Where Are The iPhone Patches?

The iPhone software, as you may know, is a special version of Mac OS X itself. In the last few months there have been numerous updates to OS X (such as this, this, this, and this) but, as Brian Krebs of the Washington Post points out, there have been no security updates to the iPhone since February.

In that time several serious vulnerabilities in OS X were found and patched. Some, as described by Krebs, are known to exist on the iPhone. Why would Apple wait so long? Krebs speculates that since the iPhone 2.0 software will soon be released, Apple is focusing on that instead.

Posted in Web Security | 1 Comment »

Update Coming To Windows Update

Be on the lookout for an update coming over the next few months to Windows Update itself, the software in Windows that finds and applies updates to itself.

According to the Microsoft Update Product Team, the update will improve performance, especially in the time it takes to scan to see if new updates are available. They say they’ve seen improvements with this update of almost 20%.

The Update team calls such updates Infrastructure Updates and sends them out about once a year. In fact, Windows Update will download and apply infrastructure update regardless of user settings for whether Windows should apply updates. The rationale for this is that, but for such updates, the user might not have accurate information about what updates existed, and might think that they were secure when they weren’t. This behavior has been controversial for some time, as it seems to violate an explicit user setting, and there are criticisms of it in the comments to the blog referenced here.

Posted in Web Security | No Comments »

Adobe Acrobat 9 Does The Right Thing On Vista

When Adobe announced that they would combine Flash and Acrobat, two heavily attacked and common software components, into one package, I was concerned. Combining two big attack surfaces into one bigger one seemed like a dangerous proposition.

The argument may or may not make sense, but for Vista users Acrobat 9 (now with Flash!) will be much, much harder to compromise than in the past. As Microsoft Security Software Engineer Robert Hensing reveals, Acrobat 9 on Vista opts in to DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization). These defensive feature will mean that even if—actually, I should say “when”—new vulnerabilities are found in Acrobat 9, they will be much harder to exploit in real world cases because DEP and ASLR impede a very large percentage of the exploit techniques..

Technically, opting in to these features should mean just adding some linker switches, but for a company like Adobe it can mean a lot more work than that. It might have meant changing tools and it certainly meant doing a lot more testing and probably more debugging. DEP and ASLR are likely to uncover other types of bugs in software that might have appeared benign in the past, but which will throw exceptions with DEP and ASLR enabled. They force you to write better code.

So hats off and some applause for Adobe for doing the right thing by their Vista users. They will be a lot safer. Even the XP SP2 and SP3 users will be safer if they turn on DEP.

Posted in Web Security | 1 Comment »

Who Is Running The Most Secure Browser?

A recent study by ETH Zurich, Google, and IBM, looked at log data provided by Google and came to the conclusion that large numbers of users are not running the most secure, up-to-date version of their web browser. The study also found that this was more a problem of Internet Explorer users than of Firefox users.

But limitations in the methodology used in the study call into question the conclusions reached by the author, according to an analysis of the study in eWEEK by yours truly. The Google log data was based on the HTTP user-agent string provided by the client browsers in order to identify them, and Internet Explorer provides much less precise data in its user-agent than other browsers. While Firefox provides data on the specific build of the browser, IE provides only major version information (IE6, IE7, etc.) So the study authors decided that everyone using IE7 was up to date (even those who hadn’t applied IE7 patches), and everyone using IE6 was insecure, even those who had applied all patches available for it.

We can definitely conclude from the study that Firefox users overwhelmingly apply patches quickly, which shows that they are probably more technical users with authority over their systems, and not mainstream corporate IT users who don’t have authority to apply such patches. IE5 and IE6 are still supported products from Microsoft because customers demand it, whereas Mozilla has already announced that support for Firefox 2 will end in December 2008.

Posted in Web Security | No Comments »

No Critical Updates In July Patch Tuesday

On Tuesday, July 8, Microsoft will release 4 security bulletins and patches to address them. All four are rated “Important”. Two bulletins address vulnerabilities in Microsoft Windows, one in Exchange Server and one in SQL Server.

