Vulnerabilities / Threats
09:15 AM

Microsoft Fights Flame Malware With Certificate Killer

Flame malware spoofed a Microsoft digital certificate to automatically install itself on targeted PCs, leading Microsoft to tweak Windows to receive a daily update listing untrusted certificates.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
Flame malware includes a killer feature: It can install whole copies of itself on targeted Windows PCs, using built-in Windows Update functionality. The culprit was the malware's ability to spoof a Microsoft digital certificate, thus tricking Windows into thinking that the malware code was legitimate.

In response, Microsoft Wednesday released an automatic updater--available for Windows Vista, Windows 7, as well as Windows Server 2008 and 2008 R2--that keeps tabs on a list of known-bad digital certificates, including the one exploited by Flame. "This updater expands on the existing automatic root update mechanism technology that is found in Windows Vista and in Windows 7 to let certificates that are compromised or are untrusted in some way be specifically flagged as untrusted," according to Microsoft's related update notes.

"The goal of the new updater is to allow for updates to the untrusted certificate store in one day--or less--after a new bad certificate is known," said SANS Institute chief research officer Johannes B. Ullrich in a blog post. "A [bit] sad that we need this, but it does appear to be necessary to have a method to continuously update a bad certificate [list]," not least to stop malware of the Flame variety.

[ How did Flame work? Read Flame Malware Tapped World Class Crypto. ]

Revoking bad digital certificates is a tricky business. One approach has been to use a certificate revocation list (CRL), which includes the serial numbers of all certificates that have been revoked and should no longer be trusted. Meanwhile, Microsoft had also relied on the Online Certificate Status Protocol (OCSP), which is an Internet protocol used to set the revocation status of an X.509 digital certificate.

But neither CRL or OCSP are perfect. "Key revocation lists and OCSP were designed to notify clients of revoked certificates," said Ullrich. "However, these protocols haven't shown the scalability necessary to reliably notify clients of invalid certificates."

Indeed, revoking bad certificates typically required Windows administrators to manually tweak the Windows Untrusted Certificate Store, or else Microsoft had to push certificate updates via Windows Update. By comparison, "this new automatic updater will enable Certificate Authorities to report information about their revoked CA certificates to Microsoft and have them publicly untrusted in a much faster manner, as compared to propagating this information by using CRLs," according to a blog post from Microsoft's Kurt Hudson.

Some small infrastructure tweaks might be necessary to make the updater work in enterprise environments. In particular, any firewalls containing hardcoded URLs for Windows Update will need to see their settings edited to allow for the new disallowed and allowed CTLs. "As part of this update, the URLs that are used for contacting Windows Update to download the untrusted and trusted CTLs were changed. This could cause problems for enterprises that hardcode these URLs in their firewalls as exceptions," noted Microsoft.

Meanwhile, in other Microsoft-related security news, the company warned Tuesday of an unpatched vulnerability in Microsoft XML (MSXML) Core Services--now being actively exploited in the wild--that allows attackers to execute arbitrary code on a compromised PC. According to Microsoft's security advisory, "the vulnerability exists when MSXML attempts to access an object in memory that has not been initialized, which may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user."

"MSXML provides a set of W3C-compliant XML APIs which allows users to use [JavaScript], VBScript, and Microsoft development tools to develop XML 1.0 standard applications," said Pavithra Hanchagaiah, a senior security researcher at Trend Micro, in a blog post.

"An attacker can craft ... websites to host a malicious Web page invoking affected MSXML APIs, which in turn accesses a COM object in memory that has not been initialized," Hanchagaiah said. "The vulnerability is exploited when a user opens these crafted Web pages using IE."

According to Microsoft, "an attacker who successfully exploited this vulnerability could gain the same user rights as the logged on user," meaning that users with administrative-level access rights are more at risk from this type of attack. It said the likeliest attack vectors using this vulnerability would be phishing emails, or links sent via instant messages.

According to news reports, the attack has already been used to compromise multiple Gmail accounts. Google, meanwhile, appears to have begun warning people targeted by the exploit that "state-sponsored attackers may be attempting to compromise your account or computer."

The vulnerability affects all versions of Windows, as well as Microsoft Office versions 2003 SP3, 2007 SP2, and 2007 SP3. But Microsoft said that by default, Internet Explorer on Windows Server 2003, 2008, and 2008 R2 "runs in a restricted mode that is known as Enhanced Security Configuration," which would block the attack from working on those systems.

While no automatic patch is yet available, Microsoft said it's released a "fix it" solution.

Employees and their browsers might be the weak link in your security plan. The new, all-digital Endpoint Insecurity Dark Reading supplement shows how to strengthen them. (Free registration required.)

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.