The Hacker News | Biggest Information Security Channel

Sunday, December 07, 2014

Google App Engine - More than 30 Vulnerabilities Discovered
Security researchers have discovered a number of critical vulnerabilities in the Java environment of the Google App Engine (GAE) that enables attackers to bypass critical security sandbox defenses.

Google App Engine is Google’s PaaS (Platform as a Service) Cloud computing Platform for developing and hosting web applications in Google-managed data centers. GAE offers to run custom-built programs using a wide variety of popular languages and frameworks, out of which many are built on the Java environment.

The vulnerabilities was reported by Security Explorations, the same security research company that carried out multiple researches related to Java in past. The discovery was announced on the Full Disclosure security mailing list by Adam Gowdiak, founder and CEO of Security Explorations.

According to the security firm, the flaws can be exploited by attackers to achieve a complete Java VM security sandbox escape, as well as to execute an arbitrary code. The researchers estimate that the number of issues is "30+ in total."

By exploiting the vulnerabilities, security researchers were able to bypass Google App Engine whitelisting of JRE Classes and gain access to full JRE (Java Runtime Environment). They discovered 22 full Java VM security sandbox escape issues and were able to exploit 17 of them successfully.

Moreover, the researchers were able to execute native code, specifically to issue arbitrary library/system calls and to gain access to the files (binary/classes) comprising the JRE sandbox. They even siphoned off DWARF information from binary files, PROTOBUF definitions from Java classes and PROTOBUF definition from binary files among others.

However, the researchers have been unable to finish their research because Google suspended their test Google App Engine account.
"Unfortunately, we cannot complete our work due to the suspension of the "test" GAE account that took place today," Gowdiak wrote. "Without any doubt this is an opsec failure on our end (this week we did poke a little bit more aggressively around the underlying OS sandbox / issued various system calls in order to learn more about the nature of the error code 202, the sandbox itself, etc.)."
As Google has generally been supportive and helpful to the security research community, Researchers at the security firm believes that Google will allow them to complete their research and re-enable their Google App Engine account.

Sunday, December 07, 2014

AliExpress WebSite Vulnerability Exposes Millions of Users' Private Information
A critical, but easily exploitable personal information disclosure vulnerability has been discovered in the widely popular online marketplace AliExpress website that affects its millions of users worldwide.

The reported vulnerability could allow anyone to steal personal information of hundreds of millions of AliExpress users without knowing their account passwords.

AliExpress is an online marketplace owned by Chinese E-Commerce giant Alibaba.com, which offers more than 300 Million active users from more than 200 countries and regions to order items in bulk or one at a time at low wholesale prices.

Amitay Dan, an Israeli application security researcher working at Cybermoon.cc, reported the vulnerability to The Hacker News after providing full disclosure of the flaw to the AliExpress team and Israeli media.

According to the Proof-of-Concept video and screenshots provided by the security researcher to The Hacker News, AliExpress website allows logged in user to add/update their shipping address and contact number at the following URL i.e.
http://trade.aliexpress.com/mailingaddress/mailingAddress.htm?mailingAddressId=123456
Where “123456” is the user id of the logged in user. Researcher noticed that just by changing value of “mailingAddressId” parameter to a different value, one could easily exploit the validation flaw of the website to display the Mailing Address and contact information of the respective user on the same webpage, as shown.
AliExpress WebSite Vulnerability Exposes Millions of Users' Private Information
A Smart attacker can simply gather personal information of millions of AliExpress users just by using an automated script to crawl “mailingAddress.htm” page for all possible numbers between 1 to 99999999999 as “mailingAddressId” parameter value.

The vulnerability has been reported to AliExpress team and will soon be patched in coming hours, researcher indicated.

Saturday, December 06, 2014

'DeathRing' Chinese Malware Found Pre-Installed On Several Smartphones
Malware authors are trying hard to create malicious software with more innovative ways to infect victims. A new mobile Trojan horse infection has been discovered by security researchers that comes pre-loaded onto low-cost Chinese-made Android smartphones popular in Asia and Africa.

The trojan, dubbed DeathRing, is a Chinese Trojan that masquerades as a ringtone app and comes pre-installed onto some cheap Android smartphones most popular in Asian and African countries including Vietnam, Indonesia, India, Nigeria, Taiwan, and China.

DeathRing malware app cannot be uninstalled or removed by the end user or by antimalware software because it comes pre-installed in the system directory of the handsets at an unknown point within the supply chain, making the threat even more severe.

