Archive | September, 2010

Recent in Hacking Tools:
- Recon-ng – Web Reconnaissance Framework
- INURLBR – Advanced Search Engine Tool
- DNSRecon – DNS Enumeration Script

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,969,427 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,387,642 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 674,158 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Email Worm Spreading Like Wildfire – W32.Imsolk/VBMania Variant

Don't let your data go over to the Dark Side!


Oh this is a throw back to the 90s, a self-replicating e-mail worm based around a malicious screensaver (.scr) that sends itself to everyone in your address book. It seems this one is spreading fast though with hundreds of thousands of infections.

Reminds of the heydays of ILOVEYOU and Anna Kournikova.

A fast-moving email worm that began spreading on Thursday has been able to affect hundreds of thousands of computers worldwide, anti-virus provider Symantec warned.

The email arrives with the subject “Here you have.” An executable screensaver that’s disguised as a PDF document then tries to send the same message to everyone listed in the recipient’s address book. The .scr file is a variation of the W32.Imsolk.A@mm worm Symantec discovered last month.

In addition to spreading through email, it can propagate through mapped drives, autorun and instant messenger. It also has the ability to disable various security programs.

It’s slightly more advanced than the old versions though with the ability to spread through instant messaging (probably MSN Live Messenger) and also disable security programs.

Plus it’s harder to scan for as the malicious screensaver isn’t actually attached to the email but downloaded from a remote source, and from early reports – multiple remote sources.

The worm is a throwback to attacks not seen in almost a decade, when the Anna Kournikova and I Love You attacks wreaked havoc on email systems worldwide. The Here You Go worm appears to different in that the malicious payload is downloaded from a page on members.multimania.com, rather than being attached to the email. That could make efforts to eradicate the worm easier.

Then again, McAfee said multiple variants of the worm appear to be spreading, so it’s not yet clear that the malicious screensaver is hosted by a single source.

There’s more info available here:

Symantec – New Round of Email Worm, “Here you have”
McAfee – Widespread Reporting of “Here you have” Virus (aka W32/VBMania@MM)

Source: The Register


Posted in: General News, Malware

Tags: , , , , , , , , , , , ,

Posted in: General News, Malware | Add a Comment
Recent in General News:
- Teen Accused Of Hacking School To Change Grades
- Google’s Chrome Apps – Are They Worth The Risk?
- Twitter Breach Leaks 250,000 User E-mails & Passwords

Related Posts:

Most Read in General News:
- Hacking Still Can’t Outdo Stupidity for Data Leaks - 125,366 views
- eEye Launches 0-Day Exploit Tracker - 85,459 views
- Seattle Computer Security Expert Turns Tables On The Police - 43,621 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


DllHijackAuditor – Free Audit Tool For DLL Hijack Vulnerability

Cybertroopers storming your ship?


DllHijackAuditor is the smart tool to Audit against the Dll Hijacking Vulnerability in any Windows application. This is recently discovered critical security issue affecting almost all Windows systems on the planet. It appears that large amount of Windows applications are currently susceptible to this vulnerability which can allow any attacker to completely take over the system.

DllHijackAuditor helps in discovering all such Vulnerable Dlls in a Windows application which otherwise can lead to successful exploitation resulting in total compromise of the system. With its simple GUI interface DllHijackAuditor makes it easy for anyone to instantly perform the auditing operation. It also presents detailed technical Audit report which can help the developer in fixing all vulnerable points in the application.

The new version v2 of DllHijackAuditor is available now. DllHijackAuditor is the FREE tool to audit against the recently discovered DLL Hijack Vulnerability.

Changes

  • Smart Debugger based ‘Interception Engine’ for consistent and efficient performance without intrusion.
  • Support for specifying as well as auditing of application with custom & multiple Extensions.
  • Timeout Configuration to alter the waiting time for each Application.

You can download DllHijackAuditor v2 here:

DllHijackAuditor 2.0

Or read more here.


