Week 19 in Review – 2013

Event Related

• SyScan 2013
  • SyScan13: Revisiting Mac OS X Rootkits presentation – reverse.put.as
    SyScan 2013, 10th anniversary edition is over! It is a great conference and I hope it does not end here. I had lots of fun and met new interesting people. Thomas is an awesome host! It helps that I really like Singapore and Asia in general.
  • SyScan :: Download Section – syscan.org
    SyScan is a deep knowledge technical security conference. It is the aspiration of SyScan to congregate in Asia the best security experts in their various fields, to share their research, discovery and experience with all security enthusiasts in Asia.
• Introducing Daisho – ossmann.blogspot.com
  At TROOPERS13, Dominic Spill and I presented Introducing Daisho, Monitoring Multiple Technologies at the Physical Layer (video, slides).
• Tektip ep24 -Moloch – tekdefense.com
  In this episode of Tektip, we take a closer look at one of the most exciting projects showed at Shmoocon 2013, Moloch.

Resources

• OWASP Top Ten for 2013 – bankinfosecurity.com
  The OWASP Top Ten list of application security risks was created more than a decade ago to be the start of an industry standard that could bootstrap the legal system into encouraging more secure software. Here are the 2013 updates.
• IOS Application security Part 2 Getting class information of IOS apps – resources.infosecinstitute.com
  In this article, we will look at how we can analyze any preinstalled app on your device or any other app downloaded from App store and discover things about the source code of the app like the classes that it uses, the names of the view controllers it uses, the internal libraries, and even intricate details like the variables and methods names used in any particular class or view controller.

Tools

• SpiderFoot – The Open Source Footprinting tool – spiderfoot.net
  Spiderfoot 2.0 – the open source footprinting tool.
• AV0id – Anti-Virus Bypass Metasploit Payload Generator Script – commonexploits.com
  Introducing a simple script I have created to bypass most Anti-Virus products. This script is based on scripts I used whilst attempted to avoid A.V, credit to all authors of the mentioned scripts below for their research and work. This was just a very quick script I put together to make life a bit easier.
• Netcat without -e? No Problem! – pen-testing.sans.org
  Netcat is fantastic little tool included on most Linuxes and available for Windows as well. You can use Netcat (or its cousin, Ncat from the Nmap project) to create a reverse shell as follows.

Techniques

• Quickly Determine Allowed Outbound Ports – securitypadawan.blogspot.com
  This is nothing new, I just simply wanted to share a couple quick ways to find open outbound ports using native command shells and letmeoutofyour.net.

Vendor/Software Patches

• Department of Labor IE 0-day Exploit (CVE-2013-1347) Now Available at Metasploit – community.rapid7.com
  First off, according to Microsoft’s advisory, only Internet Explorer 8 is vulnerable to this exploit, and we verified that with a fully patched Windows 7 with IE8. If you are looking for an excuse to upgrade to something more recent, the following image demonstrates IE8’s weakness.