Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

01 August 2006 | 14,063 views

SpikeSource Spike PHP Security Audit Tool

Check Your Web Security with Acunetix

Spike is an Open Source tool based on the popular RATS C based auditing tool implemented for PHP.

The tool Spike basically does static analysis of php code for security exploits, PHP5 and call-time pass-by-reference are currently required, but a PHP4 version is coming out this week.

This tool is especially welcomed by Darknet as there aren’t many static analysis tools out there that are free, and there are very few tools for auditing PHP code..which as we all known tends to be coded quite insecurely at times (just look at phpBB and PhpNUKE).

You can find the latest version here:

Spike PHP Audit Tool

Advertisements



31 July 2006 | 6,409 views

WordPress 2.0.4 Released – Fixes Security Issues

Just to let you all know, if you are using WordPress you can upgrade today.

The latest stable release of WordPress (Version 2.0.4) is available.

his release contains several important security fixes, so it’s highly recommended for all users. We’ve also rolled in a number of bug fixes (over 50!), so it’s a pretty solid release across the board.

Also fixes for the serious SQL vulnerabilities that led to several WordPress sites being hacked.

Upgrading is fairly simple, just overwrite your old files with the latest from the download. If you’d like more thorough instructions, the Codex is always the best spot.

Since this is a security release, if you have any friends with blogs make sure to remind them to upgrade and lend a hand if they’re not too savvy. We’re all in this together.

As we reported here at Darknet, there was some serious security issues in 2.0.3 and below so it’s recommended you upgrade immediately.


30 July 2006 | 5,923 views

Netscape.com HACKED With Cross Site Scripting (XSS) Vulnerability

Netscape.com has been hacked via a persistent Cross Site Scripting (XSS) vulnerability in their newly launched Digg-like news service.

It seems the attacker did report the flaw to them repeatedly but they didn’t heed and ignored it, so he performed the XSS all over the site.

eplawless stated the following:

It was me. I did it. C’est moi, etc. This was in response to my having reported the month and a half old vulnerability to Netscape over a week ago. They ignored me. I reported it again, multiple times; they continued to ignore. I posted a few stories on their site, which made it to the front page and were deleted. I made the decision, in response to the recent Rose/Calacanis debacle, to add a benign script to the site that everyone would see and recognize as a compromise of security because this vulnerability is serious and they were not taking it as such. They had this coming; this isn’t a juvenile prank, and is only marginally retaliation against Calacanis for being a twit. This is making sure their users don’t get hacked too.

The guy made use of a fairly simple XSS vulnerability to inject their own javascript code snippets into pages on the website, including the homepage. As of now, it has only been used to display javascript alerts with “comical” messages and to redirect visitors to Digg.com!

Luckily nothing malicious has been done and the users aren’t at risk, as far as we know anyhow..

You can see the screenshots of the hacked JavaScript alerts here:

Shot 1, Shot 2 & Shot 3

Source: F-Secure Blog


28 July 2006 | 6,531 views

BASE 1.2.6 Released (Basic Analysis & Security Engine)

We are happy to announce that the 1.2.6 (christine) release of the Basic Analysis and Security Engine (BASE) is available.

BASE is the Basic Analysis and Security Engine. It is based on the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the alerts coming from a SNORT IDS system.

I used to LOVE ACID, and I have to say BASE has taken it one step further, it’s a superb project.

A number of bugs have been fixed including some that affected IE and the setup system for BASE. A couple of interface tweaks have also been done to make it more user friendly.

The developers are currently looking for more people willing to test the BASE releases as they work on them. If you are interested, feel free to contact base@secureideas.net

The BASE team have also started coding the 2.x code base. If you have any ideas or feedback regarding that rewrite, please forward them to the BASE developers list which is a public mailing list.

You can download the new version of BASE at:

http://sourceforge.net/projects/secureideas


27 July 2006 | 17,161 views

Serious WordPress Vulnerability/Exploit Verion 2.0.3 and Below

Yes that means all versions including the current version and before, 2.0.4 has not yet been released at the current time.

An exploit has been discovered in the current release of WordPress, affecting WordPress 2.0.3 and below (including 1.5.x) that allows these subscribed users to cause some serious damage.

It’s recommended at present if you are using WordPress to disable the “Anyone can Register” option in your ‘Options’ tab.

It’s also advised you delete any unknown subscribers that haven’t commented or that you don’t know personally.

WordPress developers are aware of this flaw and hopefully it will be fixed in the 2.0.4 release which is imminent.

Leaving it open and letting people sign-up for guest accounts on your WordPress blog could lead to incredibly nasty stuff happening if anybody so desired. And trust me I am not exaggerating this. So don’t wait a second to disable this option and please relay the message.

WordPress dev team has been notified a while back and I dare hope they will soon start acting on it, if only by relaying a similar announcement through the official channel (as well as, of course, releasing a proper patch).

Source: Dr Dave


26 July 2006 | 12,159 views

HOPE Speak Steven Rombom (Rambam) Charged

It turns out yesterday one of the planned speakers at HOPE Number 6 was arrested on Saturday and is being charged by the FBI.

Security Fix obtained a copy of the complaint against “Steven Rambam” the private investigator arrested Saturday at the Hope Number Six hacker conference in New York City. The government document says Rambam is an alias, and that his real name is Steven Rombom, so that is how he’ll be referred to here henceforth.

The complaint, available here as a PDF, charges Rombom with obstruction of justice and with witness tampering, alleging that in April 2006 Rombom impersonated a federal investigator at the request of a client who had hired him to locate a government informant who was central to the client’s money-laundering indictment in 2003.

Seems like it’s not unjust though, he is getting what he deserves. He was taking things a little bit too far.

