IT News & Technology update

Find Windows vulnerabilities with a hex editor

Written by IT News on 11:03 AM

Kevin Beaver, CISSP, 09.18.2007

The hex editor is a long-time favorite investigative tool for forensics professionals. But the capabilities of the tool go

Security testing tips Hacking Vista and planning for security breaches Pen testing your VPN

beyond piecing together bits and bytes to prove a case. Used in the right context, a hex editor can actually uncover Microsoft Windows and application vulnerabilities that you may not have thought about, yet can't afford to overlook. In fact, the hex editor is one of the most underrated and overlooked security testing tools.

Here are just a few of the things you can do with a hex editor to root out security weaknesses in your Windows environment:

• Check for passwords that may still be saved in Windows, Internet Explorer (IE) and other applications. Passwords left in memory can pose a risk and this technique demonstrates just how vulnerable logins and other private information can be -- especially on public computers that can be accessed by several people.

Figure 1: Using WinHex to search Firefox's memory range for sensitive information.

If this isn't enough proof that a vulnerability exists, you can also search the computer's entire memory range for Windows application passwords or other sensitive information. Many times, I've been able to find sensitive information stored in memory by Web browsers even after the programs were closed. Searching all physical memory for this type of sensitive information is simple, fast and very revealing.

• Search local system files, such as pagefile.sys and hiberfil.sys or the entire physical disk, for sensitive information. It's worked for me every time. This can really come in handy for spot checking computer hard drives that have supposedly been wiped before being disposed of or given away. Figure 2 shows the WinHex interface for searching local files.

Figure 2: Using WinHex to search logical drive C: for sensitive information.

• Search for malware in memory or hidden data on disk that you wouldn't be able to see otherwise.
• Search for "dirty" documents, such as Microsoft Word files that reveal sensitive information that should never leave the network. Those include file authors, draft verbiage, comments or third-party information that had supposedly been removed or were assumed to be non-existent since they're not visible in the native application. This comes in handy when searching for the files of those who forgot to enable the "Remove personal information from file properties on save" option.

Even with hex editors, it pays to have good tools. There are plenty of hex editors to go around. Check out the commercial alternative to WinHex called Hex Workshop or even the freebie XVI32. Don't even bother with the DOS/Windows debug tool that we used to have to rely on. Most of the hex editor features and capabilities you'll need are not there.

If you jump in head first with a hex editor, you'll be amazed at how powerful it is and what you can uncover. With this power comes some risk: A hex editor can and will modify anything on in memory or stored on disk, so be careful. The results can be beneficial or devastating. Either way, the power is in your hands.

Microsoft security update causes IE meltdown

Written by IT News on 10:09 AM

By SearchSecurity.com Staff | 18 Dec 2007 | SearchSecurity.com

The latest Microsoft MS07-069 update is causing Internet Explorer (IE) to freeze, according to some frustrated users.

Microsoft customers typically run into trouble after installing the software giant's monthly security updates, and this month is proving to be no exception.

Microsoft customer Bill Drake wrote on the Windows Vista Community site that after installing the update, he was getting an "'Internet Explorer has encountered a problem and must close" dialog box about 60% of the time.

"I suspect the KB942615 update should be coded to force a reboot and does not," he said. "Consequently, some part of the update that requires a reboot before the update is fully applied does not get done."

As a result, he wrote, installing the update without the reboot causes IE 6 to run in a "half-updated/half-not-updated" mode, which causes the connectivity problem.

MS07-069, a cumulative update for IE, was among the seven patch bulletins Microsoft released last week for its December 2007 security update. Other fixes addressed critical flaws attackers could exploit in DirectX and various versions of Windows to launch malicious code or gain extra system privileges on targeted machines.

It's not uncommon for glitches to appear after a Microsoft security update is installed. In the week following Microsoft's October 2007 update, for example, several users reported system difficulties after installing the fixes released in security bulletins MS07-057 and MS07-058.

Pay attention at Microsoft Security Advisory (945713)

Written by IT News on 11:11 PM

Microsoft is warning customers about a zero-day flaw in the process of how Windows looks up other computers on the Internet. This announcement can be read at Microsoft Technet with entitled "Microsoft Security Advisory (945713)" Vulnerability in Web Proxy Auto-Discovery (WPAD) Could Allow Information Disclosure, Published: December 3, 2007

The vulnerability is a variation of one patched in 1999, and attackers could exploit it to access sensitive data and redirect users to Web sites rigged with malware. It is not considered as big a threat as more recent zero-day flaws, however.

Tim Rains of the Microsoft Security Response Center communications team said in an email late Monday that the software giant is investigating new public reports of a vulnerability in how Windows resolves hostnames that do not include a fully-qualified domain name (FQDN). He said the specific technology affected is Windows' Web Proxy Auto-Discovery (WPAD) program.

The problem affects Microsoft Windows 2000 Advanced Server, Windows 2000 Datacenter Server; Windows 2000 Professional; Windows 2000 Server; Windows Server 2003 Datacenter Edition; Windows Server 2003 Enterprise Edition; Windows Server 2003 Standard Edition; Windows Server 2003 Web Edition; Windows Vista; Windows XP Home Edition; Windows XP Professional; Internet Explorer 6 and Internet Explorer 7.

This is mainly a problem for corporate users outside the U.S, though Microsoft warned that attackers could exploit it to silently redirect users to malware-laden Web sites. Though the flaw was patched years ago, researcher Beau Butler recently discovered it in more recent versions of Windows.

Suggested action and workarounds:
Create a WPAD.DAT Proxy Auto Configuration File on a Host Named WPAD in Your Organization to Direct Web Browsers to Your Organization’s Proxy
1.Create a WPAD.DAT file that adheres to the Proxy auto-config specification. For more information on Proxy Auto-Configuration (PAC) files including a sample file, see the following MSDN article.
2.Place the WPAD.DAT file in the root directory of a web server in your organization and ensure the file can be requested anonymously.
3.Create a MIME type for the WPAD.DAT file on the web server of "application/x-ns-proxy-autoconfig".
4.Create the appropriate entries in your organizations DHCP or DNS server to allow discovery of the WPAD server.

Disable Automatically Detect Settings in Internet Explorer
To disable the Automatically Detect setting in Internet Explorer, follow these steps:
1.Start Internet Explorer.
2.On the Tools menu, select Internet Options.
3.On the Connections tab, click LAN Settings.
4.Clear Automatically Detect Settings on the Local Area Network (LAN) Settings page.
Impact of Workaround: Internet Explorer will no longer automatically detect proxy settings.

Disable DNS Devolution
To disable automatic DNS devolution, save the following to a file with a .REG extension and then run regedit.exe /s from an elevated or administrative command prompt:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient]
"UseDomainNameDevolution"=dword:00000000

For the changes to take effect, the DNS Client service must be stopped and re-started. This can be accomplished from an elevated or administrative command prompt using the following command:
net stop dnscache & net start dnscache:

Configure a Domain Suffix Search List
To create a domain suffix search list, save the following to a file with a .REG extension and then run regedit.exe /s from an elevated or administrative command prompt:
Windows Registry Editor Version 5.00
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"Search"=

Impact of Workaround: When a domain suffix search list is configured on client systems, only that suffix list is used in DNS queries. The primary DNS suffix and any connection-specific DNS suffixes are not used. The DNS resolver will not perform devolution, potentially breaking any applications or configurations that rely on this behavior.