Archive | January, 2010

GFI EventsManager – Event Monitoring, Archiving & Management

Cybertroopers storming your ship?


You may remember a while back we reviewed the latest update of GFI LANguard 9, another powerful product developed by GFI is EventsManager.

Managing, archiving and monitoring logs and SNMP traps for a whole network can be a bit of a logistical nightmare, that’s where products like this come in. Commonly they are known under the umbrella term Business Intelligence Systems or more specifically Log/Event Management.

Installation is easy enough as per usual with GFI software, configuration will be a little more complex depending on the architecture of your network. If you have any problems however you can download the user manual here – esm8manual.pdf [PDF]. Do note you will require a local or remote instance of MS-SQL for events archiving. You can download and use MS-SQL 2005 Express Edition (which is free).

You can find an overview of the software here and a full features list here.

Once you get started you’ll need to setup the MS-SQL database before you can do anything else, so either put the details for your remote server or install the free express edition then set up the database.

GFI EventsManager

After that you can select if you wish to process local computer events, selected machines or setup custom config (snmp traps/syslog). There are a lot of options in the configuration management and allows you to easily aggregate the logs/SNMP output from a whole network. It allows logging from a plethora of devices including Windows and Linux servers, Cisco devices, Juniper devices, laptops, desktops and databases.

Config Manager

The main screen gives you a very simple overview that the services are running correctly and the global events count with a break-down by type.


Status Screen

The graphing view allows you to visually see by source or globally by event classification and volume flow by hour.

Graph View

The Event Browser allows you to view individual events, drill down to the details captured and sort them by status allowing you to track down problems easily and diagnose which application is causing the problem.

Event Browser

You can also add the free GFI EventsManager ReportPack, which enables you to generate graphical IT-level, technical and management reports based on the hardware and software events processed by GFI EventsManager.

Pricing runs as low as $45.00 per node for Servers and $4.50 per node for Workstations if you buy in bulk.

You can download the free trial here:

http://www.gfi.com/downloads/register.aspx?pid=esm

You can find the full details on GFI EventsManager here:

http://www.gfi.com/eventsmanager


Posted in: Advertorial, Countermeasures, Security Software

Tags: , , , , , , , , , , , , , , ,

Posted in: Advertorial, Countermeasures, Security Software | Add a Comment
Recent in Advertorial:
- 13 WordPress Security Tips From Acunetix
- Acunetix WVS 10 Released – Keeping Your Website Secure just got Easier
- Double For Your Money With Acunetix Vulnerability Scanner

Related Posts:

Most Read in Advertorial:
- eLearnSecurity – Online Penetration Testing Training - 41,259 views
- Acunetix Web Vulnerability Scanner 6 Review - 15,228 views
- Acunetix WVS (Web Vulnerability Scanner) 7 Review – Engine & Scanning Improvements - 15,043 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Microsoft Preps Windows Security Fix for Patch Tuesday

Don't let your data go over to the Dark Side!


Many users are expecting a patch for the Microsoft IIS Semicolon Bug, but from the recently published bulletin by Microsoft it seems that is highly unlikely during this patch cycle.

Microsoft Security Bulletin Advance Notification for January 2010

It seems they will only be pushing out a fairly low priority fix which is rated critical only for Windows 2000 users.

In its first Patch Tuesday of the year, Microsoft is planning to plug a Windows security hole rated critical for Windows 2000 systems. A fix for a Server Message Block protocol vulnerability is still being worked on, Microsoft says.

Microsoft is kicking off the new year with a single Windows security bulletin. The first Patch Tuesday release of 2010 will contain a fix rated “critical” for Windows 2000 users and low for others. According to Microsoft’s pre-Patch Tuesday notification, the bulletin addresses a remote code execution vulnerability, and the exploitability index—the rating system that predicts the likelihood of a successful exploit—is not high.

