Security
New browser-fingerprinting techniques
Web tracking, which is generally used by advertisers to target their ads, is not popular in some circles—particularly with privacy advocates and privacy-conscious users. But it is also fairly pervasive. Originally, tracking was done using browser cookies, but tracking techniques have expanded over the years. A recent web survey has found several new ways that advertisers and tracking companies are fingerprinting browsers so that the users sitting in front of them can be tracked across the web.
The Princeton
Web Census is a study done by Steven Englehardt and Arvind Narayanan
to look at both cookie-based (stateful) and browser-fingerprint-based
(stateless) tracking on the top 1 million web sites. The survey was run in
January
by making some 90 million requests to those sites. The survey was run using OpenWPM, which is an
open-source project to make "it easy to collect data for privacy
studies on a scale of thousands to millions of site[s]
". In
addition, the data
gathered by the study is available for others to use.
The output of the study was a 24-page paper [PDF] that covers quite a bit of ground. The study looked at cookie-based tracking, as well as cookie syncing, where advertising/tracking companies share cookie IDs either in headers (e.g. the referrer header) or behind the scenes. There are some rather interesting findings, many of which are summarized on the pages linked above, but perhaps the most interesting findings are the new ways tracking companies are trying to fingerprint browsers.
The idea behind fingerprinting is straightforward; gather enough information about the user's browser and its environment (plugins, fonts, User-Agent header, localization settings, etc.) to uniquely (or nearly uniquely) identify the user. The Panopticlick tool from the Electronic Frontier Foundation (EFF) demonstrates the uniqueness of a user's browser. The current version of the tool uses some additional techniques, including canvas fingerprinting—drawing images into a hidden <canvas> element to measure the rendering differences between different browsers.
In the survey, canvas fingerprinting was found on more than 14,000 sites, where the actual tracking scripts came from roughly 400 different domains. The sites that use canvas fingerprinting (and the domains where the scripts originate) are listed on the web census page, as are those that use the newer fingerprinting methods described below.
Browser developers have taken some steps to avoid revealing high-value information like font lists, so the fingerprinters have made efforts to find workarounds. One that the study found uses the JavaScript measureText() method to provide font information. By attempting to draw a specific text string in a large number of fonts and comparing the width of the result to the width obtained using the default font, the tracking script can figure out which fonts are not present (since those will be drawn in the default font, thus have the same width). The study calls this "canvas-font fingerprinting" and found it on more than 3,200 sites. One third party (MediaMath) was responsible for most of the scripts found, but there are five other third parties found that are using canvas-font fingerprinting.
The WebRTC realtime communication feature is another vector for leaking private information that can be used in fingerprinting. In order to facilitate finding the best route between two peers, WebRTC nodes collect information on IP addresses of interest, including those used by local network interfaces (which may well be unroutable NAT addresses from behind a firewall). These addresses are made available to WebRTC, which leads to privacy concerns in its own right, but may also be used for fingerprinting purposes.
The researchers instrumented the WebRTC createDataChannel() and createOffer() API calls, then tried to determine if those calls were made for tracking purposes. In the top 1 million sites, 700 or so delivered scripts that accessed WebRTC, with more than 600 being used for tracking purposes. Furthermore:
Another clever "attack" (at least on privacy) uses the Web Audio API to detect differences in the hardware and browser implementation that provide some amount of information about the browser. It is unclear at this point whether there is enough information gleaned from that to provide a fingerprint, but it certainly can be used in conjunction with other techniques.
One of the tracking scripts using the Audio API is simply looking for the presence of certain elements of the API (AudioContext and OscillatorNode) to provide a single bit of information to a more widespread fingerprint. The other two take the output from the oscillator, do some calculations on it, and produce a hash. The researchers only found roughly 500 occurrences of the simplest technique, the other two total to less than 60. This new fingerprint method was found by analyzing known tracking scripts for the use of new APIs.
OpenWPM is Firefox-based, which allowed the researchers to test with certain add-ons that are meant to block tracking scripts, such as Ghostery and EasyList + EasyPrivacy. For the most part, these tools blocked the majority of the more widespread, canvas-based techniques (i.e. canvas and canvas-font) and had less success with the newer fingerprinting methods (i.e. WebRTC and Audio) on sites that use them. For both of these blocking mechanisms, which are blacklist-based, the more prevalent third-party scripts were blocked. That resulted in covering the majority of the sites, but not generally a majority of the scripts, as less-popular scripts that are infrequently used do not get onto the blacklist.
Overall, the paper makes for an engaging look at the user-tracking landscape of the web. It is a reminder that web browsers today have an enormous reach that can be exploited to identify their users. It will be yet another arms race in the digital world, where browser makers and standards groups seek to close or narrow the information leaks (to the extent they can), while advertisers and tracking companies try to find more ways to gather their precious data. But closing the holes is a balancing act and—since vast sums of money are at stake—one suspects that these companies will always find a way to track.
