19-year-old man arrested in Heartbleed privacy breach, hacked SSNs from Revenue Agency Post By- Anand Garg

Right now, Internet world is facing a big security threat also known as Hearlbleed Bug, which has affected almost every popular website we use like facebook, google, yahoo…, and in this biggest security breach case one 19-year-old Canadian has been charged for using heartbleed bug to exploit taxpayer data of the Canada Revenue Agency website.

The Royal Canadian Mounted Police arrested that man named “Stephen Arthuro Solis-Reyes” at his home Tuesday, for now he has been released and is staying with his  parents in London’s north end.

Solis-Reyes faces charges related to one count of unauthorized use of a computer and one count of mischief in relation to data.

The arrested man is the son of a computer science professor at Western University, CTV News has confirmed.

According to the CRA, it had shutdown its services on April 8 after learning that their systems were vulnerable to the Heartbleed bug, after that on monday, it was announced by the officials at CRA that the Social Insurance Numbers of about 900 taxpayers were taken from the CRA systems over a six-hour period by someone who had exploited the Heartbleed bug.

“The RCMP treated this breach of security as a high priority case and mobilized the necessary resources to resolve the matter as quickly as possible,” Assistant RCMP Commissioner Gilles Michaud said in a statement.

The RCMP confiscated every computer in the London home and analyzed their contents.

Heartbleed bug was identified by Security company Codenomicon, this bug affects OpenSSL, which is one of the most widely used open-source software programs used to encrypt Internet Communications.

Your secure data can be exploited by hackers thorugh this bug. Right now at the time of publishing this post, not all of the websites affected by this flaw, fixed it.

Refrence by- hackersnewsbulletin

TARGETED ATTACK USES HEARTBLEED TO HIJACK VPN SESSIONS POST BY ANAND GARG

A targeted attack against an unnamed organization exploited the Heartbleed OpenSSL vulnerability to hijack web sessions conducted over a virtual private network connection.

Incident response and forensics firm Mandiant shared some details on a recent investigation of an incident that began April 8, one day after Heartbleed was publicly disclosed. Mandiant said the attackers exploited the security vulnerability in OpenSSL running in the client’s SSL VPN concentrator to remotely access active sessions.

This is just the latest in an escalating series of attacks leveraging Heartbleed, which is a problem in OpenSSL’s heartbeat functionality, which if enabled, returns 64KB of memory in plaintext to any client or server requesting a connection. Already, there have been reports of attackers using Heartbleed to steal user names, session IDs, credentials and other data in plaintext. Late last week came the first reports of researchers piecing together enough information to successfully reproduce a private SSL key.

Earlier this week, researchers in Sweden were able to exploit Heartbleed to extract private keys over OpenVPN, an open source VPN software package.

Mandiant’s report today is the first publicly known real-world attack on an organization providing remote access via Heartbleed.

Mandiant said the attacker was able to steal active user session tokens in order to bypass the organization’s multifactor authentication and VPN client software used to validate the authenticity of systems connecting to network resources.

“Specifically, the attacker repeatedly sent malformed heartbeat requests to the HTTPS web server running on the VPN device, which was compiled with a vulnerable version of OpenSSL, to obtain active session tokens for currently authenticated users,” wrote Mandiant investigators Christopher Glyer and Chris DiGiamo. “With an active session token, the attacker successfully hijacked multiple active user sessions and convinced the VPN concentrator that he/she was legitimately authenticated.”

Since Heartbleed exploits return only 64KB of memory for each heartbeat request, attackers would need to replay an attack over and over to steal any worthwhile data. In this case, Mandiant said an IDS signature specifically written for Heartbleed triggered more than 17,000 alerts during the attack.

While heartbeat requests don’t leave a trace, Mandiant said it was able to find evidence of the attacks not only from the IDS alerts, but also from the company’s VPN logs. Specifically, it said a malicious IP address triggered the IDS alerts as the attacker tried to reach the company’s SSL VPN. The key evidence was in the VPN logs, which showed active VPN connections changing rapidly—sometimes within seconds of each other—between the attacker’s IP address and the user’s legitimate one; geographically too, the IP addresses were distant, Mandiant said, and they belonged to different ISPs. Mandiant said it was also able to correlate those IDS alerts with the connection changes in the VPN logs.