The single bulletin means that a fix for the SMB (Server Message Block) protocol vulnerability the company warned users about in November is not on the menu to be fixed by Jan. 12. According to Microsoft Security Program Manager Jerry Bryant, the company is still working on the issue.

The critical SMB bug we published back in November is not slated to be fixed either.

So as usual, disable public access to your SMB ports! And of course…don’t hold your breath for a fix, if we’re lucky it may get rolled into the February patch cycle.

“We are not aware of any active attacks using the exploit code that was made public for this vulnerability and continue to encourage customers to follow the guidance in the advisory which outlines best practices to help protect systems against attacks that originate outside of the enterprise perimeter,” Bryant wrote on the Microsoft Security Response Center blog.

Microsoft is also not releasing a patch for the IIS (Internet Information Services) problem reported in late December. According to Microsoft, the issue is not an actual vulnerability in IIS 6.0, but an inconsistency in how it handles semicolons that can only be exploited if IIS is configured in a vulnerable setting.

This month’s Patch Tuesday release is slated to be available at 1 p.m. EST, Jan. 12.

Not being aware of any public exploitation isn’t really a valid excuse is it? Since when do blackhats go around telling everyone exactly what they are up to?

People could and probably are getting pwned left right and center and no one will have any idea how.

They are skating around the IIS issue too, even if it’s a vulnerability caused by settings (yes settings can mitigate it) they should push out something to solve the problem (an updated config for example).

Source: eWeek


Posted in: Exploits/Vulnerabilities, Web Hacking

Tags: , , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Web Hacking | Add a Comment
Recent in Exploits/Vulnerabilities:
- BeautifulPeople.com Leak Exposes 1.1M Extremely Private Records
- Apple Will Not Patch Windows QuickTime Vulnerabilities
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,366 views
- AJAX: Is your application secure enough? - 120,031 views
- eEye Launches 0-Day Exploit Tracker - 85,486 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


WAFP – Web Application Finger Printing Tool

Don't let your data go over to the Dark Side!


How it works?

WAFP fetches the files given by the Finger Prints from a webserver and checks if the checksums of those files are matching to the given checksums from the Finger Prints. This way it is able to detect the detailed version and even the build number of a Web Application.

In detail?

A Web Application Finger Print consits of a set of relative file locations in conjunction with their md5sums. It is made based on a production or example installation of a Web Application or just out of an extracted Web Application install files tarball. For this task, generate_wafp_fingerprint.sh is to be used.

WAFP comes with a README and a HOWTO file both containing some descriptions and examples.

Example

A specific fingerprint with verbose mode enabled:


You can download WAFP here:

wafp-0.01-26c3.tar.gz

Or read more here.


Posted in: Hacking Tools, Network Hacking, Web Hacking

Tags: , , , , , , , , ,

Posted in: Hacking Tools, Network Hacking, Web Hacking | Add a Comment
Recent in Hacking Tools:
- SubBrute – Subdomain Brute-forcing Tool
- The Backdoor Factory (BDF) – Patch Binaries With Shellcode
- Gdog – Python Windows Backdoor With Gmail Command & Control

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,973,556 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,401,813 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 676,112 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Active Exploitation Of Unpatched PDF Vulnerability

Cybertroopers storming your ship?


Fairly wide-spread attacks based on the latest vulnerability in Adobe PDF Reader have been spotted by Symantec, they appear to be variants on old attacks but still can be very effective.

It’s not the first time this has happened, back in February 2009 Hackers targeted a 0-day exploit in PDF Reader.

With one variant of this current attack seeing 34,000 detections on Symantec’s network alone, it could be considered fairly widespread.

A week before Adobe is scheduled to patch a critical vulnerability in its popular PDF software, hackers are actively exploiting the bug with both targeted and large-scale attacks, a security researcher said today.

