Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on RSS or Twitter for the latest updates.

03 February 2014 | 829 views

A Story Of Social Engineering – How @N Lost His $50,000 Twitter Handle

Check Your Web Security with Acunetix

So last week I read an interesting tale about social engineering on Medium, a story by a chap named Naoki Hiroshima and his Twitter handle, which was @N.

Yes just one letter, a pretty rare and it seems valuable handle as he had offers of up to $50,000 for it. In the end though, someone decided they would just take it. Although there had been many attempts on the account before, this one was successful.

I had a rare Twitter username, @N. Yep, just one letter. I’ve been offered as much as $50,000 for it. People have tried to steal it. Password reset instructions are a regular sight in my email inbox. As of today, I no longer control @N. I was extorted into giving it up.

While eating lunch on January 20, 2014, I received a text message from PayPal for one-time validation code. Somebody was trying to steal my PayPal account. I ignored it and continued eating.

Later in the day, I checked my email which uses my personal domain name (registered with GoDaddy) through Google Apps. I found the last message I had received was from GoDaddy with the subject “Account Settings Change Confirmation.” There was a good reason why that was the last one.

Unsurprisingly, this cautionary tale involves two of the most hated companies online – PayPal and GoDaddy. GoDaddy has accepted partial responsibility though and has agreed that it needs to address and improve the processes that were abused in this case.

GoDaddy accepts partial responsibility in social engineering attack of @N’s customer account

PayPal however has denied giving out any information to the hacker, as would be expected from them:

PayPal denies providing payment information to hacker who hijacked $50,000 Twitter username

I changed my username @N to @N_is_stolen for the first time since I registered it in early 2007. Goodbye to my problematic username, for now.

It’s hard to decide what’s more shocking, the fact that PayPal gave the attacker the last four digits of my credit card number over the phone, or that GoDaddy accepted it as verification.

With my GoDaddy account restored, I was able to regain access to my email as well. I changed the email address I use at several web services to an @gmail.com address. Using my Google Apps email address with a custom domain feels nice but it has a chance of being stolen if the domain server is compromised. If I were using an @gmail.com email address for my Facebook login, the attacker would not have been able to access my Facebook account.

This whole situation just shows why 2 factor authentication is so important and also that you should really use @gmail.com accounts for important stuff rather than vanity domains registered with shady providers like GoDaddy.

Read the full story on Medium to see all the e-mail exchanges and get the full low down on exactly what happened.

Source: Medium.com



24 January 2014 | 5,559 views

PACK – Password Analysis & Cracking Kit

PACK (Password Analysis and Cracking Toolkit) is a collection of utilities developed to aid in analysis of password lists in order to enhance password cracking through pattern detection of masks, rules, character-sets and other password characteristics. The toolkit generates valid input files for Hashcat family of password crackers.

Before using the PACK, you must establish a selection criteria of password lists. Since we are looking to analyze the way people create their passwords, we must obtain as large of a sample of leaked passwords as possible. One such excellent list is based on RockYou.com compromise. This list both provides large and diverse enough collection that provides a good results for common passwords used by similar sites (e.g. social networking). The analysis obtained from this list may not work for organizations with specific password policies. As such, selecting sample input should be as close to your target as possible. In addition, try to avoid obtaining lists based on already cracked passwords as it will generate statistics bias of rules and masks used by individual(s) cracking the list and not actual users.

Please note this tool does not, and is not created to, crack passwords – it just aids the analysis of passwords sets so you can focus your cracking more accurately/efficiently/effectively.

You can download PACK here:

PACK-0.0.4.tar.gz

Or read more here.


22 January 2014 | 3,668 views

The 25 Worst Passwords Of 2013 – “password” Is Not #1

The worst passwords of 2013 – really, more like the most common. The majority come from the massive Adobe leak, which contributed over 40 million passwords and skewed the data a fair bit pushing “photoshop” and “adobe123″ into the list.

Most of them are no surprise though, we published the top 10 most common passwords back in 2006, and although it’s rather UK-centric, it did contain “password”, “123″, “123456″, “letmein”, “qwerty” and for some reason both the old list and this one contain “monkey”.

