Drive by Download attacks

Drive by Download attacks

 

Users browse through web-sites and they are asked to install certain Active X applications for better viewing of the website. Unsuspectingly, users would click “YES” resulting in the installation of mallware / spyware etc. This process is called Drive by Download attacks

 

Spyware vendors frequently use automated installations of ActiveX controls (a special kind of plug-in program for Microsoft's Internet Explorer web browser) to distribute their software via web sites. These automated installations are initiated when web surfers land on pages that include HTML code to start the download and installation process. These installations may also be initiated by pop-ups spawned by web pages that users visit. As these installations are initiated by web sites and not users, many consumers refer to these automated installations as "drive-by-downloads." Web users often find these "drive-by-downloads" confusing and disorienting, and it is little wonder that many of them would carelessly click through pop-ups on web sites with very little understanding of the programs they are in fact allowing to be installed on their PCs.

 

This link gives a very good explanation of this process. - http://www.spywarewarrior.com/uiuc/dbd-anatomy.htm

 

What are Virtual IT Systems?

Source: “Auditing Security Risks in Virtual IT Systems “ - Abhik Chaudhuri, MCA, PMP, SH (Basie) von Solms, and Dipanwita Chaudhuri, ACA (ICAI), MIIA; Isaca – vol 1 – 2011

Virtualization in a distributed environment is the basis for grid computing & cloud computing – supplying computing infrastructure as a utility, on-demand service. It can be applied to O/Ss, desktops, applications, storage (SAN) and networks.

What is Virtualization?
Virtualization S/W – Virtual Machine Monitor (VMM) or Hypervisor sits on native O/S. This plays the role of a resource manager that enables sharing of processing power & memory. This virtualizes the H/W of the physical machine & partitions it into multiple, logically separate VMs.

Components of Virtualization
· Physical hardware or virtualisation host—Physical machine on which the VM environments reside. The number of VMs that can be supported on a single physical machine depends on the hardware configuration and specifications.
· Host operating system—Primary OS on the physical machine. The virtualisation layer resides on this OS.
· Virtualisation layer—Virtualisation software that co-ordinates with the host OSs for requests from VMs regarding CPU time, physical memory, disk read and write, network input/output (I/O), etc. The virtualisation software is called hypervisor and it plays an important role in virtualisation technology. It intercepts the hardware resource requests from the virtual machines that reside on it and translates the requests to a format that can be understood by the physical hardware. Similarly, the requests from the physical hardware are translated by the hypervisor so that the virtual machines can understand. The hypervisor decouples the VMs from the physical hosts by introducing a layer of abstraction between the VMs and the physical hardware layer.
· Not all virtualisation solutions leverage a hypervisor. Some of the virtualisation products that make use of a hypervisor are VMware ESX and Virtual Infrastructure, Microsoft Hyper-V, and Citrix XenSource.
· Virtual machine—Independent and isolated environment created by the virtualisation software. OSs can run VMs independent of each other.
· Guest operating systems—The OSs installed on VMs. These run on the host OS. Virtualisation technology allows multiple VMs with heterogeneous guest OSs to run in isolation, side by side on the same physical machine. The VMs have their own virtual hardware (e.g., CPU, RAM, disks, network cards) on which the guest OSs and applications are loaded. The guest OSs perform consistently, irrespective of the physical components.

Types of Virtualization:

· Storage virtualisation—Virtualises the physical storage from multiple network storage devices so that they appear to be a single storage device. In general, ‘virtualization’ refers to server virtualization.
· Network virtualization—Combines computing resources in a network by splitting the available bandwidth into independent channels that can be assigned to a particular server or device in real time
· Server virtualization—Hides the physical nature of server resources, including the number and identity of individual servers, processors and OSs from the software running on them.

Benefits of Virtualization:


· Improving IT service agility
· Reduces the infrastructure cost of ownership by decreasing the total number of physical servers; therefore, operating expenses go down dramatically.
· It expedites the server provisioning procedure
· Improves capacity management.
· IT efficiency is increased due to shared CPU processing capacity and effective storage utilisation. VMs are capable of running different OSs and have several benefits such as encapsulation, isolation and partitioning.
· VMs are encapsulated into files, which make it possible to :
o rapidly save, copy and provision the VM.
o Fully configured systems, applications, OSs and virtual hardware may be moved within seconds from one physical server to another, for zero-downtime maintenance and continuous workload consolidation.
· VMs are completely isolated from the host machine and other VMs. If a VM crashes, all others are unaffected.
· Data do not leak across VMs, and applications can communicate over configured network connections only.
· It allows for partitioning multiple applications and supporting multiple OSs within a single physical system. Servers can be consolidated into VMs on either a scale-up or scale-out architecture, and computing resources can be treated as a uniform pool that is allocated to VMs in a controlled manner.
· Effective segregation of duties, simulation support with multiple versions of the same or different OSs, more continuity options and expansion of the test environment.
· Some big organisations have embraced virtualisation to increase business resiliency to support disaster recovery (DR) and business continuity.

Benefits from a security point of view:

· Better forensic capabilities
· Faster recovery after an attack
· Safer and more effective patching
· Better control over desktop resources
· More cost-effective security devices

MIEL e-Security

Lot of courses in information Security -   http://www.mielesecurity.com/Services/ISTI/ISTI%20schedule.htm   http://www.mielesecurity.com/Services/ISTI/prism.html   There was this article sometime back about the founder of this company.

