Network Management

ZombieLoad Vulnerability: SPARC Solaris Immune

Abstract:

Computing platforms have long had issues with MalWare, dating back to the MS-DOS days. Windows systems had been targeted, due to their ubiquity as well as the ability to install software with no user interaction into the system using pre-bundled keys. For the most part, UNIX Systems have been immune to most malware. A new classification of malware had become apparent, using CPU vulnerabilities, normally related to the Intel processor (leaving SPARC processors immune.) The latest vulnerability is ZomieLoad, affecting Intel processors and non-UNIX platforms such as Linux and Windows.

What is ZombieLoad

A new family of vulnerabilities on the Intel Processor have become apparent in Mid-May 2019. As an aggregate, they are referred to as "Microarchitectural Data Sampling" or MDS vulnerabilities. ZombieLoad is one of these vulnerabilities. Oracle provided a nice list of CVE's with summary details: CVE-2019-11091, CVE-2018-12126, CVE-2018-12130, and CVE-2018-12127

CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)

CVE-2018-12127: Microarchitectural Load Port Data Sampling (MLPDS)

CVE-2018-12130: Microarchitectural Fill Buffer Data Sampling (MFBDS)

How does it affect SPARC Solaris?

If you return back t the Oracle provided CVE's above, you will notice the following 2x lines:

Conclusions:

Posted by David at 12:01 AM No comments:

Labels: Intel, Malware, MDS, SPARC, vulnerability, ZombieLoad, ZombieLoad Attack

Spectre - SPARC Solaris: The Safe Choice

Abstract:

As the industry continues to struggle with Meltdown, a second vulnerability family appeared referred to as Spectre. As of this article publication, there are 4 variants of Spectre, the latter two variants referred to as Spectre-NG. All SPARC systems are safe, if the most recent systems are on the most current firmware & OS releases. As of this publishing, the latest application/OS & firmware patches fixes the first two. The later 2 does not affect SPARC, as the rest of the Intel and other CPU communities are struggling with their cloud and local server infrastructures.

Spectre

Spectre v1

Unpatched super-scalar CPU's (i.e. SPARC T4, T5, M6, M7, S7, M8, M10, M12) could possibly be exploited by CVE-2017-5753.

Spectre v2

A quick summary on Stack Exchange on how Spectre works:

the attacker tricks the speculative execution to predictively execute instructions erroneously. In a nutshell, the predictor is coerced to predict a specific branch result (if -> true), that results in asking for an out-of-bound memory access that the victim process would not normally have requested, resulting in incorrect speculative execution. Then by the side-channel, retrieves the value of this memory. In this way, memory belonging to the victim process is leaked to the malicious process.

Unpatched super-scalar CPU's (i.e. SPARC T4, T5, M6, M7, S7, M8, M10, M12) may be exploited by CVE-2017-5715.

Spectre v3a

All 64 bit SPARC is immune to CVE-2018-3640 .

Spectre v4

All 64 bit SPARC is immune to CVE-2018-3639 .

SPARC

Modern 64 bit SPARC variants come in 2 classes: Scalar and Super-Scalar

Sun UltraSPARC

Older Sun UltraSPARC 64 bit Servers do not have the CPU feature which could possibly be exploited and were not vulnerable... they did not issue speculative instructions. Oracle had purchased Sun, so their support channel can provide a definitive explanation. Performance was mostly driven on these servers leveraging SMP chassis, Multi-Core sockets, and large memory footprints.

Oracle SPARC

Newer Oracle SPARC Solaris servers are possibly vulnerable, if you are running a modern CPU which initiates speculative instructions (i.e. T4 or newer) while older 64 bit CPU's are not vulnerable. It has been reported on Solaris WTF that "Spectre (CVE-2017-5753 and CVE-2017-5715)" has been fixed in firmware (i.e. T4: 8.9.10 or greater; T5, M5, M6: 9.6.22a or greater; M7, S7, M8: 9.8.5c or greater.)

The short story, a firmware patch for CPU's newer than T4 are required and the impact is very minor in performance, according to the previous blog. Stock Firefox as shipped with Solaris 10 is vulnerable to Spectre v1, Solaris 11 fixed Firefox vulnerability early 2018, so users should migrate to Solaris 11.

