Metal Gear Solid V bug can wipe saved games

If you’re already deep into Metal Gear Solid V, beware: there’s a game-breaking, save data-wiping bug in Hideo Kojima’s masterpiece. Consider this your alert sound.

Players who take supporting character Quiet with them on certain missions will see all progress eradicated. The save file becomes corrupt, and restarting is impossible. The error affects the game on all formats — PS4, PS3, Xbox One, Xbox 360, and PC.

The solution to this crippling bug? As Konami posted on its official forums, “this situation can be avoided by not using Quiet as a buddy while playing either ‘Mission 29’ or ‘Mission 42’.”

It’s not exactly the kind of fix players might hope for. Anyone coming to the game a few years from now, when awareness of the bug may be lost, may be caught unawares without an actual fix being rolled out.

Whether that happens or not remains to be seen, though Konami adds “We deeply apologise, and appreciate your patience for further announcements regarding this issue.” That at least implies a patch may be forthcoming.

Development of The Phantom Pain over the last year has been fraught with tension between Konami and director Hideo Kojima. Kojima’s internal development team has been disbanded, and Konami has cancelled what was to be his next game, a reboot of horror series Silent Hills, which was being designed with filmmaker Guillermo del Toro.

‘Critical’ bug targets Internet Explorer users

Microsoft has warned Internet Explorer users to update their machines to avoid being targeted by hackers. Here’s how to protect your computer

Microsoft has issued an emergency fix for a “critical” vulnerability that could allow hackers to take control of your computer after visiting an infected webpage.

The vulnerability, which affects all current versions of Internet Explorer, has the potential to enable an attacker to gain administrative user privileges and trick victims into visiting further malicious websites.

While the hackers could not force the victim into visiting further attacker-controlled web content, they could attempt to convince users to click on links in emails or instant messages, Microsoft warned. The administrative privileges granted by the vulnerability would then allow attackers to explot this.

The company’s recently-launched Windows 10 browser Microsoft Edge is not at risk.

“The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit this vulnerability,” Microsoft added.

The update addresses how Internet Explorer handles objects in memory, preventing any further interference.

Around 17.64 per cent of the world currently uses Internet Explorer, and around 23.35 per cent of the UK, according to StatCounter.

Some users attempting to update their systems to Windows 10 experienced problems after their PCs were forced into an endless loop of crashes and reboots earlier this month.

The US Department of Homeland Security advised US citizens not to use Internet Explorer following a security flaw which also had the potential for hackers to gain access to computers.

How to make sure you’re protected

1. The update is available through Windows Update, and will have been installed automatically if you have auto updates enabled.
2. Alternatively, you can download it through the Microsoft Download Centre. Microsoft advises that subsequent update 3078071 must be installed before 3087985.

Bug Bounties Entice Researchers to Don White Hats

Not all bug hunters are in search of a payday. In fact, many are primarily concerned with maintaining Internet security.”The target audience of bug bounty programs are researchers who want to keep users safe,” Eduardo Vela Nava, a security engineer with Google remarked. “They would continue to report the bugs they find with or without a reward.”

Bug bounty programs are used by individual software makers to improve the quality of their products, but they can have incidental benefits for all software makers, too. One of those is to encourage bug hunters to wear a white hat instead of a black one.

“An overwhelming majority of people have a vested interest in a secure Internet,” explained Alex Rice, CTO of HackerOne.

“When you make it easy for hackers to do the right thing, the majority will,” he told TechNewsWorld.

Adam Ely, co-founder of Bluebox, identified three primary markets for software flaws. The first is bug bounty programs. “This is the easiest place to submit the bug,” he told TechNewsWorld.

Moreover, many flaws just aren’t worth very much on the second market — the online underground. “Most bugs found in bug bounty programs are trivial and have little value to attackers, thus the company’s program is more profitable and less work — though high severity bugs earn more in the black market,” Ely said.

Inclined to Be Ethical

The third market — governments — can be the most lucrative for a bug hunter, but it’s also the most difficult to crack.

“Selling to a government is harder, as it requires the proper contacts and only certain, high severity bugs are of interest,” Ely explained.

“Those two requirements,” he added, “are why most people who find bugs will not be able to go this route.”