The SANS Institute’s Internet Storm Center (ISC) reported Monday that they’d received samples of a new rigged PDF document that hijacked PCs using a bug Adobe acknowledged Dec. 14 . Later last month, Adobe said it would not patch the bug until Jan. 12. In his write-up of the sample, ISC analyst Bojan Zdrnja called the attack PDF “sophisticated” and its use of egg-hunt shellcode “sneaky.”

“Egg-hunt shellcode” is a term for a multi-stage payload used when the hacker can’t determine where in a process’ address space the code will end up.

Today, Joshua Talbot, security intelligence manager at Symantec, confirmed that the malicious PDF exploited the Adobe Reader and Acrobat vulnerability, but unlike Zdrnja, said it wasn’t out of the ordinary. “It’s not particularly novel or sophisticated,” Talbot said.

It seems the solution is the same as it has always been, disable JavaScript support in PDF Reader. But honestly, how many non-tech savvy users will do that? Or even know HOW to do that?

Mine recommendation of course is always to use Foxit PDF Reader and avoid these issues all together.

Which I have of course recommended since 2008 back when Adobe PDF Reader was getting pwned 2 years ago.

All the maker of the recently-discovered exploit did, Talbot added, was take code published in a 2004 research paper and make minor modifications. “These techniques aren’t new or clever, but the same things that all attackers are doing,” Talbot argued.

Although the malicious PDF described by ISC has been seen in only limited numbers — designed for high-profile targets, such as company executives or personnel with access to network passwords — Symantec has monitored bigger attacks exploiting the PDF bug. One attack generated more than 34,000 detections on Symantec’s global detection network, peaking on Dec. 31 before falling sharply.

“We’re definitely seeing activity out there, since the vulnerability is unpatched,” said Talbot. When asked to put that attack on the size scale, Talbot answered, “That puts it in the class of being actively exploited. It shows that there’s both going on … that attackers are crafting one-off exploits for their own purposes, and that there are people who are trying to distribute exploits to as many people as possible.”

Hopefully Adobe will pull the patch forward seen as though this is being actively exploited and push the patch out to users ASAP.

It’s currently stated that Adobe will release the patch on January 12th at their support site, which thankfully isn’t too far off.

Perhaps they take testing seriously so their patch cycle will naturally be delayed.

Source: Network World


Posted in: Exploits/Vulnerabilities, General News

Tags: , , , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, General News | Add a Comment
Recent in Exploits/Vulnerabilities:
- BeautifulPeople.com Leak Exposes 1.1M Extremely Private Records
- Apple Will Not Patch Windows QuickTime Vulnerabilities
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,366 views
- AJAX: Is your application secure enough? - 120,031 views
- eEye Launches 0-Day Exploit Tracker - 85,486 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


YASAT – Yet Another Stupid Audit Tool

Cybertroopers storming your ship?


YASAT (Yet Another Stupid Audit Tool) is a simple stupid audit tool. Its goal is to be as simple as possible with minimum binary dependencies (only sed, grep and cut).

It do many tests for checking security configuration issue or others good practice.

It checks many software configurations like:

  • Apache
  • PHP
  • kernel
  • MySQL
  • OpenVPN
  • Packages update
  • snmpd
  • tomcat
  • user accounting
  • vsftpd
  • xinetd

YASAT has been tested on:

  • Gentoo
  • Debian
  • Ubuntu
  • FreeBSD
  • OpenBSD

YASAT is licensed under GPLv3.

You can download YASAT here:

yasat-207.tar.gz

Or read more here.


Posted in: Countermeasures, Security Software

Tags: , , , , , , , , , , ,

Posted in: Countermeasures, Security Software | Add a Comment
Recent in Countermeasures:
- Google Rapid Response (GRR ) – Remote Live Forensics For Incident Response
- PEiD – Detect PE Packers, Cryptors & Compilers
- NAXSI – Open-Source WAF For Nginx

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,031 views
- Password Hasher Firefox Extension - 117,720 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,707 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


2010 Bug Wreaks Havoc In Germany

Cybertroopers storming your ship?


