Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

28 July 2006 | 6,523 views

BASE 1.2.6 Released (Basic Analysis & Security Engine)

Don't let a Dragon into your website!

We are happy to announce that the 1.2.6 (christine) release of the Basic Analysis and Security Engine (BASE) is available.

BASE is the Basic Analysis and Security Engine. It is based on the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the alerts coming from a SNORT IDS system.

I used to LOVE ACID, and I have to say BASE has taken it one step further, it’s a superb project.

A number of bugs have been fixed including some that affected IE and the setup system for BASE. A couple of interface tweaks have also been done to make it more user friendly.

The developers are currently looking for more people willing to test the BASE releases as they work on them. If you are interested, feel free to contact base@secureideas.net

The BASE team have also started coding the 2.x code base. If you have any ideas or feedback regarding that rewrite, please forward them to the BASE developers list which is a public mailing list.

You can download the new version of BASE at:

http://sourceforge.net/projects/secureideas

Advertisements



27 July 2006 | 17,151 views

Serious WordPress Vulnerability/Exploit Verion 2.0.3 and Below

Yes that means all versions including the current version and before, 2.0.4 has not yet been released at the current time.

An exploit has been discovered in the current release of WordPress, affecting WordPress 2.0.3 and below (including 1.5.x) that allows these subscribed users to cause some serious damage.

It’s recommended at present if you are using WordPress to disable the “Anyone can Register” option in your ‘Options’ tab.

It’s also advised you delete any unknown subscribers that haven’t commented or that you don’t know personally.

WordPress developers are aware of this flaw and hopefully it will be fixed in the 2.0.4 release which is imminent.

Leaving it open and letting people sign-up for guest accounts on your WordPress blog could lead to incredibly nasty stuff happening if anybody so desired. And trust me I am not exaggerating this. So don’t wait a second to disable this option and please relay the message.

WordPress dev team has been notified a while back and I dare hope they will soon start acting on it, if only by relaying a similar announcement through the official channel (as well as, of course, releasing a proper patch).

Source: Dr Dave


26 July 2006 | 12,151 views

HOPE Speak Steven Rombom (Rambam) Charged

It turns out yesterday one of the planned speakers at HOPE Number 6 was arrested on Saturday and is being charged by the FBI.

Security Fix obtained a copy of the complaint against “Steven Rambam” the private investigator arrested Saturday at the Hope Number Six hacker conference in New York City. The government document says Rambam is an alias, and that his real name is Steven Rombom, so that is how he’ll be referred to here henceforth.

The complaint, available here as a PDF, charges Rombom with obstruction of justice and with witness tampering, alleging that in April 2006 Rombom impersonated a federal investigator at the request of a client who had hired him to locate a government informant who was central to the client’s money-laundering indictment in 2003.

Seems like it’s not unjust though, he is getting what he deserves. He was taking things a little bit too far.

The government claims that in April Rombom located and visited the California home of the informant’s in-laws, and introduced himself as an FBI agent, flashing what the informant’s mother-in-law described as “a laminated card with an official government gold seal or badge.”

The complaint says “ROMBOM told [the mother-in-law] that he was investigating the [informant], and that her son-in-law was a very bad and dangerous person, and that there were many things about the [informant] that the in-laws probably didn’t know,” such as that the informant had been in jail many times. Rombom also told the mother-in-law that her daughter was in danger because of the informant and that he was afraid for the safety of their daughter, the government says.

1 less speaker for HOPE next time then I guess?

Source: Security Fix


25 July 2006 | 59,426 views

Hping 2 Fixed for Windows XP SP2 (Service Pack 2)

We are happy to announce that Hping 2 works with Windows XP again! Hping support on Windows was never that great.

Darknet is indeed a great fan of Hping! Glad to see it has overcome the Raw sockets problems Windows XP SP2 brought about.

hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn’t only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.

I’m guessing they used the Ethernet frames workaround that was implemented in nmap.

For those who might not know, hping 2 is a packet crafting tool created by Salvatore Sanfilippo and ported to Windows by Rob Turpin. The unix version is available at http://www.hping.org. When Microsoft removed raw socket support in SP2, hping and a number of other programs broke. This causes problems in situations where Windows is the only thing available.

Thankfully the developers decided to fix the problem. For this, we would like to thank Fyodor and the Nmap developers because they had already overcome the biggest hurdles and we were able to work with their code and make it work within Hping 2.

You can download the latest version here:

Hping2 for Windows


24 July 2006 | 7,490 views

IBM Accused of Hacking

This is actually a very important case depending on which way it goes.

It could become a landmark case in regards to liability for machines on your network, or actually any traffic originating from your IP range.

A boutique Washington, D.C.-based law firm is accusing IBM of hacking into its e-mail system and is seeking recourse.

The firm, Butera & Andrews, filed suit against IBM and is seeking unspecified damages and repayment of more than $61,000 that it paid to investigate the alleged break-in and repair its e-mail system, according to a copy of the suit, which was filed in April in U.S. District Court for the District of Columbia.

IBM of course wants to dismiss the case stating it’s not their liability.

IBM has since filed papers with the court seeking to dismiss the case, arguing that the law firm failed to state a legitimate claim. Butera & Andrews, meanwhile, have asked the court for limited discovery, allowing it to investigate the matter, which IBM opposes, according to recently filed court papers.

Butera & Andrews charge that an unnamed IBM employee at a Durham, N.C., hacked into its e-mail system. The individual allegedly broke into the system, gained full privileges and was able to download messages at will, according to the complaint.

