New Firefox ESR is late in Debian (again)

Update: Firefox ESR 140 arrived as a security update in the afternoon of  the morning of this post. My apologies for misrepresenting the update process.

It's still important to note that Firefox ESR 128 is EOL, has security vulnerabilities, and will not get security updates.

Users of Debian Testing will have an unsecure browser until the new version of the browser passes through the update process from Unstable.

Users of Debian Trixie should ensure they have the security repository enabled and have updated Firefox. 

--------------------------------

Firefox ESR 128 has reached its EOL, which means no more security fixes, but the new version (140) has only just gone into Unstable, which means there will be a period of testing as 140 moves from Unstable to Testing to Trixie, the current version of Debian, and to previous still-supported versions.

There are currently seven security issues affecting Firefox ESR 128.

Just to be utterly sensationalist, I looked for anything scary about these vulnerabilities. Well, this is pretty scary:

A remote code execution vulnerability has been identified in Firefox versions below 143 and Firefox Extended Support Release (ESR) below 140.3. This vulnerability allows attackers to execute arbitrary code on affected installations, which could lead to unauthorized access and manipulation of user systems. It is crucial for Firefox users to update to the latest version to mitigate potential exploitation risks.

securityvulnerability.io

The reason for the (again) in the title is that this is not the first time this has happened. See this post from 2021.

I have no idea why Debian does not begin the process of switching to the new ESR version before EOL. If anybody does, please let me know in the comments.

Debian users concerned about the security vulnerabilities present in Firefox ESR 128 can use an alternative browser like Chromium, or install Firefox directly from Mozilla.

wiki.debian.org

Does Debian Testing need a security repository?

Debian Testing is for testing the upcoming new release of Debian as it develops. You may think the clue is in the name, but some people seem to regard it as a rolling release. It's not. As a Debian installation for daily use, it is in fact the least secure Debian version. Security fixes go through the normal process of migration from Unstable to Testing, which may take days, because new packages must not introduce release critical bugs, whereas the Stable release gets security updates immediately from a special security repository.

As the Debian Wiki says:

Security for testing benefits from the security efforts of the entire project for unstable. However, there is a minimum two-day migration delay, and sometimes security fixes can be held up by transitions. The Security Team helps to move along those transitions holding back important security uploads, but this is not always possible and delays may occur. Especially in the months after a new stable release, when many new versions are uploaded to unstable, security fixes for testing may lag behind. If you want to have a secure (and stable) server you are strongly encouraged to stay with stable.

The Debian Wiki recommends an active approach to security when using testing.

It is a good idea to install security updates from unstable since they take extra time to reach testing and the security team only releases updates to unstable.

For details of how to do so, see the Wiki link. This involves an Apt pinning process, not just enabling the Unstable repository, which would give you an Unstable installation, aka Sid, the notorious breaker of toys.

A security repository for Testing exists, but I have always believed it was for users of Testing who intended to stay with the next release. Say you have new hardware and find that Debian Stable does not work, but Debian Testing does. You might decide to accept or mitigate the risks by watching for and installing security updates from Unstable - (see above) and use Testing until it becomes Stable.

In which case, Debian sources list would look like this at the time of writing:

deb http://deb.debian.org/debian/ trixie main contrib non-free non-free-firmware
deb http://security.debian.org/debian-security/ trixie-security main

"trixie" would of course be replaced by the codename of the Testing relase at any point in Time. If you are reading this years in the future, it may be different. Local mirrors for the primary repository are of course also acceptable.

I have always believed (and indeed the Debian Wiki said so) that the repository would be empty, just there so that users would have the security repository automatically when Testing became stable in case they forgot to add it after the release. For that reason, I have never added a security line to my sources.list.

However, I noticed recently (in fact it was pointed out to me by a member at the Debian User Forum) that a security line is recommended for users of Testing tracking either the current codename or Testing in their sources.list.