“123456″ is finally getting some time in the spotlight as the world’s worst password, after spending years in the shadow of “password.” Security firm Splashdata, which every year compiles a list of the most common stolen passwords, found that “123456″ moved into the number one slot in 2013. Previously, “password” had dominated the rankings.

The change in leadership is largely thanks to Adobe, whose major security breach in October affected upwards of 48 million users. A list of passwords from the Adobe breach had “123456″ on top, followed by “123456789″ and “password.” The magnitude of the breach had a major impact on Splashdata’s results, explaining why “photoshop” and “adobe123″ worked their way onto this year’s list.

Fans of “password” could reasonably petition for an asterisk, however, given that the stolen Adobe passwords included close to 100 million test accounts and inactive accounts. Counting those passwords on the list is kind of like setting a home run record during batting practice. Don’t be surprised if “password” regains the throne in 2014.

It’s amazing to think in this day and age, with the amount of news coverage about hacking that people still use such simplistic passwords. Especially when they are dealing with accounts that have billing information/credit card details.

Plus the proliferation of fairly easy to use password generators and storage tools (KeePass/LastPass/PassPack/1Password etc). I’ve been trying a few of them out lately, and I’m favouring Passpack – although it changed hands lately and development has slowed down for a while.

Weaker passwords are more susceptible to brute-force attacks, where hackers attempt to access accounts through rapid guessing. And when encrypted passwords are stolen, weaker ones are the first to fall to increasingly sophisticated cracking software.

As always, Splashdata suggests avoiding common words and phrases, and says that replacing letters with similar-looking numbers (such as “3″ instead of “E) is not an effective strategy. Instead, consider using phrases of random words separated by spaces or underscores, and using different passwords, at least for your most sensitive accounts. Password management programs such as LastPass, KeePass and Splashdata’s own SplashID can also help, as you only have to remember a single master password.

Here are the passwords:

1. 123456
2. password
3. 12345678
4. qwerty
5. abc123
6. 123456789
7. 111111
8. 1234567
9. iloveyou
10. adobe123
11. 123123
12. admin
13. 1234567890
14. letmein
15. photoshop
16. 1234
17. monkey
18. shadow
19. sunshine
20. 12345
21. password1
22. princess
23. azerty
24. trustno1
25. 000000

Source: Network World


10 January 2014 | 1,217 views

Capstone – Multi-platform, Multi-architecture Disassembly Framework

Capstone is a lightweight multi-platform, multi-architecture disassembly framework. The target of the author is to make Capstone the ultimate disassembly engine for binary analysis and reversing in the security community.

It is one of a very few disassembly frameworks that can support multi-architectures. So far, it can handle 4 most important architectures: ARM, ARM64 (aka ARMv8/AArch64), Mips & X86. More will be added in the future when possible.

Implemented in pure C language, Capstone is easy to be adopted for your low-level tool. Furthermore, lightweight & efficient bindings for popular languages such as Python, Ruby, OCaml, C#, Java & Go are also available.

Note that all of our the bindings are all manually coded, since we do not want to rely on bloated SWIG for wrapping.

Features

  • Support hardware architectures: ARM, ARM64 (aka ARMv8), Mips & X86 (more details).
  • Clean/simple/lightweight/intuitive architecture-neutral API.
  • Provide details on disassembled instruction (called “decomposer” by others).
  • Provide some semantics of the disassembled instruction, such as list of implicit registers read & written.
  • Implemented in pure C language, with bindings for Python, Ruby, OCaml, C#, Java and GO available.
  • Native support for Windows & *nix (including MacOSX, Linux, *BSD platforms).
  • Thread-safe by design.
  • Distributed under the open source BSD license.

You can download Capstone source here:

capstone-1.0.tgz

Or read more here.


08 January 2014 | 855 views

Yahoo! Spread Bitcoin Mining Botnet Malware Via Ads

Bitcoin and other cryptocurrencies are pretty much headline news every day now, especially with the inflated values (Bitcoin over $1000 recently). We haven’t mentioned them for a long time though, back in 2012 we wrote about Hackers breaking into a Bitcoin Exchange Site called Bitcoinica.

There have been plenty of Bitcoin related hacks since then, mostly targeting exchanges, but there have been some other interesting developments like these so called bitnets, which are basically Bitcoin Mining malware botnets.

The most recent news is that Yahoo! recently served up some adverts which contained malware, the intent of the malware is to create a Bitcoin mining botnet.

