Tue, 01 Jul 2008 03:05:01 +0000

June's threatscape that I'll summarize in this post based on all the research conducted during the month, was a very vibrant one. With the return of GPcode, a remotely exploitable flaw in the Zeus crimeware kit allowing both, researchers and malicious parties to assess the severity of a particular banker malware campaign, the increasing use of malicious doorways next to ICANN and IANA's DNS hijacking, all speak for themselves and how diverse the threats and, of course, the abilities to maintain a decent situatiational awareness about what's going on have become.

01. U.K's Crime Reduction Portal Hosting Phishing Pages - nothing new here since vulnerable sites are to be "remotely file included" and SQL injected to locally host anything on behalf of a malicious party. Risk and responsibility forwarding is one thing, but having a crime reduction portal hosting phishing pages is entirely another. The phishing pages was shut down in less than 12 hours upon notification

02. Price Discrimination in the Market for Stolen Credit Cards - Tracking down "yet another stolen credit cards for sale" service in the wild, the price discremination that they applied greatly reflects the current lack of transpararency for a potential buyer of stolen credit cards, and how higher profit margins are driving the entire business model. With script kiddies running their own botnets and undermining the sophisticated botnet master's high profit margin business model by undercutting their prices, stolen credit cards are not what they used to be - an exclussive good. Nowadays, they are a commodity good and often a bargain

03. Blackhat SEO Redirects to Malware and Rogue Software - Sampling an active blackhat SEO campaign out of the hundreds of thousands currently active online, releaved a large portfolio of domains serving Zlob variants by pitching them as fake codecs that the end user should download if they are to view the non existent adult content at the sites. Where's the OSINT mean? It's in the fact that the codecs and the fake security software phone back to UkrTeleGroup Ltd's network

04. Using Market Forces to Disrupt Botnets - With the current oversupply of malware infected hosts, and botnet masters embracing the services model for anything malicious, in this post I discussed the radical security approach of puchasing already infected malware hosts on a per country basis, disinfecting them and forcing them to update all the software on the infected PCs. Of course, on an opt-in basis. The possibility to directly provide incentives for botnet hunters to shut down whatever they come across to on a daily basis, and that's a lot of botnets, is also there

05. Who's Behind the GPcode Ransomware? - The title speaks for itself, the research with enough actionable intelligence gathered in the shortest timeframe possible is already proving accurate and highly valuable. How come? Stay tuned for more developments

06. ImageShack Typosquatted to Serve Malware - In a rare instance of a creative attack combining typosquatting in order to impersonate ImageShack and serve malware by redirecting users to an image file that is actually forwarding to the binary, I was recently tipped by the folks at TrendMicro who are also following this that the site is up and running again. Not for long

07. Fake YouTube Site Serving Flash Exploits - Next to using the usual set of exploits courtesy of a commodity web malware exploitation kit, this campaign was also using flash exploits. Even more interesting is the fact that the password stealer obtained was attempting to phone back to a misconfigured malware command and control interface, basically allowing you to assess the campaign from the eyes of the "campaigner"

08. Monetizing Web Site Defacements - Web site defacements are getting monetized just like SQL injections are in order to locally host a blackhat search engine optimization campaign on a vulnerable site with a high page rank. In this post I've assessed such monetization courtesy of a web site defacer at The Africa Middle Market Fund

09. Malicious Doorways Redirecting to Malware - Yet another large domains portfolio exposed though a malicious doorway redirecting to fake porn and video sites serving Zlob variants, tracking down the initial spamming of the malicious doorways across multiple vulnerable forums and guestbooks

10. The Zeus Crimeware Kit Vulnerable to Remotely Exploitable Flaw - When cyber criminals get advised to patch their vulnerable versons of the Zeus Crimeware Kit, you know there's a monoculture in the crimeware market. This flaw released publicly in May, 2008, not just allows others to hijack someone's ebanking botnet, but also, vendors and researchers to better assess a vulnerable Zeus command and control location

11. Fake Celebrity Video Sites Serving Malware - When templates for fake video and adult sites are just as available as they are now, anyone can take advantage of this cheap social engineering track that seems to work just fine. Compared to relying on blackhat search optimization to acquire traffic, some of the campaigns were SQL injected at vulnerable sites in order to drive traffic to them, next to several other tactics which when combined can result in a lot of people unknowingly visiting the sites

