Yahoo Patches Messenger

Yahoo Inc. has updated its Messenger instant messaging software to flush a bug that hackers could exploit by sending video chat invitations to unwary users.

The vulnerability, which surfaced last week in a posting to a Chinese security forum, could be exploited by duping a user into accepting a malicious webcam invitation, McAfee Inc. confirmed Aug. 15.

In its advisory, Yahoo said that it had actually patched two bugs, the heap overflow disclosed last week and a previously unknown denial-of-service (DoS) issue that also involves Messenger's video chat feature. Speaking of the latter, Yahoo's alert said: "For this specific security issue, Messenger exits unexpectedly after accepting a webcam invitation from a malicious attacker."

Unlike the buffer overflow flaw, the DoS vulnerability would not give an attacker the chance to sneak his own malicious code onto the PC.

Messenger 8.1.0.416 is the summer's second patched-up IM client for Yahoo. In June, eEye Digital Security fingered Messenger for two other critical flaws in the webcam feature. Then, Yahoo patched the bugs considerably faster: It released a fix just a day after the flaws went public. According to McAfee researcher Wei Wang, August's video vulnerability wasn't connected to the older June bugs.

Messenger users can download the patched version immediately, or wait for the software's auto-update to kick in. Yahoo acknowledged that it may take weeks for the update to be fully deployed. "Over the next several weeks, users worldwide will be prompted to update to a new version of Messenger upon signing into the service," Yahoo's advisory read.

source : www.computerworld.com

The Monster.com Mess

The last thing you need when you're unemployed is a bank account that's suddenly emptied. But that's exactly what some unwary users of employment search site Monster.com faced after identity thieves made off with the personal information of more than a million people looking for jobs.

How It Started

This still-developing story has enough nooks and crannies to confuse a gumshoe, but some facts are clear: Monster's resume database was looted, and the personal information taken was used to forge convincing messages that deposited password-stealing Trojans and ransomware on users' PCs.

Calculated and ambitious, the attack is striking for how it blended several elements--stolen credentials of legitimate users, phishing e-mails, Trojan horses, money mules and more--into a slick assault.

What We Know So Far

Was Monster.com hacked? No, as Symantec said immediately. Instead, the attackers accessed the resume database with legitimate usernames and passwords, probably stolen from professional recruiters and human resource personnel who use the "Monster for employers" section of the site to look for job candidates. But it wasn't until Thursday that Monster.com admitted as much. "By gaining unauthorized access to employer accounts, the software was obtaining job seeker contact information," a new alert said.

What was snatched from the database? Names, e-mail addresses, mailing addresses, phone numbers and resume IDs, said Symantec. Yesterday, Monster.com added that only about 5,000 of the people whose data was filched live outside the U.S. That squares with what Symantec's Amado Hidalgo said in an e-mail: The information-stealing Trojan was hard-coded to dig through only the "hiring.monster.com" and "recruiter.monster.com" domains, limiting their theft to the Monster USA site's database. "They only targeted the U.S. Monster site and not any other international Monster [Worldwide] Inc. sites, such as those in the U.K., Spain, etc.," said Hidalgo.

source : www.pcworld.com

Site Auctions Software Vulnerabilities to top Bidder

There are many ways vulnerability information can get out to the industry but a controversial new site, auctioning such information to the highest bidder, may be the wave of the future.

The auction service, called WabiSabiLabi, lets potential sellers and buyers connect e-Bay-style, with timed bidding periods and minimum starting prices. Founders of the wslabi.com site say their auction house serves the researchers who discover vulnerabilities and often don't reap monetary rewards for their time and talent.

The business model is based on a practice that e-Bay shut down 16 months ago saying it promoted illegal activity. At the recent Black Hat show, published reports stated that 88 percent of respondents to an online poll said using such sites is dangerous. While it is accepted that researchers deserve to be paid for their work, selling to the highest bidder is frowned upon.

WabiSabiLabi disagrees, saying its e-marketplace, where any qualified buyer can bid, will actually discourage those who discover vulnerabilities from selling them on black markets to criminals who try to turn them into money.

The company says it checks out buyers and sellers before they can trade. "We are very aware about the risks of selling vulnerabilities, and this is why we subject buyers to deeper scrutiny, to minimize the risk of selling the wrong information to the wrong people," WabiSabiLabi says in its ethics statement. "We require non-anonymity from buyers and sellers alike. The stakes are just too high at this point in history."

Even so, the marketplace, which started business six weeks ago, is being eyed cautiously by entities dedicated to eliminating vulnerabilities quickly to avoid criminal exploitation.

