Archive | March, 2011

NASA Systems At Risk From Hacking Attacks

Your website & network are Hackable


It’s not surprising really, when I learned that the recently retired NASA space shuttle was still using 5.25″ floppy drives – I suspected that much of the NASA IT architecture was probably antiquated.

Also the recent SCADA related security scare, indicated the industrial and large-scale systems probably aren’t the most secure around.

Combine those two lines of reasoning together and you get a fairly solid conclusion that NASA networks (especially those controlling old equipment like shuttles) are probably horribly insecure.

An official audit of NASA’s network has concluded that the space agency faces a high risk of cyberattack.

Experts from the Office of the Inspector General (OIG) paint a grim picture of the state of the space agency’s server infrastructure, warning that vulnerabilities in its systems leave it open to defacement, denial of service or information-stealing attacks.

In particular, six unnamed IT systems were found to be at risk to attacks that might allow hackers to seize remote control of critical systems over the net – which included systems that control spacecraft – as a result of unpatched software vulnerabilities. The OIG’s report (24-page PDF/703 KB, extract of conclusions below) also warns that sensitive account information is poorly protected and wide open to extraction for any attackers who make it past NASA’s perimeter defences.

Add that to the fact that back in 2008 The International Space Station Was Infected by a Virus and you should be fairly wary of NASA security.

OIG recently provided this with a recent security audit of the the server infrastructure and networks at NASA, the findings were not pretty. The full report is available for download here:

IG-11-017.pdf

Obviously NASA claims all the vulnerabilities found during the OIG audit have been fixed, but what about all the rest that haven’t been found yet? I sincerely hope they start implementing a more holistic approach to security rather than just reactive patching.


We found that computer servers on NASA’s Agency-wide mission network had high-risk vulnerabilities that were exploitable from the internet. Specifically, six computer servers associated with IT assets that control spacecraft and contain critical data had vulnerabilities that would allow a remote attacker to take control of or render them unavailable.

Moreover, once inside the Agency-wide mission network, the attacker could use the compromised computers to exploit other weaknesses we identified, a situation that could severely degrade or cripple NASA’s operations. We also found network servers that revealed encryption keys, encrypted passwords, and user account information to potential attackers. These data are sensitive and provide attackers additional ways to gain unauthorized access to NASA networks.

It is quite worrying as NASA has been a fairly frequent victim of cyber-crime and attacks, especially when it comes to stealing data. Remember the whole Gary McKinnon case is because he hacked NASA.

It was also suggested by an OIG audit in May 2010 that they implement an agency wide computer security program, it seems that hasn’t been done. Hopefully with this hitting the mainstream media this time around, something wil lget fixed.

Source: The Register


Posted in: Exploits/Vulnerabilities, Legal Issues, Privacy

Tags: , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Legal Issues, Privacy | Add a Comment
Recent in Exploits/Vulnerabilities:
- Mirai DDoS Malware Source Code Leaked
- mimikittenz – Extract Plain-Text Passwords From Memory
- Massive Yahoo Hack – 500 Million Accounts Compromised

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 236,473 views
- AJAX: Is your application secure enough? - 120,368 views
- eEye Launches 0-Day Exploit Tracker - 85,862 views


T50 – Experimental Mixed Packet Injector & Network Stress Testing Tool

Find your website's Achilles' Heel


T50 Sukhoi PAK FA Mixed Packet Injector (f.k.a. F22 Raptor) is a tool designed to perform “Stress Testing”.

It is a powerful and an unique packet injection tool, that is capable of the below:

1 – Send sequentially (i.e., ALMOST on the same time) the following protocols:

  • ICMP: Internet Control Message Protocol
  • IGMP: Internet Group Management Protocol
  • TCP: Transmission Control Protocol
  • UDP: User Datagram Protocol

2 – Send an (quite) incredible amount of packets per second, making it a “second to none” tool:

  • More than 1,000,000 pps of SYN Flood (+50% of the network’s uplink) in a 1000BASE-T Network (Gigabit Ethernet).
  • More than 120,000 pps of SYN Flood (+60% of the network’s uplink) in a 100BASE-TX Network (Fast Ethernet).

