Archive | August, 2010

China Policy Could Shut Out Foreign Security Firms

Your website & network are Hackable


China catches a lot of flack in the infosec World, mostly for being suspected of cyber-terrorism and for propagating nasty malware.

Lately things have been getting more political especially during their tussle with Google over the whole ‘search freedom’ issue and censorship.

The latest is that they are starting to check for compliance on a 3 year old initiative called the Multi-Level Protection Scheme or MLPS which effectively mandates all core services that the government uses must be provided by local Chinese companies.

China is stepping up efforts to keep the security systems that protect its critical infrastructure in the hands of local firms, and that could be bad news for companies based outside the country.

China has started sending out inspectors to check for compliance with a little-known initiative called the Multi-Level Protection Scheme (MLPS), the Associated Press reported Wednesday. Introduced three years ago by China’s Ministry of Public Security, it mandates that core products used by government and infrastructure companies such as banks and transportation must be provided by Chinese companies.

Over the past year, government inspectors have been telling some companies that they must switch to Chinese firewalls and other types of security technology, the AP said. The development could force security vendors such as Cisco Systems and Symantec out of important parts of the growing market, or force them to partner with local businesses, said Stephen Kho, senior counsel with Akin Gump Strauss Hauer & Feld, an international law firm based in Washington. “Right now, it seems to only affect the companies that are in the information security sector,” he said.

The MLPS regulations have been public since 2007, but it wasn’t clear until recently that China would actually enforce them, Kho said. “When they put this one in place, nobody really paid any attention to it,” he said. “A lot of times these laws stay on the books and they do nothing.”

The regulations have been in place for 3 years but are only being enforced now, it seems like a concerted effort by the Chinese government to start pushing foreign companies out of China. Some could also say it’s to get back at the US rejecting takeover bids by Huawei citing ‘security concerns’.

It’s a two way street, you don’t let China in…they are going to push you out. So much for bilateral ties?

Critics worry that China may be leveraging security concerns to shut down free trade in its growing security products market.

The MLPS covers critical infrastructure companies, and China has said most government agencies and state-owned companies must be fully compliant by this year, according to a recent report by the American Chamber of Commerce in China. This requirement could have “serious implications” for companies that sell to critical infrastructure operators in China, the report states.

The MLPS is just one of several policies designed by China over the past few years to spur homegrown technology development. Groups like the American Chamber of Commerce worry that they simply close out foreign competition. “[P]olicies that China is adopting under the banner of ‘indigenous innovation’ are increasingly closed and protectionist in nature,” the group wrote in its report.

In a blog post last year, Oracle Director of Standards Strategy and Policy Trond Undheim said other laws and regulations are also at play here, including the Chinese Compulsory Certification (CCC), which requires the disclosure of intellectual property in some security products.

“China is at the moment poised to limit the global IT industry’s footprint in their country,” Undheim wrote. “They have devised a quite devious set of schemes to do this, centered around IT security legislation.”

This could cause some serious issues for big hardware players like Cisco and Juniper and honestly I think if China really pushes this policy their only choice will be to form some kind of joint venture with China shareholders being in the majority.

It seems China have things locked down pretty tight and if they so wish they can shut everyone down or just simply push them out of the market by making it illegal for them to do business.

Either way, it’s not looking good for some of the big US players.

Source: Network World


Posted in: General News, Legal Issues

Tags: , , , , , , , , , , , , , ,

Posted in: General News, Legal Issues | Add a Comment
Recent in General News:
- Teen Accused Of Hacking School To Change Grades
- Google’s Chrome Apps – Are They Worth The Risk?
- Twitter Breach Leaks 250,000 User E-mails & Passwords

Related Posts:

Most Read in General News:
- Hacking Still Can’t Outdo Stupidity for Data Leaks - 125,393 views
- eEye Launches 0-Day Exploit Tracker - 85,539 views
- Seattle Computer Security Expert Turns Tables On The Police - 43,849 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


WinAppDbg – Python Instrumentation Scripting/Debugging Tool For Windows

Find your website's Achilles' Heel


The WinAppDbg python module allows developers to quickly code instrumentation scripts in Python under a Windows environment.

It uses ctypes to wrap many Win32 API calls related to debugging, and provides an object-oriented abstraction layer to manipulate threads, libraries and processes, attach your script as a debugger, trace execution, hook API calls, handle events in your debugee and set breakpoints of different kinds (code, hardware and memory). Additionally it has no native code at all, making it easier to maintain or modify than other debuggers on Windows.