12. Phishing Campaign Spreading Across Facebook - An internal phishing campaign was circulating across Facebook, which got taken care of thanks to coordinated efforts with Facebook's security folks. There's also an indicating tha they are currently typosquatting other social networking sites like Hi5 for instance

13. Underground Multitasking in Action - As a firm believed in taking a random sample for a particular threat segment, this was once of these cases confirming the confidence I've built into anticipating upcoming tactics and strategies to be used

14. An Update to Photobucket's DNS Hijacking - Despite that Photobucket didn't oficially acknowledge the DNS hijacking, the hosting provider the NetDevilz hacking team used issued a statement. Ironically, the Turkish hacking group used the same provider weeks later to redirect ICANN and IANA's domains to Atspace.com

15. Fake Porn Sites Serving Malware - Among the largest domains portfolio of malware serving porn sites I've exposed in a while, all of them naturally remain active since they are hosted on a partition of RBN's diverse network. Visualizing a malicious doorway or the entire ecosystem provides a better understanding at how structured the ecosystems are

16. Backdoording Cyber Jihadist Ebooks for Surveillance Purposes - Despite that in this case we have a cyber jihadist backdoording his own released books, the international intelligence community next to law enforcement are known to have expressed interest in backdooring suspect's PCs, so why not SQL inject the cyber jihadist forums themselves?
17. Right Wing Israeli Hackers Deface Hamas's Site - When you read that Hamas's site is hacked, you ask yourself the following, do they even have a web site that's up the running? The answer to which would be the fact that even Hezbollah has been maintaining an Internet infrastructure since 1998
18. ICANN and IANA's Domain Names Hijacked by the NetDevilz Hacking Group - A fact is a fact, no comment here, go through all the technical details of the hijacking, including some actionable intelligence on who's behind the hijacking
19. The Malicious ISPs You Rarely See in Any Report - Who's tolerating malicious activities on their network, and how is the RBN related to all this? Well, when combined, the tiny parts of these ISPs represent a tiny part of the Russian Business Network itself

New Firefox 3.0 Is Vulnerable To High-Severity Code Execution

Wed, 18 Jun 2008 22:10:52 +0000

Code execution vulnerability found in latest Firefox 3.0 could allow an attacker to execute arbitrary code, permitting the attacker to completely take over the vulnerable process, potentially allowing the machine running the process to be completely controlled by the attacker. The flaw found in Firefox 3.0 is considered a high-severity risk and affects earlier versions [...]

June Patch Tuesday Advance Notification

Thu, 05 Jun 2008 11:49:31 +0000

On Tuesday, June 10, Microsoft will release 7 security bulletins, 3 of them critical, and security updates to address them. Microsoft's new advance notification bulletin format adds a very readable new view in the Affected Software section. For each operating system version you can see which bulletins are relevant and what the severity is. The bulletins now have English titles too: The three critical bulletins:

The Bluetooth Bulletin: Affects XP SP2 and SP3, Vista and Vista SP1
The Internet Explorer Bulletin: Affects all Windows versions. Critical on IE6 and IE7 on Windows 2000, XP and Vista; Moderate on Windows Server 2003 and 2008.,
The DirectX Bulletin: Critical on all versions of Windows and DirectX.

The other bulletins are entitled WINS, Active Directory, PGM (all ranked Important) and Kill Bit, ranked Moderate.

June Patch Tuesday Advance Notification

Thu, 05 Jun 2008 11:49:31 +0000

On Tuesday, June 10, Microsoft will release seven security bulletins, three of them critical, and security updates to address them. Microsoft's new advance notification bulletin format adds a very readable new view in the Affected Software section. For each operating system version you can see which bulletins are relevant and what the severity is. The bulletins now have English titles too: The three critical bulletins:

The Bluetooth Bulletin: Affects XP SP2 and SP3, Vista and Vista SP1
The Internet Explorer Bulletin: Affects all Windows versions. Critical on IE 6 and IE 7 on Windows 2000, XP and Vista; Moderate on Windows Server 2003 and 2008
The DirectX Bulletin: Critical on all versions of Windows and DirectX

The other bulletins are for WINS, Active Directory and PGM (all ranked Important) and Kill Bit, ranked Moderate.

