The Middler is a Man in the Middle tool to demonstrate protocol middling attacks. Led by Jay Beale, the project involves a team of authors including InGuardians agents Justin Searle and Matt Carpenter. The Middler is intended to man in the middle, or “middle” for short, every protocol for which we can create code.

In our first alpha release, we released a core built by Matt and Jay, with introductory plug-ins by Justin and InGuardians agent Tom Liston. It runs on Linux and Mac OS X, with most of the code functional on Windows and BSD Unix.

The current codebase is in the alpha state, but a beta release is coming soon, with better documentation (see the wiki), easier installation, and even more plug-ins.

Plug-ins

• plugin-beef.py – inject the Browser Exploitation Framework (BeEF) into any HTTP requests originating on the local LAN
• plugin-metasploit.py – inject an IFRAME into cleartext (HTTP) requests that loads Metasploit browser exploits
• plugin-keylogger.py – inject a JavaScript? onKeyPress event handler to cleartext forms that get submitted via HTTPS, forcing the browser to send the password character-by-character to the attacker’s server, before the form is submitted.

The author team has done a tremendous amount of research, design and pseudo-code work, fleshing out attacks on web-based e-mail systems and social networking sites.

Dependencies

The Middler depends on the following Python modules:

• scapy
• libpcap
• readline
• libdnet
• beautifulsoup

You can download The Middler here:

middler-alpha-2009022301.tgz

Or read more here.

Tags:  hacking tool,  inguardians,  jay beale,  Network Hacking,  network hacking tool,  network-security,  Privacy,  session cloning,  session cloning tool,  the middler,  user session cloning

This story actually gave me a lot of LULZ, how stupid can you be seriously? Man this guy made so many mistakes for someone so paranoid (he had a web cam setup outside his appartment door so he could see who was coming)..

But then he exposed his IP address on IRC, posted his face on some freaky vampire site and posted up screenshots of the HVAC system he ‘owned’ on a forum.

He wasn’t exactly making it hard for someone to find him..especially seen as though he actually WORKED IN THE HOSPITAL.

The leader of a malicious hacker collective who used his job as a security guard to breach sensitive Texas hospital computers has been arrested just days before his group planned a “massive DDoS” attack for the July 4 Independence Day holiday.

Jesse William McGraw, 25, of Arlington, Texas, was taken into custody late Friday evening after posting screenshots showing he had complete control of computers that administered air-conditioning systems at The Carrell Clinic in Dallas, federal prosecutors said. McGraw also brazenly posted videos showing him installing malware on hospital computers that made them part of a botnet he operated, said a network security expert, whose sleuthing uncovered the breach.

As a contract security guard at the hospital, McGraw had no authorized access to any of its computers. But that didn’t stop the miscreant, who went by the handle GhostExodus, from taping himself as he walked down the halls of the hospital with a blue security guard uniform poking out through a gray hoody, as he bragged about gaining control over sensitive computers.

If there was ever an original script kiddy, I think this guy fits the bill perfectly.

Seems like his l33t hacking skills extend to walking into rooms he has access too (with a security card), and taking some screenshots!

Or perhaps even sometimes he booted in with BackTrack and reset the passwords.

“It’s a unique mindset among these hackers,” said Wesley McGrew, a 29-year-old network PhD network security researcher at Mississippi State University. “It’s all about respect and fame and the respect of their equally weird peers.”

According to McGrew and federal prosecutors in Dallas, McGraw was the leader of a hacker gang known as the Electronik Tribulation Army. He had recently posted videos admonishing fellow hackers to carry out a “massive DDoS,” or distributed denial of service, attack on July 4, a date he called “Devil’s Day”. While the target and other details of the attack are unknown, the investigators are taking the threat seriously because McGraw, prior to his arrest, had tendered his resignation as a security guard job effective July 3.

According to court documents, hospital officials had experienced problems with their HVAC, or heating, ventilation and air-conditioning, units and were perplexed why none of the system alarms had gone off as programmed. Had they seen screenshots posted here by someone calling themselves GhostExodus, they would have known why. They images showed the HVAC control window for the hospital’s surgery unit. A test alarm setting was turned to “inactive.”

“You almost can’t help it ya know,” GhostExodus writes. “It must be done!”