The intended audience are QA engineers and software security auditors wishing to test / fuzz Windows applications with quickly coded Python scripts. Several ready to use utilities are shipped and can be used for this purposes.

Current features also include disassembling x86 native code (using the open source diStorm project, see https://code.google.com/p/distorm/), debugging multiple processes simultaneously and produce a detailed log of application crashes, useful for fuzzing and automated testing.

What’s new in this version?

  • fully supports Python 2.4 through 2.7
  • fully supports Windows XP through Windows 7, 32 and 64 bit editions
  • crash report tool now supports MSSQL (requires pyodbc)
  • now supports downloading debugging symbols from Microsoft (thanks Neitsa!)
  • new tool: sehtest.py (Windows SEH buffer overflow jump address bruteforcer, inspired by the same tool by Nicolas Economou)
  • now with only one MSI installer for all supported Python versions
  • now using cerealizer instead of pickle whenever possible

You can view the entire changelog for all versions here.

You can download WinAppDbg here:

Win (32-bit) – winappdbg-1.4.win32.exe
Win (64-bit) – winappdbg-1.4.win-amd64.exe
Source Code – winappdbg-1.4.zip

Or read more here.


Posted in: Hacking Tools, Programming

Tags: , , , , , , , ,

Posted in: Hacking Tools, Programming | Add a Comment
Recent in Hacking Tools:
- Unicorn – PowerShell Downgrade Attack
- Wfuzz – Web Application Brute Forcer
- wildpwn – UNIX Wildcard Attack Tool

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,978,283 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,421,121 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 679,076 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Windows Binary Planting DLL Preloading/Hijacking Bug

Find your website's Achilles' Heel


The big news that is turning the infosec world inside out this week is about a new DLL pre-loading/hijacking bug which effects more than 200 Windows applications including some produced by Microsoft itself.

The basis of this exploit is the way in which Windows works and how it loads DLL files used by many applications, if an application calls a DLL without specifying an absolute path Windows will conduct a search for the DLL file in various set locations. This of course can and is being abused.

The big problem with is the fact that it can’t really be patched by Microsoft, each vulnerable application vendor needs to issue an update to their applications to fix the way in which they deal with DLL files.

The Microsoft Security Response Center has written about the issue here:

Loading dynamic libraries is basic behavior for Windows and other operating systems, and the design of some applications require the ability to load libraries from the current working directory. Hence, this issue cannot directly be addressed in Windows without breaking expected functionality. Instead, it requires developers to ensure they code secure library loads. However, we’re looking into ways to make it easier for developers to not make this mistake in the future.

Microsoft is also conducting a thorough investigation into how this new vector may affect Microsoft products. As always, if we find this issue affects any of our products, we will address them appropriately.

More information about the DLL Preloading remote attack vector

Microsoft also has published some Registry tweaks which can change the default DLL library search behaviour (downloads are available for each version of Windows):

A new CWDIllegalInDllSearch registry entry is available to control the DLL search path algorithm

Microsoft and quite a few other researchers have known about this for some time and have stated they won’t be patching it but will be looking at ways to address it in future versions of Windows.

MIcrosoft has told a researcher that it won’t patch a problem that has left scores of Windows applications open to attack. According to a growing number of reports, crucial Windows functionality has been misused by countless developers, including Microsoft’s, leaving a large number of Windows programs vulnerable to attack because of the way they load components.

The issue first surfaced last week when HD Moore, chief security officer of Rapid7 and creator of the open-source Metasploit hacking toolkit, said he had found 40 vulnerable applications , including the Windows shell. A day later, Slovenian security firm Acros announced its homegrown tool had uncovered more than 200 flawed Windows programs in an investigation that began in November 2008.

Over the weekend, Taeho Kwon, a Ph.D. candidate in computer science at the University of California Davis, stepped forward to cite his research, which he published in a February 2010 paper.

Microsoft won’t patch critical DLL loading bugs

The attack code was posted yesterday to the Exploit Database. It included exploits for the Wireshark packet sniffer, Windows Live email and Microsoft MovieMaker, in addition to those for the most recent versions of Firefox, uTorrent and PowerPoint.

Some more info is available here:

Microsoft Binary Planting Bug: What You Need to Know

If you want to scan your own system you can do so here:

DLLHijackAuditKit v2

It includes complete instructions and the steps to scan for vulnerable apps, build test cases for each application and assemble an exploit.


