Category Archives: Security

Security

Penguins and threats

Leave a comment

The New Zealand penguin pages explain in detail how humans have significantly altered the threats to these harmless birds:

Before the arrival of man, marine mammals were the only mammalian predators of penguins in New Zealand. Rats were the first mammalian predators introduced, albeit accidentally, but several more were deliberately introduced. Cats were the first, in an effort to control rats and mice. There is now a large population of wild cats in New Zealand, which is continually added to by the dumping of unwanted kittens by irresponsible pet owners

Beyond the new predators introduced by humans, there are also pages on oil (humans), climate (humans), fishing (humans), and habitat (humans). And after all that, if you can imagine, they have a page on the threat from humans. Unfortunately, the amazing (under water) flying ability of penguins is only adapted to reduce their vulnerability to non-human related threats. Time will run out before they develop another countermeasure, so some self-regulation by humans is in order…

Security

Apple faces MOAB

Leave a comment

I wasn’t going to write about this because it has such a notoriously self-serving marketing slant (e.g. “we’re just trying to improve OS X by publishing early warning to you about its flaws”) but I just can’t get around the fact that people are still under the impression that life will be safer if they choose X (pun intended) operating system. So, here it is in all it’s glory, the Month of Apple Bugs (MOAB) with four bugs so far (one-a-day):

  1. A vulnerability in the handling of the rtsp:// URL handler allows remote arbitrary code execution.
  2. A vulnerability in the handling of the udp:// URL handler allows remote arbitrary code execution.
  3. A vulnerability in the handling of the HREFTrack field allows to perform cross-zone scripting, leading to potential remote arbitrary code execution.
  4. A format string vulnerability in the handling of iPhoto XML feeds title field allows potential remote arbitrary code execution.

And just for further perspective, there are some excellent resources by people who notify their user communities about proper patching and maintenance of Apple systems (no scary exploit warning tactics needed). For example, James Madison University has a nice page open to the public. Don’t get me wrong, I’m all for disclosure, but I’m also curious about the fine line between public communication with manufacturers and the risk of narcissism.

Security

PDF XSS hits the fan

Leave a comment

Another nasty to follow-up on yesterday’s QuickTime post, GnuCitizen reports that PDFs prior to version 8.0 appear to have a serious XSS flaw, and it only seems to impact Acrobat on certain platforms:

PDF documents can execute JavaScript code for no apparent reason by using the following template.

http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here

You must understand that the attacker doesn’t need to have write access to the specified PDF document. In order to get an XSS vector working you need to have a PDF file hosted on the target and that’s all about it. The rest is just a matter of your abilities and desires.

This finding was originally mentioned by Sven Vetsch, on his blog. The attack vector was discovered by Stefano Di Paola and Giorgio Fedon. This is a very good and quite interesting finding. Good work.

Time to upgrade? Unfortunately the attack is client-side (e.g. uses anchor points, as specified after the # and in page seven of the HighlightFileFormat PDF developer spec). I have to say I’ve been far more wary of PDFs since I noticed Acrobat (writer) code taking up more space than Microsoft Office.

adobe chairThe functionality bundled in by product managers is often overwhelming when most of us really (really!) just want a simple pre-formatted viewer…it’s like being given a top-end massage recliner with built-in multimedia, a cooler, drink holders and remote controllers when all you asked for was a place to sit down.

The original paper by Stefano Di Paola and Giorgio Fedon, released December 2006, can be found here. And, of course, it’s a PDF.

EDITED TO ADD (5 Jan 2007): Local system implication is discussed here, and some comments point to a firefox fix.

History, Security

America’s Holy Blackwater

Leave a comment

Here is an interesting report on militant American forces operating in Iraq and elsewhere:

The former New York Times Mideast Bureau chief warns that the radical Christian right is coming dangerously close to its goal of co-opting the country’s military and law enforcement.

The drive by the Christian right to take control of military chaplaincies, which now sees radical Christians holding roughly 50 percent of chaplaincy appointments in the armed services and service academies, is part of a much larger effort to politicize the military and law enforcement. This effort signals the final and perhaps most deadly stage in the long campaign by the radical Christian right to dismantle America’s open society and build a theocratic state. A successful politicization of the military would signal the end of our democracy.

The parallels with historic militarist movements are obvious:

“Contracting out security to groups like Blackwater undermines our constitutional democracy,â€? said Michael Ratner, the president of the Center for Constitutional Rights. “Their actions may not be subject to constitutional limitations that apply to both federal and state officials and employees—including First Amendment and Fourth Amendment rights to be free from illegal searches and seizures. Unlike police officers they are not trained in protecting constitutional rights and unlike police officers or the military they have no system of accountability whether within their organization or outside it. These kind of paramilitary groups bring to mind Nazi Party brownshirts, functioning as an extrajudicial enforcement mechanism that can and does operate outside the law. The use of these paramilitary groups is an extremely dangerous threat to our rights.”

I was thinking more about the Taliban or the Spanish Civil War, but point taken. It’s no longer sufficient to understand what’s the matter with Kansas, it’s becoming necessary to observe moderate Christians being swept out of public office by militant, organized, rich and highly political radical fringe groups claiming to fight secular bogeyman, or terrorists, or Muslims, or whatever else they can stand on to justify their supremacy in a time of “need”. The clear irony is that fundamentalists always end up quietly moving towards a police-state on a platform that says they must intervene to prevent any movement towards a police-state.