Monthly Archives: May 2018

Potential Risk of CVE

Microsoft Patch Tue security Focus – 8th May 2018

Microsoft Patch Tue transform to weekly routine security process. As far as I know, IT technical experts are busy for change management control schedule (time window) weekly. For the evaluation of each vulnerability most likely will be do a quick walk-through. As a  matter of fact, engage the patch updating exercise looks time consuming. IT Dept will be do the patch management out of office hour, earlier morning or Sunday morning. But think it over, our existing business world seems operate in 24 hours. Another new round of patch announcement will be held on coming Tue.  And therefore implement managed security services become a significant pathway.

Remark: We are all under demanding competitions environment!

CredSSP updates for CVE-2018-0886

My security focus for Microsoft Patch Tue this week will be observe the vulnerability of Credential Security Support Provider protocol. Regarding to my observation, vendor doing 3 times of security enhancement last 3 months. For details, please refer to diagram above.

The spectra and meltdown vulnerabilities found this year bring the people focus to CPU design architecture. As a matter of fact, memory management looks critical today because of APT attack. Heterogeneous systems that integrate a multicore CPU and a GPU on the same die are ubiquitous. On these systems, both the CPU and GPU share the same physical memory as opposed to using separate memory dies.

In order to avoid Credential Theft , what is the Secure practice?

  1. Prevent network logon for local accounts
  2. Prevent credentials from remaining in-memory when connecting remotely (out of IT operation control)
  3. Prevent access to in-memory credentials (Control by application developers)
  4. Leverage protected users and control privileged users

In short, please refer to Microsoft official announcement for reference.

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-0886

 

Blockchain

The design weakness of Ethereum

 

Preface:

Any idea from you in regards to cryptocurrencies security features at this moment?  From technical point of view, blockchain technology is able to protect the data in the block. Thus hacker is hard to modify the data. It looks a prefect system. As far as we know, crypto currencies platform not secure as expected. But what is the actual problem ?

Refer to above diagram, it explicitly show the design weakness of Ethereum design. Since both smart contract and ethereum wallet has critical vulnerabilities occurred. Since a design weakness occurred in the end point (Ethereum wallet). In additional of the smart contract has vulnerability occurred. And therefore it provides a gut feeling to people crypto currency not indeed safe.

Known Attack

Integer Overflow and Underflow

Definition of integer overflow – If a balance reaches the maximum uint value (2^256) it will circle back to zero. Since the uint variable changes state, If any user can call functions which update the uint value, it’s more vulnerable to attack.

We understand that web3.js is a collection of libraries which allow you to interact with a local or remote Ethereum node, using a HTTP or IPC connection. Java application encounter  vulnerabilities caused end user encounter cyber attack is not a news. Above informative diagram shown the integer overflow vulnerability of Ethereum case study involves java applet on the client side. As a front end application, Java application may not aware that he is the accomplice with the cryptocurrency cyber security incident.

Definition of integer underflow –  If a uint is made to be less than zero, it will cause an underflow and get set to its maximum value.  C-like underflow might affect Solidity storage. It can arbitrarily allow malicious changes to constant variables. Below is the example of uint overflow and underflow.

Remark: What is the largest value you can represent using a 256-bit unsigned integer?

The 256-bit unsigned int (uint) data type can hold integer values in the range of 0 to 11579208923731619542357098500868790785326998466564 0564039457584007913129639935

contract C {
    // (2**256 - 1) + 1 = 0
    function overflow() returns (uint256 _overflow) {
        uint256 max = 2**256 - 1;
        return max + 1;
    }

    // 0 - 1 = 2**256 - 1
    function underflow() returns (uint256 _underflow) {
        uint256 min = 0;
        return min - 1;
    }
}

A vulnerability in the Parity Wallet library contract of the standard multi-sig contract has been found.

In June 2016, users exploited a vulnerability in the DAO code to enable them to siphon off one third of The DAO’s funds to a subsidiary account. On 20 July 2016 01:20:40 PM +UTC at Block 1920000, the Ethereum community decided to hard-fork the Ethereum blockchain to restore virtually all funds to the original contract.