Posted in: Exploits/Vulnerabilities, Windows Hacking

Tags: , , , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Windows Hacking | Add a Comment
Recent in Exploits/Vulnerabilities:
- Intel Hidden Management Engine – x86 Security Risk?
- TeamViewer Hacked? It Certainly Looks Like It
- Serious ImageMagick Zero-Day Vulnerabilities – ImageTragick?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,764 views
- AJAX: Is your application secure enough? - 120,108 views
- eEye Launches 0-Day Exploit Tracker - 85,539 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


DotDotPwn v1.0 – Directory Traversal Checker/Scanning Tool

Find your website's Achilles' Heel


A simple PERL tool which detects several Directory Traversal Vulnerabilities on HTTP/FTP Servers. This AttackDB version currently has 871 traversal payloads. This tool was tested against various Kolibri+ WebServer v2.0 and Gefest WebServer v1.0 (HTTP servers) giving good results identifying the right vulnerability strings. Those HTTP servers were vulnerable, and somebody reported those vulns on sites such as exploit-db, but those advisories just reported some (1 or 2) traversal strings with a difference with DotDotPwn which detected between 10 or 20 different attack strings on those vulnerable servers.

Features

  • Detects Directory traversal vulnerabilities on remote HTTP/FTP server systems.
  • DotDotPwn checks the presence of boot.ini on the vulnerable systems through Directory traversal vulnerabilities, so it is assumed that the tested systems are Windows based HTTP/FTP servers.
  • Currently, the traversal database holds 871 attack payloads. Use the -update flag to perform an online fresh update.

Requirements

Perl with support of HTTP::Lite and Net::FTP modules

The full README file is available here.

You can download DotDotPwn v1.0 here:

ddpwn.tar.gz

Or read more here.


Posted in: Hacking Tools, Web Hacking

Tags: , , , , , , , , , , , ,

Posted in: Hacking Tools, Web Hacking | Add a Comment
Recent in Hacking Tools:
- Unicorn – PowerShell Downgrade Attack
- Wfuzz – Web Application Brute Forcer
- wildpwn – UNIX Wildcard Attack Tool

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,978,283 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,421,121 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 679,076 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Intel Acquires Security Specialist McAfee For $7.68bn

Your website & network are Hackable


We’ve seen a trend in recent years, especially in the technology sector of acquisitions and consolidations. It’s been something Microsoft has been doing for a long time, acquiring smaller niche companies to improve/supplement their existing product lines.

In recent years the trends has shifted towards web services and of course security, many smaller security companies have been acquired, most recently would be the Sunbelt acquisition by GFI.

Back in 2007 Google Acquired Web Security Startup GreenBorder. There have been many others of course, a lot of which we haven’t covered as they are more business related than anything else.

Bruce Schneier has also been talking about these kind of acquisitions for over two years.

There has been a pretty unanimous WTF from the tech community as Intel isn’t even a software provider, they are a hardware manufacturer…and yes they’ve had some flaws in their products but does that justify spending almost $8 Billion USD to acquire a security company?

And well McAfee isn’t exactly highly thought of within the security community.

Both boards of directors have approved the deal, which is still subject to McAfee shareholder approval and regulatory approval.

Intel said the deal signalled its decision to put security on par with energy-efficient performance and internet connectivity as a strategic focus area.

“Today’s security approach does not fully address the billions of new Internet-ready devices connecting, including mobile and wireless devices, TVs, cars, medical devices and ATM machines as well as the accompanying surge in cyber threats,”

The details can be seen on Market Watch here.

And well McAfee don’t even provide hardware security functions, which is I assume what Intel is looking for. Who knows, this may just be a capital investment strategy from Intel and not particularly related to what McAfee produces.

Intel of course can benefit from the security knowledge McAfee has and integrate that into their hardware – but that is going to take some time.

Several security analysts have given their opinions of what this could mean and how it could effect Intel, McAfee and the industry in general.

Source: The Register


Posted in: General News, Legal Issues

Tags: , , , , , , ,

Posted in: General News, Legal Issues | Add a Comment
Recent in General News:
- Teen Accused Of Hacking School To Change Grades
- Google’s Chrome Apps – Are They Worth The Risk?
- Twitter Breach Leaks 250,000 User E-mails & Passwords

Related Posts:

Most Read in General News:
- Hacking Still Can’t Outdo Stupidity for Data Leaks - 125,393 views
- eEye Launches 0-Day Exploit Tracker - 85,539 views
- Seattle Computer Security Expert Turns Tables On The Police - 43,849 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Tshark – Network Protocol Analyzer & Traffic Dumper

Find your website's Achilles' Heel


Tshark is actually part of the Wireshark package, and has some similar functionality. It does some cool stuff though so I thought it’s worthy of its own post.

