Slashdot Mirror
Cross-Site-TRACE
quackking writes "Uh-oh! Looks bad for RFC 2068! Kudos to WhiteHat out of Santa Clara, CA for this one. ALL current web servers comply with this RFC, which means they ALL are vulnerable to this newly named attack - XST - cross-site-trace.
When misused, TRACE, part of the HTTP protocol, allows an unauthorized script to be passed to a Web server for execution even if the server is secured against running such scripts. Even devices like web-managed routers are open to this."
Let's see... he's got the blog, online sellers, copies of it online in all the great formats, a blog, and even the desire to put it on P2P sharing services. Don't forget the /. post.
Not many look to writing books for fun these days, perhaps I shall click on his advertisements to give him some support.
--------
Free your mind.
highly popular blog
apparenlty a bit to popular right now:-)
When will I end this grieving ? When will my future begin ?
... he's also doing a bit of groundbreaking with the release of this book. He's selling it, and, distributing it under a Creative Commons licence at the same time. You can download it in TXT, HTML and PDF here.
So he isn't getting raped by a publishing company? Thats a good thing, a friend and I talked about this type of thing yesturday...
Seems to use neither science nor fiction.
I find that most stories I peruse contain such far-out "scientific principles" that the events that occur could never happen anywhere on this planet.
Then again, some parts (even in Doctorow's 0wnz0red series) are simply stolen facts from things that have already happened and been talked about in the news.
I find it ironic that the best new science fiction works are not science and barely contain any fiction.
Reply or e-mail; don't vaguely moderate. Ex-O'Reilly/MIT employee, now a full-time Google employee.
first off, i remember when slashdot posted his short story "0wnz0red", and i really enjoyed reading it...
secondly, not that i'm saying i'm cheap or anything, but why would i go buy the book, when i just downloaded the pdf for free?
"Facts are meaningless. You could use facts to prove anything that's even remotely true." - Homer Simpson
When this was a physical magazine, it was one of the most fun, intelligent and readable cyber magazines ever. I bought my copies at the short lived Binary Cafe in Toronto (three computers on dialup to the net...) - and now I can't find them.
/. effect ends.)
Kind of like Mondo 2000, Wired and National Lampoon (jeez - anyone here remember when those were good?) all rolled into one. Now it's a web site and a HECK of a mail list.
Highly recommended and I'm looking forward to DLing the book. (As soon as the
It's Christmas everyday with BitTorrent.
Got his little chapbook right here, signed even. And if you flip though the pages, the donkey changes into a boy, or is that the other way around?
One line blog. I hear that they're called Twitters now.
I thought the Magic Kingdom was the happiest place on earth? If you cry Mickey will give you free gifts.
I started to rely to this with a post telling the parent to "save the phony B.S.". Then the light came on. Whoops, I'm a little serious today.
"Give a woman two glasses of wine and some pad thai, and they'll agree to just about anything." the Sports Guy
Supprisingly, while the click to page view is a little slow, the site is holding well under the strain. And my d/l of the book screamed. Someone was ready :)
Started reading the prolouge on the screen, but just decided to print it out. Starting out as a neat story. Although the continued lack of specifics might drive me nuts.
Grab it at Mirrored on an OC3
TODO: Something witty here...
If you look at the link, it's http://www.craphound.com/down/
Yep, that's exactly how it is, "down".
IIRC the slashdot crowd or at least the ones modded 2+ hated his short story on salon. I thought it was ok, though a bit contrived. I'm all for a new sci-fi author getting his works out, and his distribution methods seem very /. friendly; I still have to wonder if the content is all that good though. Guess I'll be reading it myself.
sigh.
You can only be young once, but you can be immature forever.
http://www.mit.edu/~dmark/palm/
-karlcritz
except without the talent! Oh boy!
Doctorow has a tin ear.
By the way, the PDF file of this book is not secure. It has no Adobe security applied. So, you can make changes, extract text, add whatever you want to the "book" Now was that on purpose or by accident, Cory. Enquiring minds want to now.
I don't know how others were rated for their comments, but I would agree, the short story on Salon, "Ownz0red" or whatever he called it was poorly written.
The plot was rather weak and contrived, the story flat and barely interesting. It just wasn't a good story. I think folks here "liked" it because it was superficially about tech, human-cyborg stuff (programming your DNA) and the millitary industrial complex (yeah, those bad CIA/NSA/millitary guys programming super soldiers).
Sorry, I've seen better stories and plots on Amateur's night on the Sci-Fi channel. It certainly doesn't make me want to try reading anything else by the same author.
Isn't it funny to read the words "You can download it here" in Slashdot's Front Page, when we all know you can count in the fingers of one hand the number of instances of "here" capable of surviving the honor?
who noticed the first (0wnz0r3d) book sucked? Just think about the premise for a second: suddenly it's possible to completely manipulate human phsysiology on every level, not because of some miracle scientific advancement but simply because programmers with little to no medical knowledge get a crack at it?
Oh No! better watch out or those 1337 h4x0rs will hack into your DNA and turn you into a flying monkey!
From Here to Eternity...
