หากคุณ Follow Security Scene คุณต้องสังเกต Buzz เยอะมากรอบ Security Issues ต่างๆ ที่ค้นพบในเดือนนี้ คือ Critical Vulnerability ใน Microsoft Graphics Component ตาม MS16-039 Bulletin เรื่องราวและ Rumors รอบ Badlock Bug และ Risks Associated Using Firefox Add-ons All Well And Good ยกเว้นมัน Nothing More Than Clickbait Hype Nonsense
Reading Articles fueled My Anger 到 Heights ที่ผมต้อง Wait 1-2 วัน ก่อนเขียน Piece นี้ มิฉะนั้น มันจะเป็น Venom และ Expletives เท่านั้น แต่ Important ที่จะ Express Myself และ Protect Internet Users จาก Torrent of Pointless, Amateurish, Sensationalist Wanna-be Hackerish Security Diarrhea ที่ Produced เดือนนี้ ตามมาซิ
All your Ragnarok are belong to us.
Noscript และ Add-ons อื่นๆ เปิดโอกาสให้ Millions Exposed To New Attack
ผมจะไม่ Link ไป Article ใน Question เพื่อไม่ Drive Traffic ไปสิ่งที่อธิบายได้ได้แค่ Digital Goatfest ใน Essence Article บอกเราว่า เนื่องจาก Firefox Add-ons ทั้งหมด Share Same Namespace i.e. No Memory Isolation Potentially Malicious Add-on Could Snoop On Other Add-ons That's The Story Noscript 一个 Supremely Useful 和 Important Add-on 提供 Tremendous Silver-bullet Security 给 Firefox Users 被 Singled Out 在这篇文章中 以给它一个 Ironic Spin
Complete Nonsense.
The Thing Is 除了 Driving Traffic 当然 和没有东西 Breeds 和 Generates Page Views 像 Good Ole Fear 文章不 Provide One Shred of Useful, Actionable Information 给 Readers 因为 Highlighted Problem 只能成为 Problem 如果 User Installs Malicious Add-on 他们自己 是的 没错 您可能被 Infected 如果您 Infect Yourself Holy Crap, Sherlock 现在 这如何发生:
您安装 Unsigned Add-on 自己 Please Electrocute Yourself.
您安装 Add-on 从 Mozilla Repository, 后它已被 Screened, Tested 和 Digitally Signed 换句话说 如果 Add-ons Servers 被 Hacked 用户将有 Much Bigger Problems 而不是 Extension ที่ Targets Other Extensions
然后 有 Validity of Such an Attack 如果您可以 Gain Privileged Access 到 System Eavesdropping On Other Extensions 是 Least Useful Thing 您可以做 这像 Wire-tapping Someone's Phone 然后 Hiding Under The Bed 听 Calls 或一些 Analogy 谁在乎
换句话说 这个 Would-be Security Issue 不是 Issue At All 它 Requires Active, Deliberate Interaction 从 User Keen On Damaging Their System 对于那件事 您可以 Just Infect Your Machine With Any Which Malware 您知道什么还有 Single Namespace? Your Kernel
Microsoft Bulletin MS16-039
这是一个 Interesting One Top 20 Results 为此 Particular Item 所有有 One Thing in Common - Word-for-word Copy Paste 实际的 Advisory 而不 Provide A Single Original Thought 或 Valuable Comment 如果那是 Journalism 我是 Shakespeare
Out of These Twenty Websites 只有 Single Source Mentioned EMET 那个 Supremely Useful 和 Important Mitigation Framework 开发由 Microsoft 提供 Excellent Protection Against Exploits 但嘿 那不是 Dramatic Enough! 和只有一个其他 Would-be 或 Be Security Blog 实际上 Gone To Some Length 尝试 Outline Issues 和 How They May Come To Bear
Apparently 有 Four Separate Vulnerabilities 其中 Three 是 Local Boring 除非您是 Corporation With Lots of People Working 在 Organization One Could Be Remote Execution Issue 如果 User Opens Specially Crafted Document - Electrocute Yourself Please - 或 Visits Page With Embedded Malicious Fonts
This security update resolves vulnerabilities in Microsoft Windows, Microsoft .NET Framework, Microsoft Office, Skype for Business, and Microsoft Lync. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted document or visits a webpage that contains specially crafted embedded fonts.
