<![CDATA[[SecurityRatty] tag: ubuntu]]> http://securityratty.com/tag/ubuntu Wed, 09 Apr 2008 21:20:05 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Actns/Swif.T virus found in YouTube videos]]> http://securityratty.com/article/8eff71f0ca5bfea5ed734ae63e7157fa http://securityratty.com/article/8eff71f0ca5bfea5ed734ae63e7157fa TOOLS FOR FLASH ANALYSIS

Breaking news regarding malicious Flash popping up from YouTube is starting to break all over the Internet.
CrunchGear has a bit of a write-up on it.
Rather than sound off about what will become old news quickly, I'd like to point you to resources I use to analyze (or have the analysis done for me, to be more concise) malicious Flash or JavaScript.
I grabbed the evil .swf in question from the URL below via command-line on my trusty Ubuntu box:
wget hxxp://www.youtube.com/v/O7tB1pYSNuE&rel=1
I then fed l.swf to Adops Tools and Wepawet.
The results from each analysis are below for your review.
Note System.security.allowDomain("*").
Not good. ;-)
Adops Tools Results
Wepawet Results
Use in good faith, but always be careful grabbing the evil .swf.

del.icio.us | digg | Submit to Slashdot]]> Tue, 02 Dec 2008 07:51:00 +0000 wepawet results results adops tools results adops tools tools analysis youtube malicious flash flash analysis Actns/Swif.T virus found in YouTube videos <![CDATA[Linux vendors patch XML parser]]> http://securityratty.com/article/48ce8cfc7bfe516853c78d98f7e6c52d http://securityratty.com/article/48ce8cfc7bfe516853c78d98f7e6c52d

]]> Wed, 19 Nov 2008 21:00:00 +0000 libxml2 module libxml2 major linux vendors parser bugs xml gnome project service attack patches Linux vendors patch XML parser <![CDATA[Download: H1 2008 Desktop OS Vendor Report - Vulnerabilities and Days-of-Risk]]> http://securityratty.com/article/3dadf3c9dc033dffce216e9be647ff0d http://securityratty.com/article/3dadf3c9dc033dffce216e9be647ff0d This report looks at all of the vulnerabilities fixed by Apple, Microsoft, Red Hat and Ubuntu during the first half of 2008. At the vendor level, the report examines all vulnerabilities as well as Days of Risk (DoR) associated with those vulnerabilities. The report further drills down to examine just those issues affecting the commonly installed desktop operating system components.

The key findings for 1H08:
  • The four vendors fixed a total 585 vulnerabilities in 1H08. 26.8% affected multiple vendors and of those, only 8 were fixed on the same day – the rest had an average 35 day delay between the first available fix and the last available fix..
  • Microsoft had the lowest average Days of Risk for all vulnerabilities fixed at 24.22 days, with the next closest vendor at 72 days.
  • For desktop OS vulnerabilities, Windows Vista had the fewest vulnerabilities in 1H08 at 21. The next lowest number was Windows XP SP2 at 26.
  • Windows Vista customers experienced full or partial mitigation for 46% of the 26 vulnerabilities affecting Windows XP SP2 in 1H08, but also experienced one additional vulnerability in new code.

In addition to these measurements for the vendors and products, the body of the report also provides weighted analysis which provides a lesser consideration for lower severity issues. Please read the full report for details.

]]> Mon, 27 Oct 2008 04:00:00 +0000 vulnerabilities vulnerabilities fixed report windows vista customers windows vista fixed days windows average days Download: H1 2008 Desktop OS Vendor Report - Vulnerabilities and Days-of-Risk <![CDATA[Tools circulate that crack Debian, Ubuntu keys]]> http://securityratty.com/article/9d1bdbc8689522127fecbb6d308d7c42 http://securityratty.com/article/9d1bdbc8689522127fecbb6d308d7c42 Thu, 15 May 2008 20:00:00 +0000 noted security researcher digital signatures linux distributions confidential information cryptographic keys attackers recently widely forgery Tools circulate that crack Debian, Ubuntu keys <![CDATA[Tools circulate that crack Debian, Ubuntu keys]]> http://securityratty.com/article/77801b8a1bf9d12a22df39d6a3f1a9f5 http://securityratty.com/article/77801b8a1bf9d12a22df39d6a3f1a9f5