Your schlong is much too long, dear.
Too bad for you!
Who are you giving that present to?
To be or not to be...That question is just too damn difficult to answer!
Me too!
I agree!
Besides, critics should rarely be taken seriously; they tend to pan creators because they themselves cannot create.
OK, I've seen at least eight posts from Doctorow about his own literature on BoingBoing. The shameless self-promotion is getting old. Now this?
Well.. I just finished reading it, only took about three hours.
It had more than it's fair share of netizen and unix speak,
but the writing style and story rocked my casbah.
Highly recommended by this AC
Technically, Baen already broke the ground. Hey, they've given away an entire CD-ROM of books, under the same terms. Granted, they didn't use a specific license, but it says right there on the disk that you're allowed to copy and share but not sell its contents.
It sure is nice to see Doctorow jumping on the bandwagon, though.
Editor Emeritus and Senior Writer, TeleRead.org
Finished reading "Down and Out", and it's pretty good. Not brilliant or classic or anything like that, but more than good enough that I'd be willing to pay for the dead-tree version, even though it's pretty short (67 pages). It's got a very nice, twisted sense of humor, definately worth the read.
I'm the stranger...posting to
Preaching to the choir, half of whom are asleep and the other half can't sing. The pews are empty. You GO, boy.
It would appear that the publishing industry and the recording industry are similar in that they are difficult to get into and tend to "stiff" new artists/authors. Of course the recording industry is difficult to get into because they're looking for the next 18-24 year old Britney Spears clone and the publishing industry is difficult to get into unless your work has something that will sell (for sci-fi your works these days either have to be attached to a franchise or be militaristic in nature).
The main difference, as far as I can see, is that this author and, say, Bruce Eckel, is that they also publish their works through major book publishers. There's lots of websites wherein you can download the entire CD of a small artist, usually the ones who press their own albums on CD-R. But as soon as these guys sign to a major record label, this practice goes away. How it is that TOR is allowing Doctrow to do this is beyond me. No way would they let Robert Jordan release Wheel of Time 10 this way.
But something occured to me - this is a book that's like 136 pages (though Amazon says the hardcover is 208). And it's being published in hardcover for $22.95. That's more than most DVD's or CD's. You can usually pick it up for less than that, but doesn't that seem a little pricey to anyone else? I know that hardcover first issue books are steep, like $29.95 for Wheel of Time 10, but that's a 700 page book whose target audience is rabid about it. Shouldn't a 136 page hardcover book be a little cheaper?
Even better question - how come no one complains about this? People complain about the price of a lot of things - CD's, DVD's, Movies, etc. but they never complain about the price of books. Of course you can download your music if you really want to, you can wait for the movie to hit DVD, you can download the DivX of the movie/DVD if you can find it, and the DVD is loaded down with extras so you don't feel jipped. Could uneasy accessibility to books in digital form be the reason no one complains about their prices?
And what will this do to the mix? Will authors release their material this way in the future in the hopes that being noticed will land them a book deal so they can sell copies to all of those who want a keepsake of something they read for free? Will this guy sell a ton of copies of this book because he was on a Slashdot story? Will this work on a fiction document (Eckel's works are programming books)?
Can the recording industry learn a thing or two from the publishing industry? Or is it the other way around? And whose cause does it help if the Slashdot community buys a ton of this book?
Schnapple
You could download the itsy-bitsy Palm PDB version and read it wherever you go without having to lug around a microforest!
That's freakin' genius, you ask me. In the Beginning was a good read too, and I think it's because I could read it on my Visor that I've enjoyed reading it over and over whenever the mood strikes me. On the bus, waiting in the line at the bank, over dinner... I love it.
assuming you're serious about having read a book on your Visor, how much text could actually fit on one screen?, i mean, it seems like it could get pretty annoying having to scroll down after every two sentences or someting like that...
"Facts are meaningless. You could use facts to prove anything that's even remotely true." - Homer Simpson
I haven't laughed that hard in months!
...
Your journal is hillarious!
Also, I've never seen anyone admit that they had terrible karma
For anyone who needs to laugh REALLY hard, check out this journal! I read it five minutes ago, and I'm still laughing!!!
HallmarkOrnaments.Com
"Downloading a novel from the net is not something I'd ever likely do myself, but mainly because reading novels on the screen of a PDA is something I might get into only if I were incarcerated, with no alternative. ... You could have sex relatively comfortably on a platform of books, but not on a platform of PDA's. Hardcover books. Paperbacks might start sliding around. Though I'd still prefer paperbacks to a pile of PDA's." -- William Gibson
It's called Karma, dude.
Just read it, and I liked it.
Felt kinda bad for the guy, I was in the exact same situation he was in with Lil. Girl I was with, good friend, you see where that goes.
Story got to me, very well written though.
-------------------------------------------------
because Whuffie doesn't exist yet. Karma won't buy you a beer, according to my local Tavern owner.
The Three Major Kind of Tools
* Tools for hittings things to make them loose or to tighten them up or
jar their many complex, sophisticated electrical parts in such a
manner that they function perfectly. (These are your hammers, maces,
bludgeons, and truncheons.)
