In the past 6 months Mozilla has released 62 Security Bulletins addressing 88 vulnerabilities. Of the 62 Mozilla Security Bulletins released more than 1 out of every 2 bulletins had vulnerabilities that could be used to exploit the rights of the logged on user. All of the bulletins released affected Mozilla Firefox, which means that any user not keeping up to date with their Firefox browser is in imminent danger unless some privilege management software is in place. Here’s a breakdown of the Mozilla Security Bulletins:

Mozilla classifies the bulletins as critical, high, moderate, and low. Similar to Microsoft, critical vulnerabilities can run attacker code and install software without users knowing. High vulnerabilities also happen without users knowing but can only disclose information to attackers. In most cases, exploit of critical and high vulnerabilities would come in the form of visiting a malicious website or legitimate website serving up malicious content as is often done through ad networks. Moderate vulnerabilities can only occur if a user has a non-default configuration, and Low vulnerabilities pose no major threat to users. With that classification in mind here’s a breakdown of the Mozilla Bulletin Severity and Vulnerabilities with Privilege Exploits:

With 96% of the 52 critical vulnerabilities having privilege exploitation, any user who uses Firefox and uses an administrator account should be concerned. In layman’s terms, in the past 6 months there have been 50 known ways that an attacker can execute code on a user’s computer and gain full access using the privileges of the user, which roughly calculates into 2 new vulnerabilities a week for a hacker to use. Privilege management software is a proven method to limit these vulnerabilities. Privilege management software, unlike patching, can limit both existing and unknown vulnerabilities from being exploited by always limiting the privileges of the application regardless of the user’s account type.

Software vulnerabilities will be most dangerous to users and businesses if least privilege management software best practices aren’t followed. Those best practices include removing administrative rights from end-users, running applications with restricted privileges, and securing administrator accounts. Privilege management software such as Arellia Application Control Solution and Local Security Solution can reduce the impact of vulnerabilities by securing the rights of applications and users.

Original Article at Arellia.com

In the past 6 months Adobe has released 16 Security Bulletins addressing 116 vulnerabilities. Of the 16 Adobe Security Bulletins released 81% had vulnerabilities that could be used to exploit the rights of the logged on user. However, if you don’t count the bulletins related to ColdFusion then 100% of the Security Bulletins had vulnerabilities that could be used to exploit user rights. Here’s a breakdown of the Adobe Security Bulletins:

Adobe classifies the bulletins as critical, important, moderate, and low. Similar to Microsoft, critical vulnerabilities can run attacker code and install software without users knowing. Important vulnerabilities also happen without users knowing but can only disclose information to attackers. In most cases, exploit of critical and high vulnerabilities would come in the form of visiting a malicious website or legitimate website serving up malicious content via Flash or an e-mail containing a PDF exploit. Moderate vulnerabilities can only occur if a user has a non-default configuration, and Low vulnerabilities pose no major threat to users. With that classification in mind here’s a breakdown of Adobe Software and Critical and Important Vulnerabilities with Privilege Exploits (there were no Moderate or Low):

With 93% of Adobe Flash, 83% of Adobe Shockwave, and 54% of Adobe Reader critical vulnerabilities having privilege exploitation, any user who has Adobe Flash or Reader installed, has an administrator account, and does not use privilege management software should be concerned. The majority of vulnerabilities, especially for Flash, have dangerous repercussions for user privilege exploitations including complete control over a user’s computer. Privilege management software is the only proven way to limit privilege vulnerability exploits. Privilege management, unlike patching, limits both existing and unknown vulnerabilities from being exploited by always limiting the privileges of the application regardless of the user’s account type.

Software vulnerabilities will be most dangerous to users and businesses if least privilege management best practices aren’t followed. Those best practices include removing administrative rights from end-users, running applications with restricted privileges, and securing administrator accounts. Privilege management software such as Arellia Application Control Solution and Local Security Solution can reduce the impact of vulnerabilities by securing the rights of applications and users.

Original Article at Arellia.com

In the past 6 months Apple has released 2 Security Updates for their Windows versions of Quicktime and iTunes addressing 52 vulnerabilities. Both of the Apple Security Bulletins released had vulnerabilities that could be used to exploit the rights of the logged on user. Here’s a breakdown of the updates released:

Apple, unlike Microsoft and other software vendors Arellia has looked at, does not classify their Security Updates. Instead they lump many vulnerabilities into a single security update. Here’s a breakdown of the two security updates and the vulnerabilities with Privilege Exploits:

100% of Quicktime’s vulnerabilities had privilege exploits, meaning that any malicious file opened in Quicktime by an administrator not using privilege management software could have their computer exploited with code running with their same rights to the system. 62.5% of iTunes vulnerabilities also had privilege exploits, however the exploits for iTunes would be more difficult to achieve because most of the exploits can only happen by injecting code as a middle man when a user is accessing the iTunes store. Regardless of how difficult it is to pull off an exploit though, any vulnerability that can exploit user privileges should be concerning. Privilege management software is a proven method to limit those privilege vulnerability exploits. Privilege management, unlike patching, limits both existing and unknown vulnerabilities from being exploited by always limiting the privileges of the application regardless of the user’s account type.

iTunes and Quicktime are unlikely to be deployed by IT in many organizations. The reality is that iTunes and Quicktime are probably on the majority of desktops due to the iPhone, iPad, and iPod that end users have. As such, many organizations are vulnerable to being exploited by vulnerabilities in this software.

