Vulnerabilities / Threats
6/14/2012
09:15 AM
50%
50%

Microsoft Fights Flame Malware With Certificate Killer

Flame malware spoofed a Microsoft digital certificate to automatically install itself on targeted PCs, leading Microsoft to tweak Windows to receive a daily update listing untrusted certificates.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
Flame malware includes a killer feature: It can install whole copies of itself on targeted Windows PCs, using built-in Windows Update functionality. The culprit was the malware's ability to spoof a Microsoft digital certificate, thus tricking Windows into thinking that the malware code was legitimate.

In response, Microsoft Wednesday released an automatic updater--available for Windows Vista, Windows 7, as well as Windows Server 2008 and 2008 R2--that keeps tabs on a list of known-bad digital certificates, including the one exploited by Flame. "This updater expands on the existing automatic root update mechanism technology that is found in Windows Vista and in Windows 7 to let certificates that are compromised or are untrusted in some way be specifically flagged as untrusted," according to Microsoft's related update notes.

"The goal of the new updater is to allow for updates to the untrusted certificate store in one day--or less--after a new bad certificate is known," said SANS Institute chief research officer Johannes B. Ullrich in a blog post. "A [bit] sad that we need this, but it does appear to be necessary to have a method to continuously update a bad certificate [list]," not least to stop malware of the Flame variety.

[ How did Flame work? Read Flame Malware Tapped World Class Crypto. ]

Revoking bad digital certificates is a tricky business. One approach has been to use a certificate revocation list (CRL), which includes the serial numbers of all certificates that have been revoked and should no longer be trusted. Meanwhile, Microsoft had also relied on the Online Certificate Status Protocol (OCSP), which is an Internet protocol used to set the revocation status of an X.509 digital certificate.

But neither CRL or OCSP are perfect. "Key revocation lists and OCSP were designed to notify clients of revoked certificates," said Ullrich. "However, these protocols haven't shown the scalability necessary to reliably notify clients of invalid certificates."

Indeed, revoking bad certificates typically required Windows administrators to manually tweak the Windows Untrusted Certificate Store, or else Microsoft had to push certificate updates via Windows Update. By comparison, "this new automatic updater will enable Certificate Authorities to report information about their revoked CA certificates to Microsoft and have them publicly untrusted in a much faster manner, as compared to propagating this information by using CRLs," according to a blog post from Microsoft's Kurt Hudson.

Some small infrastructure tweaks might be necessary to make the updater work in enterprise environments. In particular, any firewalls containing hardcoded URLs for Windows Update will need to see their settings edited to allow for the new disallowed and allowed CTLs. "As part of this update, the URLs that are used for contacting Windows Update to download the untrusted and trusted CTLs were changed. This could cause problems for enterprises that hardcode these URLs in their firewalls as exceptions," noted Microsoft.

Meanwhile, in other Microsoft-related security news, the company warned Tuesday of an unpatched vulnerability in Microsoft XML (MSXML) Core Services--now being actively exploited in the wild--that allows attackers to execute arbitrary code on a compromised PC. According to Microsoft's security advisory, "the vulnerability exists when MSXML attempts to access an object in memory that has not been initialized, which may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user."

"MSXML provides a set of W3C-compliant XML APIs which allows users to use [JavaScript], VBScript, and Microsoft development tools to develop XML 1.0 standard applications," said Pavithra Hanchagaiah, a senior security researcher at Trend Micro, in a blog post.

"An attacker can craft ... websites to host a malicious Web page invoking affected MSXML APIs, which in turn accesses a COM object in memory that has not been initialized," Hanchagaiah said. "The vulnerability is exploited when a user opens these crafted Web pages using IE."

According to Microsoft, "an attacker who successfully exploited this vulnerability could gain the same user rights as the logged on user," meaning that users with administrative-level access rights are more at risk from this type of attack. It said the likeliest attack vectors using this vulnerability would be phishing emails, or links sent via instant messages.

According to news reports, the attack has already been used to compromise multiple Gmail accounts. Google, meanwhile, appears to have begun warning people targeted by the exploit that "state-sponsored attackers may be attempting to compromise your account or computer."

The vulnerability affects all versions of Windows, as well as Microsoft Office versions 2003 SP3, 2007 SP2, and 2007 SP3. But Microsoft said that by default, Internet Explorer on Windows Server 2003, 2008, and 2008 R2 "runs in a restricted mode that is known as Enhanced Security Configuration," which would block the attack from working on those systems.

While no automatic patch is yet available, Microsoft said it's released a "fix it" solution.

Employees and their browsers might be the weak link in your security plan. The new, all-digital Endpoint Insecurity Dark Reading supplement shows how to strengthen them. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.