* Tools that, if dropped properly, can penetrate your foot. (Awls)
* Tools that nobody should ever use because the potential danger is far
greater than the value of any project that could possibly result.
(Power saws, power drills, power staplers, any kind of tool that uses
any kind of power more advanced than flashlight batteries.)
-- Dave Barry, "The Taming of the Screw"
- this post brought to you by the Automated Last Post Generator...
This isn't at all related to whats going on right now is it?
...this is responsible for the massive DDoS attack happening right now.
It is not likely to be related to the current DDOS, which seems to be this MS vuln.
The script is not executed on the server. It is executed on the client.
This is a sort of cross-site scripting vulnerability, not an "execute arbitrary commands on any web server" vulnerability like the writeup suggests.
Your Computer Is Currently Broadcasting An
Internet IP Address. With This Address, Someone Can
Immediately Begin Attacking Your Computer! [ OK ]
Shut up Slashdot. I get all the Security Alerts I need from media*.fastclick.net.
Help savingAmigaOS and a free PowerPC market
This story is utter alarmist crap. There is nothing wrong with TRACE, and the internet is not falling apart. It's just another IE cross-site scripting vulnerability. Here's a few choice links from the discussion on bugtraq:
2 003-01-22/2003-01-28/0 2 003-01-22/2003-01-28/0
http://online.securityfocus.com/archive/1/307778/
http://online.securityfocus.com/archive/1/308165/
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
Back to the drawing board, methinks. >p>Seriusly, yes, it's always an issue with a vulnerability discovered by a white hat - but on the whole, it's probably better that folk know about it than have to start figuring out what happened *after* they got hit with it.
[FUCK BETA]
This report is just nonsense. TRACE causes the web server to send a reply containing a 'body' part consisting of the request headers. Well, so what. Getting to the cookies enclosed with said request is not made any simpler by this method. The TRACE request method makes life no more joyful for those who would do your system harm. (Juicier than ActiveX and straight-ahead annoying VBScript/ECMACrap? Nope. More satisfying than polluting p2p with trojans? Nope.)
I just finished reading this so-called whitepaper and the press release, and
all I can say is hyped, sensationalised snakeoil.
The HttpOnly cookie feature, a proprietary Microsoft extension designed to
mitigate a single aspect of XSS, can be circumvented in myriads of ways. In
fact, reading the HTTP response in any other way than through the
document.cookie property immediately exposed through JS will return the
cookie to you. Calling from JS to a Java applet that in turn parses a HTTP
response, using a Flash movie (or most any other plugin) or even needlessly
complicating matters by parsing the BODY of a TRACE response received
through XMLHTTP - such as this 'whitepaper' suggests.
By design, HttpOnly makes the cookie available only through the HTTP
headers - which, among many others, the XMLHTTP control can read.
What we end up with from WhiteHat Security is a way to circumvent the
HttpOnly cookie feature in IE6SP1, nothing else. In itself, worthy of a note
in a roundup of browser problems or a comment in a reply to the posting
announcing the HttpOnly feature on Bugtraq - but hardly a whitepaper,
pressrelease and blurbs such as comparing this to Code Red and Nimda or
calling this a flaw in all web servers worldwide. This is simply not "a new
class of web-app-sec attack" or a flaw in TRACE, as hyped by WhiteHat
Security.
System administrators should most definitely not waste their precious time
on implementing the silly workarounds suggested, such as disabling
TRACE/TRACK requests. The one, and only, impact the discovery from WhiteHat
Security has is that it re-enables cookie reading from JS despite if you had
already cared to specifically alter your webapplication to accomodate this.
in short, absolute FUD dreamt up by some "whiteHatSecurity" bahaha
From the article: users of both Internet Explorer and Netscape are equally at risk to the same vectors of attack.
will it effect Opera browser?
.
#3 pencils and quadrille pads.
If your applications aren't vulnerable to XSS, you have nothing to worry about w.r.t. HTTP TRACE. If your applications ARE vulnerable to XSS, you have bigger problems than HTTP TRACE.
If users visiting other sites somehow have untrusted code running in them, which performs an HTTP TRACE to your site, the user's browser is broken for not enforcing domain restrictions.
Ignore this advisory, it's sensationalist snakeoil. Leaving HTTP TRACE enabled is harmless (although you probably don't use it, so disable it anyway).
Browsers routinely keep secrets from local scripts, like authentication responses or cookies for other realms. I wonder if Sun thought about this when they designed the sandbox (an applet needs to be granted the privilege of sending requests to any server other than the one it's hosted on).
Sheesh, I thought my university's Residential Computing department was to blame. They've been pretty damned unreliable all year, but if everybody's having this problem I guess it's not their fault.
So the Internet, which is supposedly impervious to a nuclear barrage, has succumbed to a simple attack from some moderately skilled hacker(s). Amazing how much more damaging sheer traffic volume can be than a physical destruction of the network, eh?
At least people will soon be able to continue downloading things like this. (Beware, it's > 3 gigs--a long download from my slow connection!)
