Week 12 In Review – 2011

Events Related

• Outerzone 2011 Hacker Con – irongeek.com
  The following are videos of the presentations from the Outerzone 2011 hacker conference.

Resources

• web.config Security Analyzer
  This little beauty let’s you feed in a Web.config then it comes back and tells you everything you’ve done wrong in the world of security configuration.
  • web.config Security Analyzer – wcanalyzer.com
  • Continuous Web.config security analysis with WCSA and TeamCity – troyhunt.com

• OWASP Top 10
  If you’ve spent any time defending web applications as a security analyst, or perhaps as a developer seeking to adhere to SDLC practices, you have likely utilized or referenced the OWASP Top 10.
  • OWASP Top 10 Tools and Tactics – resources.infosecinstitute.com
  • A Deliberately Vulnerable Set of PHP Scripts That Implement the OWASP Top 10 – irongeek.com

• Focusing on the Spirit of NIST’s Guidance For Continuous Monitoring – blog.coresecurity.com
  The National Institute of Standards and Technology (NIST) has regularly recommended new guidance to help give agencies a clearer deployment path to a more robust information security program.
• Viewpoint Paper on Threats and Vulnerabilities – jps.anl.gov
  I would go even further and argue that understanding Vulnerabilities is more powerful than understanding Threats—regardless of the relative difficulty of TAs vs. VAs.
• The Key Skill-Set of Great Penetration Testers – thehackeracademy.com
  For me, the difference between Keatron’s list and a great penetration tester comes down to one thing: intelligence types.   Specifically, the difference between convergent intelligence and divergent intelligence.

Tools

• Metasploit VNC Password Extraction – room362.com
  I ran into the same issue on Penetration Tests in the past but didn’t know much about the wacked out version of DES that RFB (the VNC protocol) was using.
• Update: Inspathx r66 – code.google.com
  Inspathx is a tool that uses local source tree to make requests to the URL and search for path inclusion error messages.
• Update: JBroFuzz 2.5! – sourceforge.net
  JBroFuzz is a web application fuzzer for requests being made over HTTP or HTTPS. Its purpose is to provide a single, portable application that offers stable web protocol fuzzing capabilities.
• Update: Skipfish-1.85b! – code.google.com
  Skipfish is a fully automated, active web application security reconnaissance tool.
• Update: WhatWeb v.0.4.6! – github.com
  WhatWeb next generation web scanner identifies what websites are running. Released at the Kiwicon conference (kiwicon.org) in Wellington, New Zealand.
• Pastenum – Pastebin/pastie enumeration tool – corelan.be
  When conducting a pen-test, the process typically starts with the reconnaissance phase, the process of gathering information about your target(s) system, organization or person.
• The Open Pentest Bookmark Collection v1.4 – securityaegis.com
  News, news, news… Hey guys and gals of the security community.  We are pleased to announce the release of version 1.4 (yes 1.3 squeaked by without a blog post) of the Open Pentest Bookmarks Collection.
• New SNMP Metasploit Modules – carnal0wnage.attackresearch.com
  My new favorite modules (for today) are the snmp_enumusers and snmp_enumshares modules that work against windows hosts that have snmp running.

Techniques

• PenTest Perfect Storm 6: We Love Cisco! – willhackforsushi.com
  In the webcast, hosted by CORE Security Technologies, we discussed attack techniques against Cisco devices, combining wireless, network and web app techniques to exploit common network architectures.
• Metasploit: Adobe Flash CVE-2011 – blog.metasploit.com
  Recently, I spent about a week and a half working on the latest 0-day Flash vulnerability. I released a working exploit on March 22nd 2011. The original exploit was just an attempt to get something working out the door for all of our users.
• Attack using CVE-2011-0609 – f-secure.com
  Attackers have been taking advantage of the situation in Japan to trick their targets into opening malicious files. These cases have used infected Excel attachments with Flash exploits.
• Extracting AP names from Packet Captures – packetstan.com
  Years ago, while working as a Network Engineer, I did a bit of sniffing of our wireless access points. I noticed that some access point, mainly Cisco, broadcast the Access Point’s name.

