Category Archives: Security Response News

?????????????Microsoft Patch Tuesday?- 2014 ? 4 ?

      No Comments on ?????????????Microsoft Patch Tuesday?- 2014 ? 4 ?

今月のマイクロソフトパッチリリースブログをお届けします。今月は、11 件の脆弱性を対象として 4 つのセキュリティ情報がリリースされています。このうち 7 件が「緊急」レベルです。

いつものことですが、ベストプラクティスとして以下のセキュリティ対策を講じることを推奨します。

  • ベンダーのパッチが公開されたら、できるだけ速やかにインストールする。
  • ソフトウェアはすべて、必要な機能を使える最小限の権限で実行する。
  • 未知の、または疑わしいソースからのファイルは扱わない。
  • 整合性が未知の、または疑わしいサイトには絶対にアクセスしない。
  • 特定のアクセスが必要な場合を除いて、ネットワークの周辺部では重要なシステムへの外部からのアクセスを遮断する。

マイクロソフトの 4 月のリリースに関する概要は、次のページで公開されています。
http://technet.microsoft.com/ja-jp/security/bulletin/ms14-apr

今月のパッチで対処されている問題の一部について、詳しい情報を以下に示します。

  1. MS14-017 Microsoft Word および Office Web Apps の脆弱性により、リモートでコードが実行される（2949660）

    Microsoft Office File Format Converter の脆弱性（CVE-2014-1757）MS の深刻度: 重要

    Microsoft Office ソフトウェアが、特別に細工されたファイルを変換する方法に、リモートコード実行の脆弱性が存在します。攻撃者がこの脆弱性の悪用に成功すると、現在のユーザーとして任意のコードを実行できる場合があります。現在のユーザーが管理者ユーザー権限でログオンしている場合は、影響を受けるシステムを攻撃者が完全に制御する可能性があります。攻撃者はその後、プログラムのインストール、データの表示、変更、削除、完全なユーザー権限を持つ新しいアカウントの作成ができる場合があります。

    Microsoft Word のスタックオーバーフローの脆弱性（CVE-2014-1758）MS の深刻度: 重要

    Microsoft Word が、特別に細工されたファイルを解析する方法に、リモートコード実行の脆弱性が存在します。攻撃者がこの脆弱性の悪用に成功すると、現在のユーザーとして任意のコードを実行できる場合があります。現在のユーザーが管理者ユーザー権限でログオンしている場合は、影響を受けるシステムを攻撃者が完全に制御する可能性があります。攻撃者はその後、プログラムのインストール、データの表示、変更、削除、完全なユーザー権限を持つ新しいアカウントの作成ができる場合があります。

    Word RTF のメモリ破損の脆弱性（CVE-2014-1761）MS の深刻度: 緊急

    Microsoft Word が、特別に細工されたファイルを解析する方法に、リモートコード実行の脆弱性が存在します。攻撃者がこの脆弱性の悪用に成功すると、現在のユーザーとして任意のコードを実行できる場合があります。現在のユーザーが管理者ユーザー権限でログオンしている場合は、影響を受けるシステムを攻撃者が完全に制御する可能性があります。攻撃者はその後、プログラムのインストール、データの表示、変更、削除、完全なユーザー権限を持つ新しいアカウントの作成ができる場合があります。

  2. MS14-018 Internet Explorer 用の累積的なセキュリティ更新プログラム（2950467）

    Internet Explorer のメモリ破損の脆弱性（CVE-2014-0235）MS の深刻度: 緊急

    Internet Explorer のメモリ内のオブジェクトへのアクセスが不適切な場合に、リモートコード実行の脆弱性が存在します。この脆弱性によってメモリが破損し、攻撃者が現在のユーザーのコンテキストで任意のコードを実行できる場合があります。

    Internet Explorer のメモリ破損の脆弱性（CVE-2014-1751）MS の深刻度: 緊急

    Internet Explorer のメモリ内のオブジェクトへのアクセスが不適切な場合に、リモートコード実行の脆弱性が存在します。この脆弱性によってメモリが破損し、攻撃者が現在のユーザーのコンテキストで任意のコードを実行できる場合があります。

    Internet Explorer のメモリ破損の脆弱性（CVE-2014-1752）MS の深刻度: 緊急

    Internet Explorer のメモリ内のオブジェクトへのアクセスが不適切な場合に、リモートコード実行の脆弱性が存在します。この脆弱性によってメモリが破損し、攻撃者が現在のユーザーのコンテキストで任意のコードを実行できる場合があります。

    Internet Explorer のメモリ破損の脆弱性（CVE-2014-1753）MS の深刻度: 緊急

    Internet Explorer のメモリ内のオブジェクトへのアクセスが不適切な場合に、リモートコード実行の脆弱性が存在します。この脆弱性によってメモリが破損し、攻撃者が現在のユーザーのコンテキストで任意のコードを実行できる場合があります。