Yah you just can’t help messing with the critical HVAC system of a hospital YOU TOOL. What is the point of that anyway, other than bragging rights (which will only impress other script kiddies).

Who knows…I guess if he had any real skills he wouldn’t be working as a security guard and he’d actually be using his talent to make some real bank.

Oh well, good luck to you I say GhostExodus.

Source: The Register

Tags:  arrested,  botnet,  ddos,  dos,  fail,  ghostexodus,  hacker arrested,  hospital hacker,  jesse william mcgraw,  malware,  owned,  pwned,  script kiddy

Kon-Boot is an prototype piece of software which allows to change contents of a Linux kernel (and now Windows kernel also!!!) on the fly (while booting).

In the current compilation state it allows to log into a Linux system as ’root’ user without typing the correct password or to elevate privileges from current user to root. For Windows systems it allows to enter any password protected profile without any knowledge of the password.

It was mainly created for Ubuntu, later the author has made a few add-ons to cover some other Linux distributions.

Entire Kon-Boot was written in pure x86 assembly, using old grandpa-geezer TASM 4.0.

Latest Updates – Kon-Boot for Windows

Kon-Boot was moved to Windows platforms. So now it provides support for Microsoft Windows systems and also the Linux systems listed below. Kon-Boot for Windows enables logging in to any password protected machine profile without without any knowledge of the password. This tool changes the contents of Windows kernel while booting, everything is done virtually – without any interferences with physical system changes. So far following systems were tested to work correctly with Kon-Boot:

• Windows Server 2008 Standard SP2 (v.275)
• Windows Vista Business SP0
• Windows Vista Ultimate SP1
• Windows Vista Ultimate SP0
• Windows Server 2003 Enterprise
• Windows XP
• Windows XP SP1
• Windows XP SP2
• Windows XP SP3
• Windows 7

No special usage instructions are required for Windows users, just boot from Kon-Boot CD/Floppy, select your profile and put any password you want. You lost your password? Now it doesnt matter at all.

It has been tested with the following Linux distributions:

• Gentoo 2.6.24-gentoo-r5 GRUB 0.97
• Ubuntu 2.6.24.3-debug GRUB 0.97
• Debian 2.6.18-6-6861 GRUB 0.97
• Fedora 2.6.25.9-76.fc9.i6862 GRUB 0.97

You can download Kon-Boot here:

Floppy Image – FD0-konboot-v1.1-2in1.zip
CD ISO Image – CD-konboot-v1.1-2in1.zip

Or read more here.

Tags:  forgot linux password,  forgot windows password,  kon boot,  konboot,  lost linux password,  lost root password,  lost windows password,  Password Cracking,  password reset,  password reset tool,  reset linux password,  reset linux root password,  reset windows password

For people of my age and generation and I’d guess for most readers of Darknet, Michael Jackson would have had a great influence on our lives.

The biggest news last week was most certainly his death, as usual the bad guys were extremely quick to capitalize on this and were sending out spam within hours of the announcement.

It was suspected malware would follow shortly after, and it did according to F-secure.

Within hours of the death of pop star Michael Jackson, spam trading on his demise hit inboxes, a security firm said today as it warned that more was in the offing.

Just eight hours after news broke about Jackson, U.K.-based Sophos started tracking the first wave of Jackson spam, which used a subject head of “Confidential — Michael Jackson.” The spam wasn’t pitching a product or leading users to a phishing or malware Web site, but instead was trying to dupe users into replying to the message in order to collect e-mail addresses and verify them as legitimate.

“The body of the spam message does not contain any call-to-action link such as a URL, e-mail or phone number,” said Sophos in its company’s blog today. “But the spammer can harvest receivers’ e-mail addresses via a free live e-mail address if the spam message is replied to.”

The original versions were just plain old spam to harvest addresses, but later malware laden versions followed which dropped IRC bots and backdoors detected as “Trojan.Win32.Buzus.bjyo”.

It’s sad to see such things happening, but social engineering attacks to spread malware are always expected when some big news like this breaks.

Nothing is sacred to the dark side of the Internet.

The timing of that campaign was not coincidental: It followed Jackson’s acquittal on all charges in child sexual abuse. “The news of his suicide attempt was believable,” said Cluley, who noted that scammers and hackers often trade on tragedies to get people to click links. In that case, users were hit with a hacker toolkit that tried several exploits against Internet Explorer.

