While reviewing some old publications I came across this great article that was written just weeks after the 9/11 tragedy in NY.
Based on recent events disclosed around the PRISM program and US Government actions against privacy in general the article seems to be very scary with it’s foreshadowing.
Here is an excerpt taken from 2600 Magazine (Fall 2001):
It takes an event of great magnitude to really put things in perspective, to make us realize how insignificant our daily concerns can be. At the same time, such an occurrence can trigger a chain of events that wind up magnifying these concerns.
…
What is most disturbing is the speed with which things began to change after the attacks. It was as if members of Congress and other lawmakers were poised to spring into action the moment public opinion began to turn and before common sense had a chance of regaining its dominance. Within hours of the horrific events, new restrictions on everything from encryption to anonymity along with broad new powers allowing much easier wiretapping and monitoring of Internet traffic were being purposed – all with initial overwhelming support from the terrified public.
We find it absolutely unconscionable that anyone would use such a tragedy to further their own agenda – whether it be by selling a product or enacting a wish list of legislation. We’ve witnessed a good amount of both recently and its all pretty repugnant. Almost every new law purposed is something we’ve seen in the past – and rejected. And there is very little in them that would have been helpful in preventing the terrorist attacks in the first place.
Our concerns can best be summed up by this quote:
“Maybe the Senate wants to just go ahead and adopt new abilities to wiretap our citizens. Maybe they want to adopt new abilities to go into people’s computers. Maybe that will make us feel safer. Maybe. And maybe what the terrorists have done made us a little bit less safe. Maybe they have increased Big Brother in this country. If that is what the Senate wants, we can vote for it. But do we really show respect to the American people by slapping something together, something that nobody on the floor can explain, and say we are changing the duties of the Attorney General, the Director of the CIA, the U.S. attorneys, we are going to change your rights as Americans, your rights to privacy? We are going to do it with no hearings, no debate. We are going to do it with numbers on a page that nobody can understand.”
Those remarks came from Senator Patrick Leahy of Vermont, one of the few who seem to actually comprehend the serious risks we’re facing.
Today we are seeing the repercussions of the actions taken during that time, and now the train is running full speed so it will take a strong force to have any chance of derailing it.
This all reminds me of another quote from Philip K. Dick (also in 2600 Magazine Spring 2003):
…the essence of the evil government is that it anticipates bad conduct on the part of its citizens. Any government which assumes that the population is going to do something evil has already lost its franchise to govern. That tacit contract between a government and the people governed is that the government will trust the people and the people will trust the government. But once the government begins to mistrust the people it is governing, it loses its mandate to rule because it is no longer acting as a spokesman for the people, but is acting as an agent of persecution
Very interesting source code leak today for the Carberp malware family.
This black market malware once being offered for $40k will surely be of interest to anyone who conducts malware & botnet analysis. The leak included a few other tools that helped make it so successful like the bootloader, MC obfuscate, along with various functions taken from other malware source code like Zeus and Spyeye.
Which begs the question, how do we address the leakage and sharing of malware source code in the public domain?
Stoned framework with Black Hat Europe 2007 Vipin Kumar POC, detected as Sinowal
pro\source builder plugins inj’s modules etc\Сорцы и Модули\Stoned Bootkit Framework.zip
There is also a copy of Win32 Obfuscator known as Mystic Compressor.
adminpanel без иконки\bot_adm\cache\cryptor\CRYPTOR.EXE
pro\all source\BootkitDropper\nbuild\Tools\Mystic.exe
pro\all source\Locker\build\Tools\mystic.exe
pro\all source\test\Mystic.exe
pro\all source\Инфа по буткиту\Инсталятор БК\BootkitDropperPlugBuild\Tools\Mystic.exe
This article will just provide some quick steps to get Backbox Linux ready with a DB for Metasploit to use. To learn more about any of the framework commands shown below try running them with a ‘-h’ switch to see the help.
First start postgresql
sudo service postgresql start
Then login as the DBA and create a user and database
su – postgres
CREATE USER user_name WITH PASSWORD ‘SecretPassword’;
CREATE DATABASE db_name;
GRANT ALL PRIVILEGES ON DATABASE db_name to user_name;
Sometimes it really fun to watch people stumble about.
