[NEWS] Dedicated Mobile Services Carry Out Anonymous Web Attacks

From: SecuriTeam (support_at_securiteam.com)
Date: 07/20/05

  • Next message: SecuriTeam: "[NT] Race Driver Multiple Vulnerabilities (Broadcast Format String, Buffer-Overflow)" 
    To: list@securiteam.com
Date: 20 Jul 2005 14:28:23 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Dedicated Mobile Services Carry Out Anonymous Web Attacks
    ------------------------------------------------------------------------

    SUMMARY

    WAP stands for Wireless Application Protocol, a communication standard
    primarily designed for Information Exchange on various Wireless Terminals
    such as mobile telephones. WAP devices work with WML (Wireless Markup
    Language), a markup language similar to HTML but more strict because of
    its XML nature. WML and HTML are totally different in semantics. As such,
    there are applications located on the Internet that are able to transcode
    from HTML/XHTML to WML.

    Various Mobile Services provide malicious users with an intermediate point
    to anonymously browse web resources and execute attacks against them.

    DETAILS

    Vulnerable Systems:
     * Google's WMLProxy
     * IYHY

    An attacker can take advantage of the Google's WMLProxy Service by sending
    a HTTP GET request with carefully modified URL of a malicious nature. Such
    request hides the attacker's IP address and may slow down future
    investigations on a successful break-in since Google's Services are often
    over-trusted.

    The following URL should reveal the current IP address:
    http://ipchicken.com

    However, a similar request proxied through WMLProxy:
    http://wmlproxy.google.com/wmltrans/u=ipchicken.com
    results to:
    64.233.166.136 which belongs to Google Inc.

    Like Google's WMLProxy, IYHY.com is HTML/XHTML transcoder, although it is
    primarily designed for PDAs and Smart Phones. Still, IYHY can be used as
    an intermediate point for launching anonymous attacks. For example the
    following URL reveals IYHY IP address:
    http://www.iyhy.com/?a=http%3A%2F%2Fipchicken.com

    Attackers are able to chain Google's WMLProxy and IYHY in order to obscure
    their IP address further. For example, the following URL goes through
    WMLProxy and IYHY before getting to
    http://ipchiken.com:
    http://wmlproxy.google.com/wmltrans/u=tinyurl.com@2f9g65o

    Misuse of Services like Google's WMLProxy and IYHY must be considered as a
    hight risk in situations where they are over-trusted. Google's entries are
    often filtered out from the logs making all possible attacks undetectable.
    Moreover, attackers can make use of mobile devices to request dangerous
    URLs in order to compromise vulnerable Web Applications. If such requests
    are not monitored by the particular mobile network, there is no way to
    detect where the attack is launched from.

    Workaround:
    Mobile Services can offer cleaver parameter filtering features to prevent
    the execution of dangerous requests. However, it is important to
    understand that simple input validation technique can be easily
    circumvented. The tinyurl service can be used to obscure the dangerous
    URLs, bypassing the input validation checks that an application may have.

    It is also worth to mention that modifying the requests, in order to stop
    certain XSS and SQL Injection attacks, may completely brake the logic of
    the proxided Web Site leaving the users with unsatisfactory results.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:ppetkov@gnucitizen.org>
    Petko Petkov.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Race Driver Multiple Vulnerabilities (Broadcast Format String, Buffer-Overflow)"

    Relevant Pages

    • [UNIX] phpMyAdmin Multiple CSRF Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... phpMyAdmin Multiple CSRF Vulnerabilities ... Request Forgeries we discovered that there were multiple ways to bypass ... vulnerable to multiple attacks because before and during the 3 steps ...
      (Securiteam)
    • [Full-disclosure] Anonymous Web Attacks via Dedicated Mobile Services
      ... Anonymous Web Attacks via Dedicated Mobile Services ... * Google's WMLProxy ... request with carefully modified URL of a malicious nature. ...
      (Full-Disclosure)
    • Anonymous Web Attacks via Dedicated Mobile Services
      ... Anonymous Web Attacks via Dedicated Mobile Services ... An attacker can take advantage of the Google's WMLProxy Service by ... Such request hides the attacker's IP address and may slow down ...
      (Bugtraq)
    • [REVS] Acoustic Cryptanalysis: On Nosy People and Noisy Machines
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... emitted by a computer's CPU. ... systems is side-channel attacks: ... desktop and laptop computers, and in all cases it was possible to ...
      (Securiteam)
    • [NEWS] McAfee ePolicy Orchestrator Remote Compromise
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... request, UUID, and computer hostname. ... The data that follows first specifies a directory and xml filename, ... +06h DWORD file offset of XML ...
      (Securiteam)