شماره: IRCNE2014092330
تاريخ: 09/07/93

در حال حاضر تمامي رايانه هاي جديد اپل در برابر آسيب پذيري امنيتي Bash ايمن هستند. اين آسيب پذيري به طور بالقوه به هكرها اجازه مي دهد تا كنترل سيستم عامل دستگاه آسيب پذير را بدست آورند.
آخرين آسيب پذيري در دنياي رايانه با نام Bash يا Shellshock شناخته مي شود كه مي توان بواسطه آن كدي مخرب را در پوسته Bash اجرا نمود. Bash يك پوسته خط فرمان است كه در سيستم عامل هاي يونيكس و لينوكس و سيستم عامل Mac OS X اپل استفاده مي شود.
روز دوشنبه شركت اپل اعلام كرد كه در حال حاضر اين آسيب پذيري در سيستم عامل هاي OS X Lion، Mountain Lion و نرم افزار Maverick اصلاح شده است. هم چنين اين شركت سايتي را ايجاد كرده است تا كاربران بتوانند به روز رساني هاي Bash را از آن دانلود نمايند.
هفته گذشته شركت اپل اعلام كرد كه Bash يك زبان و دستور يونيكسي است كه در OS X استفاده مي شود و داراي ضعفي است كه بواسطه آن كاربران غيرمجاز مي توانند از راه دور كنترل يك سيستم آسيب پذير را در اختيار بگيرند. سيستم هاي OS X به طور پيش فرض ايمن هستند مگر آن كه كاربران خدمات پيشرفته يونيكس را پيكربندي كرده باشند.

Number: IRCNE2014102331
Date: 2014/10/04

According to “techworld”, sophisticated attacks like Stuxnet aren't necessary to compromise industrial control systems for dams, power plants, chemical plants and the like. Rather, simple phishing attacks followed up by using tools that are easily available through Metasploit will do the trick, security pros were told at a conference in Atlanta this week.
Even with firewalls in place and buffering access to control devices through a server protected in a DMZ, simple-to-execute attacks succeed, said Chris Shipp, a contractor who is director of cyber security for the U.S. Department of Energy, Strategic Petroleum Reserve, in a talk to (ISC)² Security Congress.
Shipp says he's seen such attacks work more than once in real life situations, and the problem is more worrisome because it's been shown through Stuxnet and other sophisticated attacks that groups with extensive resources are at work.
For systems that can't be upgraded readily, the best defense is constant penetration testing to find weaknesses and adopting new architectures that are less vulnerable.
The root of the problem is that many of the control systems are connected to facilities' business networks and therefore the Internet. This makes the switches, gates and valves being controlled remotely accessible for billing, inventory control and patching. It also makes them accessible for remote attacks, Shipp says
Networking gear within these facilities has moved from proprietary software to Windows in many cases. This means more hackers understand the environment, increasing the number of potential attackers, Shipp says.
In a demonstration, the contractor showed how an attack could be carried out even in a network that routed access to its control system through a secured server. It started with gaining control of a business workstation via a phishing attack that tricks a user into clicking on a link to a malicious Web site that downloads malware.
That was followed up with using several tools within Metasploit to grab passwords and screenshots of the victim's machine and to install a key logger. It also installed a shell that carried out commands from the hacker machine and using that, revealed machines that the victim's workstation was connected to. That included the secured server, which connected to the control network.
Shipp established a route from the attacker PC through the compromised workstation to the secured server to the control network. In the demonstration, he showed how the attacking machine could turn on fans and lights on a piece of hardware.
The speaker recommended that security architects at sites using industrial control systems follow National Institute of Standards and Technology guidelines for such systems.

Number: IRCNE2014092330
Date: 2014/09/30

According to “cnet”, all of Apple's recent Mac computers are now safe from a security flaw that could potentially allow hackers to take over an operating system.
Known as the "Shellshock" or "Bash" bug, the latest vulnerability for the world's computers involves the execution of malicious code within a bash shell -- a command-line shell used in many Linux and Unix operating systems, and by Apple's Mac OS X operating system.
Apple on Monday said it has now patched the Bash vulnerability for its OS X Lion, Mountain Lion and Mavericks software. The company also created a site for users to download the Bash update.
"Bash, a UNIX command shell and language included in OS X, has a weakness that could allow unauthorized users to remotely gain control of vulnerable systems," Apple said last week. "With OS X, systems are safe by default and not exposed to remote exploits of bash unless users configure advanced UNIX services."