Posted in: Countermeasures, Programming, Security Software

Tags: , , , , , , , , , ,

Posted in: Countermeasures, Programming, Security Software | Add a Comment
Recent in Countermeasures:
- Google Rapid Response (GRR ) – Remote Live Forensics For Incident Response
- PEiD – Detect PE Packers, Cryptors & Compilers
- NAXSI – Open-Source WAF For Nginx

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 119,987 views
- Password Hasher Firefox Extension - 117,693 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,696 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Microsoft Investigates IE CSS Cross-Origin Theft Vulnerability

Cybertroopers storming your ship?


There’s a lot of circumstantial evidence surround this as Microsoft themselves haven’t clarified or publicly announced anything related to the CSS Cross-Origin Theft bug – but it seems fairly clear.

Some media sources are quoting it as a ‘new bug‘ – which it isn’t, according to other sources it has been known about for at least 2 years and one paper has traced it back as far as 2002 (PDF file).

Microsoft last Friday said it was looking into a long-known vulnerability in Internet Explorer (IE) that could be used to access users’ data and Web-based accounts.

The bug can allow hackers to hijack Web mail accounts, steal data and send illicit tweets, said Google security engineer Chris Evans in a message posted on the Full Disclosure mailing list. Evans also published a demonstration that showed how the flaw in IE8 could be used to commandeer a user’s Twitter account and send unauthorized tweets.

The vulnerability, known as a “CSS cross-origin theft” bug, has a long history. Researchers at Carnegie Mellon University, who recently published a paper on the subject, have traced it back as far as 2002. Those researchers will present their paper at the Conference on Computer and Communications Security next month. Even so, the flaw received little attention until Evans blogged about it in December 2009. He had submitted a bug report for Chrome eight months earlier.

Microsoft did Tweet about looking into something but haven’t named it although coincidentally it was just a few hours after the public disclosure of this flaw. A point of contention is that this bug has been known about for a long time and has been patched by all the other major browsers including Chrome and Firefox.

Another interesting point is that Chris Evans is actually a Google engineer. Earlier this year Tavis Ormandy went public with a serious flaw in Windows once again stating Microsoft was unwilling to address it.

Although Microsoft has not patched the vulnerability in IE8, other browsers, including Firefox, Chrome, Safari and Opera, have fixed the flaw. Google patched the bug in Chrome last January, while Mozilla did the same in July with Firefox 3.6.7 and Firefox 3.5.11.

IE9 includes a fix for the vulnerability. Microsoft plans to ship a public beta of IE9 on Sept. 15.

On Friday, Evans explained why he was adding to the patch pressure by crafting a proof-of-concept. “I have been unsuccessful in persuading the vendor to issue a fix,” he said of Microsoft.

Microsoft issued a statement Friday saying it was investigating Evans’ reports, but declined to answer questions on Monday, including whether earlier versions of IE were vulnerable or why it has not yet addressed the bug.

“We’re currently unaware of any attacks trying to use the claimed vulnerability or of customer impact,” said Jerry Bryant, a group manager with the Microsoft Security Response Center, in the e-mailed statement.

In the case of Tavis Ormandy it was the Windows Help Vulnerability Exploited In The Wild, I expect with this vulnerability going public and with an accompanying proof of concept we may well see this CSS attack in the wild too.

IF you are interested you can see the PoC for the bug here:

http://scary.beasts.org/misc/twitter.html

Source: Network World


Posted in: Exploits/Vulnerabilities, Windows Hacking

Tags: , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Windows Hacking | Add a Comment
Recent in Exploits/Vulnerabilities:
- BeautifulPeople.com Leak Exposes 1.1M Extremely Private Records
- Apple Will Not Patch Windows QuickTime Vulnerabilities
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,102 views
- AJAX: Is your application secure enough? - 119,987 views
- eEye Launches 0-Day Exploit Tracker - 85,459 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Arachni – Web Application Vulnerability Scanning Framework

Don't let your data go over to the Dark Side!