Fujitsu SPARC

Sun and Oracle are not the only 2 vendors, who have produced 64 bit SPARC platforms. Newer Fujitsu SPARC Servers are also super-scalar, possibly vulnerable to Spectre v2 (CVE-2017-5753), and have been been fixed in firmware (i.e. M10: XCP2351; M12: XCP3051.)

Conclusions:

If you are using an older Sun UltraSPARC server, you are OK. If you are running a newer Oracle SPARC (i.e. T4 or newer) server, you should update Firefox on Solaris 10 or get on the latest Solaris 11 release to be protected from Spectre v1. For the same class of hardware, apply firmware patches available today to protect from Spectre v2. SPARC is immune to Spectre v3 & v4. Get with your Oracle support for the first 2 variants (doc id 2349278.1) and second 2 variants.

Posted by David at 2:49 PM 1 comment:

Labels: Fujitsu, M10, M12, M5, M6, M7, M8, Malware, Solaris, SPARC, SPARC M5, SPARC M6, SPARC M7, SPARC M8, SPARC T5, SPARC T7, Spectre, Spectre-NG, T5, T7

Meltdown - SPARC Solaris: The Only Safe Choice

Abstract:

As the rest of the industry has been struggling with security vulnerabilities, SPARC Solaris platforms have been relatively quiet. Meltdown, otherwise known as CVE-2017-5754, has taken the world by storm. Operating Systems have long relied on Memory Management Units to isolate user application programs from the OS kernel. This had come to a screeching halt, leaving lesser secure systems in a world of hurt.

Meltdown Vulnerability:

Some OS's will keep the Kernel Pages mapped into the same context as User Application Pages. This is often done for speed (i.e. linux) but places extra dependencies upon the MMU for isolation. Nearly all OS's had ceded this security concern to the CPU vendor, instead of applying the most secure practice in the OS architecture.

Meltdown:

As one vendor noted, SPARC Solaris is immune from Meltdown and about the only platform not subject to this critical vulnerability in the data center. This was accomplished by OS designers placing Kernel and User pages into different contexts, a design which added additional security, but at a performance cost that other OS designers in the industry were not willing to cede.

Conclusion:

Some Solaris systems, decades ago, may be affected, but nothing modern. Secure by Design is a typical decision for Solaris architects, a decision that has served them well for the decades they served a 64 bit OS to the user community, as other OS vendors played "catch up" in performance or features or functionality.

Posted by David at 11:39 AM No comments:

Labels: Malware, meltdown, Security, Solaris, SPARC

Abstract:
Nearly every computing device today is connected together via a network of some kind. These connections open up opportunities or vulnerabilities for exploitation by mafia, criminals, or government espionage via malware. While computers such as MacOSX are immune, along with their mobile devices based upon iOS iPhone and iPads... huge numbers of Linux and Android devices are at risk!





Heartbleed:

This particular vulnerability can be leveraged by many sources in order to capture usernames and passwords, where those account credentials can be later used for nefarious purposes. Nefarious includes: command and control to attack commercial, financial, government, or even launch attacks against entire national electrical grids; stealing money; stealing compute resources. The defect is well documented.


Apple and Android/Linux Vulnerabilities:

There are many operating systems which are vulnerable to this defect, but for this article, we are only really concerned about the mobile market.

• 2014年04月14日 - Not just websites hit by OpenSSL's Heartbleed – PCs, phones and more under threat

While most of the buzz surrounding OpenSSL's Heartbleed vulnerability has focussed on websites and other servers, the SANS Institute reminds us that software running on PCs, tablets and more is just as potentially vulnerable.
Williams said a dodgy server could easily send a message to vulnerable software on phones, laptops, PCs, home routers and other devices, and retrieve up to 64KB of highly sensitive data from the targeted system at a time. It's an attack that would probably yield handy amounts of data if deployed against users of public Wi-Fi hotspots, for example.

• 2014年04月12日 - Millions of Android Devices Vulnerable to Heartbleed Bug

While Google said in a blog post on April 9 that all versions of Android are immune to the flaw, it added that the “limited exception” was one version dubbed 4.1.1, which was released in 2012.
Security researchers said that version of Android is still used in millions of smartphones and tablets, including popular models made by Samsung Electronics Co., HTC Corp. and other manufacturers. Google statistics show that 34 percent of Android devices use variations of the 4.1 software.