Software vulnerabilities will be most dangerous to users and businesses if least privilege management best practices aren’t followed. Those best practices include removing administrative rights from end-users, running applications with restricted privileges, and securing administrator accounts. Privilege management software such as Arellia Application Control Solution and Local Security Solution can reduce the impact of vulnerabilities by securing the rights of applications and users.

Original Article at Arellia.com

ソーシャルメディアのアカウント、なかでも Twitter アカウントを利用して、Android.Opfake（昨年のブログを参照）などをホストしている悪質なサイトにユーザーを誘導する手口は、特に珍しいものではありません。シマンテックは最近、何も知らない一般ユーザーのアカウントが感染して、こうしたタイプの悪質なリンクをフォロワーにツイートしているケースを確認しました。
 

図 1.感染したアカウントからの悪質なツイート
 

感染した一連のアカウントが出現するようになったのは 7 月の初め頃で、影響は全世界のユーザーに及んでいます。数週間で広範囲のアカウントが感染しましたが、すでに何百というツイートが送信されているにもかかわらず、多くのユーザーは自分のアカウントが悪質なツイートを送信していることに気づいていません。
 

図 2.感染したアカウントから正規のツイートと悪質なツイートが送信される
 

フォローしているアカウントから送信された悪質なリンクを誤ってクリックしてしまったのではないかと心配な場合でも、ロシア語を理解できなければおそらくは安全です。というのも、このツイートはロシア語で書かれており、友人のアカウントでロシア語を見かけても無視すると思われるからです。ただし、ロシア語を理解することができ、ふだんロシア語でツイートするユーザーをフォローしている場合には警戒が必要です。

こういったリンクをクリックすると、マルウェアをホストしているサイトがブラウザで開きます。一般的なブラウザでは、アプリの自動ダウンロードを開始するページが表示されます。
 

図 3.マルウェアをホストしているサイトがブラウザで開く
 

アプリは自動的にダウンロードされますが、インストールはユーザーが手動で実行する必要があります。
 

図 4.自動的にダウンロードされたアプリ
 

注目に値するのは、この悪質なツイートから無償版の Asphalt 7 を入手できるように見える点です。しかし、アプリをダウンロードしてインストールする際は、正規のアプリであるかどうかを再確認してください。このアプリは無償版を装っていますが、正規の Asphalt 7 アプリとは異なり、バックグラウンドでプレミアム SMS を送信するからです。この費用は、本物を実際に購入するよりも、よほど高くついてしまいます。
 

図 5.偽の Asphalt 7 ダウンロードサイト
 

ユーザーにリンクをクリックさせてマルウェアをデバイスにダウンロードさせようと、ユーザーの気を引くような画像が添付されたツイートもあります。悪用されるのは感染したアカウントとは限らず、詐欺師によって用意されたアカウントの場合もあります。この手の詐欺には十分に注意してください。
 

図 6. 興味を引く画像が添付された詐欺
 

シマンテックは、感染してしまったユーザーのサポートに関して Twitter 社と協力しています。アカウントが感染しているかどうかを確認するには、身に覚えのないツイートがないかどうか、フォローした覚えのないアカウントをフォローしていないかどうかを調べます。アカウントを感染から保護するために、強力なパスワードを使用し、フィッシング詐欺に注意してください。また、アカウント情報を盗み出すマルウェアにコンピュータやデバイスが感染しないように、オペレーティングシステムやインストールされているすべてのソフトウェアに最新のパッチを適用したり、最新のセキュリティソフトウェアを使用したりするなど、基本的なセキュリティ対策（ベストプラクティス）に従ってください。悪質なサイトにアクセスしてしまわないように、たとえ知人のツイートでも、ふだんとは違うメッセージは無視するようにしてください。ノートン モバイルセキュリティや Symantec Mobile Securityなどのセキュリティアプリをインストールすることもお勧めします。シマンテックは、このブログで説明したマルウェアを Android.Opfakeとして検出します。

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/jaにアクセスしてください。

3D プリンタは魅力的なデバイスで、最近では値段も手ごろになり、広く利用できるようになりつつあります。多くのユーザーが好んで 3D プリンタを試用し、さまざまな分野にイノベーションを起こしています。3D 印刷によって可能なことはあまりに多く、武器の模造など物議を醸すアイデアの実現から、鍵の複製までさまざまです。ここで言っているのは、単に安っぽいプラスチック製の複製の話だけではありません。新型の 3D プリンタになると、チタンなどの素材を焼結して耐久性の高いものを作ることも可能です。