The firm hired outside experts after it “became aware of facts which suggested that the e-mail server through which the firm operated had been compromised by unauthorized parties” in November 2005, according to the complaint.

It seems like an awful lot of attempts, but really can IBM be held liable? In a way I hope not as it could tide badly for everything if they are made responsible for the activity on all IP addresses registered to them.

The investigation turned up more than 42,000 attempts from over 80 different Internet protocol addresses owned by IBM to acces the Butera & Andrews e-mail system last year, the complaint said.

“Plaintiff cannot state a claim merely by alleging that certain events are ‘tied’ to IP addresses registered to IBM,” the Armonk, N.Y., IT giant said in a court filing on June 30. “Indeed, plaintiff’s argument would be akin to holding AOL liable for intentional misconduct any time an IP address registered to AOL.”

It’s an accurate comparison IMHO.

Source: News.com


21 July 2006 | 39,772 views

Freeware MAC Address Changer – Technitium v3.1

I saw a Freeware MAC Address Changing tool today which I thought I’d share with you all, as I used to use SMAC, a nice tool, until the guy started charging for it!

Hopefully this one won’t go the same way.

Technitium MAC Address Changer, which allows you to change Machine Access Control (MAC) Address of your Network Interface Card (NIC) irrespective to your NIC manufacturer or its driver.

It has a very simple user interface and provides ample information regarding each NIC in the machine. Every NIC has an MAC address hard coded in its circuit by its manufacturer. This hard coded MAC address is used by windows drivers to access Ethernet Networks (LAN). This tool can set a new MAC address to your NIC, bypassing the original hard coded MAC address.

Technitium MAC Address Changer v3.1 is a must tool in every security professionals tool box.

Technitium MAC Address Changer v3.1 is coded in Visual Basic 6.0.

There are some famous commercial tools available in the market for as much as US$19.99, but Technitium MAC Address Changer is available for FREE. (We don’t charge for just changing an registry value! Also knowing how this works doesn’t require extensive research as some commercial tool providers claim!)

You can download the MAC Address Changer here:

MAC Changer v3.1


18 July 2006 | 6,900 views

Vista more insecure than XP

Symantec has made a research and affirming to there research Windows Vista will be more insecure than Windows XP, because most of the new code is fresh, and the old code isn’t used anymore…

Microsoft has removed a large body of tried and tested code and replaced it with freshly written code, complete with new corner cases and defects,” the researchers wrote in the report, scheduled for publication Tuesday. “This may provide for a more stable networking stack in the long term, but stability will suffer in the short term.

Also by using new tehnologies, such as IPv6 and peer-to-peer protocol will be a part of the new insecurity thread:

“As these technologies see wider deployment, we expect IPv6 and the new peer-to-peer protocols to play an increasing role in the delivery of malicious payloads,” the Symantec paper said. “These features are critical to the success of Microsoft’s peer-to-peer initiative but are also the same features that attackers need to deliver malicious content.”

So it seems that besides the system requierments needed for Vista it’s even likely to be used because of the future insecurity issues…

Source: news.com.com


17 July 2006 | 5,359 views

CAPTCHA – Safer and better looking

CAPTCHA, acronym for “completely automated public Turing test to tell computers and humans apart” is used, most of the times at least, as an authentication mechanism. Not to prove your identity, but to do a much simpler job than that; to prove your a human.

With the bad guys always a step ahead (which is cool by me), older forms of CAPTCHA have become unsafe and easy to hack – very easy actually.

A few months ago, we saw a new implementation of this method, using cats instead of numbers. That’s a great idea. It’s much difficult for a bot and/or crawler to detect in 9 figures which ones are cats and which ones are not. However, things have taken another step forward.

Introducing, HOTCAPTCHA – literally

Proving your a human has *never* been easier – there are some really ‘bad’, to be gentle, photos there – and fun.

If the author manages to add more pictures to the database, it will be pretty secure.


16 July 2006 | 13,251 views

Play v2.71 Games on your v1.5 PSP

For those who haven’t noticed yet, today booster made a milestone in PSP history. Enabling firmware 2.71 emulation in DevHook 0.44.

Alot has been going on lately in the PSP scene and its great. With the release of the 2.5/.6 downgrader and full iso and game emulation in DevHook.

Download here. Credit goes to booster for this release !!…


14 July 2006 | 15,375 views

Linux Kernel 2.6.x PRCTL Core Dump Handling – Local r00t Exploit ( BID 18874 / CVE-2006-2451 )

A working version of the exploit used to escalate privileges to root in the recent Debian breakin, ah another root kernel exploit.

It’s to do with the way the kernel handles file permissions (or lack of) on core dumps.

Linux kernel is prone to a local privilege-escalation vulnerability.

A local attacker may gain elevated privileges by creating a coredump file in a directory that they do not have write access to.

A successful attack may result in a complete compromise.

Linux kernel versions prior to 2.6.17.4 are vulnerable.

/*****************************************************/
/* Local r00t Exploit for: */
/* Linux Kernel PRCTL Core Dump Handling */
/* ( BID 18874 / CVE-2006-2451 ) */
/* Kernel 2.6.x (>= 2.6.13 && < 2.6.17.4) */
/* By: */
/* - dreyer (main PoC code) */
/* - RoMaNSoFt (local root code) */
/* [ 10.Jul.2006 ] */
/*****************************************************/

#include stdio.h
#include sys/time.h
#include sys/resource.h
#include unistd.h
#include linux/prctl.h
#include stdlib.h
#include sys/types.h
#include signal.h

You can download it here:

Linux Kernel 2.6.x PRCTL Core Dump Handling Exploit