3 – Perform “Stress Testing” on a variety of network infrastructure, network devices and security solutions in place.

4 – Simulate Denial-of-Service attacks, validating the Firewall rules and Intrusion Detection System/Intrusion Prevention System policies.

You can download T50 here:

t50-5.4.1.tar.gz

Or read more here.


Posted in: Hacking Tools, Network Hacking

Tags: , , , , , , , , , , , , ,

Posted in: Hacking Tools, Network Hacking | Add a Comment
Recent in Hacking Tools:
- PyExfil – Python Data Exfiltration Tools
- Netdiscover – Network Address Discovery Tool
- Kautilya – Human Interface Device Hacking Toolkit

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 2,000,422 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,509,573 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 691,774 views


RSA Silent About Compromise For 7 Days – Assume SecurID Is Broken

Find your website's Achilles' Heel


About a week ago we tweeted about the “Open Letter” from RSA to customers, a rather vague letter. If you haven’t read it yet, you can do so here.

To summarise, they basically said “Recently, our security systems identified an extremely sophisticated cyber attack in progress being mounted against RSA. […] Our investigation also revealed that the attack resulted in certain information being extracted from RSA’s systems. Some of that information is specifically related to RSA’s SecurID two-factor authentication products.“.

And well that’s about it, they’ve been totally tight lipped since then. There is a link to some ‘updated info for SecurID customers’ – but it’s behind a customer login.

It’s been a week since RSA dropped a vaguely worded bombshell on 30,000 customers that the soundness of the SecurID system they used to secure their corporate and governmental networks was compromised after hackers stole confidential information concerning the two-factor authentication product.

For seven days, reporters, researchers, and customers have called on RSA, and its parent corporation EMC, to specify what data was lifted – or at the very least to say if it included details that could allow government or corporate spies to predict the one-time passwords that SecurID tokens generate every 60 seconds. And for seven days, the company has resolutely refused to answer. Instead, RSA has parroted Security 101 how-tos about strong passwords, support-desk best practices, and the dangers of clicking on email attachments.

Officials from RSA and EMC have steadfastly refused to give yes or no answers to two questions that have profound consequences for the 40 million or so accounts that are protected by SecurID: Were the individual seed values used to generate a new pseudo-random number exposed and, similarly, was the mechanism that maps a token’s serial number to its seed leaked?

Without the answers to those two basic questions, RSA customers can’t make educated decisions about whether to continue relying on SecurID to prevent unauthorized logins to their sensitive networks. After all, if the breach on RSA’s servers exposed the seeds and the mapping mechanism, SecurID customers have lost one of the factors offered by the two-factor authentication product.

An RSA spokesman released an updated statement earlier this week that said in part: “Our investigation to date has revealed that the attack resulted in certain information being extracted from RSA’s systems. Even with this information being extracted, RSA SecurID technology continues to be an effective authentication solution for customers.” (Notice the statement didn’t say “an effective two-factor authentication solution.”)

And well seen as though RSA isn’t exactly forthcoming with a detailed statement or at least exactly what has been compromised – people are going to start assuming. The first logical assumption is that SecurID is broken or has been compromised in some way.

This may not be the case, and if so – RSA really needs to clarify that. This is really not the way in which an industry leader should be acting. There are approximately 40 million accounts protected by SecurID and for the past 7 days RSA has refused to answer the two most important questions.

  • Can you specifcy what data was lifted?
  • And did it include details that could break SecurID?

As to breaking SecurID, well did the attackers steal enough data to allow someone to predict the one-time passwords that SecurID tokens generate?


The latest example of these so-called advanced persistent threats came Wednesday when digital certificate authority Comodo disclosed its private encryption keys were used to generate counterfeit credentials for Google Mail and six other sensitive addresses. The CEO has claimed that the attack, which was perpetrated on an unnamed SSL certificate reseller of Comodo, had the hallmarks of state-sponsored hackers, most likely from Iran, although he provided no convincing proof.

“The security companies who are providing authentication are being directly attacked by the government,” CEO Melih Abdulhayoglu said.

This is precisely the assumption being taken by a security administrator who was in the process of helping a financial institution set up a SecurID system when RSA made last week’s announcement. He told The Reg on Thursday that he’s spent the past week trying to pry meaningful details out of RSA, so far without success.