先々週に相次いで開催されたセキュリティカンファレンス OHM2013と DEFCONでは、錠前破り（ピッキング）に関して類似のプレゼンテーションが 2 つ行われました。どちらも、物理的な鍵の複製を 3D プリンタで作成できることを実証したもので、必要なのは元の鍵の ID 番号と、精巧な写真数枚だけです。たったそれだけで、実際に使える 3D モデルの鍵を複製できてしまうというのは、考えるだけでも心配です。3D モデルのファイルの一部は、一般に入手可能で、変更も改造も簡単です。

これは別に新しい概念ではありません。手錠の鍵の 3D モデルは、1 年以上前から一般に出回っています。数年前には、高解像度のカメラで撮影した数枚の写真から鍵を複製する方法を実証した本も何種類か出版されました。

もちろん、熟練した腕前の攻撃者であれば、通常のピッキング道具で錠を開けることもできます。3D プリンタが一般にも利用できるようになり、対応する鍵ファイルがオンラインで流通すれば、多くの人々がますます簡単に複製を作れるようになります。

新聞やテレビ番組で鍵の写真が映しだされた例は数多くあり、それが複製につながる恐れがあります。たとえば、消防士がさまざまなエレベータや非常口を操作できる特殊な鍵や、警察官が持つ手錠の鍵などは、それなりのプリンタさえあれば誰にでも簡単に作れる標的になりえます。

これは大多数の人々が心配しなければならない性質の問題ではありませんが、撮影したものの物理的な特性について慎重を期することは重要です。言うまでもなく、この攻撃は、あらゆる種類の鍵と錠の組み合わせに有効なわけではありません。どちらかといえば、デジタル世界の暗号鍵に似ており、脆弱な鍵を使った古い単純な実装は破られてしまう可能性があるので、強力な鍵に取り替える必要があるものの、未熟で脆弱な鍵を使っている実装もまだまだ多く、リスクにさらされている恐れがあります。

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/jaにアクセスしてください。

By Brian Dunphy, senior director, product management, Symantec Managed Security Services

In the current business climate, organizations that need to process, store or transmit credit card data are most likely familiar with the Payment Card Industry Data Security Standard or PCI DSS. This standard specifies the security controls needed to keep credit card data safe and secure during transit, processing, and storage. PCI DSS requires organizations to build and maintain a secure network, protect cardholder data, implement strong security measures, maintain a vulnerability management program and an information security policy, and test and monitor networks on a regular basis.

Today, we’re pleased to announce that Symantec Managed Security Services (MSS) is now a PCI DSS-certified service provider. While MSS is not a service used to process payments, this certification is important to all organizations using the service, whether they have to be PCI DSS-certified themselves or not: Customers that are required to be PCI DSS-certified will be able to use this certification as part of their own audit, simplifying the process. Other customers and prospects will find this certification beneficial because PCI DSS is viewed as a good indicator of the ability of an organization to build, maintain and certify that best security practices are in place.

Our PCI compliance demonstrates the commitment that Symantec MSS has to information security at every level. Compliance with the DSS standard, validated by an independent third-party audit, confirms that the internal security program in place is comprehensive and follows best practices. This validation provides more assurance and clarity for customers evaluating the breadth and strength of our security practices.

I want to point out that Symantec is one of the few MSS providers to have achieved the rigorous audit and certification process required by the PCI DSS 2.0 standard. We understand the need to independently validate the security of our infrastructure, and this certification adds to our ISO 27001 and SAS-70 Type II certifications and demonstrates that our security services are robust enough to meet the most stringent standards of best practices.

In January 2014, Symantec Endpoint Protection 11 will reach End of Support Life. Keep your customers protected with a free upgrade to Endpoint Protection 12. Strengthen your long-term relationships by building customer loyalty and promoting three-year SKUs. Go online to find everything you and your customers need in one place!

Recently, we observed an attack campaign using link files attached to emails in Japan. We have blogged about threats utilizing link files before and this type of attack is still alive and well.

The target of the link is disguised to make it look like it is linking to a text file, tricking the user into opening it, unaware that they are not opening a text file.

Figure 1. Details of LNK file made to look like a link to a text file

Under more careful examination, by scrolling to the left of the text box, you can see the malicious scripts that will actually be executed if you open this link.

Figure 2. True destination of link file

The lesson here is to check carefully to see where link files actually point to before opening them.

After the link file is opened, a series of events happen involving the download and execution of various script files. This process ends with the display of a bogus error message followed by a back door being opened to a remote command-and-control (C&C) server, which will allow the remote attacker to perform numerous activities on the compromised computer.

Figure 3. Attack steps

A key theme of this attack is the use of detection avoidance techniques. These techniques include:

• All attack components, including the back door, are made from script code that can be easily morphed without changing its functionality. This makes it easy to create new variants.
• Some downloaded scripts are only stored in memory, allowing it to avoid disk scanning mechanisms employed by typical antivirus software.
• The back door script uses AES (a strong encryption algorithm) to encrypt communications and the path of the URL to the C&C server.

