Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

23 June 2014 | 1,440 views

Codesake::Dawn – Static Code Analysis Security Scanner For Ruby

Check For Vulnerabilities with Acunetix

Codesake::Dawn is a source code scanner designed to review your code for security issues. Basically a static analysis security scanner for ruby written web applications.

Codesake::Dawn is able to scan your ruby standalone programs but its main usage is to deal with web applications. It supports applications written using majors MVC (Model View Controller) frameworks, like Ruby on Rails, Sinatra & Padrino.

When you run Codesake::Dawn on your code it parses your project Gemfile.lock looking for the gems used and it tries to detect the ruby interpreter version you are using or you declared in your ruby version management tool you like most (RVM, rbenv, …).

Static Code Analysis Security Scanner For Ruby

Then the tool tries to detect the MVC framework your web application uses and it applies the security check accordingly. There checks designed to match rails application or checks that are appliable to any ruby code.

Codesake::Dawn can also understand the code in your views and to backtrack sinks to spot cross site scripting and sql injections introduced by the code you actually wrote. In the project roadmap this is the code most of the future development effort will be focused on.

Codesake::Dawn security scan result is a list of vulnerabilities with some mitigation actions you want to follow in order to build a stronger web application.

Options

Installation

codesake-dawn rubygem is cryptographically signed. To be sure the gem you install hasn’t been tampered, you must first add paolo@codesake.com public signing certificate as trusted to your gem specific keyring.

You can install latest Codesake::Dawn version, fetching it from Rubygems by typing:

Or read more here.



20 June 2014 | 2,968 views

Source Code Hosting Service Code Spaces Deleted By Hacker

There’s been a LOT of noise about this incident in the past day or two, the very definition of a cloud nightmare. Git/SVN & Project Management SaaS Code Spaces has been hacked and completely deleted by a hacker.

It started off with a large scale DDoS attack (the likes of which Feedly and Evernote have also seen this month) – and in all cases the malicious parties have been asking for ransom money to stop the attacks.

Code Spaces Deleted By Hacker

This time however, with Code Spaces – somehow the malicious parties got access to their Amazon console..which gave them access to delete everything, including snapshots and backups. This has rendered Code Spaces totally inoperable, and unfortunately it looks like they won’t be able to recover from this.

Source code hosting provider Code Spaces has suffered the ultimate cloud nightmare, having been effectively forced out of business by the actions of an attacker who managed to gain access to its Amazon EC2 control panel.

The devastating incident began on June 17 when Code Spaces – a company that claimed to offer “Rock Solid, Secure and Affordable Svn Hosting, Git Hosting and Project Management” – became the target of a DDoS attack from an unknown party who demanded “a large fee” to make it stop.

This isn’t the first such incident in recent weeks. Evernote and Feedly were each knocked down on June 10, reportedly by criminals trying to extort money. Both managed to restore their services, albeit only after extended outages.

The difference this time is that in addition to having access to a formidable botnet, Code Spaces’ assailant had also gained access to the company’s Amazon EC2 control panel, giving him control over the data it had stored using Amazon’s Elastic Block Store (EBS) and S3 cloud services.

“We finally managed to get our panel access back but not before he had removed all EBS snapshots, S3 buckets, all AMI’s, some EBS instances and several machine instances,” the company wrote in a message posted to its homepage. “In summary, most of our data, backups, machine configurations and offsite backups were either partially or completely deleted.”

The ironic part is they make claims about having bulletproof ‘offsite’ backups, when all they seem to mean is they put some backups in a different Amazon region – not even on a different cloud platform – so anyone having access to their Amazon console..could nuke everything. You can see their claims on Archive.org here.

We have invested a great deal of time and effort in developing a real-time backup solution that allows us to keep off-site, fully functional backups of your data – at high performance. We literally backup everything you do, as soon as you do it.

Also why weren’t they using 2 Factor Authentication for such an important account? I’m really very interested in how the extortion DDoS gang got hold of their Amazon credentials.

The net effect was that, once the smoke cleared, Code Spaces no longer had any service to offer its customers.

“Code Spaces will not be able to operate beyond this point,” the company’s statement reads, “The cost of resolving this issue to date and the expected cost of refunding customers who have been left without the service they paid for will put Code Spaces in an irreversible position both financially and in terms of ongoing credibility.”

The source-sharing site said it is now working to export whatever data remains so that customers can regain access to their files. All Git repositories and some svn repositories are reportedly available for export, although their backups and snapshots have been erased, and some svn repositories have been destroyed altogether. All of Code Spaces’ EBS-hosted database files have also been wiped clean, along with their backups and snapshots.

