Отправляет email-рассылки с помощью сервиса Sendsay

Антивирусы и безопасность (SaaS, Cloud ...)

Подписаться Бесплатная «Серебряная» новостная рассылка . Подписчиков 8.345 RSS
←   Апрель 2014   →
 1
01.04.2014
06:15:52
17:15:19
 2
02.04.2014
06:15:44
17:16:08
 3
 4
04.04.2014
06:15:38
17:16:15
 5
 6
 7
 8
08.04.2014
06:15:38
17:15:53
 9
09.04.2014
06:15:50
17:16:13
10
10.04.2014
06:15:48
17:15:56
11
11.04.2014
06:15:50
17:15:53
12
13
14
15
15.04.2014
06:15:40
17:16:36
16
16.04.2014
06:15:52
17:16:27
17
18
19
20
21
22
22.04.2014
06:15:47
17:16:28
23
23.04.2014
06:15:36
17:16:14
24
24.04.2014
06:15:45
17:16:35
25
25.04.2014
06:15:37
17:16:39
26
27
28
29
29.04.2014
06:15:18
17:25:25
30
30.04.2014
06:15:46
17:16:57


За последние 60 дней ни разу не выходила


Сайт рассылки: http://av-host.net
Открыта: 09-03-2012

Автор
kmm

Статистика

8.345 подписчиков
0 за неделю
←   Все выпуски   →

The Heartbleed Bug: A Critical Vulnerability in OpenSSL


Антивирусный "хостинг"

Клуб пользователей антивирусных услуг (Saas, Cloud)

добавить на Яндекс
Антивирусы и безопасность (SaaS, Cloud ...)
av-host.net

The Heartbleed Bug: A Critical Vulnerability in OpenSSL
2014-04-08 21:18

KMM поделился ссылкой

The Heartbleed Bug: A Critical Vulnerability in OpenSSL

heartbleedIndependent researchers have discovered a critical vulnerability in the widely popular cryptographic software library, OpenSSL. As stated by the discovering parties, this vulnerability “allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software.”

What Has Been Compromised?

According to researchers, exploitation of CVE-2014-0160, or the Heartbleed Bug, allows attackers to steal:

  1. Primary Key Material - These are the secret keys that allow websites to unlock the encrypted information their users send during transmissions secured by TLS/SSL.
  2. Secondary Key Material - These are user credentials transferred in TLS/SSL transmissions, such as usernames and passwords.
  3. Protected Content – This is the content that is transferred during a TLS/SSL transmission and that is supposed to be protected by cryptographic secret keys. This is alarming because most encrypted data – such as financial information – is encrypted because it is sensitive.
  4. Collateral – This is all of the technical information related to an OpenSSL user account, such as memory addresses and user specific security settings.

How Can I Fix This?

Anyone using OpenSSL 1.0.1 through 1.0.1f (inclusive) is vulnerable, and needs to upgrade to OpenSSL 1.0.1g immediately. If this is not possible, users may also recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.

It is also crucial to invalidate all compromised primary and secondary key material with your Certificate Authority. Although the Heartbleed bug was discovered by independent security researchers at Codenomicon, the vulnerability had actually been out in the wild since March 14th, 2012. No one knows if Heartbleed was exploited during that time, and even if it was the nature of the vulnerability allows attackers to hide all evidence of memory access.

What is most alarming is that OpenSSL is the most popular open source cryptographic security service in use on the Internet today. Combined with its time in the wild of over 2 years, Heartbleed may have compromised a massive amount of information — or, it might not have compromised anything at all. The true extent of the breach really depends on whether anyone else knew about Heartbleed. Now that the vulnerability has been made public, service providers using an affected version of OpenSSL absolutely must address the issue; otherwise, all the information on their server will remain at high risk of compromise.

Where Can I Find More Information?

Codenomicon has published a detailed treatment of Heartbleed at http://heartbleed.com/

There readers may find official information about the bug, how to get rid of  it, and additional links to commentary from other authorities, including statements from Cloudfare, The Tor Project, and Ubuntu.

Have a nice (malware-free) day.



New Zeus Variant with Digital Certificate
2014-04-09 01:17

KMM поделился ссылкой

New Zeus Variant with Digital Certificate

blog_zeuszert

Reports indicate that Zeus has struck again – this time adding a fraudulent digital certificate to its bag of tricks.