]]> Thu, 15 May 2008 09:00:00 +0000 linux distributions security researcher cryptographic keys confidential information attackers moore widely possibly vulnerability Tools circulate that crack Debian, Ubuntu keys <![CDATA[Debian OpenSSL Blunder]]> http://securityratty.com/article/5c2626ec83bf50c7eb535287ca4280cb http://securityratty.com/article/5c2626ec83bf50c7eb535287ca4280cb Metasploit fame for exposing a serious weakness introduced into the Debian distribution of OpenSSL in September 2006. As Moore explains it, the problem began when the team addressed a different potential vulnerability having to do with uninitialized data. To fix it, they removed one line of code. Moore shows how this had "...the side effect of crippling the seeding process for the OpenSSL PRNG." (PRNG is pseudo-random number generator.) It removed substantial randomness from the seed for the PRNG, leaving the process ID, which maxes out at 32,768, as the only input. This allowed Moore to pre-generate all the possible 32768 keys and do a brute force attack. The fact that OpenSSL uses 1024 bit or larger keys didn't matter, because the randomness in them had been so greatly diminished. Moore was able to generate all the 1024 bit DSA and 2048 bit RSA keys for an SSH account in a couple hours on 31 2.33GHz Xeon cores and he has published them. The ISC also makes the point that to fix the damage caused by this problem you don't just update your software, you have to recreate certificates, get them signed again, and reencrypt. Other Debian-based distributions, such as Ubuntu, are also affected; in fact, Moore has published all the keys for the Ubuntu root file system. The ISC recommends that you monitor your logs for evidence of brute force password logins.They also point out that web site certificates generated with Debian have a huge problem because the public key is public; in such cases, they don't even have to brute-force you since Moore has done all the work already. Debian has published a tool to detect such weak keys. Engineers at the German company Cynops tested public keys at all the major certificate authorities and found none affected
]]> Thu, 15 May 2008 05:19:37 +0000 openssl bit rsa keys keys public key public public keys moore explains moore debian Debian OpenSSL Blunder <![CDATA[Q1 2008 - Client OS Vulnerability Scorecard]]> http://securityratty.com/article/7b8af4c00571d063bc5dfa725eaa52ca http://securityratty.com/article/7b8af4c00571d063bc5dfa725eaa52ca This paper is a compilation of vulnerability data for client operating systems for the first 3 month, January through March, of 2008. Vulnerabilities and fixes for the following products are discussed:
  • Microsoft Windows Vista
  • Microsoft Windows XP SP2
  • Red Hat Enterprise Linux Desktop (v. 5 client)
  • Red Hat Enterprise Linux WS (V. 4)
  • Ubuntu 6.06 LTS Desktop
  • Apple Mac OS X 10.5 (Leopard)
  • Apple Mac OS X 10.4 (Tiger)

For January through March of 2008, Mac OS X users experienced the highest number of vulnerabilities as well as the highest number of High severity vulnerabilities while Windows Vista users experienced the fewest and the fewest High severity vulnerabilities.

Here is the chart breaking down all of the OSes by NVD severity ratings:

q108-client-scorecard-chart

Download the attached paper for full details.

Share this post :
]]> Wed, 14 May 2008 19:04:00 +0000 severity vulnerabilities vulnerabilities microsoft windows vista mac apple mac microsoft windows users windows vista users client Q1 2008 - Client OS Vulnerability Scorecard <![CDATA[Getting Ubuntu Linux to connect to a PPTP Cisco VPN 3000 Concentrator]]> http://securityratty.com/article/8afc7be856397b8248d1fa7baa38a023 http://securityratty.com/article/8afc7be856397b8248d1fa7baa38a023 Conglomeration April 18th-20th. While it's not a Hacker/Security con, it's still a fun little Sci-Fi/Fantasy convention with plenty of geeky types running around. Let me know if you're a reader of Irongeek.com and plan to be there.]]> Wed, 09 Apr 2008 21:20:05 +0000 quick notes page conglomeration april 18th-20th hackersecurity con plan geeky types sci-fifantasy convention reader plenty irongeek Getting Ubuntu Linux to connect to a PPTP Cisco VPN 3000 Concentrator <![CDATA[Getting Ubuntu Linux to connect to a PPTP Cisco VPN 3000 Concentrator]]> http://securityratty.com/article/231a65d7e4ae1ded42a8cecad21648fe http://securityratty.com/article/231a65d7e4ae1ded42a8cecad21648fe Conglomeration April 18th-20th. While it's not a Hacker/Security con, it's still a fun little Sci-Fi/Fantasy convention with plenty of geeky types running around. Let me know if you're a reader of Irongeek.com and plan to be there.

]]> Wed, 09 Apr 2008 21:20:05 +0000 quick notes page conglomeration april 18th-20th hackersecurity con plan geeky types sci-fifantasy convention reader plenty irongeek Getting Ubuntu Linux to connect to a PPTP Cisco VPN 3000 Concentrator <![CDATA[Getting Ubuntu Linux to connect to a PPTP Cisco VPN 3000 Concentrator]]> http://securityratty.com/article/f1b20f33d03e6d0bc133ea44e98b7ede http://securityratty.com/article/f1b20f33d03e6d0bc133ea44e98b7ede Conglomeration April 18th-20th. While it's not a Hacker/Security con, it's still a fun little Sci-Fi/Fantasy convention with plenty of geeky types running around. Let me know if you're a reader of Irongeek.com and plan to be there.]]> Wed, 09 Apr 2008 21:20:05 +0000 quick notes page conglomeration april 18th-20th hackersecurity con plan geeky types sci-fifantasy convention reader plenty irongeek Getting Ubuntu Linux to connect to a PPTP Cisco VPN 3000 Concentrator