Indian Website Defacements

Bank of India website got compromised yesterday and was used to host malware/exploits.
If you have visited the website recently and feels that your computer is showing strange behaviour after that, it is most likely that your system got compromised by some malware which was on the site.
Indian Computer Emergency Response Team (CERT-IN) have some interesting info about the Indian sites which were defaced last year.

“
In the year 2006 a total no. of 5211 Indian websites were defaced , on an average of about 14 websites per day.
“
The Bank website has been cleaned up by their staff and is considered safe to access now.

An analysis of the defacement is available at Mcafee AvertLabs blog at
http://www.avertlabs.com/research/blog/index.php/2007/08/31/compromised-bank-of-india-website/

Another Yahoo Security Fix

Within a week after its previous security update, Yahoo has now come up with another security fix. This update patches a stack overflow in one of the activex controls related to Yahoo Messenger. According to analysis by iDefense.

It is important to note that functions within this class can only be called if the control believes it is being run from the yahoo.com domain. In order for this exploit to be triggered an attacker would either have to leverage a Cross-Site Scripting vulnerability in the yahoo.com domain, or be able to control the targeted user's DNS resolution

Yahoo's advisory related to this vulnerability could be found at http://messenger.yahoo.com/security_update.php?id=082907

Patched version of Yahoo Messenger is available at http://messenger.yahoo.com/download.php.

Little Endian, Big Endian & Gulliver ..

Big Endian and Little Endian are terms used in computing to specify how bytes are ordered in memory. In Big Endian bytes are stored from most significant byte to least significant byte (MSB to LSB) and in Little Endian it is from least significant byte to most significant byte (LSB to MSB) .
For example,on a 32bit system an unsigned integer ‘0x40812131’ will be stored as ‘0x40812131’ itself in Big Endian byte order and in Little Endian, it will be stored as ‘0x31218140’.

Most Intel processors are Little Endian, while processors such as Sparc belong to the Big Endian family. In processors like MIPS and ARM it is possible to specify the byte order at startup.

TCP/IP uses Big Endian byte order for its data transfer. Systems with a byte order other than BigEndian should first convert any data it receives from a TCP/IP network (Network Byte Order) to its own byte order (Host Byte Order) before processing it. Most network appliances (routers, firewalls,ids,ips,..) are build using BigEndian processors as they can avoid overhead caused due to byte order conversions.
Following are some C functions used for byte order conversion

unsigned long htonl(unsigned long hostlong); //Host byte order to Network byte order long
unsigned short htons(unsigned short hostshort);//Host byte order to Network byte order Short
unsigned long ntohl(unsigned long netlong);//Network byte order to Host byte order long
unsigned short ntohs(unsigned short netshort); Network byte order to Host byte order short


These functions are even found in the source code for BigEndian systems, but internally they don’t perform any operation on them. This is mainly done to make the code portable across platforms with different byte orders.
One interesting fact about the terms ‘Little Endian ‘and ‘Big Endian’ is that they came from the novel Gulliver's Travels :) .


"Gulliver finds out that there is a law, proclaimed by the grandfather of
the present ruler, requiring all citizens of Lilliput to break their
eggs only at the little ends. Of course, all those citizens who broke
their eggs at the big ends were angered by the proclamation. Civil war
broke out between the Little-Endians and the Big-Endians, resulting in
the Big-Endians taking refuge on a nearby island, the kingdom of
Blefuscu."
[http://www.ietf.org/rfc/ien/ien137.txt]

The following code could be used to check whether a system is Big Endian or Little Endian during run time.

#include
#define LITTLE_ENDIAN 0
#define BIG_ENDIAN 1
int byteOrder(void)
{
unsigned int x=1;
unsigned char *y=(unsigned char *)&x;
if(y[0]) return LITTLE_ENDIAN;
return BIG_ENDIAN;
}
int main()
{
printf("%s Endian\n",byteOrder()?"Big":"Little");
return 0;
}

Yahoo Fixes Security Flaw

Yahoo recently released an updated version of Yahoo Messenger which fixes a heap based overflow in one of its webcam related functions. Details about the update could be found at http://messenger.yahoo.com/security_update.php?id=082107.

A proof of concept for the above mentioned vulnerability was posted last month on a Chinese security forum. Later this was found and reported by a researcher of Mcafee Avertlabs. The vulnerability was fixed within one week after it was reported by Avertlabs but more than one month after it first appeared in a public forum.

Trip to Nandi Hills ,Bangalore