Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

29 August 2006 | 12,281 views

Link & Comment Spamming – A possible solution.

Check Your Web Security with Acunetix

Recently one of the sites I am developing for my self was link spammed. Some unpleasant individual decided that it would be fun to post 160 ‘comments’ spread over all the blog posts. All the comments contained was URL’s. Even more stupid they used BB tags, but as I wrote the site it doesn’t use them.

Any way, obviously this isn’t some thing I want, so I deleted them all with a quick bit of SQL. No one else has posted a comment to the site because like I said, its still under development.

However, it happened once so there is no reason to think it wont happen again. I thought about the problem for a while, and the only solution is to incorporate some kind of humanity check. Because lets face it, its not like some one sat there and entered them all in. Its was some kind of bot.

Now, I don’t really like the ones that ask you to type the letters from some hard to read image. I can do that, no problem but they look ugly, and if the user was colour blind, or any other sight related issue, then you buggered.

So, I have come up with a different solution. The idea is to ask a random question, some thing that’s so easy any every one will know the answer, but unless you can read, you wont know what the answer is.

While I was busy implementing this solution, and believe me it didn’t take very long, another 20 comments of a very similar nature where posted. How annoying is that?

The solution seems to work for now. There have been no more comments since I completed the changes, but then maybe its only time until the bot gets adjusted, time will tell. But I thought other might benefit from having it so here goes, how to add random questions to your site.

Oh, one thing, I am not going to list my questions here, for a start it took me a shockingly long time to think of 30 really really easy questions, and I also don’t want to give a list of the question text and answers away.

So – on with the show. First off you will need 2 tables, one for the questions and one to keep track of what questions you have asked each user.

The questions table is easy, 3 coloums. Question_id, question and answer. The question id is just a unique number, the question and answer are both varchar.

Then we have the table used to store the asked questions. This is even less complicated. All you need is 2 fields, one for the question that was asked ID, and one to store the users Session ID.

So far, that’s all easy enough. You fill in the question table with as many questions as you can think of, along the lines of “is the sky blue” with an answer of “yes” or perhaps “What is 25 + 30″ answer, obviously “55”.

Of course you can create the tables and this isn’t going to do a hell of a lot. So, you’ll need a class to deal with it all. This is a copy of the code, though you will notice the use of the functions “performQuery” and “fetchRow”, these are from my own DB layer. They replace the standard MySQL commands by using a wrapper. It makes it easy to port code from one RDBMS to the other. I personally like this solution because its light weight and simple. But it’s a bit beyond the scope of this post.

So, the class? Its got 2 methods: getQuestion and getAnswer. They both take the a single parameter of ‘sid’. This is the session id, but for compatibility it is passed in to the function so it can basically be any thing.

How do you use it? Well, when your page displays the form you make a call to getQuestion and display it. For a while I thought about putting the question ID into the page, but only for a couple of seconds as I realised any half decent attempt to beat the system would just replace the ID with one with a known answer, infact as I suspect that the form is not used, simple data “posted” to the page, then it wouldn’t even matter.

That’s why we keep that information in the database.

Any way, once the form is submitted you then ask the class to get the answer for the current session, and compare what the user entered to the correct answer. I’d suggest forcing lower case, or upper case if you want, but basically make the comparison case insensitive.

If the answers don’t match then the person is, well an idiot or a bot. If no answer is available, then some ones messed with the session, or never even used the form. Doesn’t matter which, either way its an error.

I don’t think I will bother to explain the code it self, its really not that complicated. I think maybe the only bit that might seem a bit strange is the sql used to select a question:

This simply selects a random record from the table, because its ordered by “rand”. This basically means that for each record in the table a random number is generated, and then the records are ordered by the value. Because we only want one question we use the limit to only select the first record, how ever because each time the records are selected they will be in a different order, each time you get a different record cool ha? :-)

I hope this proves to work over time. I’ll have to keep any eye on it. Just to see how it goes. If any one can see any thing wrong with it, well, let me know.