Watching the drunk bloke leave the local pub after way to many.
Seeing as he stumbles about in his drunken dance trying to stay on his feet.
Just before he hits the curb loses his footing and tumbles on his back into the middle of the roadway.
At least that’s what it feels like when you see the constant attempts to run web scanning tools against websites these days.
The scripts and tools have been dumb’d down so much that most people running the tools have no idea what they are doing.
That being said it’s not nearly as much fun if all the players don’t understand the rules to play the game.
So here is your first installment of how to UN-n00B your nikto script.
Since Nikto scans are such a commonly used tool out there it is something more website admin’s will look for and try to prevent.
The easiest way to do this is to just filter for the default Nikto user agent since many n00B’s will not bother to change this value.
Here is what it looks like in the web server logs:
Pretty easy to see the big “Kick Me” sign there.
So let’s make that look better shall we?
First we need to verify we have a newer version of Nikto (v2+) ./nikto.pl --Version (older version’s of Nikto require modification of actual perl modules not covered here)
Next we edit the nikto.conf file (for BT users that’s /pentest/web/nikto/nikto.conf)
We want to change the following value
To something more friendly
Now when we look at the web server logs we see our changes
The folks here at SecurityPimp.net have been doing this Information Security thing for some time. Back in the early days knowledge, tools, and training usually took place on a hidden BBS, and later private IRC’s. But as technology and the internet have evolved so has the training methods and sharing in our hacking community.
It’s always good to learn new things or how to do old things even better. It’s that thirst for knowledge that lead myself to a FREE subscription to a new Information Security & Hacking electronic publication known as “Hakin9”. How I came to know about this publication I do not remember but I’m sure it had something to do with the free issues and some decent talking points on the cover.
Who doesn’t like free stuff? Over the next few months I received more links for issues to download for free. Then around Fall/Winter of 2011 things changed. The “Hakin9” publication was going to start charging for their electronic monthly issues. No big deal I will pay a fair price for quality content. And so far so good right?
About that price.. So I click on the “Subscribe Now” link and see a price of $180 for a 1 year subscription. Or if you break it down $15 a month (the cost of a decent tablet, 3 x monthly Netflix subscription, 2 x annual Amazon Prime). So does this include any swag, extra tools, access to member forums or anything special? Nope.. $180 for the magazine for 1 person (guess that means others can’t read your magazine).
About that magazine.. After the first 2 issues I had downloaded I realized there was not too much “new” content included, it almost felt like a version of 2600 quarterly but with cheaper content (and no cool phone pictures). Since then I have mostly tuned out the entire publication and everything associated with it. The most interaction I have these days is seeing the Hakin9 emails spamming my garbage email account at least 2 times a week (over 300 in the past year alone) begging to buy their wares..
Then the other day I found this little gem on our twitter timeline.
Which leads you here an email thread on the Nmap boards which outlines how Hakin9 got trolled by some of their “volunteer” authors. Judging by how hard they spammed my inbox just to sell the product I can only imagine how hard these guys were spammed to give them FREE product to sell in their magazine.
So you start off with something decent and catch everyone’s attention, then modify your business model to disgust and gouge your customers. Then after charging an inflated fee for your mediocre product you do not even bother to proof read the content you sell?
And with support drying up very quickly hopefully we just see another fly by night security outfit go out into that good night..
Looking for a chance to have fun and show your stuff to the industry players?
CSAW CTF Begins this weekend.
“CSAW CTF is a entry-level CTF, designed for undergraduate students who are trying to break into security. Challenges are specifically designed to point students in directions that will help them understand fundamental concepts and develop practical skills. Our sponsors are big players in the security field, who are serious about hiring the right people with the right skills. Our judges are world-renowned experts in the security field, who are dedicated to making sure that our challenges are designed to test these skills.” https://csawctf.poly.edu/
Wish I had some wild story involving Aliens, Play-Doh, 2 wristwatches and 4 midgets to share as an excuse for my lack of updates. But the play-doh ran out before we were able to even get started.