“If they don’t give me an answer by the end of tomorrow about whether the seeds were taken, I’m returning the product,” said the admin, who asked not to be named because he wasn’t authorized to speak publicly. “Their integrity is just shot. Yes, they got hacked but their response is what’s so troubling. The silence is deafening.”

SecurID’s two-factor authentication may not be broken, but until RSA comes clean and provides some yes or no answers to two simple questions, it’s better to assume it is. The network security you preserve may be your own.

As per usual, don’t trust 3rd party solutions, don’t trust proprietary solutions – if you want to maintain total security – you better manage everything yourself. I think this could really hurt sales for RSA and it’s just about destroying their integrity.

Fine if you don’t want to give explicit details, at least clarify in black and white that SecurID is still totally safe to use.

We’ll be waiting for more news from RSA, hopefully their clarifications will come soon and explain everything properly. Until then, be careful.

Source: The Register


Posted in: Cryptography, Exploits/Vulnerabilities

Tags: , , , , , , , , , , ,

Posted in: Cryptography, Exploits/Vulnerabilities | Add a Comment
Recent in Cryptography:
- Signal Messaging App Formal Audit Results Are Good
- SHA-256 and SHA3-256 Are Safe For the Foreseeable Future
- Up1 – Client Side Encrypted Image Host

Related Posts:

Most Read in Cryptography:
- The World’s Fastest MD5 Cracker – BarsWF - 47,908 views
- Hackers Crack London Tube Oyster Card - 45,432 views
- WPA2 Vulnerability Discovered – “Hole 196” – A Flaw In GTK (Group Temporal Key) - 33,372 views


CAT – Web Application Security Test & Assessment Tool

Your website & network are Hackable


CAT is designed to facilitate manual web application penetration testing for more complex, demanding application testing tasks. It removes some of the more repetitive elements of the testing process, allowing the tester to focus on individual applications, thus enabling them to conduct a much more thorough test. Conceptually it is similar to other proxies available both commercially and open source, but CAT provides a richer feature set and greater performance, combined with a more intuitive user interface.

There are a number of differences between CAT and currently available web proxies. They include:

  • CAT uses Internet Explorer’s rendering engine for accurate HTML representation
  • It supports many different types of text conversions including: URL, Base64, Hex, Unicode, HTML/XML, SQL and JavaScript no quotes
  • It offers integrated SQL Injection and XSS Detection
  • Synchronised Proxies for Authentication and Authorisation checking
  • Faster performance due to HTTP connection caching
  • SSL Version and Cipher checker using OpenSSL
  • Greater flexibility for importing/exporting logs and saving projects
  • Tabbed Interface allows for multiple tools at once e.g. multiple repeaters & different logs
  • The ability to repeat and modify a sequence of requests (particularly useful in SSO testing)
  • It’s free!

Do bear in mind that this is a free tool, but it is NOT Open Source. Also take a good look at the EULA before using it (especially Section 6).

You can download CAT Beta 4 here:

CAT_Beta_4.msi

Or read more here. (Thanks to reader Simon for the heads-up on this.)


Posted in: Hacking Tools, Programming, Web Hacking

Tags: , , , , , , , , , , , , , ,

Posted in: Hacking Tools, Programming, Web Hacking | Add a Comment
Recent in Hacking Tools:
- PyExfil – Python Data Exfiltration Tools
- Netdiscover – Network Address Discovery Tool
- Kautilya – Human Interface Device Hacking Toolkit

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 2,000,422 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,509,573 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 691,774 views


Exploits For Popular SCADA Programs Made Public

Find your website's Achilles' Heel


SCADA is not something we’ve mentioned before, we have covered related areas with articles such as – Industrial Control Systems Safe? I Think Not.

Plus the whole Stuxnet thing which was able to attack nuclear plants. In a way I find it ironic because so much more emphasis these days is put on the security of things like Twitter and Facebook, but the industrial control systems in factories and nuclear refining facilities are left unsecured.

It just goes to show how devastating a focused attack against these kind of large scale control systems could be.

The security of software used to control hardware at nuclear plants, gas refineries and other industrial settings is coming under renewed scrutiny as researchers released attack code exploiting dozens of serious vulnerabilities in widely used programs.

