Vupen security researchers finger Windows 8 holes

Vupen, a security company in the business of selling zero-day vulnerabilities, said it has found a way to bypass security mechanisms on Windows 8 and execute code via a Web page.

Vupen Chief Executive Chaouki Bekrar said in an email Friday that the company's researchers had found "multiple vulnerabilities" in Windows 8 and Internet Explorer 10, the latest version of Microsoft's operating system and Web browser. (See also PCWorld'sreview of Windows 8).

"We have researched and discovered multiple vulnerabilities in Windows 8 and Internet Explorer 10 that we have combined together to achieve a full remote code execution via a Web page which bypasses the new exploit-mitigation technologies included in Win8," he said.

Microsoft declined comment on Bekrar's email, saying that it had not received any details of the flaws. "We continue to encourage researchers to participate in Microsoft's Coordinated Vulnerability Disclosure program to help ensure our customers' protection," Dave Forstrom, director of Microsoft Trustworthy Computing, said in a statement.

Wolfgang Kandek, chief technology officer of Qualys, said the fact that Vupen had to chain vulnerabilities was an indication of how well Microsoft has bolstered security in Windows 8. To exploit such a collection of bugs would take considerable skill.

Nevertheless, the fact that it was done reminds the industry that Windows is unlikely to ever be bulletproof. "We've not reached the point where the product is perfect, but that's probably not reachable anyway," Kandek said.

Bekrar first announced the feat Tuesday on Twitter. In the email to CSO Online, the chief executive gave Windows 8 self-serving praise, since the more difficult software is to crack, the more Vupen can charge customers.

"This new Microsoft operating system is definitely the most secure version of Windows so far," he said.

The exploit-mitigation technologies Vupen claimed to bypass were HiASLR (high-entropy Address Space Layout Randomization), AntiROP (anti-Return Oriented Programming), DEP (data execution prevention) and the IE 10 Protected Mode sandbox.

Experts have cited ASLR as a particularly useful anti-hacking mechanism because it involves scrambling system memory to make an application's location more difficult to find.

Because of the security features in Microsoft's latest OS, Bekrar did not expect cybercriminals to find vulnerabilities on their own for a while.

"We do not expect to see, in the short term, attackers creating an exploit for Windows 8 and Internet Explorer 10 as the cost would be too high," he said.

Vupen and competitors Endgame Systems and Netragard sell the vulnerabilities they discover or buy from third-party researchers to government agencies and large corporations. The bug hunters are in a gray area of the market because they don't pass along the knowledge to the software makers, which could release patches.

Unlike many of its rivals, Vupen publicly promotes its services. The company claims to vet its customers and won't sell vulnerabilities to cybercriminals. In 2011, consulting firm Frost & Sullivan named Vupen Entrepreneurial Company of the Year.

Source: pcworld.com

Read More

Yahoo to ignore Microsoft's 'Do Not Track' signal from IE10

Yahoo plans to ignore “Do Not Track” privacy requests sent by Microsoft’s Internet Explorer (IE10) browser, calling its ally’s unilateral decision “signal abuse” and pointing to a possible rift between the search partners.

One Do Not Track (DNT) expert, however, didn’t think Yahoo’s decision, announced last week, would affect its deal with Microsoft.

“I don’t think this is especially significant,” said Justin Brookman, director of consumer privacy at the Center for Democracy and Technology. “Yahoo! is just the biggest individual company to draw this line in the sand. I doubt this will affect their search relationship.” Brookman has been heavily involved in the DNT standard-setting effort.

Dan Olds, an analyst with the Gabriel Consulting Group, agreed. “This won’t rise to the level where it will affect the Yahoo-Microsoft relationship. Companies this large are able to compartmentalize.”

IE10, which launched Oct. 26 alongside Windows 8 and will be released as a preview for Windows 7 by mid-November, is the only browser that has switched on Do Not Track (DNT) by default.

In reality, some argue, IE10 does not actually switch DNT on: In August, Microsoft backed away a step, and promised that during Windows 8 setup, customers will be notified of the impending setting and given a chance to turn it off.

Do Not Track (DNT) signals whether a user wants online advertisers and websites to track his or her movements. Four of the five major browsers—Firefox, IE, Opera and Safari—can now send a DNT signal, while Chrome will include the option by the end of this year. All but IE, however, initially leave it in the “off” position and require users to manually turn on the signal.

Like others—primarily advertisers, but also some browser makers such as Firefox’s Mozilla—Yahoo criticized the on-by-default setting in IE10.

