Archive | October, 2006

A Politically Tight Situation? Blame a HACKER!

Find your website's Achilles' Heel


It has happened quite a few times lately, politically tight situations, mistakes, data or information leaks and whoops damn…er…let’s blame it on hackers!

Case 1:

California Highway Patrol officials have opened a criminal investigation into “multiple” breaches and illegal downloads by outside hackers into the computers of Gov. Arnold Schwarzenegger’s office, after an embarrassing private taped conversation was leaked last week to the Los Angeles Times, administration officials told The Chronicle.

“There is an investigation conducted by the California Highway Patrol on how the tape obtained by the L.A. Times was acquired,” said a senior official who spoke on condition of anonymity. “This is a criminal matter that has been turned over to the CHP.”

Source: SFGate

Case 2:

The man responsible for Joe Lieberman’s campaign Web site said Tuesday that Joe2006.com was overwhelmed by traffic generated by hackers early Tuesday morning, forcing him to take the site off-line.

Tuesday’s attack was the third in the past month, said Dan Geary, who runs Lieberman’s site. But the earlier two attacks involved defacements & the hacker altered content on Lieberman’s home page. This time, attackers toppled the Lieberman site with requests, probably by directing an army of hacked computers at the site.

Source: MSN

So who do we believe?!


Posted in: General News

Tags: , , , , , , , , , , , ,

Posted in: General News | Add a Comment
Recent in General News:
- Teen Accused Of Hacking School To Change Grades
- Google’s Chrome Apps – Are They Worth The Risk?
- Twitter Breach Leaks 250,000 User E-mails & Passwords

Related Posts:

Most Read in General News:
- Hacking Still Can’t Outdo Stupidity for Data Leaks - 125,393 views
- eEye Launches 0-Day Exploit Tracker - 85,539 views
- Seattle Computer Security Expert Turns Tables On The Police - 43,849 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Mozilla Hires Ex-Microsoft Security Strategist Window Snyder

Find your website's Achilles' Heel


Looks like Mozilla is toughening it’s stance on security, people have been putting it down lately, especially those from the Microsoft camp as there have been a few flaws.

But well, it’s still not part of the operating system, the flaws are generally fixed within a couple of days and the patching system is simple and bandwidth friendly since version 1.5.0.1.

I generally find it more effecient, better designed, more secure and less proprietary :P than Internet Exploder.

Anyway back on topic..

Former Microsoft security strategist Window Snyder is joining Mozilla to lead the company’s effort to protect its range of desktop applications from malicious hacker attacks.

Snyder, who was responsible for security sign-off for Microsoft’s Windows XP Service Pack 2 and Windows Server 2003, will spearhead Mozilla’s security strategy, eWEEK has learned.

The hiring of Snyder is a coup for Mozilla Corp., the for-profit subsidiary of the Mozilla Foundation, based in Mountain View, Calif.

The group has seen its flagship Firefox Web browser chip away at the market dominance of Microsoft’s Internet Explorer, largely because of high-profile security flaws in and attacks on IE, and the addition of Snyder is sure to help beef up Mozilla’s security process and improve its communications with bug finders.

Sounds like a very good idea to me, with a proper security stance and process in place Firefox will become a market dominating product, it’s already fantastic, now it’s getting more money and skills injected, it’s evolving faster and smoother than ever.

Snyder most recently served as principal and founder of Matasano Security, a New York-based startup that was one of several external penetration testers hired by Microsoft to conduct simulated hacking attacks on Windows Vista.

She is also credited with seeding the idea for Microsoft’s internal “Blue Hat” security briefings, in which the crème de la crème of the hacking community is invited to the company’s Redmond, Wash., headquarters to discuss security with employees.

Snyder, a regular at security conferences, helped to soothe Microsoft’s contentious relationship with security consultants, and played a part in the improvement of the software maker’s strategy for reaching out to security vendors and researchers.

She was HITB conference this year I think if anyone was there, she’s quite cute too :P

Source: eWeek


Posted in: General News

Tags: , , , , , , , , ,

Posted in: General News | Add a Comment
Recent in General News:
- Teen Accused Of Hacking School To Change Grades
- Google’s Chrome Apps – Are They Worth The Risk?
- Twitter Breach Leaks 250,000 User E-mails & Passwords

Related Posts:

Most Read in General News:
- Hacking Still Can’t Outdo Stupidity for Data Leaks - 125,393 views
- eEye Launches 0-Day Exploit Tracker - 85,539 views
- Seattle Computer Security Expert Turns Tables On The Police - 43,849 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Download pwdump 1.4.2 and fgdump 1.3.4 – Windows Password Dumping

Find your website's Achilles' Heel


New versions of the ultracool tools pwdump (1.4.2) and fgdump (1.3.4) have been released.

