The enemy in the network card

There's no corner too small for rootkits to hide themselves. Check this out.

Security expert Guillaume Delugré, who works for the Sogeti European Security Expertise Center (ESEC), has demonstrated that a rootkit doesn't necessarily have to infest a computer. The expert used freely available tools and documentation to develop custom firmware for Broadcom's NetExtreme network controller. He was then able to conceal a rootkit within the firmware, making it untraceable by the virus scanners usually installed on a PC.

Delugré's code is executed by the network card's MIPS CPU and can directly communicate with working memory through the PCI interface's Direct Memory Access (DMA) – network cards normally use this functionality to exchange network frames with the driver installed on the computer.

Potential attackers using such a rootkit could remotely access computers or listen to a user's network traffic. Broadcom's NetExtreme controller is mainly used in corporate environments. Network controllers for home users are usually equipped with little, if any, memory and offer limited programming flexibility, which makes them unlikely targets for such an attack.

The attack scenario isn't entirely new: in 2006, John Heasman injected a rootkit into the extended memory of graphics cards and network cards, although his rootkit needed to download code from the net once Windows had started up. Flash memory chips intended for the PC BIOS on a mother board are another potential rootkit hiding place.

Researchers Uncover Holes In WebOS Smartphones

Linux-based platform prone to Web-injection vulnerabilities and targeted attacks for stealing data.

A pair of researchers has discovered multiple flaws in the WebOS smartphone platform, including one that could let an attacker build a mobile botnet or execute other remote attacks.

Orlando Barrera and Daniel Herrera of SecTheory plan to demonstrate their findings tomorrow at the Austin Hackers Association meeting in Texas. The most dangerous of the vulnerabilities is an injection flaw they found on the WebOS version 1.4.X that allows remote command and control, including access to a phone's files or injecting a remote JavaScript backdoor into the phone's Contacts Application to build a botnet.

Read more here.

Korean cross-border attacks exploited to spread malware

The recent cross-border shellings between North and South Korea have left many people wondering what has been going on and what triggered the attacks: North Korean Artillery Attack on a Southern Island

Scareware and malware pushers have been very prompt at poisoning related search results.

Search combinations such as "north korea bombs/attacks south korea", "kim jong il", "korean war", "world war 3", "yeonpyeong island" and "korean news" have been producing results that take users to pages where warnings about infection on their computers are shown and the users are offered to download rogue antivirus solutions, to pages that attempt to hijack their browser through JavaScript or pages that offer Trojans disguised as codecs and bogus updates for Mozilla's Firefox.

The Tech Herald reports that all of the offending compromised domains are using open source CMS software which was not updated and, consequently, vulnerable to attack. They also noted that topics related to Black Friday, Bristol Palin, Dancing with the Stars, and others have been targeted by the same black hat SEO campaign.

Facebook Messaging System Opens New Security Concerns

The next big thing in social media has been revealed in Facebook's new Messages system, which combines email, texting, and instant messaging into one threaded experience. They want to let people talk to each other without having to worry about whether the recipient prefers email or SMS, etc. This also opens the way for new security challenges to be overcome as more and more people start using this new service.

Sophos, an internet security company that advertises a variety of email and encryption services, has released an article concerning the new Facebook Messages system which focuses on the new security issues that need to be considered for people who opt to use it. In it, senior technology consultant Graham Cluley discusses that the burden of security lies more with the user than with Facebook itself. He says, "Before signing up, users need to realize that these new features increase the attack surface on the Facebook platform, and make personal accounts all the more alluring for cybercriminals to break into. Facebook accounts will now be linked with many more people in the users' social circles - opening up new opportunities for identity fraudsters to launch attacks." Basically, spammers now have more of an incentive to hack into Facebook accounts using phishing attacks and exploiting weak passwords.

The other security issue that Cluley discussed was the fact that "users also need to be aware that Facebook will be storing a complete archive of all of their communications with one person - this raises concerns as to how this data could be misused if it fell into the wrong hands." Imagine every conversation you've ever had with anyone being recorded and stored on servers you have no control over. All that vital information in the wrong hands could most certainly spell trouble for anyone unfortunate enough to fall victim to such a situation. For more security-based information about the new Facebook Messages system, check out the Sophos FAQ about it.

Facebook bug compromises top pages

A customer of Sendible, an online marketing service for promoting and tracking brands through the use of social media, e-mail and SMS messaging, has inadvertently discovered a flaw in Facebook API.

Using Sendible's Facebook application, he tried to post messages on a few Facebook walls - as a fan - but apparently the flaw made them be posted as status messages from the owner of the pages.

Before the flaw could be patched, it was apparently discovered also by some users that decided to use it to propagate a malicious link that would supposedly allow the victims to change their Facebook background. This message appeared on a number of Facebook pages of brands and companies like Coca-Cola, Google, YouTube, South Park, The Daily Show and others.


"A few people who did click on the link reported that it took you to a page outside of Facebook that asks you for some information about you," reports TechCrunch. "The bottom of the page reads 'Powered By AWeber Email Marketing'."

It seems that the malicious link in question has been taken down, but people have been reporting that other links were propagated with the help of the flaw.

Sendible claims that its application wasn't hacked. "This is a flaw in Facebook’s API and may affect all third party Facebook applications," it says. "To ensure this doesn’t happen again, we’ve agreed with Facebook to remove the feature on Sendible that allows fans of Facebook pages to update multiple pages at once."

Facebook claims that there was a bug on its platform AND a flaw in Sendible's API:

"We’ve looked into this more. We began removing the posts immediately upon discovering them and shortly after they were made. They were caused by a temporary bug on Facebook that allowed certain posts requested by an application to be rendered when they shouldn’t have.

There was a flaw in Sendible’s API call that caused Sendible to incorrectly request that posts users had intended to make on the Walls of Pages they liked be rendered on behalf of those Pages themselves. This bug caused those requests to go through.

Upon discovering the bug, we immediately began work to fix it. It’s now been resolved, and these posts can no longer be made. Sendible has also fixed the flaw on its end. We’re not aware of any cases in which the bug was used maliciously."

Facebook "love button" app links to malware

If you spot a Facebook post or a message that advertises an application that will let you "unlock" a "love" button if you run it - don't do it. If you do, you will be actually running a malicious Java applet that downloads a password-stealing Trojan.


You don't even have to press a button to install the application - a simple visit to the application's page (which is displayed in Croatian) will trigger a pop-up that will ask you to run the application which - unexplainably - masquerades as a “Sun Microsystems Java Security Update 6":


If this warning fails to arouse your suspicion and you run the application, the Java applet will download an .exe file from a URL passed as a parameter on the website.

"It then saves and executes it as “NortonAV.exe” from the local user profile folder," explains McAfee's expert. "The downloaded trojan payload is a password stealer which search for passwords stored on the user’s machine. It then sends a password log to an e-mail account on gmail.com over an encrypted SMTP/TLS connection."