Poof of Concept Firmware Keyboard Hack Demostrated at Black Hat

K. Chen gave a talk which demonstrated a proof of concept attack using HIDFirmwareUpdaterTool to insert code into the firmware of Apple keyboards allowing an attacker to record keystrokes. The attack does require physical access to the machine. It is important to remember that all input devices that have firmware can be attacked and it is possible to record information from the device. This is true of wired and wireless devices, a trip to the local Radio Shack and some basic skills a keystroke recorder/interceptor can be constructed. 

The best defense is to restrict physical access to your devices, organizations should control physical access to their offices always. 

Flash Vulnerability Can be Contained in Web Page, Air Application or PDF File

Adobe Flash Player has a vulnerability which an attacker is able to use a specially crafted Flash (.SWF) content and gain access to a users system. The exploit allows an attacker to execute code and gain that users access privileges. Several sites have been compromised and it is possible to be delivered by a drive by download attack. This affects specifically Flash, it is important to remember that viewing this type of content in a Web Browser or other applications such as Acrobat it is possible that the system can be compromised and Trojan type software can be installed. It is recommended by Adobe to delete the following two files from the Acrobat Reader application from the terminal.

• "/Applications/Adobe Reader 9/Adobe Reader.app/Contents/Frameworks/AuthPlayLib.bundle"
• "/Applications/Adobe Reader 9/Adobe Reader.app/Contents/Frameworks/Adobe3D.framework"

Make sure that you use the quotes to allow for spaces and special characters. Users should also set their Flash Preferences to limit content and control privacy settings. If you are using Firefox for Web Browsing make sure to use the No-Script plug-in.

Another alternative for PDF file viewing is to make sure that Preview.app is the default application for PDF files.

Update on Friday, July 24, 2009 at 06:13PM by drStrangeP0rk

Adobe should have a patch around July 30 for Flash. It appears that Windows is the primary target, it can causethe application at the very least to crash. What is also important to remember is that altering the application bundle and removing the files listed above also will cause Acrobat Reader to crash if Flash content is within the file. If you are using Acrobat Professional you should delete the files and make sure that Multimedia Trust is set to prompt for all media. This includes Flash, thus users have to approve the media before it runs. This does not stop this Trojan since it loads within the embedded page. This is just a good practice.

Update on Friday, July 24, 2009 at 09:05PM by drStrangeP0rk

Interesting article on the Adobe update process.

http://www.computerworld.com/s/article/9135740/Adobe_admits_users_vulnerable_after_downloading_Reader

Update on Saturday, July 25, 2009 at 07:34AM by drStrangeP0rk

The vulnerability does not currently affect PDF that are opened in Preview.app that have the embedded Flash (.SWF) content. Although blocking the PDF file type at your proxy is a good idea for mixed networks, if you need to read PDF's using Preview.app is a safe bet. 

Update on Saturday, July 25, 2009 at 09:39AM by drStrangeP0rk

Link to uninstalling the Adobe Flash Player.

http://kb2.adobe.com/cps/141/tn_14157.html

Update on Friday, July 31, 2009 at 07:33PM by drStrangeP0rk

Updates are available for Flash, Air and Acrobat. Many of these updates address the issues related to Flash Player in various Adobe products. The vulnerability was in Flash, thus any application that ran Flash content could be affected.

http://www.adobe.com/support/security/bulletins/apsb09-10.html

Update on Monday, August 17, 2009 at 07:43PM by drStrangeP0rk

Click to Flash for Safari is an excellent WebKit plugin that allows the user to select Flash content to view. You can also setup white list and black list.

http://rentzsch.github.com/clicktoflash/

Firefox 3.5.1 Update Addresses Tracing Clean Up

The reported crash is triggered by the an escape function at the site http://www.aport.ru/. The combination of tracing optimization and the failure in the processes of "deep bail" clean up is fixed in update3.5.1. After the update users should reset the value of javascript.options.jit.content to true. 

Critical JavaScript Vulnerability in Firefox 3.5

There is a critical vulnerability in the JIT compiler in Firefox 3.5. It is possiable that an attacker by directing a user to a maliciously crafted site will be able to execute code or trigger a uncontrolled system crash. Users should be using NoScript for all web surfing in Firefox. In addition users can disable JavaScript, Run in SafeMode or disable JIT in the JavaScript engine.

1. In the location bar enter about:config
2. Filter to jit
3. Set the value of javascript.options.jit.content to false.

Disabling javascript.options.jit.content will slowdown performance and is temporary. Once the fix is released and installed users should set this value back to true. 

Update on Sunday, July 19, 2009 at 09:21PM by drStrangeP0rk

Mozilla Security Blog reports that exploit the crash is not exploitable in version 3.5.1. The crash is reported to occur in the ATSUI(Apple Type Services for Unicode Imaging) system library which is the result of a failure to check allocation results.

http://blog.mozilla.com/security/2009/07/19/milw0rm-9158-stack-overflow-crash-not-exploitable-cve-2009-2479/

Safari 4.0.2 Update Addresses WebKit Issues

WebKit when handling parent objects has a vulnerability which can allow for a maliciously crafted site to conduct a XSS attack. The improvement is in the way the WebKit handles parent objects. Simple Class Dump from Safari 4.0.1In addition numeric character references crafted in a malicious way can corrupt memory leading to unexpected application termination and/or arbitrary code execution.