Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

21 July 2006 | 39,773 views

Freeware MAC Address Changer – Technitium v3.1

Cyber Raptors Hunting Your Data?

I saw a Freeware MAC Address Changing tool today which I thought I’d share with you all, as I used to use SMAC, a nice tool, until the guy started charging for it!

Hopefully this one won’t go the same way.

Technitium MAC Address Changer, which allows you to change Machine Access Control (MAC) Address of your Network Interface Card (NIC) irrespective to your NIC manufacturer or its driver.

It has a very simple user interface and provides ample information regarding each NIC in the machine. Every NIC has an MAC address hard coded in its circuit by its manufacturer. This hard coded MAC address is used by windows drivers to access Ethernet Networks (LAN). This tool can set a new MAC address to your NIC, bypassing the original hard coded MAC address.

Technitium MAC Address Changer v3.1 is a must tool in every security professionals tool box.

Technitium MAC Address Changer v3.1 is coded in Visual Basic 6.0.

There are some famous commercial tools available in the market for as much as US$19.99, but Technitium MAC Address Changer is available for FREE. (We don’t charge for just changing an registry value! Also knowing how this works doesn’t require extensive research as some commercial tool providers claim!)

You can download the MAC Address Changer here:

MAC Changer v3.1

Advertisements



18 July 2006 | 6,901 views

Vista more insecure than XP

Symantec has made a research and affirming to there research Windows Vista will be more insecure than Windows XP, because most of the new code is fresh, and the old code isn’t used anymore…

Microsoft has removed a large body of tried and tested code and replaced it with freshly written code, complete with new corner cases and defects,” the researchers wrote in the report, scheduled for publication Tuesday. “This may provide for a more stable networking stack in the long term, but stability will suffer in the short term.

Also by using new tehnologies, such as IPv6 and peer-to-peer protocol will be a part of the new insecurity thread:

“As these technologies see wider deployment, we expect IPv6 and the new peer-to-peer protocols to play an increasing role in the delivery of malicious payloads,” the Symantec paper said. “These features are critical to the success of Microsoft’s peer-to-peer initiative but are also the same features that attackers need to deliver malicious content.”

So it seems that besides the system requierments needed for Vista it’s even likely to be used because of the future insecurity issues…

Source: news.com.com


17 July 2006 | 5,361 views

CAPTCHA – Safer and better looking

CAPTCHA, acronym for “completely automated public Turing test to tell computers and humans apart” is used, most of the times at least, as an authentication mechanism. Not to prove your identity, but to do a much simpler job than that; to prove your a human.

With the bad guys always a step ahead (which is cool by me), older forms of CAPTCHA have become unsafe and easy to hack – very easy actually.

A few months ago, we saw a new implementation of this method, using cats instead of numbers. That’s a great idea. It’s much difficult for a bot and/or crawler to detect in 9 figures which ones are cats and which ones are not. However, things have taken another step forward.

Introducing, HOTCAPTCHA – literally

Proving your a human has *never* been easier – there are some really ‘bad’, to be gentle, photos there – and fun.

If the author manages to add more pictures to the database, it will be pretty secure.


16 July 2006 | 13,251 views

Play v2.71 Games on your v1.5 PSP

For those who haven’t noticed yet, today booster made a milestone in PSP history. Enabling firmware 2.71 emulation in DevHook 0.44.

Alot has been going on lately in the PSP scene and its great. With the release of the 2.5/.6 downgrader and full iso and game emulation in DevHook.

Download here. Credit goes to booster for this release !!…


14 July 2006 | 15,376 views

Linux Kernel 2.6.x PRCTL Core Dump Handling – Local r00t Exploit ( BID 18874 / CVE-2006-2451 )

A working version of the exploit used to escalate privileges to root in the recent Debian breakin, ah another root kernel exploit.

It’s to do with the way the kernel handles file permissions (or lack of) on core dumps.

Linux kernel is prone to a local privilege-escalation vulnerability.

