Vulnerabilities / Threats
6/14/2012
09:15 AM
50%
50%

Microsoft Fights Flame Malware With Certificate Killer

Flame malware spoofed a Microsoft digital certificate to automatically install itself on targeted PCs, leading Microsoft to tweak Windows to receive a daily update listing untrusted certificates.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
Flame malware includes a killer feature: It can install whole copies of itself on targeted Windows PCs, using built-in Windows Update functionality. The culprit was the malware's ability to spoof a Microsoft digital certificate, thus tricking Windows into thinking that the malware code was legitimate.

In response, Microsoft Wednesday released an automatic updater--available for Windows Vista, Windows 7, as well as Windows Server 2008 and 2008 R2--that keeps tabs on a list of known-bad digital certificates, including the one exploited by Flame. "This updater expands on the existing automatic root update mechanism technology that is found in Windows Vista and in Windows 7 to let certificates that are compromised or are untrusted in some way be specifically flagged as untrusted," according to Microsoft's related update notes.

"The goal of the new updater is to allow for updates to the untrusted certificate store in one day--or less--after a new bad certificate is known," said SANS Institute chief research officer Johannes B. Ullrich in a blog post. "A [bit] sad that we need this, but it does appear to be necessary to have a method to continuously update a bad certificate [list]," not least to stop malware of the Flame variety.

[ How did Flame work? Read Flame Malware Tapped World Class Crypto. ]

Revoking bad digital certificates is a tricky business. One approach has been to use a certificate revocation list (CRL), which includes the serial numbers of all certificates that have been revoked and should no longer be trusted. Meanwhile, Microsoft had also relied on the Online Certificate Status Protocol (OCSP), which is an Internet protocol used to set the revocation status of an X.509 digital certificate.

But neither CRL or OCSP are perfect. "Key revocation lists and OCSP were designed to notify clients of revoked certificates," said Ullrich. "However, these protocols haven't shown the scalability necessary to reliably notify clients of invalid certificates."

Indeed, revoking bad certificates typically required Windows administrators to manually tweak the Windows Untrusted Certificate Store, or else Microsoft had to push certificate updates via Windows Update. By comparison, "this new automatic updater will enable Certificate Authorities to report information about their revoked CA certificates to Microsoft and have them publicly untrusted in a much faster manner, as compared to propagating this information by using CRLs," according to a blog post from Microsoft's Kurt Hudson.

Some small infrastructure tweaks might be necessary to make the updater work in enterprise environments. In particular, any firewalls containing hardcoded URLs for Windows Update will need to see their settings edited to allow for the new disallowed and allowed CTLs. "As part of this update, the URLs that are used for contacting Windows Update to download the untrusted and trusted CTLs were changed. This could cause problems for enterprises that hardcode these URLs in their firewalls as exceptions," noted Microsoft.

Meanwhile, in other Microsoft-related security news, the company warned Tuesday of an unpatched vulnerability in Microsoft XML (MSXML) Core Services--now being actively exploited in the wild--that allows attackers to execute arbitrary code on a compromised PC. According to Microsoft's security advisory, "the vulnerability exists when MSXML attempts to access an object in memory that has not been initialized, which may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user."

"MSXML provides a set of W3C-compliant XML APIs which allows users to use [JavaScript], VBScript, and Microsoft development tools to develop XML 1.0 standard applications," said Pavithra Hanchagaiah, a senior security researcher at Trend Micro, in a blog post.

"An attacker can craft ... websites to host a malicious Web page invoking affected MSXML APIs, which in turn accesses a COM object in memory that has not been initialized," Hanchagaiah said. "The vulnerability is exploited when a user opens these crafted Web pages using IE."

According to Microsoft, "an attacker who successfully exploited this vulnerability could gain the same user rights as the logged on user," meaning that users with administrative-level access rights are more at risk from this type of attack. It said the likeliest attack vectors using this vulnerability would be phishing emails, or links sent via instant messages.

According to news reports, the attack has already been used to compromise multiple Gmail accounts. Google, meanwhile, appears to have begun warning people targeted by the exploit that "state-sponsored attackers may be attempting to compromise your account or computer."

The vulnerability affects all versions of Windows, as well as Microsoft Office versions 2003 SP3, 2007 SP2, and 2007 SP3. But Microsoft said that by default, Internet Explorer on Windows Server 2003, 2008, and 2008 R2 "runs in a restricted mode that is known as Enhanced Security Configuration," which would block the attack from working on those systems.

While no automatic patch is yet available, Microsoft said it's released a "fix it" solution.

Employees and their browsers might be the weak link in your security plan. The new, all-digital Endpoint Insecurity Dark Reading supplement shows how to strengthen them. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2208
Published: 2014-12-28
CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n (newline) character before the end of a string.

CVE-2014-2209
Published: 2014-12-28
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.

CVE-2014-5386
Published: 2014-12-28
The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initial...

CVE-2014-6228
Published: 2014-12-28
Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted arguments to the chunk_split ...

CVE-2014-6229
Published: 2014-12-28
The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string,...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.