The government claims that in April Rombom located and visited the California home of the informant’s in-laws, and introduced himself as an FBI agent, flashing what the informant’s mother-in-law described as “a laminated card with an official government gold seal or badge.”

The complaint says “ROMBOM told [the mother-in-law] that he was investigating the [informant], and that her son-in-law was a very bad and dangerous person, and that there were many things about the [informant] that the in-laws probably didn’t know,” such as that the informant had been in jail many times. Rombom also told the mother-in-law that her daughter was in danger because of the informant and that he was afraid for the safety of their daughter, the government says.

1 less speaker for HOPE next time then I guess?

Source: Security Fix


25 July 2006 | 59,646 views

Hping 2 Fixed for Windows XP SP2 (Service Pack 2)

We are happy to announce that Hping 2 works with Windows XP again! Hping support on Windows was never that great.

Darknet is indeed a great fan of Hping! Glad to see it has overcome the Raw sockets problems Windows XP SP2 brought about.

hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn’t only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.

I’m guessing they used the Ethernet frames workaround that was implemented in nmap.

For those who might not know, hping 2 is a packet crafting tool created by Salvatore Sanfilippo and ported to Windows by Rob Turpin. The unix version is available at http://www.hping.org. When Microsoft removed raw socket support in SP2, hping and a number of other programs broke. This causes problems in situations where Windows is the only thing available.

Thankfully the developers decided to fix the problem. For this, we would like to thank Fyodor and the Nmap developers because they had already overcome the biggest hurdles and we were able to work with their code and make it work within Hping 2.

You can download the latest version here:

Hping2 for Windows


24 July 2006 | 7,490 views

IBM Accused of Hacking

This is actually a very important case depending on which way it goes.

It could become a landmark case in regards to liability for machines on your network, or actually any traffic originating from your IP range.

A boutique Washington, D.C.-based law firm is accusing IBM of hacking into its e-mail system and is seeking recourse.

The firm, Butera & Andrews, filed suit against IBM and is seeking unspecified damages and repayment of more than $61,000 that it paid to investigate the alleged break-in and repair its e-mail system, according to a copy of the suit, which was filed in April in U.S. District Court for the District of Columbia.

IBM of course wants to dismiss the case stating it’s not their liability.

IBM has since filed papers with the court seeking to dismiss the case, arguing that the law firm failed to state a legitimate claim. Butera & Andrews, meanwhile, have asked the court for limited discovery, allowing it to investigate the matter, which IBM opposes, according to recently filed court papers.

Butera & Andrews charge that an unnamed IBM employee at a Durham, N.C., hacked into its e-mail system. The individual allegedly broke into the system, gained full privileges and was able to download messages at will, according to the complaint.

The firm hired outside experts after it “became aware of facts which suggested that the e-mail server through which the firm operated had been compromised by unauthorized parties” in November 2005, according to the complaint.

It seems like an awful lot of attempts, but really can IBM be held liable? In a way I hope not as it could tide badly for everything if they are made responsible for the activity on all IP addresses registered to them.

The investigation turned up more than 42,000 attempts from over 80 different Internet protocol addresses owned by IBM to acces the Butera & Andrews e-mail system last year, the complaint said.

“Plaintiff cannot state a claim merely by alleging that certain events are ‘tied’ to IP addresses registered to IBM,” the Armonk, N.Y., IT giant said in a court filing on June 30. “Indeed, plaintiff’s argument would be akin to holding AOL liable for intentional misconduct any time an IP address registered to AOL.”

It’s an accurate comparison IMHO.

Source: News.com


21 July 2006 | 39,780 views

Freeware MAC Address Changer – Technitium v3.1

I saw a Freeware MAC Address Changing tool today which I thought I’d share with you all, as I used to use SMAC, a nice tool, until the guy started charging for it!

Hopefully this one won’t go the same way.

Technitium MAC Address Changer, which allows you to change Machine Access Control (MAC) Address of your Network Interface Card (NIC) irrespective to your NIC manufacturer or its driver.

It has a very simple user interface and provides ample information regarding each NIC in the machine. Every NIC has an MAC address hard coded in its circuit by its manufacturer. This hard coded MAC address is used by windows drivers to access Ethernet Networks (LAN). This tool can set a new MAC address to your NIC, bypassing the original hard coded MAC address.

Technitium MAC Address Changer v3.1 is a must tool in every security professionals tool box.

Technitium MAC Address Changer v3.1 is coded in Visual Basic 6.0.

There are some famous commercial tools available in the market for as much as US$19.99, but Technitium MAC Address Changer is available for FREE. (We don’t charge for just changing an registry value! Also knowing how this works doesn’t require extensive research as some commercial tool providers claim!)

You can download the MAC Address Changer here:

MAC Changer v3.1


18 July 2006 | 6,901 views

Vista more insecure than XP

Symantec has made a research and affirming to there research Windows Vista will be more insecure than Windows XP, because most of the new code is fresh, and the old code isn’t used anymore…

Microsoft has removed a large body of tried and tested code and replaced it with freshly written code, complete with new corner cases and defects,” the researchers wrote in the report, scheduled for publication Tuesday. “This may provide for a more stable networking stack in the long term, but stability will suffer in the short term.

Also by using new tehnologies, such as IPv6 and peer-to-peer protocol will be a part of the new insecurity thread:

“As these technologies see wider deployment, we expect IPv6 and the new peer-to-peer protocols to play an increasing role in the delivery of malicious payloads,” the Symantec paper said. “These features are critical to the success of Microsoft’s peer-to-peer initiative but are also the same features that attackers need to deliver malicious content.”

So it seems that besides the system requierments needed for Vista it’s even likely to be used because of the future insecurity issues…

Source: news.com.com