Infosec Events » Uncategorized

Week 19 in Review – 2012

Roxanne — Mon, 14 May 2012 16:48:25 +0000

Resources

Research for SharePoint (MOSS) – owasp.org
This page contains research notes on Microsoft’s SharePoint MOSS and WSS
MS SQL – Useful Stored Procedures for SQL Injection and Ports Info – pentesticles.com
The following post lists and describes various useful stored procedures and port information for MS SQL.
Portable Executable 101 – a windows executable walkthrough – code.google.com
This graphic (PDF JPG) is a walkthrough of a simple windows executable, that shows its dissected structure and explains how it’s loaded by the operating system.
SAP Slapping – labs.mwrinfosecurity.com
Dave Hartley delivered his “SAP Slapping” presentation at the CRESTCon and BSides London security conferences recently. The talk provides a high level overview of common SAP system vulnerabilities and misconfigurations.
Scanning the Web with Ammonite – resources.infosecinstitute.com
Ammonite is a Fiddler extension used to scan web applications for common vulnerabilities like verbose and blind SQL injection, OS commanding, local file inclusion, buffer overflows, format string vulnerabilities etc.
Exploiting Windows 2008 – esec-pentest.sogeti.com
Internal network pentesting involving domain controllers requires a few steps in order to gain domain administrator access. One of them usually requires to gain local administrator access to a workstation.

Tools

Gason - BurpSuite Plugin’s Project – Google Project Hosting - code.google.com
This project contains a plugin to extend BurpSuite proxy. And know you can run gason stand alone!!
Skipfish version 2.06b Update – code.google.com
Skipfish is a fully automated, active web application security reconnaissance tool.

Techniques

Android

Android Emulator, Trusted CA, and Persistent Storage – carnal0wnage.attackresearch.com
Android periodically updates it’s SDK and somtimes when this happens, old methods for importing a Trusted CA, necessary to proxy SSL traffic, will fail and you must find a new solution.
Update – Android & SSL Cert – carnal0wnage.attackresearch.com
Thanks to the comments left by Zach from our last Android post here, it has been brought to my attention there is an easier way to do all of this with the latest AVD (4.0.3).

SecurityStreet: Unsupported Browser – rapid7.com
The purpose of this post is to point out a little-known jewel — the -m flag to meterpreter’s execute command.

Vendor/Software Patches

Microsoft Security Bulletin

MS12-029 – Critical : Vulnerability in Microsoft Word Could Allow Remote Code Execution (2680352) – technet.microsoft.com
This security update resolves a privately reported vulnerability in Microsoft Office. The vulnerability could allow remote code execution if a user opens a specially crafted RTF file. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
MS12-032 – Important : Vulnerability in TCP/IP Could Allow Elevation of Privilege (2688338) – technet.microsoft.com
This security update resolves one publicly disclosed and one privately reported vulnerability in Microsoft Windows. The more severe of these vulnerabilities could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application.
Bulletin Management Process and the May 2012 Bulletins - blogs.technet.com
Have you ever wondered why bulletins group particular issues together? Or one set of products and not another? Well today Jonathan Ness has posted an insightful Security Research & Defense (SRD) blog discussing some of the nuances and packaging decisions that went into MS12-034.
Microsoft patches 23 Windows flaws, warns of risk of code execution attacks – zdnet.com
The Patch Tuesday batch for May 2012 covers at least 23 documented vulnerabilities in Microsoft Office, Microsoft Windows, the Microsoft .NET Framework and Microsoft Silverlight.

Adobe, Microsoft Push Critical Security Fixes – krebsonsecurity.com
Adobe and Microsoft today each issued updates to address critical security flaws in their software.
PHP-CGI Vulnerability Exploited in the Wild – blog.sucuri.net
When the PHP-CGI vulnerability was disclosed, we knew it would be just a matter of days before it started to be exploited in the wild.

Vulnerabilities

Thousands of Twitter passwords exposed – news.cnet.com
It’s unclear who’s responsible for posting passwords for Twitter accounts to a public Web site. The exact number of accounts is also unclear, as Twitter says many are duplicates and many had already been suspended.

Other News

FBI Warns Travelers Using Hotel Networks About New Attack – darkreading.com
The FBI says attackers are trying to trick users into installing malware with promises of software updates.
Sniffer tool displays other people’s WhatsApp messages – h-online.com
WhatsApp Sniffer is an app able to display messages from other WhatsApp users connected to the same network as the app user.

Week 10 in Review – 2012

Roxanne — Tue, 13 Mar 2012 01:50:11 +0000

Event Related

CanSecWest

CanSecWest evolving – blog.securiteam.com
Let me say, right off the top, that I love CanSecWest. I am tired of “vendor” conferences, where you pay outrageous fees for the privilege of sitting through a bunch of sales pitches. At least CanSecWest has real information, as opposed to virtual information.
CanSecWest Day 1 Pen testing, social authentication, APR and Duqu – nakedsecurity.sophos.com
A wrap-up of the news and talks from CanSecWest 2012 in Vancouver. I highlight talks on pen testing, social authentication, vulnerability mitigation and the Duqu command and control servers.
CanSecWest Day 2 Smartphones, mobile security, iOS 5 and NFC – nakedsecurity.sophos.com
Day 2 at CanSecWest was dominated by mobile security talks. The highlights included anti-rooting technologies used in Android, iOS and a look at NFC enabled mobile phone security.
Playing with Network Layers to Bypass Firewalls Filtering Policy – home.regit.org
The slides of my CansecWest talk can now be downloaded: Playing with Network Layers to Bypass Firewalls’ Filtering Policy.