What Are You Managing Towards? (And On Disproving Risk Management)

Tue, 03 Jun 2008 10:41:11 +0000

First, I’d like to thank Steve McCalmont for including FAIR in his excellent article in the May 2008 ISSA Journal, “Streamlining the Risk Management Process”. Three quick things to anyone who has read it and is visiting our blog for the first time:

We don’t believe that the goal of Quantitative Risk Analysis is to be precise. We believe the goal is to be accurate. Subtle but important difference.
FAIR can be used both Quantitatively and Qualitatively. The decision on which method to be used depends on various factors that Steve lays out nicely in the article there.
We believe that Risk Management is more than looking at specific vulnerabilities, their likelihood and impact. It must encompass all aspects of the organizations ability to effect the probable frequency and magnitude of loss on an aggregate level, not just within the context of a discreet technical or policy issue.

That last point is important. And it’s related to my post today.

WHAT DO YOU MANAGE TOWARDS?
This blog is blessed to have some very smart people be part of it. There are security managers from all sorts of industries that read and comment and contribute. And so today’s blog is more of an open-ended question for you all. It’s a question that, if I have a comfortable relationship with the organization I like to first ask the senior manager, and then subsequently ask the direct reports.

When you think about it, Sales & Marketing managers have goals they manage towards. CFO’s have goals that they manage towards. COO’s have goals and measurement that they manage towards (cost management, production, etc…). So what does the CSO manage towards? I’m guessing if we took a national poll, we’d get all sorts of very nice sounding answers to that question. I thought I’d list some of the answers I’ve heard and talk about them with you today.

1.) Being Secure or “Managing to Security”

Generally, this concept of being secure is the most common answer. And when I’m given that answer, it generally means that management focuses on Vulnerability Management, Patch Management, and to some degree, log analysis from various sources. These are very basic core security functions, and the belief is that if we do these well, we will be “secure”. Ok, well… what does this “secure” mean, and how can we talk to management about whether we are meeting this goal? If you examine that question, you actually find out what a “Being Secure” organization is really managing towards, another answer I hear often:

2.) Being Incident-Free or “Managing to Perfection”

Security Person: “Alex, our goal is not to have any incidents.” Alex: “Good luck with that.”

OK, that’s not what I really say, but here’s the problem I see with this common answer and the one above both of these common answers: How do you know if you’re good or just lucky?

Well, are you, punk? (youtube link)

In my six years of working with a Penetration Testing team, nobody ever really “passed” with a perfect score*. Some did better than others, some folks looked really, really good - but the degree of good/bad was really more dependent on scope than the actual state of controls or the ability of the team to overcome them. That is to say, when pressed, the mature security professional must admit that, given a strong, capable threat community - there is no secure. And therefore any state of “incidentlessness” deals with some combination of amount of control strength, and some lack of attacks (frequency!) by someone with enough skills and resources to overcome those controls. If that last sentence sounds very FAIR-Like, that’s because it is. If FAIR really accounts for those things that create Risk, then Managing to security or lack of incident means that you’re primarily concerned with FAIR Vulnerability, and ignoring other critical aspects of risk (like frequency of attacks, controls that reduce the probable impact of an event due to an ability to respond well to external stakeholders, etc…).

3.) Being Compliant or “Managing to Compliance” (External Compliance Pressures)

Because that’s what business buy, right? They buy compliance! Or so I’m told. So let’s say that you go out and actually twist senior managements arm to get them to cough up enough dough so that you can be as compliant as Large Accounting Firm says you need to be. Good on you!

But what I always wonder is, what happens when you want to manage something beyond compliance? What happens when the checklist you’re managing towards is run by a bureaucracy that can’t keep up with a changing threat landscape? For many people, the answer is “GOTO 1″ and try to sell upper management using FUD (hey, it used to work, maybe it’ll work again). An alternative is to get to the next step:

4.) Being Measured or “Managing to Metrics”

Say what you will, but “quants” have one thing right. What gets measured gets done. And a few mature organizations have spent a ton of time and effort on being able to create dashboards of KPI’s that attempt to measure security. Problem is, that we don’t know if a 98% on patch levels is good or bad or just right. We don’t know what value, if any, does creating metrics around the number and severity of vulnerabilities found in a monthly scan actually have. So we’ve come up with this thing called “GRC” that’s supposed to make sense of those things we can measure empirically and help you find out if/when you’ve fixed them. And while GRC tools can tell you some good information about systems out of compliance, they tend to give you fantastic information like how your “risk = 57“.

Wha….?

