Week 4 In Review – 2011

Events Related

• Shmoocon 2011
  • ShmooCon 2011: Team Joch vs. Android: The Final Showdown – blog.c22.cc
  • Shmoocon 2011: Printers gone wild! – blog.c22.cc
  • ShmooCon 2011: Attacking 3G and 4G mobile telecommunications networks – blog.c22.cc
  • ShmooCon 2011: Defeating mTANS for profit – blog.c22.com
  • ShmooCon 2011: URL enlargement: Is it for you? – blog.c22.cc

Resources

• Train Like You Fight – carnal0wnage.attackresearch.com
  One of my favorite talks from this year’s BlackHat DC was Ryan Kazanciyan’s & Sean Coyne’s “The Getaway” talk on data exfiltration.
• CNIT 124 Advanced Ethical Hacking – samsclass.info
  Advanced techniques of defeating computer security, and countermeasures to protect Windows and Unix/Linux systems. Hands-on labs include Google hacking, automated footprinting, sophisticated ping and port scans, privilege escalation, attacks against telephone and Voice over Internet Protocol (VoIP) systems, routers, firewalls, wireless devices, Web servers, and Denial of Service attacks.
• Google safe browsing v2: Implementation notes – research.zscaler.com
  I wanted to share what I learned while I implementing Net::Google::SafeBrowsing2, a Perl library for Google Safe Browsing v2.
• Plug and Prey: Malicious USB Devices – irongeek.com
  This paper is meant as an overview of malicious USB devices. The paper will first lay out a proposed set of categories for malicious USB devices, how these categories function, how they differ, and how they can be used by an attacker.
• OWASP Appsec  Tutorial Series pt. 1 – youtube.com
  The first episode in the OWASP Appsec Tutorial Series. This episode describes what the series is going to cover, why it is vital to learn about application security, and what to expect in upcoming episodes.
• Blocking evil with the Enhanced Mitigation Experience Toolkit (EMET) – rsreese.com
  While experimenting with EMET I decided to put together a little presentation demonstrating how it can be used to prevent exploitation of a known threat to Acrobat Reader.
• DoD Cyber Crime Conference 2011
  My slides from the 2011 DoD Cyber Crime Conference are now available.
  • Applying the Science of Similarity to Computer Forensics – jessekornblum.com
  • Windows Memory Forensics and Direct Kernel Object Manipulation – jessekornblum.com
• Attacking Oracle Web Applications With Metasploit – vulnerabilitydatabase.com
  A great paper from Chris Gates (carnalOwnage) enumerating techniques, vulnerabilities and metasploit modules to scan, identify and own a vulnerable Oracle based system.

Tools

• THC-Hydra v6
  One of the most famous network logon cracker – THC-HYDRA, has been updated! We now have THC-HYDRA version 6!
  • THC-Hydra v6.0 Released (Celebrating 10 yrs) – vulnerabilitydatabase.com
  • Update: THC-Hydra v6 – pentestit.com
• Update : OWasp WebScarab NG v.0.2.1 is out – pentestit.com
  WebScarab is a framework for analysing applications that communicate using the HTTP and HTTPS protocols.
• Cain & Abel 4.9.37 released – net-security.org
  It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using dictionary and brute force attacks, decoding scrambled passwords, revealing password boxes, uncovering cached passwords and analyzing routing protocols.
• ms-patch-tools – codes.google.com
  This project consists of several tools for extracting useful information from Microsoft bulletins. Currently there are two tools.
• Marvin: Man In The Middle for 802.1x Links! – pentestit.com
  Marvin sure is a man-in-the-middle tool, but it not your usual run of the mill MITM tool. It is not for the times when you would like to arp poisoning.
• Malware Attribute Enumeration & Characterization v1.1 released – vulnerabilitydatabase.com
  MAEC™ International in scope and free for public use, MAEC is a standardized language for encoding and communicating high-fidelity information about malware based upon attributes such as behaviors, artifacts, and attack patterns.
• The Social-Engineer Toolkit v1.2 “Shakawkaw” Released – secmaniac.com
  This version of SET does not include any new attack vectors however does incorporate two new exploits from Metasploit, has some bug fixes, but most importantly introduces a significant step in allowing individuals build and automate additions onto the toolkit.

Techniques

• Alexa Illustrates Web Security Risks (part 2) – research.zscaler.com
  I wanted to circle back and close the loop from my original post on this. First- not surprisingly I’m not the only one to have taken note at malicious sites landing in Alexa.
• PDF security under the microscope: A review of OMG-WTF-PDF – nakedsecurity.sophos.com
  At the end of last year, while preparing for the presentation I gave at the Virus Bulletin conference, I intentionally avoided reading other papers about PDF security by other researchers because I felt that it would confuse my talk.
• 8 gdb tricks you should know – blog.ksplice.com
  Despite its age, gdb remains an amazingly versatile and flexible tool, and mastering it can save you huge amounts of time when trying to debug problems in your code. In this post, I’ll share 10 tips and tricks for using GDB to debug most efficiently.
• Nmap 5.50: Now with Gopher protocol support – seclists.org
  Hi folks!  It has been a year since the last Nmap stable release (5.21) and six months since development version 5.35DC1, so I’m pleased to release Nmap 5.50!  I’m sure you’ll find that it was worth the wait!
• Basic .Net Reversing Part-2 – blog.kaffenews.com
  As promised in the first part, in 2nd part of the series we will crack the crack me used in first tutorial using .NET Reflector.
• Praeda Release – foofus.net
  PercX has been furiously hacking multi-function printers, and the result is a new tool called Praeda. Praeda is used to interrogate printers from a variety of manufacturers in an effort to gain information about a target network, or compromise credentials.

Vulnerability

• Microsoft MHTML Script Injection Vulnerability
  Microsoft warned today that hackers have published instructions for attacking a previously unknown security hole in all versions of Windows that could be exploited to siphon user data or trick users into installing malicious code.
  • Microsoft: Exploit Published for Windows Flaw – krebsonsecurity.com
  • More information about the MHTML Script Injection vulnerability – blogs.technet.com
  • Microsoft Security Advisor for MHTML via Internet Explorer – isc.sans.edu

Other News

• Is the answer more InfoSec Conferences – blog.thinkst.com
  I’m not saying that InfoSec Conferences are bad (although many a battered liver would disagree), but what i am saying is that we don’t seem to be improving our security posture at the same rate as we seem to be growing our conferences. Something is not right here.
• Erasing drives should be quick and easy – computer-forensics.sans.org
  In the past years, I have seen many many false and misleading statements about what is needed to securely erase or wipe a hard drive.
• Egypt Unplugged from the Internet – krebsonsecurity.com
  As many readers no doubt know, the Egyptian government on Thursday severed the nation’s ties with the rest of the Internet, in an apparent effort to disrupt political protests calling for an end to the 30-year rule of Egyptian leader Hosni Mubarak.
• Amazon.com Security Flaw Accepts passwords That Are Close, But Not Exact – wired.com
  An Amazon.com security flaw allows some customers to log in with variations of their actual password that are close to, but not exactly, their real password.
• Data-Leak Flaw Found In newest version of Google Android – darkreading.com
  Google’s new Android version 2.3, a.k.a. Gingerbread, was supposed to close a previous data-leak hole in the smartphone operating system, but a researcher has discovered a new, similar hole in the OS.
• Ethics of password cracking/dissemination – skullsecurity.org
  Anyway, this post is going to cover some of the pros and cons of what I do, and why I think that I’m doing the right thing, helping the world, etc.