    Internet Explorer のメモリ破損の脆弱性（CVE-2014-1755）MS の深刻度: 緊急

    Internet Explorer のメモリ内のオブジェクトへのアクセスが不適切な場合に、リモートコード実行の脆弱性が存在します。この脆弱性によってメモリが破損し、攻撃者が現在のユーザーのコンテキストで任意のコードを実行できる場合があります。

    Internet Explorer のメモリ破損の脆弱性（CVE-2014-1760）MS の深刻度: 緊急

    Internet Explorer のメモリ内のオブジェクトへのアクセスが不適切な場合に、リモートコード実行の脆弱性が存在します。この脆弱性によってメモリが破損し、攻撃者が現在のユーザーのコンテキストで任意のコードを実行できる場合があります。

  3. MS14-019 Windows のファイル操作コンポーネントの脆弱性により、リモートでコードが実行される（2922229）

    Windows のファイル操作の脆弱性（CVE-2014-0315）MS の深刻度: 重要

    Microsoft Windows が外部ネットワークから実行される .bat ファイルや .cmd ファイルを処理する方法に、リモートコード実行の脆弱性が存在します。攻撃者がこの脆弱性の悪用に成功すると、影響を受けるシステムを完全に制御できる恐れがあります。攻撃者はその後、プログラムのインストール、データの表示、変更、削除、完全なユーザー権限を持つ新しいアカウントの作成ができる場合があります。システムでのユーザー権限が低い設定のアカウントを持つユーザーは、管理者のユーザー権限で実行しているユーザーよりもこの脆弱性による影響が少ないと考えられます。

  4. MS14-020 Microsoft Publisher の脆弱性により、リモートでコードが実行される（2950145）

    任意のポインタ逆参照の脆弱性（CVE-2014-1759）MS の深刻度: 重要

    Microsoft Publisher が、特別に細工されたファイルを解析する方法に、リモートコード実行の脆弱性が存在します。攻撃者がこの脆弱性の悪用に成功すると、現在のユーザーとして任意のコードを実行できる場合があります。現在のユーザーが管理者ユーザー権限でログオンしている場合は、影響を受けるシステムを攻撃者が完全に制御する可能性があります。攻撃者はその後、プログラムのインストール、データの表示、変更、削除、完全なユーザー権限を持つ新しいアカウントの作成ができる場合があります。

今月対処されている脆弱性についての詳しい情報は、シマンテックが無償で公開している SecurityFocus ポータルでご覧いただくことができ、製品をご利用のお客様は DeepSight Threat Management System を通じても情報を入手できます。

 

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

Heartbleed ??, ??? ???? ?? ??? ??? ??

      No Comments on Heartbleed ??, ??? ???? ?? ??? ??? ??

가장 많이 사용되는 SSL 및 TLS 암호화 프로토콜 중 하나인 OpenSSL에서 새로 발견된 취약점이 패치가 설치되지 않은 서버에 즉각적이고 심각한 위험으로 작용하고 있습니다. “Heartbleed(하트블리드)”라고 불리는 이 버그를 이용하면 공격자가 보안 통신을 가로채서 로그인 인증 정보, 개인 데이터, 심지어 암호 해독 키와 같은 중요 정보를 훔쳐낼 수 있습니다.

Heartbleed, 즉 OpenSSL TLS ‘하트비트’ 익스텐션 정보 공개 취약점(CVE-2014-0160)은 하트비트라는 OpenSSL의 구성 요소에 영향을 미칩니다. OpenSSL은 보편적으로 사용되는 SSL(Secure Sockets Layer) 및 TLS(Transport Layer Security) 프로토콜의 오픈 소스 기술 중 하나입니다.

하트비트는 TLS 프로토콜의 익스텐션으로 실제 통신이 얼마 동안 이루어지지 않았더라도 TLS 세션이 활성 상태를 유지하게 해줍니다. 이 기능으로 두 시스템이 계속 연결되어 있고 통신 가능한 상태임을 확인할 수 있습니다. 또한 최초 연결이 끊긴 경우 사용자가 다시 보안 연결을 설정하기 위해 인증 정보를 다시 입력해야 하는 수고를 덜어줍니다.

그렇다면 하트비트는 어떻게 작동할까요? 하트비트가 OpenSSL 서버로 메시지를 보내면, 이 서버에서 다시 해당 메시지를 발신자에게 전달하여 연결을 확인합니다. 이 메시지는 최대 64KB의 페이로드라는 데이터 패킷과 이러한 페이로드의 크기에 대한 정보, 이 두 가지 구성 요소로 이루어집니다.

그러나 OpenSSL의 Heartbleed 취약점을 이용하면 공격자가 페이로드 크기에 대한 정보를 스푸핑할 수 있습니다. 이를테면 크기가 1KB에 불과한 페이로드를 보내면서 64KB라고 하는 것입니다.