I found the meaning of life the other day, but I had write-only access.
Why do people make posts like this? Mod this guy down!
I found the meaning of life the other day, but I had write-only access.
Yes .. A massive DDos is going on...
40% of the sites on the net are not responding...
January 22, 2003
Web Vulnerability Puts Internet Users, Sites At Risk
ByDavid Worthington, Freelance Writer, special to ExtremeTech
January 23,2003 9:10AM
IE Vulnerability Puts Internet Users, Sites At Risk
BugTraq-Thor Larholm
--
#3 pencils and quadrille pads.
Resent-From: mbac@romulus.netgraft.com From: Michael Bacarella Date: Fri Jan 24, 2003 11:11:41 PM America/Los_Angeles Resent-To: bugtraq@securityfocus.com To: nylug-talk@nylug.org, wwwac@lists.wwwac.org, linux-elitists@zgp.org Subject: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434! I'm getting massive packet loss to various points on the globe. I am seeing a lot of these in my tcpdump output on each host. 02:06:31.017088 150.140.142.17.3047 > 24.193.37.212.ms-sql-m: udp 376 02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp: 24.193.37.212 udp port ms-sql-m unreachable [tos 0xc0 It looks like there's a worm affecting MS SQL Server which is pingflooding addresses at some random sequence. All admins with access to routers should block port 1434 (ms-sql-m)! Everyone running MS SQL Server shut it the hell down or make sure it can't access the internet proper! I make no guarantees that this information is correct, test it out for yourself! -- Michael Bacarella 24/7 phone: 646 641-8662 Netgraft Corporation http://netgraft.com/ "unique technologies to empower your business" Finger email address for public key. Key fingerprint: C40C CB1E D2F6 7628 6308 F554 7A68 A5CF 0BD8 C055
-- sigs suck --
To re-iterate: your web server or site isn't vulnerable because it supports trace, that's about as silly as blaming ping packets for the ping-of-death problems on early windoze systems, sheesh.
This is all a bunch of crap that requires a browser to be vulnerable to cross scripting, and for the user to have visited a malicious site just beforehand.
Resent-From: mbac@romulus.netgraft.com
From: Michael Bacarella
Date: Fri Jan 24, 2003 11:11:41 PM America/Los_Angeles
Resent-To: bugtraq@securityfocus.com
To: nylug-talk@nylug.org, wwwac@lists.wwwac.org, linux-elitists@zgp.org
Subject: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!
I'm getting massive packet loss to various points on the globe.
I am seeing a lot of these in my tcpdump output on each
host.
02:06:31.017088 150.140.142.17.3047 > 24.193.37.212.ms-sql-m: udp 376
02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp: 24.193.37.212 udp port ms-sql-m unreachable [tos 0xc0
It looks like there's a worm affecting MS SQL Server which is
pingflooding addresses at some random sequence.
All admins with access to routers should block port 1434 (ms-sql-m)!
Everyone running MS SQL Server shut it the hell down or make
sure it can't access the internet proper!
I make no guarantees that this information is correct, test it
out for yourself!
--
Michael Bacarella 24/7 phone: 646 641-8662
Netgraft Corporation http://netgraft.com/
"unique technologies to empower your business"
Finger email address for public key. Key fingerprint:
C40C CB1E D2F6 7628 6308 F554 7A68 A5CF 0BD8 C055
-- sigs suck --
So, I'm not the only one noticing this evilness? That makes me happy, for some odd reason.
I was pondering if my ISP was have a seizure or something...
If it's a MS exploit, then that doesn't explain why at least one website I tried to get to is down, but it explains the rest of them.
Can you imagine the royal slashdotting that RIAA/MPAA/MS/etc would receive if the thousands of script kiddies that read /. suddenly had access to such a thing?
Perhaps this is what Obi-Wan was talking about when he felt the tremor in the force, and the whole Alderaan blowing up thing was just a bizarre coincidence...
"To confine our attention to terrestrial matters would be to limit the human spirit." -Stephen Hawking
As been discussed on BugTraq the latest days, this is not a 'general' vunerablility, rather a bug in Microsoft's XMLHTTP component (nomatter what the whitepaper says).
References: RE: TRACE used to increase the dangerous of XSS.
Original posting to Bugtraq
Tomorrow headline will read: /. effect, as it is known, was determined to be the cause after the servers started rejected requests from the referrer "slashdot.org". In related news, 98% of DNS lookups are not necessary.
Internet Slowdown Due to Slashdot Readers.
What was actually thought to be a DoS attack turned out to be the insomniac slashdot readers believing there is a problem on the net. The
Without them on 99% of the recent browser/http/www problems go away. And 100% of the popups go away too. Sure you stop being able to view many sites, but most of those sites that lock you out when you don't have this stuff on are full of junk anyway.
Given what this attack can do, you have to 100% trust any site which you visit with these active stuff on, because they can use the active stuff to snarf your cookies and info for other sites.
In this light, how should you treat a site which absolutely _requires_ you to turn such dangerous stuff on in order to use their site? Is it worth all that potential hassle just to see some stupid shockwave which only the PHB likes?
