Hackers update malware toolkit, add first zero-day attack code
632100
The IcePack hacker exploit toolkit has three new tools in its collection, including one that targets a zero-day flaw in Microsoft's DirectX software development kit.
30517
The first malicious codes to exploit security flaws in Microsoft Windows&#39; handling of jpeg image files has appeared on internet newsgroups.
682949
The newest version of the MyDoom worm now circulating suggests to security experts that the much-anticipated &quot;Zero Day attack&quot; may have arrived.
53629
Clicking the fraudulent update could install malicious code on your desktop.
551854
InfoWorld - A hacker has released attack code that could be used to exploit a critical bug in some versions of the Windows operating system.
466917
This third and final article in the Metasploit series covers the msfcli scripting interface as well as the intuitive web interface to the Framework. The article also discusses what's new with version 2.2, and then introduces the exploit development process through an example.
222388
In what may be the first step toward a major security problem, security researchers have released attack code that will crash Windows machines that are susceptible to a recently patched bug in the operating system.The code is not available to the general public. It was released Thursday to security professionals who use Immunity&#39;s Canvas computer security testing software. It causes the Windows system to crash but does not let the attacker run malicious software on the victim&#39;s system.&quot;It reliably crashes Windows machines,&quot; said Dave Aitel, Immunity&#39;s CTO. &quot;In fact, it blue-screened our print server by accident -- this is a broadcast attack, after all.&quot;That&#39;s the biggest concern for security experts who worry that a more dangerous attack may soon follow as researchers dig further into the vulnerability. The bug is particularly troublesome for two reasons. First, it affects a widely used Windows component that is turned on by default. Worse, no user interaction is required to trigger the flaw, meaning that it could be exploited in a self-copying worm attack.Microsoft patched the flaw in its MS08-001 update, released last week, but it takes time for enterprise users to test and install Microsoft&#39;s patches.The flaw lies in the way Windows processes networking traffic that uses IGMP (Internet Group Management Protocol) and the MLD (Multicast Listener Discovery) protocol, which are used to send data to many systems at the same time. The protocols are used by a range of applications, including messaging, Web conferencing, and software distribution products.For a worm attack to work, the attacker would have to send specially crafted packets to a victim&#39;s machine, which could then allow the attacker to run unauthorized code on the PC. The worm could then spread from computer to computer within a LAN but would generally be stopped from travelling to another network by a firewall.A reliable exploit could be combined with malicious botnet software, giving attackers a way to widen the size of their networks of infected computers. The flaw is rated critical for Windows XP and Vista systems, according to Microsoft.After patching the flaw, Microsoft published some technical research indicating that it would be hard for an attacker to exploit this vulnerability.But Aitel believes that Microsoft may have overestimated how difficult it would be to create reliable attack code. Because it could spread so quickly through a network, a reliable exploit &quot;is going to be worth the effort,&quot; Aitel said. &quot;You can be assured lots of smart people are working on it.&quot;Part of the problem is that IT staff may not be aware of how widely these multicasting protocols are used within their companies, said Russ Cooper, a senior network consultant with Verizon Business. &quot;I am extremely worried that this becomes a problem simply because people are unaware of what they&#39;re already allowing,&quot; he said.If one machine were infected within a network subnet, its attempt to attack other machines might not even be noticeable, he added. &quot;It may look like a large file transfer.&quot;
79963
Web gateway filtering specialist Finjan is reporting a new toolkit that uses randomized JavaScript to stay hidden from virus crawlers and deliver its payload via compromised Web sites.Dubbed by Finjan's Malicious Code Research Center (MCRC) as the "Random JS Toolkit," the malware development package is allowing attackers to create threats that only attempt to victimize an individual computer in the same manner a single time to protect against discovery by anti-virus systems and researchers' automated "crawlers."By dynamically changing the JavaScript employed to deliver each variant of attack being created, and by using random file names that are only delivered to the same machine or IP address once, Finjan researchers said the malware authoring package is meant to avoid the programs used by AV researchers to find new threats emerging on the Web.Typically when automated crawler programs come across new attack samples, they return to the threats' source URLs to verify their names and characteristics and to create signature files that allow their products to block the programs -- or they enter the sites onto so-called blacklists of compromised domains.However, once a machine has been infected with an attack made using the Random JS Toolkit, the threat will recognize that the machine has already been targeted and won't attempt to download it again, thereby thwarting efforts to identify or track the exploits, Finjan experts contend.During the month of December 2007, Finjan estimates that more than 10,000 individual sites were compromised with attacks built using the Random JS Toolkit. Most of the URLs serving as distribution points for the attacks were legitimate sites that had been hijacked, the company said.Among the infected sites were some that would qualify as well-known, highly trusted domains, said Yuval Ben-Itzhak, chief technology officer of Finjan.Ben-Itzhak said the toolkit serves as a prime example of the types of tactics he expects leading-edge malware