The company said it is experiencing “massive demand” for support and has asked customers for patience as it struggles to get to everyone.

“On behalf of everyone at Code Spaces, please accept our sincere apologies for the inconvenience this has caused to you, and ask for your understanding during this time!” the statement reads. “We hope that one day we will be able to and reinstate the service and credibility that Code Spaces once had!”

In a way I’m glad this happened though, nothing against Code Spaces (never even heard of the service) – but it’s a lesson to be learnt – Cloud DOES not make you any more secure, in many ways it makes you less secure.

All your eggs in one basket? Then yeah, you are asking to get burnt. Set up pull only backups on an entirely different platform (the desktop in your office is fine, or on Linode/Rackspace/Softlayer etc).

It costs $5 to run up a Digital Ocean VPS and pull backups from your production servers – just do it.

There’s further discussion on Reddit here too – Hacker Puts Code Spaces Out of Business.

Source: The Register


18 June 2014 | 1,758 views

Don’t Get Hacked – Have A Free Acunetix Security Scan

The recent Heartbleed vulnerability has highlighted the urgent need for more network level security scanning. In view of this, Acunetix has announced that it will be offering 10,000 users a Free Acunetix Security Scan with the Acunetix Online Vulnerability Scanner (OVS) in a bid to make it easier for businesses to take control of their network security.

Acunetix Online Vulnerability Scanner is a hosted security scanner that will scan a perimeter server for network level vulnerabilities and provide detailed reports so as to allow the security administrator to fix the vulnerabilities before a hacker finds them.

Acunetix Online Vulnerability Scanner (OVS)

All the Network Scanning capabilities available in Acunetix OVS will be available for free for fourteen days (From today June 18th 2014), allowing users to audit their internet (and hacker) facing servers.

Features

  • Scan your servers for over 35,000 network vulnerabilities
  • Audit your internet facing architecture and identify system and network weaknesses
  • Ensure that servers are not running any illegitimate services, such as a Bitcoin mining botnet
  • Identify any vulnerable versions of applications running on the servers
  • Discover the information that the systems are leaking using various techniques such as OS fingerprinting, port banner grabbing and service probing (like the information SHODAN archives)
  • Ensure that all the organisation’s services, including FTP and mail, do not suffer from Heartbleed
  • Get additional information about other vulnerabilities and network problems detected.

To make use of this offer, you can sign-up at www.acunetix.com/free-network-security-scan/ using a valid company email address. Once your scan target has been verified (it actually belongs to your company), you can then make use of the scanning features mentioned above.


16 June 2014 | 2,408 views

SHODAN – Expose Online Devices (Wind Turbines, Power Plants & More!)

SHODAN is a search engine that lets you find specific computers (routers, servers, etc.) using a variety of filters. Some have also described it as a public port scan directory or a search engine of banners.

Web search engines, such as Google and Bing, are great for finding websites. But what if you’re interested in finding computers running a certain piece of software (such as Apache)? Or if you want to know which version of Microsoft IIS is the most popular? Or you want to see how many anonymous FTP servers there are? Maybe a new vulnerability came out and you want to see how many hosts it could infect? Traditional web search engines don’t let you answer those questions.

Shodan - Expose Online Devices

So what does SHODAN index then? Good question. The bulk of the data is taken from ‘banners’, which are meta-data the server sends back to the client. This can be information about the server software, what options the service supports, a welcome message or anything else that the client would like to know before interacting with the server. For example, following is a FTP banner:

This tells us a potential name of the server (kcg.cz), the type of FTP server (Solaris ftpd) and its version (6.00LS). For HTTP a banner looks like:

This can be used to find all sorts of interesting things like Webcams, routers, power plants, iPhones, wind turbines, refrigerators – basically anything connected to the internet that has a banner that identifies what it is.

There is an API service as well if you want to build an app around the data in the Shodan database at https://developer.shodan.io/. The Shodan API is the easiest way to provide users of your tool access to the Shodan data. The API provides access to all of the search features, allowing you to get exactly the information you want. There are libraries for Python, Ruby & NodeJS.

You can get started with Shodan here – http://www.shodanhq.com/


12 June 2014 | 4,541 views

14-Year Olds Hack ATM With Default Password

This is actually a pretty good hack and a good use of the word hacking in the original sense, two curious teenagers managed to access the administrator mode of an ATM in Winnipeg, Canada by using the default password they found in a manual they downloaded online.

Ingenious and pretty forward thinking, I like the fact they were responsible about it too and headed to the branch to let them know there was an issue with the security of their ATM machines.

Hack ATM

I’m not surprised the bank staff were originally skeptical of the teenagers claims as it seems pretty unlikely a couple of 14 year olds could hack your ATM machines..