A local attacker may gain elevated privileges by creating a coredump file in a directory that they do not have write access to.

A successful attack may result in a complete compromise.

Linux kernel versions prior to 2.6.17.4 are vulnerable.

/*****************************************************/
/* Local r00t Exploit for: */
/* Linux Kernel PRCTL Core Dump Handling */
/* ( BID 18874 / CVE-2006-2451 ) */
/* Kernel 2.6.x (>= 2.6.13 && < 2.6.17.4) */
/* By: */
/* - dreyer (main PoC code) */
/* - RoMaNSoFt (local root code) */
/* [ 10.Jul.2006 ] */
/*****************************************************/

#include stdio.h
#include sys/time.h
#include sys/resource.h
#include unistd.h
#include linux/prctl.h
#include stdlib.h
#include sys/types.h
#include signal.h

You can download it here:

Linux Kernel 2.6.x PRCTL Core Dump Handling Exploit


13 July 2006 | 5,753 views

Debian Development Machine ‘gluck’ Hacked!

Ah, I wonder what happened?

I’ve always been a great fan of Debian, all the way back into the early days of woody and backporting apt packages.

What a name too, gluck to me usually means g’luck or good luck ;)

Early this morning we discovered that someone had managed to compromise gluck.debian.org. We’ve taken the machine offline and are preparing to reinstall it. This means the following debian.org services are currently offline:

cvs, ddtp, lintian, people, popcon, planet, ports, release

Based on the results of our initial investigation we’ve locked down most other debian.org machines, limiting access to DSA only, until they can be fixed for what we suspect is the exploit used to compromise gluck.

We’re still investigating exactly what happened and the extent of the damage. We’ll post more info as soon as we reasonably can.

I wonder if it’s a 0-day for one of the services? I doubt it’s bad configuration?

If it’s 2.6 kernel though…I’ve noticed it’s pretty badly coded, but most of those exploits are local…they had to get in remotely somehow.

As a dev machine though it is possible a local user used a kernel exploit.

It could be speculated that it’s the Linux Kernel PRCTL Core Dump Handling Privilege Escalation Vulnerability.


12 July 2006 | 3,920 views

Consultant Breached FBI’s Computers

Using standard script kiddy tools a consultant managed to compromise some of the FBI’s computers containing confidential information.

Quite a hack eh?

A government consultant, using computer programs easily found on the Internet, managed to crack the FBI’s classified computer system and gain the passwords of 38,000 employees, including that of FBI Director Robert S. Mueller III.

The break-ins, which occurred four times in 2004, gave the consultant access to records in the Witness Protection Program and details on counterespionage activity, according to documents filed in U.S. District Court in Washington. As a direct result, the bureau said it was forced to temporarily shut down its network and commit thousands of man-hours and millions of dollars to ensure no sensitive information was lost or misused.

The consultant Joseph Thomas Colon was approved (although he does have a somewhat unfortunate surname).

The incident is only the latest in a long string of foul-ups, delays and embarrassments that have plagued the FBI as it tries to update its computer systems to better share tips and information. Its computer technology is frequently identified as one of the key obstacles to the bureau’s attempt to sharpen its focus on intelligence and terrorism.

As usual with the government, no specifics are available..It seems like he got a hold of the SAM file or the shadow file from one of the systems then brute forced the hashes with john the ripper or something similar.

According to Colon’s plea, he entered the system using the identity of an FBI special agent and used two computer hacking programs found on the Internet to get into one of the nation’s most secret databases.

Colon used a program downloaded from the Internet to extract “hashes” — user names, encrypted passwords and other information — from the FBI’s database. Then he used another program to “crack” the passwords by using dictionary-word comparisons, lists of common passwords and character substitutions to figure out the plain-text passwords. Both programs are widely available for free on the Internet.

The new names they are coming up with for this stuff is straight out of the matrix.

The FBI’s Trilogy program cost more than $535 million but failed to produce a usable case-management system for agents because of cost overruns and technical problems, according to the Government Accountability Office.