이렇듯 OpenSSL 서버에서 잘못된 형식의 하트비트 메시지를 처리하는 방식이 바로 이 취약점으로 야기되는 위험성입니다. OpenSSL 서버에서는 실제로 페이로드가 메시지 표시된 크기와 같은 크기인지 확인하려 하지 않습니다. 대신 페이로드가 정확한 크기일 것으로 가정하고 해당 페이로드를 전송했던 시스템으로 다시 보내려고 시도합니다. 하지만 실제로는 페이로드에 64KB의 데이터가 들어 있지 않으므로 애플리케이션 메모리에서 이 페이로드의 옆에 저장된 데이터로 페이로드를 자동으로 채우게 됩니다. 따라서 서버에서 1KB의 페이로드를 받은 경우 메모리에 저장되어 있던 63KB의 다른 데이터를 함께 보내는 것입니다. 여기에는 사용자의 로그인 인증 정보, 개인 데이터, 경우에 따라서는 세션 및 개인 암호화 키까지 포함될 수 있습니다.

애플리케이션에서 다시 보내는 데이터는 무작위이므로 공격자가 쓸모없거나 부분적인 데이터를 받을 가능성도 있습니다. 하지만 이 취약점의 특성상 반복적인 공격이 가능하므로, 차츰 공격자가 애플리케이션에 의해 저장된 데이터를 보다 폭넓게 파악할 수 있게 됩니다.

아마도 이 공격으로 훔쳐내기 가장 힘든 정보는 개인 암호화 키일 것입니다. 데이터는 순차적으로 저장되므로 새로운 데이터가 오래된 데이터의 앞에 저장됩니다. 암호화 키는 대개 메모리에서 페이로드의 뒤에 저장되므로 액세스될 가능성이 더 낮습니다. 유출될 가능성이 가장 높은 데이터 유형은 최신 SSL/TLS 세션의 컨텐트입니다.

Heartbleed 버그는 올해 발견된 SSL/TLS 취약점 중 가장 최근에 나타난 것입니다. TLS와 그 전 세대 격인 SSL 모두 인터넷 통신용 보안 프로토콜로, 두 시스템을 오가는 트래픽을 암호화하는 방식입니다.

지난 2월 Apple은 자사 소프트웨어의 SSL에 영향을 주는 두 가지 중대한 취약점에 대한 패치를 배포했습니다. 첫 번째는 모바일 운영 체제인 iOS의 업데이트로, 공격자가 네트워크에 대해 특별한 권한을 가지고 SSL/TLS로 보호되는 세션의 데이터를 획득하거나 수정할 수 있게 하는 문제점을 해결한 것이었습니다. 며칠 후 발표된 두 번째 업데이트는 데스크탑 운영 체제인 OS X을 위한 패치였는데, 이 운영 체제 역시 동일한 취약점의 영향을 받는다는 사실이 밝혀졌기 때문입니다.

3월에는 보안 라이브러리 GnuTLS에서 인증서 취약점이 발견되었으며, 이 라이브러리는 Red Hat 데스크탑 및 서버 제품, Ubuntu 및 Debian 디스트리뷰션 등 다수의 Linux 운영 체제 버전에서 사용됩니다.

GnuTLS는 SSL/TLS의 오픈 소스 소프트웨어 기술 중 하나입니다. 이 취약점 때문에 GnuTLS에서 보안 인증서 확인 시 발생할 수 있는 몇 가지 오류를 제대로 해결하지 못했습니다. 그로 인해 공격자가 만든 특수 인증서를 이용하여 GnuTLS에서 악성 웹 사이트를 인증하도록 유도할 수 있습니다. 이 취약점에 대한 패치는 GnuTLS에서 즉시 배포했습니다.

Heartbleed는 근래 밝혀진 SSL/TLS 취약점 중 가장 심각한 유형입니다. 이 취약점은 특성상 그리고 이 버그가 가장 널리 사용되는 SSL/TLS 기술에 영향을 미친다는 사실 때문에 심각한 문제를 일으킬 수 있습니다.

기업 사용자를 위한 시만텍 권고 사항:

  • Heartbleed는 OpenSSL 라이브러리의 취약점으로, SSL/TLS 또는 시만텍에서 발급하는 인증서의 결함이 아닙니다.
  • OpenSSL 1.0.1~1.0.1f 사용자는 반드시 이 소프트웨어의 최신 수정 버전(1.0.1g)으로 업데이트하거나 하트 비트 익스텐션 없이 OpenSSL을 다시 컴파일해야 합니다.
  • 수정된 OpenSSL 버전으로 교체한 다음에는 이미 웹 서버 인증서가 이 취약점의 익스플로잇으로 손상되었거나 도용되었을 가능성이 있다면 인증 기관에 연락하여 인증서를 교체하십시오.
  • 공격받은 서버 메모리에서 유출되었을 수 있는 엔드유저 암호를 재설정하는 것을 권장합니다.