现在 在这一点上 我会问 好的 所以你写下 Problem OK What's Next? Exploit 实际上如何工作? 用户实际上如何 Protect Themselves 从 This Thing?
Nothing Silence 因为人们抱怨和写所有这 Drama 实际上不 Want To Help 他们 Just Want To Grab Attention 和 Reap Profit From Fear 和 Propaganda 并且他们 Most Likely Do Not Have Necessary Technical Expertise 来 Actually Help 这 Makes Them Useless
Proper Analysis
所以让我们看看什么给 首先 您可以 Actually Install Security Updates Provided by Microsoft No Biggie 这意味着 No Particular Advisory Warrants Any Special Mention Really 但如果您 Want To Go Technical Microsoft 有 Lot of Useful Information 在这个话题上 不像 Blogs 写关于这个
Three of the Four Vulnerabilities Fall Under Category of: Multiple Win32k Elevation of Privilege Vulnerabilities Identified by Advisories CVE-2016-143, -165 和 -167 他们 All Local 和 Two of These Have Active Exploits Not Interesting 对于 Vast Majority of Home Users
The Fourth One - Graphics Memory Corruption Vulnerability CVE-2016-0145 全部关于 Embedded Fonts 目前它 Not Been Publicly Disclosed 或 Exploited 那 然而 Should Not Really Console 或 Worry 您 因为它 All About Education 我们不 Want To Worry About Something 被 Patched Today 我们 Want To Be Able To Address All Potential, Future Vulnerabilities of Similar Nature 无论它们有 Their Moment of Spotlight 或 Not
Which Means 我们 Need To Focus On Embedded Fonts 这是 Source of the Problem 如果 Malicious Embedded Fonts Exist On A Webpage 并且 User Visits That Page 然后 System Font Libraries May Go Crazy 和 Allow For Arbitrary Execution of Code
换句话说 我们想 Stop Embedded Fonts 和/或 Stop Browser From Calling On Font Libraries 在 Illegal Manner Either One 或 Both of These Vectors 如果 Stopped 可以 Prevent Exploits
The First Can Be Addressed by Not Allowing Embedded Fonts 一般来说 Embedded Fonts Displayed 使用 @font-face CSS Rule 换句话说 如果您 Prevent This Particular CSS Rule From Being Parsed 当 Page Loads Embedded Fonts Will Not Be Loaded 和 Potential Exploits Will Not Run
Now Remember Noscript 和 How It Was Vilified Just Earlier?
Noscript Actually Blocks @font-face On Untrusted Pages!
所以事实上 不仅 Noscript 不 Put Millions At Risk 它 Actually Helps Millions Not Be Exposed 到 Potential Issues with Embedded Fonts 它 Just Shows How Much Hype 和 Drama 有 Without Any Real Justification 但我们才刚开始
The Second Vector 是 Browser Going Crazy By Calling On A Font Library 在 Illegal Manner 这 Exactly What Enhanced Mitigation Experience Toolkit Is For 'Tis A Very Nifty Security Tool Zero Footprint, No Nonsense 它不 Differentiate Between Good 和 Bad Applications 它 Stops All Illegal Instructions 它 Can Detect 在 Programs That Run Under Its Wings
和然后 一个 Practical, Useful Question Would Be - Has Anyone Tested Embedded Font Exploits Under EMET Using Any One of The Browsers? 或 Perhaps Office Tools 或 Skype 或 Alike? Has Anyone Tried Any Sort of Embedded Fonts Tricks That Would Trigger An Illegal Instruction?