Digg This Article

Advertisements



27 August 2006 | 15,651 views

Sophos Offers Free Rootkit Detection Tool/Software

Ah, here at Darknet we have always been a fan of Sophos and the way they operate, a very efficient company and good to see good technical products still coming out of the UK!

Another good move by them, they have decided to offer a free rootkit detection tool called Sophos Anti-Rootkit..Yah I know, not a very imaginative name eh?

Called Sophos Anti-Rootkit, the software will detect and remove both known and unknown rootkits, and it will warn systems administrators if removing the software might harm operating system integrity.

Rootkits are a collection of tools used by hackers to gain administrative privileges on compromised machines. They are typically used to help hide other forms of malware — keyloggers or Trojan horse programs, for example — from antivirus software.

Rootkits got a LOT of press after the whole Sony rootkit fiasco, so it’s good to see a decent free tool being offered to the general public.

Sophos Anti-Rootkit works with the Windows NT, 2000, XP and Windows Server 2003 operating systems. The software features a graphical interface to help guide users through the process of detecting and removing the malicious software.

Since the Sony fiasco, the security industry has paid more attention to the rootkit problem, and there are now a number of free utilities designed to identify this type of software. Other tools include RootkitRevealer, GMER and IceSword.

We shall try out as soon as possible, after all we’ve had chkrootkit on *nix forever…about time someone did something similar for Windows.

You can download Sophos Anti-Rootkit here.

Source: ComputerWorld


25 August 2006 | 121,281 views

Anonymous Connections Over the Internet – Using Socks Chains Proxy Proxies

Introduction

This tutorial is an attempt to help you re-route all internet winsock applications in ms windows trough a socks chain, thus making your connections much more anonymous.

Theory

The more different hops you make your data jump, the more difficult it will be to trace it back. take this route for example:

you –> socks1 –> socks2 –> socks3 –> … –> socksx –> target

People who want to trace you will have to contact x persons to ask their them for their logs. chances are one of them didn’t log… and if they logged, the ip seen by each host/socks is the ip of the previous host/socks in the chain.

This works for:

  • icq-like tools
  • ftp clients
  • mail clients
  • telnet clients
  • portscanners
  • (just about anything that uses the internet)

It doesn’t work on most irc servers since they often check for open wingates
and proxies.

Now let’s do it

1) First you need to find some boxes running wingate, we look for wingates since the default installation of wingate includes a non-logging socks server on port 1080

Visit http://www.samair.ru/proxy/socks.htm or http://www.proxyleecher.com/socks.php for some wide-known wingate ips, or even better: you could try to find some yourself.

To do this, i would suggest you use ‘proxy hunter’, available for download at http://www.proxys4all.com/tools.shtml be sure to look for wingates (port 23) and not for socks, as we only want wingate socks.

You could also use wingatescan, available for download at http://packetstormsecurity.org/wingate-scanner/

Speed is very important since we will be using multiple socks, and we don’t want our programs to time out. with the klever dipstick tool, you can find out which are the fastest ones. (get the klever dipstick program at http://klever.net/kin/static/dipstick.exe)

Just fire off Dipstick. Rightclick in the small green rectangular and choose Show main window. To import a list of wingates, just click on Advanced, choose Import List and select your file.

You can also manually ping a simple host by clicking on Manual Ping. Use those wingates with the smallest average time. *duh*

2) Second, check if the wingates from the list are actually running :)

There are a lot of programs that can help you with this.

3) Third, install a program that will intercept all outgoing networking calls.

I use the great tool sockscap for this purpose. you can get it at http://www.socks.permeo.com/Download/SocksCapDownload/index.asp

In the setting, enter this as socks server : 127.0.0.1 port 8000. Click on ‘socks version 5′. click ‘resolve all names remotely’. Uncheck ‘supported authentication’.

In the main window, choose new and then browse to create a shortcut for the internet client you want to give socks support.

Repeat this step for every program you want.

4) Install SocksChain

Download it at http://www.ufasoft.com/socks

In the service menu, click on new. enter ‘Chain’ as name and ‘8000’ as port to accept connections on.