TShark is a network protocol analyzer. It lets you capture packet data from a live network, or read packets from a previously saved capture file, either printing a decoded form of those packets to the standard output or writing the packets to a file. TShark’s native capture file format is libpcap format, which is also the format used by tcpdump and various other tools.

Without any options set, TShark will work much like tcpdump. It will use the pcap library to capture traffic from the first available network interface and displays a summary line on stdout for each received packet.

TShark is able to detect, read and write the same capture files that are supported by Wireshark. The input file doesn’t need a specific filename extension; the file format and an optional gzip compression will be automatically detected. Near the beginning of the DESCRIPTION section of wireshark(1) is a detailed description of the way Wireshark handles this, which is the same way Tshark handles this.

Compressed file support uses (and therefore requires) the zlib library. If the zlib library is not present, TShark will compile, but will be unable to read compressed files.

If the -w option is not specified, TShark writes to the standard output the text of a decoded form of the packets it captures or reads. If the -w option is specified, TShark writes to the file specified by that option the raw data of the packets, along with the packets’ time stamps.

When writing a decoded form of packets, TShark writes, by default, a summary line containing the fields specified by the preferences file (which are also the fields displayed in the packet list pane in Wireshark), although if it’s writing packets as it captures them, rather than writing packets from a saved capture file, it won’t show the “frame number” field. If the -V option is specified, it writes instead a view of the details of the packet, showing all the fields of all protocols in the packet.

If you want to write the decoded form of packets to a file, run TShark without the -w option, and redirect its standard output to the file (do not use the -w option).

When writing packets to a file, TShark, by default, writes the file in libpcap format, and writes all of the packets it sees to the output file. The -F option can be used to specify the format in which to write the file. This list of available file formats is displayed by the -F flag without a value. However, you can’t specify a file format for a live capture.


Read filters in TShark, which allow you to select which packets are to be decoded or written to a file, are very powerful; more fields are filterable in TShark than in other protocol analyzers, and the syntax you can use to create your filters is richer. As TShark progresses, expect more and more protocol fields to be allowed in read filters.

Packet capturing is performed with the pcap library. The capture filter syntax follows the rules of the pcap library. This syntax is different from the read filter syntax. A read filter can also be specified when capturing, and only packets that pass the read filter will be displayed or saved to the output file; note, however, that capture filters are much more efficient than read filters, and it may be more difficult for TShark to keep up with a busy network if a read filter is specified for a live capture.

A capture or read filter can either be specified with the -f or -R option, respectively, in which case the entire filter expression must be specified as a single argument (which means that if it contains spaces, it must be quoted), or can be specified with command-line arguments after the option arguments, in which case all the arguments after the filter arguments are treated as a filter expression. Capture filters are supported only when doing a live capture; read filters are supported when doing a live capture and when reading a capture file, but require TShark to do more work when filtering, so you might be more likely to lose packets under heavy load if you’re using a read filter. If the filter is specified with command-line arguments after the option arguments, it’s a capture filter if a capture is being done (i.e., if no -r option was specified) and a read filter if a capture file is being read (i.e., if a -r option was specified).

Tshark is available for download as part of the Wireshark package here:

Windows (32-bit) – wireshark-win32-1.2.10.exe
Source Code – wireshark-1.2.10.tar.bz2

Or read more here.


Posted in: Hacking Tools, Network Hacking

Tags: , , , ,

Posted in: Hacking Tools, Network Hacking | Add a Comment
Recent in Hacking Tools:
- Unicorn – PowerShell Downgrade Attack
- Wfuzz – Web Application Brute Forcer
- wildpwn – UNIX Wildcard Attack Tool

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,978,283 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,421,121 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 679,076 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Serious Vulnerability In Adobe ColdFusion Application Server

Find your website's Achilles' Heel


We haven’t often reported anything relating to ColdFusion, the application server from Adobe, most likely because it’s not a very prevalent hosting platform. It was quite popular earlier in the decade before PHP became so popular, the choices back then were early versions of ASP, JSP and CFM.