RSA Conference

B-Sides SF and RSAC 2012 Summary – rants.effu.se
One of the consistent themes I heard from attendees of B-Sides SF and RSAC this year was “this was the best year yet!” That is a huge turn-around from the cynicism that was so prevalent last year.
Invasion of the Risk Managers: Altering the Complexion of Security” – readwriteweb.com
Article about the discussion panel on risk.

Resources

M-Trends: The One Threat Report You Need to Read – blog.mandiant.com
Today is a big day. If you’ve followed us for a while you know that once a year we step back and take stock of what we’ve seen on the front lines battling targeted attacks. What is the advanced persistent threat (APT) up to?

Tools

TaskManager.xls V0.1.2 Update – blog.didierstevens.com
This is a new version of TaskManager.xls with memory usage statistics, with code given to me by sciomathman.
Zscaler tool can find unprotected embedded web servers – zdnet.com
The web-based tool can scan IP ranges to find multi-function printers and photocopiers, VOIP devices and video-conferencing systems that are currently.
Introducing Adobe SWF Investigator – adobe.com
Today I am launching a beta of a tool on Adobe Labs called, Adobe SWF Investigator. This Adobe AIR-based application is a suite of tools that may be useful to SWF developers, quality engineers, and security researchers.
Ettercap v0.7.4.1 Lazarus Released – ettercap.sourceforge.net
Ettercap is a suite for man in the middle attacks on LAN. It features sniffing of live connections, content filtering on the fly and many other interesting tricks.
Wireshark and Pcap-ng – blog.wireshark.org
When Wireshark 1.8.0 is released in the next few months it will introduce two major features: the ability to capture from multiple interfaces at once and the ability to annotate packets.
Mole v0.3 (2012-03-02) – themole.nasel.com.ar
Command line sql injection tool
WCE v1.3beta 32bit released – hexale.blogspot.com
WCE v1.3beta 32bit released.

Techniques

Testing the Security of Virtual Data Centers – community.rapid7.com
If you are doing security assessments, you are probably running into virtual servers every day. According to analyst firm Gartner, 80% of companies now have a virtualization project or program. With the recent 4.2 release of Metasploit, your next penetration test should be much more fun.
Why Security Assessments Must Cover IPv6, Even In IPv4 Networks – community.rapid7.com
What’s your company doing to prepare for IPv6? Probably not an awful lot. While 10% of the world’s top websites now offer IPv6 services, most companies haven’t formulated an IPv6 strategy for the network.
Foot printing – Finding your target… – sensepost.com
Network foot printing is, perhaps, the first active step in the reconnaissance phase of an external network security engagement. This phase is often highly automated with little human interaction as the techniques appear, at first glance, to be easily applied in a general fashion across a broad range of targets.

Vulnerabilities

Google Chrome Hacked

Pwn2Own 2012: Google Chrome browser sandbox first to fall – zdnet.com
Exploit writers at VUPEN take special pleasure in attacking Google’s Chrome browser, using a pair of zero-day flaws to defeat the browser.
CanSecWest Pwnium: Google Chrome hacked with sandbox bypass – zdnet.com
The attack, which included a Chrome sandbox bypass, was the handiwork of Sergey Glazunov, a security researcher who regularly finds and reports Chrome.
Chrome Finally Breached in Google’s $1 Million Hackathon- gizmodo.com
Google recently offered up prizes totaling $1 million for those capable of exploiting its browser Chrome. Now, at Google’s own competition called Pwnium, a student has walked away with one of the top prizes, earning $60,000 by hacking a PC running Chrome.
After the pwnage: Critical Google Chrome hole plugged in 24 hours – arstechnica.com
Underscoring the nimbleness of Google’s patching cycle, Chrome developers fixed a complex series of bugs less than 24 hours after they were demoed at a hacker conference.
Teen Exploits Three Zero-Day Vulns for $60K Win in Google Chrome Hack Contest – wired.com
A teenage hacker known as Pinkie Pie pokes a hole in Google’s Chrome browser, an unlikely winner who’s taking home $60K and a possible job at the search giant.
How Google set a trap for Pwn2Own exploit team – zdnet.com
Here’s the story of how a unique signature was used to figure out if exploit writers would take aim at the Flash Player plugin in Google Chrome

Pwn2Own Hacking Contest

Charlie Miller skipping Pwn2Own as new rules change hacking game – zdnet.com
The annual Pwn2Own hacker contest kicks off today with new rules, controversy over disclosure and the absence of a regular participant.
Pwn2Own 2012: IE 9 hacked with two 0day vulnerabilities – zdnet.com
The code execution attack, which required no user action beyond browsing to a rigged web site, also works on Internet Explorer v10.
How to Pwn the Pwn2Own Contest – wired.com
Finding zero-day exploits to win a hacking contest can be really hard work these days. So sometimes the better strategy is just to game the game.