This was pretty unexpected for most people, the Y2K bug was so over-hyped then nothing really happened. Then suddenly 2010 comes and everything goes haywire!

The first big news that struck was Spam Assassin which included all versions of cPanel, it started rejected almost all e-mails due to a bug in the spam detection rules with the 2010 date.

After that Symantec’s Endpoint Protection Manager caused a storm and a bunch of other stopped working, stopped updating or started acting weirdly.

A delayed Y2K bug has bitten hard at some 30 million holders of German debit and credit cards, making it impossible for them to use automatic teller machines and point-of-sale terminals since New Year’s Day.

Multiple news agencies said the outage stemmed from card chips that couldn’t recognize the year 2010. The DSGV, an association representing German banks, said engineers were working diligently to fix the problem, but a full resolution might not come until Monday.

The outage affected 20 million EC, or electronic cash, cards, which act as debit cards, and 3.5 million credit cards, according to the DSGV. A separate bank association known as BDB said about 2.5 million of its cards suffered from the same problem and another 4 million cards issued by Germany’s cooperative banks were at least partially touched.

The latest big news to hit is pretty huge, 30 million German customers are unable to use their debit or credit cars as the chips couldn’t process the 2010 date.

This is pretty serious as it needs a physical card replacement so could be very costly and time consuming for the banks involved.

It’ll be interesting to see what kind of solution they can come up with.

The reports are the latest to involve the inability of computers to properly handle the 2010 date. Just after midnight on New Year’s Day, Symantec’s Endpoint Protection Manager stopped accepting updates after it was hit by its own 2010 date bug. Soon after the first of the year, SpamAssassin began blocking huge amounts of legitimate email because they included the 2010 in their headers, a date so far off the spam filter assumed they had to be junk.

Kaspersky software also experienced massive update problems on December 30, according to support forums, but it’s not clear the new year had anything to do with them.

The German payment card snafu hit a variety of banks, although customers of Deutsche Bank reportedly were not affected. More from the AFP and Dow Jones is here and here.

I wonder how many other pieces of software are currently malfunctioning but no-one knows about it, I hope my banks accounting software has screwed up and it’s crediting me with 500% daily interest!

I’m sure there are plenty of other cases too that haven’t been reported (or at least not reported yet).

We’ll have to wait and see how widespread this 2010 bug really is.

Source: The Register


Posted in: General News, Programming

Tags: , , , , , , , , , ,

Posted in: General News, Programming | Add a Comment
Recent in General News:
- Teen Accused Of Hacking School To Change Grades
- Google’s Chrome Apps – Are They Worth The Risk?
- Twitter Breach Leaks 250,000 User E-mails & Passwords

Related Posts:

Most Read in General News:
- Hacking Still Can’t Outdo Stupidity for Data Leaks - 125,378 views
- eEye Launches 0-Day Exploit Tracker - 85,486 views
- Seattle Computer Security Expert Turns Tables On The Police - 43,719 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


fimap – Remote & Local File Inclusion (RFI/LFI) Scanner

Don't let your data go over to the Dark Side!


fimap is a little python tool which can find, prepare, audit, exploit and even google automatically for local and remote file inclusion bugs in webapps. fimap is similar to sqlmap just for LFI/RFI bugs instead of sql injection. It is currently under heavy development but it’s usable.

Features

  • Check a Single URL, List of URLs, or Google results fully automatically.
  • Can identify and exploit file inclusion bugs.
  • Test and exploit multiple bugs
  • Has an interactive exploit mode
  • Add your own payloads and patches to the config.py file.
  • Has a Harvest mode which can collect URLs from a given domain for later pentesting.
  • Can use proxies (experimental).