Is there a javascript/activex/java program that will turn off javascript/activex/java support in a viewer's browser?
I also proposed a tag to mark regions of HTML as unsafe so the browser ignores any javascript/active stuff that slips through the site's filters. But there wasn't any interest. This doesn't help if users visit malicious sites, but it helps decent sites protect their users from stuff slipping through.
The TRACE method is used to invoke a remote, application-layer loop-
back of the request message. The final recipient of the request
SHOULD reflect the message received back to the client as the
entity-body of a 200 (OK) response
.
#3 pencils and quadrille pads.
The article is about a new exploit they are talking about... nothing to do with the current mess.
I'm watching my firewall logs fill up even as I type, and all the 1434 hits are coming from different IPs... no dupes yet that I can see (maybe there are... but I'm not planning on sitting here all night reading logs).
These SQL attacks are coming from a plethora of different ports on the machines that are hitting me... anybody know if this is a normal part of this worm's behavior?
Even if a man chops off your hand with a sword, you still have two nice, sharp bones to stick in his eyes.
Two T3s with Quest: DOWN. Port udb traffic 1434 totally flooded. Uplinks have their heads up their asses and have no answers at this point. My uplink says he has a Linux server that when activated starts spamming port 1434. Is this or is this not a MS SQL-related issue?
I'm up because I'm multi-homed and I have no MS servers at all running on my network, but every other network that i know of running some MS servers is having blackouts.
We need to find out what is going on right now, and we need to make sure the media does NOT misrepresent exactly what is at fault. Everyone here has a responsibility!
props man, you got em fired up with the old classic "steal text from site to make it look as if you know what you are saying" gag
watch the small penis/karma whores point it out for you
Unix does not have a very good security record as of late either, zealot.
"If you want to be 100% compliant with RFC 2068, a document defining the standard behavior of the world wide web, you must include TRACE." noted Lex Arquette, Chief Technology Officer of WhiteHat. http://www.whitehatsec.com/press_releases/WH-PR-20 030120.txt
:-)
Strange... RFC 2068 seems to be obsoleted by RFC 2616 since June 1999...
This would explain why allmost all of the hostways [www.hostway.com]servers (at least their windows servers) are down right now, and through parts of the day. Their excuse what "backbone conectivity".
If someone who is behind a firewall or just wants see the traffic but can't get to it, I've listed what my router has been seeing lately: Click here.
Unix loses because it comes with more and with too much switched on by default.
Note the story submitters name.
Quack King.
Next!
--LP
Here's what we've been able to learn, at 4:30am Central time.
We have reason to believe that something called the "SQL Worm" is in play. Some sort of DDOS attack which creates overwhelming traffic on port 1434. This is all preliminary stuff, so take it as such but I have one link up and 3 others down.
I don't have confirmation or details on what systems are affected but we have information to indicate that the following networks are currently affected: Quest, Cable & Wireless, Broadwing, Sprint (partially). My Worldcom link seems to be unaffected (which is why I can post). Note that the connectivity interruptions may be regional but that's what we are dealing with in the South Central area of the US. This has been going on now for about 4-5 hours.
What we are seeing is a major outage due to DDOS on port 1434, on portions of the Internet backbone. At this point, the exact pattern of the outage has not been clarified.
Expect the problem to potentially be addressed when the backbone providers start filtering port 1434. However, it's taken them at least four hours to figure this out.
We just got notice (a few moments ago) that Quest finally started filtering port 1434 and everything went back up. So now we need to figure out what vulnerability this was. My information indicates that port 1434 is MS SQL server resolution service (see related CERT advisory. My initial impression is that while this vulnerability was discovered awhile back, someone just recently figured out a very effective exploit using the vulnerability. I am looking forward to hearing more about what people find out.
Umm no... this happens to be an MS exploit.
In particular, it affects XMLHTTP.
See here and here
I have 13 internet kiosks around 2 metropolitain citys, all of them are on roadrunner cable and qwest dsl. I have not expierenced any problems with this systems. My hosting provider on the other hand.....
Apparantly "ALL" web servers are *not* open to this "exploit" - here's a post someone made on macintouch.com:
When I read the article on MacInTouch about the TRACE security flaw, I immediately checked our Mac based servers to find out if they support the TRACE option in HTTP. Here's a summary of the servers and the OPTIONS they support. These results were shown after connecting to the server via telnet:
%telnet www.domain.com 80
Trying 123.123.123.123
Connected to www.domain.com.
Escape character is '^]'.
OPTIONS / HTTP/1.1
Host: www.domain.com
* WebSTAR 3.x answers: 405 Method Not Allowed
* WebSTAR 4.4 and 4.5 allows GET, POST, HEAD
* WebSTAR V allows GET, POST, HEAD
* Apache/1.3.27 (Personal WebSharing MacOS X 10.2.3): GET, HEAD, OPTIONS, TRACE
* Apache/1.3.27 (iTools - MacOS X Server 10.2.2): GET, HEAD, OPTIONS, TRACE
* Apache/1.3.27 (iTools - MacOS X Server 10.2.2 - PHP 4.x): GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, PATCH, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK, TRACE
When connecting to a system that has PHP 4.x installed, a lot more options are available.