The company said less than 10 percent of active devices are vulnerable. More than 900 million Android devices have been activated worldwide.

• 2014年04月11日 - Apple is IMMUNE from Heartbleed. OS X and iOS unaffected.

After taking a few days to check its security, the fruity firm joined other companies in publicly announcing how worried or secure its customers should feel.
“Apple takes security very seriously. IOS and OS X never incorporated the vulnerable software and key Web-based services were not affected,” an Apple spokesperson said.

Conclusions:
To give an adequate understanding regarding the number of mobile Android devices at risk, one could take the population of the United States, at roughly 317 Million people as a baseline. 90 million Android Linux based devices vulnerable, that is equivalent to nearly 28% of the population of the United States is at risk! This is no small number of mobile devices - there is a lot of patching that either needs to be done or mobile devices which should be destroyed. Ensure you check your android device!

Posted by David at 2:21 PM 1 comment:

Labels: Android, Apple, Heatbleed, IOS, Linux, MacOSX, Malware, Security, Virus, WORM

Security: Software Piracy, Android Phones, and SMS Spam
Abstract:
Ever since the creation of computers, people have been distributing software to avoid paying money or paying to distribute something that people don't want. Pirated Applications and Spam are two primary means to distribute viruses, malware, and worms. Baby steps against these on-line monsters are occasionally made.


In Review: 2013

From January to November last year, nearly 2 viruses, trojans, or generic malware was discovered each month in the Android mobile application market. December had a couple more discovered. For the malware discovered, there are countless numbers of mobile applications which have not yet been discovered... to steal credit card information, identities, or even "command and control" applications to turn your mobile device into a robot against unsuspecting targets (while you pay for the data traffic that is produced!)

Starting: 2014

While consolidating a list of mobile malware in the Android market was not completed, it is clear that there is some progress in this space... no matter how small.

2014年03月25日 U.S. Government First Convictions Over Pirated Mobile Android Applications

The US has enforced its first convictions for illegally distributing counterfeit mobile apps, after two Florida men pleaded guilty for their part in a scheme that sold pirated apps with a total retail value of more than 700,000ドル. Thomas Allen Dye, 21, and 26-year-old Nicholas Anthony Narbone both pleaded guilty to the same charge - conspiracy to commit criminal copyright infringement - earlier this month and are due to be sentenced in June and July respectively. Both men were in the Appbucket group, of which Narbone was the leader, which made and sold more than a million copyrighted Android mobile apps through the group's alternative online market.

2014年03月26日 Chinese Arrest 1,500 in Fake Cellular Tower Text Message Spam Raid

China’s police have arrested over 1,500 people on suspicion of using fake base stations to send out mobile SMS spam. The current crackdown, began in February, according to Reuters. Citing a Ministry of Public Security missive, the newswire says a group operating in north-east Liaoning province, bordering North Korea, is suspected of pinging out more than 200 million spam texts.

In Conclusion:
Be diligent! Remember to purchase your applications from reputable places, don't be seduced into stealing applications on-line or purchasing them under list price. Being a thief could make you a victim!

Posted by David at 5:23 PM No comments:

Labels: Android, Cell, Malware, Mobile, Security, Spam, Trojan, Virus

Abstract:

Posted by David at 12:22 AM No comments:

Labels: ASUS, D-Link, Huawei, Linksys, Linux, Malware, MicroNet, Router, Security, Tenda, TP-Link, Viruses

Android: Malware Infestations for 2013

2013 Ending
Rounding out the 2013 Year with More Android Virus and Malware issues.

• 2013年12月17日 - Android and SMS Text Messages to China
  http://www.theregister.co.uk/2013/12/17/android_botnet/

• 2013年12月17日 - Android Anti-Virus Unable to Kill Malware
  http://www.theregister.co.uk/2013/12/17/android_anti_malware/

Somehow, this is no surprise.

2013 Investigation
A previous Network Management article discussing Android Malware from 2013 - not a pleasant place to be. Nearly a new Android exploit was uncovered every 2 weeks.