The Ruby/GitHub hack: translated – erratasec.blogspot.com
The underlying issue is an “Insecure Direct Object Reference”, #4 on the OWASP Top 10 list of most important web-application vulnerabilities. It means that that a hacker can change what’s in the website database without having permission.

Other News

Uncle Sam: If It Ends in .Com, It’s Seizable – wired.com
The U.S. government says it has the right to seize any .com, .net and .org domain name because the companies that have the contracts to administer them are based on United States soil, according to Nicole Navas, an Immigration and Customs Enforcement spokeswoman.
Sabus sordid story detailed in FBI indictment – nakedsecurity.sophos.com
Hector Xavier Monsegur may have portrayed the exploits of Anonymous and LulzSec as a glamorous fight against “the man”, but the dark criminal realities of their exploits were exposed in his indictment. It appears he wasn’t just in it for the lulz.
Dropbox Abused by Spammers – symantec.com
Recently we noticed spammers abusing Dropbox, a popular cloud-based, file-hosting and synchronization tool, to spread spam. Dropbox accounts have a public folder where files can be placed and made publicly available. This function is useful to spammers, as it effectively turns Dropbox into a free hosting site.

Week 8 in Review – 2012

Roxanne — Mon, 27 Feb 2012 22:49:51 +0000

Resources

A look at ASLR in Android Ice Cream Sandwich 4.0 – blog.duosecurity.com
For the uninitiated, ASLR randomizes where various areas of memory (eg. stack, heap, libs, etc) are mapped in the address space of a process.
The Ultimate OS X Hardening Guide Collection – isc.sans.edu
Many security professionals tend to use OS X systems. Maybe for the nice and shiny looks, or the Unix under pinnings that make it a great platform to run current tools. However, the operating system itself isn’t exactly “secure out of the box” and like all operating systems can profit from some additional hardening tricks.
White Hat Hacker Flowchart – dankaminsky.com
A white hat hacker flowchart by Dan Kaminsky.

Tools

DPScan: Drupal Security Scanner – github.com
This small tool is public and accessible for our use. It may help other auditors or penetration testers do their job faster and gather more information.
DNSChef – thesprawl.org
DNSChef is a highly configurable DNS proxy for Penetration Testers and Malware Analysts. A DNS proxy (aka “Fake DNS”) is a tool used for application network traffic analysis among other uses.
Sqlmap plugin for BurpSuite – blog.buguroo.com
Today we present a free plugin, developed by me, so you can use the sqlmap from BurpSuite so really comfortable.
SIPVicious 0.2.7 – code.google.com
SIPVicious suite is a set of tools that can be used to audit SIP based VoIP systems. It currently consists of four tools.
Skipfish-2.04b – code.google.com
Skipfish is a fully automated, active web application security reconnaissance tool.
Social-Engineer Toolkit (SET) 3.0 released. – secmaniac.com
Greetings all. I’m excited to release the 3.0 version of the Social-Engineer Toolkit (SET) Codename “#WeThrowBaseballs”.
Metasploit 4.2 Released: IPv6, VMware, and Tons of Modules! – community.rapid7.com
Since our last release in October, we’ve added 54 new exploits, 66 new auxiliary modules, 43 new post-exploitation modules, and 18 new payloads — that clocks in at just about 1.5 new modules per day since version 4.1.

Techniques

Mobile App Permissions and Choice – pen-testing.sans.org
Recently we’ve seen a flurry of news articles identifying a weakness in the Apple iOS architecture where application developers have unrestricted access to contact book entries on your iPhone, iTouch or iPad.
Minimizing Vulnerabilities in Applications – Part 1 – resources.infosecinstitute.com
During my 20+ year career, I have seen many coding virtuosos which had only one problem – they did not pay any attention to the security of their code.
MindshaRE: a reversing tool – dvlabs.tippingpoint.com
MindshaRE is our periodic look at some simple reverse engineering tips and tricks. The goal is to keep things small and discuss every day aspects of reversing. You can view previous entries by going through our blog history or querying a search engine for dvlabs mindshare.

Vulnerabilities

iOS 5 Flaw Allows data access

Paperclips pose security threat to iPhones – technolog.msnbc.msn.com
Under the right — though easily arranged — circumstances, a simple paperclip could allow someone to circumvent your iPhone’s passcode and access your voicemail, contacts, recent call list, and other data.
iOS 5 Flaw Allows Unfettered Access to User’s Contacts, Calls – threatpost.com
A passcode flaw in Apple’s iOS 5 could allow unauthorized access to an iPhone user’s contacts list, recent calls, voicemail, text messages and more, according to a recent blog post from CultofMac.com.

New Oracle ERP Vulnerabilities Unmasked – darkreading.com
Design flaws could allow attackers to access, alter, or take over ERP systems — but will enterprises do anything about the vulnerabilities?