“I wouldn’t be surprised to see hackers claiming that they have top-secret footage from the hospital, perhaps [allegedly] taken by the ambulance people, that then asks you to install a video codec,” said Cluley, talking about a common malware ploy. Users who click on the supposed codec update link are, in fact, then infected with attack code, often a bot that hijacks their computer.

So do warn people, if someone e-mails them pictures or videos claiming to be secret or exclusive footage surrounding the death of Michael Jackson – it’s most likely an infection vector.

Common sense prevails, but is sadly not common.

RIP Michael.

Source: Network World

Tags:  michael jackson,  michael jackson dead,  michael jackson malware,  michael jackson spam,  michael jackson virus,  Social Engineering,  spam,  twitter malware,  virus,  viruses

You may remember back in February the BETA of BackTrack 4 was released for download, the team have made many changes and have now released BackTrack 4 Pre Release.

For those that don’t know BackTrack is the top rated linux live distribution focused on penetration testing. With no installation whatsoever, the analysis platform is started directly from the CD-Rom and is fully accessible within minutes.

It’s evolved from the merge of the two wide spread distributions – Whax and Auditor Security Collection. By joining forces and replacing these distributions, BackTrack has gained massive popularity and was voted in 2006 as the #1 Security Live Distribution by insecure.org. Security professionals as well as new-comers are using BackTrack as their favorite toolset all over the globe.

The new version has busted the 700mb file size though so it’d DVD or USB, it’s recommended to use a USB drive to run it or install it on your HDD as running from a CD isn’t exactly speedy.

Full details available in the PDF guide:

BackTrack 4 Guide [PDF]

You can download BackTrack 4 Pre Release ISO here:

bt4-pre-final.iso

Or read more here.

Tags:  backtrack,  backtrack 4,  backtrack 4 pre release,  debian,  hacking-livecd,  linux-livecd,  network security livecd,  pen test livecd,  penetration testing livecd,  security-livecd,  wireless security livecd

I had a spam tweet appear in my stream a while back and like Guy Kawasaki I also had absolutely no idea where it came from.

Perhaps some kinda XSS flaw in Twitter when I visited a site that spawned the message (in a hidden iframe perhaps).

It wouldn’t be the first time Twitter was having security problems, just this time it’s not something that’s gone public. Spammers are using it to entice people to watch Sex Tapes and visit affiliate sites.

Former Apple Macintosh evangelist Guy Kawasaki posts Twitter messages about a lot of different thing, but the message he put up on Tuesday afternoon was really out of character.

“Leighton Meester sex tape video free download!”

His message included a link that, after some further clicking, landed Kawasaki’s followers on a fake porn site where online criminals try to install a nasty Trojan horse program on victim’s computers. And in an interesting twist, the program attacks both Mac and Windows users.

Kawasaki, a well known entrepreneur who is now a a managing director of Garage Technology Ventures, isn’t the only person whose account was misused during a new round of Twitter hacking Tuesday, but with nearly 140,000 followers he’s the most high-profile. Meester, the star of the TV Show GossipGirl is also said to be the subject of a homemade sex tape that is reportedly in circulation.

Apparently 1,600 people clicked on the link, probably because most people don’t know who Leighton Meester is, they would have had more luck with Lady Gaga or Britney Spears sex tapes

They would have better results hijacking his account, but I suspect they didn’t have access. He just clicked the wrong link or viewed the wrong site once and that spawned the message.

It’s possible there could a flaw in the Twitter API too and with some kinda fuzzing or brute force you can broadcast messages.

It’s not clear how hackers managed to gain access to Kawasaki’s account — security experts say that he and others may have fallen victim to earlier Twitter phishing attacks, where attackers tried to trick victims into logging into fake Twitter sits in hopes of stealing their login credentials.

Other hacked accounts are being used to to promote pornographic Web sites. Victims include an Arizona political blogger, an up-and-coming Canadian musician, and a Gay news site. (note, some of these Twitter pages still include pornographic and possibly malicious links)

Twitter has had its share of security problems over the past months. Earlier this year someone gained access to the Twitter accounts of U.S. President Barack Obama, Britney Spears, and others.