All dependent multi-sig wallets that were deployed after 20th July. No funds can be moved out of the multi-sig wallets afterwards. For more details, please see below:

contract Wallet {
    function () payable {
    Deposit(...)
    }
}

CVE-2018-10666

CVE-2018-10666 – The vulnerability allows attackers to acquire contract ownership because the setOwner function is declared as public. A new owner can subsequently modify variables (see below diagram for reference).

Status update on 22nd May 2018

CVE-2018-11239 – An integer overflow in the _transfer function of a smart contract implementation for Hexagon (HXG), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets by providing a _to argument in conjunction with a large _value argument, as exploited in the wild in May 2018, aka the “burnOverflow” issue.

CVE-2018-10944 – The request_dividend function of a smart contract implementation for ROC (aka Rasputin Online Coin), an Ethereum ERC20 token, allows attackers to steal all of the contract’s Ether.

Observation:

In regards to the cyber security incident happened in past, the Ethereum system looks did not shown they are capable to protect himself.
Their functionaility may have improvement comparing with traditional bitcoin technology (see below):

Hyperledge Ethereum Bitcoin
Association Linux Foundation Ethereum Developers Bitcoin Developers
Currency N/A Ether BTC
Mining Reward N/A Yes Yes
Network Design goal – Private Design goal – Public Public only
Privacy Private Open Open
Smart Contracts Multiple-programming language C++,Rust and Go i. Bitcoin Core, is written primarily in C++
ii. Lightweight clients like MultiBit and Bitcoin Wallet written in Java

Next step : How to Protecting Yourself and Your Funds

1. One of the safest & easiest ways to store your ETH is use a hardware wallets.

2. Activate 2FA (duh) on any exchanges or online wallet you use.

3. Move your ether off exchanges, into a hardware wallet or paper wallet.

How to view your account balance, look up transaction and explore smart contracts?

Etherchain is an Explorer for the Ethereum blockchain. It allows you to view your account balance, look up transactions and explore smart contracts.

Browse all Ethereum Transactions – https://www.etherchain.org/txs

In God We Trust.

— End —

News update on 14th Aug 2018: An critical vulnerability was found in EETHER.An integer overflow occurs in unprotected distributeToken function. See below details for reference.

https://github.com/rootclay/Audit-of-smart-contracts/blob/master/0x00a0cbe98e4d110b0fa82646152d77babf2951d0/README.md

 

 

 

Potential Risk of CVE

Netapp-How I met your Java debugger(CVE-2018-5486)

How I met your Java debugger is not a new hacking technique. It announced in 2014. Hacker is able to turn any open JDWP service into reliable remote code execution. But it can only execute in inside compartment (exploit inside). JDWP is one component of the global Java debugging system, called the Java Platform Debug Architecture. Hardware storage vendor (Netapp) found vulnerabiliy on their product. A design weakness of Java Platform Debug Architecture with their products cause local code execution vulnerability in OnCommand Unified Manager (Linux 7.2 and above). Vendor (Netapp) provides remediation, for more detail please refer below url for reference.

https://security.netapp.com/advisory/ntap-20180425-0001/

Under our observation

Any further idea on SAN storage data deduplication function under GDPR data protection policy

EU-GDPR held on 28th May, 2018. We believe that enterprise firms are ready. The GDPR policy indirect assist both employees and consulting firm doing the business and career development. Many company require to hire data protection officer. Meanwhile the consulting company has opportunities to promote the data protection consulting services. But there are more and more opportunities are coming soon. Even though the dead line held on end of this month. See below example, you might have more idea how to do the business development.

Example: User (A) send in EU country send a confidential document to non EU user (B). The data will be store on cloud. Perhaps we know the deduplication is common in Cloud computing area. But under GDPR data protection policy, it is better to turn off the deduplication function.

Remark: Heard that a company offer blocking EU IP addresses service for the company who do not involves their business operation in EU countries. Do you have any new idea in this regards?