We’ve only posted one tool related to ColdFusion too which was – Wfuzz – A Tool for Bruteforcing/Fuzzing Web Applications.

Adobe seems to have tried to hide this one away and downgrade the severity of the exploit by classifying it as ‘important’ but not ‘critical’. Stating it could only lead to information disclosure via directory traversal. It seems however publicly released exploit code can utilise this vulnerability to take full control of any server running the unpatched version of ColdFusion.

A recently patched vulnerability in Adobe’s ColdFusion application server may be more serious than previously thought following the public release of exploit code and blog posts claiming it can be used to take full control of systems running the software.

In a bulletin published last week, Adobe rated the directory traversal vulnerability “important,” the third-highest classification on its four-tier severity scale. “This directory traversal vulnerability could lead to information disclosure,” the company warned. The flaw affects version 9.0.1 and earlier of ColdFusion for machines running Windows, Mac OS X, and Unix operating systems.

But at least two researchers have said the security bug should have been rated critical because it allows attackers to seize control of servers. What’s more, they said attackers can employ simple web searches to find administrators who have carelessly exposed ColdFusion files that make the attacks much easier to carry out.

“This attack can lead to a full system compromise, so let’s make sure we’re clear,” HP researcher Rafal Los wrote here. “It’s not just that you can poke around the system files of the machine you’ve attacked (which is highly likely a MS Windows server); it’s also the ability to upload scripts that can compromise the system or even poke around the database natively if the security is really that bad.”

From what has been written about the flaw by researchers that have tested it out, it really should have been rated as critical. Plus the fact you can use some old school Google Hacking to find vulnerable servers means this could lead to some widespread mass defacements.

Well perhaps I shouldn’t really say mass defacements as there just aren’t that many servers running ColdFusion, and yes most of which are indeed running on Windows machines and most likely poorly maintained and not particularly secure Windows machines.

The bottom line, if you have any ColdFusion servers in your organization or within your realm of responsibility, get them patched ASAP.

One reason the vulnerability may have been rated critical is that attacks generally work only when ColdFusion administrative components are accessible over the public internet, something that’s not considered a best practice. Los pointed to Google searchers here , here, here and here, which over the weekend generated “a lot of results.”

Around the same time, a hacker who goes by the name Carnal0wnage posted attack code that reliably exploits the vulnerability.

Also over the weekend, hacker and penetration tester Adrian Pastor warned that attackers could exploit the vulnerability to login as a ColdFusion admin without needing to crack the cryptographic hash.

Adobe on Monday issued the following statement:

“The ColdFusion hotfix and security bulletin released on August 10, 2010 address a directory traversal vulnerability (CVE-2010-2861) that could lead to information disclosure (http://www.adobe.com/support/security/bulletins/apsb10-18.html). The vulnerability on its own has been rated as ”important” in accordance with the severity criteria available on the Adobe website at http://www.adobe.com/devnet/security/security_zone/severity_ratings.html. Because it is possible for a vulnerability to be exploited in combination with other factors that may impact the overall severity of an attack, Adobe always recommends users update their product installations in line with security best practices.”

To take complete control however the server admin would have had to ignore the ‘best-practice’ guidelines and allowed public access to administrative components of the ColdFusion server.

If you are interested you can find reliable exploit code here:

Adobe ColdFusion Directory Traversal Vulnerability

Source: The Register


Posted in: Exploits/Vulnerabilities, Web Hacking

Tags: , , , , , , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Web Hacking | Add a Comment
Recent in Exploits/Vulnerabilities:
- Intel Hidden Management Engine – x86 Security Risk?
- TeamViewer Hacked? It Certainly Looks Like It
- Serious ImageMagick Zero-Day Vulnerabilities – ImageTragick?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,764 views
- AJAX: Is your application secure enough? - 120,108 views
- eEye Launches 0-Day Exploit Tracker - 85,539 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


RSMangler – Keyword Based Wordlist Generator For Bruteforcing

Your website & network are Hackable


RSMangler will take a word list and perform various manipulations on it similar to those done by John the Ripper with a few extras. It goes along well with our previous post on Password Cracking Wordlists and Tools for Brute Forcing.

There are other options too like Wyd – Automated Password Profiling Tool, which is a little more advanced – or The Associative Word List Generator (AWLG).