2013 Conclusions
A recent article in The Register mentions the dangers of Java and Android (which is based upon a Java port) on network clients:

Meanwhile, fully 99 per cent of all mobile malware discovered during the year targeted Android, as did 71 per cent of all web-based attacks on mobile devices.

Android mobile devices are less expensive than the alternative - but there is clearly a price to be paid.

Posted by David at 2:51 PM No comments:

Labels: Android, Linux, Malware, SMS, Trojan, Virus, WORM

Why do people want to hack your server? Maybe it is to mine BITCOINS!
http://arstechnica.com/security/2013/12/anatomy-of-a-hack-what-a-successful-exploit-of-a-linux-server-looks-like/

Like most mainstream operating systems these days, fully patched installations of Linux provide a level of security that requires a fair amount of malicious hacking to overcome. Those assurances can be completely undone by a single unpatched application, as Andre' DiMino has demonstrated when he documented an Ubuntu machine in his lab being converted into a Bitcoin-mining, denial-of-service-spewing, vulnerability-exploiting hostage under the control of attackers.

Posted by David at 2:00 PM No comments:

Labels: bitcoins, Linux, Malware, Security, Virus

 This is not the first case of such worms, targeting Internet devices, in this case Intel based only.
http://arstechnica.com/security/2013/11/new-linux-worm-targets-routers-cameras-internet-of-things-devices/

Researchers have discovered a Linux worm capable of infecting a wide range of home routers, set-top boxes, security cameras, and other consumer devices that are increasingly equipped with an Internet connection. Linux.Darlloz, as the worm has been dubbed, is now classified as a low-level threat, partly because its current version targets only devices that run on CPUs made by Intel

A short article from Security company Symantec discussing the latest WORM targeting The Internet.
http://www.symantec.com/connect/blogs/linux-worm-targeting-hidden-devices

Symantec has discovered a new Linux worm that appears to be engineered to target the “Internet of things”. The worm is capable of attacking a range of small, Internet-enabled devices in addition to traditional computers. Variants exist for chip architectures usually found in devices such as home routers, set-top boxes and security cameras. Although no attacks against these devices have been found in the wild, many users may not realize they are at risk, since they are unaware they own devices that run Linux.

Posted by David at 2:26 PM No comments:

Labels: Intel, Internet, Linux, Malware, Symantec, WORM

Abstract:
Sometimes the term "virus" generically, but there are really many kinds of "malware", of which Virus is a specific type. I categorized a few Android malware incidents from 2013 for friends. Please be aware of the "Apps" you buy, what you download, install, and even the web sites you go to.

A Brief 2013 History:
The Android ecosystem is not as "tight" as other ecosystems, such as Apple or Blackberry - as such, it is vulnerable to many more exploits... which may cause you money in bandwidth, future purchases, text messages, etc.

2013年01月09日 --- Android users hit by scareware scam
http://www.zdnet.com/blog/security/android-users-hit-by-scareware-scam/9960

2013年01月13日 --- “Bill Shocker” Android malware hits China, infecting 620K smartphone users
http://e27.co/bill-shocker-android-malware-hits-china-infecting-620k-smartphone-users/

2013年01月20日 --- New variants of premium rate SMS trojan 'RuFraud' detected in the wild
http://www.zdnet.com/blog/security/new-variants-of-premium-rate-sms-trojan-rufraud-detected-in-the-wild/10165

2013年02月08日 --- Researchers spot a fake version of Temple Run on Android's Market
http://www.zdnet.com/blog/security/researchers-spot-a-fake-version-of-temple-run-on-androids-market/10257

2013年02月27日 --- Android drive-by download attack via phishing SMS
http://www.zdnet.com/blog/security/android-drive-by-download-attack-via-phishing-sms/10422

2013年03月26日 --- First-Known Targeted Malware Attack On Android Phones Steals Contacts And Text Messages
http://www.forbes.com/sites/parmyolson/2013/03/26/first-known-targeted-malware-attack-on-android-phones-steals-contacts-and-text-messages/

2013年04月01日 --- Evidence Mounts That Chinese Government Hackers Spread Android Malware
http://www.forbes.com/sites/andygreenberg/2013/04/01/evidence-mounts-that-chinese-government-hackers-spread-android-malware/