The flaws, which reside in programs sold by Siemens, Iconics, 7-Technologies, Datac, and Control Microsystems, in many cases make it possible for attackers to remotely execute code when the so-called supervisory control and data acquisition software is installed on machines connected to the internet. Attack code was released by researchers from two separate security camps over the past week.

“SCADA is a critical field but nobody really cares about it,” Luigi Auriemma, one of the researchers, wrote in an email sent to The Register. “That’s also the reason why I have preferred to release these vulnerabilities under the full-disclosure philosophy.”

The vulnerability dump includes proof-of-concept code for at least 34 vulnerabilities in widely used SCADA programs sold by four different vendors. Auriemma said the majority of the bugs allow code execution, while others allow attackers to access sensitive data stored in configuration files and one makes it possible to disrupt equipment that uses the software. He included a complete rundown of the vulnerabilities and their corresponding PoC code in a post published on Monday to the Bugtraq mail list.

There are a whole long list of vulnerabilities including PoC code posted publicly on Bugtraq this past Monday:

Vulnerabilities in some SCADA server softwares

The vulnerabilities include software by popular vendors such as Siemens. If you don’t know what SCADA is it stands for supervisory control and data acquisition.

The e-mail explains it well:

In case someone doesn’t know SCADA (like me before the tests): it’s just one or more softwares (usually a core, a graphical part and a database) that allow people to monitor and control the various hardware sensors and mechanisms located in industrial environments like nuclear plants, refineries, gas pipelines, airports and other less and more critical fields that go from the energy to the public infrastructures and obviously also the small “normal” industries.

Pretty heavy stuff, more on Wiki here – SCADA.


It came six days after a Moscow-based security firm called Gleg announced the availability of Agora SCADA+, which attempts to collect virtually all known SCADA vulnerabilities into a single exploit pack. The 22 modules include exploits for 11 zero-day vulnerabilities, said the company’s Yuriy Gurkin in an email. It’s not clear how much the package costs.

Gurkin said Gleg’s website has come under sustained web attacks shortly after releasing the SCADA exploit pack.

“We have tried to switch to ddoshostingsolutions.com provider but in just 3 days were out of 500 GB traffic limit,” he said. “Currently trying to solve this.”

The vulnerability of SCADA systems had long been theorized, but it wasn’t until last year that the world got an object lesson on just how susceptible they could be to attack. In July, researchers reported the discovery of a computer worm that attacked SCADA software sold by Siemens. Research later showed that the underlying Stuxnet exploit amounted to a “search-and-destroy weapon” built to take out Iran’s Bushehr nuclear reactor.

SCADA software often runs on extremely old systems that are difficult to replace without causing disruptions to critical equipment. As a result, installing patches and upgrades is frequently avoided despite the obvious security benefits.

Most of the bugs are quite serious too, not just DoS attacks or simple information disclosure. The majority actually lead to code execution and are able to be exploited remotely to any of these SCADA systems that are connection to an Internet enabled LAN.

What’s worse is SCADA systems rate way lower than IT systems in terms of budget for audits and security, there are very few people with in-depth knowledge in SCADA security and in general people don’t really seem interested in it.

With the scary flip side being, the SCADA systems control MUCH more important equipment than any of the IT systems do. It’ll be interesting to see if any of these companies issue statement and fixes for the software and perhaps carry out some proper audits.

Of course issuing guidelines on setting up SCADA systems in a secure manner would be useful too.

Source: The Register


Posted in: Exploits/Vulnerabilities, Hardware Hacking

Tags: , , , , , , , , , ,

Posted in: Exploits/Vulnerabilities, Hardware Hacking | Add a Comment
Recent in Exploits/Vulnerabilities:
- Mirai DDoS Malware Source Code Leaked
- mimikittenz – Extract Plain-Text Passwords From Memory
- Massive Yahoo Hack – 500 Million Accounts Compromised

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 236,473 views
- AJAX: Is your application secure enough? - 120,368 views
- eEye Launches 0-Day Exploit Tracker - 85,862 views


Smooth-Sec – All In One Pre-Configured IDS/IPS System

Your website & network are Hackable


Smooth-Sec is a ready to-go IDS/IPS (Intrusion Detection/Prevention System) Linux distribution based on the multi threaded Suricata IDS/IPS engine and Snorby, the top notch web application for network security monitoring. Smooth-Sec is built on Ubuntu 10.04 LTS using the TurnKey Core base as development platform.