The first Windows issue affects just Windows Vista and Windows Server 2008. It is characterized as a remote code execution bug, the only one of the 4. The “Important” rating probably means that the issue is mitigated; perhaps it is in a feature which is not turned on by default. We’ll learn more on Tuesday.

The second Windows issue is a spoofing bug. The bulletin is somewhat unclear on which versions are affected. Many versions are marked with “No client update applicable” or “No server update applicable” as opposed to the more usual and straightforward “Not applicable.” I suspect that all versions are affected, but for some of them there is no update, for reasons which will become more clear on Tuesday.

The SQL bulletin is a privilege elevation bug that affects the SQL Server 2000 Desktop Engine and the Windows Internal Database (WYukon) Service Pack 2 (both 32-bit and x64), as well as all supported server versions of SQL Server.

The Exchange Server bug is also a privilege elevation bug that affects Exchange 2003 SP2 and Exchange 2007, SP0 and SP1.

Posted in Web Security | 1 Comment »

Whitepaper: Vulnerability Assessment Plus Web Application Firewall (VA+WAF)

For those interested we’ve released a whitepaper on how Vulnerability Assessment Plus and Web Application Firewall (VA+WAF) function independently and collectively. We spend a few pages describing the technical fundamentals of both which many should find educational – especially on the WAF side with industry material in painfully short supply. Very few people really understand the nitty gritty details of how WAF work and deployed in the real-world. I’ve learned a great deal in the last couple months talking with those who have. There is a little F5 ASM marketing in the paper so beware! Enjoy, snippets:

“WAFs at their core are designed to separate safe Web traffic from malicious traffic before it’s received by the website. And, if an attack does find a way to sneak past a WAF, it still has the ability to prevent sensitive information from leaving the trusted network. To get a better understanding of how the technology works, it’s helpful to view a WAF’s functionality as three discrete components - policies, policy generation, and policy enforcement. Depending on the particular WAF in use, they may go about implementing each component in a number of different ways. No one particular way has proven to be the right way, as each has its pros and cons.”

“Every effective vulnerability assessment program requires a cohesive combination of people, process, and technology. Qualified people are necessary to carry out day-to-day tasks, manage the technology, and interpret the results to make them meaningful to the business. Process is required for coordinated efforts between executive management, IT Security, and software development groups to share information, prioritize vulnerability fixes, and enable organizational improvements. The right technology is essential for consistency, efficiency, and comprehensiveness. Whether an organization chooses to perform vulnerability assessments with internal resources, a consultancy, or a Software-as-a-Services vendor, the overall vulnerability program must always account for people, process, and technology. If not, the effort will cost more in time and dollars than it should. Or worse, simply not work.”

Posted in Web Security | No Comments »

Security on a Stick

A new class of security product has developed over the last year or two, the USB key security token. These products perform a variety of functions, from cleaning up systems to storing and protecting your username/password pairs, then filling them in when you log in to web sites, and protect themselves against tampering. Now PCMag has a review of 4 of them by our own Neil Rubenking.

There are host-based programs for doing all of these things, but of course they all fail to work once you go to a different computer. I can imagine circumstances in which these would fail, such as a locked-down PC in a cafe, but they can certainly be a secure convenience.

Posted in Web Security | No Comments »

Firefox 2.0.0.15 Fixes Multiple Serious Security Issues

The Mozilla Developer Center announced the release of Firefox 2.0.0.15, what is sure to be one of the last releases of the Firefox 2 generation.

According to the Known Vulnerabilities in Mozilla Products page the update fixes a dozen vulnerabilities.