The threat does not use the standard Windows cryptographic APIs to provide cryptographic services; instead it downloads a legitimate code library from Google Code to provide AES encryption services.

Figure 4. Code snippet showing request for legitimate encryption code library from Google Code

As we have seen time and time again, malware creators are engaged in an endless cat and mouse game with security vendors. They will never stop thinking of ways to trick users into running their malware and of schemes to avoid detection by security vendors.  

Symantec detects these threats, including the malicious LNK files, as Downloader.Dashikut and Backdoor.Dashikut.

Did you know that Symantec's legal department has had a formal pro bono program since 2007?

Since 2007, Symantec attorneys, paralegals and public affairs staff have been applying their day-job skills to volunteer with Legal Aid Society of San Mateo County and the Pro Bono Project of Silicon Valley. Our team helps families retain their homes, transition to new housing when faced with eviction, deal with landlord issues, address imminent homelessness and protect domestic violence survivors from their abusers. With its origins in the legal profession, pro bono has grown to include many diverse professional functions.  Pro bono, unlike traditional forms of volunteerism, uses business skills to provide services for the public good without compensation.

The impact of our pro bono program has been immense, both internally and externally. Without access to courts or legal services, vulnerable populations can struggle to navigate through the complexities and language of the law.

One of the important things to emphasize is that the Symantec pro bono team is not solely comprised of attorneys. One of the questions I frequently get from people is, “but I’m not an attorney—how can I help?” Our pro bono work has many opportunities for lawyers and non-lawyers alike. Volunteer attorneys take cases, represent clients and staff legal clinics. Non-attorney volunteers provide administration, help with paperwork, translation services, and research. And sometimes just providing that sympathetic ear can be helpful to the client. Everyone counts!

I’ve found that the most challenging aspects of pro bono are finding the time and just getting started. It’s easy to identify the opportunities—the need is out there. And once you’ve tried pro bono, it gets easier and easier to do—and it’s so rewarding. Following are some tips on getting started with a pro bono project.

Getting Started with Pro bono

1. Align pro bono work with your skill set

My father told me, “It’s a marathon—pace yourself.” Although you might want to jump in and create an all-encompassing formal program, it’s best to start small and look for opportunities that align with your department’s unique skill sets and goals:

• Are you looking to foster teambuilding?
• Do you want to retain your high performers?
• Do you want to increase your external visibility?
• Is skill development an issue you want to address?
• Do you want to foster a climate of innovation?

The business benefits are there—and the social impact is immeasurable.

I encourage other managers to think about how their departments can use their unique professional skills to help others. For example, if you’re in Finance, you could lend your skills to help a nonprofit with its budgets or help determine the economic feasibility of adding a new social program. If you’re in a technology role, your skills could help nonprofits evaluate new hardware/software donations or upgrade to a more secure server. Marketing teams could develop a social media campaign or write targeted fundraising appeals—the possibilities are limitless.

2. Plan, promote, organize

Once you’ve determined your goals, it’s time to get organized. Identify an executive champion within your group who supports this concept and its benefits of culture-enrichment, teambuilding, skill development and recruiting/reputation enhancement. Look for opportunities that are quick wins and are not difficult to implement. Ask for volunteers to help plan, promote, identify the nonprofits and organize. And remember— our Symantec CR team is there to help and answer any questions for internal teams. External resources from pro bono specialists like the Taproot Foundation and Billion+Change are also useful.

Our people and our talents are our greatest strengths. As managers for a corporation with thousands of employees, we need to leverage these talents to develop and inspire our future leaders. Each of us has a skill that nonprofits need, just like our business. It’s a give-get. Our employees provide the talent and the nonprofits provide an inspirational experience that opens eyes to new ways of problem-solving. When we give what differentiates us in the marketplace, we will produce not only significant benefit for the community, but for ourselves.

I encourage you to explore the possibilities for your department, and your particular skill sets. Some ideas are included below. Share your pro bono success stories here in the comments, or contact us at CR@Symantec.com!

Copyright ©2009 Deloitte Development

Hillary Weingast is Vice President, Legal, and the developer of Symantec's Legal and Public Affairs Pro Bono Program.

Hello, welcome to this month's blog on the Microsoft patch release. This month the vendor is releasing eight bulletins covering a total of 23 vulnerabilities. 14 of this month's issues are rated ’Critical’.

As always, customers are advised to follow these security best practices:

• Install vendor patches as soon as they are available.
• Run all software with the least privileges required while still maintaining functionality.
• Avoid handling files from unknown or questionable sources.
• Never visit sites of unknown or questionable integrity.
• Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft's summary of the July releases can be found here:
http://technet.microsoft.com/en-us/security/bulletin/ms13-Aug

The following is a breakdown of the issues being addressed this month:

1. MS13-066 Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (2873872)

   AD FS Information Disclosure Vulnerability (CVE-2013-3185) MS Rating: Important

   An information disclosure vulnerability exists in Active Directory Federation Services (AD FS) that could allow the unintentional disclosure of account information.