Even if they had an opportunity to sell their findings to the dark side, many wouldn’t do so, maintained David Lindsay, a senior security product manager at Coverity.

“A lot of researchers want to do the right thing, and even at the expense of money will disclose a vulnerability to a company,” he told TechNewsWorld.

That’s particularly true for researchers attracted to bounty programs, observed Eduardo Vela Nava, a security engineer with Google, which has a large and successful bug bounty program.

“The target audience of bug bounty programs are researchers who want to keep users safe,” he told TechNewsWorld. “They would continue to report the bugs they find with or without a reward.”

Snow Days

Kids aren’t the only ones who get to stay home on snowy days. Some companies allow their workers to punch in from home on those days also. That can present a security problem for an organization.

While a company’s road warriors may have their equipment properly secured from a host of nasty things outside the corporate firewall, workers who only occasionally work from home and use a family machine to do so can pose a risk to a company. That’s especially true if they’re using VPN software.

“You’re giving these home machines that you have no control over access to your corporate network,” explained Sergio Galindo, general manager of GFI Software.

“That’s one of the scariest things for an IT administrator,” he told TechNewsWorld, “allowing a machine into your network that you don’t know anything about.”

Galindo recommends taking measures to secure computers of employees who need to use a VPN before the snow starts falling.

“You need to make sure there’s some agreement in place around anti-virus and some sort of malware protection on that computer,” he said.

Virtual Mata Haris

Governments have been using women to coax intelligence from men throughout history, but a group of supporters of Syrian President Bashar al-Assad have brought the ruse into the virtual world.

Using fake Facebook profiles and Skype, members of the group posing as women persuaded some opponents of the Assad regime to download malware that pilfered 7.7 gigabytes of data, some of it exposing insights into military operations against the government.

The pro-Assad hackers would set up a Skype account and choose a female avatar, explained Nart Villeneuve, senior threat intelligence researcher atFireEye. “Then they’d contact these fighters in Syria and engage in flirtatious chats with them,” he told TechNewsWorld.

Eventually the “women” would send a picture — typically clipped from news sites — of themselves to their targets. Although the picture file had an image extension, it was actually an executable file that displayed a picture as promised, but also planted malware on the target’s machine.

An examination by FireEye of the chat sessions between the virtual women and men revealed a common question: What are you running Skype on?

“The reason they did that,” Villeneuve said, “was the attackers had a diverse malware arsenal, so if the target was on Android, the attackers could deliver Android malware to them instead of Windows malware.”

Breach Diary

• Feb. 2. FireEye releases report revealing 7.7GB of data was stolen from forces opposed to the regime of Syrian President Bashar al-Assad. Attackers posed as women on Skype and Facebook and tricked targets into downloading malware onto their systems.
• Feb. 3. U. S. District Court Judge Edward Davila tentatively approves $1.25 million settlement of class-action lawsuit resulting from 2012 data breach at LinkedIn.
• Feb. 3. Target appoints third CIO since 2013 data breach resulting in the theft of personal information of some 70 million customers. New executive vice president and CIO is Mike McNamara, who was serving as CIO at UK-based Tesco PLC, a grocery and general merchandise retailer.
• Feb. 3. CIA whistleblower John Kiriakou released to home confiniement after serving two years in federal prison for revealing that waterboarding was an official U.S. policy approved by the highest levels of government.
• Feb. 3. Crypto anarchist collective unSystem announces launch of Darkleaks, an exchange powered by bitcoin technology designed to allow information to be traded anonymously for digital money.
• Feb. 4. Bills introduced in U.S. House and Senate to update the nearly 20-year-old Electronic Communications Privacy Act. House bill was filed by Representatives Kevin Yoder (R-Kan.) and Jared Polis (D-Colo.) and the Senate bill by Senators Mike Lee (R-Utah) and Patrick Leahy (D-Vt.).
• Feb. 5. Anthem Inc., the second largest health insurer in the United States, reports a database with 80 million customer records has been breached by hackers. Information stolen from the database included names, birthdays, medical IDs, social security numbers, street addresses, e-mail addresses and employment information, including income data. The company said there was no evidence that credit card or medical information was compromised.
• Feb. 5. Amy Pascal resigns as head of Sony Entertainment Pictures. A number of embarrassing emails penned by Pascal were exposed by system intruders after a devastating cyberattack on Sony earlier this year.
• Feb. 5. Iovation releases report on dating site fraud. Among its findings: In 2014, 1.37 percent of all transactions on online dating sites were fraudulent, compared to 1.24 percent for all other industries monitored by the company.
• Feb. 6. UK’s Investigatory Powers Tribunal declares regulations covering access by Britain’s GCHQ to emails and phone records intercepted by the U.S. National Security Agency breached human rights law.