The Debian Wiki did not explain why, so I contacted a member of the Wiki team to ask for clarification. It seems that under exceptional, rare circumstances very serious bug fixes may indeed be added to the Testing security repository, which is why the Debian Wiki recommends it, and the answer to the question in the title of this post is "yes".

For people tracking Testing like me, source.list should look like this:

deb http://deb.debian.org/debian/ testing main contrib non-free non-free-firmware
deb http://security.debian.org/debian-security/ testing-security main

I have edited a couple of Debian Wiki pages to reflect this new information or to make clear why the security repository is recommended for all Testing users. Many thanks to my contact at the Debian Wiki team for providing the information.

Update Flash won't fix security flaws!

Another Flash update in Debian today, but Flash is still insecure- there's still an active 0-day exploit- and blocked by default by Mozilla.

Update Flash fix security flaws!

Adobe pushes emergency fix for active 0-day.

No, this isn't a duplicate of the previous post.

It looks like I'll be saying exactly the same thing next week too, according to Brian Krebs.

For the second time in a week, Adobe Systems Inc. says it plans fix a zero-day vulnerability in its Flash Player software that came to light after hackers broke into and posted online hundreds of gigabytes of data from Hacking Team, a controversial Italian company that’s long been accused of helping repressive regimes spy on dissident groups.

In an advisory published late Friday evening, Adobe said it plans to issue another Flash patch the week of July 13, 2015.

Update Flash fix security flaws! Groundhog day.

A security update is available for Flash in Linux.

See previous post.

And the one before that.

Update Flash fix security flaws! (The prequel)

Another Flash update is on the way.

Security Advisory for Adobe Flash Player 

Release date: February 2, 2015
Vulnerability identifier: APSA15-02 CVE number: CVE-2015-0313
Platform: All Platforms

Summary 

A critical vulnerability (CVE-2015-0313) exists in Adobe Flash Player 16.0.0.296 and earlier versions for Windows and Macintosh. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. We are aware of reports that this vulnerability is being actively exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below. Adobe expects to release an update for Flash Player during the week of February 2. For more information on updating Flash Player please refer to this post.

Affected software versions 

Adobe Flash Player 16.0.0.296 and earlier versions for Windows and Macintosh Adobe Flash Player 13.0.0.264 and earlier 13.x versions
Adobe Flash Player 11.2.202.440 and earlier versions for Linux 

adobe.com

Update Flash fix security flaws!

Browsing the web today I noticed that some Flash videos were not playing, and I saw this message:

"This plugin is vulnerable and should be updated".

The option to check and update Flash in Iceweasel told me I had the latest version, but Adobe has issued a security update for Flash.

As I have mentioned before, Flash updates are not automatically downloaded in Debian- a user has to do:

# update-flashplugin-nonfree --install

Restart the browser afterwards to load the updated Flash player.

Bad Bash Bug

There's a bug in Linux. I read the story on the BBC this morning. Doing a bit of Googling, I came across a page at Red Hat which confirmed my computer (running Debian Testing) was vulnerable.

 By evening Debian Testing had a patch:

Now I seem to be safe:

However, the real issue here does not seem to be Linux desktops:

...this bash bug has been around for a long, long time. That means there are lots of old devices on the network vulnerable to this bug. The number of systems needing to be patched, but which won't be is [large].

Robert Graham, on tomsguide.com.

Android adware

Zscaler ThreatLab has a interesting report on adware in Android, and the discrepancy in detection rates between AV companies.

Google has plenty of incentive to allow apps with aggressive advertising practices. AV vendors on the other hand have no such incentive but are instead under pressure to show that they are adding value by identifying malicious/suspicious/unwanted content. As such, there is a big gap between Google and AV vendors when it comes to adware. Ultimately, end users are stuck in the middle as they are left to decide if they will keep or delete the apps being flagged.