Like its predecessors, the financial Trojan is being dropped by malicious email attachments and drive-by downloads. Installation is initiated when users double-click an icon that appears on the desktop and that is made to look like an innocent Internet Explorer document. Users who initiate install are subsequently infected by both a malware that can allow its author to snag information from online financial transactions through “Man-in-the-Middle” attacks and a rootkit designed to hide said malware.

If this sounds pretty nasty, what’s even worse is that this nothing new! Zeus has been around for quite some time, and in fact in 2013 it was responsible for approximately one-third of all computerized attacks on financial institutions. This particular variant has made recent headlines however because it adds a little extra trick that contributes to its already deceptive design.

A Fraudulent Digital Certificate

Legitimate software developers utilize digital certificates to validate their identity and to prove that they are not creating malware or perpetuating scams. The most common way to create a Digital Certificate is with Public Key Infrastructure (PKI). With PKI, Certificate Authorities (CAs) issue certification to software vendors after the vendors have verified their identity and proven that their product is not malicious. The Certificate Authority signs this certification with their unique, cryptographic “digital signature” and keeps a record of this certification on file.

A software that is “Digitally Certified” is therefore supposed to be a software created by a legitimate developer that has passed a Certificate Authority’s set of standards. As malware, one would think that this new variant of Zeus would be flat out denied certification, and in a perfect world, it very well would have been. Certificate Authorization is a sprawling business, however, and many of the largest players distribute their certificates through retailers. As a result, certificates leak through, as monitoring the behavior of each and every retailer is quite impossible. In fact, in malware-land, digital certificates are bought and sold on a regular basis, and applying them to malware is really nothing new. That a new variant of Zeus uses one isn’t all that surprising, however to the untrained eye it can be deceptive.

To the average user, who is not running a comprehensive anti-malware, adding a real Digital Certificate to a malicious program basically works like a fake ID. Imagine your computer is a party and you are the doorman. With this new Zeus, the appearance of what looks like a new Internet Explorer document on your desktop raises suspicion, so you ask for Identification. Your skepticism leads you to Right Click > Properties > Digital Signatures, and voila: The Document is Certified by a Trusted CA. Combine this with the curiosity one is bound to have upon the appearance of something new and mysterious on their desktop, and even the most tech-savvy among us are tempted to Double-Click.

Where the author of this particular Zeus variant obtained a fraudulent certificate is really anybody’s guess. The most important thing to realize here is that this an all too common social engineering tactic and that relying on Digital Certification alone as a means of preventing malware infection simply doesn’t cut it.

A Bit More on Encryption – Man-in-the-Middle Attacks

Multiple variants of Zeus have seen success because they utilize man-in-the-middle attacks. Like Digital Certification, a man-in-the-middle attack is related to cryptography. This is a highly technical arena, however at its basis cryptography relies on pairs of keys and really is not too difficult to understand.

Say for example you want to perform a secure, encrypted transaction with your bank, online. Your bank will send you what is known as a public key to encrypt all data that you send them during the transaction. A public key is essentially a lock, and it can only be opened by the person who holds the matching, private key.

Stealing a private key from a bank would be quite the feat indeed, so instead malware authors use man-in-the-middle attacks. Malware like Zeus is designed to “wake up” when an infected user engages communication with their banking website and requests a public key for data encryption. Zeus is designed to intercept this request and send the user a fake public key, instead. That way, when the user sends what they think is encrypted information to their bank, they are actually sending encrypted information to the attacker – and the attacker, having used his own public key, can open it with his matching, private key and take a look inside.

Protecting Yourself from Zeus, Be He Certified or Not

Much of the press surrounding this latest variant of Zeus has focused on its legitimate Digital Certificate and how this might allow it to bypass antivirus software. Certified or not, Emsisoft Anti-Malware detects malware from the Zbot/Zeus family as Trojan.Win32.Zbot.

Additionally, users should remain extremely cautious with mysterious desktop icons of any kind and unsolicited banking emails with attachments and links. If you are worried that you may have become a victim of this latest exploit, please don’t hesitate to contact our experts in the “Help, my PC is infected!” Emsisoft Forum. Our removal service is free, even if you are not an Emsisoft customer yet.

Now that you know a little bit more about cryptography, we might also suggest our recent post on the OpenSSL Heartbleed Bug. Researchers have uncovered a massive vulnerability that allows anyone on the Internet to accesses OpenSSL secured servers and steal encrypted information, including private keys. This bug went undetected for over 2 years, and very well may change open source encryption technology forever.

Have a Great (Zeus-Free) Day!
В избранное