Upcoming Security Events

• Feb. 10-12. International Disaster Conference and Exposition (IDCE). Ernest N. Morial Convention Center, New Orleans. Registration: government, nonprofit, academia, $150; private sector, $450.
• Feb. 11. SecureWorld Charlotte. Harris Conference Center, Charlotte, North Carolina. Open sessions pass: $25; conference pass: $165; SecureWorld plus training: $545.
• Feb. 12. President Obama’s New Personal Data Notification & Protection Act: Overview, Analysis, and Challenges. 3 p.m. ET. webinar sponsored by ID Experts. Free with registration.
• Feb. 17. Cyber Threat Spotlight: Social Domains–Fraud’s New Frontier. 1 p.m. ET. BrandProtect webinar. Free with registration.
• Feb. 19. Third Annual 2015 PHI Protection Network Conference. The DoubleTree – Anaheim-Orange County, 100 The City Drive, Orange, California. Registration: before Jan. 2, $199; after Jan. 1, $249.
• Feb. 19. Secure Because Math: Understanding Machine Learning-Based Security Products. 2 p.m. ET. Black Hat webcast. Free with registration.
• Feb. 21. B-Sides Tampa. The Museum of Science and Industry, 4801 E. Fowler Ave., Tampa, Florida. Free.
• Feb. 21. B-Sides Indianapolis. DeveloperTown 5255 Winthrop Ave., Indianapolis, Indiana. Fee: $10.
• March 4-5. SecureWorld Boston. Hynes Convention Center. Open sessions pass: $25; conference pass: $175; SecureWorld plus training: $545.
• March 11. Intelligence Squared U.S. Debates: The U.S. Should Adopt The “Right To Be Forgotten” Online. 6:45 p.m. Merkin Concert Hall, Goodman House, 129 W. 67th Street, New York City. Tickets: $40; student, $12.
• March 12. B-Sides Ljubljana. Poligon Creative Centre, Tobačna ulica 5, Ljubljana, Slovenia. Free.
• March 12-13. B-Sides Austin. WinGate Williamson Conference Center, Round Rock, Texas. Fee: $15/day.
• March 14. B-Sides Atlanta. Atlanta Tech Village, 3423 Piedmont Rd. NE, Atlanta. Free.
• March 18-19. SecureWorld Philadelphia. DoubleTree by Hilton Hotel, Valley Forge, Pennsylvania. Open sessions pass: $25; conference pass: $295; SecureWorld plus training: $695.
• March 24-27. Black Hat Asia 2015. Marina Bay Sands, Singapore. Registration: before Jan. 24, $999; before March 21, $1,200; after March 20, $1,400.
• April 1. SecureWorld Kansas City. Kansas City Convention Center, 301 West 13th Street #100, Kansas City, Mo. Registration: open sessions pass, $25; conference pass, $75; SecureWorld plus training, $545.
• April 20-24. RSA USA 2015. Moscone Center, San Francisco. Registration: before March 21, $1,895; after March 20, $2,295; after April 17, $2,595.
• June 8-11. Gartner Security & Risk Management Summit. Gaylord National, 201 Waterfront St., National Harbor, Md. Registration: before April 11, $2,795; after April 10, standard $2,995, public sector $2,595.

There’s a GHOST in Linux’s Library

As security flaws go, the recently discovered GHOST hole is pretty scary. Patching it could be more trying than fixing other recently discovered Linux vulnerabilities, according to Coverity’s Jon Passki. “Patching a bug like Shellshock and rolling out a new version could be much easier than patching GHOST, as libc is a core library for many packages and the host operating system in Linux.”

Patches for GHOST, a critical vulnerability in the Linux GNU C Library (glibc), now are available through vendor communities for a variety of Linux server and desktop distributions.