A Winnipeg BMO branch got an unlikely security tip from two 14-year-olds when the pair managed to get into an ATM’s operating system during their lunch break last Wednesday.

The Grade 9 students, Matthew Hewlett and Caleb Turon, used an ATM operators’ manual they found online to get into the administrator mode of an ATM at a Safeway grocery store. They saw how much money was in the machine, how many transactions there had been and other information usually off-limits for the average bank customer.

“We thought it would be fun to try it, but we were not expecting it to work,” Hewlett told the Winnipeg Sun. “When it did, it asked for a password.”

They managed to crack the password on the first try, a result of BMO’s machine using one of the factory default passwords that had apparently never been changed.

They took this information to a nearby BMO branch, where staff were at first skeptical of what the two high-schoolers were telling them. Hewlett and Turon headed back to the Safeway to get proof, coming back with printouts from the ATM that clearly showed the machine had been compromised.

A slightly more advanced hack I remember writing about a few years back was a group Stealing ATM Pin Numbers Using Thermal Imaging Cameras.

Of course back in 2008 there was the famous ATM hacker ‘Chao’ who gave out a bunch of ATM hacking tips.

ATM Hacks have been around for a long time in various forms (skimming being the most common) – and they will continue to be around.

The teens even changed the machine’s greeting from “Welcome to the BMO ATM” to “Go away. This ATM has been hacked.”

The BMO branch manager called security to follow up on what the teenagers had found, and even wrote them a note to take back to school as explanation for why they were late getting back to class.

According to the Sun, the note started with: “Please excuse Mr. Caleb Turon and Matthew Hewlett for being late during their lunch hour due to assisting BMO with security.

Ralph Marranca, a spokesperson for BMO’s head office, said no customer information was exposed when Turon and Hewlett probed the ATM’s system. He did not immediately respond to questions from Postmedia News about what steps the bank is taking to ensure security at its thousands of ATMs across the country.

I just hope this incident gets enough press that it alerts other banks to audit their ATM Security and ensure they aren’t using the default administrator password.

Of course the Retards category sees a fair number of ATM related requests too.

Source: Edmonton Journal


09 June 2014 | 2,024 views

OWASP Mantra 0.92 – Browser Based Security Framework

OWASP Mantra is a collection of free and open source tools integrated into a web browser, which can become handy for students, penetration testers, web application developers,security professionals etc. It is portable, ready-to-run, compact and follows the true spirit of free and open source software.

Mantra is lite, flexible, portable and user friendly with a nice graphical user interface. You can carry it in memory cards, flash drives, CD/DVDs, etc. It can be run natively on Linux, Windows and Mac platforms. It can also be installed on to your system within minutes. Mantra is absolutely free of cost and takes no time for you to set up.

OWASP Mantra

Mantra is a browser especially designed for web application security testing. By having such a product, more people will come to know the easiness and flexibility of being able to follow basic testing procedures within the browser. Mantra believes that having such a portable, easy to use and yet powerful platform can be helpful for the industry.
Mantra has many built in tools to modify headers, manipulate input strings, replay GET/POST requests, edit cookies, quickly switch between multiple proxies, control forced redirects etc. This makes it a good software for performing basic security checks and sometimes, exploitation. Thus, Mantra can be used to solve basic levels of various web

Mantra Provides

  • A web application security testing framework built on top of a browser.
  • Supports Windows, Linux(both 32 and 64 bit) and Macintosh.
  • Can work with other software like ZAP using built in proxy management function which makes it much more convenient.
  • Available in 9 languages: Arabic, Chinese – Simplified, Chinese – Traditional, English, French, Portuguese, Russian, Spanish and Turkish
  • Comes installed with major security distributions including BackTrack and Matriux

The full list of changes in v0.92 is available here:

OWASP Mantra Security Toolkit 0.92 beta – Janus

You can download OWASP Mantra here:

Windows: OWASP Mantra Janus.exe
Linux: OWASP Mantra Janus Linux 32.tar.gz / OWASP Mantra Janus Linux 64.tar.gz

Or read more here.


06 June 2014 | 1,126 views

Important OpenSSL Patch – 6 More Vulnerabilities

So after the Heartbleed vulnerability in OpenSSL that turned the World upside down, there has a been a lot of focus on the codebase and the manner in which it was written. They’ve raised a bunch of money, an audit is underway and there has even been a fairly serious branch named LibreSSL (who are currently whining about not being told about this set of vulns).

OpenSSL Vulnerability

So yah if you have any Linux servers terminating SSL connections with OpenSSL (or LibreSSL) you really need to patch them now and reload any services using the library (or safer just to reboot if you’re not sure).