Arachni is a feature-full and modular Ruby framework that allows penetration testers and administrators to evaluate the security of web applications. Arachni is smart, it trains itself with every HTTP response it receives during the audit process. Unlike other scanners, Arachni takes into account the dynamic nature of web applications and can detect changes caused while traveling through each path of a web application’s cyclomatic complexity. This way attack/input vectors that would otherwise be undetectable by non-humans are seamlessly handled by Arachni.

The project aims to:

  1. Provide a stable and efficient framework
    Developers should be allowed to easily and quickly create and deploy modules with the minimum amount of restrictions imposed upon them, while provided with the necessary infrastructure to accomplish their goals. Module writers should be able to take full advantage of the Ruby language under a unified framework that will increase their productivity without stifling them or complicating their tasks. Basically, give them the right tools for the job and get the hell out of their way.
  2. Be simple
    Well, not simple in general…some parts of the framework are fairly complex. However, the module and report APIs are very similar and very simple.
  3. Be developer and user friendly
    Users should be able to make the most out of Arachni without being confused or overwhelmed. Developers unfamiliar with the framework should be able to write working modules and reports immediately after a small glance at an existing one.

You can download arachni v0.1.1 here:

zipball-v0.1.1

Or read more here.


Posted in: Hacking Tools, Web Hacking

Tags: , , , , , , , , ,

Posted in: Hacking Tools, Web Hacking | Add a Comment
Recent in Hacking Tools:
- Recon-ng – Web Reconnaissance Framework
- INURLBR – Advanced Search Engine Tool
- DNSRecon – DNS Enumeration Script

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,969,427 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,387,642 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 674,158 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Google Agrees To Pay $ 8.5 Million To Settle Buzz Class Action Lawsuit

Cybertroopers storming your ship?


And once again Google is in the news regarding privacy issues, this time it’s regarded their social networking service Buzz (which by all accounts is pretty much a flop). The way in which the service used Gmail users address books alarmed a lot of people and the default settings were rather risky and revealed a lot more than most people were comfortable with.

This led to a lot of people boycotting Buzz and in the end rolling out server civil cases against Google. They did attempt to rectify the issue by moving the checkbox to a more prominent position – but honestly the defaults shouldn’t have exposed such personal information to the public Internet in the first place.

Google has agreed to pay $8.5 million to settle a class action lawsuit claiming it violated the privacy of Gmail users when it released Google Buzz, a Gmail bolt-on that turned the email service into a Tweetbookish social networking tool.

The suit in question consolidates several civil cases filed against the company over Google Buzz, which was rolled out to all Gmail users in February – before it had been publicly tested. By default, Buzz automatically exposed users’ most frequent Gmail contacts to the public internet. You did have the option of hiding the list from the public view, but many complained that the checkbox that let you do so was less than prominently displayed.

Within days, Google agreed to move the checkbox to a more prominent position, and it rejiggered the way it handles user contacts. But this didn’t prevent a spate of lawsuits.

I wonder who is actually going to get this $8.5 million though, there are no details on that front. And who are the class representatives? Did any actual individuals band together under this class action suit to get a sweet payout from Google?

I guess more details may come out some time after the case.

In settling the consolidated case, Google will create an $8.5 million fund that will be used to distribute awards to organizations focused on internet privacy or privacy education. It will also be used to pay the lawyers and class representatives – i.e. the people who sued.

Clearly, Google is desperate to challenge the Facebooks of the world with a widely used social networking service of its own, which would expand its its efforts to collect data on users that can then be used to target ads. But like Orkut before it, Buzz hasn’t exactly achieved that goal – just judging from anecdotal evidence. Google has not said, however, how many people actually use the service.

It’s a win for Internet privacy and Google has been getting in a lot of trouble lately, especially with privacy issues regarding their illegal capturing of Wifi data during the Google Wifi Scanning debacle.