개인 사용자를 위한 시만텍 권고 사항:

  • 취약한 서비스 제공업체를 이용했다면 귀하의 데이터가 타인에게 유출되었을 수 있습니다.
  • 귀하가 이용하는 벤더나 업체들로부터 관련 공지 사항이 있는지 확인합니다. 취약한 벤더가 고객에게 암호를 변경해야 한다는 안내를 받으면 그에 따라 암호를 변경해야 합니다.
  • 공격자가 암호를 업데이트하라는 내용의 피싱 이메일이 있을 수 있으니 주의해야 합니다. 위장 웹 사이트 접속을 방지하기 위해 공식적인 사이트 도메인만 이용합니다.
  • 신뢰할 수 웹 사이트와 서비스만 이용합니다. 이러한 사이트들은 취약점 문제에 즉각적으로 대처했을 가능성이 높습니다.
  • 은행 및 신용 카드 거래 명세서에 의심스러운 항목이 있는지 확인하십시오.

 

2014년 4월 10일 업데이트: 시만텍의 SSL Tools Certificate Checker를 통해 웹 사이트가 익스플로잇에 취약한지 여부를 확인할 수 있습니다. Certificate Checker는 아래 위치에서 이용 가능합니다.

https://ssltools.websecurity.symantec.com/checker/

Certificate Checker를 사용하려면 Check your cerftificate installation을 누른 다음 해당 웹 사이트 URL을 입력하십시오.

heartbleed-explained_02.png

Heartbleed Bug Poses Serious Threat to Unpatched Servers

      No Comments on Heartbleed Bug Poses Serious Threat to Unpatched Servers

A newly discovered vulnerability in one of the most commonly used implementations of the SSL and TLS cryptographic protocols presents an immediate and serious danger to any unpatched server. The bug, known as Heartbleed, allows attackers to intercept secure communications and steal sensitive information such as login credentials, personal data, or even decryption keys.

Heartbleed, or the OpenSSL TLS ‘heartbeat’ Extension Information Disclosure Vulnerability (CVE-2014-0160), affects a component of OpenSSL known as Heartbeat. OpenSSL is one of the most widely used implementations of the SSL (Secure Sockets Layer) and TLS (Transport Layer Security) protocols.

Heartbeat is an extension to the TLS protocol that allows a TLS session to be kept alive, even if no real communication has occurred for some time. The feature will verify that both computers are still connected and available for communication. It also saves the user the trouble of having to reenter their credentials to establish another secure connection if the original connection is dropped.

How does it work? Heartbeat sends a message to the OpenSSL server, which in turn relays that message back to the sender, verifying the connection. The message contains two components, a packet of data known as the payload which can be up to 64KB and information on the size of the payload.

However, the Heartbleed vulnerability in OpenSSL allows an attacker to spoof the information on the payload size. For example, they could send a payload of just one kilobyte in size, but state that it is 64KB.

How an OpenSSL server deals with this malformed Heartbeat message is key to the danger this vulnerability poses. It does not attempt to verify that the payload is the same size as stated by the message. Instead it assumes that the payload is the correct size and attempts to send it back to the computer it came from. However, since it doesn’t have the full 64KB of data it will instead automatically “pad out” the payload with data stored next to it in the application’s memory. If the server received a 1KB payload, it will thus send it back along with 63KB of other data stored in its memory. This could include the login credentials of a user, personal data, or even, in some cases, session and private encryption keys.

The data the application sends back is random and it is possible that the attacker may receive some incomplete or useless pieces of data. However, the nature of the vulnerability means that the attack can be performed again and again, meaning the attacker can build a bigger picture of the data stored by the application over time.

Private encryption keys may be the most difficult thing to steal using this attack. Data is stored in a sequential fashion, with new data stored in front of older data. Encryption keys will usually be stored “behind” the payload in memory, meaning they are less likely to be accessed. Content from current SSL/TLS sessions is the type of data most likely to be at risk.

The Heartbleed bug is the latest in a series of SSL/TLS vulnerabilities uncovered this year. TLS and its older predecessor SSL are both secure protocols for Internet communication and work by encrypting traffic between two computers.

In February, Apple had to patch two critical vulnerabilities affecting SSL in its software. It first issued an update for its mobile operating system iOS, which patched a flaw that enabled an attacker with a privileged network position to capture or modify data in sessions protected by SSL/TLS. Days later, a second update was issued, this time for its desktop operating system OS X, after it was discovered that the same vulnerability also affected it.

In March, a certificate vulnerability was found in security library GnuTLS, which is used in a large number of Linux versions, including Red Hat desktop and server products, and Ubuntu and Debian distributions of the operating system.

GnuTLS is an open source software implementation of SSL/TLS. The bug meant that GnuTLS failed to correctly handle some errors that could occur when verifying a security certificate. This could allow an attacker to use a specially crafted certificate to trick GnuTLS into trusting a malicious website. The vulnerability was immediately patched by GnuTLS.

Heartbleed is by far the most serious vulnerability in SSL/TLS to be uncovered of late. The nature of the bug and the fact that affects one of the most widely used implementations of SSL/TLS means that it poses an immediate risk.

