The importance of patch management after serious Linux vulnerabilities 0 860

  • The open-source Linux operating system is used by most of the servers on the internet as well as in smartphones, with an ever-growing desktop user base as well.
  • The bug known as Dirty Cow (CVE-2016-5195) – named as such since it exploits a mechanism called “copy-on-write” and falls within the class of vulnerabilities known as privilege escalation. This would allow an attacker to effectively take control of the system.
  • Patch management should be a core consideration for all IT systems, whether they are servers or workstations, and of course regardless of the operating systems used.
Serious Linux vulnerabilities

In recent news there have been a number of serious vulnerabilities found in various Linux systems. Whilst OS vulnerabilities are a common occurrence, it’s the nature of these that have garnered so much interest.

The open-source Linux operating system is used by most of the servers on the internet as well as in smartphones, with an ever-growing desktop user base as well.

Open-source software is typically considered to increase the security of an operating system, since anyone can read, re-use and suggest modifications to the source code – part of the idea being that many people involved would increase the chances of someone finding and hopefully fixing any bugs.

With that in mind let’s turn our sights on the bug known as Dirty Cow (CVE-2016-5195) found in October – named as such since it exploits a mechanism called “copy-on-write” and falls within the class of vulnerabilities known as privilege escalation. This would allow an attacker to effectively take control of the system.

What makes this particular vulnerability so concerning however isn’t the fact that it’s a privilege escalation bug, but rather that it was introduced into the kernel around nine years ago. Exploits already taking advantage of Dirty Cow were also found after the discovery of the bug by Phil Oester. This means that a reliable means of exploitation is readily available, and due to its age, it will be applicable to millions of systems.

Whilst Red Hat, Debian and Ubuntu have already released patches, millions of other devices are still vulnerable – worse still is the fact that between embedded versions of the operating and older Android devices, there are difficulties in applying the updates, or they may not receive any at all, leaving them vulnerable.

Next, let’s have a look at a more recent vulnerability which was found in Cryptsetup (CVE-2016-4484), which is used to set up encrypted partitions on Linux using LUKS (Linux Unified Key Setup). It allows an attacker to obtain a root initramfs shell on affected systems. At this point, depending on the system in question, it could be used for a number of exploitation strategies according to the researchers whom discovered the bug, namely:

  • Privilege escalation: if the boot partition is not encrypted:
    • It can be used to store an executable file with the bit “SetUID” enabled. Which can later be used to escalate privileges by a local user.
    • If the boot is not secured, then it would be possible to replace the kernel and the initrd image.
  • Information disclosure: It is possible to access all the disks. Although the system partition is encrypted it can be copied to an external device, where it can be later be brute forced. Obviously, it is possible to access to non-encrypted information in other devices.
  • Denial of service: The attacker can delete the information on all the disks, causing downtime of the system in question.

Whilst many believe the severity and/or likely impact of this vulnerability has been exaggerated considering you need physical or remote console access (which many cloud platforms provide these days), what makes it so interesting is just how it is exploited.

All you need to do is repeatedly hit the Enter key at the LUKS password prompt until a shell appears (approximately 70 seconds later) – the vulnerability is as a result of incorrect handling of password retries once the user exceeds the maximum number (by default 3).

The researchers also made several notes regarding physical access and explained why this and similar vulnerabilities remain of concern. It’s generally accepted that once an attacker has physical access to a computer, it’s pwned. However, they highlighted that with the use of technology today, there are many levels of what can be referred to as physical access, namely:

  • Access to components within a computer – where an attacker can remove/replace/insert anything including disks, RAM etc. like your own computer
  • Access to all interfaces – where an attacker can plug in any devices including USB, Ethernet, Firewire etc. such as computers used in public facilities like libraries and internet cafes.
  • Access to front interfaces – usually USB and the keyboard, such as systems used to print photos.
  • Access to a limited keyboard or other interface – like a smart doorbell, alarm, fridge, ATM etc.

Their point is that the risks are not limited to traditional computer systems, and that the growing trends around IoT devices will increase the potential reach of similar attacks – look no further than our last article on DDoS attacks since IoT devices like printers, IP cameras and routers have been used for some of the largest DDoS attacks ever recorded.

This brings us back around to the fact that now, more than ever, it’s of critical importance that you keep an eye on your systems and ensure any vulnerabilities are patched accordingly, and more importantly – in a timeous manner. Patch management should be a core consideration for all IT systems, whether they are servers or workstations, and of course regardless of the operating systems used.

To this end ESET formed another Technology Alliance with software vendor Flexera, whom recently acquired the well-known security vendor, Secunia. Through this partnership, ESET now also offers Corporate Software Inspector, one of the most popular and established patch management solutions on the market. Their 2016 review indicated that the number of vulnerabilities detected in 2015 was 16081, which were “discovered in 2484 applications from 263 vendors” and shows a worrying “39% increase over the course of the five-year trend and a 2% increase from 2014 to 2015.”

Keep an eye out for coming news, material and demos regarding Corporate Software Inspector, or contact us.

Previous ArticleNext Article

Beware: ad slingers thinly disguised as security apps 0 740

Fake Security App

According to AV-Comparatives, an independent testing organization, there are significant differences in the level of protection provided by mobile security solutions. However, even the least secure of them are still far better than questionable apps that impersonate security applications in order to display ads to users. Thirty-five such applications have recently been discovered in the Google Play official Android app store.

