Articles by "Vulnerability"
Showing posts with label Vulnerability. Show all posts

25 most important software weaknesses

There are many vulnerabilities that can affect security in our day to day. Many failures that make the software we use, network connections or the devices we use can be a threat. In this article we echo a list published by MITER that shows the 25 main software weaknesses that are the cause of the serious vulnerabilities that can affect our security. Let's talk about it.



There are many errors that can affect the programs we use, the tools that our devices have. It is something that is present in our day to day. However, there are times when these vulnerabilities may represent a more important threat.

MITER , an American company dedicated to systems engineering, research and development, has released a list of the 25 most important software vulnerabilities. They indicate that these errors can be easily exploited and, ultimately, be used by a possible attacker to have control of a system.

Due to these vulnerabilities that are considered important, an attacker could steal confidential data, make the proper functioning of certain software impossible, or cause various attacks.

The main objective of MITRE in making this list public is that software developers have it as a guide to control these vulnerabilities . This way they can create more secure software that does not put the security of users at risk, or at least reduce it as much as possible.

Keep in mind that these 25 vulnerabilities are not the result of chance or what they believe. To reach this conclusion they have applied a formula that uses different scores to give a final assessment to each one. In this way they can draw up the definitive list with which they can have a higher level of prevalence and also represent a greater danger.

To create this list have been based on vulnerabilities around the world. They have given a denomination to each of them and together with each one they have put the valuation, the CVSS score, which is what allows to know which are the most dangerous and, in short, with which the developers have to be more careful.


Main vulnerabilities according to MITER

If we start with the top 5 we can say that the most important vulnerability for MITRE and the one with the highest CVSS score is the incorrect restriction of operations within the limits of a memory buffer . He has been assigned the name of CWE-119 and has a score of 75.56.

The second is the inappropriate neutralization of the input during the generation of the website . It has a rating of 45.69 and has been referred to as CWE-79.

The following are, respectively, the incorrect input validation , which has qualified it with a score of 43.61 and has called it CWE-20; the exposure of information , called CWE-200 and a score of 32.12 and, closing the top 5, the vulnerability CWE-125 called reading out of bounds and with a score of 26.53.
These are the five main vulnerabilities according to MITER. However, in total they have released a list with 25. The remaining 20 are the ones mentioned below:
  • CWE-89 Incorrect neutralization of special elements used in an SQL command ("SQL Injection") 24,54
  • CWE-416 Use after free version 17.94
  • CWE-190 Entire Overflow 17,35
  • CWE-352 cross-site request forgery 15.54
  • CWE-22 Incorrect limitation of a path name to a restricted directory 14.10
  • CWE-78 Incorrect neutralization of special elements used in an operating system command 11,47
  • CWE-787 Writing out of bounds 11.08
  • CWE-287 Incorrect authentication 10.78
  • CWE-476 No cursor reference 9.74
  • CWE-732 Incorrect permission assignment for critical resource 6.33
  • CWE-434 Unrestricted upload of files of dangerous type 5.50
  • CWE-611 Incorrect XML restriction External entity reference 5.48
  • CWE-94 Improper control of code generation ("Code injection") 5.36
  • CWE-798 Use of coded credentials 5.12
  • CWE-400 Consumption of uncontrolled resources 5.04
  • CWE-772 Resource release is lacking after life 5.04
  • CWE-426 Unreliable search path 4.40
  • CWE-502 Deserialization of unreliable data 4.30
  • CWE-269 Inadequate privilege management 4.23
  • CWE-295 Incorrect validation of certificate 4.06


Two analysts threats recently hit a new Linux malware that conceals its cryptocurrency mining operations.

On 16 September, Augusto Remillano II and Jakub Urbanec revealed in a news post on Trend Micro, a security intelligence blog, they have discovered a new malware. According to analysts, this malware is particularly notable for the way it loads malicious kernel modules to mask its mining operations of crypto-time data.

Malware provides full access hackers to the infected machine




Analysts have found that Skidmap hid his cryptocurrency extraction using a rootkit, a program that installs and executes code on a system without the consent or knowledge of the end user. This makes its malicious components undetectable by infected system monitoring tools.

In addition to launching a crypto-piracy campaign on the infected machine, the malware would give attackers a "unfettered access" to the affected system. Analysts add:


"Skidmap aussi olefins has a backdoor way to get access to the engine and replaces the file system aussi pam_unix.so by His Own malicious release. This malicious file Accepts a specific password for all users, Allowing attackers to log in As Any use of the machine. "

cryptojacking campaigns up 29%

Cryptojacking is a term used in the industry to designate crypto-exploration stealth attacks which consist of malicious software or any other way to computer processing power to operate without the consent or cryptomoney the knowledge of the owner.