Advice for businesses:

  • Anyone using OpenSSL 1.0.1 through 1.0.1f should update to the latest fixed version of the software (1.0.1g), or recompile OpenSSL without the heartbeat extension
  • After moving to a fixed version of OpenSSL, if you believe your web server certificates may have been compromised or stolen as a result of exploitation, contact the certificate authority for a replacement
  • Finally, and as a best practice, businesses should also consider resetting end-user passwords that may have been visible in a compromised server memory

Advice for consumers:

  • You should be aware that your data could have been seen by a third party if you used a vulnerable service provider
  • Monitor any notices from the vendors you use. Once a vulnerable vendor has communicated customers that they should change their passwords, users should do so
  • Avoid potential phishing emails from attackers asking you to update your password – to avoid going to an impersonated website, stick with the official site domain
  • Stick to reputable websites and services. They are most likely to have immediately addressed the vulnerability
  • Monitor your bank and credit card statements to check for any unusual transactions

heartbleed-explained_02.png

Instagram Scam: Lottery Winners Impersonated to Offer Money for Followers

      No Comments on Instagram Scam: Lottery Winners Impersonated to Offer Money for Followers

Over the last few days, Instagram scammers have been posting images offering fake lottery winnings to followers. They have convinced users to share the posts, give up personal information, and even send money back to the scammers.

In this scam, a number of Instagram accounts have been created to impersonate real-life lottery winners from the UK and US. These accounts claim to offer US$1,000 to each Instagram user who follows them and leaves a comment with their email address.

figure1_20.png
Figure 1. Instagram accounts impersonating real-life lottery winners

The accounts impersonating lottery winners have been extremely successful, and have gained anywhere from 5,000 to 100,000 followers.

Once they have amassed a certain number of followers, they reveal a secondary Instagram account belonging to their “accountant”, who is in charge of delivering the US$1,000 to users—with a catch.

figure2_19.png
Figure 2. Fake “accountant” profiles asking users for money

The previous figure shows the “accountant” profiles asking Instagram users to send US$0.99 through a large payment processing service to cover the postage fees for mailing out the checks.

figure3_11.png
Figure 3. Users who have fallen for the lottery scam

Even though a number of red flags were present for users, the scam has proven to be a success. Each account has gained thousands of followers, with users willingly divulging their email addresses, and some users sending scammers US$0.99 for the supposed postage fees.

The main goal of this scam campaign was to collect accounts with thousands of followers for personal use or resale. During our research, we also found that user names associated with some of the impersonation accounts had performed an account pivot. This means the avatar, user name, and user biography section were changed to preserve the account from being flagged for spam. This allowed the scammers to continue to use or sell the account.

figure4_9.png
Figure 4. Instagram impersonation accounts have reappeared with fewer followers

Shortly after the account pivot, the impersonation accounts reappeared, but with fewer followers than before. One of the accounts even claimed that it was “hacked” and asked followers to be patient.

It’s clear that these accounts are fraudulent, but users continue to believe that they will be given US$1000 just for following Instagram accounts.

Symantec advises users with the following precautions:

  • Do not believe everything you read, especially on social networking sites
  • Be skeptical when you come across such offers. As we have previously pointed out, free stuff on social networks is not free
  • Do not willingly give up personal information
  • Do not send money to somebody you do not know or trust

Always remember that if it sounds too good to be true, it is.

Windows PowerShell ??????

      No Comments on Windows PowerShell ??????

先日、Microsoft のスクリプト言語、Windows PowerShell がマルウェア作成者によって不正な目的に利用されていると報じられました。シマンテックは、さらに多くの PowerShell スクリプトが、悪質な目的で攻撃に使われていることを特定しています。これまでに確認された他の PowerShell スクリプトとは違って、今回のスクリプト（シマンテックは Backdoor.Trojan として検出します）は、さまざまな層の不明瞭化の機能を備えており、悪質なコードを rundll32.exe にインジェクトして、コンピュータの内部に潜伏しながら、バックドアのように動作し続けることができるのです。

Powershell 1.png

図 1. 元の Microsoft Windows PowerShell スクリプト

上の画像を見るとわかるように、このスクリプトは平文でユーザーの目に触れないように不明瞭化されています。ところが、攻撃者はスクリプト全体を base64 でエンコードするために、-EncodedCommand というパラメータを使っていました。デコードしてもスクリプトは不明瞭化されたままで、次の図のように見えます。

Powershell 2.png

図 2. PowerShell スクリプトの最初の復号層

次に、このスクリプトは自身の一部を base64 から平文に再度デコードし、デコードされた部分を圧縮解除の機能によって渡します。圧縮解除されたデータは、不明瞭化を解除した PowerShell スクリプトの最新段階であり、Invoke-Expression コマンドによって実行されます。

Powershell 3.png

図 3. 不明瞭化を解除された PowerShell スクリプト

攻撃者は、コンピュータに潜伏するために埋め込まれたコードを処理中にコンパイルし、実行できるように、CompileAssemblyFromSource というコマンドを使います。コンパイルされたコードは次に、保留状態で rundll32.exe を実行し、新しく作成されたプロセスに悪質なコードをインジェクトして、rundll32 のスレッドを再開します。これが、コンピュータ上で検出をすり抜けるための手口です。