Other News

Plesk control panel bug left FTC sites (and thousands more) exposed to Anons – arstechnica.com
[needs validation]A critical vulnerability in Parallels’ Plesk Panel Web hosting administration tool left thousands of servers open to potential hijacking by hackers. And the recently hacked sites belonging to the Federal Trade Commission were among them, according to sources.
Note to self: Encrypt data, memorize password – news.cnet.com
In a case that serves as a reminder to: a) use encryption, and b) memorize the encryption pass-phrase, an appeals court has ruled that people have a constitutional right not to be forced to decrypt data that potentially includes evidence that could be used to prosecute them in court.
Researchers Reveal How Attackers Can Track Cell Phone Locations – threatpost.com
New research has found information leaked by cell towers can be used to determine your cell phone’s general location.
Does The Cybersecurity Act Of 2012 Mark The Beginning Of The War On Cyber-terrorism? – forbes.com
The Cybersecurity Act of 2012 is the latest effort by Congress to do something about the threat of cyber attacks and cyber crime.
NIST, Maryland Plan New Cybersecurity Center – threatpost.com
The US National Institute of Standards and Technology (NIST) announced plans Tuesday to break ground on a new center that will be committed to cybersecurity research.

Week 25 in Review – 2010

Glenn Santos — Mon, 28 Jun 2010 13:08:24 +0000

Events Related:

Who’s on…uh, at…FIRST? – windowsir.blogspot.com
My employer is not a member of FIRST, but we were a sponsor, and we hosted the “Geek Bar”.
La “Nuit Du Hack” in Paris – rootshell.be
The event was split in two parts: a set of talks about security topics and, starting from midnight, a CTF contest.
NovaInfosec Twits – novainfosecportal.com
The Twitter account for the NovaInfosec Twits list is novainfosec.
Hacking at Mach Speed! – trailofbits.com
The first ever NYC SummerCon last weekend was a blast and everyone seemed to have a great time.
Call for Papers: EC2ND’10 – honeyblog.org
EC2ND 2010 specifically encourages submissions presenting work at an early stage with the intention to act as a discussion forum for innovative security research.
Comments on Sharkfest Presentation Materials – taosecurity.blogspot.com
This is the third year that CACE Technologies has organized this conference.

Resources:

Conference on Cyber Conflict – Slides.. – thinkst.com
The CCDCOE (Cooperative Cyber DefenceCentre of Excellence) held its Conference on Cyber Conflict in Tallinn, Estonia.
The talks I’m looking forward to attending in Las Vegas – securityninja.co.uk
We are getting closer to the annual geek pilgrimage to Las Vegas for the BlackHat, DEF CON and SecurityBSides conferences.
SQL Injection Anywhere White Paper – docs.google.com
An advanced SQL Injection exploitation technique, that allows the complete disclosure of information from (almost) any SQL Injection exposure.
Public SSL Server Database / SSL Server Test – ssllabs.com
Public SSL Server Database is an online service that enables you to look up the configuration of any public SSL web server.
Live CD for Remote Incident Handling – sans.edu
Bert Hayes is a security professional at the University of Texas.

Tools:

UATester Alpha – c22.cc
This tool is designed to automatically check a given URL using a list of standard and non-standard User Agent strings provided by the user (1 per line).
JBroFuzz – owasp.org
Its purpose is to provide a single, portable application that offers stable web protocol fuzzing capabilities.
w3af 1.0-rc3 Available For Download – darknet.org.uk
The project’s goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend.
andiparos – code.google.com/p/andiparos/
Andiparos is a fork of the famous Paros Proxy.

Techniques:

TEHTRI-Security gave 13 0days against most black hats tools – tehtri-security.com
Today, during our humble new talk at SyScan 2010 Singapore, we have just released many 0days and new offensive concepts against most of the tools used by attackers currently, like web shells, exploit packs, etc.
Risk Management 103 – Choosing Threat Agents – greebo.net
We’re talking about the attackers (threat agents) on the left today.
Review of darkjumper v5.7 – stateofsecurity.com
In continuing our research and experimentation with PHP and the threat of Remote File Inclusion (RFI), our team has been seeking out and testing various tools that have been made available to help identify web sites that are vulnerable to RFI during our penetration tests.
Security Intelligence: Defining APT Campaigns – sans.org
The “persistence” in APT intrusions is manifested in two ways: maintaining a presence on your network, as well as repeatedly attempting to gain entry to areas where presence is not established.
Side Channel Attacks in SSL – ha.ckers.org
Initially it really upset me off that this paper was written, not because it’s not excellent, but because it’s partially what I was going to be speaking about at BlackHat.
How Secure are Secure Interdomain Routing Protocols? – microsoft.com
In response to high-profile Internet outages, BGP security variants have been proposed to prevent the propagation of bogus routing information.
Episode #101: Third-Party Party – commandlinekungfu.com
Yes, believe it or not, there are instances where some things are really straight-forward and fun on Windows, and are inscrutably ugly on Linux.
Comparing web application scanners – portswigger.net
Earlier this year, Larry Suto published a paper comparing web application vulnerability scanners.
In-depth analysis of a PHP attack that lead to Apple information disclosure – acunetix.com
Security experts blame this breach on “poorly designed software”.
The National Strategy for Trusted Identities in Cyberspace – whitehouse.gov
Cyberspace has become an indispensible component of everyday life for all Americans.
US interested in Aussie zombie code – zdnet.com
Australia’s Internet Industry Association (IIA) took its e-security code of conduct to the White House, where it met with Barack Obama’s cyber-security coordinator, Howard Schmidt, to discuss it as a potential model for the US internet industry to adopt.
Linux Buffer Overflow Tutorial – gunslingerc0de.wordpress.com/
Improving HTTPS Side Channel Attacks – ha.ckers.org
In regards to the previous post and the impending Blackhat speech with Josh Sokol, I thought I’d spend some time enumerating some of the possibilities for reducing the chatter over SSL/TLS that the browser introduces.
Yep, they broke it. – golubev.com
I don’t know how they test drivers or even are they test drivers at all but situation is pretty weird.
Another round of Asprox SQL injection attacks – m86security.com
Earlier this month, we reported on a new variant of Asprox malware which was being spammed out by the Pushdo botnet.
Using KillerBee with ZigBee devices – digitalbond.com
Yesterday I received a few of the Raven ZigBee USB sticks with the KillerBee firmware loaded on it, thank you Joshua Wright.
Botnet Command and Control Methods – attackvector.org
I think probably the biggest reason would be that there would be a pretty cut and dry trail of what the bots are doing.
Places to MITM – ha.ckers.org
There’s a lot of places there than an attacker can get in the middle and mess things up.
The Low Hanging Fruit scanner strategy can get you into trouble – jeremiahgrossman.blogspot.com
Vulnerabilities identifiable in an automated fashion, such as with a scanner, can be loosely classified as “low-hanging fruit”.
SQLmap 0.8 and SOAP based Web-Services – invalid-packet.blogspot.com
Lately I was pen-testing SOAP Web-Services, and I came to learn that SQLmap wasn’t aware of SOAP syntax.

Vulnerabilities:

New Firefox Flaw Enables URL Spoofing, Code Injection – threatpost.com
A prominent security researcher has identified a problem with the way that Mozilla Firefox handles links that are opened in a new browser window or tab.

Vendor/Software Patches:

Pre-Notification – Quarterly Security Updates for Adobe Reader and Acrobat – adobe.com
A Security Advisory has been posted in regards to the upcoming Adobe Reader and Acrobat updates scheduled for June 29, 2010.

Other News:

Napolitano: US must balance liberties, security – google.com
Fighting homegrown terrorism by monitoring Internet communications is a civil liberties trade-off the U.S. government must make to beef up national security, the nation’s homeland security chief said Friday.
Looking For Vulns In All The Right Places? Experts Say You Might Be Missing A Few – darkreading.com
Network-attached devices, paper documents, and your physical plant should be included in vulnerability scans, researchers warn.
Malicious code on Lenovo driver download page – Update – h-online.com
Various virus scanners issued alerts about a Java-based Trojan downloader or dropper.
Defenders of the Faith – vrt-sourcefire.blogspot.com
Quite recently, Tavis Ormandy released a 0-day vulnerability in a prominent piece of software.
Researchers find 12 zero day flaws, targeting 5 web malware exploitation kits – zdnet.com
Security researchers from TEHTRI-Security, have found 12 zero day flaws targeting 5 of the most common web malware exploitation kits.
White House unveils plan to combat online piracy and counterfeit goods – thehill.com
“I have a warning to you, we’re committed to putting you out of business,” Intellectual Property Enforcement Coordinator Victoria Espinel, also known as the “copyright czar,” said.
Apple leaves iPad vulnerable after monster iPhone patch job – computerworld.com
However, the first-generation iPhone and iPod Touch, as well as the much newer iPad, may be vulnerable to some or all of the 65 bugs.
Inquiry into Cyber Crime – aph.gov.au
On Monday 21 June 2010, the Standing Committee on Communications tabled its report on the inquiry into Cyber Crime entitled Hackers, Fraudsters and Botnets: Tackling the Problem of Cyber Crime.
Not even FBI was able to decrypt files of Daniel Dantas – g1.globo.com
Hard drives were seized by the feds during Operation Satyagraha, in 2008.
VeriSign SSL Hackable – Comodo Exposes, VeriSign Denies – networkworld.com
Comodo announced today that it requested an independent third-party to notify VeriSign of a security vulnerability affecting its customers’ web sites, including a major financial institution.
Exploiting the Exploiters – krebsonsecurity.com
Last week, French security researchers announced they had discovered a slew of vulnerabilities in several widely used “exploit packs,” stealthy tool kits designed to be stitched into hacked and malicious sites.
Researcher ‘Fingerprints’ The Bad Guys Behind The Malware – darkreading.com
Black Hat USA researcher will demonstrate how to find clues to help ID actual attackers, plans to release free fingerprinting tool.
Inside the Carding Underworld – avertlabs.com
Carder.cc is a German online forum dedicated to helping criminals in trading stolen credit card and login details obtained via their carding or phishing activities.
ATM scammers take it to a new level – dailytelegraph.com.au
Thieves set up a fake ATM that recorded the bank details of unsuspecting users whose accounts were later robbed, in the first such scam discovered in China.
Accused Hacker Who Balked at 2-Year Prison Deal Now Faces Decades – wired.com
An alleged hacker who declined a 2-year plea deal is facing decades behind bars after federal authorities Thursday added multiple charges, including possession and distribution of child pornography.
Senate Working To Consolidate Cybersecurity Bills – darkreading.com
There is broad agreement between key Senate committees in terms of key elements that need to be included in any comprehensive legislation.
Android Also Gives Google Remote App Installation Power – threatpost.com
It turns out that Android also includes a feature that enables Google to remotely install apps on users’ phones as well.