2. MS13-062 Vulnerability in Remote Procedure Call Could Allow Elevation of Privilege (2849470)

   Remote Procedure Call Vulnerability (CVE-2013-3175) MS Rating: Important

   An elevation of privilege vulnerability exists in the way that Windows handles asynchronous RPC requests. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

3. MS13-064 Vulnerability in Windows NAT Driver Could Allow Denial of Service (2849568)

   Windows NAT Denial of Service Vulnerability (CVE-2013-3182) MS Rating: Important

   A denial of service vulnerability exists in the Windows NAT Driver that could cause the target system to stop responding until restarted.

4. MS13-060 Vulnerability in Unicode Scripts Processor Could Allow Remote Code Execution (2850869)

   Uniscribe Font Parsing Engine Memory Corruption Vulnerability (CVE-2013-3181) MS Rating: Critical

   A remote code execution vulnerability exists in the Unicode Scripts Processor included in affected versions of Microsoft Windows. An attacker who successfully exploited this vulnerability could run arbitrary code as the current user.

5. MS13-065 Vulnerability in ICMPv6 could allow Denial of Service (2868623)

   ICMPv6 Vulnerability (CVE-2013-3183) MS Rating: Important

   A denial of service vulnerability exists in the Windows TCP/IP stack that could cause the target system to stop responding until restarted. The vulnerability is caused when the TCP/IP stack does not properly allocate memory for incoming ICMPv6 packets.

6. MS13-059 Cumulative Security Update for Internet Explorer (2862772)

   Internet Explorer Process Integrity Level Assignment Vulnerability (CVE-2013-3186) MS Rating: Moderate

   An elevation of privilege vulnerability exists in the way that Internet Explorer handles process integrity level assignment in specific cases. An attacker who successfully exploited this vulnerability could allow arbitrary code to execute with elevated privileges.

   EUC-JP Character Encoding Vulnerability (CVE-2013-3192) MS Rating: Moderate

   An information disclosure vulnerability exists in Internet Explorer that could allow script to perform cross-site scripting attacks. An attacker could exploit the vulnerability by inserting specially crafted strings into a website, resulting in information disclosure when a user viewed the website.

   Internet Explorer Memory Corruption Vulnerability (CVE-2013-3184) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

   Internet Explorer Memory Corruption Vulnerability (CVE-2013-3187) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

   Internet Explorer Memory Corruption Vulnerability (CVE-2013-3188) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

   Internet Explorer Memory Corruption Vulnerability (CVE-2013-3189) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

   Internet Explorer Memory Corruption Vulnerability (CVE-2013-3190) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

   Internet Explorer Memory Corruption Vulnerability (CVE-2013-3191) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

   Internet Explorer Memory Corruption Vulnerability (CVE-2013-3193) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

   Internet Explorer Memory Corruption Vulnerability (CVE-2013-3194) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

   Internet Explorer Memory Corruption Vulnerability (CVE-2013-3199) MS Rating: Critical

   A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

7. MS13-063 Vulnerability in Windows Kernel Could Allow Security Feature Bypass (2859537)

   ASLR Security Feature Bypass Vulnerability (CVE-2013-2556) MS Rating: Important

   A security feature vulnerability exists in Windows due to the improper implementation of the Address Space Layout Randomization (ASLR). The vulnerability could allow an attacker to bypass the ASLR security feature, most likely during, or in the course of exploiting, a remote code execution vulnerability. The attacker could then load a DLL in the process.

   Windows Kernel Memory Corruption Vulnerability(CVE-2013-3196) MS Rating: Important

   An elevation of privilege vulnerability exists in the Windows kernel due to a memory corruption condition in the NT Virtual DOS Machine (NTVDM). An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

   Windows Kernel Memory Corruption Vulnerability(CVE-2013-3197) MS Rating: Important

   An elevation of privilege vulnerability exists in the Windows kernel due to a memory corruption condition in the NT Virtual DOS Machine (NTVDM). An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

   Windows Kernel Memory Corruption Vulnerability(CVE-2013-3198) MS Rating: Important

   An elevation of privilege vulnerability exists in the Windows kernel due to a memory corruption condition in the NT Virtual DOS Machine (NTVDM). An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

8. MS13-061 Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution (2876063)

   Oracle Outside In Contains Multiple Exploitable Vulnerabilities (CVE-2013-2393) MS Rating: Critical

   Remote Code Execution vulnerabilities exist in Exchange Server 2007 and Exchange Server 2010 through the WebReady Document Viewing feature. The vulnerabilities could allow a remote code execution as the LocalService account if a user views a specially crafted file through Outlook Web Access in a browser.

   Oracle Outside In Contains Multiple Exploitable Vulnerabilities (CVE-2013-3776) MS Rating: Critical

   Remote Code Execution vulnerabilities exist in Exchange Server 2007 and Exchange Server 2010 through the WebReady Document Viewing feature. The vulnerabilities could allow a remote code execution as the LocalService account if a user views a specially crafted file through Outlook Web Access in a browser.

