NGUPLUS

Gaining Control Over Cloud Infrastructure Easy as One Two Three

Several months ago the Positive Research Center analyzed security of Citrix XenServer. Among other things, we studied the security of administration interfaces, and web interfaces of various system components in particular. As a result, we managed to find several critical vulnerabilities, which allow obtaining control not only over these components but over the master server as well, that is over the whole cloud infrastructure. The Citrix company was immediately notified of the detected vulnerabilities. After the issues had been fixed ([1], [2], [3]), the results were disclosed at the Positive Hack Days forum as part of the FastTrack section.

So lets get down to business.
While analyzing, we focused on three components of Citrix XenServer:

1. Web Self Service — a web based virtual machine management console.
2. vSwitch Controller — a web console for virtual network infrastructure management.
3. License Administration Console — XenServer license management service.

We tested the latest (at the moment of the research) version of XenServer (6.0.0).

Web Self Service

This component is a web based virtual machine management console.
As in all other modules, we detected a common set of web vulnerabilities:

• Cross-site request forgery (CSRF);
• Cross-site scripting (stored XSS);
• URL redirector abuse;
• HTTP response splitting.

All forms of the application were exposed to CSRF, a lot of fields were not properly filtered, what made stored XSS possible. Moreover, on the system logon page, we detected a very "useful" parameter, allowing URL redirector abuse and HTTP response splitting. The video demonstrates the automated exploit in action. The exploit obtains an administrator cookie via the first three vulnerabilities and then covers its tracks.

1. At first we redirect the administrator to a specially crafted page using URL redirector abuse.
2. The page script via CSRF creates a new system account. The user name field contains a stored XSS vulnerability. We inject useful JavaScript load to the page with a user list by exploiting the vulnerability and redirect the administrator there.
3. The injected JavaScript code sends the administrator cookie to our server and then removes the account that has just been created.

vSwitch Controller

This component was the most interesting. The following vulnerabilities were detected in it:

• Cross-site request forgery (CSRF);
• URL redirector abuse;
• HTTP response splitting;
• Insufficient authorization.

vSwitch Controller web interface uses REST API for server communication. It means that for each users action an HTTP request is generated. Depending on user privileges he or she is either allowed or not allowed to execute specific requests.

Moreover, the web interface of the vSwitch Controller allows an administrator to make configuration snapshots. Only privileged users should have the right to download these snapshots. However, it turned out that a user with read-only permissions also can download a snapshot, manually crafting a request to REST API.

GET /ws.v1/nox/snapshot//export

is substituted for the identifier of a snapshot that, which should be downloaded.
You can receive the list of all snapshots and their identifiers sending the following request:

GET /ws.v1/nox/snapshot/

The snapshot contains all vSwitch controller parameters, data of the vSwitch Controller users (account names and password hashes with salt), server SSL certificate together with a private key and plain-text credentials of the master server privileged user. You can connect via SSH to the main server of XenServer using these credentials and obtain control over the whole XenServer infrastructure. Once the access is gained, attackers’ possibilities are limited only by their imagination.

It is difficult to exploit this vulnerability as it is, because it requires privileges of a user with read-only permissions. However, the CSRF vulnerability comes to help. It allows an attacker to create a necessary account with a known password and stay unnoticed by the administrator (you only need to trick the administrator into following a phishing link).

License Administration Console

This component is meant for license management and based on Flexera Softwares free license server manager lmadmin. We managed to detect the following vulnerabilities:

• Content spoofing;
• Cross-site scripting (stored XSS);
• Cross-site request forgery (CSRF);
• Denial of service.

Reviewing the links, you can find out that the main page of the site has an interesting GET parameter – admin, which determines the address of the link to the administrator section. The value is filtered in such a way that full XSS attack is impossible, but nothing can prevent you from slipping a link to an arbitrary resource. Denial of Service can be conducted by sending only one HTTP request, in which one of the parameters is transferred as an array, for instance:

?admin[]=blah

Besides the attacker does not need to be authorized in the system. The reason is an uncaught exception if an array is transferred as a script parameter. That is why we failed to execute arbitrary code exploiting this vulnerability.