インジェクトされたコードは次にリモートコンピュータへの接続を試み、リモートコンピュータは命令のバッファが受信されるのを待ちます。続いてこのコードが、EXECUTE_READWRITE 許可を持つ命令を格納し、その命令がステルス状態で実行されます。

インジェクトされたコードがメモリを割り当て、命令を受信して後で実行する過程を次の図に示します。

Powershell 4.png

図 4. rundll32.exe にインジェクトされた悪質なコード

シマンテック製品をお使いのお客様は、Backdoor.Trojan という検出定義により、この攻撃から保護されています。感染を防ぐために、シマンテックの最新技術を使い、ウイルス対策を更新することをお勧めします。不明な PowerShell スクリプトは実行しないよう心がけるとともに、悪質なスクリプトの実行を防ぐために、PowerShell のデフォルトの実行設定は低くしないようにしてください。

 

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

Microsoft Patch Tuesday – April 2014

      No Comments on Microsoft Patch Tuesday – April 2014

Hello, welcome to this month’s blog on the Microsoft patch release. This month the vendor is releasing four bulletins covering a total of 11 vulnerabilities. Seven of this month’s issues are rated ’Critical’.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft’s summary of the April releases can be found here:
http://technet.microsoft.com/en-us/security/bulletin/ms14-apr

The following is a breakdown of the issues being addressed this month:

  1. MS14-017 Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (2949660)

    Microsoft Office File Format Converter Vulnerability (CVE-2014-1757) MS Rating: Important

    A remote code execution vulnerability exists in the way that affected Microsoft Office software converts specially crafted files. An attacker who successfully exploited this vulnerability could run arbitrary code as the current user. If the current user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

    Microsoft Word Stack Overflow Vulnerability (CVE-2014-1758) MS Rating: Important

    A remote code execution vulnerability exists in the way that Microsoft Word parses specially crafted files. An attacker who successfully exploited this vulnerability could run arbitrary code as the current user. If the current user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

    Word RTF Memory Corruption Vulnerability (CVE-2014-1761) MS Rating: Critical

    A remote code execution vulnerability exists in the way that Microsoft Word parses specially crafted files. An attacker who successfully exploited this vulnerability could run arbitrary code as the current user. If the current user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

  2. MS14-018 Cumulative Security Update for Internet Explorer (2950467)

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-0235) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-1751) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-1752) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-1753) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-1755) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2014-1760) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

  3. MS14-019 Vulnerability in Windows File Handling Component Could Allow Remote Code Execution (2922229)

    Windows File Handling Vulnerability (CVE-2014-0315) MS Rating: Important

    A remote code execution vulnerability exists in the way that Microsoft Windows processes .bat and .cmd files that are run from an external network. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

  4. MS14-020 Vulnerability in Microsoft Publisher Could Allow Remote Code Execution (2950145)

    Arbitrary Pointer Dereference Vulnerability (CVE-2014-1759) MS Rating: Important

    A remote code execution vulnerability exists in the way that Microsoft Publisher parses specially crafted files. An attacker who successfully exploited this vulnerability could run arbitrary code as the current user. If the current user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

More information on the vulnerabilities being addressed this month is available at Symantec’s free SecurityFocus portal and to our customers through the DeepSight Threat Management System.

The 2013 Internet Security Threat Report: Year of the Mega Data Breach

      No Comments on The 2013 Internet Security Threat Report: Year of the Mega Data Breach

istrbanner.png

Once again, it’s time to reveal the latest findings from our Internet Security Threat Report (ISTR), which looks at the current state of the threat landscape, based on our research and analysis from the past year. Key trends from this year’s report include the large increase in data breaches and targeted attacks, the evolution of mobile malware and ransomware, and the potential threat posed by the Internet of Things. We’ll explore each of these topics in greater detail below.

The year of the mega data breach
While 2011 was hailed by many as the “Year of the Data Breach,” breaches in 2013 far surpassed previous years in size and scale. For 2013, we found the number of data breaches grew 62 percent from 2012, translating to more than 552 million identities exposed last year – an increase of 368 percent. This was also the first year that the top eight data breaches each resulted in the loss of tens of millions of identities – making it truly the year of the “mega” data breach. By comparison, only one data breach in 2012 reached that distinction.

Attackers set their sights on medium-sized businesses
If you’ve been following our reports, you know that small and medium-sized businesses (SMBs) are a key target for attackers, and this year proved no exception to the trend. In 2013, SMBs collectively made up more than half of all targeted attacks at 61 percent – up from 50 percent in 2012 – with medium-sized (2,500+ employees) businesses seeing the largest increase.

Attacks against businesses of all sizes grew, with an overall increase of 91 percent from 2012. Similar to last year, cybercriminals deployed watering hole attacks and spear-phishing to increase the efficiency of their campaigns. However, spear-phishing campaigns were down 23 percent, with cybercriminals relying less on emails to carry out their attack campaigns. Watering hole attacks allowed the bad guys to run more campaigns through drive-by-downloads, targeting victims at the websites they frequently visit. Efforts were also aided by a 61 percent increase in zero-day vulnerabilities, which allowed attackers to set up on poorly patched sites and infect their victims with little or no additional effort required. 

