Exploit Available for Symantec End Point Protection
An exploit is now available at exploit-db.com for the Symantec End Point Protection privilege escalation vulnerability. Symantec released a patch for this issue earlier this week [1].
The vulnerability requires normal-user access to the affected system and can be used to escalate privileges to fully control the system (instead of being limited to a particular user) so this will make a great follow up exploit to a standard drive-by exploit that gains user privileges.
We have gotten some reports that users have problems installing the patch on legacy systems (e.g. Windows 2003). Applying the patch just fails in these cases and appears to have no ill effect on system stability.
[1] http://www.symantec.com/business/support/index?page=content&id=TECH223338
Free Service to Help CryptoLocker Victims by FireEye and Fox-IT
Various Internet Storm Center Handlers have written Diaries on the malware called CryptoLocker, a nasty piece of malware which encrypting the files of the systems it infects, then gives victims 72 hours to pay the ransom to receive a private key that decrypts those files. There are still victims out there with encrypted files, and if you're one of them or know of someone affected, the folks at FireEye and Fox-IT have created a web portal https://www.decryptcryptolocker.com/ to decrypt those files.
This is a free service for any afflicted by CryptoLocker, many of which are small businesses without the resources to deal with this properly, so let people know.
Using the site is very straight forward (Steps taken from the FireEye blog[1]):
How to use the DecryptCryptoLocker tool Users need to connect to the https://www.decryptcryptolocker.com/ Identify a single, CryptoLocker-encrypted file that they believe does not contain sensitive information. Upload the non-sensitive encrypted file to the DecryptCryptoLocker portal. Receive a private key from the portal and a link to download and install a decryption tool that can be run locally on their computer. Run the decryption tool locally on their computer, using the provided private key, to decrypt the encrypted files on their hard drive. DecryptCryptoLocker is available globally and does not require users to register or provide contact information.
This is a fantastic resource from both FireEye and Fox-IT, so thanks to all involved in making this happen and making it free to use.
For more background on CryptoLocker from Fox-IT, read their CryptoLocker ransomware intelligence report [2].
[1] http://www.fireeye.com/blog/corporate/2014/08/your-locker-of-information-for-cryptolocker-decryption.html
[2] http://blog.fox-it.com/2014/08/06/cryptolocker-ransomware-intelligence-report/
Chris Mohan --- Internet Storm Center Handler on Duty
All Passwords have been lost: What's next?
Some of it may be hype. But no matter if 500 Million, 1.5 Billion or even 3.5 Billion passwords have been lost as yesterday's report by Hold Security states, given all the password leaks we had over the last couple years it is pretty fair to assume that at least one of your passwords has been compromised at some point. [1]
yes. we have talked about this many times, but it doesn't seem to get old sadly.
So what next? Password have certainly been shown to "not work" to authenticate users. But being cheap, they still are used by most websites (including this one, but we do offer a 2-factor option).
For web sites:
- review your password policies. There is no "right" policy, but come up with something that rejects obvious weak passwords and on the other hand, allows users to choose passwords that they can remember (so they can have a unique password for your site).
- Make sure your site works with commonly used password managers. The only real way for the user to have a unique password for each site is a password manager.
- lock accounts that haven't been used in a long time, and delete their password from your database forcing a password reset if they try to reactivate it
- consider two factor authentication, at least as an option and maybe mandatory for high value accounts (e.g. administrators). Google authenticator is probably the easiest one to implement and it is free. We talked about other alternatives in the past as well.
For users:
- Have a unique password for each site. As an alternative, you may have a single "throw away" password for sites that you don't consider important. But be aware that at one point, a site that is not important now, may become important as you are doing more business with them.
- Use a password safe, if possible one that allows syncing locally without having to send your password collection to a cloud service.
- For important sites that don't allow for two factor authentication, consider a "two-part password": One part will be kept in your password safe, while the second part you type in. The password safe part is unique to the site while the additional second part can be the same for different sites or at least easy to remember. This will give you some protection against a compromised password safe.
- Change passwords once in a while (I personally like every 6 months... ) in particular the "static" part of these high-value passwords.
- Ask sites that you consider important to implement 2-factor authentication.
That's at least what I can come up with while sipping on my first cup of coffee for the day.
[1] http://www.holdsecurity.com/news/cybervor-breach/
Comments
www
Nov 17th 2022
6 months ago
EEW
Nov 17th 2022
6 months ago
qwq
Nov 17th 2022
6 months ago
mashood
Nov 17th 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
6 months ago
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.
<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
isc.sans.edu
Dec 26th 2022
5 months ago
isc.sans.edu
Dec 26th 2022
5 months ago