"I don't think it's necessarily good for the community," says Jason Greenwood, the general manager of VeriSign's iDefense team, which pays bounties -- sometimes tens of thousands of dollars -- to researchers who discover vulnerabilities. "It will increase the perceived value of vulnerabilities, and the good guys already have trouble competing with the money you can get on the black market."

"There's a real danger that a number of these vulnerabilities will be purchased by buyers who do not turn them over to the vendors," says Terri Forslof, manager of security response for Tipping Point. "Once a vulnerability is turned over to a vendor its value starts to depreciate immediately. If someone paid lots of money for a vulnerability -- say US$75,000 to $100,000 -- I guarantee they're not giving it to the vendor. Otherwise they've wasted their money."

VeriSign and its competitor Tipping Point, for example, both pay cash for significant vulnerability discoveries in an effort to plug software holes before they can be exploited. The companies then work with the vendors whose software is compromised to find fixes and publish the vulnerabilities.

VeriSign runs quarterly challenges paying as much as $15,000 for researchers to find particular types of vulnerabilities in particular platforms, Greenwood says. Tipping Point ranks contributing vulnerability researchers as bronze, silver, gold and platinum depending on the quantity and quality of their discoveries, according to its description of Tipping Point's Zero Day Initiative. It rewards them with cash bonuses up to $25,000 and pays their way to the Defcon and Black Hat security conferences.

Underground markets pay as much or more, experts say. Charlie Miller of Independent Security Evaluators, says he sold a Linux Daemon vulnerability for $50,000 to an organization he approached directly. But he had no idea whether somebody else would have paid much more, he says in a talk delivered at Carnegie Mellon University's Workshop on the Economics of Information Security earlier this year.

"I had no way to know the fair market value of this exploit," he says in his paper, "The Legitimate Vulnerability Market; Inside the Secretive World of 0-Day Exploit Sales," which he delivered at the conference. "I may have been off by a factor of 10 or more."

Money isn't the motivation behind most of the vulnerabilities reported to entities that will try to fix them, says Art Manion, team leader for vulnerabilities at Carnegie Mellon's Software Institute CERT program, a nonprofit that acts as a go-between for researchers and software vendors.

"They desire to get the vulnerability out in the open and get the credit for it," he says. "We don't pay for vulnerabilities," but the software vendors may.

Researchers go through CERT, he says, because dealing with the software vendors themselves can be tedious, time consuming and aggravating. "They may not want to deal with the vendors. If it's a protocol problem, they might have to tell 60 or 70 vendors. "It's lots of work, and CERT will do it," Manion says.

CERT's goal is to get the vulnerabilities published as soon as possible, he says, making the flaws next to worthless to criminals. Their goal ideally is to run exploits before vulnerabilities have been identified when they can do maximum damage, he says.

About 16 months ago, a Microsoft vulnerability was posted on e-Bay and was taken down by the site after Microsoft complained. E-Bay says the sale violated its policy against enabling criminal activity.

WabiSabiLabi this week listed four vulnerabilities for sale, two against Windows Server 2003, one against Windows XP and one against WordPress 2.2.2. None had bids, but that doesn't tell much by itself, says Greenwood.

source : NetworkWorld

Old Worm Slammer Threatens Again

An old worm known as Slammer, which originated back in January 2003, is still going strong according to Gunter Ollmann, director of security strategy at IBM's Internet Security Systems (IBM ISS).

Ollmann, the author of the white paper "Old threats never die", says that Slammer is still the threat most commonly encountered by IBM ISS.

But it isn't just high-profile vulnerabilities and malware that are a problem, Ollmann said. In effect, the security industry is now witnessing a snowball effect, where threats are accumulating at an "exponential" rate, and it isn't really possible to eradicate any of those threats.

"Organizations need to be aware that old threats never actually retire from the digital landscape," Ollmann wrote in the white paper. "Rather, they tend to become background noise on the Internet -- ready to burst into life with each new software update, host recovery, device deployment or embedded system release."

The problem is that many of the protection mechanisms companies rely on, like signature-based security software, are no longer able to keep up with the rate at which new threats are appearing.

That's worsened by the fact that whenever security firms retire older signatures, they open a hole through which old attacks can instantly reappear, Ollmann said.

"Antivirus systems can handle tens of thousands of new signatures without blinking, but after a few hundred thousand they begin to struggle a bit," he wrote in a blog post this week. "Now, with several hundred thousand new virus strains each year (and increasing faster than Moore's Law), things are getting pretty creaky."

