Tenable Blog

Brucon is a security conference held in Brussels, Belgium. This was the second year of Brucon and it was comprised of two days worth of training and two days worth of presentations. It’s a decent sized conference of about 300 people total, including speakers and attendees. Everyone at the conference was extremely nice and very hospitable. The organizers went above and beyond to make sure that attendees had a good time, were able to get around the city and (most importantly) share ideas about information security in an open environment.

On Monday, Apple released Security Update 2010-006, which fixes an “error handling” issue in the AFP (Apple Filing Protocol) server that may allow an attacker to log in as another user with a malformed password, provided he has “knowledge of an account name” on the remote system:

We see enough Mac OS X systems with AFP enabled in universities to spend some time on this given flaw and revisit the Mac OS X file sharing abilities and  default settings.

"Silent" Worms: Stuxnet

The vulnerability patched with MS10-061 is perhaps one of the most interesting we've covered in a "Patch Tuesday" post this year. The vulnerability was discovered when antivirus researchers at Kaspersky Lab analyzed malware called "Stuxnet". The malware was one of the first worms to use the LNK vulnerability, and contained code to exploit three other vulnerabilities, the print spooler vulnerability patched by MS10-061 and two other unnamed privilege escalation vulnerabilities that have yet to be patched. Its not everyday that we hear of malware in the wild exploiting 4 0-day vulnerabilities.

I am not easily impressed (in fact, I am even less than impressed) with the capabilities of most malware in the wild. However, there are some facts about the "Stuxnet" malware that do impress me:

• Stuxnet also contains an exploit for a vulnerability from 2008. It will only execute this exploit if it determines it is inside an organization using SCADA systems and not a typical corporation.
• Stuxnet was written specifically to attack control systems, and is the first publicly known malware to contain a rootkit for PLCs, devices that control SCADA systems. The rootkit silently waits for commands.
• Stuxnet gains access to control systems using default passwords and is rumored to have compromised 14 different control systems-based organizations.
• Stuxnet was first thought to primarily use USB devices to propagate (likely to get around "air gapped" security measures)

There was an interesting quote from Symantec that stated, "Symantec gained control of the domain used to send commands to infected machines shortly after Stuxnet was discovered". Apparently, this turned over control of Stuxnet-infected systems to Symantec. I just don't understand the logic behind the malware authors; if they had used fast flux, they may still have control over the botnet they seemed to have worked so hard to implement.

Welcome to the Tenable Network Security Podcast - Episode 50

Announcements

• Several new blog posts have been published this past week, including:
  • Making Penetration Testers Lives Awful
  • Tenable Network Security Podcast - Episode 49 - Interview with Dennis Brown
  • Passive Vulnerability Scanner Network Licensing
• Ron, Marcus, and Renaud present the San Francisco Security Showcase on September 15, 2010! This is a free event that will feature topics such as a Nessus overview and future plans, the advantages of pairing active and passive scanning, an overview and discussion of current security strategies and new industry trends, the past, present and future of regulatory compliance, and a Tenable Network Security product/solutions overview.
• Be certain to check out our video channel on YouTube that contains the latest Nessus tutorials.
• We're hiring! - Visit the web site for more information about open positions.
• You can subscribe to the Tenable Network Security Podcast on iTunes!
• Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make various announcements, provide Nessus plugin statistics and more!

Welcome to the Tenable Network Security Podcast - Episode 49