Yahoo has addressed a cross-site scripting (XSS) flaw that, prior to May 2, existed in the commenting platforms utilized by most of its services, including travel, food, tech, security, news, TV, music, shopping and weather.

The vulnerability – which could enable information theft by simply posting a piece of code into the comments sections of the aforementioned Yahoo websites – was discovered by Behrouz Sadeghipour, an independent researcher known for hunting down bugs in popular services.

“An attacker could inject a malicious script, which could be used to obtain session tokens, cookies and other sensitive information stored in the users' browser that is associated with Yahoo,” Satnam Narang, a Symantec researcher familiar with XSS flaws.

In a Friday post containing proof-of-concept videos, Sadeghipour is shown posting a piece of code, designed to prompt a popup dialog box, into the comments section of a Yahoo website. The popup box is presented in the browser when the code is viewable, and is shown to do so on international Yahoo sites, as well.

“In the proof of concept, it shows the researcher leaving a comment on the page, which stores it in a database, thereby making it persistent, or stored,” Narang said, explaining that this interesting because most XSS attacks are non-persistent.

Sadeghipour published his research after Yahoo issued a fix and granted him permission to discuss it publicly. In his post, Sadeghipour explained that Yahoo disabled the comments sections on April 30, a day after he initially reported the XSS flaw, and the internet corporation fixed the issue by May 2.

“Prior to being patched, [this would affect] any user who visited pages on Yahoo.com that use a specific commenting platform on articles that had been targeted by an attacker,” Narang said. “A really popular article on Yahoo that garnered a lot of views or comments would be a potential target for an attacker.”



source

Industrial controller vendor Schneider Electric has found that while its own kit wasn't affected by the Heartbleed OpenSSL bug, there are some third party components that need work.

In an advisory published here (PDF), the company says a third-party software component, Tableau from Wonderware, could re-introduce a Heartbleed vulnerability into its systems.

It affects “Tableau Server, versions 8.0.6 through 8.0.9 or 8.1.0 through 8.1.5. This software is provided as a component of our Wonderware Intelligence and Avantis.DSS products”, the advisory states. “Any installations that did not apply the available Tableau Server updates from Wonderware Development Network (WDN) would not be impacted by HeartBleed vulnerability”

Tableau is an analytical data visualisation suite. The vulnerable server component has now been upgraded by Tableau Software, but users that applied a recent update from Schneider may have reverted to an older version of the server.

The company continues to review its own products, and says that “no evidence of the vulnerable versions of OpenSSL were identified”.

Schneider's advisory also says the version of McAfee ePO (the policy orchestrator) that ships with its Invensys control systems is vulnerable. McAfee released patches for its vulnerable products in April.



source

Ever wondered what happens to your data when it ends up in one of these?

The next speaker in today's MAPPING Assembly was responsibility for fire-fighting, when security emergencies occur and need a swift, effective response. Coming from a small country that did not actually do anything bad on the internet but presumably outsourced its data crises and security leaks to larger, more technically ambitious countries, the speaker listed some of the things that can upset the serenity of the internet, such as sinkholing, keylogging and malware infections [at this point this blogger wonders whether someone out there has been attacking Google.it, which appears to be on a go-slow this morning and has shown a marked reluctance to find things ...]. 

The speaker then reviewed the effect on his jurisdiction of the recent Heartbleed virus. Experience of this attack demonstrated that ISPs have an important role to play in assisting their users to preserve security. Indeed, any halfway competent ISP will know who is using its service, who is sending out bulk emails and spreading spam etc.  Any software put out for consumer use should already be configured for security purposes, he added: it should not be necessary for consumers to have to do the job themselves -- though there is a discussion as to whether security settings should be a default setting or merely an option.  If unsafe software were, for example, infected meat, national governments would be swift to prevent its importation, so why should software be treated differently? The comparison is not as strange as it seems: much medical equipment, for example MRI scanners, is software-driven. If it is insecure or cannot be operated properly, it can be dangerous.  At any rate, it's axiomatic that all software that is supplied to Europe for use in Europe must be subject to European legal standards, notwithstanding that it may be compliant with its own home-grown legal standards.

Not all intruders are so conspicuous ...

Defence of networks was next discussed. This is crucial since networks are being attacked on a daily basis. Attacks must first be detected before they can be defended. The existence of a new member of the network must be identified, as well as the "mother" address as a rendezvous protocol with which the attacker or intruder communicates. Attackers try to copy the normal communication patterns of legitimate users, and the same websites, in order to make themselves look less conspicuous. Attackers will also be active when other network users are, rather than all by themselves in the middle of the night. Some will even communicate via means such as Twitter. Encryption is helpful in the face of intrusive attacks, but more is needed: any diligent company should keep looking for signs that someone else has penetrated its network -- and this is best done by looking at messages sent out from it, particularly if they match the behaviour of known malware. Netflow, which tells you which routers are talking to which other routers, is also a useful source of information here.

Finding evidence of new attacks is difficult, the speaker concluded, because you may be looking for something that hasn't yet happened and it can be tricky to discern relevant threat-related data from the noise that a network might in any event be generating.

In discussion, participants mentioned the exponential growth of reported computer fraud, which has taken place at a time when calls for greater information-sharing are still being made. The main issue here is not just computer security but perception management -- politician awareness is low and there are no votes in cyber-crime, of which consumers are insufficiently aware.  Meanwhile, the potential profitability of data exfiltration and the low risk of detection make it an attractive proposition. Against this, insurance against cyber attacks is being increasingly tied to satisfying acceptable security standards, and business are running ahead of governments in protecting their data since their money depends upon it.  Raising awareness among SMEs and start-ups is the wrong place to start: what they want is to be able to buy safe off-the-peg software that they can trust, rather than having to invest in developing their own protection.

A further speaker, representing the police, urged the audience to trust the police -- which, in his jurisdiction, was guided in all operative matters by the provisions of the European Convention on Human Rights and data protection legislation. Some police action involves surveillance, but this requires (i) authorisation and (ii) justification before the court when evidence obtained by means of it is placed before a court.  Enforcement is difficult, he said, since courts struggle to understand the technical issues involved: the courts are struggling to deal with even matters such as online pornography.  In addition, most internet-related crime spans jurisdictions and is therefore expensive and impractical to chase.

Another speaker, who had worked for an international military alliance, spoke of cyber-security in various contexts, conceding that a big weakness of even the best policies and security systems was the fact that people are people and, even in a top security environment, will display human characteristics such as curiosity (eg plugging in a USB stick, contrary to security instructions, since they wonder what's on it).

At this point, this blogger absented himself so that he could revise his presentation, for delivery immediately after lunch.