Week 43 in Review – 2009

Glenn Santos — Mon, 26 Oct 2009 16:50:03 +0000

Events Related:

S4 registration open / full agenda available – digitalbond.com
The 2010 SCADA Security Scientific Symposium has opened it registration and its schedule is now available.
RSA Europe 2009 – Day 1 Recap – infosecramblings.com
Interesting Information Security Bits RSA Catch-up Part 1 – infosecramblings.com
RSA Europe 2009 Security Bloggers Meetup Recap – infosecramblings.com
RSA Europe 2009 – Day 3 Recap – infosecramblings.com
A few of summaries on the happenings at this security event.

Resources:

PenTester Scripting – pentesterscripting.com
A site for hosting useful scripts for penetration testing
Social Engineering Framework – social-engineer.org
A comprehensive site detailing all things related to social engineering from attacks to defense tactics.
Classification: Exploit Status Overhaul – osvdb.org
OSVDB overhauled the exploit classification system for better categorization.
Metasploit Reference Support Added & More – osvdb.org
OSVDB now supports a ‘Metasploit ID’ that uses the corresponding OSVDB ID to link and auto-search their database.

Tools:

Reverse Hash Calculator – isc.sans.org
This uses a database of a couple million pre-compiled hash values.
Free Tools – windowsir.blogspot.com
A very long list of tools that might be interesting to pentesters everywhere
Vicnum v1.3 – owasp.org
Helpful to IT auditors honing web security skills and setting up ‘capture the flag’ .
CeWL – Custom Word List Generator v2.2 – digininja.org
CeWL spiders a given url to a specified depth and returns a list of words which can be used for password crackers.

Techniques:

Bob’s Double Penetration Adventure – Part 1 – synjunkie.blogspot.com
Pardoning the adult-oriented title, this is basically a story of a simple man’s quest at hacking.
PhoneSnoop – Turn a BlackBerry into a portable bug – chirashi.zensay.com
A hacker releases a tool to tap into phone calls undetected.
‘Evil Maid’ USB stick attack keylogs TrueCrypt passphrases – zdnet.com
A ‘plug-and-exploit’ technique that can help attacker decrypt a hard drive’s content
Using USBs for incident response – darkreading.com
A brief look at how USB devices can be used for good and evil
Paul Wright released whitepaper about “Create Table to OSDBA” (preprocessor exploit) – red-database-security.com
This whitepaper shows how to escalate privileges by running OS commands using create table together with utl_file.
Analysis of 10k Hotmail passwords Part 3 – brute force – reusablesec.blogspot.com
In this third installment, brute force is tested on this password subset.
List of addresses for the Pass-the-Hash toolkit -a switch – hexale.blogspot.com
A list of addresses for different versions of lsasrv.dll
How delegation privileges are represented in Active Directory – msinfluentials.com
Delegation rights are represented in the userAccountControl flag on the account object in AD, whether a user or a computer account.
Cyber Security Awareness Month – Day 21 – Port 135 – isc.sans.org
When a host wants to connect to a RPC service on a remote machine,it firsts checks with the destination machine on port 135, to know which port is being used by the service it wants to connect into.
Cyber Security Awareness Month – Day 23 port 179 TCP – Border Gateway Protocol – isc.sans.org
There are two major concerns about the security of BGP – router table corruption and blindly resetting BGP sessions.
Cyber Security Awareness Month – Day 24 – The Small Services – isc.sans.org
Some discussion on ports below 20, also called ‘small services’
Hacker Halted 2009 – neohapsis.com
A couple of hackers discussed a distributed password cracker they designed and implemented that utilizes redirected browsers to build a swarm of worker nodes.
How to decrypt Coldfusion v6 datasource passwords – hexale.blogspot.com
A blogger writes a quick perl script to decrypt DataSource passwords using TwoFish encryption.
Metasploit JSP Shells – carnal0wnage.attackresearch.com
Stephen Fewer has pushed up a jsp reverse and jsp bind shell.
Just another day at the office – root.org
A common day at Root Labs
Shellcode Tutorial 9: Generating Shellcode using Metasploit – projectshellcode.com
This tutorial is an introduction into using the Metasploit Framework to generate shellcode.
Using Nessus to audit Microsoft Patches – tenablesecurity.com
Nessus has several features, including credentialed scanning and plugins, that list missing patches and can assist in the patch verification process.

Vulnerabilities:

Gaping security hole in Time Warner cable routers – zdnet.com
A security hole in cable modems from Time Warner/Road Runner customers could potentially lead to private network access.