It is worth noting that the latest (at that moment) version of lmadmin already did not contain these vulnerabilities.



Finally, the following conclusion can be made: vulnerabilities ranked according to their severity as not critical should not be ignored. When applied together, several simple vulnerabilities can be exploited for conducting an attack, in the result of which an attacker will get full control over the system. Such scenarios have been successfully implemented many times (including pentesting).

No product is secured against defects; vulnerabilities have always existed and will never disappear. And it is great if vendors quickly address security issues and provide patches promptly as it happened this time, but, unfortunately, this case is not a rule.

However, risks can be mitigated. Almost all abovementioned flaws can be eliminated, if additional measures to limit access to the XenServer administration interfaces are taken. Moreover, a lot of these vulnerabilities can be triggered off by a simple CSRF attack. Increase your vigilance, especially dealing with suspicious links.

Available link for download

Formal ICC complaint over Coalition war crimes in Iraq Afghanistan

According to the latest UNICEF report (2006), in 2004 the under-5 infant mortality was 122,000 in Occupied Iraq, 359,000 in Occupied Afghanistan and 1,000 in the occupying country Australia (noting that in 2004 the populations of these countries were 28.1 million, 28.6 million and 19.9 million, respectively)(http://www.unicef.org/infobycountry/index.html).

About 1,300 under-5 year old infants will have died in Occupied Iraq and Afghanistan on Christmas Day alone, 0.5 million will die in the coming year and 1.7 million have died post-invasion due to non-provision by the US-led Coalition of life-preserving requisites demanded by the Geneva Conventions (http://www.unhchr.ch/html/menu3/b/92.htm).

Anglo-American and Australian mainstream media will simply NOT report horrendous Coalition war crimes against helpless infants and their mothers.

A detailed, formal complaint has been sent to the International Criminal Court charging the Coalition with war crimes in Occupied Iraq and Afghanistan (see Countercurrents, 21 December 2005) (http://www.countercurrents.org/us-polya211205.htm). The full text is reproduced below for your convenience. PLEASE INFORM EVERYONE.

19 December 2005

Office of the Prosecutor,

International Criminal Court,

The Hague, The Netherlands

Dear Mr Moreno-Ocampo, Mr Brammertz and Mrs Bensouda,

On 14 October 2004 I made a formal complaint against the Australian Government and its Coalition allies over war crimes in Iraq, specifically illegal invasion and subsequent horrendous civilian mortality in contravention of international law (for details of this complaint and a prior complaint sent to the 2 dozen top law officers of Australia see: http://www.newscentralasia.com/modules.php?name=News&file=article&sid=1019).

Since that complaint was made, it can be estimated from the latest UNICEF reports (see: http://www.unicef.org/infobycountry/index.html) that a further 560,000 under-5 year old infants have died in US Coalition-occupied Iraq and Afghanistan in gross contravention of the Geneva Conventions for the protection of civilians in time of war (1949).

I am accordingly renewing and extending my formal complaint of egregious war crimes against the US-led Coalition leaders responsible for (1) the irresponsible and illegal invasions and occupations of Iraq and Afghanistan; (2) deliberate conduct of military operations to minimize politically-sensitive invading military deaths at the expense of the lives of utterly innocent civilians; (3) subsequent horrendous civilian mortality in these occupied countries in gross contravention of the Geneva Conventions (1949); and (4) collateral damage involving mass mortality elsewhere in the world as a consequence of Coalition actions in Iraq and Afghanistan.

I have amplified these charges briefly below.

(1). Irresponsible and illegal invasions.