Click on new and fill in the ips of the fastest wingates you found, but this time, use port 1080 for this (and not the port 23)

Using the ‘<' and '>‘, you can add and remove socks. be sure to test all socks one by one before adding them all to the list in once, because if one of them is bad, you chain will not work and you will not be able to locate the bad socks in the chain.

If all of them seem to work, you use the ‘<' key to add them all (mind speed problems. 4 or less is fine. i think 10 or 13 is the limit put by tcp/ip)

Testing your anonymous setup

To check what socks your computer is connecting to, you can use x-ploiters totostat (http://tucows.mundofree.com/preview/7534.html). look for connections to port 1080, the remote ip found there should be the first ip found in your chain in sockschain.

use the shortcut in sockscap that points to your browser, and connect to http://cavency.virtualave.net/cgi-bin/env.cgi or
http://www.junkbuster.com/cgi-bin/show_http_headers

Use your shortcut in sockcap to start your telnet client then telnet to ukanaix.cc.ukans.edu

In all the above cases, the remote server should show you the ip of the last server in the sockschain. if you look at the sockschain program while surfing you should see the chain being built up.

Some final remarks

Never use internet explorer to do tricky stuff as it might reveal your ip. my personal favorite browser is opera 4.0 (http://www.opera.com/), Darknet recommends Firefox.


To avoid info being sent out, we could install another proxy between the sockscap and the sockschainer proxy that would filter out those things. A4proxy is an example of a proxy capable of doing such things or Proximitron which Darknet uses.

Remember, if you want to do the real stuff, better switch to Linux like Ubuntu.

Written by Zoa_chien – EFNet – Updated with current info, lists and URL’s by Darknet.

Digg This Article


23 August 2006 | 4,675 views

libtiff Vulnerability gives hope for a new GTA-less PSP exploit

QJ.net forums have been abuzz lately with the talk of a possible new exploit centered around a libtiff vulnerability. NOPx86 stating that he’d managed to crash the PSP using this method. As those of you who follow these things know, a crash doesn’t always mean an open door to an exploit.

But after a cumulative 60 hours of work and research put in by Skylark and psp250 (with a little help from Fanjita), they can confirm that NOPx86’s method is indeed valid and opens the door for a new exploit. They have confirmed that it will work on 2.0 and 2.01 PSP’s, and could potentially work on firmware as high as 2.80 – although at this moment, this is unconfirmed.

But even if this only works on lower firmwares, it will usher in the age of GTA-less homebrew for 2.01+ PSP’s, which will be a welcome change for homebrew enthusiasts.

Work and research on applying this exploit into a publicly usable form will take some time, and it will take even more time to put this to use on PSP’s with higher firmware, but there definitely are possibilities. As always, we’ll keep you up to date on this developing story as soon as more information becomes available.


17 August 2006 | 4,859 views

Bot Herders Go After MS06-40 Exploit

Malware herders are speeding up, the first wave is already here for MS06-40.

It’s basically a variant of some old malware suited to the new vulnerability. Same old story then, same packer, technique, new exploit.

Same as the days of autorooters.

It’s basically the Mocbot trojan that was used in the Zotob worm attack in August 2005.

The first wave of malicious attacks against the MS06-040 vulnerability is underway, using malware that hijacks unpatched Windows machines for use in IRC-controlled botnets.

The attacks, which started late Aug. 12, use a variant of a backdoor Trojan that installs itself on a system, modifies security settings, connects to a remote IRC (Internet Relay Chat) server and starts listening for commands from a remote hacker, according to early warnings from anti-virus vendors.

I hope the AV first are on top of things, people are patching their machines in a timely fashion (especially in corporate environments – come on people, get SUS!) and awareness is going up.

“Amazingly, this new variant of Mocbot still uses the same IRC server hostnames as a command-and-control mechanism after all these months. This may be partially due to the low-profile it has held, but also may be due to the fact that the hostnames and IP addresses associated with the command-and-control servers are almost all located in China,” LURHQ said in an advisory.

Historically, Chinese ISPs and government entities have been less than cooperative in taking action against malware hosted and controlled from within their networks, the company said.