Government remained the most targeted industry (16 percent of all attacks). This year we looked at not only the volume of attacks but also at who are the preferred targets and what are the odds of being singled out. The bad news is that no one faces favorable odds and we all need to be concerned about targeted attacks. However, looking at the odds produced some surprises. If you’re a personal assistant working at a mid-sized mining company, I have bad news for you – you topped the “most wanted” list for attackers. 

Mobile malware and madware invades consumers’ privacy
While many people download new apps to their mobile devices without a second thought, many malicious apps contain highly annoying or unwanted capabilities. Of the new malware threats written in 2013, 33 percent tracked users and 20 percent collected data from infected devices. 2013 also saw the first remote access toolkits (or RATs) begin to appear for Android devices. When running on a device, these RATs can monitor and make phone calls, read and send SMS messages, get the device’s GPS coordinates, activate and use the camera and microphone and access files stored on the device – all without the knowledge or consent of the victim.

Ransomware growth explodes and turns even more vicious 
As we had previously predicted, ransomware, the malicious software that locks computers and files, grew rapidly in 2013. Ransomware saw an explosive 500 percent growth over last year and remained a highly profitable enterprise for the bad guys, netting $100 to $500 USD for each successful ransom payment. We also saw attackers become more vicious by holding data hostage through high-end encryption and threatening to delete the information forever if the fee was not paid within the given time limit.

The future of identity theft: The Internet of Things
Which of these things have been hacked in the past year: a refrigerator or a baby monitor? When I ask customers this question, they often reply, “Both.” The correct answer is the baby monitor. Despite what you may have heard on the news, Internet connected refrigerators have yet to be attacked. But never say never. Security researchers in 2013 demonstrated that attacks against cars, security cameras, televisions and medical equipment are all possible. The refrigerator’s time will come. The Internet of Things (IoT) is on its way and related threats are sure to follow. In this year’s report, we talk about what we’ve seen so far, and the consensus is that the Internet connected device at most risk of attack today is the home router.

What comes next? With personal details and financial information being stored on IoT devices, it’s only a matter of time before we find a true case of a refrigerator being hacked. Right now, security is an afterthought for most manufacturers and users of these devices, and it will likely take a major security incident before it is seriously considered. However, by starting the conversation now about the potential security risks, we will be that much more prepared when that day comes. This year’s ISTR starts the conversation. 

For more details, check out the complete Internet Security Threat Report, Vol. 19.

Facebook ???????????????????????

      No Comments on Facebook ???????????????????????

寄稿: Parag Sawant

フィッシング詐欺師は、ユーザーの重要な情報を手に入れるチャンスを増やすために、さまざまな計略を繰り出し続けています。シマンテックが最近確認したフィッシング攻撃の場合は、男性と女性のどちらが偉いかと質問する偽の投票サイトを通じてデータが集められていました。

フィッシングページは無料の Web ホスティングサイトを利用しており、Facebook ユーザーを標的にした偽の投票ページには、「WHO IS GREAT BOYS OR GIRLS?（男性と女性、どちらが偉い?）」という質問と［VOTE（投票）］ボタンがあります。ページには、投票結果を示す棒グラフも埋め込まれており、過去 4 年間の総得票数が示されます。このようなグラフがあることで、より本物らしく見えます。

figure1_1.jpg
図 1. 投票サイトへの登録を求める Facebook アプリケーション

最初のフィッシングページには、投票プロセスを開始するボタンがあります。このボタンをクリックすると、次の図のようにポップアップウィンドウが開き、ユーザーのログイン ID とパスワードを入力するよう求められます。

figure2_0.jpg
図 2. ユーザーのアカウント情報の入力を求めるポップアップウィンドウ

ポップアップウィンドウには、男性か女性のどちらかに投票するためのボタンと、投票を送信するボタンも表示されます。フィールドに必要な情報をすべて入力し終わると、投票した情報を確認するための確認ページに進みます。

figure3.jpg
図 3. ユーザー情報を入力し終わると、投票の確認メッセージが表示される

ここで最初のページに戻ろうとして、投票数が定期的に増えていることに気付きました。先ほど 4,924,055 だった数値が、今見ると 4,924,096 になっているのです。

figure4.jpg
図 4. 変化する前と変化した後の投票数の比較

今回のフィッシング詐欺師は以下の URL を使っており、そのサブドメインからこれがアプリケーションであることがわかります。
[http://]smartapps.[削除済み].com

このサイトに騙されたユーザーは、個人情報を盗まれ、なりすまし犯罪に使われてしまいます。

偽アプリケーションを餌に使う手口は珍しいものではありません。インターネットを利用する際には、フィッシング攻撃を防ぐためにできる限りの対策を講じることを推奨します。

