Apple Mobile Devices - Patch 'em Up NOW

Apple has issued an "important security update", iOS 9.3.5, to neutralize a new piece of malware that can remotely jailbreak iPhones allowing an attacker full access to your device to read texts and email, record calls, track your location and activate your phone's camera and microphone.

The update patches the three previously unknown zero-day vulnerabilities that together are referred to as "Trident".

To check if you're at risk look at Settings > General > About > Version   If you're on version 9.3.5 then you're OK.  If you're on a different version you should update now.  You can pull the update through Settings > General > Software Update then just follow the instructions to download and install it.

For those interested we'll go into the details a little:
The three exploited vulnerabilities are:

• CVE-2016-4655, Memory Corruption in Webkit 
• CVE-2016-4656, Information leak in Kernel 
• CVE-2016-4657, Kernel Memory corruption leads to Jailbreak.

The issue was found by cyber security firms Lookout and Citizen Lab, who were tipped off to unusual text messages received by an iPhone user in the United Arab Emirates.
Lookout and Citizen Lab worked with Apple on the patch before releasing information on the vulnerability.
The Trident vulnerabilities are exploited in a spyware package called Pegasus which is widely available throughout the world

Continue reading →

Windows God Mode

Just the other day I was helping a friend set up their computer after doing a full reinstall of the OS.

Now configuring a system can get to be a bit tedious with all of the clicking necessary to get to all of the settings and tools.  So to make things a little easier, I clued him into Windows' God Mode.

God mode puts all of the the things you can customize together in one place on your Windows machine, and it is available from Windows Vista through Windows 10.

Getting to God Mode is easy; just create a folder anywhere you like and name it God Mode.{ED7BA470-8E54-465E-825C-99712043E01C}

Actually, you can name it anything you like before the dot.  the important part is what comes after the dot.  Don't change that part.

Once you rename the folder, open it up and you'll find a wealth of tweaks and tools.

Give it a look if you're of the mind.  If you find it convenient, enjoy.  If it's not for you, just delete the folder and it's gone.

Continue reading →

GHOST Buffer Overflow Vulnerability

A critical vulnerability that impacts a majority of Linux servers has been identified.  This vulnerability, named "GHOST", affects the GNU C library (glibc) that is used by Linux applications to interface with the Linux operating system via a series of function calls. The “buffer overflow” vulnerability in a pair of glibc’s functions can allow a remote attacker to exploit this flaw to execute arbitrary code on the system.  

Details of the discovery in this posting on Openwall and, Red Hat provides a detailed description of the vulnerability and updates to resolve the issue.

Continue reading →

Apple Releases OS X Bash/ShellShock Patch

The official patches for the UNIX shell vulnerability have been released.
You may see them listed under 'Software Update' or you may get system notifications alerting you to them.
You can also grab them yourself here:

·              Mavericks v10.9.5+: http://support.apple.com/kb/DL1769

·              Mountain Lion v10.8.5: http://support.apple.com/kb/DL1768

·              Lion v10.7.5: http://support.apple.com/kb/DL1767

Continue reading →

CSRF/XSRF Protection in ColdFusion 9

Here's another little thing that's come across my desk and I hope my solution can be of some help to others.

I was asked to provide a solution to protect a site from Cross Site Request Forgery (CSRF or XSRF) attacks.  Specifically, there were forms on the site that were considered at-risk for exploitation.  I won't get into great detail on what CSRF is, but basically it's an attack vector that attempts to exploit the trust that a website has in the user's browser to allow malicious actions to take place on the server.  

CF10 has methods for CSRF protection available built in, but the site I was asked to chime in on is on CF9.

So, the forms were vulnerable to a CSRF attack because a malicious user could cause a legitimate, authenticated user to unwittingly submit them.  In order to protect the public facing forms, it's necessary to set up a condition where the server can trust that the form submission is from the legitimate user during their session.  The method CF10 uses is to send a token with the form and check for it on submission.  We can do the same thing by adding just a few lines of code to our forms.

Here's a typical self-posting form:

<cfif structKeyExists(form, 'sendInfo')>

       <p>Your information has been received.</p>

    <cfelse>

      <cfform>

            <label for="fName">First name:</label><cfinput name="fName" type="text"><br>

            <label for="lName">Last name:</label><cfinput name="lName" type="text"><br>

            <input type="submit" value="Submit" name="sendInfo">

      </cfform>

    </cfif>

Let's add a token to the form that the server can check for:

<cfif structKeyExists(form, 'sendInfo')>

       <p>Your information has been received.</p>

    <cfelse>

      <cfset session.foobar = createUUID()>

      <cfform>

            <cfoutput><input type="hidden" name="foobar" value="#session.foobar#"></cfoutput>