On Aug. 13, a second variant of the Trojan was detected, confirming fears that botnet herders are already playing cat-and-mouse with anti-virus vendors.

Quite surprising in a way, but also not really as it’s China and they are notoriously un co-operative.

Source: Eweek


14 August 2006 | 4,213 views

OpenOffice.org Security ‘Insufficient’

It seems people are turning some attention towards the security of Open Office finally, I for one say this is a good thing as it means it’s making inroads, it’s becoming popular, it’s getting to be a contender.

If people are seriously considering the security implications of using Open Office it means they are actually really interested in using it.

With Microsoft Corp.’s Office suite now being targeted by hackers, researchers at the French Ministry of Defense say users of the OpenOffice.org software may be at even greater risk from computer viruses.

“The general security of OpenOffice is insufficient,” the researchers wrote in a paper entitled “In-depth analysis of the viral threats with OpenOffice.org documents.”

“This suite is up to now still vulnerable to many potential malware attacks,” they wrote.

The paper describes four proof-of-concept viruses that illustrate how maliciously encoded macros and templates could be created to compromise systems running the open-source software. “The viral hazard attached to OpenOffice.org is at least as high as that for the Microsoft Office suite, and even higher when considering some … aspects,” they wrote.

This is an interesting paper, I’m glad someone did take a rather more in-depth look at the flaws in the Open Office suite.

At least they patch the flaws almost instantly.

A number of the problems described in the report have to do with the basic design of the software. For example, OpenOffice.org does not perform adequate security checks on the software it runs, the researcher said. And because of the extreme flexibility of the free office suite, there are many ways for writers to create malicious macros, the researchers found.

The OpenOffice.org team has already fixed a software bug discovered by the French researchers, and the two groups are in discussions about how to improve the overall security of the software, said Louis Suarez-Potts, an OpenOffice.org community manager.

“The one real flaw in the programming logic has been fixed,” Suarez-Potts said. “The others are theoretical.”

I’d be interested to see some more focus on OpenOffice.Org and it’s security architecture, and of course following this to see all the flaws fixed to make it a strong contender.

Source: InfoWorld


13 August 2006 | 4,396 views

Microsoft Takes an Effort at Cutting Down Blogspam – Splogs

Splogs are becoming a huge problem, half the stuff you search for nowadays returns a splog, mostly auto syndicated content.

I find a lot of my own entries on there, surrounded by Adsense ads.

New age scrapers I guess.

Technorati returns a lot of results from splogs too, but at least they have made some efforts to clean that up and Google and being making sign-ups for blogspot much stricter so people are having to resort to their own domains, like the scrapers.

Microsoft today released new research on the epidemic of spam blogs — or “splogs” — as well as the “comment spam” that dodgy marketers splatter all over blogs in a bid to improve their sites’ search-engine rankings. Redmond’s research team found that splogs hosted on Google’s Blogspot.com appear to be widely spammed and fairly effective at jacking up the search results for the spammers’ Web sites.

Comment spam is also getting pretty bad, I can get a couple of hundred a day on some sites.

I’m glad they are making some kind of effort to sort it out.

Yi-Min Wang, manager of Microsoft’s cybersecurity and systems management research group, told me that the goal of Search Defender is to help the software giant automate the filtering of splogs and comment spam links in search results returned on MSN.com.

“We now have a method to identify spammers so that before they get indexed into search results, we can block them,” Wang said. “When this is fully automated, the spammers will need to spend a lot more effort trying to get into our search results.”

We ourselves as writers also have to take measures to curb the comment spam, I use Akismet and find it extremely effective!

But that’s just a start: Sitepoint has some excellent tips on fighting comment spam. Also, most of the major blogging sites now include pointers on how to use antispam features. Blogger.com lets users require commenters to follow a verification process — essentially a captcha — to help weed out automated processes. WordPress has its own tips here, or users can outsource their blogspam patrol (well, sort of) with Akismet, a free (for personal use) tool that compares any link, trackback or comment left on your WordPress blog to a service “which runs hundreds of tests on the comment and returns a thumbs up or thumbs down.” SixApart, which runs TypePad and LiveJournal, also lists a number of tips for users fed up with blogspam.