Zscaler reference Lookout in creating a definition of unacceptable behaviour in adware:

• Harvests excessive personally identifiable information
• Performs unexpected actions in response to ad clicks without appropriate user consent (appropriate user consent entails providing a clear alert in the application that the user can accept or decline before any behavior takes place)
• Collects IMEI numbers, UDIDs or MAC addresses
• Initiating phone calls and SMS messages
• Changing wallpaper and ringtones
• Leaks location information
• Leaks email addresses
• Leaks personal information such as contacts, birthdays, calendar appointments, etc

At the moment, as the Zscaler report highlights, Google may be allowing apps that exhibit unacceptable behaviour on Google Play, but AV companies are not consistent in their definition of what constitutes unacceptable behaviour, and it is left to the user to make a decision about what to install.

In relevant other news, Google has acquired VirusTotal, which, coincidentally or not, is now available as an Android app, so the paranoid Android user may check to see if any AV company detects their apps as adware or other malware.

Hat tip: GOT2.ME

Tor browser served malware

The Tor browser (part of the Tor Browser Bundle) has been served malware on a compromised website as the result of a security vulnerability in the browser, a version of Firefox. US security services are allegedly responsible for the malware, which reports the user's IP address to a third party. The suggestion is that security services are trying to identify child pornography users.

Foss Force has the story, and repeats a claim made on eWeek that the browser in the Tor Browser Bundle was left insecure for weeks. The Tor blog rejects this claim, arguing that a security update was available.

To me it seems that Tor is correct here: only users who had not updated to the secure version were vulnerable. The Tor Browser Bundle had a warning on its start page advising users to get the security upgrade.

My own interest in the Tor network, I should point out, is the evasion of internet restrictions placed on users by countries which do not respect freedom of speech and information. I recently used it to evade a block on Blogger by the country I was staying in, a petty and profoundly undemocratic action, which I felt no compunction about evading. However, out of respect for my host nation, I won't reveal which country it was.

Linux Banking Trojan

With Windows computers beset with banking Trojans, and Linux seen as a secure alternative, it was never going to be long before similar malware appeared for Linux: the user base may be small, but with those users doing their banking on Linux, the reward was likely to be worth the effort.

The RSA blog has the story of the Hand of Thief Linux banking Trojan.

The Trojan's sales agent (yes, there is such a person) has very kindly let Linux users who bank online know what to watch out for.

[I]n a conversation with the malware’s sales agent, he himself suggested using email and social engineering as the infection vector.

I suppose the usual suspects will claim that this shows the need for an anti-virus program on Linux (again), but I still don't believe that is necessary. Not installing Linux executables from untrusted sources remains the key to security, and I have no information yet about detection rates for this Trojan.

Update: the avast! Blog has an analysis of the Trojan,  with links to a VirusTotal analysis, showing which AV programs detect the malware (avast! being one , of course).

Update Flash fix security flaws! (Again)

Flash has been updated to fix security vulnerabilities.

This is not an automatic update for Debian users (see here). To update, issue this command:

# update-flashplugin-nonfree --install

Banners Broker

Having had an interest in computer malware for almost ten years now, I've come across some very unscrupulous internet advertising operations- the sort that try to install advertising software on computers by exploitation of security vulnerabilities or social engineering, and make it as difficult as possible to uninstall it. The people behind such operations may masquerade as legitimate, but they are crooks.

Perhaps that's why when somebody suggested I put some money into the Banners Broker company I smelled a rat. It claims to make you money by buying and reselling internet advertising. At first look, perhaps plausible, but schemes to make huge amounts of money from internet advertising can be crooked.

I'm also suspicious of money making schemes that require no work or expertise, especially ones that seem to guarantee a return.

I Googled the company and found that it was a Ponzi scheme, promoted by a bunch of obvious con men and women. The evidence for this was clearly available, and I didn't want anything to do with the company. It seemed likely at the time that the scheme was close to collapse, but it still seems to be trying to attract new money (although not paying out any more). 