Number: IRCNE2014092329
Date: 2014/09/30

According to “cnet”, Cisco Systems and Oracle are hard at work identifying networking and other products in their portfolios that are affected by the critical Shellshock vulnerability.
The Shellshock vulnerability and several related ones found over the past week stem from errors in how the Bash command-line interpreter for Unix and Linux systems parses strings passed to it by external scripts. The flaws allow attackers to trick certain processes running on vulnerable machines to pass malicious strings to Bash that would then get executed as commands on the underlying OS.
Security researcher Rob Fuller has put together a collection of Shellshock proof-of-concept exploits gathered from various sources. The most well-known attack vectors are through Web servers that run CGI scripts and through SSH (Secure Shell) daemons, although other applications that interact with Bash are also potential targets.
Cisco has identified 71 products so far that are exposed to the vulnerability. These products serve various purposes, including network application, service and acceleration; network content and security; network management and provisioning; routing and switching; unified computing; voice and unified communications; video, streaming, TelePresence and transcoding.
The number of Cisco products vulnerable to Shellshock and related bugs far exceeds the 38 confirmed not to be vulnerable. The company is reviewing an additional 168 products and hosted services, so the list of vulnerable products is likely to increase.
"The impact of this vulnerability on Cisco products may vary depending on the affected product," Cisco said in its advisory.
Oracle is also in the process of identifying which of its products are vulnerable. So far the company has released Shellshock patches for nine products: Oracle Database Appliance 12.1.2 and 2.X; Oracle Exadata Storage Server Software; Oracle Exalogic; Oracle Exalytics; Oracle Linux 4, 5, 6 and 7; Oracle Solaris Operating System 8, 9, 10 and 11; Oracle SuperCluster; Oracle Virtual Compute Appliance Software and Oracle VM 2.2, 3.2 and 3.3.
An additional 42 products use Bash in at least one of their versions and are likely to be vulnerable to Shellshock, Oracle has found. No patches are currently available for those products.
"Oracle has not assessed the impact of this vulnerability against products that are no longer supported by Oracle," the company said in its advisory.

Number: IRCNE2014092328
Date: 2014/09/30

According to “cnet”, Akamai’s Prolexic division has warned of the growing threat from a Chinese toolkit that has started infecting Linux, Windows and embedded systems in order to launch DDoS attacks peaking at hundreds of Gigabits per second.
Dubbed the ‘Spike’ toolkit, the malware started life targeting Linux servers earlier in 2014 but now seems to have been ported to run on Windows (both PCs and servers), consumer and SME routers, and even Internet of Things (IoT) devices such as thermostats.
This means it can also infect Linux-based desktops and embedded devices running on ARM – to demonstrate this, Akamai’s engineers were able to get the bot up and running on the humble Raspberry Pi home computer.
Capable of generating a surge of conventional SYN, UDP and GET traffic as well as DNS floods, the malware had already been responsible for a number of large botnet-driven attacks, including one in Asia that peaked at an alarming 215Gbps across its ‘scrubbing’ centres, according to Akamai.
"This DDoS kit is designed to build botnets from devices and platforms that system administrators may not have thought to be at risk for botnet infection in the past. Enterprises need system hardening to prevent initial infection and DDoS protection to stop DDoS attacks from the Spike bots.”
The good news is that the malware should be easy to spot, assuming people know how to defend against it. On servers, this means ‘hardening’ systems at Layer 3 using Access Control Lists (ACLs), or at layer 7 using signatures for systems such as SNORT or the YARA open source malware detection tool.

Number: IRCNE2014092327
Date: 2014/09/27

According to “cnet”, Apple says that most Mac users are safe from a newly discovered security flaw, one that could -- in principle -- allow hackers to take over an operating system.
Known as the "Shellshock" or "Bash" bug, the latest vulnerability for the world's computers involves the execution of malicious code within a bash shell, which is a command-line shell used in many Linux and Unix operating systems, and by Apple's Mac OS X operating system. Apple however says that most people using its software have nothing to worry about.
"The vast majority of OS X users are not at risk to recently reported bash vulnerabilities," an emailed statement from Apple to CNET said.
"Bash, a UNIX command shell and language included in OS X, has a weakness that could allow unauthorized users to remotely gain control of vulnerable systems," it continues. "With OS X, systems are safe by default and not exposed to remote exploits of bash unless users configure advanced UNIX services. We are working to quickly provide a software update for our advanced UNIX users."
The Bash glitch is reminiscent of the Heartbleed security flaw that left information stored on data servers potentially vulnerable to hackers. Heartbleed was first identified in April, and an estimated 300,000 servers were still exposed two months later .
For now, it seems there's nothing ordinary computer users can do to protect against the new security flaw, with the responsibility for patching the potential exploit resting with those that manage Web systems.
"Anybody with systems using bash needs to deploy the patch immediately," Tod Beardsley, an engineering manager at security firm Rapid7 told CNET yesterday.