Potential Risk of CVE, Under our observation

Hacker also interest of the SIEM operation (CVE-2018-1418)

SIEM functions play an important role in the IT infrastructure. And therefore the security architect plan to design the SIEM not only focusing for log collection, correlation, alert and report templates. Meanwhile, a critical item must be added to the design objective. That is how to hidden your SIEM. For instance, hacker target most likely is the IT admin or CSO because they have confidental data or priviligies ID on hand. Besides, hacker also interest of the SIEM operation.

IBM Q Radar announce that a vulnerability occurs in their SIEM. Q-Radar admin must stay alert!

Since IBM do not mention what is the possible cause of this vulnerability.
Reveiw their windows log event collection method. My speculation is shown as below:
QRadar requires XPath query to communcation with windows server.
An XPath query is a log source parameter that filters specific events when the query communicates with a Windows 2008 or newer event log.
The XPath injection also leads to extracting document structure and modify the document information in addition to escalate privileges.

For more details. please see below url for reference.

CVE-2018-1418 – IBM Security QRadar SIEM privilege escalation

https://exchange.xforce.ibmcloud.com/vulnerabilities/138824

Cell Phone (iPhone, Android, windows mobile), Under our observation

Integrated GPU may allow side-channel and rowhammer attacks – 03 May 2018 | Last revised: 03 May 2018

3 Comments

The side-channel attack looks never ending in CPU world.
So called rowhammer attack jeopardize to the cyber security world today especially smartphone. The worst is that it can altering the information saved in a computer’s memory once attack successful.

An academic paper describes an attack called “GLitch,” which leverages two different techniques to achieve a compromise of a web browser using WebGL (see below url for reference).

https://www.vusec.net/wp-content/uploads/2018/05/glitch.pdf

Impact

The attacker may be able to bypass security features provided by the web browser.

Observation:

Microsoft and Cisco announce that they will intend to integrate New Intel Threat Detection Technology to Help Defend Against Advanced Security Threats last month.
I think they have to consider this technincal problem before click start of their project.

https://newsroom.intel.com/editorials/securing-digital-world-intel-announces-silicon-level-security-technologies-industry-adoption-rsa-2018/

Status:

 

Vendor Status Date Notified Date Updated
Google Affected 16 Mar 2018 03 May 2018
Mozilla Affected 16 Mar 2018 03 May 2018
Microsoft Not Affected 16 Mar 2018 25 Apr 2018
AMD Unknown 16 Mar 2018 16 Mar 2018
Apple Unknown 16 Mar 2018 16 Mar 2018
Arm Unknown – 26 Apr 2018
BlackBerry Unknown 16 Mar 2018 16 Mar 2018
Brave Software Unknown 16 Mar 2018 16 Mar 2018
Broadcom Unknown 16 Mar 2018 16 Mar 2018
IBM, INC. Unknown 26 Apr 2018 26 Apr 2018
Imagination Technologies Unknown 16 Mar 2018 16 Mar 2018
Intel Unknown 16 Mar 2018 16 Mar 2018
NVIDIA Unknown 16 Mar 2018 16 Mar 2018
Opera Unknown 16 Mar 2018 16 Mar 2018
QUALCOMM Incorporated Unknown 16 Mar 2018 16 Mar 2018
Potential Risk of CVE

2nd May 2018 – Windows Host Compute Service Shim Remote Code Execution Vulnerability

A low level container management API in Hyper-V called the Host Compute Service (HCS). HCS compatible written in Go (and used by Docker), and the other is written in C#.
On 2nd of May, Microsoft official announcement urge end user who deployed Host Computer Service (HCS) requires to do the security update. Microsoft has patched their own infrastructure hosting offerings, as have Microsoft partners with Google among them.

Technical details:

(CVE-2018-8115) –  Duplicate the original CVE technical details.

A remote code execution vulnerability exists when the Windows Host Compute Service Shim (hcsshim) library fails to properly validate input while importing a container image. To exploit the vulnerability, an attacker would place malicious code in a specially crafted container image which, if an authenticated administrator imported (pulled), could cause a container management service utilizing the Host Compute Service Shim library to execute malicious code on the Windows host.