The invasions of Iraq and Afghanistan were manifestly irresponsible (as borne out by the immense mortality estimates given below) and illegal in lacking sanction from the United Nations. Indeed, by way of example, the Secretary General of the United Nations, Mr Kofi Anan, has repeatedly indicated the illegality and un-wisdom of the invasion of Iraq and the late Holy Father of the Catholic Church, Pope John Paul II, a major source of moral wisdom for humanity, also opposed the invasion of Iraq. Further, the obvious must be stated, namely that ordinary, decent people universally regard hatred, violence, war and both non-state terrorism and state terrorism as utterly abhorrent.

(2). Criminal application of high technology war yielding huge “enemy civilian death”/US military death ratios.

In World War 2 the Axis civilian deaths totalled 5.1 million as compared to Allied civilian losses in Europe and Asia totalling 54 million; US, British Empire, Axis and Soviet military losses totalled 0.29 million, 0.45 million, 5.9 million and 13.6 million, respectively. Accordingly the "enemy civilian"/"military death" "kill ratios" were 0.4 (for the Soviet forces), 9.2 (Axis), 11.3 (the British Empire) and 17.6 (the US). Implicit in the 1944 Italian Ardeatine Caves Massacre of 335 civilians ordered by Hitler in revenge for 33 German military deaths was a Nazi German attitude that regarded an "enemy civilian death"/"German soldier death" "kill ratio" (or "death ratio") of 10 as quite appropriate.

It has been possible to assess "civilian deaths" in various post-war conflicts using UN Population Division demographic data from 1950 onwards. Using this data it is possible to calculate "avoidable mortality" ("excess mortality"), which is the difference between the ACTUAL deaths in a country in a given period and the deaths EXPECTED for a peaceful, decently-run country with the same demographics (see: http://globalavoidablemortality.blogspot.com/).

The following "enemy civilian avoidable mortality"/"US combat death" "kill ratios" (in parentheses) have been calculated for the Korean War (1950-1953) (23.8), the Indo-China War (1957-1975) (276.5), the Gulf War & Sanctions War (1990-2003) (12,259), the Afghanistan War (2001-2005) (15,716) and the Iraq War (2003-2005) (323.9). The actual calculations involving the ratios of "avoidable (excess) deaths" (for the Asian country concerned over the relevant period) to "US combat deaths" (for the relevant conflict) are reproduced below (actual mortality figures are rounded off for clarity):

0.8 million Korean excess deaths/33,651 US combat deaths = 23.8

13.1 million excess Cambodian, Laotian & Vietnamese excess deaths/47,378 US combat deaths = 276.5

1.8 million Iraqi excess deaths (1990-2003)/147 US combat deaths = 12,259

1.6 million Afghan excess deaths (2001-2005)/102 US combat deaths = 15,716

0.5 million Iraqi excess deaths (2003-2005)/1,513 US combat deaths = 323.9

The above figures show that in the post-war era the US (and its allies) have grossly violated the Geneva Conventions in these Asian wars and have done so in vast excess over the "enemy civilian"/"German soldier" "kill ratio" of 10 in the Ardeatine Caves atrocity – and most clearly in the Iraq and Afghanistan Wars. The reason for these horrendous US "kill ratios" is that high technology US warfare preserves politically-sensitive US military lives at the expense of enemy civilian lives through high technology killing from afar (e.g. more bombs were dropped on Laos by the US than on all of Europe in all of World War 2); “better training” of its soldiers to overcome the natural revulsion from killing; and through improved medical technology to save the lives of wounded US soldiers. Over half of the civilian victims of these conflicts have been innocent infants under the age of 5. Thus the under-5 infant mortality in these conflicts was 0.3 million (Korea, 1950-1953); 5.6 million (Indo-China, 1957-1975); 1.3 million (Iraq, 1990-2003); 1.4 million (Afghanistan, 2001-2005); and 0.3 million (Iraq, 2003-2005). US state terrorism has indeed exacted a horrendous civilian death toll in US Asian wars (for further details see Senate Inquiry submission #112: http://www.aph.gov.au/senate/committee/legcon_ctte/terrorism/index.htm).

(3). Horrendous civilian avoidable mortality (excess mortality) in contravention of the Geneva Conventions.