WHAT DOES DEATHRING DO?
Though the malware pretends to be a genuine ringtone app, but actually downloads SMS and WAP content from its command-and-control server to the victim’s handset, which gives it potential to phish user’s sensitive data through fake text messages.
"DeathRing might use SMS content to phish victim’s personal information by fake text messages requesting the desired data," the security firm LookOut wrote in a blog post. "It may also use WAP, or browser, content to prompt victims to download further APKs - concerning given that the malware authors could be tricking people into downloading further malware that extends the adversary’s reach into the victim’s device and data."
AFFECTED SMARTPHONE HANDSETS
DeathRing malware pre-loaded on a number of entry-level phones sold by third-tier manufacturers to developing countries and according to the security firm, the handsets affected are:
  • Counterfeit Samsung GS4/Note II
  • A variety of TECNO devices
  • Gionee Gpad G1
  • Gionee GN708W
  • Gionee GN800
  • Polytron Rocket S2350
  • Hi-Tech Amaze Tab
  • Karbonn TA-FONE A34/A37
  • Jiayu G4S – Galaxy S4 clones,
  • Haier H7
  • a i9502+ Samsung clone by an unspecified manufacturer
However, DeathRing is not the first pre-installed mobile malware spotted by the firm. Earlier this year, LookOut discovered another pre-loaded piece of malware called Mouabad on devices sold by retailers in China, India, and the Philippines. Similar to DeathRing, Mouabad is also somewhere pre-loaded in the supply chain and affected predominantly Asian countries.

Friday, December 05, 2014

Sony Pictures Employees Receive Threatening Email After Hack
The massive hacking attack against Sony Pictures Entertainment have reached a totally unbelievable and scary phase as multiple media sources are saying that Sony Pictures employees received e-mails from hackers threatening to harm them and their family members.
Said one employee, "It's really crazy and scary."
It seems like matters for Sony Pictures is getting worse with time. Last month hacking attack on Sony Pictures Entertainment made the studio’s internal corporate systems offline and spewed confidential information onto the Internet. Hackers group that identifies itself as #GOP (Guardians of Peace) claimed responsibility for the hack and apparently stolen reams of internal corporate data as well.

Just a week after the cyber-attack on Sony Pictures Entertainment, high-quality versions of five newest films – Annie, Fury, Still Alice, Mr. Turner and To Write Love on Her Arms – distributed by Sony Pictures leaked online during Black Friday. Although it has not been confirmed that the leak of all the films came from the same breach, but the company suffering is the same.

However, it didn’t end up here!! Just last week, the massive data breach at Sony appeared to have exposed more sensitive documents, revealing the US Social Security numbers of more than 47,000 celebrities, freelancers, and current and former Sony employees.

And now, according to several media sources, employees at Sony Pictures Entertainment were sent threatening emails from the GOP group of hackers.
The e-mail was written in English that asked the company employees, "Please sign your name to object the false (sic) of the company at the email address below, if you don't want to suffer damage. If you don’t, not only you but your family will be in danger."
Sony Pictures is working with the Federal Bureau of Investigation (FBI) to investigate the whole matter. Till then, the employees at the Studio were told to turn off their phones after receiving this email messages.

As we reported earlier, there are some possibilities that hackers working on behalf of North Korea were behind the hacking incident, though the country denied it. But Sony believes that the cyber attack on its network is the payback for upcoming Kim Jong assassination comedy film, "The Interview," which is about two journalists who are recruited by the CIA to assassinate North Korean leader Kim Jong Un.

The FBI investigating the matter said that cyber criminals have used malicious software, Wiper malware, to launch destructive cyber-attacks including the one occurred at Sony Pictures Entertainment.

The full email send by hackers to the Studio’s employee reads:
"I am the head of GOP who made you worry. 
Removing Sony Pictures on earth is a very tiny work for our group which is a worldwide organization. And what we have done so far is only a small part of our further plan.It’s your false if you if you think this crisis will be over after some time. All hope will leave you and Sony Pictures will collapse. This situation is only due to Sony Pictures. Sony Pictures is responsible for whatever the result is. Sony Pictues clings to what is good to nobody from the beginning. It’s silly to expect in Sony Pictures to take off us. Sony Pictures makes only useless efforts. One beside you can be our member.

Many things beyond imagination will happen at many places of the world. Our agents find themselves act in necessary places. Please sign your name to object the false of the company at the email address below if you don’t want to suffer damage. If you don’t, not only you but your family will be in danger.

Nobody can prevent us, but the only way is to follow our demand. If you want to prevent us, make your company behave wisely."

Thursday, December 04, 2014

Operation Cleaver — Iranian hackers Targeting Critical Infrastructure Worldwide
For over past two years, Iranian hackers have infiltrated computer networks of some of the world's top organizations including airlines, defense contractors, universities, military installations, hospitals, airports, telecommunications firms, government agencies, and energy and gas companies, security researchers said.

An 87-page report published by the U.S. cyber security firm Cylance says Iranian state-sponsored hackers have hacked critical infrastructure of more than 50 organizations in 16 countries worldwide in a cyber-espionage campaign that could allow them to eventually cause physical damage. Among the targeted organizations, ten are reportedly based in the United States.

The threat-detection firm dubbed the campaign as "Operation Cleaver," which aimed at gathering data from various agencies. The group reportedly stole highly sensitive information and took control of networks in Canada, China, England, France, Germany, India, Israel, Kuwait, Mexico, Pakistan, Qatar, Saudi Arabia, South Korea, Turkey, the United Arab Emirates, and the U.S.

