Operation Red October: Look what the Red Hacker Alliance has been up to for the last few years!

--
The Red Hacker Alliance (aka the Chinese government) wrote exploits for the newly discovered 'Operation Red October' global malware racket that's been running since 2007. Surprise. (O_0)

Massive espionage malware targeting governments undetected for 5 years

 "Red October" command-and-control setup more sophisticated than that of Flame.

While the malware developers spoke Russian, many of the exploits used to hijack victim computers were initially developed by Chinese hackers.

And we still give China 'Most Favored Nation' Status. Why? Does China own the USA or something?

Red October is also notable for the broad array of devices it targets. Beside PCs and computer workstations, it's capable of stealing data from iPhones and Nokia and Windows Mobile smartphones, along with Cisco enterprise network equipment. It can also retrieve data from removable disk drives, including files that have already been deleted, thanks to a custom file recovery procedure.

IOW Folks: 'Red October' has been active on:

I) Macs

II) iOS Devices.

The discovery of Red October opens yet another chapter in the just-begun era of highly advanced espionage malware that already included Duqu, Flame, and Gauss. With its high degree of customization and its ability to evade detection for five years, the operation has rivaled previous espionage campaigns including the Aurora attacks that hit Google and dozens of other large companies three years ago. 

"All of these are very well-coordinated, very professionally run projects," Baumgartner said. "There's not enough evidence to link it to a nation-state, but certainly this level of interest and multi-year, ongoing campaign puts it up there with something like Flame and Duqu in the amount of effort it takes to seek out those targets and infiltrate the networks."

More exciting revelations to come, no doubt.

Why do we humans hate each other so vehemently?
What is our problem?
Why are we DRIVEN to self-hatred and self-destruction?
And no, it's not some ethereal demons out-to-get-us.
This is OUR problem and OURS to solve.
WE CHOOSE this insanity.
There's no one else to blame or to end it.
I get philosophical like that.
--

Java 7u11 Is Out And Inadequate

--
[Updated 2012-01-28]

Oracle rushed out Java 1.7 update 11 over the weekend.

1) It still has well known, published, publicly acknowledged security holes. IOW: It's still entirely dangerous. Don't use Java unless you have to. Meanwhile:

Just Turn Java Off.

2) Apple's quick response (despite the nasty bug when DIY running XProtect Updater) was EXCELLENT. I applaud Apple for speed and efficiency. This is Apple on-their-toes and I like it!

3) That stupid, moronic Java 'Control Panel' bug that my 11 year old nephew could solve, whereby the 'Enabled' checkbox is ON forever, no matter what, continues. I hate you Oracle, you blithering idiots:

4) --> UPDATE NOTE from 2013-01-28:
It has been found that the "Very High" Security Level setting is INEFFECTIVE! It does NOT block malware. Consider it USELESS! Read ahead to my article:

Just Turn Java Off: 'Very High' Security Setting NOT EFFECTIVE!

 Therefore, here is how you effectively turn OFF Java in its 'Control Panel' until you have already navigated to a website you know is safe for running Java:

Set it and leave it on the 'Very High' Security Level. There is no excuse for setting it on anything else unless you know you're on a safe site. Then before you leave that site, turn it back up to 'Very High'. I can't stress this enough. 'Very High'. No, not me! The Java Security Level!

~~~

With the help of my Mac security friend Sean O'Connell, I'll be providing some further safety settings for the 'Advanced' tab later.

Just Turn Java Off. 
It's that bad.

--

NOTE: New 'Java 7' Security Hole Apparently Affects ALL Java, v4 through 7

--
The bleeding edge news

TAKE NOTE:

I'm reading assertions on the net that today's zero day Java security hole is NOT limited to Java 7, but all the way back to Java 4.

IOW: There is no safety in older versions of Java.

I'll post more after the chaos has settled down and we have clear information.

Just Turn Java OFF.

:-Derek

Apple Disables Java 7 In Response To New Malware

--
GO Apple! I like it... EXCEPT! There's a problem.

First the good news:

What a day. Check out this article at MacRumors:

Apple Blocks Java 7 Plug-in on OS X to Address Widespread Security Threat

As noted by ZDNet, a major security vulnerability in Java 7 has been discovered, with the vulnerability currently being exploited in the wild by malicious parties. In response to threat, the U.S. Department of Homeland Security has recommended that users disable the Java 7 browser plug-in entirely until a patch is made available by Oracle.

So Apple, paying attention to the situation, did THIS:

Apple used its built-in XProtect system to disable ALL versions of Java 7. No versions of Java 7 will be allowed to run until Oracle provides an update. MacRumors lists the XProtect XML code that blacklists the Java 7 Internet plug-in.

XProtect will NOT allow a Java 7 plug-in to work until Oracle update past the current version, Java 1.7 update 10 beta 18 (AKA 7u10b18).

How to verify you have the updated Xprotect.plist file:

Navigate in the Finder to here:

/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/

There you will find the file "XProtect.plist". Do a Get Info on the file to discover its 'Created' date. You'll want to see either today's date (Friday, January 11, 2012...) or later. If you see a date circa "December 13, 2012..." you do NOT have the update. You are looking at the previous version of the .plist file, NOT the updated version.

NOT what you want.

A NOT updated XProtect.plist file.

How to force an update of your XProtect.plist file:

Navigate in the Finder (using the menu command Go/Go to Folder...) to here:

/usr/libexec/

There you will find the file "XProtectUpdater". If you have Administrator privileges on your Mac, you can simply double-click this file to run it. You'll see the Terminal app open. It will then perform the UNIX process built into XProtectUpdater.

Now for the PROBLEM:

At the moment, I can't get XProtectUpdater to update my XProtect.plist file on a Mac running 10.7.5. That's not good.

(We're into the realm of super geeky, nasty CLI, character line interface, hell here. I despise CLIs and the associated geekiness that goes with them. That's MY problem. YOUR results will no doubt vary).

Here is what I am consistently seeing in the Terminal after I invoke XProtectUpdater:

2013-01-11 15:29:30.053 XProtectUpdater[91712:707] Unable to verify signature: Error Domain=com.apple.security Code=-20044 "The operation couldn’t be completed. (com.apple.security error -20044.)" UserInfo=0x7ff2ba606f60 {FailingMethod=SecManifestVerifySignature}

I get these same results if I:

A) Double-click XProtectUpdater

-OR-

B) Drop XProtectUpdater on the Terminal window and invoke it

-OR-

C) Use 'sudo', space, then invoke XProtectUpdater

This is apparently a security problem over at Apple.com, NOT on my machine UNLESS Apple has only provided the XProtect.plist update for OS X 10.8, which is a distinct possibility.

If other folks have further insights into this problem, please post a comment.

Today's Java BS has burned me out. But tomorrow I will be checking for new information as well as testing XProtectUpdater on my 10.8.x systems. If you run into this same problem updating your XProtect.plist file, stick to the mantra:

Just Turn Java OFF.

If you don't know how, travel on down the blog to my previous articles about Java 7.

:-Derek

Mal/JavaJar-B, That New Java 7 Malware You've Been Waiting For!

--
[Updated 2012-01-28]

That didn't take long! Sophos has reported the name of the new in-the-wild Java 7 exploit is:

Mal/JavaJar-B

Translated into the official malware naming system (that nearly everyone ignores), the name would be:

OSX.Trojan.JavaJar.B

Naming such malware as a 'Trojan horse' is debatable as it is a drive-by infection not requiring anything more than a user visiting a website with the Java plug-in left insecure. I suspect this is why Sophos reports the malware as 'Mal'. I personally would advocate for calling it:

OSX.DriveBy.JavaJar.B

In any case, the malware is here and dangerous.

Just Turn Java OFF.

--> UPDATE NOTE from 2013-01-28:
It has been found that the "Very High" Security Level setting is INEFFECTIVE! It does NOT block malware. Consider it USELESS! Read ahead to my article:

Just Turn Java Off: 'Very High' Security Setting NOT EFFECTIVE!

Or if you must use Java, at least get used to keeping its Security setting at 'Very High' as of Java v1.7 update 10, aka 7u10. 

Sophos provides a picture that indicates using the 'High' setting. That's baloney. Just leave it on 'Very High' until you're at a trusted web page. Don't forget to turn it back to 'Very High' BEFORE you leave that web page. And yes kids, this is a big PITA. Blame Oracle.

Also, Sophos made an error when they stated:

A single check-box can be used to disable the web plugin entirely...

That continues to NOT be true on the OS X version of the Java 7u10 'Control Panel'. Oracle know about it. They attempted to provide a workaround that was specific to OS X 10.8.x. But from my experience, Oracle's workaround was a FAIL. Hopefully Oracle will figure out how to allow mere humans to uncheck a checkbox in their next rendition of Java 7. 