Recently scammers have become more aggressive on the site. They will set up new accounts and post spam messages on hot topics in hopes of gaining clicks when people search through Twitter.

Twitter have recently set up a system for verified accounts, I hope they also ensure these accounts stay secure and in the hands of the right people.

It’ll be interesting to see what turns up, if someone makes another flaw in Twitter public.

I hope they do as it’ll make the system more secure for everyone.

Source: PCWorld

Tags:  guy kawasai twitter hack,  guy kawasaki,  guy kawasaki twitter,  leighton meester,  leighton meester sex tape,  malware,  twitter,  twitter hack,  twitter hacked,  twitter security,  viruses,  Web Hacking,  web-application-security

This tool has been hitting the news, including some mentions in the SANS ISC Diary.

It’s not actually a new attack (it’s been around since 2005) but this is the first time a packaged tool has been released for the attack.

Slowloris holds connections open by sending partial HTTP requests. It continues to send subsequent headers at regular intervals to keep the sockets from closing. In this way webservers can be quickly tied up. In particular, servers that have threading will tend to be vulnerable, by virtue of the fact that they attempt to limit the amount of threading they’ll allow.

Slowloris must wait for all the sockets to become available before it’s successful at consuming them, so if it’s a high traffic website, it may take a while for the site to free up it’s sockets. So while you may be unable to see the website from your vantage point, others may still be able to see it until all sockets are freed by them and consumed by Slowloris. This is because other users of the system must finish their requests before the sockets become available for Slowloris to consume. If others re-initiate their connections in that brief time-period they’ll still be able to see the site.

So it’s a bit of a race condition, but one that Slowloris will eventually always win – and sooner than later.

Slowloris lets the webserver return to normal almost instantly (usually within 5 seconds or so). That makes it ideal for certain attacks that may just require a brief down-time.

This affects a number of webservers that use threaded processes and ironically attempt to limit that to prevent memory exhaustion – fixing one problem created another. This includes but is not necessarily limited to the following:

• Apache 1.x
• Apache 2.x
• dhttpd
• GoAhead WebServer
• Squid

There are a number of webservers that this doesn’t affect as well, in the authors testing:

• IIS6.0
• IIS7.0
• lighttpd
• nginx
• Cherokee (verified by user community)

You can download Slowloris here:

slowloris.pl

Or read more here.

Tags:  Apache,  apache dos,  apache dos tool,  dos,  Network Hacking,  network-security,  perl,  slowloris,  slowloris apache dos,  Web Hacking,  web-security

I find it a little surprising in this day and age that such a low percentage of IT managers believe data loss is a low impact issue.

Don’t they read the news? Don’t they understand how losing customer trust can really effect your bottom-line?

I would have thought 30% of respondents thinking data loss was high impact as a low figure, but 7%? That’s just insane.

A mere seven per cent of respondents to a survey on data management believed data loss has a “high” impact on a business.

This is one of the key findings of a survey launched in Hong Kong yesterday by Kroll Ontrack, a US-based provider of data recovery solutions. The survey was conducted earlier this year by StollzNow Research. It asked IT managers from 945 small, medium and large companies in Hong Kong, Singapore and Australia about their views and experiences related to data management.

The survey found that just less than half (49 per cent) of all IT managers have reported a data loss situation in the last two years.

Even more shocking is that half of the small business surveyed don’t even run back-ups! It’s so cheap and simple now with mass storage devices available off the shelf with Terabytes of storage.

There’s really no excuse for not backing up any more, I even had a 2TB RAID mirrored storage unit at home to back up my personal stuff. All my websites are backed up nightly and the backups sent to multiple physical servers and DB backups sent via e-mail.

While larger companies may not fully appreciate the risks they face with data loss, it is the small business sector that appears to be most at risk. An alarming 49 per cent of small companies stated that they fail to back up their data on a daily basis.

This is despite the fact that nearly half of all participants had experienced data loss in their workplace in the past two years, and 36 per cent felt that data loss could have a significant impact on their business.

Small businesses were also less likely to test their backup systems on a regular basis, or to have implemented a policy for the preservation of data. While 61 per cent of overall respondents reported that their company had a formalised data retention policy, this figure fell to just 45 per cent for companies with 50 or fewer employees.

I’d be interested to see a similar survey for the US and Europe to see if the figures are in the same kind of range.