Yahoo confirmed that for a four-day period in January, malware was served in ads on its homepage. Experts estimate that as many as two million European users could have been hit. Security firm Light Cyber said the malware was intended to create a huge network of Bitcoin mining machines.

“The malware writers put a lot of effort into making it as efficient as possible to utilise the computing power in the best way,” Light Cyber’s founder Giora Engel told the BBC.

Bitcoin mining malware is designed to steal computing power to make it easier for criminals to accumulate the virtual currency with little effort on their part.

“Generating bitcoins is basically guessing numbers,” said Amichai Shulman, chief technology office of security firm Imperva. “The first one to guess the right number gets 25 bitcoins and if you have a large volume of computers guessing in a co-ordinated way then you have a more efficient way of making money,” he added.

Other than a computer running slower, victims will be unaware that their machine is being used in what could become known as a “bitnet”. It is a variation on the traditional botnet, networks of malware-infected computers used to churn out spam or bombard websites with requests in order to knock them offline. Some experts estimate that such networks could be generating as much as $100,000 (£60,000) each day.

If the estimates are true, then whoever wrote this malware and managed to get it onto the Yahoo! frontpage could be minting money – $100,000 a day! That’s 3 million bucks a month, certainly no chump change.

I’d be interested to know more though, as CPU mining for Bitcoin is incredibly inefficient – so I wonder if this malware also harnesses GPU minining – which whilst can’t be compared to ASICS miners – still has a decent amount of grunt.

Yahoo acknowledged the attack in a statement earlier this week.

“From December 31 to January 3 on our European sites, we served some advertisements that did not meet our editorial guidelines – specifically, they spread malware,” the statement read.

It went on to say that users in America, Asia and Latin America weren’t affected but did not specify how many European users were victims. Fox IT, the Dutch cybersecurity firm which revealed the malware attack, estimates that there were around 27,000 infections every hour the malware was live on the site. Over the period of the attack that could mean as many as two million machines were infected. Such attacks may be hard to avoid, said Mr Shulman.

“For an ad platform it is virtually impossible to guarantee 100% malware free ads. There are many independent stakeholders involved in the process of web advertising, so from time to time any ad platform is bound to deliver malware.”

It’s a pretty scary thought that no ad platform can be malware free, but honestly I’ve never experienced Google Adsense serving any kind of malware – although when I’m browsing on mobile lately I’ve had a lot of sides trying to push random .apk files to me.

It seems to like it was only regional as well with European users being targeted (perhaps due to the advert geo-targeting) – but with up to 2 million people infected – that’s a fairly decent sized Bitcoin mining botnet.

Source: BBC News


06 January 2014 | 1,820 views

xssless – An Automated XSS Payload Generator Written In Python

xssless is an automated XSS payload generator written in python.

Usage

  1. Record request(s) with Burp proxy
  2. Select request(s) you want to generate, then right click and select “Save items”
  3. Use xssless to generate your payload: ./xssless.py burp_export_file
  4. Pwn!

Features

  • Automated XSS payload generation from imported Burp proxy requests
  • Payloads are 100% asynchronous and won’t freeze the user’s browser
  • CSRF tokens can be easily extracted and set via the -p option
  • POST multipart is supported, along with XSS file uploading via the -f option
  • Payloads are dynamic and portable (due to relative URLs)
  • Crazy JavaScript worms with no hassle!

Installation/Download

Download the latest xssless:

Install dependencies:

Run the script:

Or read more here.


23 December 2013 | 4,529 views

Researchers Crack 4096-bit RSA Encryption With a Microphone

So this is a pretty interesting acoustic based cryptanalysis side-channel attack which can crack 4096-bit RSA encryption. It’s been a while since we’ve seen anything hardware based, and RSA 4096 is pretty strong encryption, I wonder how they figured this one out.

Acoustic Cryptanalysis

It makes sense though when you think about it, although I wouldn’t have thought about it – I wasn’t even aware that processors made any audible noise when processing (even if the noise can only be picked up by a fairly high quality mic).

Security researchers have successfully broken one of the most secure encryption algorithms, 4096-bit RSA, by listening – yes, with a microphone — to a computer as it decrypts some encrypted data. The attack is fairly simple and can be carried out with rudimentary hardware. The repercussions for the average computer user are minimal, but if you’re a secret agent, power user, or some other kind of encryption-using miscreant, you may want to reach for the Rammstein when decrypting your data.

