Friday, 26 April 2013

Yahoo! Blind SQL Injection could lead to data leakage

It seems that 2013 is the "Data Leakage Year"!many customers 
information and confidential data has been published on the 
internet coming from government institutions, famous vendors, and
 companies too.

Ebrahim Hegazy(@Zigoo0) an Egyptian information security advisor
 who found a high severity vulnerability in "Avira license daemon" 
days ago, is on the news again, but this time for finding and reporting
 Blind SQL Injection vulnerability in one of Yahoo! E-marketing applications.
SQL Injection vulnerabilities is ranked as Critical vulnerabilities, because
 if used by Hackers it will cause a database breach which will lead to 
confidential information leakage.

A time based blind SQL Injection web vulnerability is detected in
 the official Yahoo! TW YSM Marketing Application Service.The vulnerability 
allows remote attackers to inject own sql commands to breach the database
 of that vulnerable application and get access to the users data.

The SQL Injection vulnerability is located in the index.php file 
of the so easy module when processing to request manipulated said
 parameters. By manipulation of the said parameter the attackers can inject own
 sql commands to compromise the webserver application dbms.

The vulnerability can be exploited by remote attackers without
 privileged application user account and without required user interaction.
 Successful exploitation of the sql injection vulnerability results in 
application and application service dbms compromise.

But Ebrahim is a white hat hacker, so he reported the vulnerability to 
the Yahoo! security team with recommendations on how to patch the vulnerability. 
Yahoo! TW YSM MKT - Blind SQL Injection Vulnerability

Common Vulnerability Scoring System:


Yahoo! Inc. is an American multinational internet corporation 
headquartered in Sunnyvale, California. It is widely 
known for its web portal, search engine Yahoo! Search, and
 related services, including Yahoo! Directory, Yahoo! Mail, 
Yahoo! News, Yahoo! Finance, Yahoo! Groups, Yahoo! Answers, advertising,
 online mapping, video sharing, fantasy sports 
and its social media website. It is one of the most popular sites in the
 United States.
 According to news sources, 
roughly 700 million people visit Yahoo! websites every month. Yahoo! 
itself claims it attracts `more than half a 
billion consumers every month in more than 30 languages.

(Copy of the Vendor Homepage: )

2013-02-24: Researcher Notification & Coordination
2013-02-25: Vendor Notification
2013-03-01: Vendor Response/Feedback
2013-04-01: Vendor Fix/Patch by check
2013-04-03: Public Disclosure




A time based blind SQL Injection web vulnerability is 
detected in the official Yahoo!
 TW YSM Marketing Application Service.
The vulnerability allows remote attackers to inject 
own sql commands to compromise the affected application dbms. 

The SQL Injection vulnerability is located in the index.php file
 of the so easy module when processing to request manipulated 
scId parameters. By manipulation of the said
 parameter the attackers can inject own sql commands
 to compromise the webserver 
application dbms.

The vulnerability can be exploited by remote attackers 
without privileged application user account and without required 
user interaction. Successful exploitation of the sql 
injection vulnerability results in application and application 
service dbms compromise.

Vulnerable Service(s):
    [+] Yahoo! Inc - TW YSM Marketing

Vulnerable Module(s):
    [+] soeasy

Vulnerable Module(s):
    [+] index.php

Vulnerable Parameter(s):
    [+] scId

Proof of Concept:
The time-based sql injection web vulnerability 
can be exploited by remote attackers without privileged 
application user account and without 
required user interaction. For demonstration or reproduce ...

Vulnerable Service Domain:
Vulnerable Module:   soeasy
Vulnerable File:   index.php
Vulnerable Parameters:   ?p=2&scId=

 select SLEEP(5)--

1; union select SLEEP(5)--


GET /soeasy/index.php?p=2&scId=113;%20select%20SLEEP(5)-- HTTP/1.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:19.0)
 Gecko/20100101 Firefox/19.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: is_c=1; device=pc; showNews=Y;
 B=9tgpb118xilu04&b=3&s=mu; AO=o=1&s=1&dnt=1;
1.10.1361672202; __utmc=2636114698;
DNT: 1
Connection: keep-alive

HTTP/1.0 200 OK
Date: Sun, 24 Feb 2013 02:16:48 GMT
P3P: policyref="",
Cache-Control: no-store, no-cache, must-revalidate
, post-check=0, pre-check=0, private
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Content-Encoding: gzip

Since it'a time based blind so the page will
 not give an output as a result in the reply,
 but it will SLEEP/DELAY for 5 seconds before it load.

The vulnerability can be patched by a restriction 
and secure parse of the said parameter request.

The security risk of the time based
 blind sql injection web vulnerability is estimated as critical.