   Oracle Outside In Contains Multiple Exploitable Vulnerabilities (CVE-2013-3781) MS Rating: Critical

   Remote Code Execution vulnerabilities exist in Exchange Server 2007 and Exchange Server 2010 through the WebReady Document Viewing feature. The vulnerabilities could allow a remote code execution as the LocalService account if a user views a specially crafted file through Outlook Web Access in a browser.

More information on the vulnerabilities being addressed this month is available at Symantec's free SecurityFocus portal and to our customers through the DeepSight Threat Management System.

There’s been a lot of confusion over the last few days, since bitcoin.organnounced that an Android component responsible for generating secure random numbers contained a critical weakness that rendered many Android bitcoin wallets vulnerable.

There are a number of different issues that seem to have come into play to make these bitcoin wallets vulnerable.

Bitcoin uses the ECDSA algorithm to ensure that funds can only be spent by their rightful owners. The algorithm requires a random number to compute an ECDSA signature, but if two different messages are signed with the same private key and the same random number, the private key can be derived. This is a known method of attacking the algorithm and was previously used to break the security of other products, such as the PlayStation 3 master key

On the Android side, the implementation of the SecureRandom class may be vulnerable in some Android versions. Earlier this year, two researchers presented on a number of issues which they claimed affected the randomness of numbers generated by SecureRandom.

Android versions from 4.2 (Jelly Bean) and on may not be affected by these specific flaws since SecureRandom was reimplemented

Certain bitcoin wallets applications using Android’s SecureRandom signed multiple transactions using an identical ‘random’ number. Since transactions are public on the bitcoin network, attackers scanned the transaction block chain looking for these particular transactions to retrieve the private key and transfer funds from the bitcoin wallet without the owner’s consent.

Other Android apps may be vulnerable to similar attacks depending on how they implement SecureRandom. Looking at Norton Mobile Insight data, we have found over 360,000 applications that make use of SecureRandom and over 320,000 of them use SecureRandom in the same way the bitcoin wallets did (they did not call setSeed). The type of applications affected are almost uniformly distributed:
 

Figure. Affected application distribution
 

We strongly advise users of Android bitcoin wallet apps to check whether their applications are affected, and to follow the steps outlined by bitcoin.org to make their funds safe. We would also like to advise Android developers to stay tuned and review their cryptographic implementations based on SecureRandom and evaluate whether this could pose a security risk.

日本では最近、電子メールにショートカット（.lnk）ファイルを添付する攻撃活動が確認されています。ショートカットファイルを使った脅威については以前のブログでもお伝えしましたが、この種の攻撃がいまだに活動を続けています。

ショートカットは、リンク先がテキストファイルであるかのように偽装されているため、欺かれたユーザーはこれを開いてしまいますが、実際はテキストファイルが開くわけではないことに気がつきません。

図 1.テキストファイルにリンクしているように偽装されたショートカットファイルのプロパティ

慎重に調べるために、リンク先のテキストボックスを左にスクロールしてみると、このショートカットを開いたとき実際に実行される悪質なスクリプトを確認できます。

図 2.ショートカットファイルの真のリンク先

つまり、ショートカットファイルは、実際のリンク先を必ず確認してから開く必要があるということです。

ショートカットファイルを開くと一連のイベントが起動し、各種のスクリプトファイルもダウンロードされて実行されます。このプロセスの締めくくりとして、偽のエラーメッセージが表示され、リモートのコマンド & コントロール（C&C）サーバーのためにバックドアが開かれます。これで、リモートの攻撃者は侵入先のコンピュータ上でさまざまな活動を実行できるようになります。

図 3.攻撃の手順

この攻撃の最大のポイントは、次のような検出回避の手法を利用していることです。

• バックドアも含めたすべての攻撃コンポーネントは、スクリプトコードで構成されています。このコードは、機能を変えることなく簡単に形態だけ変えることができるため、新しい亜種を作成するのも容易です。
• ダウンロードされるスクリプトの一部はメモリにのみ格納されるため、一般的なウイルス対策ソフトウェアで採用されているディスクスキャンのメカニズムをすり抜けることができます。
• バックドアスクリプトは AES（強力な暗号化アルゴリズム）を使って、C&C サーバーとの通信や C&C サーバーへの URL パスを暗号化します。

この脅威は、暗号化サービスの実装に Windows 標準の暗号化 API を使っておらず、Google Codeから正規のコードライブラリをダウンロードして AES 暗号化サービスを実行します。

図 4. Google Code の正規の暗号化コードライブラリを要求するコードスニペット

今までにも何度となく見てきたように、マルウェアの作成者とセキュリティベンダーは、終わりのないイタチごっこを繰り広げています。マルウェアの作成者は、ユーザーを欺いてマルウェアを実行させようとする手口や、セキュリティベンダーによる検出をかいくぐろうとする策略を日々休むことなく考えているのです。