Both versions provide some feature upgrades as well as bug fixes. Folks with really old versions of either program should definitely look at upgrading, since there are numerous performance improvements and full multithreading capabilities in both packages.

If you don’t know..what are pwdump6 and fgdump?

pwdump6 is a password hash dumper for Windows 2000 and later systems. It is capable of dumping LanMan and NTLM hashes as well as password hash histories. It is based on pwdump3e, and should be stable on XP SP2 and 2K3. If you have had LSASS crash on you using older tools, this should fix that.

fgdump is a more powerful version of pwdump6. pwdump tends to hang and such when antivirus is present, so fgdump takes care of that by shutting down and later restarting a number of AV programs. It also can dump cached credentials and protected storage items, and can be run in a multithreaded fashion very easily. I strongly recommend using fgdump over pwdump6, especially given that fgdump uses pwdump6 under the hood! You’ll get everything pwdump6 gives you and a lot more.

Darknet definately DOES recommend fgdump, super cool update of the old favourite pwdump.


fgdump was born out of frustration with current antivirus (AV) vendors who only partially handled execution of programs like pwdump. Certain vendors’ solutions would sometimes allow pwdump to run, sometimes not, and sometimes lock up the box. As such, we as security engineers had to remember to shut off antivirus before running pwdump and similar utilities like cachedump. Needless to say, we’re forgetful sometimes…

So fgdump started as simply a wrapper around things we had to do to make pwdump work effectively. Later, cachedump was added to the mix, as were a couple other variations of AV. Over time it has grown, and continues to grow, to support our assessments and other projects. We are beginning to use it extensively within Windows domains for broad password auditing, and in conjunction with other tools (ownr and pwdumpToMatrix.pl) for discovering implied trust relationships.

fgdump is targetted at the security auditing community, and is designed to be used for good, not evil. :) Note that, in order to effectively use fgdump, you’re going to need high-power credentials (Administrator or Domain Administrator, in most cases), thus limiting its usefulness as a hacking tool. However, hopefully some of you other security folks will find this helpful.

Get pwdump here

Get fgdump here


Posted in: Hacking Tools, Password Cracking, Windows Hacking

Tags: , , , , , , , , , ,

Posted in: Hacking Tools, Password Cracking, Windows Hacking | Add a Comment
Recent in Hacking Tools:
- Unicorn – PowerShell Downgrade Attack
- Wfuzz – Web Application Brute Forcer
- wildpwn – UNIX Wildcard Attack Tool

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,978,333 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,421,311 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 679,112 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


zCodec Video Codec is a TROJAN

Your website & network are Hackable


For those that didn’t see, there is a new all singing all dancing ‘light-weight’ Codec in town that is actually a trojan.

Indeed it’s not the first time we’ve seen this kind of thing.

The zCodec software actually messes with your DNS settings.

Users looking for the latest and greatest video software may not just be in danger from media lawyers. Security firm Panda Software last week warned that zCodec, which claims to offer “up to 40 percent better (video) quality,” is in fact an adware program that can install Trojans, rootkits and other malicious software.

zCodec is freely available online and, as of Monday afternoon, was easy enough to find, offering downloads from its own website – zcodec.com. The site uses images from the films Sin City and Pulp Fiction, and claims zCodec will boost audio as well as video quality.

“zCodec is a multimedia compressor/decompressor which registers into the Windows collection of multimedia drivers and integrates with any application using DirectShow and Microsoft Video for Windows,” the site states.

Media players use codecs (compressor/decompressors) to compress and play back digital media files, but in the real world, for a codec to make any quality difference, a file must be encoded using that codec.

As always do be vigilant when installing software and use a software or desktop firewall to patrol outgoing connections. You can also use something like TCPView to check on outgoing connections a little easier than using plain old netstat.

Panda’s advisory last week revealed that the 100KB file is in fact adware, which “downloads and runs files, changes the DNS configuration and monitors accesses to several adult websites”.

zCodec, formally known as Adware/ZCodec or Adware/EMediacodec, affects most versions of Windows and was first detected last week, Panda said.

