Printable View
Hi Guys,
Got about a 4th mate whos gmail aco**** was compromised. Now they are not network gurus but I did train them to have complex password , more than 10 characters, mixed characters, number etc.
But they just let me know that two of there accounts was hacked.
What is the deal here?
They do not open a mail they are not 100 % sure of the legitamacy. AV running permanently on their PC. Without a keylogger in the background how is this being done.
Do you guys use Gmail or another service?
There was a unpatched 0-day floating around recently. :)
Other then that tell them to change there passwords secret question etc and to check it they have forwarding or pop3 enabled in settings etc.
also how often do they log into the actual gmail account from https://gmail.google.com ?
if it's like hotmail/live etc if you don't log into the actual e-mail account they shut the account down and others can re-register the account and get the past owners e-mails.
Tip....never believe users....they lie. They open stuff and click on links all the time.
Alot of the new malware is using social engineering and unpatched applications\oses ...just watched a great video on you tube about the varied attack vectors...specifically the Zeus variants
http://www.youtube.com/watch?v=CzdBCDPETxk
MLF
agree with this comment.beware with shortlink at your inboxQuote:
Originally Posted by morganlefay
Downloading now, thanks MLF.
edit: the 0 day attack you are talking about is Adobe reader, right?
Yes...adobe is definitely one of them
MLF
add a little ajax handling into that also. ;)Quote:
Originally Posted by morganlefay
also nice Video morgan :thumbsup:
This 0 day you speak of Hybrid, tell me more. Are you referring to encoding an email with these scripts and gmail renders and runs the script within the email or is it an actual attack on the google servers since they are using AJAX improperly? DETAILS! GIVE THEM TO ME!!!..... please?
a little bit from column "A" ;)
there are loads of "fun" 1 can have with badly handled ajax parsing for instance VB3.8.4 has a nifty ajax issue.
Some of these guys save their user / password in a plugin to IE to save these passwords. They say that by doing this to autocomplete their credentials keyloggers cannot get hold of their data.
Strangely enough only the username / passwords saved here are the accounts that were hacked.
It is a legitimate plugin so what gives o_0 ...
Well there is the problem! Letting IE save your passwords is a major problem because all a XSS attack needs to know is where IE stores them. There is also a plethora of tools that crack IE in this same fashion. Tell your friends that storing their passwords is more dangerous than worrying about key loggers. =P
Yeap...Snuggles is right.
Alot of those malware target the pstore file specifically
MLF
Hi Guys,
Thanks for that. They werent saving it in Native I.E , it was a toolbar plugin that saves it, would this have the same effect as you suggest above? Wouldnt AV stop this attack?
Toolbar that stores passwords???
Thats just wrong on so many levels...i have no words
And no ...av doesnt stop alot of these things
MLF
You see, the beauty of XSS is that it is your browser that runs the code. There are some protections you can do, like turning scripts off or blocking most of them, but AV won't stop really stop a malicious site. noScript even has problems blocking malicious scripts from time to time. Also, I agree with Morgan, a plug-in that saves passwords sounds shady at best. I suggest changing passwords and not using IE or that plug-in/toolbar ;)
Cool, thanks for all the replies.
People wouldn't have these issues if they didn't run as Administrator, ran there updates regularly and not continually download nakedbritneyspears.JPG.exe all the time..Quote:
Originally Posted by SnugglesTheBear
the not using IE thing is aload of bull... Heck i am still using ie7 not because i have to, or i carn't update etc i use it because i like it, and it suits my needs and does what i want.
:p
well not only does IE not conform to w3c standards like the rest of the world, it is bloated and inefficient IMO. What you say is true though hybrid, if you don't run as administrator you can minimize the amount of damage a XSS attack could do. However, they can still have their sessions/private information stolen via a XSS attack. But that is a problem with many popular browsers. The big problem with IE and especially older versions of IE, like IE7, in terms of security is its use of activeX. Yes you can disable it, but there exists code that can unset the killbit for activeX and so disabling it doesn't really work. ActiveX alone can give a rogue script complete access to your machine and results in a drive-by download. This is a huge security flaw thanks to the designers at M$. Eventually M$ just did away with all the activeX nonsense, but you would appear to still have it =P But if you want a recent example, in January 2010, there was a big exploit targeting older versions of I.E. with a 0day. Here is a link detailing it =P
http://praetorianprefect.com/archive...oit-in-action/
The funny thing is that M$ knew about the hole for months, just never got around to fixing it =P Just another reason why closed source is less secure ;)
ahhh "Aurora" that seductive vixen, good times good times. :p Nice example snuggles, i remember discussing that wonderful 0-day.
anyhow good points regarding IE, ;) but as you did indeed mention all browsers are vulnerable. you mentioned killbits etc i dislike those sorts of "Vulns" the same as the next guy the reason why i don't move to "More Secure" browser is because ie7 just works the way i want a browser to work.
