DHS Daily Open Source Infrastructure Report

Tuesday, February 26, 2008

Daily Report

• According to the Associated Press, Two United Airlines planes are being inspected after their wings touched at Dulles International Airport outside Washington, D.C. Officials say there are no reports of injuries. A spokesman for the Metropolitan Washington Airports Authority says a Boeing 737 and a smaller Embraer aircraft were preparing for departure Sunday evening when their wings touched. (See item 10)

• The Washington Post reports the number of U.S. Park Police officers has dropped to a 20-year low, with widespread vacancies in senior ranks, leaving the agency strapped, despite heightened concern about protecting the nation’s landmarks from terrorism, according to officers and a watchdog group. (See item 30)

Information Technology

24. February 25, IDG News Service – (International) YouTube blames Pakistani ISP for global site outage. Many users around the world could not access the YouTube site for about two hours on Sunday. The company blamed the outage on erroneous routing information introduced by a Pakistani Internet service provider. Pakistani authorities ordered ISPs there to block the site on Friday. Traffic to YouTube was misrouted for around two hours, rendering the site inaccessible for many users around the world, YouTube said on Monday. “We have determined that the source of these events was a network in Pakistan,” the company said, adding that it is still investigating the problem to prevent it from happening again. The Pakistan Telecommunication Authority (PTA) ordered the country’s ISPs to block users access to YouTube on Friday because of an inflammatory anti-Islamic video on the site, a representative of the Association of Pakistan Internet Service Providers said in a telephone interview on Monday. If the video is provocative, then it is better it is removed, rather than provoke unrest in Pakistan, he said, adding that he did not know the contents of the video. Access to YouTube is still blocked in Pakistan while the ISPs work with the PTA to narrow its order to block a single URL (Uniform Resource Locator) pointing to the video, he said. He expects the PTA to make an order to that effect later on Monday. Source: http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/08/02/25/YouTube-blames-Pakistani-ISP-for-global-site-outage_1.html

25. February 24, Computerworld – (National) Critical VMware bug lets attackers zap ‘real’ Windows. A critical vulnerability in VMware Inc.’s virtualization software for Windows lets attackers escape the “guest” operating system and modify or add files to the underlying “host” operating system, the company has acknowledged. As of Sunday, there was no patch available for the flaw, which affects VMware’s Windows client virtualization programs, including Workstation, Player and ACE. The company’s virtual
machine software for Windows servers and for Mac- and Linux-based hosts are not at risk. The bug was reported by Core Security Technologies, makers of the penetration-testing framework CORE IMPACT, said VMware in a security alert issued last Friday. “Exploitation of this vulnerability allows attackers to break out of an isolated guest system to compromise the underlying host system that controls it,” claimed Core Security. According to VMware, the bug is in the shared-folder feature of its Windows client-based virtualization software. Shared folders let users access certain files – typically documents and other application-generated files – from the host operating system and any virtual machine on that physical system. “On Windows hosts, if you have configured a VMware host-to-guest shared folder, it is possible for a program running in the guest to gain access to the host’s complete file system and create or modify executable files in sensitive locations,” confirmed VMware. VMware has not posted a fix, but it instead told users to disable shared folders.
Source: http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9064319&source=rss_topic17

26. February 23, Computerworld – (National) Hackers ramp up Facebook, MySpace attacks. Hackers are actively exploiting an Internet Explorer plug-in that’s widely used by Facebook Inc. and MySpace.com members with a multi-attack kit, a security company warned Friday. The exploit directed at Aurigma Inc.’s Image Uploader, an ActiveX control used by Facebook, MySpace and other social networking sites to allow members to upload photos to their profiles, is just one of five in a new hacker tool kit being used by several Chinese attack sites, said Symantec Corp. Attacks begin when users receive spam or an instant message with an embedded link, said the Symantec analyst who authored the advisory. The link takes users to a bogus MySpace log-in page, which tries to steal members’ credentials as it also silently probes the their computers for vulnerabilities in Uploader, Apple Inc.’s QuickTime, Windows and Yahoo Music Jukebox. Although the Windows and QuickTime bugs were patched eight and 13 months ago, respectively, the Uploader and Yahoo vulnerabilities were made public and fixed only within the past few weeks. The Symnatec analyst noted the hackers’ fast reaction times. “[This demonstrates] how quickly attackers are leveraging new vulnerabilities,” he said. “It is unlikely that attackers will stop trying to leverage this vulnerability any time soon.” Symantec urged users to update the Image Uploader ActiveX control to Version 4.5.57.1.
Source: http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9064298&taxonomyId=17&intsrc=kc_top

