Week 9 in Review – 2012

Event Related

• RSA Conference 2012
• RSA Conference 2012: Stress and burnout in infosec careers– csoonline.com
  IT security professionals are experiencing extreme levels of stress and burnout, but they have few places to turn for help.
• RSA Conference Photos– tripwire.com
  Here are our photos from the RSA Conference 2012. Each day of the show, we asked attendees to help us finish various statements.
• QOTD from securityburnout.org– isc.sans.edu
  In the “too good to pass up on” category we find an article by Iain Thomson in El Reg regarding a survey of stress levels among IT security staff. Iain reports on Jack Daniel’s (founder of the Security B-Sides conference) well attended presentation at RSA this morning.

Resources

• Teensy PDF Dropper Part 2 Didier Stevens– blog.didierstevens.com
  Last year I showed how to use a Teensy micro-controller to drop a PDF file with embedded executable. But I was limited to a file of a few kilobytes, because of the Arduino programming language I used for the Teensy.
• Mobile Threat Report, Q4 2011– f-secure.com
  Yesterday, our Mobile Threat Report, covering the 4th quarter of 2011, was made available for public release — now, we share it with you. Past reports have been produced for internal use, this is our first external release.
• Sample Penetration Test Report– offensive-security.com
  There are two different ways of doing things in this InfoSec world we are in. We can chase the money, or we can focus on doing what we feel is right. Then do that with passion.
• A Framework for Vulnerability Reports– bankinfosecurity.com
  A consortium of eight major information technology companies is continuing development of a free framework designed to make it easier to exchange information about security vulnerabilities.
• Which Security Certification Should I Get?– resources.infosecinstitute.com
  When it comes to deciding what security certifications to pursue, IT professionals should understand that they will be better off career-wise if they ask—and then answer—the right questions before choosing.

Tools

• CSRF PoC Generator Plugin
• Burp Suite CSRF PoC plugin source code– github.com
  Creates a CSRF PoC with in a jiffy
• Screenshots
• (1)http://imgur.com/gAf2a (2)http://imgur.com/Zry5O (3)http://i.imgur.com/tYha2.jpg
• Artillery 0.4 Released– svn.secmaniac.com
  Artillery is a combination of a honeypot, monitoring tool, and alerting system. Eventually this will evolve into a hardening monitoring platform as well to detect insecure configurations from nix systems.
• Hardanger – Web Application Penetration Testing Platform – hardanger.codeplex.com
  Hardanger is an open source web application penetration testing platform for Microsoft Windows operating systems.
• OWASP AJAX Crawling Tool 1.2b Released– code.google.com
  OWASP AJAX Crawling Tool is a tool which will automate the crawling of AJAX applications. It can be daisy-chained with other proxies (like ZAP or Burp) to allow the functionality of those tools to be used on aspects of a web app that traditional spidering tools will miss.
• WCE v1.21 64-bit version released– hexale.blogspot.com
  I just released WCE v1.21 64bit. This is a minor release, only for the x64 version of WCE.
  It fixes some minor issues with the tool when run on Windows Server 2008.
• Forensic FOCA v1.0.0 Released– informatica64.com
  Forensic FOCA is a tool for forensic analysts focused on the use of metadata files to generate a forensic case.
• BeEF v0.4.3.2 Alpha Released– nodeload.github.com
  The Browser Exploitation Framework (BeEF) is a powerful professional security tool. BeEF is pioneering techniques that provide the experienced penetration tester with practical client side attack vectors.

Techniques

• Stealing Servers Through Directory Traversal– pentestgeek.com
  Recently I was conducting an internal penetration test for a client that is part of the financial industry. Since this client is a financial institution they are required to have an independent 3rd party company audit their security once a year per NCUA and FDIC requirements.
• Debugging Fun Putting a process to sleep()– corelan.be
  Recently I played with an older CVE (CVE-2008-0532, http://www.securityfocus.com/archive/1/489463, by FX) and I was having trouble debugging the CGI executable where the vulnerable function was located.
• Protecting Privileged Domain Accounts: Safeguarding Password Hashes – forensics.sans.org
  Have you ever made a connection to a potentially compromised remote machine using a privileged domain account and wondered if there was any chance that your privileged credentials could be revealed in some way to the attacker?
• CAPTCHA Re-Riding Attack– blog.opensecurityresearch.com
  The CAPTCHA re-riding attack bypasses the CAPTCHA protections built into the web application. The attack exploits the fact that the code which verifies a CAPTCHA solutions sent by the user does not clear the CAPTCHA solution from the HTTP session.

Vulnerabilities

• For the record: Too Many Words About the Plesk SQLi– reddit.com
  This got rather long and maybe a bit more vitriolic than I intended from the outset. Sorry. It’s frustrating.

Other News

• NIST Updating Catalog of Controls– bankinfosecurity.com
  “The changes we propose in revision 4 are directly linked to the current state of the threat space – the capabilities, intentions and targeting activities of adversaries – and analysis of attack data over time,” Ross says.
• Espionage malware with ties to RSA hack snags scores of government PCs– arstechnica.com
  As many as 200 computers belonging to government ministries, a nuclear safety agency and a regional petroleum company are under the control of sophisticated espionage software that has ties to attackers who have previously penetrated RSA, the Dalai Lama’s network, and dozens of high-level government systems, researchers said.
• DOD spending $500B on 6 preparations for cyber war– venturebeat.com
  Cyber war is more than a threat, it is something the Department of Defense is spending money on as we speak. Deputy Secretary of Defense Ashton Carter outlined six ways the DOD is taking action today, as well as legislation he believes can help the government act quickly against hackers at home and abroad.
• Cable-Modem Hacker Convicted in Boston– wired.com
  Cable-modem hacker Ryan Harris has been convicted of helping users steal internet access that authorities say involved a $1 million scheme to defraud cable companies of business.
• Hackers Elect Futuramas Bender to the Washington DC School Board– pcworld.com
  One Bender Bending Rodríguez was elected to the 2010 school board in Washington DC. A team of hackers from the University of Michigan got Bender elected as a write-in candidate who stole every vote from the real candidates. Bender, of course, is a cartoon character from the TV series Futurama.
• New ‘HTTPS Everywhere’ Version Warns Users About Web Security Holes– eff.org
  The “Decentralized SSL Observatory” is an optional feature that detects encryption weaknesses and notifies users when they are visiting a website with a security vulnerability – flagging potential risk for sites that are vulnerable to eavesdropping or “man in the middle” attacks.