In August, the McAfee Labs cybersecurity company released a report on threats in the first quarter of 2019. According to the report, the cryptojacking would have increased, with an increase of 29% cryptojacking campaigns.

.

Vulnerability in SIM-cards, how to protect against Simjacker



The vulnerability of Simjacker can spread to more than 1 billion mobile phone users worldwide.
A new and previously unrecognized critical vulnerability has been discovered in SIM cards, which could allow remote attackers to compromise targeted mobile phones and spy on victims simply by sending an SMS message.
This vulnerability, dubbed “SimJacker,” is located in certain software called S @ T Browser (a dynamic toolkit for SIM cards) embedded in most SIM cards that is widely used by mobile operators in at least 30 countries and can be used no matter what phones the victims use.
Well, what's wrong with that? A special private company that works with governments has been actively exploiting the SimJacker vulnerability for at least the past two years to conduct targeted monitoring of mobile phone users in several countries.
S @ T Browser, short for SIMalliance Toolbox Browser, is an application that installs on various SIM cards, including eSIM, as part of the SIM Tool Kit (STK) and is designed to enable mobile operators to provide some basic services, subscriptions, and additional wireless services for its customers.

Because the S @ T Browser contains a number of STK instructions — such as sending a short message, setting up a call, launching a browser, providing local data, launching on command, and sending data — that can be caused by simply sending an SMS message to the device, the software offers a runtime environment to run malicious commands on mobile phones.

How does the Simjacker Vulnerability work?


Discovered by researchers from AdaptiveMobile Security in a new study published on September 12, 1919, the vulnerability can be exploited using a GSM modem for $ 10 to perform several tasks listed below on a target device by simply sending an SMS message containing a certain type of spy code .
  • Retrieving the location of the target device and IMEI information,
  • Spreading false information by sending fake messages on behalf of the victims,
  • Performing premium rate fraud by dialing premium rate numbers,
  • Spy on the surroundings of victims by ordering the device to call the attacker’s phone number,
  • The spread of malware, forcing the victim’s phone browser to open a malicious web page,
  • Perform denial of service attacks by disconnecting the SIM card and
  • Getting other information, such as language, type of radio, battery level, etc.

  • During the attack, the user is completely unaware that he received the attack, that the information was extracted and that it was successfully deleted,” the researchers explain.


    This attack is also unique in that the Simjacker attack message can be logically classified as carrying full malware load, especially spyware. This is because it contains a list of instructions that the SIM card must follow. Simjacker is the first real attack in which spyware is sent directly to SMS.
    Although technical details, a detailed document and proof of concept of the vulnerability are planned to be published in October this year, the researchers said they observed real attacks on users with devices from almost all manufacturers, including Apple, ZTE, Motorola, Samsung, Google, Huawei and even IoT with SIM cards.
    It turns out that all manufacturers and models of mobile phones are vulnerable to SimJacker attacks, since this vulnerability uses outdated technology built into SIM cards, the specification of which has not been updated since 2009, which potentially puts more than a billion people at risk.

    Simjacker Wildlife Vulnerability

    Researchers say that the Simjacker attack worked very well and has been used successfully for many years, "because it used a combination of sophisticated interfaces and obscure technologies, showing that mobile operators cannot rely on standard installed security features."

    Simjacker is a clear danger to mobile operators and subscribers. This is potentially the most sophisticated attack that has ever existed on major mobile networks. ”
    said Ketal MacDade, CTO at AdaptiveMobile Security, in a press release.





    “This is the main alarm signal that shows that hostile actors are investing heavily in increasingly sophisticated and creative ways to undermine network security.” This threatens the security and trust of customers, mobile operators and affects the national security of entire countries. "

    Moreover, now that this vulnerability has been publicly disclosed, researchers expect hackers and other attackers to "develop these attacks in other areas."

    Researchers have responsibly revealed the details of this vulnerability of the GSM Association, a trading organization representing the community of mobile operators, as well as the SIM alliance, representing the major manufacturers of SIM cards / UICC.

    SIMalliance acknowledged the issue and provided recommendations for security SIM card manufacturers for S @ T push messages.

    Mobile operators can also immediately eliminate this threat by setting up the process of analyzing and blocking suspicious messages containing S @ T browser commands.
    We, as a potential victim, as a user of a mobile device, can do nothing if we use a SIM card with S @ T Browser technology deployed on it, except for a request to replace our SIM card on which patented security mechanisms are installed.
    More information about Simjacker can be found at www.simjacker.com, and Katal MacDade, CTO of AdaptiveMobile Security, will introduce Simjacker at the Virus Bulletin Conference, London, October 3, 2019.