But what could be the exact motive of Iranian hackers behind this Operation Cleaver?? Well, Cylance firm suspects it is revenge from the US and Israel for developing the Stuxnet worm that infected Iran's nuclear program years ago, and launching espionage campaigns using Flame and Duqu malware.

In Operation Cleaver, the group uses its own custom software to hack critical infrastructure and pumped-up highly sensitive, confidential information from victims. They use SQL Injection, spear phishing, water-holing attacks and other methods in order to compromise the networks.
"We believe that if the operation is left to continue unabated, it is only a matter of time before the world's physical safety is impacted by it," the report said. "While the disclosure of this information will be a detriment to our ability to track the activity of this group, it will allow the security industry as a whole to defend against this threat."
According to the security researchers at the firm, so far the group has only focused on gathering intelligence, but it has the ability to launch cyber-attacks on their targets as well.

The research firm didn't exposed the individual companies, but a Reuters source listed these Corporations which includes California power company Calpine Corp, Saudi Arabia's petroleum and gas company Aramco, Mexican-state-owned Petroleos Mexicanos or Pemex, Qatar Airlines and Korean Air.

However, an Iranian spokesperson Hamid Babaei has denounced Cylance's report as a "baseless and unfounded allegation fabricated to tarnish the Iranian government image, particularly aimed at hampering current nuclear talks."

Iranian hackers group have collected a lot of information so far, according to researchers who managed in gaining access to some of the hackers' infrastructure finding"massive databases of user credentials and passwords, diagrams, and screenshots from organizations including energy, transportation, and aerospace companies, as well as universities.
"During intense intelligence gathering over the last 24 months, we observed the technical capabilities of the Operation Cleaver team rapidly evolve faster than any previously observed Iranian effort. As Iran's cyber warfare capabilities continue to morph, the probability of an attack that could impact the physical world at a national or global level is rapidly increasing," the report said.

Wednesday, December 03, 2014

Google's reCAPTCHA can tell if You're a Spambot or Human with Just a Click
Many a time we deal with those strange words and phrases that ask us to type them back in plaintext while signing up for an account. Yes, those increasingly annoying CAPTCHAs !!, which are both time-consuming and sometimes very difficult to read. If you really are tired of these distorted series of characters then there is a good news for you.

For the convenience of people, Google has re-introduced a new CAPTCHA system with full makeover called reCAPTCHA, in order to make it easy for users who squint their eyes and make errors while typing. This new CAPTCHA-like system will allow people into websites with only a single click.

CAPTCHA actually stands for "Completely Automated Public Turing test to tell Computers and Humans Apart" which is used by online services and websites only to verify that you're not a robot and restricts various automated programs to sign-up Email accounts, cracking passwords, spam sending, privacy violation etc.

However, now we’ll have a one-click solution for telling websites that we are, in fact, a human being. In place of CAPTCHA, now we'll have "No CAPTCHA reCAPTCHA" - just one checkbox that will say "I’m Not a Robot" next to it.

The search engine giant recently conducted a test which showed that sophisticated computer programs could fool the typical CAPTCHA 99.8 percent of the time, which means that it's been broken for a long time and most spammers are happy to run their scripts knowing just one in ten will slip through.
"While the new reCAPTCHA API may sound simple, there is a high degree of sophistication behind that modest checkbox," reads Google blog post. "CAPTCHAs have long relied on the inability of robots to solve distorted text. However, our research recently showed that today's Artificial Intelligence technology can solve even the most difficult variant of distorted text at 99.8% accuracy. Thus distorted text, on its own, is no longer a dependable test."
So, Google is rolling out the next generation of CAPTCHA, which doesn't resemble a CAPTCHA at all. Instead of seeing the old generation clunky CAPTCHA you're used to like this:
Google's reCAPTCHA can tell if You're a Spambot or Human with Just a Click
Users will now be presented with a checkbox that they can click with their mouse or, if they're on a mobile device, tap with a finger.
Google's reCAPTCHA can tell if You're a Spambot or Human with Just a Click
But here’s a Trick! After asking if you’re a bot, the "No CAPTCHA reCAPTCHA" API decides if it’s happy with your answer and if not, then you might be asked to input a CAPTCHA. So, No CAPTCHA is basically asking, and reCAPTCHA is, well, CAPTCHA itself.

The system uses image recognition as the method for thwarting bots. You might be met with a picture of a cat, then asked to select similar photos from a grid to verify you’re a human. The images on the grid araren'the same cat, but there are cats and humans understand cats are cats, and “match”. Bots don’t.

"No-CAPTCHA reCAPTCHA" is a powerful back-end algorithm, according to Google and the company is encouraging every websites that uses CAPTCHAs to switch to this new CAPTCHA system. The old API will remain active, and many sites may decline to upgrade, but the overall effect will be a great.

Already, many online services including Snapchat, WordPress and Humble Bundle have begun deploying the new No CAPTCHA reCAPTCHA to speed up humans through the verification process. Also given Google's reach, the move is likely to be widely adopted by hundreds of thousands of websites over the coming months.

I have written a PHP code example, How to use Google reCAPTCHA within your website.