Google seem to be trying to go into to many areas and not successfully, they really can’t compete with Twitter and Facebook so why bother trying? They already have a huge user base for existing services, so why not improve those and capture more market share.

Source: The Register


Posted in: Legal Issues, Privacy

Tags: , , , , , , , , , , , ,

Posted in: Legal Issues, Privacy | Add a Comment
Recent in Legal Issues:
- FBI Backed Off Apple In iPhone Cracking Case
- TalkTalk Hack – Breach WAS Serious & Disclosed Bank Details
- More Drama About Hillary Clinton’s E-mail Leak – VNC & RDP Open

Related Posts:

Most Read in Legal Issues:
- Class President Hacks School Grades - 80,681 views
- Hospital Hacker GhostExodus Owns Himself – Arrested - 47,586 views
- One Of The World’s Most Prolific Music Piracy Groups Busted - 43,593 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Malware Hash Checking Tool – Online & Offline Support

Cybertroopers storming your ship?


This program intends to detect a malicious file in two ways; online and offline. It calculates the md5 hash of a specified file and searches it in its current hash set (offline) or on VirusTotal site (online) and shows the result. It has http proxy support and update (for hash set) feature.

Malware Hash Checking Tool

It’s a simple python script so you can check out the source code, screenshots and a readme are included in the zip file. To add proxy support simply edit the .py script and add in the relevant proxy details.

You can download the Malware Check Tool here:

malware_check_tool.zip

Or read more here.


Posted in: Countermeasures, Malware, Security Software

Tags: , , , , , , , , , , ,

Posted in: Countermeasures, Malware, Security Software | Add a Comment
Recent in Countermeasures:
- Google Rapid Response (GRR ) – Remote Live Forensics For Incident Response
- PEiD – Detect PE Packers, Cryptors & Compilers
- NAXSI – Open-Source WAF For Nginx

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 119,987 views
- Password Hasher Firefox Extension - 117,693 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,696 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Deutsche Post Security Cup – Bug Bounty Contest

Cybertroopers storming your ship?


The trend of paying for bugs is certainly catching on, the most recent entrant to the field is Deutsche Post the German postal service. They announced this week a security cup for their new online secure messaging service. The bug bounty trend has resurfaced recently with Mozilla increasing its bounty to $3000 and Google increasing their offering shortly after that too.

Teams will have seed money and will be awarded additional bounties for major and minor bugs. There’s quite a lot of money up for grabs if you count the seed money + find at least 2 critical bugs and a few minor bugs you could walk away with quite a fat stash.

Deutsche Post, the successor to the German federal postal service, will offer bounties for bugs researchers find in its E-Postbrief secure message service, the company announced this week.

The firm, which also operates the DHL overnight delivery service, will kick off a contest in October after it pre-approves research teams that apply for what it’s calling the Deutsche Post Security Cup. Each team will be seeded with €3,000 ($3,800), but must use their own tools and agree to not touch any private data they come across during their work. The teams must also keep quiet about any vulnerabilities they find until December, when Deutsche Post will award prizes and reveal the bugs it’s patched.

You can look at this two ways really, on one hand this is a good initiative meaning the system will be secured in some way. Of course that’s entirely dependant on the skill level of the people who enter the ‘cup’. But judging by the bounty amounts I’d say they are likely to attract a fairly decent crowd.

On the other hand you could say this is a form of crowd-sourcing, they are avoiding paying big bucks to a proper security company for an audit and farming it out under the guise of a bounty scheme to whoever shows up.

Bounties of €6,000 ($6,400) and €1,000 ($1,300) will be paid for major and minor bugs, respectively, with a four-member jury classifying the reported vulnerabilities. The jury includes Jennifer Granick, the civil liberties director of the Electronic Frontier Foundation (EFF) and Thorsten Holz, the co-founder of the German Honeynet Project, which places vulnerable systems on the Internet to collect malware.