 

For remediation of design limitation, new version of hcsshim v0.6.10 enhance sanitize function. So called sanitize function did not use below command.
Example:

p := xxxxx.UGCPolicy()
user.Name, user.Address = p.Sanitize(user.Name),p.Sanitize(user.Address)

But do you have any idea in regards to below command syntax?

}

func makeError(err error, title, rest string) error {
 // Pass through DLL errors directly since they do not originate from HCS.
 if _, ok := err.(*syscall.DLLError); ok {
 return err
 }
 return &HcsError{title, rest, err}
}

The new release of the hcsschim able to addresses security fixes.For more details, please refer below url for reference.

Change to address CVE-2018-8115

https://github.com/Microsoft/hcsshim/releases/tag/v0.6.10

Potential Risk of CVE

Cisco Releases Security Updates Original release date: May 02, 2018

Cisco WebEx Advanced Recording Format Remote Code Execution Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-war

Reminder: My comment is that enterprise firm CSO may require to update the security policy on how to use the Cisco webex.

Cisco Prime File Upload Servlet Path Traversal and Remote Code Execution Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-prime-upload

Cisco Secure Access Control System Remote Code Execution Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-acs1

Remark: Cisco Secure ACS product offering is no longer being sold after August 30, 2017

Blockchain, Potential Risk of CVE

CVE-2018-10299 – integer overflow jeopardize Ethereum Zone

21 Comments

In the view of cryptocurrency supporter, Ethereum is the best. The cyber incident occured in cryptocurrency world so far shift the security focus to e-wallet (end point). Perhaps the cyrpto platform itself contains design limitation. However the end point design of crypto currency platform looks have more space for improvement.

If you install the MetaMask browser plugin, you can manage your accounts in your browser. The keys are stored only on your browser, so you are the only one who has access to your account and the private key. But when the web browser encounter vulnerability. It may jeopardize your private key. So security urge the crypto currency owner make use of hardware token instead of software.

We understand that web3.js is a collection of libraries which allow you to interact with a local or remote Ethereum node, using a HTTP or IPC connection. Java application encounter  vulnerabilities caused end user encounter cyber attack is not a news. Above informative diagram shown the integer overflow vulnerability of Ethereum case study involves java applet on the client side. As a front end application, Java application may not aware that he is the accomplice with the cryptocurrency cyber security incident.

Return to reality. Below headline news shown the vulnerabilities occurred in Ethereum (see below for reference). I am wishing that above details can provides hints to you for reference.  Let’s us awaken the design weakness of Ethereum cypto currency platform.

Critical EOS Smart Contract Vulnerability Discovered By Auditing Firm

https://bitcoinexchangeguide.com/critical-eos-smart-contract-vulnerability-discovered-by-auditing-firm/

 

Potential Risk of CVE, Public safety

Siemens – (CVE-2018-4832): Siemens Security Advisory by Siemens Product 18th Apr 2018

The Gas and Petroleum industries requires automation to enhance their overall operation in last decade. And therefore the automation system setup requires Supervisory control and data acquisition (SCADA). We noticed that hackers targeted SCADA system installed in nuclear power facilities. We are living in digital age and therefore electricity power supply similar air and water. So system automation hardware vendor has responsibility to hardening their system design. Siemens found vulnerability in their Automation Technology Process control systems (PCS 7) on April last month. For more details, please refer below url for reference.

Vulnerability details

https://cert-portal.siemens.com/productcert/pdf/ssa-348629.pdf

My Speculation:

1. A denial of service vulnerability exists in the remote procedure call (RPC) facility due to a failure in communicating with the NTLM security provider when performing authentication of RPC requests. An anonymous attacker could exploit the vulnerability by sending a specially crafted RPC authentication request to a computer over the network. An attacker who successfully exploited this vulnerability could cause the computer to stop responding and automatically restart.

2. GetMachineName ( ) copies machine name to a fixed 32 byte buffer causes problem occurs.