Vendor/Software Patches:

WordPress 2.8.5: Hardening Release – wordpress.org
A number of security hardening changes were identified that were worth back-porting to the 2.8 branch
VMware patches vulnerabilities in its products – h-online.com
The security announcement lists a total of 48 CVE entries which can be exploited to carry out denial-of-service (DoS) attacks or to compromise systems if left unpatched.

Other News:

President Obama on Cyber Security Awareness – washingtonpost.com
A short video from the US President discussing this important issue.
WASC 2008 Statistics – webappsec.org
A pool of website vulnerability data to get a better grasp on the web app vulnerability landscape.
E-banking on a locked down PC, Part II – washingtonpost.com
A reaction to reader comments on switching to another OS other than Windows for banking online
Metasploit goes commercial, sells to Rapid7
HD Moore joins Rapid7, presaging a commercial version of the popular pentesting tool.
- Metasploit Rising – metasploit.com
- Metasploit Announcement – rapid7.com
- Joining the Team – metasploit.com
- Metasploit + Rapid7 shakes up pen-test landscape – zdnet.com
- Opinions of a contributor to Metasploit about the sale to Rapid7 – darkoperator.com
Apathy Creeps In as Cybersecurity Czar Search Drags On – threatpost.com?
With five months gone since Obama’s announcement, all the optimism has been replaced by a lot of shrugging.
DHS responds to us – praetorianprefect.com
The address featured the ability to ask questions of the Secretary; we sent one in and Secretary Napolitano answered it.
Scan of Internet Uncovers Thousands of Vulnerable Embedded Devices – wired.com
Researchers scanning the internet have found nearly 21,000 routers, webcams and VoIP products open to remote attack.
Report: Cyberterror Not a Credible Threat – threatpost.com
A new report by a Washington policy think tank dismisses the idea that terrorist groups are currently launching cyber attacks.
Whitehouse.gov switches to Drupal
The open source CMS platform is now the backbone of the White House’s public website.
- WhiteHouse.gov Goes Drupal [Updated] – techpresident.com
- Whitehouse Drupal and The Open Source Security Model – ha.ckers.org
  Some commentary on the recent switch

Week 41 in Review – 2009

Glenn Santos — Tue, 13 Oct 2009 06:33:10 +0000

Events Related:

FRHACK01 copy of presentations – professionalsecuritytesters.org
A list of the slides from the recent French conference
Things I Learned at SecTor 2009 – preachsecurity.blogspot.com
SecTor 2009 thoughts and insights
- SecTor 2009 Wrapup – spywareguide.com
- My Sector ’09 Experience – anti-virus-rants.blogspot.com

Resources:

All about Website Password Policies – jeremiahgrossman.blogspot.com
Some simple guidelines when implementing password protection in a site.
Web Application Security Scanner Evaluation Criteria v1.0 – webappsec.org
WASSEC is a set of guidelines to evaluate web application scanners on their ability to effectively test web applications and identify vulnerabilities.

Tools:

VIPER Lab’s VAST Live Distro for VOIP security assessment – vipervast.sourceforge.net
The distro includes VoIP security assessment tools such as UCsniff, VoipHopper, and more.
SFDumper 2.1 has been released – sfdumper.sourceforge.net
This is an Open Source free computer forensics useful tool written in Bash Script for Linux systems.
DVWA v1.0.6 – dvwa.co.uk
Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable.
Code Crawler 2.4 Beta Release – codecrawler.codeplex.com
A tool aimed at assisting code review practitioners.
Top 15 free SQL Injection Scanners – rochakchauhan.com
A list of free SQL Injection Scanners that will be of value to both web application developers and professional security auditors.
Netsparker – The Final Beta! – mavitunasecurity.com
The latest and final beta build bakes in better performance, improved engines, among others.
Metasm – Assembly Manipulation Suite – metasm.cr0.org
Metasm is a cross-architecture assembler, disassembler, compiler, linker and debugger.
IMA Project : Identity Management Auditor Project – xmcopartners.com/ima
IMA provides a simple way to audit Identity Management, is composed of several dedicated modules.
Burp v1.2.17 – portswigger.net
Burp Scanner now allows reporting of issues in XML format, to enable easy integration with other tools.
sqlmap v0.8 – sqlmap.sourceforge.net
Sqlmap is an open source command-line automatic SQL injection tool.
Charles Proxy v3.4 – charlesproxy.com
Charles is an HTTP proxy / HTTP monitor / Reverse Proxy that enables a developer to view traffic between their machine and the Internet.
OpenSCAP v0.5.3 – open-scap.org
It is the goal of OpenSCAP to provide a simple, easy to use set of interfaces to serve as the framework for community use of SCAP
SSLScan – Fast SSL Scanner – sourceforge.net/projects/sslscan/
SSLScan queries SSL services, such as HTTPS, in order to determine the ciphers that are supported.
OpenVAS 3.0 Beta – wald.intevation.org
OpenVAS 3.0 introduces a new architecture where openvas-libraries is now mandatory dependency for openvas-client.
Windd 1.3 Final! (x86 and x64) – msuiche.net
Windd is a free Windows utility which aims at being used as a swiss-knife to acquire physical memory.