Risk = 57 means very little to someone who doesn’t spend their life in the machinations of the GRC indicies. So again, measurement without a (good) model still falls down when faced with that ultimate business decision. Or, as Shurdlu so eloquently puts it in her post on GRC:

“By contract, risk is personal. It’s variable as hell. It “governs” what you spend your money on, and therefore, with or without a dashboard, your CEO is already doing risk assessment every time she decides what your security budget is going to be. Will you really be able to change her mind by showing her the dashboard and saying, “But—but—the needle is pointing to RED!” when you’re sitting there with your line items in your fiscal shopping cart? “

5.) Using Risk or “Risk Management”

Which brings us to my favorite, using risk (as defined as the probable frequency & probable magnitude of loss event(s)) as a means to manage. Now many industry veterans will tell you how jaded we all are on the term “Risk Management”. And we have every right to be, as Risk Management has been horribly abused by vendors, committees and standards bodies alike.

These days, the term has been narrowly defined to mean an extension of vulnerability management. This is small, small thinking, IMHO. To me, Risk Management isn’t the management of individual issues deemed as “risky” as much as it is measuring (see 4) our ability to make decisions through the lens of risk. Maybe I should start saying “Risk-Based Management” instead of “Risk Management”.

This Risk-Based Management approach provides meaning to metrics. We can know what we’re measuring and why we care about it. And why we care about it needs to match what management cares about. If your approach to Risk Management results in some metric or KPI that non-IT (or non-security) management doesn’t understand or speak to them in an evident language, it’s time to find a new model. This is why “Quants will win” and where risk = 57 is wrong. Risk, expressed as “expect a once in 5 year chance to lose $875,000 if we don’t spend $90,000 now” actually gives executives something beyond an arbitrary ordinal number or color to work with. And what’s interesting is, if your model does the right things in getting you to that expression - then metrics and KPIs - those “why/when/where” questions we have a tough time answering about metrics - they become easier to discover.

DISPROVING RISK MANAGEMENT

As a side note, originally I was going to write today a completely different post on how we can disprove whether or not OCTAVE or 800-30 or ISO 27001 risk management efforts are really “Risk Management” - and one significant point was “Does your non-IT management really care about the deliverable?” This thought came to me after seeing a few too many emails into the ISO27001 mailing list asking “How can I get management to fund ISO 27001 certification?” Of course, the value of implementing the ISMS and the value of certification are two separate business propositions, but if you can’t sell the first, then are those efforts really good risk management? You know, the kind of effort that we can use to make meaningful reporting?

=============================

* I can tell you that at times we were asked to test products out for clients before they made a significant investment. One biometric device stands out in memory as not being “hacked” in the time alloted for the engagement by a defense contractor. After it passed the “Gummi Finger” test - we were going to try using a recently severed finger, but oddly enough nobody on the team volunteered their digit for the sake of security. Bunch of slackers.

Q1 2008 - Client OS Vulnerability Scorecard

Wed, 14 May 2008 19:04:00 +0000

This paper is a compilation of vulnerability data for client operating systems for the first 3 month, January through March, of 2008. Vulnerabilities and fixes for the following products are discussed:

Microsoft Windows Vista
Microsoft Windows XP SP2
Red Hat Enterprise Linux Desktop (v. 5 client)
Red Hat Enterprise Linux WS (V. 4)
Ubuntu 6.06 LTS Desktop
Apple Mac OS X 10.5 (Leopard)
Apple Mac OS X 10.4 (Tiger)

For January through March of 2008, Mac OS X users experienced the highest number of vulnerabilities as well as the highest number of High severity vulnerabilities while Windows Vista users experienced the fewest and the fewest High severity vulnerabilities.

Here is the chart breaking down all of the OSes by NVD severity ratings:

Download the attached paper for full details.

Share this post :

Windows Vista vs Windows XP SP2 Vulnerability Report 2007

Wed, 14 May 2008 18:50:00 +0000

In the wake of my Windows Vista One Year Vulnerability Report, I have received many questions regarding the current vulnerability record of Windows Vista as compares with Windows XP SP2.

This short paper is a compilation of vulnerability data for Microsoft Windows Vista and Microsoft Windows XP SP2 for calendar year 2007 and a brief analysis to see if any benefit is apparent for users of one OS over the other.

I found that Windows Vista offers benefit over Windows XP SP2 in the following ways for 2007:

Windows Vista had 30% fewer Security Bulletins than Windows XP
Windows Vista had 20% fewer vulnerabilities than Windows XP
Windows Vista had 28% fewer Critical and Important vulnerabilities than Windows XP
26 vulnerabilities on Windows Vista are less severe for any users running as standard user.

Here is the chart breaking down the vulnerabilities by Microsoft severity ratings

Download the short paper attached to this post for full details.

Share this post :