Brief items
Security quotes of the week
It can broadcast information via your speakers, and maybe even your microphone. It can encode data in the timing of your packets as they leave your system. It can encode data in it's power consumption, it can encode data in what it sends to the screen, it can send data out via bluetooth or wifi. There are probably more ways, that I didn't think of off the top of my head.
Linux containers vs. VMs: A security comparison (InfoWorld)
Over at InfoWorld, Jim Reno compares the security of virtual machines (VMs) and containers. "Which is more secure?" is a question that is often asked, but the answer, of course, is "it depends". Reno analyzes the attack surface of each to help in the choosing between VMs and containers. "Many legacy VM applications treat VMs like bare metal. In other words, they have not adapted their architectures specifically for VMs or for security models not based on perimeter security. They might install many services on the same VM, run the services with root privileges, and have few or no security controls between services. Rearchitecting these applications (or more likely replacing them with newer ones) might use VMs to provide security separation between functional units, rather than simply as a means of managing larger numbers of machines. Containers are well suited for microservices architectures that “string together” large numbers of (typically) small services using standardized APIs. Such services often have a very short lifetime, where a containerized service is started on demand, responds to a request, and is destroyed, or where services are rapidly ramped up and down based on demand. That usage pattern is dependent on the fast instantiation that containers support. From a security perspective it has both benefits and drawbacks."
A report on the CoreOS remote SSH vulnerability
For those who are curious about how the CoreOS remote SSH vulnerability came to be, the company has posted a detailed report. "This misconfiguration was abetted by confirmation bias. The expected outcome of the change to the CoreOS PAM configuration was for users who presented a password present in an authentication database to be successfully authenticated. Because of the pam_permit failure case explained above, this was the observed behavior in testing, so the change was assumed to be correct. No attempt was made to determine whether the observed behavior could be explained in some other way, such as the system allowing any presented password."
Mathewson: Mid-2016 Tor bug retrospective, with lessons for future coding
On the Tor blog, Nick Mathewson reports on an informal survey he did for "severe" bugs in Tor over the last few years. It breaks down the 70 bugs he found into different categories that are correlated with some recommendations for ways to try to avoid them in the future. For example: "Recommendation 5.1: all backward compatibility code should have a timeout date. On several occasions we added backward compatibility code to keep an old version of Tor working, but left it enabled for longer than we needed to. This code has tended not to get the same regular attention it deserves, and has also tended to hold surprising deviations from the specification. We should audit the code that's there today and see what we can remove, and we should never add new code of this kind without adding a ticket and a comment planning to remove it." Many of the recommendations are likely applicable to other projects.
New vulnerabilities
bugzilla: cross-site scripting
| Package(s): | bugzilla | CVE #(s): | CVE-2016-2803 | ||||||||||||||||
| Created: | May 20, 2016 | Updated: | May 31, 2016 | ||||||||||||||||
| Description: | From the Arch Linux advisory:
An attacker can craft a malicious summary within a bug report to host malicious javascript code. This code will be served to a user when he or she navigates to the bug's dependency graph. An attacker is able to submit a malicious bug report and execute arbitrary javascript code in the client's browser by using the bugzilla server as a pivot. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
curl: server spoofing
| Package(s): | curl | CVE #(s): | CVE-2016-3739 | ||||||||
| Created: | May 23, 2016 | Updated: | May 25, 2016 | ||||||||
| Description: | From the CVE entry:
The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate. | ||||||||||
| Alerts: |
| ||||||||||
dhcpcd: code execution
| Package(s): | dhcpcd | CVE #(s): | CVE-2014-7913 | ||||||||
| Created: | May 20, 2016 | Updated: | June 7, 2016 | ||||||||
| Description: | From the Mageia advisory:
The print_option function in dhcp-common.c in dhcpcd through 6.10.2 misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted message (CVE-2014-7913). | ||||||||||
| Alerts: |
| ||||||||||
extplorer: cross-site request forgery
| Package(s): | extplorer | CVE #(s): | CVE-2015-5660 | ||||
| Created: | May 23, 2016 | Updated: | May 25, 2016 | ||||
| Description: | From the CVE entry:
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code. | ||||||
| Alerts: |
| ||||||
gdk-pixbuf2.0: code execution
| Package(s): | gdk-pixbuf2.0 | CVE #(s): | CVE-2015-8875 | ||||||||||||
