Windows, security, etc.

As all of you probably know, all software has bugs and have to be updated regulary. But, what if you could exploit a software using allowed functions just the way they are supposed to work? This is something that happened to PDF readers (Adobe, Foxit) few days ago.

Didier Stevens proved this concept. Read more on his blog:

Today, Core Security Technologies issued Security Advisory regarding  Virtual PC Hypervisor Memory Protection Vulnerability.
Vulnerable systems are:

• Microsoft Virtual PC 2007,
• Microsoft Virtual PC 2007 SP1,
• Windows Virtual PC,
• Windows Server 2005 and
• Windows Server 2005 R2 SP1

Microsoft Hyper-V is NOT vulnerable.

Vulnerability is explained in this document. If you don’t want to read the whole article (I advise you to read it) here are some important parts of it:

• It’s only locally exploitable (remotely only if some other vulnerability exists that is remotely exploitable)
• There is no CVE at the moment
• It was discovered 7 months ago. Core Security worked with Microsoft to identify impact this may have before announcing it.
• It’s using memory above 2GB (memory reserved for system)
• It’s possible to bypass DEP (Data Execution Prevention), SafeSEH (Safe structured error handling) and ASLR (Address Space Layout Randomization)
• There is a PoC (proofe of concept) code available
• The vulnerable part of Virtual PC hypervisor is VMM (Virtual Machine Manager)

If you susspect some file to be infected there is few thing you could do:

1. Scan it with the antivirus software you use
2. Scan it with the AV software you don’t use 
3. Scan it with all AV engines available/known/usable …
4. Analyze it yourself

Almost every AV vendor has it’s own free online scanner. Microsoft also has it’s own. Use those services if  you want to check  the difference in AV engines and scan your entire PC. If you want to scan only one or few files, you could use  Virus Total. This service will scan uploaded file with almost all AV scan engines.
If you want to analyze the file yourself, you will probably want to read some tutorials before that. Good one to start is this.

After a few months of initial public demonstration of SSL renegotiation vulnerability, there was no widely used exploit/attack.  Unfortunately, there is (was) only a matter of time when something like this will happen. Reading Microsoft security advisory 977377, one can speculate that this will happen soon. Since this is not only Microsoft “problem” (SSL and TLS are used in other OS-es), other companies are working to find a solution to. 
Microsoft has offered a workaround (disabling SSL/TLS  renegotiation) for IIS servers.If you are interested, please read KB  article 977377 . Be aware that after you apply this workaround some application will not work as expected (more on this in KB article).