Functionality is the key point that allows a user to deploy a complete IDS/IPS System up and running out of the box within a few minutes, even for security beginners with minimal Linux experience.

Features

Snorby

  • Metrics Metrics & Reports
  • Classifications
  • Full packet and session data.
  • Settings Custom Settings
  • Hotkeys

Suricata


  • Native IPv6 Support
  • Automatic protocol detection
  • Multi threaded
  • Native hardware acceleration support
  • Passive OS and Portscan detection
  • L7 Protocol awareness
  • IP Reputation using scoring threshold
  • Distributed blocking & feedback
  • Global flowbits and variables

Details

Snorby login:

Snorby interface: https://ipaddress
Username: snorby@snorby.org
Password: snorby (please change this password after the firts login)

Ssh login:

Username: root
Password: the password you have chose during the installation

You can download Smooth-Sec here:

SmoothSec-1.1.iso

Or read more here.


Posted in: Countermeasures, Network Hacking, Security Software

Tags: , , , , , , , , , , , ,

Posted in: Countermeasures, Network Hacking, Security Software | Add a Comment
Recent in Countermeasures:
- Signal Messaging App Formal Audit Results Are Good
- Snort – Free Network Intrusion Detection & Prevention System
- SHA-256 and SHA3-256 Are Safe For the Foreseeable Future

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,368 views
- Password Hasher Firefox Extension - 117,976 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,776 views


Dutch Court Rules Wi-Fi Hacking Legal In Holland

Your website & network are Hackable


Interesting case and a very interesting interpretation of the laws of Holland which lead to this decision which means the Dutch can hack in Wireless routers legally.

We published a story about the ethics of jacking open Wi-Fi connections way back in 2006, when a supposed ethics expert said it was ok: Jacking Wifi is ‘OK’ say Ethics Expert.

The main differentiation being that a router isn’t a computer and as long as the intruder doesn’t access any of the computers on the internal network – he’s within the law.

A Dutch court has ruled that hacking into Wi-Fi connections is not a crime providing any connected computers remain untouched. However Wi-Fi freeloaders would still lay themselves open to civil proceedings.

The unusual ruling came in the case of a student who threatened a shooting rampage against staff at students at Maerlant College in The Hague. The threat was posted on 4chan, the notoriously anarchic internet image board, after the student broke into a secure Wi-Fi connection. The unnamed student was caught and convicted of posting the message but acquitted on the hacking charge. The miscreant was sentenced to 120 hours of community service.

It seems like somehow 4chan was involved in this case and perhaps the Anonymous bunch too.

The interesting part for me is their definition of a computer and the part where the router falls down, they define it as a machine involved in the “storage, processing and transmission of data”. That sounds like a definition of a router to me, but for them – the router only stores the data in a transient matter as long as it needs to carry out its current task.


Reports are vague on how the student hacker was tracked down, but it may well be that the denizens of 4chan got the ball rolling by reporting the threats to police, something that happened in a similar school massacre threat case in Michigan back in February.

The Netherlands has a computer hacking law that dates from the early 1990s and defines a computer as a machine involved in the “storage, processing and transmission of data”. Since a router is not used to store data, a judge reasoned, it fails to qualify as a computer – and thus the computer hacking law isn’t applicable. The ruling, which surprised legal observers in The Netherlands, means that piggy-backing (or leeching) open wireless networks is not a crime: though civil proceedings against leechers would still be possible, so a free-for-all is unlikely.

Most countries have laws the apply to hacking into computer networks as well as computers but not, it would seem, The Netherlands. The Dutch attorney general has decided to appeal the verdict in the case, a process that may take several months.

Of course any wannabe Wi-Fi hackers in Holland are still open to civil proceedings from jacking connections, that’s if the person can show some negative effect to their livelihood or business.