This only shows which options are supported by which servers, however as the exact details of the flaw were not published, it's hard to say if you can use those options to exploit a server.
Uh, MS told everyone about this ages ago. They produced a patch in MAY 2002.
It's just windows admins aren't as likely to patch their systems as unix admins are. (for various reasons)
What works for linux, might not work for windows.
There are two things going on here I suspect. There is a discussion on a cross-trace vulnerability, at the same time, some type MS SQL-based worm was unleashed late Friday which caused lots of problems. Two different issues. Excuse the inter-mingling.
I'm also noticing an equal number of hits on port 137.
After reading through the press-release, this seems to be just another way for a pathetic company to try get some publicity.
Until the sexbots come out, at least.
Not just inaccurate, but capitalized as well? What happened to basic research? OK, here is the peer review process in action: flame the poster of this misleading and alarmist article. What I would like to see on /. is super mod points that we can use to take down articles that don't meet even the basic requirements of accuracy.
I'm possibly not entirely objective here, since my team makes a web server that is current, fairly popular, and most definitely not vulnerable.
Sig for sale or rent. One previous user. Inquire within.
I haven't tried this yet!
Patriotism is the opium of the masses
Most sites don't store their user password in a cookie, they store a session ID in a cookie that translates to a session ID in a database. Then sensitive information is keyed up with that ID, on the server. The client never recives any of it, unless they are modifying it but it is never put in a cookie or other stateful client storage device.
Upon each page load, the IP address of the original session is checked with the sent cookie ID, and if they don't match, most applications will throw out the session completly. This annoys some with DHCP who like to maintain long sessions, but works a lot of the time for simple ID attacks (since most session IDs are generated from random numbers), because you now need to know both the IP and session ID of the user you want to impersonate. Granted, this can be had with a packet sniffer (for non SSL connections), but so can a lot of personal things. Next they'll be telling us it's quite easy to get into cars: just break the window. That doesn't mean its a security flaw.
Anyway, this is how most [good] sites work. Only fools store sensitive user information in cookies, and I would never subscribe to their site (yes, I check what goes in my cookies).
Also the article/press release (PR for this security company?) seems to be getting client/sever scripting confused, and is generally full of ignorant errors. How can it be trusted with the other claims it makes?
"I'll just chip in a bit for RedHat: I actually have that installed on my university machine." - Linus, '95
The Associated Press has now written about this attack:
Internet traffic broadly affected by electronic attack World Internet Lead
By Ted Bridis
Traffic on the many parts of the Internet slowed dramatically early today, the apparent effects of a fast-spreading, virus-like infection interfering with Web browsing and delivery of email.
Sites monitoring the health of the Internet reported significant slowdowns globally. Experts said the latest electronic attack bore remarkable similarities to ``Code Red'' virus during the summer of
2001 which also ground traffic to a halt on much of the Internet.
``It's not debilitating,'' said Howard Schmidt, one of President George W Bush's top cyber-security advisers.
``Everybody seems to be getting it under control.'' Schmidt said the FBI's National Infrastructure Protection Centre and private experts at the CERT Coordination Centre were monitoring the attacks.
The virus-like attack sought out vulnerable computers to infect on the Internet using a known flaw in popular database software from Microsoft Corp, called ``SQL Server''.
But the attacking software code was scanning for victim computers so randomly and so aggressively - sending out thousands of probes each second - that it overwhelmed many Internet data pipelines.
``This is like Code Red all over again,'' said Marc Maiffret, an executive with eEye Digital Security, whose engineers were among the earliest to study samples of the attack software. ``The sheer number of attacks is eating up so much bandwidth that normal operations can't take place.''
The attack sought to take advantage of a software flaw discovered in July 2002 that permits hackers to infect corporate database servers. Microsoft deemed the problem ``critical'' and offered a free repairing patch, but it was impossible to know how many computer administrators applied the fix.
``People need to do a better job about fixing vulnerabilities,'' Schmidt said.
If the pattern goes 9am, 10am, 11am, why isn't noon 12am?
Wouldn't it make more sense to download SQL Server 2000 Service Pack 3 instead, which supposedly includes the fix for this problem, among other fixes? See the advisory and click on Additional information about this patch to see that it's included in SP3.
Follow your Euro bills at EBT
http://www.apacheweek.com/issues/03-01-24
http://online.securityfocus.com/archive/1/30816
Have more details.
SQLServer listens to 1434 to accept incomming connections. SQLServer 7 would then normally transfer these connections to 1433 by default. SQLServer 2000 would transfer the connection to a random port.
It's best to 'hide' the SQLServer from the internet, and/or disable TCP/IP listening for SQLServer totally when it's connected to the Internet. MS also suggests SQLServer should never be exposed to the Internet directly. You can hide SQLServer (2000) directly, using the Server network utility, shipped with SQLServer. You can there first deselect TCP/IP as a protocol that's active, and if you need it, you can select 'hide' to hide the server on the internet, however it's better to disable TCP/IP totally, since you do not need it when you work with SQLServer from the same box (f.e. a website running on the same box accessing the SQLServer).
