IE, Windows server bugs is likely to be exploited soon

Microsoft has released 13 updates that patch security holes in a wide range of its software offerings, including vulnerabilities rated critical in its Internet Explorer browser and Windows server operating systems.

The bugs in IE make it possible for attackers to remotely execute malicious code when an end user does nothing more than visit a booby-trapped website. Although there's no evidence the vulnerabilities are being exploited in the wild now, members of Microsoft's security team said there was a high likelihood reliable exploit code would be developed by real-world attackers in the next 30 days.

The vulnerabilities affect all supported versions of the Microsoft browser, including versions 8 and 9, which were rebuilt from scratch to minimize the damage that can be done when hackers identify vulnerabilities.

The second critical update covers all versions of Windows Server 2003 and Windows Server 2008, including the most recent R2 iteration, which is regarded as one of Microsoft's most secure server operations systems ever. By setting up a malicious DNS server and getting a vulnerable system to query it from inside the victim's network, an attacker can take complete control of the underlying machine.

According to Microsoft's exploitability index for August, attackers aren't likely to exploit the DNS flaw in the next month.

The remaining 11 patches carry the lower-level ratings of important and moderate and affected products including Windows, Office, .Net, and Visual Studio. Vulnerable components include the Remote Desktop Web Access Login, Microsoft Chart Web Control, and the Report Viewer Web control. The vulnerabilities enable attacks involving information theft and and denial of service outages.

Roundups of this month's Patch Tuesday offerings from Microsoft and SANS are here and here. Commentary from Kaspersky Lab and Qualys is here and here.

Clipboard Hacking: How it's done and how to Prevent It

This is one of the most popular things we do on the internet with our keyboard. "Ctrl+C". We copy data (i.e. email address, passwords, ssn, credit cards etc.) here and there and paste to wherever we want to reuse it. But do you realize that the data you copied are stored in what is called a clipboard temporarily and is accessible to anyone and can be stolen when you visit web sites using a combination of Javascripts and ASP (or PHP, or CGI) to write your data to a dabase on another server.

You might be wondering, how on earth is that possible. Its true and possible and we're going to explain how and how to prevent it from now happening. Just read on and i just hope you haven't copied a credit card number recently.

The Clipboard hack is done by the following Source Code:

Yes, with this simple script any website has the potential of stealing your sensitive information to their database.

Now the good news is this vulnerability can only be found on Internet Explorer and to avoid this clipboard hack problem IE users follow this simple steps.

Go to Internet Options -> Security
Press Custom Level
In the security settings, select disable under Allow paste operation via script.

Advise: I can't say you should stop using IE, though i don't use it but to save yourself from being a victim of this flaw don't use it. PERIOD.

Microsoft downplays IE 'cookiejacking' bug

Microsoft today downplayed the threat posed by an unpatched vulnerability in all versions of Internet Explorer (IE) that an Italian researchers has shown can be exploited to hijack people's online identities.

The bug, which has been only discussed and not disclosed in detail, was part of an attack technique described by Rosario Valotta, who dubbed the tactic "cookiejacking," a play on "clickjacking," an exploit method first revealed in 2008.

Valotta combined an unpatched bug, or "zero-day," in IE with a twist on the well-known clickjacking tactic to demonstrate how attackers can steal any cookie for any site from users duped into dragging and dropping an object on a malicious Web page.

He had demonstrated the attack at a pair of security conferences in Amsterdam and Zurich earlier this month, then published more information on his blog Monday.

By hijacking site cookies from IE7, IE8 and even IE9, attackers would be able to access victims' Web email, Facebook and Twitter accounts; or impersonate them on critical sites that encrypt traffic, like online banks and retail outlets.

Jeremiah Grossman, co-founder and CTO of WhiteHat Security, called Valotta's attack "clever" and said he could see hackers taking to it as a fallback to clickjacking, which he and Robert Hansen uncovered and publicized nearly two years ago. "In the event they can't find a cross-site scripting or clickjacking vulnerability, this would be a nice fallback plan for [attackers]," Grossman said.

But Microsoft didn't think cookiejacking was much to worry about.

"Given the level of required user interaction, this issue is not one we consider high risk in the way a remote code execution would possibly be to users," said Jerry Bryant, group manager with the Microsoft Security Response Center (MSRC). "In order to possibly be impacted, a user must visit a malicious Web site and be convinced to click and drag items around the page in order for the attacker to target a specific cookie from a Web site that the user was previously logged into."

Grossman strongly disagreed.

"I think they're wrong," he said. "Like many esoteric attack techniques, until they've seen it used in the wild, they'll downplay it. It's actually a very simple attack, but it's not technically difficult, so their take is 'Nothing new to see here.'"

Valotta's proof-of-concept attack was relatively simple: He built a Facebook game that baited users with a simple puzzle of an attractive woman, and with it was able to collect dozens of cookies from unsuspecting Facebook users.

"I published this game online on Facebook and in less than three days, more than 80 cookies were sent to my server," Valotta told the Reuters news service this week.

The puzzle required users to drag and drop pieces on the Web page; unbeknownst to the victims, when they did so they actually dragged cookies to a specific spot on the screen where a clickjacking attack captured the data before sending it Valotta.

Valotta said that all versions of IE, including the just-released IE9, on all supported editions of Windows, including XP, Vista and Windows 7, were vulnerable to cookiejacking attacks.

Bryant added that the IE vulnerability was not serious enough to trigger an emergency, or "out-of-band" security update. "We are also not aware of it being used in any active way outside of the demo at [the Amsterdam] Hack in the Box [conference], he said.