This acoustic cryptanalysis, carried out by Daniel Genkin, Adi Shamir (who co-invented RSA), and Eran Tromer, uses what’s known as a side channel attack. A side channel is an attack vector that is non-direct and unconventional, and thus hasn’t been properly secured. For example, your pass code prevents me from directly attacking your phone — but if I could work out your pass code by looking at the greasy smudges on your screen, that would be a side channel attack. In this case, the security researchers listen to the high-pitched (10 to 150 KHz) sounds produced by your computer as it decrypts data.

Interesting that one of the researchers involved in this is also a co-inventor of RSA, but that’s also a good thing – showing they are constantly trying to find ways to improve it, break it etc.

Perhaps all new encryption software will come with a feature to play some kind of white noise/music to disrupt any snooping of the high frequency CPU sounds.

Without going into too much detail, the researchers focused on a very specific encryption implementation: The GnuPG (an open/free version of PGP) 1.x implementation of the RSA cryptosystem. With some very clever cryptanalysis, the researchers were able to listen for telltale signs that the CPU was decrypting some data, and then listening to the following stream of sounds to divine the decryption key. The same attack would not work on different cryptosystems or different encryption software — they’d have to start back at the beginning and work out all of the tell-tale sounds from scratch.

The researchers successfully extracted decryption keys over a distance of four meters (13 feet) with a high-quality parabolic microphone. Perhaps more intriguingly, though, they also managed to pull of this attack with a smartphone placed 30 centimeters (12 inches) away from the target laptop. The researchers performed the attack on different laptops and desktops, with varying levels of success. For what it’s worth, the same kind of electrical data can also be divined from many other sources — the power socket on the wall, the remote end of an Ethernet cable, or merely by touching the computer (while measuring your body’s potential relative to the room’s ground potential).

Thankfully it’s a very academic type of attack and doesn’t have much of a real world implication on the majority of folks, the method could be constructed for other algorithms I assume – using the same technique.

But really, how many people sit around in public places decrypting sensitive documents? I don’t think there’s many.

Source: ExtremeTech


12 December 2013 | 7,455 views

THC-Hydra 7.5 Released – Fast Parallel Network Logon Cracker

Hydra is a parallelized network logon cracker which supports numerous protocols to attack, new modules are easy to add, beside that, it is flexible and very fast.

THC-Hydra

Features

  • IPv6 Support
  • Graphic User Interface
  • Internationalized support (RFC 4013)
  • HTTP proxy support
  • SOCKS proxy support

The tool supports the following protocols –

And is faster in most tests than ncrack or medusa.

Changelog for 7.5

  • Added module for Asterisk Call Manager
  • Added support for Android where some functions are not available
  • hydra main:
    • – reduced the screen output if run without -h, full screen with -h
    • – fix for ipv6 and port parsing with service://[ipv6address]:port/OPTIONS
    • – fixed -o output (thanks to www417)
    • – warning if HYDRA_PROXY is defined but the module does not use it
    • – fixed an issue with large input files and long entries
  • hydra library:
    • – SSL connections are now fixed to SSLv3 as some SSL servers fail otherwise, report if this gives you problems
    • – removed support for old OPENSSL libraries
  • HTTP Form module:
    • – login and password values are now encoded if special characters are present
    • – ^USER^ and ^PASS^ are now also supported in H= header values
    • – if you the colon as a value in your option string, you can now escape it with \: – but do not encode a \ with \\
  • Mysql module: protocol 10 is now supported
  • SMTP, POP3, IMAP modules: Disabled the TLS in default. TLS must now be defined as an option “TLS” if required. This increases performance.
  • Cisco module: fixed a small bug (thanks to Vitaly McLain)
  • Postgres module: libraries on Cygwin are buggy at the moment, module is therefore disabled on Cygwin

You can download THC-Hydra 7.5 here:

hydra-7.5.tar.gz

Or read more here.


09 December 2013 | 1,264 views

Linux.Darlloz Worm Targets x86 Linux PCs & Embedded Devices

So this is not a particularly technical source article, but it looks fairly interesting and I haven’t heard of this Linux.Darlloz worm before, so it might be new to some of you too.

