Google and others update imagery of Haiti

There was a report about how Google, Microsoft and other technology companies were using their technology to help the efforts in Haiti. The report said that the new images were on Google Earth. We checked them out using updated Haiti KML files that can be found here. These are incredible images of Port-au-Prince and surrounding areas. These are striking.

 

If you don’t have Google Earth, you can get it here. Or you can use Google Maps at http://maps.google.com. Use this link to get to Port-au-Prince.

Apple faithful, don’t be casting those stones just yet (Apple Security Update 2010-001)

While reading the Windows story in the ISC site, I was drawn to mention of an Apple Security Update that was released today. It contains numerous updates for various MAC OS X 10.x operating systems. These are the kind of issues that the MAC faithful don’t mention when they declare their OS of choice is so “secure” and not subject to the kinds of problems that MS operating systems are. Taken from the Apple Security Update:

• Playing a maliciously crafted mp4 audio file may lead to an unexpected application termination or arbitrary code execution
• A remote attacker may cause an unexpected application termination of cupsd
• Multiple vulnerabilities in Adobe Flash Player plug-in
• Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution
• Viewing a maliciously crafted DNG image may lead to an unexpected application termination or arbitrary code execution
• An attacker with a privileged network position may capture data or change the operations performed in sessions protected by SSL

The link to the Apple update: http://support.apple.com/kb/HT4004

Microsoft Windows (just about all) Privilege Escalation Vulnerability

As if things weren’t troubling enough for Microsoft, another vulnerability disclosed today and included exploit code.  The Internet Storm Center (ISC) mentions that this vulnerability exists in operating systems dating back to Windows NT 3.1 and involves the support for 16-bit applications. It continues through all versions of Windows since then, including Windows 7 and Windows Server 2008. The release was posted to a security email list.

The email author claims that nothing malicious was intended by the release and that he notified Microsoft of the vulnerability in June of 2009. No patch is available and the vulnerability remained undisclosed until today. To demonstrate his desire to have the vulnerability patched, the author detailed workarounds to mitigate this vulnerability, including providing links YouTube videos.

This vulnerability has considerable potential. We’re frankly surprised that there hasn’t been more public mention of this vulnerability; especially with exploit code having been released with the notice. Privilege escalation means that code of choice can be run with additional security rights either by a user or by a remote attacker.

Microsoft Releasing Out of Band IE patch

MS announced they will be releasing a patch for the Internet Explorer vulnerability before the regular cycle in February. Commercial administrators will want to review the impact of the patch and test it. Residential customers will want to plan on getting the patch during Windows Update that will most likely run at night.

As mentioned previously, this vulnerability is already being exploited, which makes this a serious concern. Be sure to get the patch manually at home if you don’t have Windows Update set to run automatically.

A “Zero-day” vulnerability has some security organizations raising their threat warning systems

A few days ago, Microsoft released an advisory about a vulnerability in Internet Explorer that is being exploited. According to a McAfee blog, this vulnerability was used in the attacks on Google in China earlier in the week. McAfee found this vulnerability while researching attempted penetration into several large organizations. Although most visible attacks have been against Internet Explorer 6.0, IE versions 7 and 8 are also vulnerable on all recent versions of Windows; that’s workstations AND servers.

United States Computer Emergency Readiness Team (US-CERT) issued Vulnerability Note VU#492515 on the subject. In it, they recommend the following workarounds:

• Set the Internet zone security setting to "High"
• Configure Internet Explorer to prompt before running Active Scripting or disable Active Scripting in the Internet and Local intranet security zone
• Enable DEP for Internet Explorer 6 Service Pack 2 or Internet Explorer 7

This vulnerability allows remote execution of the code of choice of the attacker. Internet Explorer is “less” vulnerable if Data Execution Prevention (DEP) is enabled. This is enabled by default in IE8. To help users enable DEP, they have provided a Knowledge Base article with a clickable “FIX IT NOW” wizard to turn it on. You can find it here. Microsoft further makes recommendations on their site dedicated to “Online Safety”.

McAfee has assigned moniker “Operation Aurora” to this attack. With the events of the Haiti Earthquake and relief efforts, news stories surrounding the Massachusetts special election next week and Health Care Reform proceedings, and any other social newsworthy event, this security concern is not going to go away soon; especially when “news” consumers are sure to click on any sensational report.

No patch is available yet and may not be until the normal patch cycle (next one in February). Malware authors are expected to “turn up the heat”. Don’t be surprised if additional attacks are found in mailboxes tonight and tomorrow.

Malware/Fake Anti-Virus IS exploiting the earthquake in Haiti

As expected, many of the domains that were being registered are malicious. According to ZDnet, several hundred that have been found are serving up malware that is pretending to be anti-virus and system messages.

The end result is bogus content related to Red Cross and other relief efforts. Google searches reveal the sites are already appearing in the first 10 slots in returns. Sunbelt Software identify one here:

The Internet Storm Center (ISC) has another picture here: 

Domain Names related to the Haiti Earthquakes are being registered

In a press release issued today, the FBI has issued a fraud alert to remind internet users that they should be very cautious when approached about donations for relief efforts. The emotion being played out in on TV and the internet makes the public easy prey for criminals. Using tragedies from the past, the FBI recommends the following when considering donations:

• Do not respond to any unsolicited (spam) incoming e-mails, including clicking links contained within those messages.
• Be skeptical of individuals representing themselves as surviving victims or officials asking for donations via e-mail or social networking sites.
• Verify the legitimacy of nonprofit organizations by utilizing various Internet-based resources that may assist in confirming the group’s existence and its nonprofit status rather than following a purported link to the site.
• Be cautious of e-mails that claim to show pictures of the disaster areas in attached files because the files may contain viruses. Only open attachments from known senders.
• Make contributions directly to known organizations rather than relying on others to make the donation on your behalf to ensure contributions are received and used for intended purposes.
• Do not give your personal or financial information to anyone who solicits contributions: Providing such information may compromise your identity and make you vulnerable to identity theft.

Internet Storm Center Warns of Haiti Earthquake scams

Computer security experts have always warned about public events that become instruments of attack. Like watching a car wreck, we are attracted to the promise of disaster videos. For others, the calling to "help" causes them to click on links in emails when faced with a donation need. Unfortunately, the vast majority of these are bogus emails with ill intent.
The Internet Storm Center (ISC) posted a reminder of these possibilities in a detailed article here.
I wouldn’t find it surprising if emails started showing up in mailboxes about the recent Tonight Show debacle.