And yah I also find it odd that the Dutch laws only cover computers and not networks or networking equipment. It means you’re pretty much open to hack anything you like as long as it’s not a computer (printers, telephones, faxes, routers, firewalls, proxies etc).

Source: The Register


Posted in: Legal Issues, Wireless Hacking

Tags: , , , , , , , , , ,

Posted in: Legal Issues, Wireless Hacking | Add a Comment
Recent in Legal Issues:
- UK Teen Earned More Than US$385,000 From DDoS Service
- Massive Yahoo Hack – 500 Million Accounts Compromised
- Two Israeli Men Arrested For Running VDoS-s.com DDoS Service

Related Posts:

Most Read in Legal Issues:
- Class President Hacks School Grades - 80,755 views
- Hospital Hacker GhostExodus Owns Himself – Arrested - 47,700 views
- One Of The World’s Most Prolific Music Piracy Groups Busted - 43,642 views


Wophcrack – Web Based Interface For Ophcrack Password Cracking Tool

Your website & network are Hackable


I’m assuming everyone reading already knows about Ophcrack – the awesome time/memory trade-off password cracker.

Well here is a nifty web-based interface for it. Rainbow Tables are really useful when cracking password hashes, but one major disadvantage of these tables is their size which can be hundreds of gigs for complex tables. The author thought it would be extremely useful to have a personal web interface for your rainbow tables which you can access from anywhere on the web anywhere without having to carry the large tables with you everywhere you go. And well here we are, Wophcrack (Web)Ophcrack.

Wophcrack - Web Interface for Ophcrack

When cracking LM or NTLM hashes Ophcrack is a great tool as we discussed recently, it provides both a GUI and CLI options along with some free and paid tables. The author basically wrote a quick and dirty PHP based web frontend for Ophcrack.

Wophcrack was designed to work on Backtrack 4 R2, Although it can be install on any Linux distribution with some small adjustments, Wophcrack can also easily edited to support Rainbow Crack.

You can download Wophcrack here:

wophcrack.zip

Or read more here.


Posted in: Hacking Tools, Password Cracking

Tags: , , , , , , , , ,

Posted in: Hacking Tools, Password Cracking | Add a Comment
Recent in Hacking Tools:
- PyExfil – Python Data Exfiltration Tools
- Netdiscover – Network Address Discovery Tool
- Kautilya – Human Interface Device Hacking Toolkit

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 2,000,422 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,509,573 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 691,774 views


Web Hacking Incident Database Shows DoS Attacks On The Rise

Find your website's Achilles' Heel


It seems like the formidable Anonymous army has managed to change the weighting of stats collected by the Web Hacking Incident Database (WHID) with it’s vast array of DDoS attacks.

We’ve reported on a couple of them like back in December when the WikiLeaks Attacks Caused Rival DDoS Retaliation. There have been a whole lot of other attack types going as usual though with SQL Injection and XSS (Cross Site Scripting) making up the to the top 3 with DDoS Attacks.

But if you haven’t worried about it before, perhaps now is the time to look into prevention/protection against denial-of-service attacks.

Driven by the hacktivism of the loose-knit Anonymous group, denial-of-service attacks surged to the top of the list of Web incidents, outpacing SQL injection and cross-site scripting, according to a survey of publicly disclosed attacks.

The ongoing survey, known as the Web Hacking Incident Database, categorized 222 incidents in 2010 and found that attackers aimed to take down the Web sites in a third of the incidents, while defacement accounted for 15 percent of attacks and stealing information was the goal in 13 percent of incidents. Unsurprisingly, the popular goal of causing downtime meant that denial-of-service attacks accounted for about a third of attack types, followed by SQL injection (21 percent) and cross-site scripting (9 percent).

In many industry reports, denial-of-service is not even on the list, but companies should worry about such brute-force tactics, says Ryan Barnett, a senior security researchers with security firm Trustwave’s SpiderLabs, who manages the WHID project. “You need to re-prioritize because Web servers are actively being targeted with denial-of-service attacks,” says Barnett.

Simple tools like Slowloris can give even the most robust web sites a big headache. Of course you also have to make sure you are secured against SQL Injection and any other kind of web attacks that can comprise your up-time or data.

According to the data different industries need to be prepared for different kinds of attacks, obviously skilled attackers will focus different ways of compromising hosts in different sectors.


