BadTunnel: A vulnerability all Windows users need to patch

 
A security researcher has uncovered a serious vulnerability that affects every version of Microsoft’s Windows operating system from Windows 95 to Windows 10.

The vulnerability could give attackers a way to set up man-in-the-middle attacks against victims by getting them to click on a link, open a Microsoft Office document or plug in a USB drive.

In an interview with Dark Reading, Yang Yu, who earned a whopping $50,000 bug bounty for the discovery he’s nicknamed BadTunnel, described the impact in grandiose terms:


This vulnerability has a massive security impact – probably the widest impact in the history of Windows.

Microsoft released a fix for the vulnerability on Tuesday in security bulletin MS16-077. Users of unsupported Windows versions such as Windows XP should disable NetBIOS over TCP/IP.

The nuts and bolts of how the vulnerability works haven’t been revealed but it has been described as a technique for NetBIOS-spoofing across networks that bypasses firewalls and NAT (Network Address Translation) devices.

In other words, it can expose you to attackers who aren’t on your network, and your firewalls won’t save you, unless you block UDP on port 137 between your network and the internet.

According to Yu, it relies on a chain of elements including “a transport layer protocol, an application layer protocol, a few specific usage of application protocol by the operating system, and several protocol implementations used by firewalls and NAT devices.”

Microsoft’s bulletin appears to break the final link in the chain by fixing a vulnerability in WPAD (Web Proxy Autodiscovery Protocol) that was first reported in 2007.

WPAD is a way for computers to discover web browser configuration files automatically by searching specific addresses on a computer’s local network. An attacker who could find a way to occupy one of those addresses, or to change the addresses being searched, could supply their own configuration files and instruct the victim’s browser to route traffic through a man-in-the-middle attack.

Until BadTunnel, the attacker had to gain access to a victim’s network (or rely on opportunistic domain name collisions) which made it a difficult trick to pull off.

Yu plans to reveal the full gory details of BadTunnel in a presentation at the upcoming BlackHat conference:


This presentation will introduce a new threat model. Based on this threat model, we found a flaw in the Windows system. It affects all Windows released in the last two decades, including Windows 10. It also has a very wide range of attacks surface. The attack can be performed on all versions of Internet Explorer, Edge, Microsoft Office, many third-party software, USB flash drives, and even Web server. When this flaw is triggered, YOU ARE BEING WATCHED.

Latest:How to hack Facebook, Gmail or Yahoo account for just $129 in 2016

How to hack Facebook, Gmail or Yahoo account for just $129 in 2016

This tools will help user to hack facebook account easily.In this tutorial i will show you detailed guide for hacking facebook account.

According to an annual report from Dell SecureWorks on underground hacker marketplaces, hiring a hacker to compromise an account with a popular email or social networking account will cost you just $129.

Hackers are increasingly operating as regular businesses with many advertising themselves as “honest, trustworthy and professional,” and providing a variety of illicit goods and services on the cheap, says the cybersecurity company’s third annual Underground Hacker Markets Report.

According to the Dell report, released on 5 April, the information was gathered by two intelligence analysts from the company’s CISO INTEL Team, who tracked hackers on a number of underground hacker forums and marketplaces scattered across the globe.

The report focuses on markets in the Russian underground as well as English-based markets, and covers the third quarter of 2015 to the first quarter of 2016 time frame.

To enlist the help of a team of “trustworthy, professional” hackers to gain access to your Facebook, Gmail, or Outlook account, all that someone has to pay is $129. It appears like quite the illicit bargain considering the kind of harm someone could inflict once they have gained access. These hackers stand by their work promising fast results, total confidentiality, and even offer after-sales support.

Stolen bank account credentials, passports, social media hacking and other services tend to get higher prices and prices are steadily rising.

“Like any other market in a capitalist system, the business of cybercrime is guided by the supply and demand for various goods and services,” the report’s authors wrote. “Unfortunately for the law abiding public, both sides of that equation remain strong, with everything from credit cards to hacker-for-hire services being sold online.”

Security analysts found that those interested in hiring a hacker to compromise a Gmail, Hotmail, or Yahoo account only have to pay $129 for the service. Popular U.S. social media and Ukrainian email accounts are priced the same, popular Russian email accounts range between $65 and $103, while Russian social media accounts are priced higher, at $194. If someone is looking to hack the IP address of a computer user, it will cost them another $90. On the other hand, hacking into someone’s corporate email account will cost $500 per business mailbox.

Over the past three years, prices for a Remote Access Trojan (RAT) — a malware program that allows cybercriminals to secretly control your computer remotely — have reduced from $50-$250 in 2013, to only $5-$10 in 2015. On the other hand, the Angler Exploit Kit is available for $100-$135, and that the price for “Crypters” went up significantly, reaching $80-$440, compared to 2014, when this type of malware went for only $50-$150.

Hacking tutorials are available for purchase online between $20-$40 for multiple tutorials, whereas doxing services cost only $19.99 (down from up to $100 a year ago). While hacking a website (stealing data) costs $350, distributed denial of service (DDoS) attacks can be hired for as low as $5 per hour, $200 per week, or $1,000 per month, with the price being higher if the website has anti-DDoS protection installed.

The upgraded ATM “skimmer” – hidden electronics that steal personal data stored on your debit or credit card’s magnetic stripe – is one of the most popular items on the underground market this year. These devices are priced at $1,775 with new 3D printed versions coming out as well.

Airline and hotel points can also be purchased in these underground black markets. Based on the number of points in account, large U.S. airline points accounts priced as high as $450 for 1,500,000 points, and large Middle East airline points accounts priced at $150 for 500,000 points. A large international hotel chain points account with 1,000,000 points cost just $200, the report reveals.

Another interesting item available for purchase on the Russian underground is “full business dossiers” on companies situated within the country and include credentials linked with the company’s bank accounts including account numbers, logins, passwords and more.

“Our security experts had never seen a full business dossier being sold for any companies, much less for Russian organizations. What could one do with this type information besides potentially siphon off all the money in the company’s bank accounts? Well, the possibilities are extensive. If the company has good credit, there is certainly the potential for those possessing this data to apply for hefty bank loans, high-limit credit cards, car loans and other lines of credit,” Dell says.

Hackers are concentrating even more on salesmanship to please customers in order to compete and guarantee “customer satisfaction.” Dell says one ad offered “free-trial attacks” and “abilities” while other hackers are increasing their work hours to include weekends and even claim of 24/7 customer service.

“Prices and goods are not the only way sellers are distinguishing themselves. There also continues to be a focus on salesmanship,” Dell reports. “Compared to the report last year, our security experts noted this time around that many hackers were expanding their working hours to include weekends and even promising to be available 24 hours a day.”