Windows, security, etc.

If somebody asked me few months ago about Internet censorship in Croatia, I would probably said: No way – it will never happen in Croatia. Yesterday I was proved wrong!

What happened?

Somebody, has stolen database containing a list of all Croatian soldiers during the war 15 years ago, and exposed it on the Internet. Half hour after that the site was inaccessible. Actually the site is and was accessible all the time, but not from Croatia. One can use proxy servers outside Croatia and it will be able to access the site (the server is located in US/New York region).

So, what kind of censorship happened here?

Probably somebody from government issued an order to ISP’s in Croatia to block access to this site. Who? By what authority???? I wonder why the ISP’s in Croatia blocked the access to this site, when the site is clearly up and running and accessible to all the People on this world (except Croatian and maybe Chinese)? What’s the point???

What hurts me, and this is the reason why I’m writing this post, is the agility of Croatian Government to address this kind of “issue”, but when something more important is at stake, they are so slooooow and inefficient.

Why is this database so important? It’s something that has to be known and it will be (probably in few months from now), but the government is fighting against it. Why?

So let’s return to the title of this post “Internet censorship: Croatia = China”. What comes next? What will be censored next? This is what frights me, because if it starts it will probably be unstoppable (and it started Yesterday).

As all of you probably know, all software has bugs and have to be updated regulary. But, what if you could exploit a software using allowed functions just the way they are supposed to work? This is something that happened to PDF readers (Adobe, Foxit) few days ago.

Didier Stevens proved this concept. Read more on his blog:

Today, Core Security Technologies issued Security Advisory regarding  Virtual PC Hypervisor Memory Protection Vulnerability.
Vulnerable systems are:

• Microsoft Virtual PC 2007,
• Microsoft Virtual PC 2007 SP1,
• Windows Virtual PC,
• Windows Server 2005 and
• Windows Server 2005 R2 SP1

Microsoft Hyper-V is NOT vulnerable.

Vulnerability is explained in this document. If you don’t want to read the whole article (I advise you to read it) here are some important parts of it:

• It’s only locally exploitable (remotely only if some other vulnerability exists that is remotely exploitable)
• There is no CVE at the moment
• It was discovered 7 months ago. Core Security worked with Microsoft to identify impact this may have before announcing it.
• It’s using memory above 2GB (memory reserved for system)
• It’s possible to bypass DEP (Data Execution Prevention), SafeSEH (Safe structured error handling) and ASLR (Address Space Layout Randomization)
• There is a PoC (proofe of concept) code available
• The vulnerable part of Virtual PC hypervisor is VMM (Virtual Machine Manager)

If you susspect some file to be infected there is few thing you could do:

1. Scan it with the antivirus software you use
2. Scan it with the AV software you don’t use 
3. Scan it with all AV engines available/known/usable …
4. Analyze it yourself

Almost every AV vendor has it’s own free online scanner. Microsoft also has it’s own. Use those services if  you want to check  the difference in AV engines and scan your entire PC. If you want to scan only one or few files, you could use  Virus Total. This service will scan uploaded file with almost all AV scan engines.
If you want to analyze the file yourself, you will probably want to read some tutorials before that. Good one to start is this.

After a few months of initial public demonstration of SSL renegotiation vulnerability, there was no widely used exploit/attack.  Unfortunately, there is (was) only a matter of time when something like this will happen. Reading Microsoft security advisory 977377, one can speculate that this will happen soon. Since this is not only Microsoft “problem” (SSL and TLS are used in other OS-es), other companies are working to find a solution to. 
Microsoft has offered a workaround (disabling SSL/TLS  renegotiation) for IIS servers.If you are interested, please read KB  article 977377 . Be aware that after you apply this workaround some application will not work as expected (more on this in KB article).