Database security reminder: do not make it down your guard (eWeek Security Watch)

18 December 2010 1 H 54

Compromise can happen quickly - something Sentrigo people have recently recalled the attackers came knocking on their door digital.

December 1st, the company deployed an instance of Oracle running on Amazon EC2 database. Six days later, he was pwn?s. Fortunately, no data production was inside - testing data, just as the instance was only there if the company could demonstrate security software.

"In this case, we were indirect capabilities to scan the database and find issues and set configurations, vulnerability assessment", explained Sentrigo CTO Slavik El. "We did not follow in place, but we do not deploy rules blocking." So we were alerted to attack and at that time there, he became interesting we let attackers continue to see real-time, real-world attack evolution.

Attackers have discovered the instance some simple port scan servers on the Internet, he said. When they found an open port, they identified and Oracle instance running behind him. From there, they could have access to the database and the escalation of privileges.

"The initial connection was conducted on a demo account without privileges by brute - force password", he said. "Senior level privileges elevation exploited a vulnerability in one of the components Oracle (OLAP)." Then, in these privileges the hacker took control of the operating system in dbms_scheduler. »

He admitted the instance Oracle has not been fully patched - they were using version 11.107 - but was struck by the speed in which compromise passed yet.

Andy Feit, Vice President of marketing at Sentrigo, said that anonymity is not true protection.

"Nobody knew which server, it was, he was just" said Feit.

He added that the situation could occur with any provider of cloud or a server owned by the company outside of the firewall and that Amazon has a "nice built-in firewall" and monitors outgoing bodies to prevent port scanning traffic.

"On the other hand, in the future, I certainly see Amazon and similar providers offering much more such as out-of-the-box IDS/IPS and other controls network," said technical director.

The moral of the story - expose your database on the Internet without appropriate including firewall security and access controls and make sure that the database is fully patched.

WikiLeaks security breach prompts U.S. military repression (TGDaily)

Nature as a child at school that breeze rules and the ruins fun for all the WikiLeaks scandal forced the DoD to prohibit the use of CD and DVD disc on SIPRNET computers-inch.

Most affected by the ban are soldiers on the ground level are now banned from everyday tools of fear in a Marshal of the Court.

The u.s. Government is worried that information can be stolen from secure servers with removable media devices mainly because this is not the first time that happened.

Server Zippernet super secure Pentagon hacked with removable flash drive and it was determined that WikiLeak documents were obtained in a similar manner.

This is not the first time a removable media is prohibited.

Two years ago discovered that drives and disks propagation has helped secure virus computers, Pentagon led DoD to implement sweeping ban.

However, the moment where that lifted, "Deep Throat" Pfc Bradley Manning began to download EUCI SIPRNET onto a CD labeled "Lady Gaga." Very embarrassing information was transferred to susbsequently WikiLeaks.

Above-mentioned prohibition came in the form of a "Cyber Control Order," which provides the immediately stop the use of removable media on all systems, servers and stand-alone machines residing on SIPRNET.

"Unauthorized regular data transfers occur on removable media classified networks and constitute a method of the insider threat uses to exploit information, topic" reads the order.

To mitigate activity all... must immediately suspend all activities SIPRNET data on removable media."

In collaboration with the order of electronic control, the Pentagon also connects military machines to a host on security system that detects the behavior of the computer "suspect".

Aside from being a global problem, the prohibition affects administrators often transfer information to flash drives between computers that are not on a network due to constraints of security or in remote areas.

"Users will be experience difficulty with the transfer of data to the operational requirements that would prevent the news on the execution of the mission," concedes the document.

Nevertheless, "soldiers who do not comply can be punished pursuant to article 92 of the Uniformed military justice."

Of course, only time will tell only if the draconian prohibition on removable media will help protect the sensitive information of the army, or if we are going to face second WikiLeaks part.

[Via connected DangerRoom]

Mozilla patches Firefox security bugs (Macworld) 13

by Gregg Keizer, Computerworld Editor's Note: this story is extracted from Computerworld. For more Mac coverage, visit the Macintosh Computerworld knowledge centre.

Mozilla Thursday 13 patched vulnerabilities in Firefox, including a patch re a bug that was broken in March 2010.

Eleven of the 13 were rated "critical", the representative of the bugs that hackers could in theory threat level allows to divert a system or it infect with malware. The two remaining vulnerabilities, one marked "top" and the second has been marked as "moderate".

Versions of hotfixes have been designated for Firefox 3.6.13 and Firefox 3.5.16 by Mozilla, which continues to provide updates to security for Firefox 3.5.

In the past, Mozilla supported older versions of browsers for approximately six months after the release of the next; version If it had followed this practice with Firefox 3.5, Mozilla would have taken retire browser in July 2010, six months after the debut of Firefox 3.6.

13 Patch is a crack a flaw in Firefox second exposed by Firebug, the popular Web development add-on debugger.

Firstly corrected March - when Mozilla has said that it will affect not for Firefox 3, 6 - Thursday repetition was necessary because the researcher who originally reported the fault that this fix might be avoided.

The new patch applies to Firefox 3.5 and 3.6, both said Mozilla.

Other parcels addressed bugs memory for the browser engine, integer and buffer overflows and location bar SSL spoofing flaw. The update fixes also near 70 defects instead of security, including several stability bugs Mozilla followed by reports of incident submitted by the user.

Like Google when it patches chrome, Mozilla temporarily bar public access to the technical details of the critical vulnerabilities that it plots up to what most users have been notified of the update. The company change Bugzilla and bug filing database, for example, allows anyone to see the lists for the two non-critical vulnerabilities in update yesterday, but blocking access to critical faults 11.

Upgrading major next Firefox 4, was to achieve 8 Beta on 30 November - later postponed to December 9 - but was postponed once, according to the notes on the Mozilla site. It now appears before December 16. In October, Mozilla has acknowledged that it could not keep its initial development schedule and announced for Firefox 4 send not at the beginning of 2011.

Firefox has been steadily losing share such use as measured by the company settings Web Net Applications. Last month, the global share of the browser slipped to 22.8%, its lowest mark since August 2009.

Users can update Firefox 3.6.13 by downloading the new edition or by selecting "Check for Updates" in the help browser menu. Firefox 3.5 users can obtain version 3.5.16 Update tool.

Gregg Keizer covers Microsoft issues security, Apple, Web browsers and General technology breaking news for Computerworld. Follow Gregg on Twitter at @ gkeizer or you subscribe to flux RSS de Gregg. Her address is gkeizer@ix.netcom.com.

Learn more about security in Computerworld security topic Center.