Qualys earlier this week reported its discovery of GHOST (CVE-2015-0235), a vulnerability that allows attackers to remotely take control of an entire system without having any prior knowledge of system credentials.

A Qualys security research team found the GHOST flaw and worked closely with Linux distribution vendors in a coordinated effort to offer a patch for all distributions of Linux systems impacted.

Corresponding vendors made that patch available effective Wednesday, said Amol Sarwate, director of vulnerability labs at Qualys.

Qualys delayed divulging the existence of the security hole for several weeks to allow vendors time to develop and distribute a patch. It is unclear whether hackers have exploited it.

“We discovered the vulnerability during a code audit. It was found not recently but some time ago. We were working with vendors to come up with a coordinated way to disclose it when patches were available,” Sarwate told LinuxInsider.

What It Does

The exploit allows an attacker to take complete control of a machine, Sarwate explained.

“I would classify this as a high severity threat because of the consequences,” he added.

The flaw opens up most Linux-based Web and mail servers to attack. The vulnerability is triggered by the gethostbyname functions.

Numerous core processes call on gethostbyname, including auditd, dbus-daem, dhclient, init, master, mysqld, rsyslogd, sshd and udevd.

The flaw in Glibc exposes a buffer overflow that can be triggered locally and remotely in the “gethostbyname” functions. Applications using glibc get access to a DNS resolver, which converts hostnames into an IP address, according to Qualys.

Almost all networked Linux computers use this function to access another networked computer by using the /etc/hosts files or by resolving an Internet domain name with Domain Name System.

Troubled Patch

The vulnerability seems easy to trigger. An attacker can force a buffer overflow by using an invalid hostname argument to an application that performs a DNS resolution. That gives the attacker an ability to remotely execute arbitrary code with the permissions of the user running DNS.

Applying the patch is a fairly straightforward process. It is just the same as installing any other patch on a Linux system, according to Sarwate.

However, it could be plagued by previous patching faults. The flaw exists in older versions of the GNU C library, or glibc, a repository of open source software written in the C and C++ coding languages. Newer versions of glibc, beginning with the August 2013 glibc 2.18 release, are not affected. However, many builds of Linux may be using older versions.

A variety of factors mitigate the impact of this security hole, according to Qualys. One key factor is a fix released on May 21, 2013, between the releases of glibc-2.17 and glibc-2.18. That fix was not classified as a security advisory.

As a result, most stable and long-term-support distributions were left exposed, according to Qualys. Affected Linux distros include Debian 7 (wheezy), Red Hat Enterprise Linux 6 and 7, CentOS 6 and 7 and Ubuntu 12.04.

Bug Fix Hell

Patching the GHOST hole could be more trying than fixing other recently discovered Linux vulnerabilities, according to Jon Passki, lead security researcher at Coverity.

“Patching a bug like Shellshock and rolling out a new version could be much easier than patching GHOST, as libc is a core library for many packages and the host operating system in Linux,” he told LinuxInsider.

Applying a patch to bash and rolling out a newer version seems a lot easier. None of its dependencies are touched, so the fix can be very specific, Passki said.

“As a sysadmin or someone in security operations, I’d rather have ShellShock than GHOST,” he added.

For single-user Linux desktops running mainly software managed by its distribution, complications probably are no issue, noted Passki. For enterprise systems running proprietary code, getting the patch right could be a thorny problem.

Microsoft irked by Google’s revealing of Windows bug

The software giant slams Google for disclosing a Windows 8.1 security flaw two days before Microsoft planned to issue a fix.

Microsoft has heavily criticized Google and the company’s security disclosure policy after Google publicly revealed a Windows 8.1 security flaw just days before Microsoft planned to issue a patch to kill the bug.

Chris Betz, senior director of the Microsoft Security Response Center, said in a lengthy blog post that the threat landscape is becoming increasingly complex, and it is time for companies to stand together in response — rather than stand divided when it comes to cybersecurity strategies, such as in vulnerability and threat disclosure, as well as the release of security patches and fixes.

This declaration comes after Google released details concerning a Windows 8.1 security flaw two days before Microsoft was due to issue a fix. The public disclosure concerned a bug that allows low-level users to become administrators, granting themselves elevated access to sensitive functions they should not be able to tap into. While Microsoft pointed out that valid login credentials were required to exploit this flaw, this wouldn’t necessarily stop a company employee with an axe to grind causing harm to a system.