For this reason I've decided to post the information I've come across in the hope that it may reach somebody tempted to put money into the scheme or a similar one. The business model of the scheme is totally implausible- this has been well documented- and the suspension of disbelieve seems to depend a sense of entitlement- there are millions of dollars moving around the internet in advertising, why shouldn't some of those dollars fall into my lap?

Because you don't deserve it: there's no way Banners Broker makes money legitimately, only by drawing in new suckers. Don't be one. Check out the evidence.

A web developer looks at the business model.

An internet advertiser looks at the business model.

Another internet advertiser looks at the business model (update here).

An online advertising expert looks at the business model (update here).

A web site publisher looks at the business model.

A make money online website looks at the business model.

A blog on internet cybercrime has pictures of Banners Broker's obviously fake headquarters.

Finally, realscam.com has a thread on Banners Broker.

Update Flash fix security flaws! (2)

Flash has released another security update. As before, Debian users won't get it without doing a manual update.

# update-flashplugin-nonfree --install

Firefox, IE and Chrome hacked at Pwn2Own, Firefox issues secuirty update

eSecurity Planet has the story. Iceweasel in Debian Experimental is still at 19.0-1 a the time of writing, but the update will no doubt be made soon. The vulnerability is critical:

Vulnerability can be used to run attacker code and install software, requiring no user interaction beyond normal browsing.

Update Flash fix security flaws!

Flash has released a security update that fixes vulnerabilities being exploited to compromise systems. KrebsonSecurity.

I'd assumed that because I'd installed Flash from the Debian repository as flashplugin-nonfree Flash would be automatically updated, but a post on the Debian forum made me aware that it isn't. The information there is confirmed on the Debian Wiki. To update, issue this command:

# update-flashplugin-nonfree --install

I'm not aware of the Flash exploits being used against Linux systems, but let's be careful out there.

UPnP security issues

This morning we released a whitepaper entitled Security Flaws in Universal Plug and Play. This paper is the result of a research project spanning the second half of 2012 that measured the global exposure of UPnP-enabled network devices. The results were shocking to the say the least. Over 80 million unique IPs were identified that responded to UPnP discovery requests from the internet. Somewhere between 40 and 50 million IPs are vulnerable to at least one of three attacks outlined in this paper. The two most commonly used UPnP software libraries both contained remotely exploitable vulnerabilities. In the case of the Portable UPnP SDK, over 23 million IPs are vulnerable to remote code execution through a single UDP packet. All told, we were able to identify over 6,900 product versions that were vulnerable through UPnP. This list encompasses over 1,500 vendors and only took into account devices that exposed the UPnP SOAP service to the internet, a serious vulnerability in of itself.

The vulnerabilities we identified in the Portable UPnP SDK have been fixed as of version 1.6.18 (released today), but it will take a long time before each of the application and device vendors incorporate this patch into their products. In most cases, network equipment that is "no longer shipping" will not be updated at all, exposing these users to remote compromise until UPnP is disabled or the product is swapped for something new.

Security Flaws in Universal Plug and Play: Unplug, Don't Play (via TechSpot).

I've never had any luck with UPnP on my now rather ancient router, which is certainly "no longer shipping", but it was enabled. I've disabled it as advised.

Meanwhile, in Windows land...

"Vulnerability in Internet Explorer Could Allow Remote Code Execution."

"Microsoft is aware of targeted attacks that attempt to exploit this vulnerability through Internet Explorer 8."

Microsoft Security Advisory (2794220)

I noticed this story on KrebsonSecurity, which has more details of the nature of the targeted attack:

...this is another example of a “watering hole” attack, which involves the targeted compromise of legitimate websites thought to be of interest to or frequented by end users who belong to organizations that attackers wish to infiltrate.

Users of affected Windows software are advised to run along and get the fix. Off you go. Now.

Desktop Linux users can put the previous story in context.