| Created: | May 20, 2016 | Updated: | May 25, 2016 | ||||||||||||
| Description: | From the Mageia advisory:
The gdk-pixbuf2.0 library is vulnerable to overflows in the pixops_composite_nearest(), pixops_composite_color_nearest() and pixops_process() functions in pixops/pixops.c (CVE-2015-8875). | ||||||||||||||
| Alerts: |
| ||||||||||||||
graphicsmagick: denial of service
| Package(s): | graphicsmagick | CVE #(s): | CVE-2016-2317 CVE-2016-2318 | ||||||||||||||||||||||||||||||||||||
| Created: | May 23, 2016 | Updated: | September 12, 2016 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Debian LTS advisory:
Vulnerabilities that allow to read or write outside memory bounds (heap, stack) as well as some null-pointer derreferences to cause a denial of service when parsing SVG files. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
kernel: two vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2016-4569 CVE-2016-4558 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 25, 2016 | Updated: | May 25, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-4569: A vulnerability was found in Linux kernel. There is an information leak in file sound/core/timer.c of the latest mainline Linux kernel, the stack object “tread” has a total size of 32 bytes. It contains a 8-bytes padding, which is not initialized but sent to user via copy_to_user, resulting a kernel leak. CVE-2016-4558: A flaw was found in the Linux kernel's implementation of BPF in which systems with more than 32GB of physical memory and unlimited RLIMIT_MEMLOCK settings an application can overflow a 32 bit refcount. Additionally in the same environment, malicious applications can overflow a map refcount on larger memory (1Tb). When the overflow wraps to zero a reference can be held while being free'd. This can lead to a use after free. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libgd2: denial of service
| Package(s): | libgd2 | CVE #(s): | CVE-2015-8874 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 20, 2016 | Updated: | July 6, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian-LTS advisory:
It was discovered that there was a stack consumption vulnerability in the libgd2 graphics library which allowed remote attackers to cause a denial of service via a crafted imagefilltoborder call. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
libxml2: denial of service
| Package(s): | libxml2 | CVE #(s): | CVE-2016-3705 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 20, 2016 | Updated: | May 25, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
libxml2 limits the number of recursions an XML document can contain so to protect against the "Billion Laughs" denial-of-service attack. Unfortunately, the underlying counter was not incremented properly in all necessary locations. Therefore, specially crafted XML documents could exhaust all available stack space and crash the XML parser without running into the recursion limit (CVE-2016-3705). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
moodle: multiple vulnerabilities
| Package(s): | moodle | CVE #(s): | CVE-2016-3729 CVE-2016-3731 CVE-2016-3732 CVE-2016-3733 CVE-2016-3734 | ||||||||
| Created: | May 19, 2016 | Updated: | May 25, 2016 | ||||||||
| Description: | From the Mageia advisory:
In Moodle before 2.8.12, users are able to change profile fields that were locked by the administrator (CVE-2016-3729). In Moodle before 2.8.12, names of hidden forums or discussions could be disclosed as part of the error message on the subscription page (CVE-2016-3731). In Moodle before 2.8.12, users can view badges of other users without proper permissions (CVE-2016-3732). In Moodle before 2.8.12, during the course restore, teachers could overwrite the idnumber even without having the capability to change it (CVE-2016-3733). In Moodle before 2.8.12, possible CSRF in the URL that marks forum posts as read (CVE-2016-3734). | ||||||||||
| Alerts: |
| ||||||||||
networkmanager: information leak
| Package(s): | networkmanager | CVE #(s): | CVE-2016-0764 | ||||||||||||||||
| Created: | May 23, 2016 | Updated: | December 15, 2016 | ||||||||||||||||
| Description: | From the Mageia advisory:
NetworkManager before 1.0.12 is vulnerable to a race condition that could lead to a local information leak. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
ose3.1: unauthorized access
| Package(s): | Red Hat OpenShift Enterprise 3.1 | CVE #(s): | CVE-2016-3703 | ||||||||
| Created: | May 20, 2016 | Updated: | May 25, 2016 | ||||||||
| Description: | From the Red Hat advisory:
An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser's localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized access_token was provided in the query parameter. (CVE-2016-3703) | ||||||||||
| Alerts: |
| ||||||||||
ose3.2: two vulnerabilities
| Package(s): | Red Hat OpenShift Enterprise 3.2 | CVE #(s): | CVE-2016-3708 CVE-2016-3738 | ||||
| Created: | May 20, 2016 | Updated: | May 25, 2016 | ||||
| Description: | From the Red Hat advisory:
A vulnerability was found in the STI build process in OpenShift Enterprise. Access to STI builds was not properly restricted, allowing an attacker to use STI builds to access the Docker socket and escalate their privileges. (CVE-2016-3738) A flaw was found in OpenShift Enterprise when multi-tenant SDN is enabled and a build is run within a namespace that would normally be isolated from pods in other namespaces. If an s2i build is run in such an environment the container being built can access network resources on pods that should not be available to it. (CVE-2016-3708) | ||||||
| Alerts: |
| ||||||
p7zip: two code execution flaws
| Package(s): | p7zip | CVE #(s): | CVE-2016-2334 CVE-2016-2335 | ||||||||||||||||||||||||||||||||||||||||
| Created: | May 19, 2016 | Updated: | January 11, 2017 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
CVE-2016-2334 (arbitrary code execution): An exploitable heap overflow vulnerability exists in the NArchive::NHfs::CHandler::ExtractZlibFile method functionality of 7zip that can lead to arbitrary code execution. Before decompression, ExtractZlibFile method read block size and its offset from file and after that read block data into static size buffer "buf". Because there is no check whether size of block is bigger than size of "buf", malformed size of block exceeding mentioned "buf" size will cause buffer overflow and heap corruption. CVE-2016-2335 (arbitrary code execution): An out of bound read vulnerability exists in the CInArchive::ReadFileItem method functionality of 7zip for handling UDF files that can lead to denial of service or code execution. Because volumes can have more than one partition map their objects are keep in object vector. To start looking for item, method tries to achieve proper partition object using to this mentioned partition maps object vector and "PartitionRef" field from Long Allocation Descriptor. Lack of checking whether "PartitionRef" field is bigger than available amount of partition map objects cause read out of bounds and can lead in some circumstances to arbitrary code execution. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
php: two vulnerabilities
| Package(s): | php5, php7.0 | CVE #(s): | CVE-2016-3078 CVE-2016-3132 | ||||||||||||
| Created: | May 25, 2016 | Updated: | May 25, 2016 | ||||||||||||
| Description: | From the Ubuntu advisory:
Hans Jerry Illikainen discovered that the PHP Zip extension incorrectly handled certain malformed Zip archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3078) It was discovered that PHP incorrectly handled invalid indexes in the SplDoublyLinkedList class. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3132) | ||||||||||||||
| Alerts: |
| ||||||||||||||
php5: three vulnerabilities
| Package(s): | php5 | CVE #(s): | CVE-2016-4342 CVE-2016-4343 CVE-2016-4346 | ||||||||||||||||||||||||||||||||
| Created: | May 19, 2016 | Updated: | May 25, 2016 | ||||||||||||||||||||||||||||||||
| Description: | From the openSUSE advisory:
CVE-2016-4342: Heap corruption in tar/zip/phar parser (bsc#977991) CVE-2016-4343: Uninitialized pointer in phar_make_dirstream() (bsc#977992) CVE-2016-4346: heap overflow in ext/standard/string.c (bsc#977994) | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
php-symfony: buffer overflow
| Package(s): | php-symfony | CVE #(s): | |||||||||
| Created: | May 23, 2016 | Updated: | May 25, 2016 | ||||||||
| Description: | From the Fedora advisory:
**Version 2.7.13** (2016-05-09) * **security** #18733 limited the maximum length of a submitted username (fabpot) * bug #18730 [FrameworkBundle] prevent calling get() for service_container service (xabbuh) * bug #18709 [DependencyInjection] top-level anonymous services must be public (xabbuh) * bug #18692 add Event annotation for KernelEvents (Haehnchen) * bug #18246 [DependencyInjection] fix ambiguous services schema (backbone87) | ||||||||||
| Alerts: |
| ||||||||||
php-ZendFramework2: insecure ciphertexts
| Package(s): | php-ZendFramework2 | CVE #(s): | CVE-2015-7503 | ||||||||||||||||||||
| Created: | May 23, 2016 | Updated: | June 22, 2016 | ||||||||||||||||||||
| Description: | From the Mageia advisory:
Zend\Crypt\PublicKey\Rsa\PublicKey has a call to openssl_public_encrypt() which uses PHP's default $padding argument, which specifies OPENSSL_PKCS1_PADDING, indicating usage of PKCS1v1.5 padding. This padding has a known vulnerability, the Bleichenbacher's chosen-ciphertext attack, which can be used to decrypt arbitrary ciphertexts. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
wireshark: denial of service
| Package(s): | wireshark | CVE #(s): | CVE-2016-4085 | ||||||||
| Created: | May 23, 2016 | Updated: | May 25, 2016 | ||||||||
| Description: | From the CVE entry:
Stack-based buffer overflow in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.12.x before 1.12.11 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long string in a packet. | ||||||||||
| Alerts: |
| ||||||||||
wordpress: two cross-site scripting vulnerabilities
| Package(s): | wordpress | CVE #(s): | CVE-2016-4566 CVE-2016-4567 | ||||||||
| Created: | May 23, 2016 | Updated: | May 25, 2016 | ||||||||
| Description: | From the CVE entries:
Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack. (CVE-2016-4566) Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via the query string. (CVE-2016-4567) | ||||||||||
| Alerts: |
| ||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>