Speaking of Mitigations Microsoft 有 WHOLE Page On Blocking Untrusted Fonts! 它 Explains How To Add Mitigation Options 哪些 Prevent GDI From Loading Any Font Outside %windir%/Fonts Directory 这 Exactly What You Want In This Case 和 That Means Exploits of This Nature Will Not Trigger Any Issues Ergo All Those Sensationalist Articles Are Just Pure Bollocks
The Article Applies To Windows 10 和它 Also Mentions EMET 5.5 Which Nicely Complements This Capability 我不确定 Windows 7 和 Windows 8.1 Users 也将 Benefit From Exact Same Level of Security 但那些 Surely Won't Be Any Worse Than They Are
Block Untrusted Fonts
无论如何 这里是如何 Block Untrusted Fonts 启动 regedit.exe 然后去:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\
Under This Hive 寻找 MitigationOptions Key 如果不存在 创建 QWORD (64-bit) Value 和 Rename 它 accordingly 文章 Assume 64-bit Architecture 所以我相信您想要 DWORD (32-bit) Value 在 32-bit Systems 上 Assign The Right Value 要 Block Untrusted Fonts 您想要 Lengthy Number - 1000000000000 Add This To Any Other Mitigation Value 您可能已经有在 Place 这个 Number 实际上是一个 Filter
And That's Children How Babies Are Made!
Other Stuff
有更多 Usual Scaremongering Flash Meh Boring 其他 Pointless Stuff 再次 Without Any Sensible Leads 如何您可能 Actually Protect Yourself 这像说 一辆卡车可能撞到你这个月 是的 但如果您不站在路中间 您可以 Significantly Reduce Chances of That Happening 只有没有人 Bothers, Knows 或 Wants To Mention Workarounds Total of Just 1 Out of 20 Top Searches Did Provide Actual Help To Users 甚至那样 也没 Too Much Info On EMET 和 How It Works
Why All This Hype, Pray?
Dedoimedo 为什么这些其他 Folks 不 Help? 为什么他们 Hype Security So Much? All Good Questions 有 Several Answers 为此 First and Obvious One Is 没有人 Got Rich By Selling Unicorns 和 Rainbows People Love Drama Secondly 对于 Lack of A Better 和 More Substantial Content Rehashing Security Bulletins Is As Good As Baking Bread Made of Pure Gold But Most Importantly ...
Military Service
Most If Not All of the Security Bloggers 在 Western World, re: California 没有 Had The Pleasure of Undergoing A Military Service of Any Kind 我 Highly Recommend It Adds Hair To Your Chest 和 Mustard To Your Radish Builds Character Forces You To Socialize 您 Learn Discipline 但也 Gives You A Different Perspective On Life Than You Normally Get Listening to Spotify While You Segway Your Way To The Nearest Bio-meta-milk Coffee Shop
And So 如果您的 Life Has Not Been Exposed To The Less Fluffy Sides of Human Existence 如 Poverty, Famine, Disease, Slavery, Trafficking, Riots 和 Revolutions, War 和 Other Delights of This World 去 QWERTY - 或 DVORAK - On A Security Issue Detected 在 An Operating System 突然 Becomes Creme De La Creme of Excitement
A blogger on its way to the next security advisory.
To Wit 如果您 All Too Deep Into Hollywood Blockbuster Mentality 其中 Explosions Are Orange 和 Hacking Occurs On Sickly-green-and-black Terminal Windows 然后您 May Easily Lose The Grip On Reality 和 Suddenly Think That A Simple Font Vulnerability Is No Less Important Than SARS 和 Ebola Combined 并且 That By Blogging About It 您 Almost As Badass As A Regiment of The French Legion Freshly Landed On The Shores of Djibouti
结论
这是 April 在一个 Nutshell 中 没有什么 New 没有什么 Exciting 没有什么 Valuable On the Contrary 很多 Detrimental Nonsense 设计来 Elicit Drama 和 Shock 保持您 Pasted To The Screens 和 Reading Frightening 您 Without Teaching 您如何 Protect Yourself Noscript, EMET, 嘿 那些 Data Backups 呢? Nothing
你们都知道我对 Software Security 感到如何 它 Totally Overrated 和那些 Blogging 关于它 Without Actually Educating Users 是 No Better Than Supposed Enemy 他们 Preaching About 如果您没有什么有价值的贡献 你最好不写任何东西 在第一位 任何人都可以阅读 Microsoft Bulletins 他们不需要您重复完全相同的信息 也不需要散布 FUD 和 Propaganda 而不知道基本事物如何工作 如 Firefox Extensions 但嘿 那就是我们生活的世界 真正重要的事情是 网站都是 Mobile-friendly 所以他们有 Good Rankings 对吗? Valuable Information 到底
Note: All Dem Old Pics Are In Public Domain.
Cheers.
