Secure USB Flaw Exposed
Update
Our Handler Arrigo Triulzi pointed out that the "fixed memory content" that was mentioned in the paper is actually the encryption key used internally in these devices. Due to ease of manufacturing, this key is the same for all devices manufactured.
----
Several ISC readers have written in regarding a security flaw recently exposed on USB flash drive. The issue of the attack is with a software bug in the password verification mechanism. This affects Kingston, SanDisk and Verbatim.
Vendor Information
SanDisk Update Information: http://www.sandisk.com/business-solutions/enterprise/technical-support/security-bulletin-december-2009
Verbatim Update Information: http://www.verbatim.com/security/security-update.cfm
Kingston Recall Information: http://www.kingston.com/driveupdate/
UPDATE: An ISC reader has contacted Kingston support and confirmed they will be releasing a firmware patch to fix the issue. They have described it as a randomization error and it will affect some of the drives. Thanks Tony.
-----------
Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot org
Possible new MySQL 0day
Intevydis published a flash video on Monday showing what appears to be a new 0day exploit against MySQL 5.x. The demo (http://intevydis.com/mysql_demo.html ) is for a recent exploit included in their VulnDisco exploit pack for CANVAS as of Aug 2009. The demo shows as running against 5.0.51a-24+lenny2 but the description appears to be "MySQL 5.x Exploit" which suggests it may work against other versions as well. Current versions for MySQL are 5.1 (recommended) with a 5.5 release available.
If anyone has any additional details on this vulnerability we'd love to hear about it.
Firefox update available
Just a quick note - Mozilla released Firefox 3.5.7 and 3.0.17 yesterday. Having looked through the patch list, it doesn't appear that there are any security issues though there are some stability fixes added.
Details can be found here:
Firefox 3.5.7: http://www.mozilla.com/
Firefox 3.0.17: http://www.mozilla.com/
Denial of Service Attack Aftermath (and what did Iran have to do with it?)
I finally finished the report summarizing what we learned from yesterday's denial of service attack. Luckily it was small and easily defeated. The interesting part with attacks like this is to try to attribute them to a group or individual. In this case, my best guess is that this is an individual living in England. The individual appears to have some ties to Iran. Probably a student going to school in England.
The attack itself was rather simple, and required little skill. We got some great help from some of the administrators of the system attacking us. Most likely, the root cause was unprotected FTP accounts. These unprotected FTP accounts got used to upload a malicious ASP script, which was then used to attack our site. The script was very simple and had no "command and control" channel. Instead, it required a GET request hitting the specific URL to activate the attack.
The full report got a bit long for a diary, so I wrote it up as a PDF for download. I know... yet another PDF ;-).
Link to the PDF: http://isc.sans.org/presentations/jan4ddos.pdf
To make you feel better, here the checksums:
md5: 8eb9d6ef20c05875688d97fd3192a7e9
sha1: c097c740669869349bb5f8a3d3447ffa0376f928
ripemd160: 227feacd529de68c0634e1b5ca574d55cacf31ef
GPG signature:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)
iEYEABEDAAYFAktEDmIACgkQPNuXYcm/v/3qzQCfRLKM64UiiWgWp0QDEomX1VAE
/gsAn2Dxst/Pe8kYsNz+QCmSZng+yRNj
=Or18
-----END PGP SIGNATURE-----
------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter
Comments