phpbb and sql errors asp sqlserver odbc sql errors

Today´s Diary

If you have more information or corrections regarding our diary, please share.


DNS ANY Request Cannon - Need More Packets

Published: 2012-05-21,
Last Updated: 2012-05-21 16:28:47 UTC
by Kevin Shortt (Version: 1)

1 comment(s)

We have a report from our reader Tuukka, who observed a flood of DNS ANY requests from likely spoofed IP addresses.  What we know so far is that it seems to be a DNS Reflective Amplification Attack.  These usually use generic recursive DNS queries trolling for poorly configured DNS services.  This event is different in that the reflection is more targeted.  DNS 'ANY' record queries are only sent for domains for which the server is authoritative for, which the server will of course reply to regardless of available recursion.  These events have been validated by a real time observation by one of our handlers. Here is what we know so far.
 
Hit List: 
  • Source IP is spoofed
  • Flood lasts up to 60 seconds with 500 queries (as witnessed, but likely could be more)
  • Flood comes from a designated IP and seem to target multiple domains on authoritative server
  • All observed requests are similar thus far
  • This appears to be similar to what others have seen [1]

Example DNS Log Entry:
  • x.x.x.x is the spoofed/target server
  • example.com/10.1.1.1 is the "reflecting" DNS server
21-May-2012 13:21:41.757 queries: info: client x.x.x.x#20475: view external: query: example.com IN ANY + (10.1.1.1)
21-May-2012 13:21:41.897 queries: info: client x.x.x.x#59247: view external: query: example.com IN ANY + (10.1.1.1)
21-May-2012 13:21:42.054 queries: info: client x.x.x.x#18676: view external: query: example.com IN ANY + (10.1.1.1)
21-May-2012 13:21:42.059 queries: info: client x.x.x.x#28530: view external: query: example.com IN ANY + (10.1.1.1)
21-May-2012 13:21:42.193 queries: info: client x.x.x.x#6489: view external: query: example.com IN ANY + (10.1.1.1)
 
 
We are interested in knowing if you have seen this and what you have done to mitigate any ill effects of such events.  Please post a comment to let us know.
 
We also want your DNS logs and packet capture logs of the events described in this diary.  There is still plenty to learn about this behavior.
 
If you see outbound ANY query floods from your own network: Try to identify the source machine. It would be interesting to see what tool causes these queries.
 
 
 
 
 
-Kevin
--
ISC Handler on Duty
1 comment(s)

ZTE Score M Android Phone backdoor

Published: 2012-05-18,
Last Updated: 2012-05-21 16:28:38 UTC
by Johannes Ullrich (Version: 1)

3 comment(s)

The ZTE Score M phone, apparently available via Metro PCS in the US, comes with a special suid backdoor. The backdoor for a change does not use a fixed "secret" root password. But instead, the suid binary "sync_agent" has to be called with a special parameter.

If you do have an Android phone, take a look if you have this application in "/system/bin". At this point, only this one particular model is reported to have this application present, but it would be odd to not have ZTE use the same backdoor on other models. 

Cataloging and limiting suid applications should be a standard unix hardening step. The simplest way in my opinion to find suid binaries is to use this find command:

find / -x -type f -perm +u=s

Files with the suid bit set will run as the user owning the file, not as the user executing the file. This is typically used to allow normal users to execute particular administrative tasks. So verify if you need or don't need to execute a particular binary as normal user before removing the suid bit.

Update: The file has also been found on the ZTE Skate.

 

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

Keywords: android backdoor zte
3 comment(s)

PHP 5.4 Exploit PoC in the wild

Published: 2012-05-19,
Last Updated: 2012-05-21 16:27:37 UTC
by Manuel Humberto Santander Pelaez (Version: 1)

2 comment(s)

Clarifications/Updates to the original diary:

- This is NOT remote exploitable. An exploit would require the attacker to upload PHP code to the server, at which point, the attacker could just use PHP to run shell commands via "exec".