Yet, different industries should also worry about different types of attacks, he says. Attackers focus on stealing money from financial firms using stolen credentials, according to the WHID data. They also tend to focus on defacing government sites and stealing credit-card numbers from retailers, using SQL injection in both cases, according to the WHID. The latter two relationships are weaker, however: While those are the most popular goals for attackers, each only accounts for a bit more than a quarter of attacks against the particular vertical. Money is the goal in two-thirds of attacks against financials.

“The outcomes and attacks and weaknesses are different, so depending on what market you are in, we have a pool of attacks that worked,” says Barnett. “So CSOs should pick out examples in their market because those are most applicable to them.”

Attackers’ focus on downtime means that corporate CSOs need to make sure that they can handle Web-specific denial-of-service attacks. Many times such attack focus on flooding the Web servers, but low-and-slow attacks are becoming more popular and require a different defense.

“Many of these organizations foolishly think that the network security gear that they have to handle the lower level DOSing floods will take care of this and it won’t,” Barnett says. “The overall amount of traffic that you have to send to take down the Web server is a lot less, and it looks legitimate.”

Downtime has gotta be one of the worst types of attack, especially for e-tailers or online vendors. Yah theft of credentials is bad, but honestly – most of the time those attacks aren’t even disclosed and no-one knows about them.

And from what I’ve seen most companies seem to think sticking a mid-range firewall in front of whatever they are doing is the be all and end all of security – it’ll protect their applications, their data, their organisation…and so on.

How misguided they are.

Source: Network World


Posted in: General News, Network Hacking, Privacy

Tags: , , , , , , , , , , ,

Posted in: General News, Network Hacking, Privacy | Add a Comment
Recent in General News:
- Teen Accused Of Hacking School To Change Grades
- Google’s Chrome Apps – Are They Worth The Risk?
- Twitter Breach Leaks 250,000 User E-mails & Passwords

Related Posts:

Most Read in General News:
- Hacking Still Can’t Outdo Stupidity for Data Leaks - 125,465 views
- eEye Launches 0-Day Exploit Tracker - 85,862 views
- Seattle Computer Security Expert Turns Tables On The Police - 44,739 views


Ophcrack 3.3.1 & LiveCD – Free Rainbow Table Password Cracking Tool

Your website & network are Hackable


Ophcrack is a free Windows password cracker based on rainbow tables. It is a very efficient implementation of rainbow tables done by the inventors of the method. It comes with a Graphical User Interface and runs on multiple platforms. It works based on a time-memory trade-off using rainbow tables. This is a new variant of Hellman’s original trade-off, with better performance. It recovers 99.9% of alphanumeric passwords in seconds.

We mentioned it in our RainbowCrack and Rainbow Tables article, definitely one of the best free options for Rainbow Cracking.

Features

  • Runs on Windows, Linux/Unix, Mac OS X
  • Cracks LM and NTLM hashes.
  • Free tables available for Windows XP and Vista.
  • Brute-force module for simple passwords.
  • Audit mode and CSV export.
  • Real-time graphs to analyze the passwords.
  • LiveCD available to simplify the cracking.
  • Loads hashes from encrypted SAM recovered from a Windows partition, Vista included.
  • Free and open source software (GPL).

You can find the various tables they offer here (mostly free with some paid):

Ophcrack Rainbow Tables

And of course our own collection of Free Rainbow Tables and other software here.

You can download Ophcrack 3.3.1 here:

Windows – ophcrack-win32-installer-3.3.1.exe
Source – ophcrack-3.3.1.tar.bz2

Or download the LiveCD here:

To crack XP hashes – ophcrack-xp-livecd-2.3.1.iso
To crack Vista hashes – ophcrack-vista-livecd-2.3.1.iso

Or read more here.


Posted in: Hacking Tools, Password Cracking

Tags: , , , , , , , , , , , , ,

Posted in: Hacking Tools, Password Cracking | Add a Comment
Recent in Hacking Tools:
- PyExfil – Python Data Exfiltration Tools
- Netdiscover – Network Address Discovery Tool
- Kautilya – Human Interface Device Hacking Toolkit

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 2,000,422 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,509,573 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 691,774 views