While Trilogy led to successful hardware upgrades and thousands of new PCs for bureau workers and agents, the final phase — a software system called the Virtual Case File — was abandoned last year. The FBI announced in March that it would spend an additional $425 million in an attempt to finish the job. The new system would be called “Sentinel.”

Hopefully they will do it right this time.

Source: Washington Post


11 July 2006 | 4,819 views

Ticketcharge.com.my website hacked

Ticketcharge.com.my, a Malaysian website that sells event tickets online appears to have been hacked. Forgot to take a screenshot of it but this screenshot from google cache taken today can be seen below. This happened over the weekend or perhaps earlier.

ticketcharge.com.my

Google cache here . This will be gone when google re-cache the site again.

Original Site:

ticket.com.my original site


11 July 2006 | 16,067 views

HoneyBot – A Windows Based Honeypot

HoneyBOT

HoneyBOT is a Windows based medium interaction honeypot solution.

What is a Honeypot?

A honeypot is a device placed on a computer network specifically designed to capture malicious network traffic. The logging capability of a honeypot is far greater than any other network security tool and captures raw packet level data even including the keystrokes and mistakes made by hackers. The captured information is highly valuable as it contains only malicious traffic with little to no false positives.

Honeypots are becoming one of the leading security tools used to monitor the latest tricks and exploits of hackers by recording their every move so that the security community can more quickly respond to new exploits.

How it Works

HoneyBOT works by opening over 1000 udp and tcp listening sockets on your computer and these sockets are designed to mimic vulnerable services. When an attacker connects to these services they are fooled into thinking they are attacking a real server. The honeypot safely captures all communications with the attacker and logs these results for future analysis. Should an attacker attempt an exploit or upload a rootkit or trojan to the server the honeypot environment will safely store these files on your computer for analysis and submission to antivirus vendors. Our test server has captured several thousand trojans and rootkits from these simulated services including:

  • Dabber
  • Devil
  • Kuang
  • MyDoom
  • Netbus
  • Sasser
  • LSASS
  • DCOM (msblast, etc)
  • Lithium
  • Sub7

HoneyBOT Installation

We suggest that you install HoneyBOT on a dedicated computer with no valuable information or resources required of it. In fact, you want your honeypot to be as free as possible from any legitimate traffic so in broad terms we can consider any traffic to the honeypot to be malicious in nature.

HoneyBOT requires minimum operating system of Windows 2000 and at least 128MB RAM is recommended.

You can read more here:

Honeybot


10 July 2006 | 4,566 views

Next Up – Hacking Nuclear Powerstations!

Now this is a scary though, with the digitisation of the old analogue power stations and the accidental cross-over of networks (as we’ve seen before) people could soon be hacking nuclear power station control systems..

he nuclear power industry is going digital — replacing mechanical systems with more efficient, networked computer-controls.

If that makes you nervous in a season-four-of-24 kinda way, you’re not alone. Last week, the US Nuclear Regulatory Commission voted unanimously to add cyber security requirements to federal regulations governing nuclear power plant security.

Scary eh? Something straight out of a sci-fi movie.

The main concern is that the next generation of digital “instrumentation and control”, or I&C, systems could all-too-easily wind up linked to company business networks, and, through them, the internet — all but guaranteeing they’d be hacked.

The risk was illustrated in 2003, when the Slammer worm penetrated a network at the idled Davis-Besse nuclear plant in Ohio, disabling a safety monitoring computer for nearly five hours. The worm snuck in through the energy company’s corporate network, over an unmonitored connection from a contractor’s private LAN.

I think the whole world should be pretty nervous, don’t you?

At an NRC security briefing last March, commissioner (and Los Alamos veteran) Peter Lyons commented he was “very, very nervous” about such interconnections. The exchange that follows shows how nervous nuclear-types are about sounding nervous. From the transcript [PDF]

Oh dear..

Source: Wired Blog