Archive | August, 2012

1 Million Accounts Leaked From Banks, Government Agencies & Consultancy Firms

Your website & network are Hackable


Seems like some hactivists have been working hard, 1 million accounsts were leaked over the weekend from some pretty serious sources by the group Team GhostShell – who are affiliated with Anonymous.

It seems like these weren’t particularly complex or technically adept multi-layer attacks, they were carried out via the most common avenue – SQL Injection.

In saying that though, they did yield a massive amount of data with some of the leaked databases providing over 30,000 records.

Hacker collective Team GhostShell leaked a cache of more than one million user account records from 100 websites over the weekend.

The group, which is affiliated with hacktivists Anonymous, claimed they broke into databases maintained by banks, US government agencies and consultancy firms to leak passwords and documents. Some of the pinched data includes credit histories from banks among other files, many of which were lifted from content management systems. Some of the breached databases each contained more than 30,000 records.

An analysis of the hacks by security biz Imperva reveals that most of the breaches were pulled off using SQL injection attacks – simply tricking the servers into handing over a bit more information than they should. “Looking at the data dumps reveals the use of the tool SQLmap, one of two main SQL injection tools typically deployed by hackers,” the company’s researchers explained in a blog post.

It looks like they even used off the shelf software too, if you look at the dumps you can actually see some references to sqlmap – which is a pretty powerful tool.

You can check it out in the analysis by Imperva here:

Analyzing the Team GhostShell Attacks

It seems like all the apps attacked were PHP CMS type web applications, there’s no information if they were all using the same platform though.


Team GhostShell said the online leaks, which are part of its Project Hellfire campaign, were made in protest against banks and in revenge for the rounding up of hacktivists by cops and government agents.

The team said it worked with other hacking crews, MidasBank and OphiusLab, on the attacks – and claims to have accessed a Chinese technology vendor’s mainframe, a US stock exchange and the Department of Homeland Security. It plans to offer access to these compromised systems to hackers who have the chops to handle them.

In a statement, the group threatened to carry out further attacks, leak more sensitive data and generally unleash hell.

“All aboard the Smoke & Flames Train, Last stop, Hell,” Team GhostShell wrote. “Two more projects are still scheduled for this fall and winter. It’s only the beginning.”

Team GhostShell is lead by self-proclaimed black hat hacker DeadMellox.

The leaks are part of the Project Hellfire campaign and the collective claims it will be ongoing and more attacks will follow. You can check out the leader on Twitter here @DeadMellox.

You can see a list of all the leak files here and the manifesto by Team GhostShell – http://pastebin.com/BuabHTvr.

Source: The Register


Posted in: Database Hacking, Exploits/Vulnerabilities, Legal Issues

Tags: , , , , , , , , , , , , ,

Posted in: Database Hacking, Exploits/Vulnerabilities, Legal Issues | Add a Comment
Recent in Database Hacking:
- Onapsis Bizploit v1.50 – SAP Penetration Testing Framework
- OAT – Oracle Auditing Tools For Database Security
- ODAT (Oracle Database Attacking Tool) – Test Oracle Database Security

Related Posts:

Most Read in Database Hacking:
- Pangolin – Automatic SQL Injection Tool - 76,384 views
- bsqlbf 1.1 – Blind SQL Injection Tool - 54,386 views
- SQLBrute – SQL Injection Brute Force Tool - 40,921 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


XMPPloit – A Tool to Attack XMPP Connections

Your website & network are Hackable


XMPPloit is a command-line tool to attack XMPP connections, allowing the attacker to place a gateway between the client and the server and perform different attacks on the client stream.

The tool exploit implements vulnerabilities at the client & server side utilizing the XMPP protocol.

The main goal is that all the process is transparently for the user and never replace any certificate (like HTTPS attacks).

Features

  • Downgrade the authentication mechanism (can obtain the user credentials)
  • Force the client not to use an encrypted communication
  • Set filters for traffic manipulation

Filters that have been implemented in this version for Google Talk are:

  • Read all the the user’s account mails
  • Read and modify all the user’s account contacts (being or not in the roster).

You can download XMPPloit here:

XMPPloit.7z

Or read more here.


Posted in: Hacking Tools, Network Hacking

Tags: , , , , , , ,

Posted in: Hacking Tools, Network Hacking | Add a Comment
Recent in Hacking Tools:
- Unicorn – PowerShell Downgrade Attack
- Wfuzz – Web Application Brute Forcer
- wildpwn – UNIX Wildcard Attack Tool

Related Posts:

Most Read in Hacking Tools:
- Top 15 Security/Hacking Tools & Utilities - 1,977,819 views
- Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,419,041 views
- wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 678,775 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


Microsoft Patches Critical Security Vulnerabilities In Windows, Office, IE, Exchange & SQL Server

Your website & network are Hackable


Another huge raft of critical fixes has been pushed out by Microsoft across almost their entire range of products, including client and server side software and the Windows OS itself.

It’s been a while since I’ve seen such a huge variety of security issues in one update including 5 critical vulnerabilities.

If you are running a Microsoft oriented organization you better get your update testing rig on-line and get rolling ASAP.

Microsoft has fixed 26 vulnerabilities in its software products, including several considered critical, the company said on Tuesday in its monthly security patch report.

The security holes, described in five critical and four important bulletins, affect multiple products, including Windows, Internet Explorer, Exchange, SQL Server and Office. In the worst-case scenarios, exploits could give attackers control of affected systems.