“Once connected to the VPN, the attacker attempted to move laterally and escalate their privileges with the Heartbleed bug,” Glyer and DiGiamo wrote.

Refrence by- threatpost

Routers TCP 32764 Backdoor Vulnerability Secretly Re-Activated Again

At the beginning of this year, we reported about the secret backdoor ‘TCP 32764’ discovered in several routers including, Linksys, Netgear, Cisco and Diamond that allowed an attacker to send commands to the vulnerable routers at TCP port 32764 from a command-line shell without being authenticated as the administrator.

The Reverse-engineer from France Eloi Vanderbeken, who discovered this backdoor has found that although the flaw has been patched in the latest firmware release, but SerComm has added the same backdoor again in another way.

To verify the released patch, recently he downloaded the patched firmware version 1.1.0.55 of Netgear DGN1000 and unpacked it using binwalk tool. He found that the file ‘scfgmgr’ which contains the backdoor is still present there with a new option “-l”, that limits it only for a local socket interprocess communication (Unix domain socket), or only for the processes running on the same device.

On further investigation via reverse engineering the binaries, he found another mysterious tool called ‘ft_tool’ with “-f”option that could re-activates the TCP backdoor.

In his illustrated report (shown below), he explained that ‘ft_tool’ actually open a raw socket, that listens incoming packages and attackers on the local network can reactivate the backdoor at TCP port 32764 by sending the following specific packets:

• EtherType parameter should be equal to ‘0x8888’.
• Payload should contains MD5 hash of the value DGN1000 (45d1bb339b07a6618b2114dbc0d7783e).
• The package type should be 0x201.

So, an attacker can reactivate the TCP 32764 backdoor in order to execute the shell commands on the vulnerable SerComm routers even after installing the patched version.

Now question rises, why the routers manufacturers are adding intentional backdoors again and again?? May be the reason behind to be a helping hand for the U.S. intelligence agency NSA.

Currently there is no patch available for newly discovered backdoor. If you want to check your wireless router for this backdoor, you can download Proof-of-Concept (PoC) exploit released by the researcher from here or follow the below given steps manually:

1. Use 'binwalk -e' to extract the file system
2. Search for 'ft_tool' or grep -r 'scfgmgr -f
3. Use IDA to confirm.

ZeuS Botnet Updating Infected Systems with Rootkit-Equipped Trojan by gorvam saddar

ZeuS Botnet Updating Infected Systems with Rootkit-Equipped Trojan

ZeuS, or Zbot is one of the oldest families of financial malware, it is a Trojan horse capable to carry out various malicious and criminal tasks and is often used to steal banking information. It is distributed to a wide audience, primarily through infected web pages, spam campaigns and drive-by downloads.

Earlier this month, Comodo AV labs identified a dangerous variant of ZeuS Banking Trojan which is signed by stolen Digital Certificate belonging to Microsoft Developer to avoid detection from Web browsers and anti-virus systems. 

FREE! FREE! ZeuS BRINGS ROOTKIT UPDATE

Recently, the security researcher, Kan Chen at Fortinet has found that P2P Zeus botnet is updating its bots/infected systems with updates version that has the capability to drop a rootkit into infected systems and hides the trojan to prevent the removal of malicious files and registry entries.

The new variant also double check for the earlier installed version (0x38) of ZeuS trojan on the infected system and then replaces it with updated binary files (0X3B version).

“Every P2P Zeus binary would extract the version number from the update packet and compare the version number that is hardcoded in its body” to verify the success of update process.

According to researchers, there is only a minimal change in the new variant of P2P Zeus as the new binary also drops a rootkit driver file into the %SYSTEM32%\drivers folder, apart from its original functions. New Zeus Trojan equipped with rootkit feature makes it more sophisticated and increases the difficulty of removing Zeus from infected systems.

HOW TO PROTECT YOURSELF FROM ZeuS TROJAN

• We recommend users to use common sense and think twice before giving a click to any link on their e-mails or at any other websites they visit.
• Trustworthy companies don't send attachments unless you have requested specific documents. So, always use caution if you receive any email from an unknown contact with attachments that you haven't requested and do not bother to open it.
• Install a best Internet Security Tool and Configure the firewall to maximize the security of your computer system.

refrence http://thehackernews.com/