Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

24 March 2006 | 7,143 views

Is Open Source Really More Secure?

Prevent Network Security Leaks with Acunetix

Is Open Source more secure? That’s a question that can be answered with both yes and no. Not only that, but the reasons for the “yes” and the “no” are fairly much the same. Because you can see the source the task of hacking or exploiting it is made easier, but at the same time because its open, and more easily exploited the problems are more likely to be found.

When it comes to open source the hackers and crackers are doing us a favour, they find the problems and bring them to the attention of the world, where some bright spark will make a fix and let us all have that to. All well and good.

However I think this could also be a problem, because lets face it. Any monkey can download “free” software to use for this or that, with little or no idea how it actually works. They don’t check for fixes and updates, often believing “it will never happen to me”. In part this is because they just don’t see any reason for some one to hack them. But in the modern world where any script kiddie little git can download a virus construction kit, or a bot to run exploits on lists of servers its no longer a case of being targeted. They don’t care who you are, it’s the box they are after.

Recently a friend of mine suffered from this very problem, he didn’t believe he was worth the effort to hack. But simply by using an Open source web app he unwittingly made him self a target. Though a fix was available, he wasn’t aware of it. It was only when the host contacted him about problems that he even realised he’d been exploited.

With the growing popularity of the internet and open source solutions more and more unskilled users are installing software they don’t even understand. Even worse as any one application grows in popularity it grows as a worth while target for the low life script kiddies out there.

The problem has been exacerbated but the simple truth that with modern scripting languages such as PHP it is getting easier and easier to make some thing, being able to hack code together until it works might be fun, and you might make some thing that does the job, but its not a way to make safe secure software.

Most often exploits are based on stupid mistakes, errors that should have been found early on but weren’t because the code evolved, expanded and changed. No design, no planning, just code it until it works. This is the original meaning of “hacking”.

Now, with out mentioning names, I have pulled apart the code used in the CMS the friend I mention earlier used, and with out doubt I can say its poorly written. But it was free, so no one can complain.

I am sure there is some very good open source applications, linux, apache to name a few, but there is even more “open source” that’s just garbage. Just because its free doesn’t mean its good. Just because it popular doesn’t make it better. In fact as far as I can tell, if you want to use open source applications your probably better of choosing one no one else has really bothered with, that why your less likely to become a victim.

Closed source always has the advantage of being a little harder to find the problems, how ever, and this is important. It doesn’t mean its any better. As a friend of mine pointed out, Open source might be easier to hack in some ways, but because of that the problems come to light and generally are fixed quickly. Where as with a closed source application its actually in the interests of the authors to keep any problems hidden, if its not a common problem it may even go unfixed, because the author sees is as being unlikely any one else will ever find it. Or a fix will be bundled up with a later version and thus many people will never even know they could be at risk.

In the end I do believe open source is good for us all, but its important to check regularly for updates, patches and fixes. If you don’t, on your own head be it.



23 March 2006 | 9,030 views

kArp – Linux Kernel Level ARP Hijacking/Spoofing Utility

Introduction

kArp is a linux patch that allows one to implement ARP hijacking in the kernel, but control it easily via userland. You may configure, enable and disable kArp via ProcFS or the sysctl mechanism.

kArp is implemented almost on the device driver level. Any ethernet driver (including 802.11 drivers) is supported. The kArp code is lower than the actual ARP code in the network stack, and thus will respond to ARP requests faster than a normal machine running a normal network stack, even if the machine we’re spoofing has a CPU twice as fast as ours!

Functionality

  • ARP Hijacking – Enabling ARP spoofing allows a user to spoof an ARP response to a specific victim host. Due to the low level at which the code exists, our spoofed packet is guaranteed to arrive at the victim’s network stack prior to the response of the machine we’ve impersonated.
  • ARP Hijacking the Impersonated – Enabling this function via arp_send_to_spoofed allows us to spoof the victim’s information to the impersonated machine as well, helping to solidify the MiM attack. However, this functionality may kill the speed of our spoofed frame to the victim, so it isn’t enabled by default.
  • ARP Flooding – Enabling this function via arp_flood causes the kernel to send a flood of random source and destination MAC addresses via a broken ARP frame. On some switches this will fill its internal MAC table, or overflow it. Often, the result of this attack is forcing the switch to fall back to dumb hub mode, allowing us to sniff the wire without a MiM attack.

Warning

kArp was written to beat the race in responding to an ARP Request from a target (victim) machine. It is *not* meant as an tool to flood a victim with ARP information. This means that some operating systems (MacOSX) that ingest unsolicited ARP responses may still obtain the actual MAC address of the machine we’re impersonating. Linux, however, only accepts the fastest response. If you want to flood a machine with fake ARP responses, use a userland tool.