Number: IRCNE2014092326
Date: 2014/09/26

According to “cnet”, a new security vulnerability known as the Bash or Shellshock bug could spell disaster for major digital companies, small-scale Web hosts and even Internet-connected devices.
The quarter-century-old security flaw allows malicious code execution within the bash shell (commonly accessed through Command Prompt on PC or Mac's Terminal application) to take over an operating system and access confidential information.
A post from open-source software company Red Hat warned that "it is common for a lot of programs to run Bash shell in the background," and the bug is "triggered" when extra code is added within the lines of Bash code.
Security expert Robert Graham has warned that the Bash bug is bigger than Heartbleed because "the bug interacts with other software in unexpected ways" and because an "enormous percentage" of software interacts with the shell.
"We'll never be able to catalogue all the software out there that is vulnerable to the Bash bug," Graham said. "While the known systems (like your Web server) are patched, unknown systems remain unpatched. We see that with the Heartbleed bug: six months later, hundreds of thousands of systems remain vulnerable."
Ars Technica reports that the vulnerability could affect Unix and Linux devices, as well as hardware running Max OS X. According to Ars, a test on Mac OS X Mavericks (version 10.9.4) showed that it has "a vulnerable version of Bash".
"On the scale of 1 to 10, this is an 11," he said, estimating that half a million websites were vulnerable.
Tod Beardsley, an engineering manager at security firm Rapid7, warned that even though the vulnerability's complexity was low, the wide range of devices affected require that system administrators apply patches immediately.
"This vulnerability is potentially a very big deal," Beardsley told CNET. "It's rated a 10 for severity, meaning it has maximum impact, and 'low' for complexity of exploitation -- meaning it's pretty easy for attackers to use it.
"The affected software, Bash, is widely used so attackers can use this vulnerability to remotely execute a huge variety of devices and Web servers. Using this vulnerability, attackers can potentially take over the operating system, access confidential information, make changes etc. Anybody with systems using bash needs to deploy the patch immediately."

شماره: IRCNE2014092329
تاريخ: 09/07/93

شركت هاي سيسكو و اوراكل در حال بررسي محصولات خود به منظور يافتن آسيب پذيري Shellshock مي باشند.
اين آسيب پذيري هفته گذشته كشف شد و به مهاجمان اجازه مي دهد تا فرآيندهاي خاص در حال اجرا بر روي ماشين هاي آلوده را فريب داده و رشته اي مخرب را به Bash وارد نمايند و در نتيجه بتوانند دستورات دلخواه را بر روي سيستم عامل اجرا نمايند.
يك محقق امنيتي با نام Rob Fullerمجموعه اي از كدهاي سوء استفاده از اين آسيب پذيري را از منابع مختلف جمع آوري كرده است. بيشترين بردارهاي حمله شناخته شده از طريق وب سرورهايي كه در حال اجراي اسكريپت هاي CGI مي باشند، صورت گرفته است. اگرچه ساير برنامه هايي كه با Bash در تعامل مي باشند نيز اهداف بالقوه محسوب مي شوند.
شركت سيسكو اين آسيب پذيري را در 71 محصول خود شناسايي كرده است. اين محصولات شامل برنامه هاي كاربردي و خدمات شبكه، امنيت و محتوي شبكه، تهيه و مديريت شبكه، مسيريابي و سوئيچينگ، پردازش واحد، صدا و ارتباطات، ويدئو، جريان داده و TelePresence مي شوند.
اين شركت در حال بررسي 168 محصول ديگر و خدمات ميزباني شده است بنابراين احتمال افزايش تعداد فهرست محصولات آسيب پذير وجود دارد.
در راهنمايي امنيتي شركت سيسكو آمده است كه تاثير اين آسيب پذيري بر روي محصولات سيسكو با توجه به نوع محصول آسيب پذير ممكن است متفاوت باشد.
شركت اوراكل در حال بررسي محصولات خود است. در حال حاضر اين شركت اصلاحيه هايي را براي نه محصول خود منتشر كرده است. اين محصولات عبارتند از: Oracle Database Appliance نسخه 12.1.2 و 2.x، Oracle Exadata Storage Server Software، Oracle Exalogic، Oracle Exalytics، Oracle Linux نسخه هاي 4، 5، 6 و 7، Oracle Solaris Operating System نسخه هاي 8، 9، 10 و 11، Oracle SuperCluster، Oracle Virtual Compute Appliance Software و Oracle VM نسخه هاي 2.2، 3.2 و 3.3.
هم چنين 42 محصولي كه از Bash استفاده مي كنند نسبت به مشكل Shellshock آسيب پذير مي باشند و در حال حاضر اصلاحيه اي براي آن ها در دسترس نيست.
اين شركت در راهنمايي امنيتي خود اشاره كرد كه شركت اوراكل مسئول تاثير اين آسيب پذيري بر روي محصولاتي كه ديگر از آن ها پشتيباني نمي كند، نيست.