Top 10 Web Application Security Risks for 2010

The OWASP Top 10 Web Application Security Risks for 2010 are:
A1: Injection
A2: Cross-Site Scripting (XSS)
A3: Broken Authentication and Session Management
A4: Insecure Direct Object References
A5: Cross-Site Request Forgery (CSRF)
A6: Security Misconfiguration
A7: Insecure Cryptographic Storage
A8: Failure to Restrict URL Access
A9: Insufficient Transport Layer Protection
A10: Unvalidated Redirects and Forwards

Top 5 app-security risks for 2010

Reference: http://developer.practicalecommerce.com/articles/1489-Top-Five-Application-Security-Risks-for-2010

So here they are, the top five application-security risks for 2010.

1. Injection Attack
All web applications that collect and transmit data (using forms, for example) are susceptible to injection attacks. By sending specific commands through your application's forms, hackers can modify various elements of the code. In extreme cases, injection attacks could allow attackers to penetrate a firewalled environment, such as a network or database.

SQL injections like the ones that compromised Symantec and NASA this year dominate this attack category, but there are many additional varieties to which you could fall prey.

Some of the best protective measures for injection attacks include:
· Input Validation. Cleanse your input data.
· Human Verification.
· Restrictive Privileges. When connecting applications to databases and other proprietary systems.
· Vague Error Messages. Gives attackers little detail to go on and can help defray an onslaught

2. Cross-site Attack
Cross-site scripting (XSS) attacks steal private information like cookies or session tokens that unsuspecting users have associated with a particular website. XSS exploits can also redirect victims to familiar-looking web content that has been devised by the attacker to steal personally identifiable information or install malware.

Hackers deliver the malicious XSS-laden content that makes these exploits possible in the form of JavaScript, HTML, Flash or any executable code format for that matter. Any web application that compiles user-generated content without validating or encoding it first could fall prey to an XSS exploit. Social media hubs and blogs that allow users to post un-moderated comments are extremely susceptible to malicious XSS exploits (as was the case with Reddit's stored XSS attack earlier this year). This can include customer reviews and comments.

Reflected XSS exploits can be combined with phishing techniques to invade private information systems like email. Lance James and his team of experts reveal how easily they exploited an XSS vulnerability to win Strong Webmail's $10,000 challenge in a quick two weeks. Developers can help prevent XSS Attacks by deploying code that:
· Validates user input.
· Does not give a site or page "full trust" simply because HTTPS is present.
· Is heavily tested. Test, test, test, and then test again before launching or introducing website enhancements.

3. Cross-site Request Forgery
Cross-site request forgery (CSRF) exploits force unknowing users to carry out any number of malicious activities as long as the action is allowable within their permission set during an authenticated user session. If a web application administrator's credentials are compromised for example, CSRF could overtake the entire website. Here's a short list of some common (and catastrophic) CSRF capabilities:
· Force a user to post an insulting comment or malicious link on a blog, forum, or product review.
· Change passwords, emails, and login credentials, effectively terminating access.
· Submit a user's email address and sign up for a newsletter.
· Make a purchase and use the hacker's shipping address.

CSRF capabilities are so powerful, you can understand why banks, financial brokers, bill pay services, and basically any institution that ties user credentials to money would need to approach each day with extreme caution and oversight. In a blog post this year, SECCOM Labs demonstrated how easily a CSRF banking scheme could be carried out.

Prohibiting users from submitting HTML code is one way help prevent CSRF. In many cases; however, that's not feasible because sites containing blogs, product reviews, and social media rely heavily on user-generated content. If your application has social web components like product reviews or comments, be aware that extremely effective, proprietary tools capable of disarming security features of even the most popular social vehicles like Twitter and Facebook do exist. Protect applications from CSRF vulnerabilities by:
· Only accepting POST transactions.
· Create unique token values for each request.
· Re-authenticate based on the unique token or a password.

4. Insecure Direct Object References
Insecure direct object reference flaws allow attackers access to private directories, for example, by manipulating the URL to gain access. The primary risks with insecure direct object references include data leakage and identity theft. Adobe Flash Player fell victim to this type of flaw last year, and the company has since addressed and patched the vulnerability. Developers with expertise in securing applications can help prevent insecure direct object references by:
· Creating a schema to protect and identify each object accessible by users.
· Using indirect reference maps in code when referring to file names, URLs and database keys.
· Ensuring the session is authenticated to view the requested information or files and only grant access for that specific request when direct references are required.

5. Broken Authentication and Session Management
Because all web applications have (at least) an administrator account, every website is susceptible to authentication and session management flaws. All too often, fingers point toward typical website functions like logout, forgotten password retrieval, and account update procedures when problems with authentication and session management arise.

Custom applications have increased risk. In fact, many instances of authentication and session management flaws occur when the code includes custom methods for validating user names and passwords and/or homegrown techniques for handling cookies or session tokens. Session hijacking is a good example of the trouble that can crop up when authentication and session management flaws reside within your application. Using widely accepted mechanisms for user authentication and session management is a good, preventative start. Additionally, you can take these steps to protect your application from these vulnerabilities.
· Use https:// encryption on every page with form fields and store credentials in encrypted format and limit browser caching so hitting the back button doesn't grant unwanted parties access or visibility.
· Make sure users can logout from every page within the application and set short visitor sessions and force visitors to time out more often.
· Limit unsuccessful login attempts and require users to verify old password credentials when establishing new ones.