For now, the URL is:

http://aversion.net/~north/karp/


22 March 2006 | 6,050 views

Why Windows Vista ‘might’ Actually be Good

The main thing is the massive kernel overhaul, it’s actually adding some decent functionality and refining the architecture to become more like Linux!

While the kernel in Vista is still primarily the same one as in Windows 2000 and XP, there have been some significant changes to tighten up security. Fewer parts of the OS as a whole run in Kernel mode – most drivers run in User mode, for instance. Things that run in Kernel mode are prevented from installing without verified security certificates, and even then they require administrator-level user permission. In Vista, it should be much more difficult for unauthorized programs (like Viruses and Trojans) to affect the core of the OS and secretly harm your system

Yay, finally, an actual secure version of Windows? It’s about time right. But well what stops malware bundling itself with a pirated valid cerficate, there must be some offline procedure for people without full-time net connections.

We’ll have to see what this protection really offers, and how we can get around it :)

Also some heap performance improvements with controls to deal with heap fragmentation for large memory calls.

Some pretty advanced application ‘buffering’ too, not sure if I like this one (hopefully it can be turned off).

A key improvement to the root file system and memory management of Vista is a technology called SuperFetch. SuperFetch learns which applications and bits and pieces of the OS you use most and preloads them into memory, so you don’t have to wait for a bunch of hard drive paging before your apps or documents load. Microsoft has developed a pretty sophisticated prioritization scheme that can even differentiate which applications you are most likely to use at different times (on the weekend vs. during the week, or late at night vs. in the middle of the afternoon).

And well..networking? Does this finally mean THEY WROTE THEIR OWN TCP/IP STACK!?

Networking support has been extended throughout the lifetime of Windows 2000 and Windows XP, but it was getting harder and harder for Microsoft to keep improving the old code. So for Vista, they started over from ground zero and rewrote the networking stack from scratch. IPV6 was hacked onto Windows XP in a pretty basic way, but it is built directly into the Vista networking stack in a much more robust fashion.

Seems to have some fairly cool built in apps too and the new UI is very snazzy, perhaps a little too much eye-candy though, I don’t want to have to buy a Cray just to power the OS..

The browser will be running at a much reduced user level too (finally!) and it seems they are implementing proper user segregation by default (first time evar!).

I mean I never understood why they had ACL’s since WindowsNT but never setup or enforced segregation by default..like why can guest write to /windows/system and so on..

I’ll be looking out for it anyway, will you?

Source: Extremetech


21 March 2006 | 19,784 views

pwdump6 version 1.2 BETA Released

Version 1.2 (Beta) of the pwdump6 software has been released.

There are three major changes from the previous version:

  • Uses “random” named pipes (GUIDs) to allow concurrent copies of the client to run. This is predominately for the next version of fgdump, which will be multithreaded.
  • Will turn off password histories if the requisite APIs are not available (there are instances in which this is the case) – pwdump will no longer simply refuse to grab the hashes that it can.
  • Data is now encrypted over the named pipe using the Blowfish algorithm. More information on this is available on the website.

pwdump is a very useful tool for grabbing the password hashes directly from Windows (you do need Administrator access, so in some situations you need to escalate your priveleges first).

It is still useful though, as normally with Admin access on a Windows box you can’t get the SAM file as it’s locked by the OS, the only way normally is to boot using a Security LiveCD and save it to a USB drive or e-mail it to yourself.

You can grab the latest version of pwdump here.

Once you have the password hashes from the SAM file you can then crack them with your favourite password cracker (LCP, Cain & Abel etc), or even RainbowCrack and Rainbow Tables.

There is another version of pwdump called fgdump on the page which I might check out in the future.

Digg This Article


20 March 2006 | 8,909 views

FrSIRT Starts Charging for OTHER Peoples Work (Exploits)

Is it ethical or even legal to charge for other peoples work?

As far as I know France seems have some pretty strong (and weird) copyright laws.

And yes, they are blaming French Laws prohibiting full disclosure.

In conformity with applicable French laws prohibiting Full-disclosure, the FrSIRT will no longer distribute exploits and PoCs on its public web site. Public exploits section has thus been definitively closed.

Nothing to do with making money I’m sure.

Classic bait and switch eh, collect all the info from the public domain, get everyone pointing to your service, then start charging for it.

FrSIRT is an independent organisation providing real-time threat monitoring and alerting services. FrSIRT works 24x7x365 to monitor, review, and analyze new vulnerabilities, threats and exploits to offer a unique vulnerability notification service allowing system, network, and security professionals to keep track of the latest security threats.