            <label for="fName">First name:</label><cfinput name="fName" type="text"><br>

            <label for="lName">Last name:</label><cfinput name="lName" type="text"><br>

            <input type="submit" value="Submit" name="sendInfo">

      </cfform>

    </cfif>

Next, we want the form processor to check for the token:

<cfif structKeyExists(form, 'sendInfo')>    

    <cfif structKeyExists(session, 'foobar') and form.foobar is session.foobar>

       <p>Your information has been received.</p>

       <cfelse>

           <p>The form has a problem</p>

       </cfif>

    <cfelse>

      <cfset session.foobar = createUUID()>

      <cfform>

            <cfoutput><input type="hidden" name="foobar" value="#session.foobar#"></cfoutput>

            <label for="fName">First name:</label><cfinput name="fName" type="text"><br>

            <label for="lName">Last name:</label><cfinput name="lName" type="text"><br>

            <input type="submit" value="Submit" name="sendInfo">

      </cfform>

    </cfif>

And finally, we want to do a little housekeeping by dropping the token from the session when we're done with it:

<cfif structKeyExists(form, 'sendInfo')>    

    <cfif structKeyExists(session, 'foobar') and form.foobar is session.foobar>

       <p>Your information has been received.</p>

       <cfelse>

           <p>The form has a problem</p>

       </cfif>

    <cfset structDelete(session, 'foobar')>

    <cfelse>

      <cfset session.foobar = createUUID()>

      <cfform>

            <cfoutput><input type="hidden" name="foobar" value="#session.foobar#"></cfoutput>

            <label for="fName">First name:</label><cfinput name="fName" type="text"><br>

            <label for="lName">Last name:</label><cfinput name="lName" type="text"><br>

            <input type="submit" value="Submit" name="sendInfo">

      </cfform>

    </cfif>

So there ya' go.  A handful of code and you've got your server recognizing your forms for a one-time post and bouncing them on any attempted re-posting.

Continue reading →

Dude, Where's My Phone (or Tablet)?

Earlier this week Google released Android Device Manager, an online tool to locate misplaced Android devices.  This handy little tool will let you:

• locate your phone or tablet on a map in real time  (if you think you left it somewhere),
• ring it at max volume (if it’s misplaced - yes, you could call it from another phone, but this will override ‘Silent’ or ‘Vibrate Only’ so it will ring , or
• erase it (if it's been stolen or is otherwise unrecoverable).

You will need to set up the erase feature on your device, but the locator and ring features work without any setup.

You can read the announcement or just go ahead and play with it.

Continue reading →

Going Hands-On with Google Chromecast

OK - let's start with the basics:
Chromecast is a $35 dongle that you plug into an HDMI port on your HDTV and it allows you to use your phone, tablet or laptop to stream (cast) content to your TV screen. It will cast content from Netflix, YouTube, Google Play Movies & TV, and Google Play Music. Google promises more apps, like Pandora, coming soon.

Something that Google doesn't mention is that almost anything that plays natively in a Chrome browser window can be cast to the TV.  So if you've got a file living on your device that will open in Chrome you can probably cast it.  I've easily sent JPG pictures,  MP3 music, and M4V video from my laptop. I haven't yet done an exhaustive test of file types, but I have found that Quicktime (MOV) files are not supported.

As far as devices, it works with Android 2.3+, iOS 6.0+, Windows 7+, Mac OS 10.7+ and Chromebook Pixel, with additional Chromebook support coming soon.

It transmits video content at up to 1080p resolution via its HDMI port and draws power through its USB port from your HDTV or the supplied external power adapter. It supports 2.4-GHz Wi-Fi 802.11 b/g/n.

In the box you get:

• the Chromecast device
• an HDMI extension cable
• a USB power cord
• a power supply

Setup is quick and easy.  It took just about 3 minutes from opening the box 'til I was casting from my laptop.

1. Plug the power cord into the dongle and into a USB port on your TV.
   Don't use the Service port.  If your set doesn't have a USB port, use the included power supply.  
2. Switch your TVs source to the input you plugged the device into
3. Go to google.com/chromecast/setup to download the app to configure the device

Follow the instructions to get the caster on your WiFi network and your pretty much done. One additional step to cast from your computer.  You'll need to install the Google Cast extension for Chrome.

Once you have Chromecast up and running it is found by your devices' YouTube, Play, etc. apps. Around the castle here, the prince and princesses are all wired up and their iOS and Android tablets, phones and such all can cast without having to install anything.

One thing to note - since all the devices can cast and there's no 'lockout', they can bump each other off the TV screen.  If Princess1 casts from her phone and Princess2 doesn't like the video, Princess2 can start a cast from her tablet and bump Princess1's video off the TV.

Maybe Google would consider a Chromecast Combo Pack including a striped shirt and a whistle?

Continue reading →