These apps have Google Play statistics showing a minimum of over six million installs, cumulatively. However, not all those were necessarily real installations, it is possilbe that many were bot downloads posting fake reviews to improve the ratings for the app.

All 35 apps have been flagged by ESET and eventually removed from the store.

In addition to annoying their victims with ads, disguising these apps as security software has some serious negative side effects, too. In mimicking basic security functions – in fact, they all act as very primitive security checkers relying on a few trivial hardcoded rules – they often detect legitimate apps as malicious. And last but not least, they create a false sense of security in the victims, which might expose them to real risks from malicious apps that are not detected as such.

ESET’s analysis has shown that among these 35 apps, only a handful stand out for their specific features: one app is not completely free as it offers a paid upgrade; one app has implemented a primitive, easily bypassed, app-locker manager; another app flags other apps from this group as dangerous by default; and finally, one misuses ESET’s branding.

 

Security-mimicking functionality
In order to stay under the radar, all the shady ad-displaying apps mimic actual mobile security solutions. However, their ‘detection mechanisms’ are incomplete and very primitive, which makes them easy to bypass and prone to false positives.

Our research into these questionable apps has shown that their ‘detection mechanisms’ can be divided into four categories. These mechanisms are identical or almost identical across the whole set of apps.

1) Package name whitelist & blacklist
These whitelists features popular apps such as Facebook, Instagram, LinkedIn, Skype and others. The ‘blacklists’ contains far too few items to be considered security functionality at all.

2) Permissions blacklist
All apps (including legitimate ones) are flagged if they require some of the listed permissions that are considered dangerous, such as send and receive SMS, access location data, access the camera, etc.

3) Source whitelist
All apps but those from the official Android store, Google Play, are flagged – even if they are completely benign.

4) Activities blacklist
All apps that contain any of the blacklisted activities: that is, parts of applications. This mainly concerns some ad-displaying activities.

Flagged are all apps that contain any of the blacklisted activities, i.e., packages of application that are used in an application. These packages can handle additional functionalities (mainly some ad-displaying activities).

While there is nothing wrong with the idea of activity blacklisting, the implementation in these questionable apps is rather sloppy. For example, Google Ads is included in the blacklist despite the fact that it is a legitimate service. On top of being legitimate, this service is implemented in all of the shady apps we analyzed.

Additional security “functionality”
Some of the questionable security apps are capable of protecting a user’s apps with a password or a pattern locker. The idea behind this seemingly useful feature is to provide the user with another layer of security in selected apps.

However, due to insecure implementation, this feature also fails to provide true security to the user.

The problem is that relevant information is not stored safely on the device – instead of using encryption, which is common baseline practice in cybersecurity, these apps store the names of locked apps and the passwords to unlock them as plaintext.

This means that the data can be accessed after the device is rooted.

Besides compromising the unencrypted data by rooting the phone, there is another way to bypass the app lock. An attacker with physical access to the device can change the app-locking password without knowing the old one!

Conclusion
Having a security solution installed in an Android phone is definitely a good thing. However, not all apps featuring “security” or “antivirus” in their name do what the name promises. Before installing a security solution, think twice: is it really a tool you can safely rely on?

The 35 pseudo-security apps described in this article are not, say, ransomware or other hardcore malware. The only harm they do is displaying annoying ads, making false-positive detections and giving the victim a false sense of security. However, those millions of unwary users who downloaded them could easily have ended up downloading true malware in some similar disguise.

Instead of shady apps with flashy names and icons and outlandish, unsubstantiated promises, seek a reputable security solution. And which one to choose? An independent test by a well-respected testing organization might help.

Meltdown and Spectre 0 1016

 Microsoft released Security Advisory 18002 on Wednesday, January 3, 2018 to mitigate a major vulnerability to Windows in modern CPU architectures. ESET released Antivirus and Antispyware module 1533.3 the same day to all customers to ensure that use of our products would not affect compatibility with Microsoft’s patch.

The first few days of 2018 have been filled with anxious discussions concerning a widespread and wide-ranging vulnerability in the architecture of processors based on Intel’s Core architecture used in PCs for many years, as well as processors from AMD, and even affecting ARM processors commonly used in tablets and smartphones.

The good news is that ESET can help protect against the types of malware that could take advantage of these vulnerabilities.

And, ESET was one of the very first security vendors to allow the Microsoft patch against the flaw to be enabled.

While ESET protects against potential malware infection, you should also take these steps to secure your computers and data:

  • Make sure your browser is up to date. For Chrome or Firefox users:
    • Mozilla has released information describing their response, including how Firefox 57 will address these security flaws.
    • Google has stated, “Chrome 64, due to be released January 23, will contain mitigations to protect against exploitation.” In the meantime, you can enable “Site Isolation” found in current stable versions of Chrome to provide better protection.
  • Make sure you update your ESET software, then update your Windows OS to protect against this exploit. To update ESET:
  • Customers should review ESET’s Knowledgebase article for important updates.
  • See this great collection of tips, articles and recommendations from the Google Project Zero team.
  • If you have a cloud-based server or have a website hosted by hosting provider, check to see what mitigations they have implemented already to prevent Meltdown.