The main new feature is permutations mode which takes each word in the list and combines it with the others to produce all possible permutations (not combinations, order matters). For example the words freds, fresh, fish will produce the following list:

Each of these new words is then subject to the other mangles, because of this we strongly recommend with permutations mode enabled (default) you use a very small wordlist, 3 start words create a final list containing 4245 words and 5 start words creates a list containing 91975. As a test we tried it with a few hundred words and gave up when the output file got to 3G. If you try to use a file with more than 5 words you will get a warning and the option to abort. Other mangles include adding the numbers 1 to 123 to the start and end, 01 to 09 to the start and end, various case manipulations, leet speak, word reversal, ed and ing on the end and doubling words up.

The initial wordlist can either be specified as a file or can be piped in through STDIN.

Installation

RSMangler is written in Ruby and therefore needs Ruby to be installed and working. The script needs to be made executable and it doesn’t rely on any gems or anything external.

You can download RSMangler here:

rsmangler_1.0.tar.bz2

Or read more here.


Posted in: Hacking Tools, Password Cracking

Tags: , , , , , , , , , , , , , , , ,

Posted in: Hacking Tools, Password Cracking | Add a Comment
Recent in Hacking Tools:
- Unicorn – PowerShell Downgrade Attack
- Wfuzz – Web Application Brute Forcer
- wildpwn – UNIX Wildcard Attack Tool

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,978,283 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,421,121 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 679,076 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Dangerous iPhone iOS JailBreak Exploit Goes Public

Your website & network are Hackable


Apple just released a patch for iOS that fixes the vulnerability that was being used by JailbreakMe website to exploit a weakness in PDF handling to Jailbreak the device.

Shortly after that the developer of the JailbreakMe exploit released the code to the public via GitHub. The code is available in full here:

http://github.com/comex/star

But is not well documented, that won’t stop the more advanced coders using it with malicious intents in mind.

Minutes after Apple issued a security update Wednesday, the maker of a 10-day-old jailbreak exploit released code that others could put to use hijacking iPhones, iPod Touches and iPads.

“Comex,” the developer of JailbreakMe 2.0, posted source code for the hacks that leveraged two vulnerabilities in iOS and allowed iPhone owners to install unauthorized apps. Apple patched the bugs earlier Wednesday.

The exploits that comex used to jailbreak the iOS could be used for other purposes, including delivering malicious payloads to grab control of iPhones, iPads, and iPod Touches. All that would be necessary is for hackers to dupe users into visiting a malicious Web site or persuading them to click on a link in an e-mail or text message. “Impressive. And dangerous,” said Mikko Hypponen , chief research officer at antivirus company F-Secure, on Twitter early today of the exploit code.

It may not be long before comex’s work is turned into a weapon for attacks that gain “root” access, or complete control, of iPhones and iPads.

This could be pretty dangerous, even though Apple has released a patch to address the issue – honestly how many people will apply the patch? And will they do it in a timely fashion? There’s always that window between the release and the majority of devices being secure that leaves things wide open to exploitation.

I’d be on the lookout for some serious malware to come out within the next week or so leveraging this method of exploitation. Could a large scale iPhone worm be the next big thing? I certainly think it’ll be more malicious that the previous rickrolling SSH bug. That was of course also followed up with a malicious iphone worm based on the same weakeness.

Noted Mac vulnerability researcher Dino Dai Zovi, co-author of The Mac Hackers Handbook , chimed in with a warning of his own. “Now that @comex released his jailbreak source, any bets on how long before it is ported to Metasploit?” Dai Zovi tweeted Wednesday.

Metasploit is the open-source penetration testing framework that some use as a hacking toolkit.

Apple did not patch 2007’s first-generation iPhone or iPod Touch yesterday, delivering the update only to the iPhone 3G or later running the iOS 2.0 or later, and to the second-generation iPod Touch or later running iOS 2.1 or later. Lacking patches, those early models may be vulnerable to attack.

Also possibly at risk: Mac OS X. Like iOS, Apple’s desktop operating system includes the FreeType font engine, which may be vulnerable to the same or a similar exploit.

And users who have used comex’s code to jailbreak their iPhones have a decision to make. If they accept Wednesday’s update, they lose the ability to install and run software not approved by Apple. But by ignoring the update, they may be victimized by future attacks based on the public code.

By making the code public comex has introduced a lot of interesting factors, does this exploit work on Mac OSX? Are older iOS devices vulnerable (because Apple has not released a patch for them)? What is going to come from this?