“In principle, we support DNT,” Yahoo said in an unattributed entry on its policy blog Friday. “[But] Microsoft unilaterally decided to turn on DNT in Internet Explorer 10 by default, rather than at users’ direction. It basically means that the DNT signal from IE10 doesn’t express user intent. We will not recognize IE10’s default DNT signal on Yahoo! properties at this time.”

Online advertisers have balked at the idea that browsers can turn on DNT without asking users, essentially hoping that the under-consideration standard will not be widely adopted if the signal must be manually switched on.

Yahoo alluded to that on its blog, saying, “In our view, [IE10’s on-by-default] degrades the experience for the majority of users and makes it hard to deliver on our value proposition to them.”

“Value proposition” clearly refers to the trade-offs—users must accept the targeted ads as the price for receiving free software, services and content—that advertisers say make the Internet what it is. As far as advertisers are concerned, tracking is required to provide targeted ads.

A group composed of advertisers, browser makers, privacy advocates and others have not finalized a DNT standard, even after months of intensive work. The Worldwide Web Consortium (W3C) standards-setting group has, however, preliminarily ruled that browser makers cannot set the DNT signal for users, essentially letting each website decide whether it will acknowledge or ignore IE10’s.

Advertisers recently turned up the rhetoric about DNT. Earlier this month, the Association of National Advertisers (ANA), an industry lobbying group, said Microsoft’s decision would “harm consumers, hurt competition, and undermine American innovation,” and called the on-by-default setting “unacceptable.”

Privacy advocates countered, saying that the ANA’s demands were “bizarre.”

Yahoo’s decision to ignore IE10’s DNT signal is notable because the California company is allied with Microsoft in search. In 2010, the two firms signed a 10-year agreement whereby Yahoo’s search results are fueled by Microsoft’s Bing search engine.

One privacy advocate tied Yahoo’s announcement to the Friday launch of Windows 8. “Hunch: Yahoo walked back its Do Not Track commitment today because of the Win8/IE10 launch,” said Jonathan Mayer on Twitter.

Mayer is a graduate student in computer science and law at Stanford University, and one of two researchers at the school who created the HTTP header implementation that signals a user’s DNT preference.

Microsoft debuted IE10 on Oct. 26 as part of Windows 8. A version of the browser for themuch more popular Windows 7 will reach beta—Microsoft calls that a “preview”—in mid-November. IE10 on Windows 7 will also have the DNT option enabled by default.

“At least Yahoo is honest about why it’s ignoring IE10 Do Not Track,” noted Mayer, also on Twitter, as he quoted the company’s claim that the privacy feature, if turned on, “makes it hard to deliver on our value proposition.”

Also on Friday, Microsoft’s head counsel, Brad Smith, blogged about DNT. Because his comments were based on an Oct. 23 keynote speech at an international conference of data protection and privacy officials, he did not address Yahoo’s move.

In the blog post, Smith defended Microsoft’s decision on IE10 and DNT, citing a survey the company commissioned that said 75% percent of U.S. and European consumers wanted DNT switched on by default.

(Smith’s Oct. 23 keynote presentation can be found on the Microsoft website ( download PDF).

Smith also urged all browser makers to “clearly communicate to consumers whether the DNT signal is turned on or off, and make it easy for them to change the setting,” a reference to Windows 8’s notice during setup.

Olds saw Yahoo’s statement as giving it an out, noting that the explicit reason it gave was due to the lack of a clear and comprehensive standard, and that the company used the phrase “at this time” in its statement.

He predicted that Yahoo would get more attention, virtually all negative, for ignoring IE10’s DNT preference than it had when it announced last March that it would support the standard.

And there will be more tussling, not less, over DNT as time goes by, both Brookman and Olds forecast.

“The most interesting question in all this is how Microsoft responds to companies that reject their DNT instructions,” said Brookman. “They can’t just sit back and let their users’ privacy settings be ignored—they would lose credibility with their customer base.”

“This topic is not going to go away,” Olds prognosticated. “As tracking becomes even more sophisticated, it will be a much bigger issue as advertisers use big data along with other information they’ve gleaned on you. It’s going to really start crossing the creepy threshold.”

Brookman sees the possibility of a full-fledged war between browser vendors and online advertisers if Microsoft responds by, for instance, blocking ads from domains that don’t honor its IE10 signal.

“DNT was really designed to prevent this sort of user-browser-advertiser war … but I know most of the browser makers are getting increasingly skeptical about how ad networks are going to honor the signal,” said Brookman. “Escalated warfare may be inevitable.”

Microsoft did not respond to a request for comment on Yahoo’s announcement.

Source: pcworld.com

Read More