Seems like it’s going after old php-cgi installs, which are very common on embedded systems (routers/pos systems/stbs etc). The vulnerability being used is actually pretty old and was patched back in May 2012.

It’s not really likely to cause a serious risk to servers, which tend not to run php-cgi any more – and it would be more common for them to be updated.

A new worm is targeting x86 computers running Linux and PHP, and variants may also pose a threat to devices such as home routers and set-top boxes based on other chip architectures.

According to security researchers from Symantec, the malware spreads by exploiting a vulnerability in php-cgi, a component that allows PHP to run in the Common Gateway Interface (CGI) configuration. The vulnerability is tracked as CVE-2012-1823 and was patched in PHP 5.4.3 and PHP 5.3.13 in May 2012.

The new worm, which was named Linux.Darlloz, is based on proof-of-concept code released in late October, the Symantec researchers said Wednesday in a blog post.

“Upon execution, the worm generates IP [Internet Protocol] addresses randomly, accesses a specific path on the machine with well-known ID and passwords, and sends HTTP POST requests, which exploit the vulnerability,” the Symantec researchers explained. “If the target is unpatched, it downloads the worm from a malicious server and starts searching for its next target.

The only variant seen to be spreading so far targets x86 systems, because the malicious binary downloaded from the attacker’s server is in ELF (Executable and Linkable Format) format for Intel architectures.

I’m not exactly sure what the end game for this worm is, perhaps it’s just into spreading and doesn’t do anything particularly malicious. But in this day and age, that seems pretty unlikely. Infected hosts are more likely to be turned into botnet zombies for a DDoS network.

It seems like it has infection vectors for non x86 architectures, but no actual infections on non PC devices have been confirmed – so the code might not even work properly.

However, the Symantec researchers claim the attacker also hosts variants of the worm for other architectures including ARM, PPC, MIPS and MIPSEL.

These architectures are used in embedded devices like home routers, IP cameras, set-top boxes, and many others.

“The attacker is apparently trying to maximize the infection opportunity by expanding coverage to any devices running on Linux,” the Symantec researchers said. “However, we have not confirmed attacks against non-PC devices yet.”

The firmware of many embedded devices is based on some type of Linux and includes a web server with PHP for the web-based administration interface. These kinds of devices might be easier to compromise than Linux PCs or servers because they don’t receive updates very often.

Patching vulnerabilities in embedded devices has never been an easy task. Many vendors don’t issue regular updates and when they do, users are often not properly informed about the security issues fixed in those updates.

In addition, installing an update on embedded devices requires more work and technical knowledge than updating regular software installed on a computer. Users have to know where the updates are published, download them manually and then upload them to their devices through a Web-based administration interface.

It’s an interesting enough story though, something to keep an eye out for, but honestly I don’t think it’s going to spread very far – and it won’t do much damage. Only old and neglected machines will be vulnerable to the exploit.

But well, as we know – there are far too many such machines plugged into the Internet.

Source: PC World


05 December 2013 | 2,164 views

Sandboxie – Sandbox Your Browser / Software / Programs In Windows

Sandboxie enables you to easily sandbox your browser and other programs, it runs your applications in an isolated abstraction area called a sandbox. Under the supervision of Sandboxie, an application operates normally and at full speed, but can’t effect permanent changes to your computer. Instead, the changes are effected only in the sandbox.

Sandboxie - Sandbox Your Programs

For those too lazy to set up a full on vm image for testing stuff, this is a pretty good alternative.

Benefits of the Isolated Sandbox

  • Secure Web Browsing: Running your Web browser under the protection of Sandboxie means that all malicious software downloaded by the browser is trapped in the sandbox and can be discarded trivially.
  • Enhanced Privacy: Browsing history, cookies, and cached temporary files collected while Web browsing stay in the sandbox and don’t leak into Windows.
  • Secure E-mail: Viruses and other malicious software that might be hiding in your email can’t break out of the sandbox and can’t infect your real system.
  • Windows Stays Lean: Prevent wear-and-tear in Windows by installing software into an isolated sandbox.

Registration is optional but there is a nag screen after 30 days (typical shareware style).

You can download Sandboxie here:

SandboxieInstall.exe

Or read more here.