Week 43 In Review

Events Related

• Hack3rcon II Videos – irongeek.com
  Archive of Hack3rcon video archive.
• SecTor 2011 Presentations – sector.ca
  Audio and video archive.
• DefCon 19 Speakers and Presentations – defcon.org
  Slides and presentations archive.
• BSidesKC Videos – h-i-r.net
  I actually didn’t get to present anything this year. Not for any particular reason. All the talks were awesome and they tied together pretty well. It took me a while to get UStream working on my phone, via 3G. Also, not all the videos worked or uploaded properly, so my apologies in advance for not getting all the talks, and for the crappy video quality, especially on the slides.

Resources

• An Intense Look At The Mobile Computing Threat – pen-testing.sans.org
  I was recently honored to speak at the National Cybersecurity Innovation Conference in Washington DC where I delivered a presentation titled “An Intense Look at the Mobile Computing Threat”. I had an attentive audience, since half of the attendees couldn’t get their BlackBerry email due to the RIM outage.
• How Secure Is HTTPS Today? How Often Is It Attacked? – eff.org
  HTTPS is a lot more secure than HTTP! If a site uses accounts, or publishes material that people might prefer to read in private, the site should be protected with HTTPS.
• New Mobile Security Course And Exploit Me Mobile – labs.securitycompass.com
  At Security Compass, we have been working hard to expand our training offerings. We’re most excited about our new Mobile Hacking and Security course. If your organization is working with mobile applications this course is a fantastic primer on how mobile apps can be hacked, and how your teams can defend against these software defects.
• Got Pwned? PwneList.com Knows – threatpost.com
  With more and more victims of identity theft minted every day, figuring out if you’re one of the unlucky masses with a leaked email password is yeoman’s work. Now one security researcher is trying to make it easy with PwnedList.com, a Web site that collects leaked and stolen data, then tells Internet users whether their information is in it.
• Mobile Applications Assesments 2: A Look At Windows Mobile – pen-testing.sans.org
  In our previous article in this series, we sketched out a generic approach penetration testers and vulnerability assessment personnel can apply to assessing mobile applications. In this post, we will look at the client-side part of the assessment for Windows Mobile applications.

Tools

• Heaplocker 64 Bit – blog.didierstevens.com
  This 64-bit version gets configured via the registry, exactly like the 32-bit version of HeapLocker. The only difference is when you want to protect specific addresses, you need to use a QWORD registry value in stead of a DWORD (QWORD is 64-bit wide, DWORD is 32-bit wide).
• THC SSL DoS/DDoS Tool Released For Download – darknet.org.uk
  THC-SSL-DOS is a tool to verify the performance of SSL. Establishing a secure SSLconnection requires 15x more processing power on the server than on the client.
• Agnitio v2.1 Security Code Review Tool Released – vulnerabilitydatabase.com
  Agnitio is tool to help developers and security professionals conduct manual security code reviews in a consistent and repeatable way. Agnitio aims to replace the adhoc nature of manual security code review documentation, create an audit trail and reporting.
• Tool lets Single Laptop Take Down An SSL Server – darkreading.com
  SSL is in the hot seat again: A new, free tool is now circulating that can take down an HTTPS Web server in a denial-of-service attack using a single laptop via a DSL connection.
• UPDATE: ostinato v0.5! – code.google.com/p/ostinato/wiki/Downloads?tm=2
  Ostinato is an open-source, cross-platform network packet crafter/traffic generator and analyzer with a friendly GUI. Craft and send packets of several streams with different protocols at different rates. Ostinato aims to be “Wireshark in Reverse” and become complementary to Wireshark.
• FOCA v3.0 Released – vulnerabilitydatabase.com
  FOCA v3.0 FREE is a fingerprinrint and information gathering tool for pentesters. It searchs for servers, domains, URLS and public documents and print out discoverd information in a network tree. It also serach for data leaks such as metadata, directory listing, unsecure HTTP methods, .listing or .DS_Store files, actived cache in DNS Serves.

Techniques

• Federal Trojan aka R2D2 – evild3ad.com
  Last weekend, the German based Chaos Computer Club (CCC) published details on a backdoor trojan they claimed was being used by German authorities, in violation of German law.
• Autocomplete…again?! – blog.mindedsecurity.com
  It is possible to get key down / up events via JavaScript when a drop down autocomplete menu is shown. This means that it is possible to lure a user to play a game and steal arbitrary values from browsers autocomplete feature.
• Decrypting iPhone Apps – sensepost.com
  This blog post steps through how to convert encrypted iPhone application bundles into plaintext application bundles that are easier to analyse.
•  JSON-based XSS Exploitation – blog.watchfire.com
  In the world of Web2.0 and mash web applications, security researchers come across more and more XSS vulnerabilities that are reflected in non HTML responses.
  For example, JSON responses are becoming more and more common, but exploiting XSS vectors in those pages is considered theoretical because browsers pop up the file download dialog instead of rendering the response when the returned content-type is application/json or application/javascript.

Vulnerabilities

• Researchers Find Holes In The Cloud – h-online.com
  At an ACM workshop on cloud security, a team of researchers from Germany’s Ruhr University of Bochum led by professor Jörg Schwenk reported that attackers were, for example, able to start and stop virtual machines, and create new images and gateways, in an EC2 instance.

Other News

• Who Else Was Hit By The RSA Hackers? – krebsonsecurity.com
  The data breach disclosed in March by security firm RSA received worldwide attention because it highlighted the challenges that organizations face in detecting and blocking intrusions from targeted cyber attacks.
• Japanese Defense Contractor Admits Hacker May Have Stolen Secrets – computerworld.com
  Japan’s largest defense contractor backpedaled yesterday, saying it’s possible some secrets had been stolen by hackers who broke into the company’s network and planted malware in August.
• Hackers Targeted US Government Satellites – wired.com
  Hackers interfered with the operation of two U.S. government satellites in 2007 and 2008, according to a report to be released next month from a congressional commission.