Update: The fix has been bypassed. Windows users with a fully patched system are at risk.

Microsoft's bad reputation(s)

A new report claims that Internet Explorer 9 is far better at blocking socially-engineered malware than other browsers. (This is malware which tricks the user into installing it rather than look for security weakness in software to install automatically.) IE9 is claimed to have a 96% protection rate, and its closest rival only a 13% protection rate.

Normally I'm quite sceptical of reports like this because they often turn out to have been sponsored by the firm that did so well, and that the test proves to have been biased in some way to favour the sponsor's product.
In this case, this doesn't seem to be true. The test is not Microsoft funded and the testing organisation seems to have gathered its own test samples. (However, Trend Micro has contested the findings.)
Microsoft has achieved this success using something it calls SmartScreen URL Reputation and Application Reputation. In other words, they are trying to blacklist every malicious URL that comes into existence, and whitelist every good download that exists on the web. Their users will be warned if a web site is malicious or if a download is known to be good.
How does Microsoft identify malicious URLs? windowsteamblog.com explains:

SmartScreen's reputation systems begin with telemetry feeds: reports from end users, data from third parties, traffic from URLs showing up in e-mail, logs from our services, etc. Some of these feeds contain billions of URLs per day. Other feeds contain URLs that a third party has certified to be known phishing sites, and still others contain little more than the fact that an URL has appeared in spam e-mail messages.

(End users? Does that mean that Microsoft checks every URL Internet Explorer users visit? Well, as Microsoft call it a cloud-based URL-reputation service, I would imagine yes. Cloud based would imply that URLs are sent to the mother ship to be categorised good or bad, or investigated if unknown.)

These feeds are checked largely by an artificial intelligence, but in some cases by human analysts.

we take every URL in every feed and use machine learning to predict the probability that the URL is abusive. At a high level, this involves examining each URL for suspicious substrings (for example, the word "pharmacy" in the URL), looking up the history of the URL–its associated domain, IPs, DNS servers, routers, subnets, ASNs–and combining these into tens of thousands of potentially predictive features for the URL. We then apply models based in machine learning, which pore over these features and separate the abusive URLs from the honest ones. Most of the time, we are confident enough in the findings of our machine learning engine that we can flag a URL as abusive based on this recommendation alone. Sometimes a URL is suspicious but we're not certain; we send many of these suspicious URLs to our analysts for final classification.

Microsoft seems to be being quite aggressive in extending this list of suspected malicious URLs:

With the right evidence, SmartScreen's reputation system will flag whole domains as abusive.

URLs and domains are concepts that let humans refer to computers. But every computer that's directly on the Internet also has a numeric code, called its IP address, that lets other computers refer to it. For example, 109.22.33.142 might be the IP address of the computer that's running the web server that's hosting the canada-pharmacy.us domain. SmartScreen's reputation system tracks these as well and will mark specific web server IP addresses as abusive. SmartScreen will also generalize to other computers "in the neighborhood" of known bad ones. For example, IP addresses are often allocated in blocks, and it's likely that the person who owns 109.22.33.142 also owns 109.22.33.143 and .144 and .145. We use knowledge about the way infrastructure blocks are allocated–into subnets, ASN (Autonomous System Number) blocks, the way message routing works, and more–to figure out what other computers the abusers own, and prevent those abusers from attacking Microsoft customers.

DNS servers are another key to SmartScreen's reputation system. DNS servers translate the URLs that you type into your browser into the IP addresses used by computers. SmartScreen assigns a lower reputation score to DNS servers that seem to know just a little bit too much about abusive domain names.

The aim is to increase the "costs that abusers incur as we dig deeper into their infrastructure".

Source: windowsteamblog.com.