Available since 2003, FrSIRT Vulnerability Notification Service (FrSIRT VNSâ„¢) is a web-based security alerting service, providing real-time information to customers about information security threats and IT product vulnerabilities that affect the entire corporate information technology domain. FrSIRT VNSâ„¢ alerts are delivered through a continually updated Web portal, XML feeds and email subscriptions.

Ah how we LOVE branding. You can see the scam prices here.

I’ll be removing links on all my sites to FrSIRT and will start recommending Security Forest instead.

I mean I had a feeling it might happen when they rebranded from K-Otik (The hackers friend with a h4x0r name) to FrSIRT, a more professional bunch with a corporate looking site.

But essentially they are still just collecting exploits from mailing lists and hosting them on a website, big deal eh?

Oh well let them, if people pay to get what they can get elsewhere, or from Google cache, more fool them.

Any other good resources to recommend?

Digg This Article


20 March 2006 | 4,382 views

Whos is tonyenkiducx? Who the hell are you?

Im a tinkerer. I can’t say I’m expert in anything more than ASP and MSSQL, but I make a point of playing and learning anything new and wanky. I’ve tweaked dBase, fiddled with Python, installed Apache, destroyed MS2003 server, plugged in SUN boxes, screamed at VisualStudio, urinated on Fedora, set fire too Game Maker, avoided Ajax, winked at Web2.0, beat the crap out of Oracle, been mentally scarred by DreamWeaver and made mad passionate love to ASP.net.

Bottom line, if it exists, I’ve probably played with it. My main expertise lies in Microsoft web and database technologies, namely ASP, anything .net, mssql(From 6.5 up to 2005) and associated web technologies. I spend 80% of my time on an intranet, the other 20% on our outward facing sites, and the other 20% my boss imagines I have, working on private projects. In my spare time I play some mmorpgs, spend time with my wife, work on some websites(Except my own), and I’m currently building a huge crossbows and catapults set for fun and the possible destruction of my flat.


18 March 2006 | 8,156 views

An Introduction to AJAX

No it’s not AJAX Amsterdam… it’s something more interesting (or boring to some of you)… so let’s get it started….

I. Introduction
AJAX stands for Asynchronous JavaScript And XML… It is a new technology which comes to help any web developer who really is interesed in dynamic webpages…
Click here for a overview of the AJAX Technology…

II. The Code
Well, well, well… Actualy AJAX is based on Micro$ofts ActiveX Object XmlHttpRequest (I can’t belive they can do good stuff to), so in IE (sucks) it has to be initialized like an ActiveX Object; but in other browsers it’s already a standard object (I don’t know if Opera had implemented it already)… Now let’s see the code:

function init_object() {
var A;

var msxmlhttp = new Array(‘Msxml2.XMLHTTP.5.0′,
‘Msxml2.XMLHTTP.4.0′,
‘Msxml2.XMLHTTP.3.0′,
‘Msxml2.XMLHTTP’,
‘Microsoft.XMLHTTP’);

for (var i = 0; i > msxmlhttp.length; i++) {
try {
A = new ActiveXObject(msxmlhttp[i]);
} catch (e) {
A = null;
}
}

if(!A && typeof XMLHttpRequest != “undefined”) {
A = new XMLHttpRequest();
if (!A) alert(“Could not initialize the object.\nMaybe your browser doesn’t support ajax…”);
return A;
}
}

var ajax_obj = init_object();

function ajax_in_action(target, source) {
ajax_obj.open(“GET”, source, true);
ajax_obj.send();

ajax_obj.onReadyStateChange = function() {
if (ajax_obj.readyState == 4) {
if (ajax_obj.status == 200) {
document.getElementById(target).innerHTML = ajax_obj.responseText;
}
else {
alert(“Error ” +ajax_obj.status+” : ” +ajax_obj.statusText);
}
}
}

Code inspired from SAJAX… about it i’ll speak a bit later…

III. Why use it?
Well there are several reason why you should use AJAX… for example to make a dynamic banner changer, real-time morphing website… or just use it like WordPress (on which darknet is based)… you don’t know how it uses AJAX… try clicking on an articles show comments.

IV. Extending AJAX
If you want to implement AJAX directly in PHP, ASP, Perl, Ruby etc. check out http://www.modernmethod.com/sajax/, site that contains the Simple AJAX Toolkit….