The Geneva Conventions (1949) are quite explicit about the responsibility of the invader and occupier to do everything in their power to preserve the life of subject civilians (see: http://www.unhchr.ch/html/menu3/b/92.htm ). However the annual per capita medical expenditure in Occupied Iraq and Afghanistan is less than 1% of that in metropolitan USA and thus the horrendous death toll in post-invasion Iraq and Afghanistan constitutes passive genocide and a war crime (see: http://www.abc.net.au/rn/science/ockham/stories/s1445960.htm).

In general, whether a person dies violently (e.g. from bombs or bullets) or non-violently (e.g. from deprivation- or malnourishment-related causes) the end result is the same and the culpability the same. Further, the Ruler is responsible for the Ruled. Thus the Geneva Conventions (1949) demand that the foreign occupier of a country acts “to the fullest extent of the means available to it” to preserve the health and life of subject civilians (see Articles 55 and 56: http://www.unhchr.ch/html/menu3/b/92.htm):

“Article 55. To the fullest extent of the means available to it, the Occupying Power has the duty of ensuring the food and medical supplies of the population; it should, in particular, bring in the necessary foodstuffs, medical stores and other articles if the resources of the occupied territory are inadequate …

Article 56. To the fullest extent of the means available to it, the Occupying Power has the duty of ensuring and maintaining, with the cooperation of the national and local authorities, the medical and hospital establishments and services, public health and hygiene in the occupied territory, with particular reference to the adoption and application of the prophylactic and preventive measures necessary to combat the spread of contagious diseases and epidemics. Medical personnel of all categories shall be allowed to carry out their duties …”

The US-led Coalition governments have manifestly failed in their obligations under the Geneva Conventions. The latest UNICEF estimates of post-invasion under-5 infant deaths (12 December 2005; see: http://www.unicef.org/infobycountry/index.html) are quite shocking: in 2004 the under-5 infant mortality was 122,000 in Occupied Iraq, 359,000 in Occupied Afghanistan and 1,000 in the occupying country Australia (noting that in 2004 the populations of these countries were 28.1 million, 28.6 million and 19.9 million, respectively). These data indicate an Iraqi post-invasion under-5 infant mortality of over 0.3 million, about 122,000 such deaths per year or 334 daily (i.e. exceeding the death toll from the horrendous and evil 9/11 atrocities every 9 days). About 90% of these infant deaths have been avoidable.

The post-invasion avoidable mortality (excess mortality) in the Occupied Palestinian, Iraqi and Afghan Territories now totals about 0.3, 0.5 and 1.6 million, respectively, while the corresponding post-invasion under-5 infant mortality now totals 0.2, 0.3 and 1.4 million, respectively (see Senate Inquiry submission #112: http://www.aph.gov.au/senate/committee/legcon_ctte/terrorism/index.htm). Most of these deaths were non-violent – thus Iraq Body Count (see: http://www.iraqbodycount.org/) currently estimates that 27,000-31,000 Iraqis have been killed violently post-invasion (out of an estimated total of 0.5 million post-invasion avoidable deaths). UK-US state terrorism – described by Blair and Bush supporters as “democratic imperialism” but by others as “democratic tyranny” or “democratic Nazism” - has had a horrendous human cost, with under-5 infant mortality now totalling about 0.5 million each year in the Occupied Iraqi and Afghan Territories.

(4). Collateral global mass mortality as a consequence of the Iraq and Afghanistan invasions and occupations.

One major consequence of the US Coalition invasion and occupation of Iraq has been an increase in the price of oil. It has been estimated that about 55,000 people die avoidably throughout the world each day (about 36,000 being under-5 year old infants) through deprivation- and malnourishment-related causes. I have not been able to quantitatively assess the inevitably increased avoidable mortality component from increased poverty due to elevated oil prices. However global mortality due to criminal distribution, sale and consumption of opiates can be assessed from UN figures.