Ebrahim Hegazy(@Zigoo0) 

Thanks for Vulnerability-laboratory Team

How phishing attack can destroy US stock market

Somebody’s prank turned into a nightmare for the world, as the word spread about the  a series of explosions taking place at the White House and rendering the U.S. President Barack Obama, injured. The news released by the international news agency Associated Press, that caused a virtual plunge in the stock market within three minutes, apart from panicking the world, was later found to be false and sent from the hacked twitter account of the agency.
Considered to be the high-profile hacking in the recent times, the hackers took control of the Associated Press Twitter account and tweeted “Breaking: Two Explosions in the White House and Barack Obama is injured.”
Apart from @AP being hacked, the hackers also targeted @AP_Mobile, another account operated by the news agency and tweeted from the account: “Syrian Electronic Army was here. A group calling itself the Syrian Electronic Army, which is supportive of that country’s leader, President Bashar al-Assad, in its two-year civil war, claimed responsibility on its own Twitter feed for the AP hack. The group has in the past taken credit for similar invasions into Twitter accounts of National Public Radio, BBC, CBS’ “60 Minutes” program and Reuters News.
Following the incident that once again exposed the vulnerability of the social networking sites, as the news spread like wild fire, AP spokesman Paul Colford quickly confirmed the tweet was “bogus,” and White House spokesman Jay Carney told reporters that Obama was fine.
Immediately after the incident Twitter suspended the account of the news agency @AP and @AP_Mobile, even as it put out word through other accounts, including that of its correspondents, that it was the victim of an egregious hacking episode.
Though it was not clear how hackers got the control of AP’s Twitter account, but there is possibility of the hackers managing it by mistaking a AP employee. Confirming this Mike Baker, an AP reporter, in his tweet said that the employees of the company had received a phishing email. He tweeted: “The @AP hack came less than an hour after some of us received an impressively disguised phishing email.
Phishing emails are disguised as genuine notification from a reputed company like Twitter and seek account information. Cyber criminals often use phishing emails to fool web users.
Even as the false piece of the news of the explosions was immediately denied by other journalists present inside the White House at the time of incident, the damage has already been done.
E McMorris-Santoro, Buzzfeed’s White House reporter, tweeted: “from here in the WH basement, this acct (AP) seems hacked.”
Michael Skolnik, editor of GlobalGrind, said that the AP tweet was an obvious fake as it was made from a web browser while the news agency always uses a tool called SocialFlow to push news through its Twitter account.
The biggest setback of the false news piece was borne by the stock markets that plunged just as the report came out, resulting in the Dow Jones Industrial Average losing 130 points, or 0.9 percent, and the S&P 500 dropping 12 points, or 0.8 percent.
Meanwhile the FBI has already started a probe into the incident along with the US Securities and Exchange Commission. SEC Commissioner Daniel Gallagher said:”I can’t tell you exactly what the facts are at this point or what we are looking for, but for sure we want to understand major swings like that, however short it was.
Commenting upon the Twitter Security issues, Stewart Baker, a cyber security lawyer at Steptoe & Johnson in Washington, said: “At a time when cyber security and hacking have become top national security concerns, Twitter and its reach to hundreds of millions of users is coming under growing scrutiny for the risk of privacy breaches on the site. there was plenty of blame to spread around regarding Tuesday’s incident. AP should have had better passwords, Twitter should have gone to at least optional two-factor authentication months ago, and guys on the Street really should be thinking twice before they trade on Twitter reports. That’s risky.
This is not the first time false claims have been made from a hacked Twitter account. In February, Twitter account of Burger King was hacked. It then tweeted that the company has been acquired by McDonald’s.

Source: Northern Voices Online (NVOnews)

Samsung to Block Access to App Store in Iran

Iranian users of Samsung mobile applications said Thursday that the company had notified them that they will no longer have access to the company's online store as of May 22.
The move is seen as part of international sanctions on the country over its disputed nuclear program. The West has imposed banking and insurance sanctions on Iran since it suspects Iran is pursuing nuclear weapons, a charge Tehran denies.
At a Tehran shopping mall, owners of mobile phones and tablets said Thursday that they had received the message via email from the company late the night before. Retailers said they had no power over the decision.
"We have heard about it, but we are only responsible for hardware here, not software and apps," shopkeeper Bijan Ashtiani said.
Mideast Iran Samsung.JPEG
In the message, Samsung said that it cannot provide access to the store, known as Samsung Apps, in Iran because of "legal barriers." It apologized to customers in emailed statement seen by the Associated Press on Thursday.
Samsung's offices in Tehran could not be immediately reached for comment due to the weekend there, and its headquarters in South Korea did not immediately respond to a request.
The decision quickly provoked ire on social media.
"Samsung is to stop its apps in Iran, oh how we appreciate our officials," wrote Bahareh, a Twitter user blaming Tehran's policy. Another, named Armin, pointed at the technology giant itself, saying: "Now, Samsung's sanctions honor us as well!"
Samsung spokesman Chris Jung in Seoul said the company is still looking into the matter and could not confirm any details.
Unlike Apple, Microsoft and Adobe, Samsung has provided localized services to Iranians in their native Persian language. In 2012, Finnish communications giant Nokia stopped its services in the country.

US banking Sector too Vulnerable to Hackers

US authorities charged with overseeing the financial sector are worried about its vulnerability to cyberattacks, they said in a report published Thursday.

"Security threats in cyberspace are not bound by national borders and can range widely from low to high security risks," wrote the Financial Stability Oversight Council in its 2013 annual report.

The council is worried, in particular, about the increasing skill of hackers attacking the US financial system.

Making reference to a series of cyber attacks that targeted several of the biggest US banks toward the end of 2012, the FSOC noted "the knowledge and skill of the attackers appeared to increase over time."

In an attempt to protect the financial system against these attacks, the FSOC proposed "enhancing cross-sector cooperation, particularly with industries upon which the financial sector is dependent, such as energy, power, and telecommunications."

"Public-private partnership improvements in the analysis and dissemination of robust information to improve real-time responses to cyberattacks will enhance incident management, mitigation, and recovery efforts," the report added.