Oh, of course it should be mentioned, there is a patch for this available at MS' technet site.
Never underestimate the relief of true separation of Religion and State.
That's all.
It's lucky that the worm writer didn't make the worm fire out random traffic on random udp ports with spoofed addresses.
/sbin/iptables -I FORWARD -p udp --dport 1434 -j DROP
It's only the fact the traffic is all destined for a certain destination port that makes it easy to filter.
You are filtering it out on your firewalls, aren't you?
This could have been a lot lot harder to filter out. I expect we'll see ThisWorm v2 soon.
I dread the day someone finds a hole in Apache, Sendmail or something really popular and writes a worm like this...
Get your own free personal location tracker
http://www.cnn.com/2003/TECH/internet/01/25/intern et.attack.ap/index.html
SQL Server 2000 SP3 automatically upgrades MDAC to 2.7(sp1, I think), which could possibly break applications that are based on earlier versions of MDAC.
Microsoft says that it shouldn't break anything, but a developer I know swears that an application of his broke after MDAC upgrade, so you may end up getting stuck applying all of the hotfixes instead.
pw:secret
Look who got modded down, troll-bait!
MS-SQL server. I just shut that interface down but my network saw a HUGE influx of traffic starting around 00:45 EST. One of my customers colo'd machines was hit and started pumping 7.2M Bytes of traffic out to the net. I think it would have done more if he didn't chew up my DS-3 to Sprint.
The interface is down. The customer will be prompty kicked in the ass. There is 50mbps less junk traffic on the Internet now.
I've stopped taking the time to M2, why bother when the base quality of this feed has dropped this low. You-all want to enhance quality on this site? Consider an M-system for the original posts/editors.
Linux is Linux, if One need clarify their dist: <Dist>/GNU Linux
bsds are of course just BSD
lets blame him anyway
Do your best, hope for the best, suspect the worst.
gotcha mike, ok ill grab the shimding and sling it operwise to the fubnub if i can hook up the low latent TCX7381b 's and punch in the new local def's we should be able to cope, you just GOTTA keeps us touching base with the gabershwing and ill keep the boys locked and loaded cos this looks like a MAJOR situation we got ourselves down here.
YOU FUCKIN WANKER !
See here. It's still the best description I've seen of the "problem", but the AC really should have credited the source.
Mo Zilla
I know that is not what you wanted to hear... But I had to say it...
Vidomi Killer media player and network distributed media encoder
It looks like if you stop the proccess sqlservr.exe it will take all of the CPU proccess back down to normal. Obviously you dont want to delete this file, but with it stopped you can at least get the box on the network to trouble shoot this stuff.
Alchemy Support
Alchemy Communications
It can giggle all it wants. The galaxy's not gettin any of our Bourbon.
shit, Im still getting hit with LAST years micro$oft vulnerability! ;)
/usr/local/www/data/scripts/..À../winnt/system32/ cmd.exe /usr/local/www/data/scripts/..Á../winnt/system32/c md.exe /usr/local/www/data/scripts/..%5c../winnt/system32 /cmd.exe /usr/local/www/data/scripts/..%2f../winnt/system32 /cmd.exe
[Sat Jan 25 02:26:01 2003] [error] [client 66.57.128.6] File does not exist:
[Sat Jan 25 02:26:02 2003] [error] [client 66.57.128.6] File does not exist:
[Sat Jan 25 02:26:02 2003] [error] [client 66.57.128.6] File does not exist:
[Sat Jan 25 02:26:02 2003] [error] [client 66.57.128.6] File does not exist:
OK, perhaps I need more coffee this morning, but I cannot see how TRACE would be used to cause harm - perhaps somebody can post this in simple terms.
As I understand it:
1) My browser requests a page from www.evilhaxor.org.
2) ??????
3) My browser sends a TRACE request to slashdot.org.
4) slashdot.org sends back to my browser my cookie data.
5) ????
6) My browser sends ????? to www.evilhaxor.org.
7) ????
8) Profit!
OK, sorry, but having more than one ???? is sufficient to make a plan unworkable.
Besides, I run with Javascript off - so I guess the only real exploitable would be the Flash plugin (damn I will be glad when this bug is fixed!)
www.eFax.com are spammers
This is not an issue. The exploit uses existing, well-known vulns.in MS' IE. Nothing to see here. Move along, move along, read the Full Disclosure list for further background.
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
And other similar active content plugins your browser might have running.
;).
You can turn cookies off if you want, but that makes it hard to implement sessions between your browser and the site you are using. Implementing sessions by using cgi parameters has disadvantages like if your browser leaves to another site, your browser could send the cgi parameter in the http referrer field.
So if your browser supports it just turn on cookies for selected sites and leave it off for other sites. The risk with cookies - if sites work together they can track where you go and what you do.