27. February 22, Techworld.com – (National) Hackers turn Google into vulnerability scanner. The hacking group Cult of the Dead Cow (CDC) this week released a tool that turns Google into an automated vulnerability scanner, scouring Web sites for sensitive information such as passwords or server vulnerabilities. CDC first achieved notoriety 10 years ago with its backdoor Back Orifice, which demonstrated in a highly public way just how easy it was to take unauthorized control of a Windows PC. The new tool, called Goolag Scan, is equally provocative, making it easy for unskilled users to track down vulnerabilities and sensitive information on specific Web sites or broad Web domains. This capability should serve as a wake-up call for system administrators to run the tool on their own sites before attackers get around to it, according to CDC. “We’ve seen some pretty scary holes through random tests with the scanner in North America, Europe, and the Middle East. If I were a government, a large corporation, or anyone with a large website, I’d be downloading this beast and aiming it at my site yesterday,” said a CDC representative. The tool is a stand-alone Windows .Net application, licensed under the open source GNU General Public License, which provides about 1,500 customized searches under categories such as “vulnerable servers,” “sensitive online shopping information,” and “files containing juicy information.”
Source: http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/08/02/22/Hackers-turn-Google-into-vulnerability-scanner_1.html

Communications Sector

28. February 24, IDG News Service – (National) Wireless broadband test continues. A wireless broadband device tested by the U.S. Federal Communications Commission for interference with television and wireless microphone signals has not failed, as a broadcasting group claimed last week, members of the White Spaces Coalition say. The National Association of Broadcasters (NAB) on February 11 said a so-called prototype device submitted by Microsoft lost power during tests being run by the FCC. The power failure comes after another white spaces device malfunctioned in tests run by the FCC last year. But a tech advisor to the White Spaces Coalition and a former chief of the FCC’s Office of Engineering and Technology said that while the devices power supply failed after many hours of continuous testing, it did not interfere with television signals due to the power failure. The White Spaces Coalition, including Microsoft, Philips, Dell and Google, is asking the FCC to allow wireless devices to operate in the so-called white spaces of the television spectrum, space allocated for television signals but vacant.The coalition wants the white spaces opened up to give consumers more wireless broadband options, and the white spaces devices would be targeted at longer-range broadband than traditional Wi-Fi. If the FCC approves the devices this year, commercial white spaces wireless devices could be available as soon as late 2009. The FCC’s in-house testing of four devices will continue for a couple more weeks, then the agency will conduct field tests for up to eight weeks. A second white spaces device has experienced no power failure problems, said the coalition’s advisor.
Source: http://news.yahoo.com/s/pcworld/20080224/tc_pcworld/142762

29. February 22, Telecom Asia – (International) Cable cuts raise security questions. The
security of the international submarine cable networks has been called into question by the severe disruptions caused by the recent series of cable cuts in the Mediterranean Sea. Those disruptions affected internet and phone services between Europe, the Middle East and South Asia. While services on the four broken undersea cables was restored by February 10, analysts suggest that the successive damage of these cables highlights the increased importance of reliability in the world’s undersea cable networks, which carry over 95 percent of the world’s international internet and telephone traffic. For years cable owners have been working hard to minimize accidental damage with different methods, such as making cable routes available to those that need to know (such as fishermen, navies and research vessels) and deliberately avoiding placing cables in high risk areas. Despite this, there is an unspoken assumption that the networks are safe from deliberate human sabotage. The recent spate of cable failures, however, has called this assumption into question, said a senior analyst at Ovum RHK. Conspiracy theories have gained ground quickly in cyberspace, despite cable owners’ claims that the cables were severed by ship anchors. The Ovum RHK analyst said while there could be several cause for the outages, there is the possibility of human attack, given the geographic position and the fact that undersea cables are a ripe target for those with an interest in wreaking havoc on international communications, whatever their motivation. “If ports, railways, gas pipelines and other types of networks are being secured against possible sabotage, we must similarly increase the security of undersea optical highways,” the analyst insisted. “Guaranteeing reliability is impossible, but an improvement on current hands-off approach is long overdue.” Source: http://www.telecomasia.net/article.php?type=article&id_article=7336