Vendor/Software Patches

• Apple releases Mac OS x 10.6.7 update – h-online.com
  In the software update notes, Apple also recommends the update “for all early 2011 MacBook Pro models”.
• Firefox 3 Updates and SSL Blacklist Extension – isc.sans.edu
  At the heels of yesterday’s Firefox 4 release, we today got 3.6.16 and 3.5.18. As usual, Mozilla will provide security updates for some older browsers after the release of a new major version.
• Adobe fixes Vulnerabilities in Flash, AIR and Acrobat – h-online.com
  Adobe has released updates to its Flash Player, Acrobat and Acrobat Reader products to fix related security vulnerabilities in these products that potentially allowed an attacker to compromise a system by means of a crafted SWF embedded in an Excel file.

Vulnerabilities

• SCADA: The Luigi Auriemma files
  The security of critical infrastructure is in the spotlight again this week after a researcher released attack code that can exploit several vulnerabilities found in systems used at oil-, gas- and water-management facilities, as well as factories, around the world.
  • Interview with Luigi Auriemma of 34 0day ICS Vulnerabilities – digitalbond.com
  • Italian Researcher Publishes 34 ISC Vulnerabilities – digitalbond.com
  • Vulnerabilities in some SCADA server software – seclists.org
  • Attack Code For SCADA Vulnerabilities Released Online – wired.com
  • Another zero-day exploit for SCADA systems – h-online.com

• Advanced Exploitation of the recent Flash Zero-Day Vulnerability – blog.fortinet.com
  Looking into it more in-depth, I was then able to confirm that this vulnerability is a perfect real-world example of program flow validation error.

Other News

• The Comodo Conspiracy
  Thus, while an Iranian state-sponsored attack is a plausible theory, it’s not the only one.
  • List of Fraudulently Issued Certificates – comodo.com
  • A brief introduction to web ‘certificates’ – erratasec.blogspot.com
  • No Reason to Believe Comodo Attack Came from Iranian Government – erratasec.blogspot.com
  • Web Browsers and Comodo Disclose A Succesful Certificate Authority Attack, Perhaps from Iran – freedom-to-tinker.com
  • Comodo RA Compromise – isc.sans.edu
  • Microsoft Advisory About Stolen SSL Crtificates – isc.sans.edu
  • Microsoft Warns: Fraudulent digital certificates issued for high value websites – zdnet.com
  • Comodo CA Compromised by Iran? – djtechnocrat.blogspot.com
  • Hack Obtains 9 Certificates to prominent Websites; traced to Iran – wired.com
  • SSL meltdown forces browser developers to update – h-online.com
  • Phony SSL Certificates issued to Google, Yahoo, Skype and others – threatpost.com
  • Fraudulent Certificates Issued by Comodo, is it time to rethink who we trust? – nakedsecurity.sophos.com
  • How the Comodo Certificate fraud calls CA trust into question – arstechnica.com
  • Comodo certificate issue follow up – blog.mozilla.com

• Homegrown: Rustock Botnet fed By U.S. Firms – krebsonsecurity.com
  Aaron Wendel opened the doors of his business to some unexpected visitors on the morning of Mar. 16, 2011.

• HD Moore Releases His Process for Security Research – resources.infosecinstitute.com
  HD Moore is Chief Security Officer at Rapid7 and Chief Architect of Metasploit, the leading open-source penetration testing platform.
• Industrial Control Systems: security holes galore – h-online.com
  It seems that Stuxnet has given many security experts an interest in the potential holes in industrial control and SCADA (Supervisory Control and Data Acquisition) systems.
• McAfee Acquires Sentrigo – securosis.com
  McAfee has had a partnership with Sentrigo for a couple years, and both companies have cooperatively sold the Sentrigo solution and developed high-level integration with McAfee’s security management software.