When run, the program alters the system’s DNS configuration in order to divert traffic to DNS servers of its choice, a technique sometimes used as part of a phishing scam or to rack up clicks for advertising schemes.

zCodec also accesses a particular IP address to randomly select and download one of a collection of files. The files that could be downloaded include Ruins.MB, a Trojan horse that uses rootkit techniques to conceal itself, Panda said. zCodec could also download an online casino program.

A second file launches every time the user starts Internet Explorer and monitors Web usage. Panda said its software can remove zCodec.

Companies are getting really unscrupulous, what is going to come next I do wonder?

Source: Techworld


Posted in: Malware, Spammers & Scammers

Tags: , , , , , , , , , , , , ,

Posted in: Malware, Spammers & Scammers | Add a Comment
Recent in Malware:
- movfuscator – Compile Into ONLY mov Instructions
- MISP – Malware Information Sharing Platform
- PEiD – Detect PE Packers, Cryptors & Compilers

Related Posts:

Most Read in Malware:
- Nasty Trojan Zeus Evades Antivirus Software - 77,491 views
- Hospital Hacker GhostExodus Owns Himself – Arrested - 47,620 views
- US considers banning DRM rootkits – Sony BMG - 44,982 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Facebook Privacy Fears

Your website & network are Hackable


Ah Facebook again, security problems again?

Not this time, but privacy fears with the new stalker-esque features for tracking changes to people’s pages.

Millions of people have flocked to social networking sites to post information about themselves and share it with friends.

Now Facebook, one of the most popular, is facing a user backlash over a recent redesign that some critics say goes too far in exposing their lives.

Since Tuesday, tens of thousands of Facebook’s estimated 9 million users have revolted against newly added News Feeds and Mini-Feed features that track and publish changes on the site. For example, the feeds notify users when their friends post new photos.

Personally I think they are over-reacting a little.

The debate over privacy in the social networking sphere is taking place on relatively new ground. When it comes to sharing personal data, how much is too much? After all, people participate in social networking communities because they want to share personal information about their lives with their friends.

Bloggers publishing personal stories with RSS feeds, Flickr users posting public photos and Facebook users filling out a profile have all consciously chosen a certain level of transparency. Online communities encourage open sharing, so, even though privacy controls are in place for most of these tools, many users publish publicly anyway.

The liabilities of Facebook publicity already include brushes with law enforcement and underage drinking busts on campuses. Now, when a Facebook user elects to not keep their information to themselves, they will be forced think a little harder about who’s watching.

Nothing has changed really, with wget or something you could have tracked the same info anyway..recursive downloads of changes, run diff or something, bingo.

Ah well, ignorance leads to fear…fear leads to anger…anger leads to hate…hate leads to? The Darkside ;)

Source: Wired


Posted in: Privacy

Tags: , , , , , ,

Posted in: Privacy | Add a Comment
Recent in Privacy:
- BeautifulPeople.com Leak Exposes 1.1M Extremely Private Records
- Recon-ng – Web Reconnaissance Framework
- IPGeoLocation – Retrieve IP Geolocation Information

Related Posts:

Most Read in Privacy:
- Browse Anonymously at Work or School – Bypass Firewall & Proxy - 180,085 views
- Hacking Still Can’t Outdo Stupidity for Data Leaks - 125,393 views
- Anonymous Connections Over the Internet – Using Socks Chains Proxy Proxies - 122,597 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


FindBugs – Find Bugs in Java Programs

Find your website's Achilles' Heel


FindBugs looks for bugs in Java programs. It is based on the concept of bug patterns. A bug pattern is a code idiom that is often an error. Bug patterns arise for a variety of reasons:

  • Difficult language features
  • Misunderstood API methods
  • Misunderstood invariants when code is modified during maintenance
  • Garden variety mistakes: typos, use of the wrong boolean operator

FindBugs uses static analysis to inspect Java bytecode for occurrences of bug patterns. Static analysis means that FindBugs can find bugs by simply inspecting a program’s code: executing the program is not necessary. This makes FindBugs very easy to use: in general, you should be able to use it to look for bugs in your code within a few minutes of downloading it. FindBugs works by analyzing Java bytecode (compiled class files), so you don’t even need the program’s source code to use it. Because its analysis is sometimes imprecise, FindBugs can report false warnings, which are warnings that do not indicate real errors. In practice, the rate of false warnings reported by FindBugs is less than 50%.

FindBugs requires JRE (or JDK) 1.4.0 or later to run. However, it can analyze programs compiled for any version of Java. The current version of FindBugs is 1.1.1, released on October 6, 2006.