Since 2001 there have been about 0.4 million global drug deaths linked to US Coalition re-establishment of globally-dominant Afghan opium production (largely destroyed by the Taliban in 2000-2001 but 76% and 86% of global production in 2002 and 2004, respectively, after US Coalition invasion and conquest). About 2,000 of these 0.4 million post-2001, US Coalition-complicit, opioid-related deaths have been Australian, 3,000 Canadian, 3,200 British and 50,000 American (for detailed documentation see: http://66.102.7.104/search?q=cache:2uNU_ysF0xQJ:www.aljazeerah.info/Opinion%2520editorials/2005%2520Opinion%2520Editorials/October/26%2520o/US%2520Coalition%2520Complicity%2520in%25200.4%2520Million%2520Drug%2520Deaths%2520By%2520Gideon%2520Polya.htm+gideon+polya+al-jazeerah+%22afghan+opium%22&hl=en and also see Senate Inquiry submission #112: http://www.aph.gov.au/senate/committee/legcon_ctte/terrorism/index.htm).

Comments and conclusions

The above data clearly indicate that the members of the US-led Coalition are complicit in passive genocide, mass murder and egregious war crimes in Iraq and Afghanistan. Accordingly, the US-led Coalition leaders should be indicted before the International Criminal Court – arraigned, tried and punished. Peace is the only way but we are inescapably obliged to inform others about man-made mass mortality of fellow human beings - silence kills and silence is complicity. We cannot walk by on the other side. As Edmund Burke famously stated: “All that is necessary for evil to succeed is that good men do nothing.”

Available link for download

Fold Over Elastic What The Hell is it Exactly

Available link for download

Flu Season is not over yet but February marks the peak

As of mid February 2011, influenza activity in the United States remains elevated, but it appears to have peaked in the majority of European, North African and Middle Eastern countries.

• There were more outpatient visits for influenza-like illness (ILI): 4.5% vs the national baseline of 2.5%, it was above region-specific baseline levels in all US regions. 
• • Twenty states (Alabama, Arkansas, Colorado, Georgia, Idaho, Indiana, Louisiana, Maryland, Missouri, New Jersey, New Mexico, New York, North Carolina, Oklahoma, South Carolina, Tennessee, Texas, Utah, Virginia, and West Virginia) experienced high ILI activity.
  • Nine states (California, Florida, Hawaii, Illinois, Kansas, Kentucky, Mississippi, Pennsylvania, and Wyoming) experienced moderate ILI activity.
  • New York City and five states (Arizona, Massachusetts, Nebraska, Nevada, and Wisconsin) experienced low ILI activity.
  • Minimal ILI activity was experienced by the District of Columbia and 16 states (Alaska, Connecticut, Delaware, Iowa, Maine, Michigan, Minnesota, Montana, New Hampshire, North Dakota, Ohio, Oregon, Rhode Island, South Dakota, Vermont, and Washington).
• The geographic spread of influenza in 37 states was reported as widespread; 10 states reported regional influenza activity; the District of Columbia reported local activity; Puerto Rico, the U.S. Virgin Islands, and three states reported sporadic influenza activity, and Guam reported no influenza activity.  

Global flu activity (see CDC page for current information), was most prominent in the tropical regions of Asia. From February, cases of respiratory disease were high in Singapore and Hong Kong, and 90% of influenza-positive samples were 2009 H1N1. Influenza activity continued to rise in southern China, where 46% of ILI specimens in Week 5 tested positive for influenza, a 3% increase from Week 4. 2009 H1N1 was the predominant subtype.

According to WHO, Madagascar reported an increase in influenza activity, with the co-circulation of influenza B and A (H3N2). There was little influenza activity reported in the tropical regions of the Americas or in sub-Saharan Africa. 

Influenza activity in the majority of North African and Middle Eastern countries appears to have peaked, except for Algeria, where flu activity increased. The percentage of influenza-positive respiratory specimens was also high in Pakistan, Iran and Oman, where 2009 H1N1 and type B viruses co-circulated in relatively equal numbers.