authors to utilize more frequently in the coming year."We've found the initial 10,000 sites, but we're sure that there are many more that have already been infected. When we can find this number of exploits, it is clear that this must be a very significant attack that has affected a lot of people," he said. "Using the combination of techniques available in this toolkit, the threats that are being created can become very powerful and stay alive to infect people for longer periods of time."Among the types of malware infections being served up using the toolkit, Finjan has observed everything from Trojan viruses and keystroke loggers to botnet recruiting programs, he said.For its part, Finjan's real-time code inspection technology can defend against such threats because it eschews the use of traditional virus signatures or blacklists in favor of constant monitoring for any malware activity coming across a network armed with one of its devices, Ben-Itzhak maintains.Rival AV vendors, including Symantec, contend that features such as the market leader's recently developed "generic exploit prevention," based on behavioral cues, should also be able to isolate and defend against such emerging attacks.Unlike the widespread iFrame attacks that proliferated across the Web during 2007, threats created using the Random JS Toolkit will also be much harder for security researchers to track down because they do not lead back to central sites where the actual malware code itself is hosted, Finjan maintains.Since the involved malware code is loaded directly on a site, and it won't attempt infect the same computer or IP address twice, traditional URL blacklisting and signature-based techniques will likely prove futile against the attack, the company said.However, from what the security appliance vendor can deduce, Ben-Itzhak said the firm believes there is only one malware group currently using the toolkit."From what we can tell, all the information flowing back from the compromised sites is heading to the same server," he said. "This indicates that there is probably only one group controlling this malware code thus far, and that they are probably being very successful; this is just another step forward for the criminals involved to continue to improve their attack methods and remain undetected."Ben-Itzhak said that the involved server is not one that matches any of the company's lists of machines controlled by well-known malware authoring groups such as the Russian Business Network. The server the company is tracking was originally located in Europe, but has recently been moved to China -- and likely will continue to be moved around to avoid detection, according to the expert.Most of the data the security company has seen being sent to the server has been related to online banking username and password data, he said.As part of its investigation, Finjan discovered that one of the Web properties infected with the randomized JavaScript attacks was an online advertising network that serves up as many as 14 million online banner ads per week. The security device maker reported that unnamed company was informed and is currently working to clean out its systems.
383060
IBM&#39;s security gurus update a dictionary that describes various &quot;cyber villains&quot; and other dangers in nontechnical terms.
493162
InfoWorld - Just one day afterÂ Microsoft issued a massive set of security patches for its software, hackers have begun posting code showing how to exploit one of the flaws.
415389
InfoWorld - In what may be the first step toward a major security problem, security researchers have released attack code that will crash Windows machines that are susceptible to a recently patched bug in the operating system.
193189
Update for Mac OS X includes a number of fixes for zero-day vulnerabilities released as part of two high-profile bug-hunting campaigns.
357185
Just one day after&#160;Microsoft issued a massive set of security patches for its software, hackers have begun posting code showing how to exploit one of the flaws.The proof-of-concept code, posted Wednesday to the Milw0rm Web site, exploits a bug in the Microsoft Works file converter software that is part of Office 2003 and can be used to run unauthorized software on a victim&#39;s computer.The flaw also affects Works 8 and Works Suite 2005. To fall prey to the attack, a victim would first have to open a malicious Works attachment.Hackers have uncovered many of these file-format bugs in recent years, and they are generally not used in widespread attacks. In fact, security vendor Symantec predicts that we&#39;ll see fewer of these attacks in the months ahead as online criminals increasingly rely on browser bugs to do their dirty work.&quot;The bad guys, they&#39;re looking for different ways to trick people,&quot; said Wayne Periman, director of development with Symantec Security Response. &quot;The popular method of choice is to exploit plugins in browsers right now.&quot;Still, Periman expects criminals to try out this latest attack code. &quot;It&#39;s so simple,&quot; he said. &quot;All you have to do is get someone to open the document.&quot;As of Wednesday, Symantec had not seen any signs of attackers taking advantage of any of the flaws that Microsoft fixed this week.The software vendor released 11 sets of patches this week, fixing 17 flaws in its products, but this is the first exploit code to pop up following Tuesday&#39;s updates. A second program exploiting one of these vulnerabilities -- this one in an ActiveX control used by the Visual FoxPro database -- was posted to Milw0rm in September, months before Microsoft patched the issue.
674299
The updates are designed to protect against network-scanning worms and keep phishing attacks at bay.
147320
Patch for Messenger addresses zero-day exploits that take advantage of vulnerabilities in its Webcam ActiveX controls.
186929
Cyber criminals are cashing in on their expertise by offering tool kits that let anyone craft attacks.
408824
Well, if you haven&#39;t patched your PC yet, now is the time. A sample program hit the Internet on Wednesday, showing by example how malicious coders could compromise Windows computers by using a flaw in the