• MFSA 2008-33: (Critical) Crash and remote code execution in block reflow
• MFSA 2008-30: (Critical) File location URL in directory listings not escaped properly
• MFSA 2008-25: (Critical) Arbitrary code execution in mozIJSSubScriptLoader.loadSubScript()
• MFSA 2008-24: (Critical) Chrome script loading from fastload file
• MFSA 2008-21: (Critical) Crashes with evidence of memory corruption (rv:1.8.1.15)
• MFSA 2008-28: (High) Arbitrary socket connections with Java LiveConnect on Mac OS X
• MFSA 2008-27: (High) Arbitrary file upload via originalTarget and DOM Range
• MFSA 2008-23: (High) Signed JAR tampering
• MFSA 2008-22: (High) XSS through JavaScript same-origin violation
• MFSA 2008-32: (Moderate) Remote site run as local file via Windows URL shortcut
• MFSA 2008-29: (Moderate) Faulty .properties file results in uninitialized memory being used
• MFSA 2008-31: (Low) Peer-trusted certs can use alt names to spoof

Firefox 2.0.0.15 is available for download at the old version download page, and Mozilla says that automatic updates and the Check for Updates option should work soon.

Mozilla also pointed out that they recommend upgrading to Firefox 3. Once they issue a new major version they stop issuing updates for the earlier ones within a few months.

Posted in Web Security | 1 Comment »

EXCEL.EXE is not a valid Win32 application

“EXCEL.EXE is not a valid Win32 application”

Huh? It was this morning.

I do love Vista SP1, but it has freaked out on me now and then. Last night I tried to open a spreadsheet by double-clicking on the .xls file. Windows told me that there was no association for that file type. I stared at the obviously false message for a while, trying to decide what to make of it. I briefly tried check the file association, and then just figured I’d run Excel directly, and got that error message.

I’ve noticed that this notebook I’m working on gets quite hot when it’s been on for a long time. At such times I’ve seen it flip out in ways I’m sure are hardware-focused, such as the video going all nuts and the system rebooting. Even though this didn’t seem like a hardware error I decided to shut down for a while and watch TV. When I got back, Excel and the file association ran fine.

Then, the next morning, purely by coincidence, I noticed a blog entry on the SBS Diva blog with the title “EXCEL.EXE is not a valid Win32 application”. The entry referred to Knowledge Base article 952709 and a “reliability and performance update” (i.e. hotfix) that fixes it. I applied the hotfix and the error hasn’t reappeared, but I haven’t exactly stressed the system since then.

The hotfix addresses several problems, including mine:

• Crashes in Windows when checking POP3 mail, when certain types of security software are installed.
• The system may stop responding when you delete user accounts in the User Accounts control panel.
• “…large applications cannot run after the computer is turned on for extended periods of time.” For instance, “EXCEL.EXE is not a valid Win32 application”
• The system crashes in Windows Live Photo Gallery when using the Apple QuickTime thumbnail preview.
• Reducing audio and video (AV) stuttering when streaming high definition content from a Windows Vista SP1-based computer that has a NVIDIA network adapter nForce driver version 67.5.4.0 that is installed to a Windows Media Center Extender device.

Posted in Web Security | 2 Comments »

Firefox 2.0.0.15 Fixes Secret Security Bug

The Mozilla Developer Center announced the release of Firefox 2.0.0.15, what is sure to be one of the last releases of the Firefox 2 generation.

The announcement refers to the Release Notes for changes in the new version, which it specifies with the phrase “The following security issue was fixed.” The link in the phrase goes to the “Known Vulnerabilities in Mozilla Products” page, which has no entry for the 2.0.0.15 version. Likewise, the Mozilla Foundation Security Advisories page has no entry for it. This is all as of now, which is 7/1/2008, 8PM eastern.

[Update: By the next morning Mozilla had updated their information and we issued a new blog. Click here please.]

We can verify that 2.0.0.15 is available for download at the relevant download page, and Mozilla says that automatic updates and the Check for Updates option should work soon.

This problem is sort of the flip side of previous problems Mozilla has had with their e-mail client Thunderbird, where they would disclose vulnerabilities and announce the version in which those vulnerabilities were fixed, but that new version wouldn’t actually be available, potentially for weeks.

Posted in Web Security | No Comments »