  • アカウントにログインするときに、アドレスバーの URL を確かめ、間違いなく目的の Web サイトのアドレスであることを確認する。
  • 電子メールメッセージの中の疑わしいリンクはクリックしない。
  • 電子メールに返信するときに個人情報を記述しない。
  • ポップアップページやポップアップウィンドウに個人情報を入力しない。
  • 個人情報や口座情報を入力する際には、鍵マーク（画像やアイコン）、「https」の文字、緑色のアドレスバーなどが使われていることを確かめ、その Web サイトが SSL で暗号化されていることを確認する。
  • ノートン インターネットセキュリティやノートン 360 など、フィッシング詐欺やソーシャルネットワーク詐欺から保護する統合セキュリティソフトウェアを使う。
  • 電子メールで送られてきたリンクや、ソーシャルネットワークに掲載されているリンクがどんなに魅力的でも不用意にクリックしない。

 

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

The Dark Power of Windows PowerShell

      No Comments on The Dark Power of Windows PowerShell

Windows PowerShell, the Microsoft scripting language, has made the headlines recently due to malware authors leveraging it for malicious purposes. Symantec has identified more PowerShell scripts being used for nefarious purposes in attacks. Unlike other PowerShell scripts that we have identified previously, the new script, which Symantec detects as Backdoor.Trojan, has different layers of obfuscation and is able to inject malicious code into “rundll32.exe” so that it can hide itself in the computer while still running and acting like a back door.

Powershell 1.png

Figure 1. The original Microsoft Windows PowerShell script

As seen from the previous image, the script is obfuscated to prevent users from seeing the clear text. However, the attacker has used the parameter “-EncodedCommand” in order to encode the entire script in base64. Once decoded, the script is still obfuscated and it looks like the following:

Powershell 2.png

Figure 2. PowerShell script’s first layer of decryption

After this, the script will again decode a portion of itself from base64 to plain text and the decoded part of the script is passed through a decompression function. The decompressed data is the latest stage of the deobfuscated PowerShell script, which will be executed through the “Invoke-Expression” command.

Powershell 3.png

Figure 3. A deobfuscated PowerShell script

The attacker uses the command “CompileAssemblyFromSource” so that they can compile and execute on-the-fly embedded code which hides itself on the computer. The compiled code will then try to execute “rundll32.exe” in a suspended state, inject malicious code into the newly created process and restart the “rundll32” thread. This method is used to prevent detection on the computer.

The injected code will then try to connect to a remote computer and it then waits to receive a buffer of instructions. The code will subsequently store these instructions with EXECUTE_READWRITE permissions, so that they can be executed in a stealthy way.

The following picture shows how the injected code allocates the memory and receives the instructions that are later executed.

Powershell 4.png

Figure 4. Malicious code injected into rundll32.exe

Symantec customers are currently protected from this attack with the detection Backdoor.Trojan. To avoid being infected, we recommend that customers should use the latest Symantec technologies and update their virus definitions. Users should avoid running unknown PowerShell scripts and should not lower PowerShell’s  default execution settings in order to prevent potential malicious scripts from executing.

The Dark Power of Windows PowerShell

      No Comments on The Dark Power of Windows PowerShell

Windows PowerShell, the Microsoft scripting language, has made the headlines recently due to malware authors leveraging it for malicious purposes. Symantec has identified more PowerShell scripts being used for nefarious purposes in attacks. Unlike other PowerShell scripts that we have identified previously, the new script, which Symantec detects as Backdoor.Trojan, has different layers of obfuscation and is able to inject malicious code into “rundll32.exe” so that it can hide itself in the computer while still running and acting like a back door.

Powershell 1.png

Figure 1. The original Microsoft Windows PowerShell script

As seen from the previous image, the script is obfuscated to prevent users from seeing the clear text. However, the attacker has used the parameter “-EncodedCommand” in order to encode the entire script in base64. Once decoded, the script is still obfuscated and it looks like the following:

Powershell 2.png

Figure 2. PowerShell script’s first layer of decryption

After this, the script will again decode a portion of itself from base64 to plain text and the decoded part of the script is passed through a decompression function. The decompressed data is the latest stage of the deobfuscated PowerShell script, which will be executed through the “Invoke-Expression” command.

Powershell 3.png

Figure 3. A deobfuscated PowerShell script

The attacker uses the command “CompileAssemblyFromSource” so that they can compile and execute on-the-fly embedded code which hides itself on the computer. The compiled code will then try to execute “rundll32.exe” in a suspended state, inject malicious code into the newly created process and restart the “rundll32” thread. This method is used to prevent detection on the computer.

The injected code will then try to connect to a remote computer and it then waits to receive a buffer of instructions. The code will subsequently store these instructions with EXECUTE_READWRITE permissions, so that they can be executed in a stealthy way.

The following picture shows how the injected code allocates the memory and receives the instructions that are later executed.

Powershell 4.png

Figure 4. Malicious code injected into rundll32.exe

Symantec customers are currently protected from this attack with the detection Backdoor.Trojan. To avoid being infected, we recommend that customers should use the latest Symantec technologies and update their virus definitions. Users should avoid running unknown PowerShell scripts and should not lower PowerShell’s  default execution settings in order to prevent potential malicious scripts from executing.