Year 2000 Millennium Core Code of All Supported Windows OS'es Had 'Jasbug' Critical Vulnerability for Decade and a Half

Microsoft just patched a 15-year-old bug that in some cases allows attackers to take complete control of PCs running all supported versions of Windows. The critical vulnerability will remain unpatched in Windows Server 2003, leaving that version wide open for the remaining five months Microsoft pledged to continue supporting it.

The flaw, which took Microsoft more than 12 months to fix, affects all users who connect to business, corporate, or government networks using the Active Directory service. The database is built into Windows and acts as a combination traffic cop and security guard, granting specific privileges to authorized users and mapping where on a local network various resources are available. The bug—which Microsoft classifies as MS15-011 and the researcher who first reported it calls Jasbug—allows attackers who are in a position to monitor traffic passing between the user and the Active Directory network to launch a man-in-the-middle exploit that executes malicious code on vulnerable machines.

"All computers and devices that are members of a corporate Active Directory may be at risk," warned ablog post published Tuesday by JAS Global Advisors, one of the firms that (along with simMachines) reported the bug to Microsoft in January 2014. "The vulnerability is remotely exploitable and may grant the attacker administrator-level privileges on the target machine/device. Roaming machines—Active Directory member devices that connect to corporate networks via the public Internet (possibly over a Virtual Private Network (VPN))—are at heightened risk."

In a Web post of its own, Microsoft provided the following example of how Jasbug might be exploited on a machine connected over open Wi-Fi at a coffee shop:

1. In this scenario, the attacker has observed traffic across the switch and found that a specific machine is attempting to download a file located at the UNC path:\\10.0.0.100\Share\Login.bat.
2. On the attacker machine, a share is set up that exactly matches the UNC path of the file requested by the victim: \\*\Share\Login.bat.
   1. The attacker will have crafted the contents of Login.bat to execute arbitrary, malicious code on the target system. Depending on the service requesting Login.bat, this could be executed as the local user or as the SYSTEM account on the victim’s machine.
3. The attacker then modifies the ARP table in the local switch to ensure that traffic intended for the target server 10.0.0.100 is now routed through to the attacker’s machine.
4. When the victim’s machine next requests the file, the attacker’s machine will return the malicious version of Login.bat.This scenario also illustrates that this attack cannot be used broadly across the internet – an attacker need to target a specific system or group of systems that request files with this unique UNC.

The Difficult Patch Fix:

http://arstechnica.com/security/2015/02/15-year-old-bug-allows-malicious-code-execution-in-all-versions-of-windows/

Hacked MIT Server Used to Stage Attacks, Scan for Vulnerabilities, Prob the Web For Unprotected Domains and Injecting Malicious Code at a Very Substatial Rate With Far Reaching Implications / Collateral Damages / Security Issues

""A compromised server at the Massachusetts Institute of Technology (MIT) has been identified as being used as a vulnerability scanner and attack tool, probing the Web for unprotected domains and injecting code. According to researchers at Bitdefender who discovered the attack, the ongoing attacks appear to be related to the Blackhole Exploit Pack, a popular crime kit used by criminals online.

The attacks started in June, and so far Bitdefender estimates that some 100,000 domains have been compromised, leading to injected pages that look similar to the ones below. In each of the images, the compromised domain has new content injected on top of the existing content, complete with random images, text, and targeted keywords. Interestingly, some of the keywords related to the strings needed to identify a successful attack.

If that wasn’t bad enough, sites that are not vulnerable are still impacted by the scanner, as the flood of GET requests searching for open directories “might grind it to a halt,” Bitdefender explains.

“Judging by initial data, one MIT server (CSH-2.MIT.EDU) hosts a malicious script actively used by cyber-crooks to scan the web for vulnerable websites. It is currently unknown how the crawler bot was planted on the MIT server, but it is certain that it probes the web for hosting accounts that come with a vulnerable version of PHPMyAdmin... Our information shows that the vulnerable versions of PHPMyAdmin range from 2.5.6 to 2.8.2.”

The attacks being staged from MIT’s resources is just one incident from one location. Other compromised hosts have been scanning the Web for vulnerable sites since 2010. These types of attacks are how BlackHat SEO scams are propagated, which target search results in order to spread rogue anti-virus or other malware. In addition, compromised hosts are also leveraged for other schemes, such as spam or botnet control.

Detecting a compromise is as simple as reading logs.

Early compromise attempts were initiated with w00tw00t, or “knock knock” string:""

http://www.securityweek.com/hacked-mit-server-used-stage-attacks-scan-vulnerabilities
http://www.malwarecity.com/blog/hacked-edu-website-serves-all-you-can-eat-dos-1199.html