シマンテックは、悪質なショートカットファイルを含めた一連の脅威を Downloader.Dashikutおよび Backdoor.Dashikutとして検出します。

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/jaにアクセスしてください。

Android でセキュアな乱数を生成するコンポーネントに致命的な脆弱性があるため、Android 用の多くの Bitcoin ウォレットが脆弱になる。Bitcoin.orgからこのような発表があったことを受けて、数日間は大混乱が続きました。

Bitcoin ウォレットの脆弱性を引き起こす原因となる問題はさまざまです。

Bitcoinは、正規の所有者しか資金を使えないようにするために ECDSAアルゴリズムを使っています。このアルゴリズムには、ECDSA 署名を計算する乱数が必要ですが、2 種類のメッセージが同じ秘密鍵と同じ乱数で署名されている場合には、秘密鍵の抽出が可能です。これはアルゴリズムを攻撃する既知の手法であり、以前にも PlayStation 3 のマスター鍵など、他の製品のセキュリティを突破するために使われたことがありました。

Android の側では、Android の一部のバージョンで SecureRandomクラスの実装に脆弱性がある可能性があります。今年の初め、SecureRandom クラスによって生成される乱数のランダム性に影響があるとして、2 人の研究者が多数の問題点を指摘しました。

Android バージョン 4.2（Jelly Bean）以降は、SecureRandom クラスが再実装されたため、この固有の欠陥の影響を受けません。

Android の SecureRandom クラスを使う一部の Bitcoin ウォレットアプリは、同じ「乱数」を使って複数のトランザクションに署名していました。トランザクションは Bitcoin ネットワーク上で公開されるため、攻撃者はトランザクションのブロックチェーンをスキャンしてこのトランザクションを探せば、所有者の同意を必要とせずに Bitcoin ウォレットから秘密鍵と資金を取り出すことができます。

SecureRandom クラスの実装方法によっては、他の Android アプリも同様の攻撃に対して脆弱な可能性があります。ノートン モバイルインサイトのデータを見ると、SecureRandom クラスを利用しているアプリは 360,000 以上あり、そのうち 320,000 以上は SecureRandom クラスの使い方が Bitcoin ウォレットと同じです（setSeedを呼び出さない）。影響を受けるアプリは、ほぼあらゆるカテゴリに分布しています。
 

図. 影響を受けるアプリの種類
 

Android 用の Bitcoin ウォレットアプリを使用している場合は、そのアプリが脆弱性の影響を受けるかどうかを確認し、Bitcoin.orgのサイトで説明されている手順に従って資金を保護することを強くお勧めします。また、Android 開発者の場合も、最新情報を確認したうえで SecureRandom クラスに基づいた暗号化の実装を見直し、セキュリティリスクを引き起こす可能性があるかどうかを評価することをお勧めします。

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/jaにアクセスしてください。

mobilesecurity.com [Ratingen, Germany] Symantec's Markus Gruneberg wrote an interesting whitepaper on the topic of BYOD recently. Follow the link below for the full article.

The challenge of BYOD (‘Bring your own Device’) has reached government agencies, where demand to integrate tablets and smartphones into the organizational structure is increasing on a daily basis. 

In reality, BYOD is mainly limited to certain individuals in the upper echelon of the civil service where devices tend to be exclusively maintained by administrators, and the acquisition of initial mobile management solutions is usually limited to executive-level and senior management positions. 

- See more at: http://www.mobilesecurity.com/articles/417-looking...

mobilesecurity.com [London, UK] Industry observers, manufacturers and developers have all predicted that biometrics could have a role to play in the future of mobile security and now independent research is backing them up. New York-based research organisation Heavy Reading has published a report into smartphone biometrics, and its findings are positive.

In the report, named 'Biometrics Offer Promise for More Secure Smartphones’, Heavy Reading consultant Denise Culver looks to biometrics as a 'not if, but when' technology, while pointing to the merger and acquisition movements of the last few months as proof. Such movements certainly include Apple's July 2012 acquisition of AuthenTec, and mobile users can take that acquisition as a strong indicator of the truth in Heavy Reading's statement.

- See more at: http://www.mobilesecurity.com/articles/548-biometr...

E-commerce is on a massive upward trajectory in the Middle East and North Africa (MENA) region. According to a recent report issued by Visa[1], nowhere else in the world is growing as fast: MENA experienced a 45% increase in 2012, compared to the previous year, with transactions soaring from $10 to $15 billion.[2] The fastest growing markets

For retailers who have tended to ignore or avoid this market, in favour of others that have seemed both more stable and lucrative, those figures are bound to make them think again. This is fertile territory and many of their rivals are now clearly reaping the rewards to be had there. So expect to see competition hotting up!

What are people buying online right now and how can the MENA region overcome some fundamental factors to drive growth even higher? The popular and growing areas for e-commerce right now are banking, paying bills and booking travel. Purchasing items and/or services is still not as developed as in the major European markets, and clearly this offers vast promise for those who can exploit its vast potential in the MENA region[3].