More info & download here:

FindBugsâ„¢


Posted in: Exploits/Vulnerabilities, Programming, Security Software

Tags: , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Programming, Security Software | Add a Comment
Recent in Exploits/Vulnerabilities:
- Intel Hidden Management Engine – x86 Security Risk?
- TeamViewer Hacked? It Certainly Looks Like It
- Serious ImageMagick Zero-Day Vulnerabilities – ImageTragick?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,767 views
- AJAX: Is your application secure enough? - 120,109 views
- eEye Launches 0-Day Exploit Tracker - 85,539 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Inprotect 0.22.5 Released – Web Interface for Nessus & Nmap

Your website & network are Hackable


A new revision of Inprotect has just been released, 0.22.5 in order to fix bugs and implement feature requests submitted by the development team and users. Existing users are recommended to upgrade.

Inprotect is a web interface for Nessus and Nmap security scanners, released under GNU/GPL license. This version has the following enhancements:

  • Improved and fixed issues in the Search page.
  • Standardised fields displayed on the HTML and PDF reports.
  • Resolved issue where the Nessus risk rating is entered inconsistently by the plugin writers and risks were reported incorrectly in Inprotect.
  • Added username and Inprotect version at the top of the page.
  • Notes and Plugin Info pages now open as popups and Notes will refresh the report page if details are entered / changed.
  • Now cannot schedule a scan if a Nessus server is offline or none has been setup.
  • Inprotect’s Nmap NASL modifications have been signed and made available for download on the Nessus website.
  • Fixed numerous other bugs and feature requests (please see CHANGES for further details).

To download, please visit:

Inprotect 0.22.5

For installation instructions, please see the INSTALL file if you are making a fresh installation or the UPGRADE file if you are updating from a previous version. N.B. Documentation is also available on the SourceForge site.

Please report any bugs through the SourceForge Bug Tracker.


Posted in: Countermeasures, Hacking Tools, Security Software

Tags: , , , , , , , , ,

Posted in: Countermeasures, Hacking Tools, Security Software | Add a Comment
Recent in Countermeasures:
- Cuckoo Sandbox – Automated Malware Analysis System
- Fully Integrated Defense Operation (FIDO) – Automated Incident Response
- MISP – Malware Information Sharing Platform

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,109 views
- Password Hasher Firefox Extension - 117,781 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,727 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


California Passes Wi-Fi Security Guidance Law – War-Driving going down?

Your website & network are Hackable


It seems like war-driving may become a thing of the past, legislation is starting to happen.

It’s a good start though, you have to target the manufacturers to educate their users, not target the users as they don’t care, sometimes ease of use has to be traded a bit with security.

California legislators have passed a law which will force makers of wireless internet equipment to include guidance on keeping data secure on wireless connections. The law now awaits signature by Governor Arnold Schwarzenegger.

From 1 October 2007, manufacturers must place warning labels on all equipment capable of receiving Wi-Fi signals, according to the new state law. These can take the form of box stickers, special notification in setup software, notification during the router setup, or through automatic securing of the connection. One warning sticker must be positioned so that it must be removed by a consumer before the product can be used.

The warnings would have to contain information on how to secure files, folders, and connections. Wireless internet connections can be used by anyone with Wi-Fi capability within the range of the transmitter unless they are secured.

Makes sense really right? The current law in a way can be seen to cover unauthorised wireless use.

The legislation acknowledges disagreement in the US as to whether it is legal for someone to use another person’s unprotected Wi-Fi connection. “While Section 502 of the Penal Code prohibits the unauthorized access to computers, computer systems, and computer data, authorized use is determined by the specific circumstances of the access,” it states. “There are also federal laws, including the Computer Fraud and Abuse Act […]that prohibit the intentional access to a computer without authorisation.”

In UK such warnings are not required but the position of using someone elses wi-fi connection is much clearer.

“The Communications Act includes an offence of dishonestly obtaining an electronic communications service ‘with intent to avoid payment of a charge applicable to the provision of that service’,” said Robertson. “We’ve already seen a conviction in the UK for using someone else’s Wi-Fi connection without authority.”

In July 2005, Gregory Straszkiewicz became the first person to be convicted under this provision. He was fined £500 at London’s Islewoth Crown Court. The Act provides for a maximum sentence of five years in prison and a fine.

So, is this the end of war driving?