At least everyone is aware of it now, we just need to get back to fighting it.

Source: Washington Post


12 August 2006 | 9,167 views

TCPReplay suite 3.0.beta10. Released

Another good tool updated! TCPReplay suite 3.0.beta10 has been released.

For those that don’t know Tcpreplay is a suite of BSD licensed tools written by Aaron Turner for *NIX operating systems which gives you the ability to use previously captured traffic in libpcap format to test a variety of network devices. It allows you to classify traffic as client or server, rewrite Layer 2, 3 and 4 headers and finally replay the traffic back onto the network and through other devices such as switches, routers, firewalls, NIDS and IPS’s. Tcpreplay supports both single and dual NIC modes for testing both sniffing and inline devices.

Tcpreplay is used by numerous firewall, IDS, IPS and other networking vendors, enterprises, universities, labs and open source projects.

Beta10 contains a number of major enhancements as the code continues to stabilize for the 3.0 stable release. The big changes include removing Libnet as a requirement, tcpprep and tcprewrite no longer requiring root access and improved packet timings for tcpreplay. There are also a number of smaller enhancements and bug fixes.

Also a lot of time has been spent updating the online manual on the wiki which covers most if not all the features of tcpreplay, tcpprep and tcprewrite.

This should be the final beta release and it’s expected to have the first release candidate in a month or so. Please download and test!

You can download it here:

TCPReplay

The new Wikified manual is here.

Download: http://prdownloads.sourceforge.net/tcpreplay/tcpreplay-3.0.beta10.tar.gz?download


10 August 2006 | 4,552 views

OWASP – Fortify Bug Taxonomy

Ah at last a good solid collaborative effort to identify and categorise software vulnerabilities with a solid taxonomy and good organisation!

It seems very well written too in terms that anyone familiar with software development or programming can understand.

Fortify Software, which identifies and remediates software vulnerabilities, has contributed its collection of 115 types of software security errors to the Open Web Application Security Project (OWASP), a six-year old non-profit with almost 5,000 members whose “mission is to find and fight the causes of insecure software.”

The work will become part of OWASP’s Honeycomb Project.

This is a very good thing.

The OWASP Honeycomb project.

In the Honeycomb project, OWASP is assembling the most comprehensive and integrated guide ever attempted to the fundamental building blocks of application security (principles, threats, attacks, vulnerabilities, and countermeasures) through collaborative community efforts.

You can find the taxonomy itself here:

The Fortify Taxonomy of Software Security Errors

This site presents a taxonomy of software security errors developed by the Fortify Software Security Research Group together with Dr. Gary McGraw. Each vulnerability category is accompanied by a detailed description of the issue with references to original sources, and code excerpts, where applicable, to better illustrate the problem.

Source: Zdnet Blog


08 August 2006 | 5,069 views

Cyberwar Efforts Step-Up – NASA Sites Hacked

Ah cyberwar, cyber terrorism, efforts are ramping up, more sites are going down.

The war in Lebanon is now showing its consequences in the digital world and a huge number of websites has been attacked and defaced as a protest against the invasion of Lebanon by Israel.

Today two NASA websites were attacked as well. The intrusion was carried out by the Chilean group of crackers known as Byond Hackers Crew through a leak in the SQL Injection they entered the system and subtracted user names, passwords and e-mails from the NASA web server.

Seems like a pretty straight forward attack..but a high profile government site being prone to SQL injection that allow admin escalation?

That’s pretty bad..

After that these information had been stolen, they managed in entering the administrative area by using an administrator user ID and password , and finally they made the defacement replacing the homepage with their message.

This group goes with the others that in last days carried out attacks against governmental and commercial websites both from America and Israel, whereas other blackhat groups attacked Israeli websites provoking a denial of service (DDoS) of that particular webpage.

Let’s hope things don’t boil over to attacking powerstations or anything that will cause collateral damage.

Source: Zone-H