Attention aux modules complémentaires pour Firefox

En voulant vérifier s’il existait des vulnérabilités récentes avec le gestionnaire de mots de passe de Firefox, je suis tombé sur l’article suivant qui parle d’un module complémentaire malicieux appelé Mozilla Sniffer. Ce module est arrivé à être rendu disponible sur le site principal de Firefox. Ce que ça me dit c’est qu’il faut faire très attention lorsqu’on ajoute un module complémentaire, plugin ou autre [dans n'importe quel navigateur].
Un autre point sur les modules complémentaires. Avec le modèle de sécurité actuel de Firefox [et autres], un module peut être malicieux dès son arrivée dans l’inventaire officiel de Mozilla [et autres] ou peut le devenir lors d’une mise à jour. Il est donc sage d’utiliser aucun module complémentaire d’une source inconnue. Malheureusement, aujourd’hui je ne connais aucune source vraiment fiable – autre que les compagnies de renommée qui portent un peu plus attention à la sécurité et à la qualité logicielle, comme Microsoft. Je ne mettrais malheureusement pas Adobe, Apple et Oracle dans cette liste.
Avec Firefox, j’aime bien les modules NoScript, SyncPlaces, Web of Trust (WOT) et Download Them All mais je n’aime pas vraiment le fait qu’une mise à jour pourrait affecter des milliers d’utilisateurs… Je crois que l’équipe de Mozilla reconnaît ce problème est que c’est pourquoi on travaille sur  un nouveau modèle pour addresser ce type de vecteur important.
Entre temps, j’attend toujours pour un navigateur qui gère bien la sécurité tout en offrant les fonctionalités et le contrôle minimum dont je m’attend. Pour le moment, la balance sécurité/fonctionalité n’est pas atteinte encore…

Ref: Firefox blog [2010/07/13]

Add-on security vulnerability announcement

One malicious add-on and another add-on with a serious security vulnerability were discovered recently on the Mozilla Add-ons site. Both issues have been dealt with, and the details are described below.

Mozilla Sniffer

Issue

An add-on called “Mozilla Sniffer” was uploaded on June 6th to addons.mozilla.org. It was discovered that this add-on contains code that intercepts login data submitted to any website, and sends this data to a remote location. Upon discovery on July 12th, the add-on was disabled and added to the blocklist, which will prompt the add-on to be uninstalled for all current users.

Impact to users

If a user installs this add-on and submits a login form with a password field, all form data will be submitted to a remote location. Uninstalling the add-on stops this behavior. Anybody who has installed this add-on should change their passwords as soon as possible.

Status

Mozilla Sniffer has been downloaded approximately 1,800 times since its submission and currently reports 334 active daily users. All current users should receive an uninstall notification within a day or so. The site this add-on sends data to seems to be down at the moment, so it is unknown if data is still being collected.
Mozilla Sniffer was not developed by Mozilla, and it was not reviewed by Mozilla. The add-on was in an experimental state, and all users that installed it should have seen a warning indicating it is unreviewed. Unreviewed add-ons are scanned for known viruses, trojans, and other malware, but some types of malicious behavior can only be detected in a code review.

Credit

This issue was originally reported by Johann-Peter Hartmann.

Note

Having unreviewed add-ons exposed to the public, even with low visibility, has been previously identified as an attack vector for hackers. For this reason, we’re already working on implementing a new security model for addons.mozilla.org that will require all add-ons to be code-reviewed before they are discoverable in the site. Here’s more information about it.

Information privée disponible sur iPhone

Voici une application développée par Nicolas Seriot qui permet de démontrer l’information personnelle que le iPhone [et en partie le iPad] permet d’obtenir à n’importe quelle application. Il l’a présenté à BlackHat DC 2010.

• Code Source: SpyPhone
• White paper: iPhonePrivacy.pdf
• Black Hat slides: iPhonePrivacySlides.pdf

A project that shows the kind of data a rogue iPhone application can collect. Nicolas presented this at BlackHat 2010 in DC.

• Source Code:  SpyPhone
• Here is the white paper: iPhonePrivacy.pdf
• And here are the Black Hat slides: iPhonePrivacySlides.pdf

Se protéger contre les attaques sur la vulnérabilité .LNK de Windows (Stuxnet/Sality)

Je viens de terminer ce rapport à propos de la vulnérabilité très récente de Windows (MS10-046, CVE2010-2568) utilisée par les vers Stuxnet et Sality. J’ai vérifié le comportement de la vulnérabilité et des contremesures suggérées par Microsoft en utilisant le nouveau module Metasploit. J’y ai aussi rajouté quelques recommandations pour se protéger contre ce type d’attaque “jour zéro” (dans le futur).

This report I just completed is a quick proof of concept that shows how easy it is to use a brand new Metasploit Module to attack a vulnerable Windows XP SP3 Workstation manually.  The module exploits a recently discovered Windows vulnerability (MS10-046, CVE2010-2568): Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the icon of a specially crafted shortcut is displayed. This vulnerability has been used by the Stuxnet and Sality worms.
Then, I verified the Microsoft workaround and it appears to be effective, even without reboot. I also verified the out-of-band hotfix released on 2010/08/02 and it’s also effective. But this time, a reboot is necessary. Note that the workaround and the hotfix are both meant to prevent the Microsoft vulnerability (that simplifies the malicious payload propagation). They wouldn’t prevent an end-user from double-clicking the malicious shortcut(s) and then executing the malicious payload that it points to.
In the past, we have accepted that users be simply careful while web surfing and with dealing with email attachments. We also told them to make sure that they updated their antivirus signatures, applications, operating system and browser plugins.
Unfortunately these days, being really careful is not good enough anymore. This proof of concept helps demonstrate that it is important, more than ever, to apply the least privilege rules (ie: remove admin privilege during day-to-day operations) while using any Windows operating system version.

Références

1. Module Metasploit
2. Avis Microsoft (KB2286198)
3. Bulletin de sécurité Microsoft MS10-046
4. Blog Trend Micro
5. Stuxnet selon McAfee
6. CVE 2010-2568