Source: The Register


Posted in: Legal Issues, Wireless Hacking

Tags: , , , , , , , , , , , , ,

Posted in: Legal Issues, Wireless Hacking | Add a Comment
Recent in Legal Issues:
- The Panama Papers Leak – What You Need To Know
- FBI Backed Off Apple In iPhone Cracking Case
- TalkTalk Hack – Breach WAS Serious & Disclosed Bank Details

Related Posts:

Most Read in Legal Issues:
- Class President Hacks School Grades - 80,699 views
- Hospital Hacker GhostExodus Owns Himself – Arrested - 47,620 views
- One Of The World’s Most Prolific Music Piracy Groups Busted - 43,616 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Echo Mirage – A Generic Network Proxy

Find your website's Achilles' Heel


Echo Mirage is a generic network proxy. It uses DLL injection and function hooking to redirect network related function calls so that data transmitted and received by local applications can be observed and modified.

Think of it as Odysseus (or Burp, if you prefer) that will proxy (almost) anything…

Windows encryption and OpenSSL functions are also hooked so that the plain text of data being sent and received over an encrypted session is also available.

Echo Mirage tries to be smart with the OpenSSL calls by monitoring ssl_set_fd() and ssl_connect() to determine when SSL is in use on a particular socket. When SSL is in use the encrypted stream is ignored and only the unencrypted data is processed. This doesn’t work for the windows SSL stuff because that functions in an entirely different way…

Traffic can be intercepted in real-time, or manipulated with regular expressions and action scripts.

Changes Since 1.0

  • Hooked RecvFrom, SendTo, WSAConnect, WSASend, WSASendTo and WSARecvFrom.
  • Fixed intermittent crash on uninject.
  • Fixed intermittent crash in thread termination.

You can download Echo Mirage here:

http://www.bindshell.net/tools/echomirage/


Posted in: Hacking Tools, Network Hacking, Web Hacking

Tags: , , , , , , ,

Posted in: Hacking Tools, Network Hacking, Web Hacking | Add a Comment
Recent in Hacking Tools:
- Unicorn – PowerShell Downgrade Attack
- Wfuzz – Web Application Brute Forcer
- wildpwn – UNIX Wildcard Attack Tool

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,978,333 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,421,311 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 679,112 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Browzar is Bullshit

Your website & network are Hackable


Not sure if any of you heard of this new super secure ultra cool web browser called Browzar?

There was a bit of a backlash as it turned out Browzar was just another custom wrapper for Internet Exploder.

Security experts are crying foul over a new supposedly secure browser application.

Browzar is promoted as an easy way for users to surf the web without leaving traces of sensitive information behind on their PCs. Critics say it fails to do what it says on the tin and, worse still, the software manipulates search results to push ads at users.

Browzar, according to its developers, is designed not to retain information. Browzar automatically deletes internet caches, histories, cookies. It doesn’t use auto-complete forms, a feature that anticipates the search term or web address a user might enter.

Ah wow sounds amazing eh….but?

Although positioned as a fully fledged browser application, Browzar is a simple “custom wrapper” and user interface for IE that inherits any problems an installed version of Internet Explorer might have, while adding some all of its own. The software is supposed to get rid of all records of sites surfers may have visited, along with cookies and history files relating to a Browzar session from users’ PCs.

But Browzar does not clean up all traces of surfing as promised. Deleted files are not wiped and would be easy to recover – allowing anyone with a basic data recovery tool to access history, cookies or any other media downloaded using Browzar. Furthermore, because Browzar uses IE’s ActiveX control, a list of browsed websites stills appear in the index.dat file. Browzar therefore, according to critics, offers a false sense of privacy protection.

What’s worse than no security? Yes…a false sense of security, the same goes for privacy.

Plus what’s worse…it seems to actually be along the lines of ad-ware spyware..

As if that wasn’t enough reason to be wary of the software, Browzar steers users towards the firm’s own search page which allows the browser’s developers to insert sponsored links intermixed with regular search results. Much of the criticism of Browzar has focused on its skewed search engine and the use of Browzar’s website as the default (unchangeable) home page for surfers.

The Register


Posted in: General News, Security Software

Tags: , , , , , , ,

Posted in: General News, Security Software | Add a Comment
Recent in General News:
- Teen Accused Of Hacking School To Change Grades
- Google’s Chrome Apps – Are They Worth The Risk?
- Twitter Breach Leaks 250,000 User E-mails & Passwords

Related Posts:

Most Read in General News:
- Hacking Still Can’t Outdo Stupidity for Data Leaks - 125,393 views
- eEye Launches 0-Day Exploit Tracker - 85,539 views
- Seattle Computer Security Expert Turns Tables On The Police - 43,849 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95