Week 30 In Review – 2015

Resources

• Jailbreak or Root Detection: A False Sense of Security, Part 1 – bluebox.com
  Mobile management vendors have ingrained in the industry that jailbroken and rooted devices are bad: automatically deny all access. There is a widespread fear in the industry that these “compromised” devices jeopardize enterprise networks and are prone to leaking corporate secrets.

• Best Reverser Write-Up: Analyzing Uncommon Firmware – blog.ptsecurity.com
  While developing tasks for PHDays’ contest in reverse engineering, we had a purpose of replicating real problems that RE specialists might face. At the same time we tried to avoid allowing cliche solutions.

• Conferences That Pay Their Speakers – consthatpaytheirspeakers.org

Tools

• 10 Places to Stick Your UNC Path – blog.netspi.com
  UNC paths are one of my favorite things to use during a pen test. Once I force an account to authenticate to me over SMB, I have two options: Capture and Crack the hash or Relay the hash on to another computer.

• GPS-SDR-SIM – github.com
  GPS-SDR-SIM generates GPS baseband signal data streams, which can be converted to RF using software-defined radio (SDR) platforms, such as bladeRF, HackRF, and USRP.

• RainbowCrackPlugin – github.com
  Plugin for RainbowCrack

• ODAT – github.com
  Oracle Database Attacking Tool

• HackRF 2015.07.1 – github.com
  This release contains fixes for CMake configuration bugs

• bettercap – bettercap.org
  A complete, modular, portable and easily extensible MITM framework.

• mitmproxy: release v0.13 – corte.si
  This is a slightly late announcement of the release of mitmproxy v0.13, which was pushed out the door earlier this week by my esteemed compatriots

Vendor / Software Patches

• Emergency Patch for Windows vulnerability MS15-078 released (KB3079904) – ghacks.net
  Microsoft pushed out an emergency patch yesterday via automatic updates to all supported versions of its Windows operating system that patches a critical issue that could allow remote code execution when exploited successfully.

Vulnerabilities

• Bug in latest version of OS X gives attackers unfettered root privileges – arstechnica.com
  A bug in the latest version of Apple’s OS X gives attackers the ability to obtain unfettered root user privileges, a feat that makes it easier to surreptitiously infect Macs with rootkits and other types of persistent malware.

• Car hack uses digital-radio broadcasts to seize control – bbc.com
  Several car infotainment systems are vulnerable to a hack attack that could potentially put lives at risk, a leading security company has said.

• How experts stay safe online and what non-experts can learn from them – net-security.org
  Google researchers have asked 231 security experts and 294 web-users who aren’t security experts about their security best practices, and the list of top ones for each group differs considerably:

• WordPress Patches Critical XSS Vulnerability in All Builds – threatpost.com
  WordPress rolled out a new version of its content management system this morning that addresses a nasty cross-site scripting (XSS) vulnerability that could ultimately lead to site compromise.

• vsftpd-3.0.3 released and the horrors of FTP over SSL – scarybeastsecurity.blogspot.com
  The exception to things getting very stable and calming down seems to be SSL over FTP, which has been a constant source of, uh, joy, for some time now. Some issues fixed relate to security and warrant describing here because I think they are interesting.

Other News

• Wassenaar Arrangement
  Today, Cisco filed comments on a Proposed Rule published by the Department of Commerce’s Bureau of Industry and Security (BIS) in an effort to comply with an international agreement called the Wassenaar Arrangement.
  • Google, the Wassenaar Arrangement, and vulnerability research – googlepublicpolicy.blogspot.com
  • Concerns about the Department of Commerce’s Proposed Export Rule under the Wassenaar Arrangement – blogs.cisco.com

• Car Hacking
  The latest car hacking research from Charlie Miller and Chris Valasek has elicited a broad spectrum of reactions: admiration for the skill; outrage at the danger the demo may have put drivers; and even a patch from an automaker.
  • Hackers Remotely Kill a Jeep on the Highway—With Me in It – wired.com
  • EFF Hopeful Car Hacking Demo Could Help Yield DMCA Exemption – threatpost.com
  • Fiat Chrysler Recalls 1.4 Million Vehicles to Defend Against Hacks – bloomberg.com

• Costco and Sam’s Club Shut Down Photo Sites After Hackers Break In – gizmodo.com
  Last week, hackers breached CVS’s photo site, so the company shut down its photo service to deal with potential credit card theft. But CVS wasn’t the only company affected.

• Lifelock Once Again Failed at Its One Job: Protecting Data – wired.com
  Customers who hired the infamous ID theft-protection firm Lifelock to monitor their identities after their data was stolen in a breach were in for a surprise. It turns out Lifelock failed to properly secure their data.

• Hacking Team
  The single fact not generally covered by news media is this: there is only one violation of law in this entire episode, and that one is the criminal attack on Hacking Team. The truth is that the company itself has operated within the law and all regulation at all times.
  • Statement from Hacking Team – hackingteam.com
  • The CEO of Hacking Team tells how his surveillance company is recovering from the hack that stole all its data – businessinsider.com
  • HACKING TEAM: A ZERO-DAY MARKET CASE STUDY – tsyrklevich.net
  • Hacking Team took a bunch of my Stuff – mulliner.org
  • This Free Tool Can Tell If Hacking Team’s Exploits Crawled Into Your System – readwrite.com

• Digital Misfits Link JPMorgan Hack to Pump-and-Dump Fraud – bloomberg.com
  Authorities arrested four people in Israel and Florida and revealed a complex securities fraud scheme tied to the computer hacks of JPMorgan Chase & Co. and other financial institutions.

• Online Cheating Site AshleyMadison Hacked – krebsonsecurity.com
  Large caches of data stolen from online cheating site AshleyMadison.com have been posted online by an individual or group that claims to have completely compromised the company’s user databases, financial records and other proprietary information.