Techniques:

Oracle Password Benchmarks – red-database-security.com
Dennis Yurichev has published details about his FPGA based Oracle (DES) password cracker.
Oracle Security Worst Practices – petefinnigan.com
Pete talks about how to audit for future security issues and bad practices.
Real World Stories: How Pen Tests Complement Vulnerability Scans – coresecurity.com
Vulnerability scans when used in cooperation with penetration tests become significantly more useful in calibrating issues of risk.
Creating wordlists with JTR – carnal0wnage.attackresearch.com
Some research on creating a word list for password brute forcing
SMB2: 351 Packets from the Trampoline – metasploit.com
Some code related to Trampoline and SMB 2.0
60 million password hashes/second Oracle password cracker available – petefinnigan.com
Dennis Yurichev has finally finished up his cracker and has added a web based front end to the hardware that is accessible from his website.
Teaching John The Ripper how to Crack MD5 Hashes and more – disenchant.ch
A fix to the guide on how to use John the Ripper for cracking hashes
Penetration testing, targeted malware attacks and the future – perpetualhorizon.blogspot.com
Some thoughts on pentesting and malware
Cyber Security Awareness Month – Day 9 – Port 3389/tcp (RDP) – isc.sans.org
Microsoft’s RDP and its associated “terminal service” client and server apps have been widely used since Windows 2000 days for Windows server administration.
Cyber Security Awareness Month – Day 11 – RPCBind aka Portmapper – isc.sans.org
A review on port scanners and how to secure open ports.
Cyber Security Awareness Month – Day 12 Ports 161/162 Simple Network Management Protocol (SNMP) – isc.sans.org
SNMP is used to monitor network connected devices.
Sqlninja & Metasploit Demo – radajo.com
A pentesting demo to be presented during a course lesson in London
Burp Tip of the Day – Nikto DB Import – room362.com
An export of the list of checks to a text file so that they could be used over and over in Intruder.
Evil Maid goes after TrueCrypt! – theinvisiblethings.blogspot.com
The whole infection process takes about 1 minute, and it’s well suited to be used by hotel maids.

Vulnerabilities:

Adobe’s recent PDF flaw
Another flaw has risen on Adobe’s flagship reader
- Adobe Reader and Acrobat issue – adobe.com
- New Adobe PDF flaw under attack; Patch coming Tuesday – zdnet.com

Vendor/Software Patches:

Microsoft plans monster Patch Tuesday next week – computerworld.com
Unlucky 13 sets record as biggest-ever patch day, includes first-ever for Windows 7 RTM.

Other News:

Hotmail passwords revealed online
Over 10,000 email accounts have been posted online
- Phishing attack targets Hotmail – bbc.co.uk
- Up to 20,000+ Windows Live Hotmail account details leaked online – h-online.com
- Phished or not, leaked passwords show lazy habits – cnet.com
- Weak passwords dominate statistics for Hotmail’s phishing scheme leak – zdnet.com
- The anatomy of a Hotmail phishing attack – neowin.net
- 10k Hotmail Passwords – reusablesec.blogspot.com
- Analysis of Hotmail Passwords by Other People – reusablesec.blogspot.com
MoD ‘how to stop leaks’ document is leaked – telegraph.co.uk
The 2,400-page restricted document has found its way on to Wikileaks
Paypal evicts hacker for selling hacking tools
PayPal suspended the account of a white-hat hacker on Tuesday after someone used his research to publish a counterfeit certificate.
- PayPal Suspends Researcher’s Account for Distributing Hacking Tools – wired.com
- Man banished from PayPal for showing how to hack PayPal – theregister.co.uk
NIST maps out the emerging field of IT metrology – hackerscenter.com
Are meaningful security metrics even achievable?
Avert Labs Paper: Inside the Password Stealing Business:the Who and How of Identity Theft – hackerscenter.com
The report uncovers technical details on the capabilities, level of sophistication, and inner workings of the most infamous contemporary password-stealing malware families.
Jail chaos as lag hacker is left in charge of computer system – mirror.co.uk
A jailed hacker shut down a prison’s entire computer system – after bosses gave him the job of programming it.
Q&A: Worldwide surveillance and filtering – net-security.org
In this interview, Rafal Rohozinski discusses international surveillance and filtering issues.
Hackers Target Xbox Live – internetnews.com
Network security issues are now popping up for game console owners.
Some 100 people face 20 years in jail following a two-year investigation by the FBI. – itpro.co.uk
US and Egyptian authorities have charged 100 people in “the largest international phishing case ever conducted”.
Phishing Scam Spooked FBI Director Off E-Banking – washingtonpost.com
Not long ago, the head one of our nation’s domestic agencies received an e-mail purporting to be from his bank.
$3 Million In Click Fraud Over Two Weeks? Just The Beginning – gizmodo.com
A recently disbanded click fraud ring in China racked up $3 million worth of clicks in two weeks.
Wikileaks plans to make the Web a leakier place – itworld.com
The new upload system will give potential whistleblowers around the world the ability to leak sensitive documents to an organization or journalist they trust over a secure connection.