Instead I offer this as something to help quench your hacking appetite while I was away..
It’s just human nature the more enthusiastic someone speaks about something the more it seems to stick around in your mind. This is how I would describe a recent talk on Password Cracking given by Robert Imhoff-Dousham at Defcon this year. I won’t recap his entire presentation which you can review for yourself but I will touch on a few key points which may affect many of the current policies and practices being used out in the real world today.
“Passwords must contain 8 characters and include upper case and numbers”
This ‘rule’ is often used by many websites, corporate domains, and networking devices. But as is the case with many information security standards by the time it is adopted by the masses it is already weakened or outdated. Another point of human nature is we usually take the path of least resistance, even more so when we are dealing with something uncomfortable. For most average people this could include working on computer systems. So let’s take a closer look at this rule and how that would apply.
Let’s see Password1…
While most users are hopefully wise enough not to use such an obvious word most would do the following. Use an uppercase letter as the first letter, it’s easier to remember that way since that’s the way we write. Use a number as the last character, because after all AOL only had the username “StickyBuns234” available for me.
So me as an attacker can simply modify my method of brute force to test for these specific rules, thus reducing your 8 character passwords to 6.
Well it’s brute so it would take you years to actually get this cracked right?
With the advancement of both the GPU and cloud computing markets this is no longer the case. Let’s take GPU brute forcing for example. If we take a newer 8 core GPU and use a rainbow cracking tool or a multihashing tool and pump up to 8000+ streams at the operation. Using a brute force calculator we can see that with 1 box w/4gpu’s we would require ~240 hours. Now if we spread this out across 4 boxes w/4gpu’s each we bring our time down to 2.5 days. Double the boxes and cut the time to crack in half again. Now these numbers are based on a true complex 8 character password. If users are using the flawed methods mentioned above they really have something closer to a 6 Character password depending on my table/dictionary files.
So depending on how valuable your password or passwords in general are to me. I may be able to scale a small server farm just to break user passwords (see the presentation for a cool shopping list showing a $50k 40GPU super cracking server that will eat your password up in less than 140 seconds).
Coincidentally adding just 1 or 2 characters to your required password policy can make this attack vector almost non existent again (well maybe not from the 40gpu super server).
Creating secure passwords can be as simple as coming up with a memorable phrase instead of just a word or two. Here is a great video on how to perform this task. Also remember NEVER use the same password on multiple sites, it makes it much easier to steal all your gold pieces..
One of the good things about long airport layovers are the chances you finally get to catch up on your reading. Which is what it finally took to crack open my last issue of Wired magazine. I must say I was quite amused to find an article outlining the love/hate relationship between AT&T and Apple. Since I have never been an Apple fan I usually just tune out most news related to them which may explain why many of the details in the article was new to me. The tale ends up being a good example of a “FAILationship” and the fact that it starred two of my favorite US corporations just made it that much more comical. Read the article Here
Meanwhile, no matter how frustrated AT&T got with Jobs, it had little choice but to stand by him. It would have been devastating to lose the iPhone after investing billions of dollars and endless reputational capital. And so the relationship carried on, dysfunctional and loveless though it was. Divorce, at least for the time being, was not an option.
Sometimes carrying around a laptop to conduct wireless recon can be a pain.
Today I will show how with your rooted Android & a couple free programs from the Android marketplace you can begin doing some real wireless recon.
Some other useful tools: ssh client, file manager w/SMB, RDP client, Wireless Tether,
Android Webserver, FTP client & server
Setup:
Once all programs are installed we setup our Droidwall like so
Continue doing this for Network Discovery and other programs
you wish to use during your recon fun.
Action:
We launch our WiFi Analyzer
Using the signal strength meter we find a good access point to visit.
Then we launch our Shark to eat up the packets out there.
Eventually we will end up with some data to read.
We can use Shark Reader now or a desktop later to read the data.
We can also use our Network Discovery tool to find devices
and services running on the target network.
Some more advanced techniques using some of the additional tools mentioned above could be to launch phishing attacks in areas requiring users to login thru a web based portal.
When looking for cool spots to capture some traffic try your networks, coffee shops, airports, campuses, hotels, etc…