Whereas with the active content stuff - javascript, activex, flash etc, you risk losing control over your entire computer, and your online accounts with other sites. Actually Java has been a tad more secure, but so far most java applets are either jokes or toys. You won't miss most of them, and it's likely they'll be ported to your cellphone anyway
Other scripts? They'd probably be just as dangerous, but most people don't have python/perl plugins in their browser, so attackers are less likely to cater for that.
Sure the risks aren't that high, it's just the consequences can be really annoying. You know that spam you get? Those by crooks who think nothing of sneaking in installs of software that dial up international numbers? If you or your cat accidentally clicked one of their urls, how sure are you that these crooks won't abuse this trace flaw to steal info? They can get your browser to send trace requests to the usual sites - banks, ebay, amazon, hotmail, yahoo etc, and collect all the echoed associated cookies and authentication data.
Even turning such stuff off isn't 100%. Last year whilst testing something out I actually managed to create some sort of a virus/worm on a site just by using IFRAME or img src (quite harmless - but in theory could do other nastier things ). Got them to fix it tho. That sort of problem affects the site and info on the site. THe site is responsible for securing their apps to prevent this sort of thing.
You secure your computer and apps and hopefully your favourite site secures their stuff.
I would like to point out that in order to execute an "XST" attack, you have to be able to able to get JavaScript/Flash/etc executed on the victim's system as a PREREQUISITE.
So, to summarize:
If you can get arbitrary JavaScript/Flash/ executed on a web client, you can use this attack method to get arbitrary JavaScript executed on a web client, in a different zone, *if* their client is vulnerable to other attakcs.
Is this a useful thing to know if you're looking for a way to steal cookies? Sure! Is this a revolutionary tactic that will allow you to compromise the security of any of the webservers listed in the whitepaper? No.
This isn't any different from the many, many, many known ways of violating someone's HTTP client if you can get them to execute Flash or JavaScript or ActiveX of your choice. We've seen dozens of holes in IE's security constraints that allow attackers to view files, steal cookies or execute commands. Unlike Guninski or GreyMagic's advisories, this one has simply been built up to ridiculous proportions with marketting language in the press release and in the ExtremeTech article.
Furthermore, they do not adequately explain how this attack relies on other (more fundamentally mportant) vulnerabilties that WhiteHat did not find and that were announced without a press release, BS whitepaper of a garbage ExtremeTech article.
"ALL current web servers comply with this RFC, which means they ALL are vulnerable to this newly named attack "
Not all current web servers are vulnerable. For various reasons. I've written some that do not support TRACE (on purpose). Others exist that do not support TRACE. Others exist that do support TRACE, but do so after first performing their usual security code.
How in the world did these jokers even think that they covered ALL current web servers? There are going to be many dozens that exist that they haven't even heard of. Just one example: at my last job they use a server known as "Remy Web Server". Oh, as well as one I wrote called "Chupacabra" (but that's internal only). Have you ever heard of either? No? Good. You should be so lucky to never hear about RWS.
The discussion on this vuln is important, but claiming that it affects ALL current web servers is naive and serves only as big glossy headline-catching words.
OMG Duuds, teh Interweb iz fallingz down! Ring deh ISPee but zey hang up!!!1 Must now post 2 swashdot bout teh problehm ant spreed zeh snake oil in a post abouut zome ozther silly IE bug.
Fucking idiot
There can be no security vulnerability in HTTP that is due to cross site scripting PERIOD.
This is because support scripting was never considered in the design of HTTP. Scripting has known security problems. The onus for solving those problems rested and rests today on the idiots who introduced scripting. It has nothing to do with the protocol layer.
TRACE was in the HTTP specs long long before Javascript was cobbled together in two weeks at Netscape. Netscape could not even be bothered to ask for advice from the HTTP community before unleashing their abomination, so why is this supposed to be my fault eh?
Java script sucks, alwasy has always will. It was yet another of those hacks Netscape put in to please the advertisers or whichever customer they were going after that week. As a result we have pop-under adds and sites can screw up the navigation buttons. Oh yes and sites keep coming up 'javascript error class not found'.
None of the uses javascript is necessary for could not have been better supported through extensions to HTML. But the Netscape guys didn't want to do that because they wanted to try to control the standards by simply throwing whatever crap they wrote over the wall and faxing the 'specification' to W3C to they could say that it had been submitted in their press release.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
This is old news, but now that it is public I can't wait for the exploits to begin... that was sarcasm in case anyone was wondering...
This has absolutely NOTHING to do with the cross-site trace whitepaper/press release/article/issue. The SQL server worm (which uses a buffer overflow discovered by NGS Software) is 100% unrelated to this. YOUR POST is misrepresenting exactly what is at fault. Go post on the SQL Server worm thread.
I have seen actual in the file samples of this exploit..
Its crosss bwoser hack..
Here is what was observed on fuckedcompany forums..
You register as poster to fuckedcompany
Hacker A sets up new website with code to gather info via traceroute..
Hacker decode the subscriber cookie from pervious step..
Hackjer A reposts garabge as your nick on fucked company forums..
-Most admins of sites know enough to turn off traceroute.. well except Phil Kaplan it seems..sorry pUd you are soemwhat inept as systems admin..
Don't Tread on OpenSource