It’s very common though for policies and backups to be implemented and never updated or tested. So when a failure actually occurs the company finds out their system isn’t even working.

Computers and backup systems don’t just keep magically working, especially when you’re changing configurations, server setups and software all the time.

Source: Network World

Tags:  data loss survey,  data-loss,  data-security,  data-theft,  impact of data loss,  information loss,  information theft,  Information-Security

You may remember a while back we did a Review of Acunetix Web Vulnerability Scanner 6 – the very full featured web vulnerability scanning software.

Well the latest version has been released recently with some updates, bug fixes and improvements on the web application security front.

I’m hoping to try out the AcuSensor on a PHP install soon to see what kind of information it can give me.

A full review isn’t really need as the installation, interface and features are mostly the same as version 6.

One of the great new features is the Login Sequence Recorder (LSR), which can record the exact sequence needed to login to a site and replay it.

Combine this with the Session Auto Recognition module, which will identify when a logged in session is invalided or expired and will re-login automatically and you have a great tool for scanning authentication based web applications.

There is also a lot more support for JSP/Tomcat based application, I haven’t had chance to test this as I don’t deal with many Java based web applications.

Also included are some back-end and interface changes like the display of port scan & network alerts separately from the web alerts, which does make it easier to see where the issues are.

Backend stuff like cookie handling and Blind SQL Injection methods have been improved, you can also import your settings from Version 6 if you are currently using that.

You can read the press release here, or more on the blog here.

The pricing can be found here (in both Euros and USD).

If you want to know more about the features you can download the manual here:

Acunetix WVS 6.5 Manual [PDF]

Tags:  acunetix,  acunetix review,  acunetix scanner review,  acunetix wvs,  acunetix wvs review,  acusensor,  AJAX-Security,  blind-sql-injection,  cross-site-scripting,  Hacking Tools,  http fuzzer,  JAVA-security,  jsp security,  penetration-testing,  sql-injection,  tomcat security,  web vulnerability scanner,  web-application-security,  wvs

With the latest version of the Apple iPhone OS being released last night or this morning (depending where in the World you are) I guess most of the iPhone users amongst you would have already installed the software.

Everyone I know using an iPhone has already done it without a hitch, it’s been long awaited and it’s definitely an improved over version 2.0.

The new OS also includes patches for 46 previously unpatched security vulnerabilities in the version 2.0 OS.

Apple releases iPhone OS 3.0 to much fanfare. In addition to new features, the updated iPhone operating system brings several patches that address serious security issues in the mobile device.

Apple quietly plugged nearly four dozen security holes when it pushed out an upgrade to iPhone OS 3.0 on June 17.

With iPhone OS 3.0, users are getting fixes for several critical flaws, a number of which could be exploited by an attacker to execute arbitrary code. The WebKit and CoreGraphics components were the most vulnerable with 21 and eight vulnerabilities, respectively.

There are several serious flaws being fixed in this update, so even if you don’t need the features please update for the security.

Let anyone else you know using the iPhone to update too.

Apple’s advisory on the issues can be found here.

The Apple iPhone OS 3.0 contains more than 100 new features, some of which were aimed squarely at enterprises. In March, Apple gave about 50,000 individuals who paid to be part of the company’s developer program access to both the updated SDK (software development kit) and the beta version of the operating system as part of an effort to bring more secure business functionality to the iPhone.

The popularity of the iPhone and other smartphones has brought about an increased interest in properly securing and managing the devices. Along those lines, the Center for Internet Security just released a benchmark with advice on using the iPhone securely.

“Phones are small and relatively cheap, and fashionable, so many companies still don’t realize—or don’t want to acknowledge—that they can be as serious in terms of breach effects as a laptop or desktop PC,” Gartner analyst John Girard said.

I would take a wild guess though with 100 new features introduced that Apple has also introduced some security vulnerabilities.

I’d give it a week or so before some issues start to pop up with the new OS.

Companies do need to look at the security of mobile devices seriously, that’s partially why BlackBerry is so popular as it’s easy to setup secure communications and lock down the device.

Source: eWeek

Tags:  apple iphone,  apple iphone 3.0,  apple iphone security,  apple software,  hacking iphone,  iphone 3.0,  iphone security,  iphone update