According to the Public Health Agency of Canada, influenza activity increased slightly in Week 5, but remained below the peak reported earlier this season. The percentage of influenza-positive respiratory samples increased from 17% in Week 4 to 19% in Week 5. Since the beginning of the influenza season, 88% of subtyped influenza A specimens have been influenza A (H3N2).

According to the China National Influenza Center, influenza activity rose in recent weeks in northern China. In Week 5, 21% of influenza-like illness (ILI) specimens were influenza-positive, and 2009 H1N1 viruses were predominant. WHO reported that Mongolia saw an increase in 2009 H1N1 virus detections, while Japan saw a sharp increase in ILI activity.

Activity in the Southern Hemisphere remained low.

In Europe, 2 countries (Georgia and Luxembourg) and the Siberian region of the Russian Federation reported very high intensity of influenza activity; 8 countries reported high intensity; 27 reported medium intensity and 4 countries, low intensity. 23 countries reported widespread activity. Of the 25 countries reporting on the impact of influenza on health care systems, 1 (Georgia) reported severe impact; 14 countries reported moderate impact and 10, low impact.

Of the 41 countries reporting on consultation rates for ILI and ARI, 8 (Albania, Belarus, the Czech Republic, Iceland, Kazakhstan, the Republic of Moldova, Serbia and Slovakia) reported increases while 6 (Ireland, Israel, Malta, Norway, Spain and the United Kingdom (England)) reported decreases. Influenza activity has apparently passed its peak in 24 countries in this region. In general, the highest consultation rates were reported for children aged 0–4 and 5–14 years.

WHO/Europe received sentinel surveillance data on hospitalized SARI cases from 9 countries (Armenia, Georgia, Kazakhstan, Kyrgyzstan, Romania, the Republic of Moldova, the Russian Federation, Serbia and Ukraine). Sentinel SARI hospitalizations are at the highest levels observed for the season so far in Georgia and Serbia. In Georgia, however, outpatient clinical consultation rates declined from week 5 to week 6, while the relative percentage of both SARI and ILI specimens testing positive for influenza B increased. Sentinel SARI hospitalizations in Kazakhstan, Kyrgyzstan, Romania and the Russian Federation have declined somewhat from observed peaks in weeks 3–5, but remain notably elevated above pre-season levels, with 30–50% of sentinel SARI specimens testing positive for influenza in each of these countries. Sentinel SARI admissions in the Republic of Moldova and Ukraine are at levels below prior peaks. Nevertheless, a significant percentage of sentinel SARI specimens continue to test positive for influenza, and the proportion of influenza A detections in sentinel SARI specimens in Ukraine increased in week 6. Further information on the sentinel SARI surveillance systems represented in the EuroFlu bulletin can be found in the “Overview of sentinel SARI systems in EuroFlu”.

Table and graphs (Europe) Intensity Geographic Spread Impact Sentinel swabs Percentage positive Dominant type ILI per 100,000 ARI per 100,000 Sentinel SARI Virology graph and pie chart Albania High Local Moderate 78 16.7% Type A, Subtype pH1 and H3 503.6 (graphs) Click here Armenia Medium Local Moderate 3 33.3% None 0.0 (graphs) 81.4 (graphs) sari Click here Austria Medium None Low 70 68.6% Type A, Subtype pH1N1 0.0 (graphs) 33.2 (graphs) Click here Azerbaijan Low Sporadic Low 17 0% None 292.7 (graphs) Click here Belarus Medium Local Moderate 33 30.3% Type A, Subtype pH1 1938.6 (graphs) Click here Belgium Medium Widespread 53 62.3% Type B and Type A, Subtype pH1 391.1 (graphs) 1695.1 (graphs) Click here Bosnia and Herzegovina Type A, Subtype pH1 Available link for download Read more » Posted by Unknown at 6:51 PM Email ThisBlogThis!Share to XShare to FacebookShare to Pinterest Labels: but, february, flu, is, marks, not, over, peak, season, the, yet Older Posts Home Subscribe to: Posts (Atom)