شماره: IRCNE2014092328
تاريخ: 09/07/93

شركت Akamai هشدار داد كه يك ابزار چيني به منظور راه اندازي حملات انكار سرويس سيستم هاي ويندوز و لينوكس را آلوده مي كند.
اين ابزار كه ‘Spike’ ناميده شده است، بدافزاري است كه در اوايل سال 2014 سرورهاي لينوكس را هدف حمله قرار داده بود اما در حال حاضر به نظر مي رسد كه اين بدافزار سيستم هاي ويندوز، مسيرياب هاي SME و حتي دستگاه هاي IoT را تهديد مي كند.
اين بدان معني است كه اين بدافزار مي تواند دسكتاپ هاي مبتني بر لينوكس و دستگاه هاي تعبيه شده در حال اجراي ARM را آلوده نمايد.
اين بدافزار توانايي توليد موجي از ترافيك هاي SYN، UDP و GET و هم چنين سيلي از درخواست هاي DNSاي را دارد و در حال حاضر مسئول تعدادي از حملات بات نتي بزرگ مي باشد.
اين كيت حملات انكار سرويس توزيع شده به گونه اي طراحي شده است كه بات نتي از دستگاه ها و پلت فرم هايي كه مديران سيستم تصور مي كنند در معرض خطر آلودگي به بات نت قرار ندارند، راه اندازي مي كند. شركت ها نياز دارند تا سيستم هاي خود را مقاوم نمايند.
با فرض آن كه مردم مي دانند كه چگونه در برابر اين بدافزار مقابله نمايند، اين بدافزار به راحتي قابل شناسايي است. مقابله با اين بدافزار از طريق مقاوم سازي سيستم در لايه 3 با استفاده از فهرست كنترل دسترسي (ACLs) يا در لايه 7 با استفاده از امضا براي سيستم هايي مانند SNORT يا ابزار كشف بدافزار منبع باز YARA صورت مي گيرد.

شماره: IRCNE2014092327
تاريخ: 05/07/93

شركت اپل اعلام كرد كه اكثر كاربران مكينتاش تحت تاثير رخنه امنيتي كه اخيرا كشف شده است قرار ندارند. اين آسيب پذيري به مهاجمان اجازه مي دهد تا كنترل يك سيستم عامل را در اختيار بگيرند.
اين آسيب پذيري كه با نام "Shellshock" يا "Bash" شناخته مي شود، آخرين آسيب پذيري شناسايي شده در دنياي رايانه مي باشد كه مي تواند منجر به اجراي كدي مخرب در پوسته Bash شود. پوسته Bash يك پوسته خط فرمان است كه توسط سيستم عامل هاي يونيكس و لينوكس و هم چنين سيستم عامل Mac OS X اپل استفاده مي شود. با اين حال شركت اپل اعلام كرد كه اكثر كاربراني كه از اين نرم افزار استفاده مي كنند نگراني نداشته باشند زيرا تحت تاثير اين آسيب پذيري قرار ندارند.
آسيب پذيري Bash، ضعفي است كه مي تواند به كاربران غيرمجاز اجازه دهد تا از راه دور كنترل يك سيستم آسيب پذير را در اختيار بگيرند. سيستم كاربران OS X به طور پيش فرض امن مي باشد و در صورتي كه كاربران سرويس هاي پيشرفته يونيكس را پيكربندي نكرده باشند، خطري آن ها را تهديد نمي كند. در حال حاضر شركت اپل در حال كار بر روي انتشار يك به روز رساني براي كاربران يونيكس پيشرفته مي باشد.
به تمامي كاربراني كه در سيستم آن ها از Bash استفاده شده است توصيه مي شود تا در اسرع وقت به روز رساني هاي مربوطه را اعمال نمايند.