iPhone 4 Order Security Breach (Again AT&T?)

From Gizmodo

Apple's iPhone 4 pre-ordering has been a total disaster, but it gets much worse: An AT&T insider claims that this iPhonecalypse may be related to "a major fraud update that went wrong." The bug is exposing AT&T users' private information.

So far there have been at least three accounted cases of mistaken identities sent by Gizmodo.com readers. This is how it happens: A customer tries to log into their AT&T account to order a new iPhone 4 upgrade. Despite entering their username and password, the AT&T system would take them to another user account. This gives access to all kinds of private information about the mistaken customer: Addresses, phone calls, and bills, along with the rest of private information, becomes exposed to random strangers.

The latest case comes from reader John King:

From: john king
Date: Tue, Jun 15, 2010 at 2:04 PM
Subject: ATT WEBSITE LOGS ME IN AS ANOTHER CUSTOMER
To: tips@gizmodo.com

I LOGGED IN AS ME AND IT BROUGHT UP A MARY ???? BIG PROBLEM
-JPK

But according to an AT&T insider, there could be a lot more happening which are not being reported. These login problems, according to the source, are probably linked to an AT server software update that went wrong this weekend [Emphasis added]:

I work at a 3rd party order processing facility—what AT&T refers to as a 3CC. We process business-to-business, business-to-customer Wireline Indirect, and ACME/PAC (what AT&T calls their iPhone program internally). Agents use AT&T programs called Phoenix, Telegence, Compass, Ordertrack and myCSP to process orders.

Over the weekend there was a major fraud update that went down on all of AT&T's systems, from Saturday overnight to Sunday early morning. All systems were down and agents were unable to use any systems.

The issues people are seeing at AT&T stores and online are most likely related to this update that went wrong.

I do know that there was absolutely NO TESTING of this system done before the launch of the new iPhone. I know it's just heresay at this point, but I can confirm that there was a major outage over the weekend that impacted all ordering systems and programs, and I can confirm that there were multiple systems being upgraded/updated, with some updates being related to fraud.

At this point, I can say that the system that AT&T uses to send automated orders to be processed is as of this very moment down completely. Our facility is unable to process any orders by phone or by automation.

[Regarding the identity problem] Whenever we see people who are logging in and seeing other customer's account info, it is an issue with the databases that contain customer information. Orders that contain any information like this can cross customer information, and cause a customer be able to see other accounts by logging out and logging back in. This means that when they log in a few times, it gives them different customer account info every time. It's a rare occurrence, but it has happened in the past.

You might want to advise people to not get the upgrade at this point as it may be a doorway to a major privacy breach.

Unfortunately it appears that even if you don't upgrade your private information could be exposed as other people try to upgrade, allowing accidental access to your account. After we reported on the initial security breaches this morning, AT&T took down their account online system completely.

At this time (3:34PM EDT), the account system is back online, but the iPhone 4 eligibility page is still down.

AT&T and Apple have not issued any statement about this security problem or the nationwide pre-order disaster.

Rapid7 Newsletter - June Issue

Metasploit Express Beats Core Impact Professional and Immunity Security’s Canvas in Hack Miami

Recently, Rapid7’s new Metasploit Express was put to the test against Core Impact Professional and Canvas and came out on top in the HackMiami Hack-a-thon. HackMiami is made up of information security professionals, hardware engineers, network administrators, students, and those who simply enjoy technology. To see the results of the Hack-a-thon, check out the Scorecard where you’ll see how each solution performed in the areas of Interface, Exploits, Reporting, Value, and Additional Features. 

For those not yet familiar with Metasploit Express, it is an affordable, easy-to-use penetration testing solution that provides full network penetration testing capabilities, backed by the world’s largest, fully tested and integrated public database of exploits.

To learn more about it, hear HD Moore, Chief Architect of Metasploit, share details on how it can make a difference in your organization.