2013年04月03日 --- Android malware: A new avenue for Chinese hackers
http://www.citeworld.com/security/21669/android-malware-chinese-hackers

2013年04月12日 --- Malicious version of Angry Birds Space spotted in the wild
http://www.zdnet.com/blog/security/malicious-version-of-angry-birds-space-spotted-in-the-wild/11520

2013年04月18日 --- Warning: Fake Instagram app on Android is malware
http://www.zdnet.com/blog/security/warning-fake-instagram-app-on-android-is-malware/11597

2013年04月26日 --- Warning: Fake Biophilla app on Android is malware
http://www.zdnet.com/blog/security/warning-fake-biophilla-app-on-android-is-malware/11715

2013年05月02日 --- A first: Hacked sites with Android drive-by download malware
http://www.zdnet.com/blog/security/a-first-hacked-sites-with-android-drive-by-download-malware/11810

2013年05月15日 --- Android malware families nearly quadruple from 2011 to 2012
http://www.zdnet.com/blog/security/android-malware-families-nearly-quadruple-from-2011-to-2012/12171

2013年05月21日 --- Malware charges users for free Android apps on Google Play
http://www.zdnet.com/blog/security/malware-charges-users-for-free-android-apps-on-google-play/12245

2013年07月09日 --- New Android malware infects 100,000 Chinese smartphones
http://www.zdnet.com/new-android-malware-infects-100000-chinese-smartphones-7000000497/

2013年08月13日 --- Google messaging service hacked, sends malware to Android users
http://rt.com/news/google-messaging-hacked-malware-451/

2013年08月26日 --- Android Malware: 44 Percent Of Android Users Vulnerable To Attacks According To U.S. Government
http://www.ibtimes.com/android-malware-44-percent-android-users-vulnerable-attacks-according-us-government-1399347

2013年08月27日 --- Nearly 7,000 Malicious Android Apps Infest China's Appstores
http://securitywatch.pcmag.com/mobile-security/315218-nearly-7-000-malicious-android-apps-infest-china-s-appstores

2013年09月12日 --- Email Spam Campaign Spreading Android Malware
http://threatpost.com/email-spam-campaign-spreading-android-malware

2013年10月25日 --- New Android Banking Trojan Targeting Korean Users
http://thehackernews.com/2013/10/new-android-banking-trojan-targeting.html

2013年11月07日 --- Another zombie 'bogus app' bug shambles out of Android
http://www.theregister.co.uk/2013/11/07/another_zombie_bogus_app_bug_shambles_out_of_android/

2013年11月17日 --- New Voicemail Notification - WhatsApp - Malware
http://techhelplist.com/index.php/spam-list/314-new-voicemail-notification-whatsapp-malware

2013年12月02日 --- Nexus phones carry SMS crash bug vulnerability
http://www.theregister.co.uk/2013/12/02/nexus_phones_carry_sms_crash_bug_vuln/

Posted by David at 5:11 PM No comments:

Labels: Android, Malware, Trojan, Virus, WORM

Posted by David at 3:00 AM No comments:

Labels: Android, Anonymous, Apple, BatchWiper, Christopher Chaney, DDoS, Dexter, email, Google, HVAC, Internet Explorer, Iran, ITU, iTunes, Malware, Security, Snooping, Trojan, Virus, Windows

Posted by David at 10:47 AM No comments:

Labels: Apple, Java, Macintosh, MacOSX, Malware, Oracle

Posted by David at 1:07 PM No comments:

Labels: Linux, Malware, Security, vulnerability, Zero-Day

Posted by David at 9:26 AM No comments:

Labels: Active-X, Adobe, Apple, Linux, Malware, Microsoft, Virus, vulnerability, Windows, Zero-Day

Posted by David at 2:12 PM 1 comment:

Labels: Apple, Java, MacOSX, Malware, Microsoft, Virus, vulnerability, Windows, Zero-Day

Posted by David at 12:40 PM No comments:

Labels: 2Wire, Chuck Norris Botnet, D-Link, DDoS, ELF_TSUNAMI.R, IRC, Kneber, Linux, Malware, Mirosoft, PSYB0T, Security, Virus