There are nifty little "app" like things that can be configured to stop those drive-by killbits bugs from happening, also you mentioned cookie stealing for psswrds etc? i would imagine from the OP that maybe the users were using a spyware toolbar to begin with ;)
So off-course they would eventually have there login credentials lifted in plain text if they used the toolbar to save form information..
also have you much no about "Proxomitron" ? great little web filter, let's you filter out pretty much anything you like. Works lovely :)
sorry for talking riddles, busy busy busy. Weill re-edit and clean up this post and make it more engrish latter ;)
I use more current web filters than proxomitron =P, but when I am feeling especially paranoid, I use Tor for close to true anonymity though it is incredibly slow :(.
On the terms of the XSS, I wasn't referring to password stealing so much, though that can be accomplished if they let their browser save their password, as I was referring to session stealing. So say I am logged into gmail and checking my mail but then I go to another page without logging out of gmail, so my browser still has all my authenticated cookies. The server hosting the other page can then easily jump into my mail using my browser's credentials by telling my browser to do just that. I suggest reading this nifty little handbook http://code.google.com/p/browsersec/wiki/Main
It is a gnarly read as the surfers would say especially if you are into web development =P
But anywho boo, the reason why I didn't suspect a session stealing attack from the OP was because most attacks of that type are done by sending the victim an email that has a link to a malicious site so the attacker is pretty sure that the victim is logged in from the beginning. So, I guess I was assuming that the users were able to tell legitimate vs illegitimate email. Both ways could have happened, but the xss attack will only be effective for as long as the attacker stays logged in.
IE has plenty of code to try and stop many other the attacks that unset the killbit, but eventually m$ that it was just a bad idea to begin with since it wasn't too much of a leap to subvert most of those protections >.< Blech, the reason browsers are so insecure is because of band-aid patching like that, as well as very loose protocols/standards as the handbook I linked goes over very thoroughly (seriously check it out if you are interested in browser security).
I didn't say ALL browsers were insecure. I simply stated most popular browsers are insecure, some more than others, but that boils down to their implementation of scripting. The power behind web languages like javascript (which has a kind of funny history where netscape threw it together very haphazardly and quickly) as well as many mistakes that were made in the design of the web, such as loose standards of HTML and URL rendering etc. etc., lead browsers to be very insecure. There are secure browsers out there, you won't get nearly the functionality out of them, such as dillo and lynx. Lynx is to my knowledge the most secure browser, it is just text rendering everything else is discarded NOW THAT'S SECURITY!, though dillo is secure enough, though it can be attacked via overflows in their image rendering libraries etc. Heh, It is kind of funny to see the seemingly one to one relationship that functionality vs security have, the more of one you have, the less of the other you have.
I think I have ranted long enough, back to work :(
That is oh so true! and another factor to consider is what add-ons and plug-ins you have installed. I frequently find that I have vulnerabilities in them rather than the browsers themselves. You need to make sure that they are up to date as well as the browser itself.Quote:
I simply stated most popular browsers are insecure, some more than others, but that boils down to their implementation of scripting.
Absolutely! which means that you really need to make sure that your applications are up to date as well as your OS and browser package.Quote:
Heh, It is kind of funny to see the seemingly one to one relationship that functionality vs security have, the more of one you have, the less of the other you have.
I find that Secunia PSI and File Hippo's Update Checker are useful when it comes to this.
Basically, I believe that anything that will launch an executable is potentially dangerous, particularly in careless hands, or " clicky, clicky fingers" :D
OK you can get relatively secure web browsers, but that will take you back to the days of the old bulletin boards and the like. :(
yep yep. Ajax is becoming way too popular and powerful to stop.Quote:
Originally Posted by nihil
The really sad thing with browsers/software being completely up to date, it still isn't very secure as the handbook I linked to in the previous post points out pretty clearly. :( That is why when I am running windows, I use sandboxie inside another sandbox =P I can't really download anything via firefox, but what the hey >.< What do you guys do for browser security?