No-one can fault comex for his actions, he was offering a free solution for users to Jailbreak their devices and when Apple had patched the flaw he released the code.

Source: Network World


Posted in: Apple, Exploits/Vulnerabilities, Hacking Tools

Tags: , , , , , , , , , , , , , , ,

Posted in: Apple, Exploits/Vulnerabilities, Hacking Tools | Add a Comment
Recent in Apple:
- FBI Backed Off Apple In iPhone Cracking Case
- Mac OS X Ransomware KeRanger Is Linux Encoder Trojan
- XcodeGhost iOS Trojan Infected Over 4000 Apps

Related Posts:

Most Read in Apple:
- KisMAC – Free WiFi Stumbler/Scanner for Mac OS X - 82,975 views
- Apple Struggling With Security & Malware - 24,133 views
- Java Based Cross Platform Malware Trojan (Mac/Linux/Windows) - 15,913 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


BitBlaze – Binary Analysis Platform For Computer Security

Find your website's Achilles' Heel


Binary analysis is imperative for protecting COTS (common off-the-shelf) programs and analyzing and defending against the myriad of malicious code, where source code is unavailable, and the binary may even be obfuscated. Also, binary analysis provides the ground truth about program behavior since computers execute binaries (executables), not source code. However, binary analysis is challenging due to the lack of higher-level semantics. Many higher level techniques are often inadequate for analyzing even benign binaries, let alone potentially malicious binaries. Thus, we need to develop tools and techniques which work at the binary level, can be used for analyzing COTS software, as well as malicious binaries.

The BitBlaze project aims to design and develop a powerful binary analysis platform and employ the platform in order to (1) analyze and develop novel COTS protection and diagnostic mechanisms and (2) analyze, understand, and develop defenses against malicious code. The BitBlaze project also strives to open new application areas of binary analysis, which provides sound and effective solutions to applications beyond software security and malicious code defense, such as protocol reverse engineering and fingerprint generation.

The BitBlaze project consists of two central research directions: (1) the design and development of the underlying BitBlaze Binary Analysis Platform, and (2) applying the BitBlaze Binary Analysis Platform to real security problems. The two research focii drive each other: as new security problems arise, we develop new analysis techniques. Similarly, we develop new analysis techniques in order to better or more efficiently solve known problems.

The underlying BitBlaze Binary Analysis Platform features a novel fusion of static and dynamic analysis techniques, dynamic symbolic execution, and whole-system emulation and binary instrumentation. The BitBlaze platform has different components for each task: Vine, TEMU, and Rudder. The three components in tandem provide the power for effective analysis of real-world binary programs for various applications.

  • Vine, the static analysis component. Open source release available now. Vine provides an an intermediate language for assembly (ILA), and an infrastructure for analyzing programs written in this language. ILA is a full language in which programs can be written, type-checked, then compiled down to assembly. We also provide analysis on the ILA, such as abstract interpretation, dependency analysis, and logical analysis via interfaces with theorem provers.
  • TEMU, the dynamic analysis component. Open source release available now. TEMU provides a dynamic analysis environment through whole-system emulation and dynamic binary instrumentation. TEMU is OS-aware (i.e., it understands OS-level semantics) and enables various fine-grained dynamic analysis to build upon, such as dynamic taint analysis and fine-grained behavioral analysis.
  • Rudder, the component for online dynamic symbolic execution. Rudder is an engine for online dynamic execution on binaries. At a high level, with a specified set of input sources of interest, Rudder can automatically explore different execution paths in a program determined by the input sources. It will automatically build logical formulas representing the constraints on the chosen input to take the followed paths.

You can download the currently available BitBlaze components here:

Vinevine-1.0.tar.gz
TEMUtemu-1.0.tar.gz

Or read more here.


Posted in: Forensics, Programming

Tags: , , , , , , , , , , , , , , , , , , ,

Posted in: Forensics, Programming | Add a Comment
Recent in Forensics:
- Web Application Log Forensics After a Hack
- CapTipper – Explore Malicious HTTP Traffic
- Google Rapid Response (GRR ) – Remote Live Forensics For Incident Response

Related Posts:

Most Read in Forensics:
- NetworkMiner – Passive Sniffer & Packet Analysis Tool for Windows - 66,423 views
- raw2vmdk – Mount Raw Hard Disk (dd) Images As VMDK Virtual Disks - 34,258 views
- OpenDLP – Free & Open-Source Data Loss Prevention (DLP) Tool - 28,768 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95