The disclosure was made by Google as part of the Mountain View, Calif.-based firm’s Project Zero. The project discloses vulnerabilities publicly — as well as code required to exploit bugs — but only after issuing affected companies with a 90-day deadline to fix problems. Microsoft was notified on October 13 2014.

The 90-day deadline passed by, no fix was issued, and the vulnerability was disclosed. However, Betz says Microsoft requested details of the vulnerability to be kept quiet until this month’s Patch Tuesday, which takes place on January 13.

Microsoft is less than pleased.

“Although following through keeps to Google’s announced timeline for disclosure, the decision feels less like principles and more like a ‘gotcha,’ with customers the ones who may suffer as a result. What’s right for Google is not always right for customers. We urge Google to make protection of customers our collective primary goal,” Betz said.

Betz said Microsoft believes security researchers who fully disclose a vulnerability before a fix is available do damage to “millions of people and the systems they depend upon,” and while other companies may disclose these issues in order to force fixes, the risk of a security flaw being exploited increases with early disclosure.

Whether or not a 90-day deadline is long enough for a fix to be issued remains up to users and companies to decide.

Betz said the time is right for a set of practices called Coordinated Vulnerability Disclosure (CVD). Rather than release details concerning security vulnerabilities found in systems to full, public disclosure, Microsoft believes the best way to tackle security problems is to issue fixes before flaws become public knowledge.

The company asks that researchers privately disclose vulnerabilities in the future, and only release details concerning security problems into the public sphere after a fix has been made available.

“Policies and approaches that limit or ignore that partnership do not benefit the researchers, the software vendors, or our customers,” Betz said. “It is a zero sum game where all parties end up injured.”

Last week, Microsoft announced that its advanced security notification service (ANS) would no longer be publicly available. As part of Microsoft’s “evolution” in the way security notifications are handled, only those with paid Premier support contracts and organizations “involved in its security programs” will now be privy to security updates ahead of Patch Tuesday.

New zero-day bug targets IE users in drive-by attack

Computers infected with malware after visiting a “strategically important Web site,” security firm FireEye warns.

A pair of vulnerabilities in Internet Explorer currently being exploited in the wild to install malware on computers that visit at least one malicious Web site, security researches warn.

The classic drive-by download attack targets the English versions of IE 7 and 8 in Windows XP and IE 8 on Windows 7, security firm FireEye warned in a company blog post Friday. However, the security researcher wrote that its analysis indicated that other languages and browser version could be at risk.

“The exploit targets the English version of Internet Explorer, but we believe the exploit can be easily changed to leverage other languages,” FireEye researchers Xiaobo Chen and Dan Caselden wrote. “Based on our analysis, the vulnerability affects IE 7, 8, 9 and 10.”

The second of the two holes is an information leakage vulnerability that is used to retrieve the timestamp from the program executable’s header.

“The timestamp is sent back to the attacker’s server to choose the exploit with a ROP chain specific to that version of msvcrt.dll,” the pair wrote. “This vulnerability affects Windows XP with IE 8 and Windows 7 with IE 9.”

The exploit’s “ROP chain,” or return-oriented programming, is a technique for disguising executable code from security defenses.

FireEye wrote in a follow-up post that further analysis found that the exploit was part of an advanced persistent threat (APT) in which attackers inserted the exploit code directly “into a strategically important website, known to draw visitors that are likely interested in national and international security policy.”

Further distinguishing this exploit from others is that the payload was delivered without first writing to disk, a technique that “will further complicate network defenders’ ability to triage compromised systems, using traditional forensics methods,” the researchers wrote.

“Specifically, the payload is shellcode, which is decoded and directly injected into memory after successful exploitation via a series of steps,” FireEye researchers wrote in the latest post. “By utilizing strategic Web compromises along with in-memory payload delivery tactics and multiple nested methods of obfuscation, this campaign has proven to be exceptionally accomplished and elusive. APT actors are clearly learning and employing new tactics.”

FireEye did not identify the affected Web but said the attacks can be mitigated by using Microsoft’s Enhanced Mitigation Experience Toolkit (EMET).