Changes

  • All commands will now be send base64 encoded. So you can use quotes as much as you want.
  • php://input detection is now 100% reliable.
  • You can now define a POST string for relative and absolute files in the config.py.
  • TTL implemented. You can define it with “—ttl “. Default is 30 seconds.
  • Experimental HTTP Proxy support. You can define a HTTP(s) proxy with “—http-proxy localhost:8080”.
  • Googlescanner can now skip the first X pages. Use “—skip-pages X”.
  • Lots of bugfixes and additional regular expressions.

Requirements

  • Needs: Python >= 2.4

You can download fimap here:

fimap_alpha_v07.tar.gz

Or read more here.


Posted in: Exploits/Vulnerabilities, Hacking Tools, Web Hacking

Tags: , , , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Hacking Tools, Web Hacking | Add a Comment
Recent in Exploits/Vulnerabilities:
- BeautifulPeople.com Leak Exposes 1.1M Extremely Private Records
- Apple Will Not Patch Windows QuickTime Vulnerabilities
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,366 views
- AJAX: Is your application secure enough? - 120,031 views
- eEye Launches 0-Day Exploit Tracker - 85,486 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Researcher Uncovers XSS Flaws In Twitter and Google Calendar

Cybertroopers storming your ship?


More flaws discovered in Twitter and Google Calender during the holiday season.

Once again XSS flaws have been discovered in popular web apps, but at least they were reported and not used nefariously this time.

Fixes have been issued promptly by both Google and Twitter so there is not much cause for concern this time round. But you can imagine if Nir Goldshlager could uncover these flaws – how many more are there

A security researcher uncovered some holes in Google Calendar and Twitter that may allow an attacker to steal cookies and user session IDs.

In a proof of concept, researcher Nir Goldshlager demonstrated cross-site scripting (XSS) vulnerabilities in Google Calendar and Twitter that he said could be used to steal cookies and session IDs. He also uncovered an HTML injection issue affecting Google Calendar as well that he said could be used to redirect a victim to an attack site any time the user viewed his or her Google Calendar agenda events.

Twitter issued a fix for the issue Dec. 30, and Google stated Dec. 31 it would examine the input validation process for the Google Calendar field to help address the situation.

XSS attack have become increasingly prevalent in the last few years and the power of harnessing them well is tarted to become more obvious.

When XSS attacks first emerged they were thought of as trivial, but as times have changed there is so much more information and valuable data stored online stealing someones login credentials can be enough to get a worthy stash of credentials.

According to Goldshlager, a penetration testing expert with Avnet Information Security Consulting in Israel, the cross-site scripting vulnerability can be exploited if a victim adds malicious code to his quick add post calendar.

“When the victim … [adds] this malicious code, his cookies [and] session ID will be stolen and will be sent to the attacker site,” he said. “Then the attacker will be able to get full control of the victim’s Google accounts like: Google Calendar account, Google Groups, iGoogle, etc.”

Goldshlager also demonstrated that the HTML injection vulnerability could be used to log a user out of his Google account, something the Google spokesman said “is of negligible security impact” and “can be avoided by not clicking on the link.”

“They should fix this immediately because an attacker can redirect a victim to any site that he wants, and [with] the XSS issue an attacker can steal the victim’s cookies and get full control of his accounts,” the researcher said.

At least the flaws were fixed quickly and disclosed responsibly. It’s an interesting start for the new year and honestly there’s been hardly any news for the past 3 days.

Let’s hope for an interesting year ahead and plenty of new interesting stories and tools.

Oh and of course, Happy New Year!

Source: eWeek


Posted in: Exploits/Vulnerabilities, Web Hacking

Tags: , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Web Hacking | Add a Comment
Recent in Exploits/Vulnerabilities:
- BeautifulPeople.com Leak Exposes 1.1M Extremely Private Records
- Apple Will Not Patch Windows QuickTime Vulnerabilities
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,366 views
- AJAX: Is your application secure enough? - 120,031 views
- eEye Launches 0-Day Exploit Tracker - 85,486 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95