But is Microsoft being too aggressive in blocking URLs, and downloads, because the Application Reputation system is also URL based?
The Sophos nakedsecurity blog contends that there is a 30-75% chance that Application Reputation warnings will be a false positive.
There's certainly evidence that Microsoft is sometimes getting it wrong:

Ever since the release of Internet Explorer 9, we (and other smaller sites) have been plagued by visitors who, when they attempt to download our stationery files, see a strong warning in Internet Explorer 9 about downloading and installing our files. This is worrisome. Even visitors who have been downloading our stationery for over a decade are writing and expressing their concern about the safety of our files.

We’ve changed nothing as far as the way our files are created. The problem lies with Microsoft and Internet Explorer 9′s obviously misnamed, SmartScreen filter.

And concern that Microsoft's aggressive attitude to abusers is damaging legitimate users:

When users who know us and have trusted us for years write us expressing their concern, what do you think users who have just discovered our site are going to do? You’re right: They’re going to leave and never come back. There is nothing we can do about it – Microsoft doesn’t care about the damage this kind of thing causes to small, niche sites like ours. They’re concerned about Microsoft and protecting what’s left of its reputation.

thundercloud.net

The Sophos nakedsecurity blog identifies the problem:

Users think, "If this were truly dangerous, it would have simply been blocked, right?" Microsoft's statistics show that in a real world attack 99% of users did delete the file, but this warning message is still a new phenomenon. It will be interesting to see how many click through over the long run.

Even worse, if up to 75% of the time you get the warning you are downloading a legitimate file, will you continue to pay attention to the warning when it really matters?

The statistics show that at the moment the warnings are causing Internet Explore 9 users to delete legitimate downloads. Internet Explorer 9 users need to be aware of this issue.

Microsoft may be saving you from yourself (to save its reputation?), but handing out some undeserved bad reputations. Don't assume that a SmartScreen download warning mean a file is malware, but don't become complacent and assume a warning is a false-positive too. Get the balance right.

How useful is anti-virus in Linux? (Part 2)

In Part 1 I wrote about Linux malware found in a screensaver. In this post, I'm going to talk about a more recent story of a Trojan horse found in a Linux distribution. The story was picked up with glee by Ed Bott:

Every time I write about Windows security software, I get a predictable flood of responses from Linux advocates who claim that they don’t need any such protection. Today comes a shining example of why they’re wrong.

Then Adrian Kingsley-Hughes jumped on the FUD wagon. So should Linux users all be installing anti-virus software? I decided to investigate. With a bit of searching, I found an analysis of the malware script concerned. Submitting the script to VirusTotal produced no detections, but I'd found this blog post from Sophos describing how they detect the malware as Troj/UnIRC-A. Another analysis suggested the malicious package was still available for download. I checked, and it was. The file had already been submitted to VirusTotal in February 2010, when there had been four detections. (A reanalysis didn't produce any more.)



Despite the rather gloating blog from Sophos above, they only added their detection for this malware on the day the story broke. F-Secure added their detection the day after. I don't know when Comodo and Panda added their detections, but I'm guessing they too added their detections after the story broke.

So should Linux users be installing anti-virus products, and combing their systems for malware? There are two points to make here:

• There's no evidence that any anti-virus product would have detected this malware before it was discovered and reported.
• Well over a month after the malware was discovered, it's detected by a tiny minority of anti-virus programs.

The real moral of the story seems to be (as the Sophos blog points out) for administrators to check signatures and checksums of files when using a distro like Gentoo. [Some background I picked up reading the comments sections of various articles about the story: Gentoo is a far from mainstream distro which requires users to compile everything from tarballs.]
In more mainstream distros, software in repositories is digitally signed by the developer, so it is not possible for a package to be replaced with malware. When enabling additional repositories, or trusted third-part repositories, always may sure the appropriate key is installed so software can be authenticated. The following warning means the appropriate key has not been installed, and you are at risk of installing a possibly insecure passage:

You are about to install software that can’t be authenticated! Doing this could allow a malicious individual to damage or take control of your system.

See here for an example.