Sheesh. :-P

--

New Java 7 Exploit In The Wild, Coming Soon To A Mac Near You!

--
Just Turn Java OFF.

Oracle's Java 7, ALL versions (v1.7 update 10, aka 7u10, on down), has a newly discovered security hole that is being exploited in-the-wild on Linux, Windows and UNIX. That 'UNIX' exploit means malware will immediately be coming to Mac.

Surprised? Not me!

CVE-2013-0422 describes the security hole as:

Unspecified vulnerability in Oracle Java 7 Update 10 and earlier allows remote attackers to execute arbitrary code via unknown vectors, possibly related to "permissions of certain Java classes," as exploited in the wild in January 2013, and as demonstrated by Blackhole and Nuclear Pack.

SecurityTracker provides further details:

A remote user can create specially crafted Java content that, when loaded by the target user, will execute arbitrary code on the target user's system. The code will run with the privileges of the target user. 

This vulnerability is being actively exploited. 

Several exploit kits include an exploit for this vulnerability....  

No solution was available at the time of this entry.

The source report about in-the-wild exploit malware can be found here:

0 day 1.7u10 (CVE-2013-0422) spotted in the Wild - Disable Java Plugin NOW !

Quoting the article:

Hundreds of thousands of hits daily where i found it. This could be a mayhem. I think it's better to make some noise about it.

I'll post when the 'mayhem' hits the Mac community, which will likely be any minute now...

--

Adobe Updates: Flash Player v11.5.502.146, Reader and Acrobat v11.0.01, Air v3.5.0.1060

Adobe provided updates on January 7th, 2013 for Reader, Acrobat, AIR and Flash Player. ALL of these updates include security patches. LOTS of security patches!

THE DOWNLOAD LINKS:

Adobe Flash Player v11.5.502.146: http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=5540&fileID=5553

Adobe AIR v3.5.0.1060: http://get.adobe.com/air/thankyou/?installer=Adobe_AIR_3.5_for_MacOS_X

Adobe Reader v11.0.01: http://www.adobe.com/support/downloads/detail.jsp?ftpID=5540

Adobe Acrobat v11.0.01: http://www.adobe.com/support/downloads/detail.jsp?ftpID=5538


LATEST VERSION INSTALLED VERIFICATION:

Adobe Flash Player: 
Visit this web page:
http://www.adobe.com/software/flash/about/

Adobe AIR: 
Visit this web page for instructions: 
http://helpx.adobe.com/air/kb/determine-version-air-runtime.html

Adobe Reader: 
Within Reader, choose Help > Check for Updates.

Adobe Acrobat:
Within Acrobat, choose Help > Check for Updates.


SECURITY BULLETINS:

Adobe Flash Player v11.5.502.146 and Adobe Air v3.5.0.160, Security Bulletin APSB13-01

Adobe Reader and Acrobat v11.0.01, Security Bulletin APSB13-02

The security bulletin for Flash Player and Air is listed as being only for Flash Player. And yet it's not. (0_o) It's about BOTH. So be sure you update both. Get your act together Adobe!


SECURITY HOLE SUMMARIES:

Adobe Flash Player and AIR:

These updates address a vulnerability that could cause a crash and potentially allow an attacker to take control of the affected system.

Details about this security hole can be found in CVE-2013-0630, which has not yet been detailed as of today. SecurityFocus lists the CVE as a "Remote Buffer Overflow Vulnerability", IOW the usual.

Adobe Reader and Acrobat:

CVE numbers: CVE-2012-1530, CVE-2013-0601, CVE-2013-0602, CVE-2013-0603, CVE-2013-0604, CVE-2013-0605, CVE-2013-0606, CVE-2013-0607, CVE-2013-0608, CVE-2013-0609, CVE-2013-0610, CVE-2013-0611, CVE-2013-0612, CVE-2013-0613, CVE-2013-0614, CVE-2013-0615, CVE-2013-0616, CVE-2013-0617, CVE-2013-0618, CVE-2013-0619, CVE-2013-0620, CVE-2013-0621, CVE-2013-0622, CVE-2013-0623, CVE-2013-0624, CVE-2013-0626, CVE-2013-0627

The total is 27 security holes. Adobe is listing them all as 'Priority 2', which they describe as:

This update resolves vulnerabilities in a product that has historically been at elevated risk. There are currently no known exploits. Based on previous experience, we do not anticipate exploits are imminent. As a best practice, Adobe recommends administrators install the update soon (for instance, within 30 days).

Again, none of these CVE reports yet offer any details as of today. If you use a search engine and input each CVE number you can find some dirt on them from various sources. Feeling in a magnanimous masochistic mood, I dug up some general descriptions of the CVEs. 

SecurityTracker describes all but the first CVE here:

Adobe Acrobat/Reader Multiple Flaws Lets Remote Users Execute Arbitrary Code and Local Users Gain Elevated Privileges

Description:   Multiple vulnerabilities were reported in Adobe Acrobat/Reader. A remote user can cause arbitrary code to be executed on the target user's system. A local user can obtain elevated privileges on the target system. A user can bypass security restrictions. 

A remote user can create specially crafted content that, when loaded by the target user, will execute arbitrary code on the target system. The code will run with the privileges of the target user.

The security problems involve the usual memory overflow problems, a "use-after-free" [which is new to me], local errors, elevated privileges and security restriction bypasses. Oh dear. Not pretty.

IOW: There is no indication of Reader or Acrobat settling into safe and secure mode. The security flaws just keep on coming! Avoid both Adobe Reader and Acrobat as much as possible. 

Apple's Preview app is adequate for most reading and annotation purposes, and it hasn't demonstrated any of Adobe's circus of security holes.

There is also a plethora of alternatives to Adobe Acrobat available for Mac. The alternatives include, in no particular order:

PDF Editor, PDF Editor Pro

PDF OCR X

PDF Signer

PDFClerk Pro

PDFPen Pro

Proview

PDF Studio

Share and Enjoy!
:-Derek
--