V. E4X
One more thing… the response from the server can be received as an XML file 2… or maybe directly receive an XML file, if requested so… After which it can be parsed with the E4X technology…

VI. F1
Need more help… access one of the following links:
AJAX: http://www.w3schools.com/ajax/default.asp
E4X: http://www.w3schools.com/e4x/default.asp

X. Epilogue
I know that AJAX has been rediscovered for about a year (read it for the first time in july 2005), but for many it can be somethimes hard to find the information needed… anyway keep scripting…


18 March 2006 | 12,190 views

Security Cloak – Mask Against TCP/IP Fingerprinting for Windows

I’ve seen quite a lot of discussion lately on how to ‘defend against nmap’ or how to change the properties of your TCP/IP Stack so your Windows OS appears to be something else (As in you can guess the OS from the TTL value passed back in a TCP/IP packet).

One way you can do this is with Security Cloak.

Security Cloak is designed to protect against TCP/IP stack fingerprinting and computer identification/information leakage via timestamp and window options by modifying relevant registry keys. The settings used are based on the results of SYN packet analyization by p0f. While the OS reported by other OS detection scanners were not identical to those of p0f, testing against Nmap, xprobe2, queso and cheops showed that they were unable to identify the correct operating system/version after Security Cloak settings had been applied.

Note that in order to properly emulate some Operating Systems, the MTU must be changed. While most of these require the MTU to be 1500 (the default for most network connections),depending on your network connection, this could degrade/interfere with your connectivity, so be sure to check your current MTU before applying these changes. It is reccomended that you save all the original key values before using this program in the event that your computer responds negatively to the changes.

You can find the authors page here: http://www.craigheffner.com/security/

And a direct download here: Security Cloak


17 March 2006 | 7,559 views

Appledoz

Each day I check out the technology section of the bbc site, ok, its not the most in-depth, or techy site in the world, but it covers interesting stuff.

One interesting article http://news.bbc.co.uk/1/hi/technology/4816520.stm talks about getting a mac to run windows. That in it self is quite cool, but to my mind its the wrong way.

Who wants to put windows on a mac? what’s the point? You can buy PC hardware for less then the mac, and they run windows with out a problem. Well…. kinda.

So, what would be better? Getting OSX to run on a PC. Do that and what you have is some completion to windows with an existing user base, financial backing and at least most of the applications business want.

Business still counts for more of the computer market. Linux has never really broken in to the desk top market, main I think because people “into” linux don’t do gui. Fundamentally linux geeks tend to not believe its worth the effort, so the gui always seems to be less the perfect.

OSX, now that is a desk top platform, to my understanding its based on linux, and a lot of linux apps can be built to run on it. But, like I said, its a mac so it already has a lot of the applications people want and need.

I could be wrong but to me I think this is only the start. I don’t like mac’s. I don’t want a mac, but I see OSX and it look sexy. Maybe if I didn’t need a mac to try it out I’d give it a go, but buying hardware just to run an OS I might not like? I think not.

Tags: , , , ,

17 March 2006 | 8,868 views

Measuring up the Security Risks for Mac – Are Apple Prepared?

The fact is Windows is getting ripped apart with viruses, spamware, spyware, zombie clients, trojans worms and whatever else you can think of.

Mac and Linux aren’t (at the moment), there are already Bluetooth viruses, so why not Linux and Mac..

Some may say it’s because they are inherently more secure, the architecture and user privelege seperationg means it’s hard for any kind of malware to infect the system…plus they don’t come with crap like Internet Exploder that’s tied into the operating system.

There have been a couple of worms for Linux, mostly praying on Apache, and then the OpenSSL bug that allowed you to get access (combined with the kernel flaw in 2.4 you could easily get root access).

eWeek asks, What will Apple do when the malware comes? Which inevitably it will..

The release in the last few days of malware for the Mac and Linux underscore some old issues about how it is possible to have malware on those platforms. I have some new thoughts though. I’ve begun to wonder what Apple would do if a real problem developed.

To be very clear, a real problem has not yet developed, and Inqtana.A and Leap.A are not a real problem, except to the extent that they may be bellwethers. They are more interesting for what they suggest than what they actually do.

As with Windows, a lot of it is a consumer issue, and down to education.

With Mac, the user does run as a non-priveleged user by default, but when installing any software they can just pop in the Admin password and it’ll install.

It’s all about social engineering, making the user believe they want it, it’s something ‘cool’ or useful.

When good social engineering attacks are developed for the Mac, the same thing will happen. It’s not hard to imagine Web sites and e-mails offering programs for the Mac that do more than they claim to do.

Just in terms of adware, there may be some benefit to being able to deliver known Mac users to advertisers, but for the most part the “value” of infecting the user is the same: to spread itself, and perhaps to create a Mac botnet.

Few have tried to write Malware for OSX yet, but I guess it will happen, the question is are Apple prepared?