Bug bounties and prizes gained momentum this summer after Mozilla and Google both hiked the rewards they pay to researchers who report vulnerabilities in Firefox and Chrome, respectively. Shortly after the bounty boosts, the long-running Zero Day Initiative (ZDI) bug payment program run by HP TippingPoint announced new rules, including a six-month deadline for patching reported problems.

More information about Deutsche Post’s bug contest can be found on its Web site.

I hope all findings are publicly published so we can really judge the value of the outcome and what kind of opportunity this represents for corporations who are looking for security solutions. It could bring about a whole new breed of ‘bounty hackers’ that solely exist (professionally) on these kind of offerings.

Plus the fact they do actually have some well-known judges who are credible and known in the industry. It seems like the whole bounty scheme could be heating up.

Source: Network World


Posted in: Exploits/Vulnerabilities, General News

Tags: , , , , , , , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, General News | Add a Comment
Recent in Exploits/Vulnerabilities:
- BeautifulPeople.com Leak Exposes 1.1M Extremely Private Records
- Apple Will Not Patch Windows QuickTime Vulnerabilities
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 234,102 views
- AJAX: Is your application secure enough? - 119,987 views
- eEye Launches 0-Day Exploit Tracker - 85,459 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Windows PowerShell DNS Server Blackhole Tool – Blacklist Domains

Don't let your data go over to the Dark Side!


This is a Windows PowerShell Script to help you with blacklisting domains you wish to block in your networks.

We have written about PowerShell before, it is something which can make the windows shell a lot more flexible.

On the external DNS servers you can create primary zones for the domain names and FQDNs you do not want your users to resolve correctly. These DNS zones will all return an incorrect IP address, such as “0.0.0.0″ or the address of an internal server, not the real address. Because the organization’s internal DNS servers are configured to forward their requests to these external DNS servers in the DMZ, the internal DNS servers will cache these incorrect addresses too when the external DNS servers respond. So, when an internal client tries to resolve an unwanted DNS name, it will receive a response, but the IP address returned will be incorrect. Because an IP address of “0.0.0.0″ is unreachable, these unwanted zones created on the external DNS servers are said to be “blackholed”, “blacklisted” or “blocklisted”.

What to block? You can obtain lists of FQDNs and domain names to blackhole for free. Some lists are only for malware, others might be just for pornography, but be aware that they are never 100% complete or accurate (you get what you pay for, so don’t be surprised to find gaps a small number of false positives).

Some of the more popular blackhole lists include (in no particular order):

www.MalwareDomains.com
www.Malware.com.br
www.MalwareDomainList.com
www.MalwareURL.com
www.SomeoneWhoCares.org
mtc.sri.com
www.MVPs.org
www.UrlBlacklist.com (not free)

From sites like the above you can download lists of FQDNs and simple domain names which can be fed into the PowerShell script for this article in order to create blackhole zones on Windows DNS servers. If you have DNS servers running BIND, perhaps on Linux or BSD, then the sites above will also help you import blackhole domains on those DNS servers too (scripts for blackholing on BIND are common).

Requirements

To use the PowerShell DNS blackhole script, you must:

  • Have PowerShell 2.0 or later on the computer where the script will be run, which may be the DNS server itself or another management workstation.
  • Use Windows Server 2003 with SP2 or later for the DNS server.
  • Allow network access to the RPC ports of the Windows Management Instrumentation (WMI) service from the workstation where the script will be run.
  • Be a member of the local Administrators group on the DNS server.

You can download the PowerShell DNS Blackhole script here:

Blackhole-DNS.zip

Or read more here.


Posted in: Countermeasures, Network Hacking, Security Software

Tags: , , , , , , , , ,

Posted in: Countermeasures, Network Hacking, Security Software | Add a Comment
Recent in Countermeasures:
- Google Rapid Response (GRR ) – Remote Live Forensics For Incident Response
- PEiD – Detect PE Packers, Cryptors & Compilers
- NAXSI – Open-Source WAF For Nginx

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 119,987 views
- Password Hasher Firefox Extension - 117,693 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,696 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95