The first critical bulletin, labeled MS12-060, involves Windows Common Controls vulnerabilities, which affect Office, SQL Server, other server products and developer tools.

There have been “limited, targeted attacks” to try to exploit this security hole, but no public proof-of-concept code has been made available to Microsoft’s knowledge, wrote Microsoft security official Yunsun Wee in a related blog post.

If a user visits a website that contains “specially crafted content” designed to exploit the vulnerability, attackers could execute code remotely on the affected machine. However, users would have to be tricked into visiting such a website. The malicious code can also be sent as an email attachment, but users would need to open the attachment for the attack to work.

Most of them don’t seem to be out in the wild as such, as in they don’t have confirmed publicly available exploits. There have been cases of targeting attacks using these exploits, so they would be very much considered 0-day attacks and are probably being traded or sold in the underground.

The Common Controls exploit would be mitigated against if you had trained your users well on the dangers of opening unknown attachments as it would come in the form of a malicious .rtf file – most likely via e-mail.


Affected products include all supported editions of Office 2003, Office 2007, Office 2010 (except x64-based editions), SQL Server 2000 Analysis Services, SQL Server 2000 (except Itanium-based editions), SQL Server 2005 (except Microsoft SQL Server 2005 Express Edition, but including Microsoft SQL Server 2005 Express Edition with Advanced Services), SQL Server 2008, SQL Server 2008 R2, Commerce Server 2002, Commerce Server 2007, Commerce Server 2009, Commerce Server 2009 R2, Microsoft Host Integration Server 2004 SP 1, Visual FoxPro 8.0, Visual FoxPro 9.0 and Visual Basic 6.0 Runtime.

Microsoft patched a Windows Common Control bug in April that “made everyone sit up and take notice” due to the broad scope of important products it touched, said Andrew Storms, director of security operations at enterprise security vendor nCircle.

“There is some good news this month: that the attack vector associated with the [Windows Common Control] patch is an RTF (rich text format) file, and the victim has to explicitly open the file to allow the exploit. If you can’t get this patch rolled out or mitigation applied quickly, you should remind users about the dangers of opening attachments from unknown persons,” he said via email.

The second critical bulletin, labeled MS12-052, concerns four issues with IE that aren’t known to be under “active attack.” If successfully exploited, a malicious hacker could execute code on the affected machine with the privileges of the current user. As with the previous hole, users would need to visit a malicious Web page to fall victim to the attack. This vulnerability is rated critical for IE 6, IE 7, IE 8 and IE 9 on Windows clients and moderate for those same IE versions on Windows servers.

The more serious vulnerability, which effects Internet Explorer – allow code execution. But from the research done, it seems like these are not being actively attacked.

It’s critical for all versions of IE, including the current version IE9.

Source: Network World


Posted in: Countermeasures, Exploits/Vulnerabilities, Windows Hacking

Tags: , , , , , , , , ,

Posted in: Countermeasures, Exploits/Vulnerabilities, Windows Hacking | Add a Comment
Recent in Countermeasures:
- Cuckoo Sandbox – Automated Malware Analysis System
- Fully Integrated Defense Operation (FIDO) – Automated Incident Response
- MISP – Malware Information Sharing Platform

Related Posts:

Most Read in Countermeasures:
- AJAX: Is your application secure enough? - 120,090 views
- Password Hasher Firefox Extension - 117,773 views
- NDR or Backscatter Spam – How Non Delivery Reports Become a Nuisance - 57,723 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


chapcrack – A tool for parsing and decrypting MS-CHAPv2 network handshakes.

Find your website's Achilles' Heel


chapcrack is a tool for parsing and decrypting MS-CHAPv2 network handshakes, it was announced recently at Defcon as we read over here – Marlinspike demos MS-CHAPv2 crack.

The process is as follows:

  1. Obtain a packet capture with an MS-CHAPv2 network handshake in it (PPTP VPN or WPA2 Enterprise handshake, for instance).
  2. Use chapcrack to parse relevant credentials from the handshake (chapcrack parse -i path/to/capture.cap).
  3. Submit the CloudCracker token to www.cloudcracker.com
  4. Get your results, and decrypt the packet capture (chapcrack decrypt -i path/to/capture.cap -o output.cap -n )

If you are interested in a much more in-depth, technical explanation – you can read more here:

Divide and Conquer: Cracking MS-CHAPv2 with a 100% success rate

Using this attack they have a 100% success rate of cracking DES hashes within 23~ hours.

You can download chapcrack here:

moxie0-chapcrack.zip

Or read more here.


Posted in: Cryptography, Exploits/Vulnerabilities, Hacking Tools

Tags: , , , , , , , , , , ,

Posted in: Cryptography, Exploits/Vulnerabilities, Hacking Tools | Add a Comment
Recent in Cryptography:
- PEiD – Detect PE Packers, Cryptors & Compilers
- DROWN Attack on TLS – Everything You Need To Know
- Dell Backdoor Root Cert – What You Need To Know

Related Posts:

Most Read in Cryptography:
- The World’s Fastest MD5 Cracker – BarsWF - 47,701 views
- Hackers Crack London Tube Oyster Card - 44,812 views
- WPA2 Vulnerability Discovered – “Hole 196” – A Flaw In GTK (Group Temporal Key) - 33,000 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95