Security vendors are at a disadvantage, because it costs nothing for attackers to append the latest exploit to their attack systems, keeping all the old attack methods in place as well, Ollmann said.

"The consequences for all of us are that old exploits (and the threats they represent) will never disappear -- and there continues to be a steady supply of hosts vulnerable to flaws for which patches have existed for half a decade," he wrote in the blog post.

IBM ISS advised companies to think twice about retiring their old, creaking protection systems, but instead to evaluate more efficient protection models such as heuristic engines.

"Instead of a one-for-one signature protection model, more advanced heuristic engines can be used to protect the entire threat class," Ollmann wrote in the white paper.

source : www.pcworld.com

Spam Fighters Hit Criminals' Weak Spot

Is the fight against spam horribly misguided?

For years, spam haters have relied on junk-mail filters and Internet blacklists, but lately, some are saying it's time for a change in tactics.

Their answer: follow the money. And that means going after the Web sites where spammers sell their pharmaceuticals and watches and male enhancement products.

Misguided or not, it's pretty easy to argue that the fight against spam has been a losing proposition of late. At the end of last year, mail administrators noticed a big spike in the amount of spam flooding their in-boxes. Between July 1 and the end of the year, spam jumped to nearly 60 percent of all e-mail traffic monitored by Symantec Corp., and many administrators say it makes up an even greater percentage of e-mail now.

Spam filtering is not the answer, said Garth Bruen, who runs a volunteer project focused on taking down the Web sites run by spammers. Bruen tracks down the ISPs and domain name registrars used by spammers and arranges to have their sites shut down.

"This problem is not going to go away if you ignore it. Blocking and filtering is just a jacked-up technological form of ignoring," he said. "What you want to do is report it and make it difficult for these people to exist on the Net and do their transactions."

Earlier this month, researchers at the University of California, San Diego, endorsed Bruen's position, saying that antispam fighters could really hurt the spammers' bottom lines by targeting their Web sites.

"If there was more diligence in taking down the Web sites, that would have an effect on overall spam," said Chris Fleizach, a research assistant at UC San Diego.

Bruen says current approaches to spam fighting evolved out of a different era -- before spam was widely used for online fraud or delivering malicious software. "When this problem started out, people were annoyed, and a lot of the junk mail at that time was urban legends and chain letters and stuff that wasn't as much of a threat as it is now," he said.

Over the past four years, Bruen has tried to move the fight to a new front with his project KnujOn (that's No Junk backwards, for those who aren't into word games), which has helped shut down more than 30,000 spammer Web sites. The project asks volunteers to send in their spam, and it uses these submissions to build a large database linking sites to known spammers. To date, it has helped take down more than 32,000 of these junk mail sites.

When the project launched, KnujOn tracked just a few thousand Web sites in its database, but that number has now grown to several hundred thousand. Interestingly, the total number of spamming groups has remained constant -- somewhere around 50. "There really aren't many people involved in this," Bruen said.

That's one reason why people like Bruen think that they can make a real difference by targeting the Web. Though critics say that KnujOn may end up fighting the same war of attrition that has already occurred with e-mail blocking, Bruen thinks he can eventually wear the spammers out. "There's a point of exhaustion where they run out of places to go," he said.

KnujOn isn't the only group targeting spammer Web sites. Earlier this month, Computer Cops LLC, the company that runs the PIRT (Phishing Incident Reporting and Termination) phishing take-down program, expanded its efforts to and began doing the same thing.

Computer Cops believes many of the spamming groups are responsible for a lot of other online crime. "We're trying to take a look at all of the Internet crime out there and do criminal profiles," said Paul Laudanski, the company's owner and the leader of the PIRT project. Crime-fighting groups that focus only on spam or phishing don't get the full picture, he added. "If one organization is only focusing on one thing, they're missing a lot of criminal activity."

Scott Conti recently signed on as one of KnujOn's 1300 registered contributors because he liked the project's Web-centric approach. "There aren't many people going back to the source," said Conti, the director of information technology at Greenfield Community College, in Greenfield, Massachusetts. "That's what I thought was interesting about it. They are actually trying to take a proactive approach by going after the sites and going after the ISPs that are hosting them."

Greenfield College is now contributing between 50 and 100 spam samples per week to KnujOn, and in return it gets back information it can use to blacklist spam sites.

The college needs all the help it can get. About 96 percent of the 90,000 e-mail messages processed each day by Greenfield's IT department are spam, Conti said.

It's one of his biggest headaches, Conti said. "We probably get more vocal complaining about spam than just about any other problem we're likely to have."

source : www.pcworld.com