Weak passwords = Easy to Hack

I am amazed at the feedback of our bake-off.  Some questions revolved around the fact that a tool used exploits against weak passwords and SMB shares.  This is still a major security problem.

Users still make hacking easy with weak passwords

In response to our bake-off, Core Security Blog, noted that the product does not exploit that unless you unlock the feature.  It should be noted that at a previous HackMiami event, we identified that the cash register had an exploit that allowed us full access to the Credit Card System.  It was weak passwords/SMB.

It doesn't matter how many locks one has on their doors.  If you don't shut the door, the locks can't save you!!!!

Released Updates for Core IMPACT Professional last week

Archive Searcher Zip Buffer Overflow Exploit (NOCVE-9999-43282)

Released: 2010-06-07

Category: Exploits/Client Side

Targets: Windows

The vulnerability is caused due to a boundary error in Archive Searcher Zip, when processing ZIP archives, which can be exploited to cause a stack-based buffer overflow by e.g. tricking a user into searching in a specially crafted ZIP archive.

----------------------------------------------------------------------------

Novell ZENworks Configuration Management UploadServlet Remote Code Execution Exploit (NOCVE-9999-43302)

Released: 2010-06-07

Category: Exploits/Remote

Targets: Windows

A remote code execution vulnerability in the UploadServlet component of Novell ZENworks Configuration Management allows remote attackers to execute arbitrary code.

----------------------------------------------------------------------------

ZipWrangler Buffer Overflow Exploit (NOCVE-9999-43301)

Released: 2010-06-07

Category: Exploits/Client Side

Targets: Windows

ZipWrangler contains a buffer prone to exploitation via an overly long string. The vulnerability is caused due to a boundary error in ZipWrangler when handling .ZIP files. This can be exploited to cause a stack-based buffer overflow via a specially crafted .ZIP file.

----------------------------------------------------------------------------

Microsoft Office PowerPoint Sound Data Exploit (MS09-017) (CVE-2009-1128)

Released: 2010-06-08

Category: Exploits/Client Side

Targets: Windows

Microsoft Office PowerPoint allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 95 native file format.

----------------------------------------------------------------------------

Adobe Acrobat Reader authplay Exploit (CVE-2010-1297)

Released: 2010-06-08

Category: Exploits/Client Side

Targets: Windows

This module exploits a vulnerability in Adobe Reader when parsing .PDF files. The vulnerability is caused due to a boundary error in authplay.dll when handling crafted malicious Flash (.SWF) file or by embedding a malicious Flash application in a .PDF file.

WARNING: This is an early release module. 

This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation.

----------------------------------------------------------------------------

Exploit Improvements Update Package (CVE-2009-3676 CVE-2010-0016)

Released: 2010-06-10

Category: Denial of Service/Client Side

Targets: Windows

This update improves exploit functionality and exploit documentation.

----------------------------------------------------------------------------

Apple Safari Use-After-Free Rtl Exploit (CVE-2010-0049)

Released: 2010-06-10

Category: Exploits/Client Side

Targets: Windows

A use-after-free vulnerability in WebKit/Apple Safari (in versions prior to 4.0.5) allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via HTML elements with right-to-left (RTL) text directionality.

----------------------------------------------------------------------------

Microsoft Windows helpctr Invalid URL Processing Exploit (CVE-2010-1885)

Released: 2010-06-11

Category: Exploits/Client Side

Targets: Windows

This module exploits a vulnerability caused due to an error in the MPC::HTML::UrlUnescapeW() function in helpctr.exe when escaping URLs.

WARNING: This is an early release module.This is not the final version of this module. It is a pre-released version in order to deliver a module as quickly as possible to our customers that may be useful in some situations. Since this module is not the final version it may contain bugs or have limited functionality and may not have complete or accurate documentation.

----------------------------------------------------------------------------

What’s the Difference Between Viruses, Trojans, Worms, and Other Malware?

http://lifehacker.com/5560443/whats-the-difference-between-viruses-trojans-worms-and-other-malware