- only the windows version is vulnerable

- on windows, the "COM" functions are part of php core, not an extension.

- this is not at all related to the (more serious) CVE-2012-2336 vulnerability mentioned below. The com_type_info vulnerability is now known as CVE-2012-2376.

/jbu/

--- original report by Manuel ----

 

There is a remote exploit in the wild for PHP 5.4.3 in Windows, which takes advantage of a vulnerability in the com_print_typeinfo function. The php engine needs to execute the malicious code, which can include any shellcode like the the ones that bind a shell to a port.

Since there is no patch available for this vulnerability yet, you might want to do the following:

  • Block any file upload function in your php applications to avoid risks of exploit code execution.
  • Use your IPS to filter known shellcodes like the ones included in metasploit.
  • Keep PHP in the current available version, so you can know that you are not a possible target for any other vulnerability like CVE-2012-2336 registered at the beginning of the month.
  • Use your HIPS to block any possible buffer overflow in your system.

Manuel Humberto Santander Peláez
SANS Internet Storm Center - Handler
Twitter:@manuelsantander
Web:http://manuel.santander.name
e-mail: msantand at isc dot sans dot org

Keywords:
2 comment(s)
ISC StormCast for Monday, May 21st 2012 http://isc.sans.edu/podcastdetail.html?id=2548

If you have more information or corrections regarding our diary, please share.

Diary Archive

DateAuthorTitle
2012-05-21 Kevin Shortt DNS ANY Request Cannon - Need More Packets
2012-05-19 Manuel Humberto Santander Pelaez PHP 5.4 Exploit PoC in the wild
2012-05-18 Johannes Ullrich ZTE Score M Android Phone backdoor
2012-05-17 Johannes Ullrich Do Firewalls make sense?
2012-05-17 Adam Swanger ISC Feature of the Week: Tools->Information Gathering
2012-05-16 Johannes Ullrich Got Packets? Odd duplicate DNS replies from 10.x IP Addresses
2012-05-16 Johannes Ullrich Reserved IP Address Space Reminder
2012-05-15 Dan Goldberg Odd DNS replies from 10 nets and RFC1323 impacting firewalls
2012-05-14 Chris Mohan Laptops at Security Conferences
2012-05-14 Mark Hofman Got packets? Interested in TCP/8909, TCP/6666, TCP/9415, TCP/27977 and UDP/7
Folder Icon Complete Archive
Search Diaries:

Diary Tagslink arrow

  windows 8     antivirus malware protection     patch     zte     bug fixes     patches     hashes     android     ddos     microsoft     reflective dos     packets     tools     helpdesk     ios 511     samba     scam     laptop     openssl     php     tns listener     ntp     safari     devices     msft     any     phpthumb     incident handlers     security update     useragent     sysinternals     wireless     nat     turbo tax     mac os x     dns     isc feature     flashback     regripper     wicd     vcenter     flashback malware     vista     ipad     incident response team     wireshark     social networking     incident     ipod     backdoor     dos     incident response     flashback trojan     hp procurve 5400     javascript     security     windows     anti virus     hardening     rfc1035     adobe flash player     ms09027     open ssid     bypass     exploitmacosxms09027a     cryptography     vulnerability assessmentcva     fail     malware     shellcode     medical malware     adobe acrobat     mozilla     incident handling     cve 20122110     rfc1918     google     iphone     firewall     blackhole     logs     sha     vmware     fda     challenge     os x     net     wordpress     adobe reader     mcafee     apple     privilege escalation     memory corruption     backtrack 5 r2     incident management     adobe     java     wardriving     md5     privacy     firefox     xss     rfc2181     oracle     black tuesday     patch tuesday     snow leopard     flash     windows vista  
site/port/ip search:

ISC Polllink arrow

Which security patch delivery schedule do you prefer?

World Map

world map

Trends

trend graph