That said, and despite its impressive performance of late, the MENA region is still not actually expanding at nearly the same rate as the rest of the globe when it comes to e-commerce.  Why is this? In part it’s down to lack of confidence and trust online; according to a recent survey by Onecard, 56 per cent of respondents based in the Middle East said they were concerned about credit card fraud and the region faces the same barriers seen elsewhere around the world, where lack of trust and payment security are regularly highlighted as key concerns for people when choosing to shop online. Additionally a report from Deloitte highlights[4] that it is there are three other factors that are holding growth back:

First, there are the logistical issues around physical addresses (they are not well defined enough) and also the postal system itself, whose infrastructure is poor.

Secondly, there is an absence of the relevant e-laws necessary to provide proper levels of protection for consumers and vendors.

And, finally, it can be expensive for small businesses to set up payment gateways, thus deterring them from entering the market – a factor that is reflected in the widespread popularity of cash on delivery (COD) payments across the region. Strikingly, while there are an estimated 90 million internet users in the Middle East, a mere 15% of Middle East companies have an online presence.[5] Moreover, some 70-80% of online purchases are COD, with just 30% paid for online – and that despite almost 50% of consumers owning credit cards.

At the same time, it should be said that such flexibility of payment types has certainly made e-commerce more accessible, and more attractive, to users; and no doubt has contributed substantially to the surge in sales that has taken place recently. Whilst ‘cash on delivery’ is a good solution to consumers’ lack of trust in online transactions, it can hinder the growth of e-commerce in the region due to difficulty in coordinating home delivery services and ultimately it’s much less cost effective than taking payments online. As mentioned above, ecommerce comes branded with what is a typical online question for end users and retailers alike: ‘Are you safe?’ Because, unless they truly believe that they can operate securely online – and that transactions can be undertaken and completed in a tightly protected environment – the massive potential that MENA offers will simply not be realised.

These issues are of course being addressed and in anticipation of this it’s worth considering that in order to Be successful online, and to capture more consumer mindshare and business, sites need to be:

• Accessible (particularly for mobile) – consider responsive design to meet the needs of your visitors
• Easy to use – e.g. clear navigation and extensive search
• Trustworthy – demonstrate that your site can be trusted with credit card details using clear security indicators such as SSL, and through the use of online trust marks such as the Norton Secured Seal
• Fully localised into your target markets language.

All well and good… in theory. The reality is that, while it’s relatively simple to set up an e-commerce site, there is still widespread ignorance of the potential hazards that exist when sending data via unsecured connections. In fact, many customers still do not even know that SSL certificates exist to protect them online.

Clearly, sites in the Middle East region that really want to be successful should be using SSL and trust marks to demonstrate that they are professional, dependable and safe to do business with. Indeed in my opinion SSL certificates should be mandatory for any ecommerce site or for anyone else that asks customers to submit any kind of personal information. Using SSL is also the clever option for companies that don't ask for personal information from visitors – something that can act as a barrier on line. Companies such as Google use SSL to pass along certain information about what searchers are looking for – and are requiring this higher level of security to perform that service. This trend seems likely to continue, making SSL certificates vital to virtually any website – but especially those with e-commerce in mind.

One question when considering which security vendor can add the most value to your existing or newly established site is “how can I can demonstrate my trustworthiness to potential customers?” According to a survey carried out this year by the independent web research organisation Baymard Institute in conjunction with Google, the Norton Secured Seal is by far the most trusted, with 35.6% of the votes – nearly 13% ahead of its nearest rival. It was shown to be the seal that gave customers the strongest sense of trust when purchasing online, making it the de facto choice[6].

Such reassurance will play a major role, as the internet spreads it reach and e-commerce gathers ever greater momentum throughout MENA capturing and keeping customers is where success lies.

Service level agreements (SLAs) must be met whether you’re keeping mission-critical data centers running or serving up frosty beverages. Disasters, configuration errors, poor performance, thirsty customers…it’s an ever-changing race to keep your operation available, fast, and resilient. Let us show you what our customers are doing to meet the challenge of delivering on SLAs.

The performance gap between computing devices and storage devices has been growing for several years. Currently, CPU and DRAM operations are measured in nanoseconds while hard disk drive (HDD) operations are measured in milliseconds – that is several orders of magnitude difference.  Enterprises are increasingly looking at SSD/Flash storage to help narrow this performance gap.

Join the Symantec Storage team on Wednesday, August 21 at 9:30am PT to learn about the growing reliance on SSD/Flash to optimize storage environments, discuss the benefits and risks, and examine best practices in incorporating SSDs to help meet your SLAs.

Tune in and get your questions answered live by our expert panelists during the event by submitting your questions to the hashtag #SYMCHangout.

Mark your calendars:

Title:               Why Host-Based SSDs are Critical for SLAs in Mission-Critical Datacenters

Date:                Wednesday, August 21, 2013

Time:               Starts at 9:30 am PT

Length:            1 Hour

Where:             Google+ Hangout: http://bit.ly/13T1ak9