The good part this time is none of these are particularly easy to exploit, unlike Heartbleed – which could pretty much be abused by anyone.

The OpenSSL team today pushed out fixes for six security vulnerabilities in the widely used crypto library.

These holes include a flaw that enables man-in-the-middle (MITM) eavesdropping on encrypted connections, and another that allows miscreants to drop malware on at-risk systems.

A DTLS invalid fragment bug (CVE-2014-0195, affects versions 0.9.8, 1.0.0 and 1.0.1) can be used to inject malicious code into vulnerable software on apps or servers. DTLS is more or less TLS encryption over UDP rather than TCP, and is used to secure live streams of video, voice chat and so on.

However, an SSL/TLS MITM vulnerability (CVE-2014-0224, potentially affects all clients, and servers running 1.0.1 and 1.0.2-beta1) is arguably worse.

Users and administrators are advised to check their systems for updates; patched builds of OpenSSL are available from the major Linux distros, for instance.
Early CCS MITM logo, source: http://ccsinjection.lepidum.co.jp

The CVE-2014-0224 MITM bug has existed since the very first release of OpenSSL, according to Masashi Kikuchi, the Japanese security researcher who unearthed the flaw.

Let’s hope they don’t do a TrueCrypt and die after the audit because the code is so bad, they don’t have the resources to fix it. Some people are saying the money being raised should go straight to LibreSSL..but well, the World isn’t a huge fan of Theo and his OpenBSD ways – so that seems unlikely.

I’m sure there’s going to be a whole lot more flaws exposed in the months to come, this is just the beginnings. Let’s just hope that none are leaked (and critical) before the fixes and patches are made public.

The DTLS flaw has also given security experts the fear. “The OpenSSL DTLS vulnerability dates from April, but was reported today. It may allow remote-code execution (OpenSSL DTLS is still a nightmare),” noted computer-science professor Matthew Green in a Twitter update.

“This OpenSSL vuln is an example of the kind of subtle protocol bug that LibreSSL’s (admirable) fork is not likely to fix.”

The OpenSSL.org advisory comes just weeks after the discovery of the infamous Heartbleed vulnerability. Prof Green reckons none of the bugs would be easy to exploit – the direct opposite of the password-leaking Heartbleed hole. The other four fixes in today’s batch deal with denial-of-service-style vulnerabilities.

Nicholas J. Percoco, veep of strategic services at vulnerability management firm Rapid7, said a wide variety of servers and other internet-connected systems will need to be updated to guard against attackers exploiting these now-fixed bugs.

“The newly disclosed man-in-the-middle vulnerability disclosed in OpenSSL affects all client applications and devices that run OpenSSL when communicating to vulnerable servers of specific versions, but includes the most recent,” Percoco explained.

“This likely contains the majority of systems on the internet given most rushed to upgrade OpenSSL after the Heartbleed disclosure in early April of this year. A man-in-the-middle attack is dangerous because it can allow an attacker to intercept data that was presumed encrypted between a client – for example, an end user – and a server – eg, an online bank.

I’m honestly surprised (and a little sad) that’s it has taken this long for there to a big chunk of pressure on OpenSSL to clean up their code and be secure as it’s driving a large part of the Internet.

If you haven’t already done it – go and apply the OpenSSL Patch now.

Source: The Register


04 June 2014 | 1,679 views

OWASP NINJA-PingU – High Performance Large Scale Network Scanner

NINJA-PingU (NINJA-PingU Is Not Just A Ping Utility) is a free open-source high performance network scanner tool for large scale analysis. It has been designed with performance as its primary goal and developed as a framework to allow easy plugin integration.

OWASP NINJA-PingU Architecture

Essentially it’s a high performance, large scale network scanner, the likes of which we haven’t seen for some time. There were a few such projects around in 2008-2009 like Angry IP Scanner & Unicornscan.

It comes out of the box with a set of plugins for services analysisembedded devices identification and to spot backdoors.

NINJA PingU takes advantage of raw sockets to reduce the three-way TCP handshake latency and it’s state. Directly sending IP packets also avoids the TCP stack overhead. It also implements non-blocking networking I/O in the plugin’s interface by means of epoll. Each component is multithreaded and they have built-in caches to minimize synchronization points. In addition, the results persistment operations are buffered to reduce disk writes.

Options

You can download v1.0 here:

v1.0.tar.gz

Or check out the repo on Github here – https://github.com/OWASP/NINJA-PingU

Or read more here.


02 June 2014 | 852 views

Spotify Hacked – Rolls Out New Android App

So it looks like Spotify was hacked, or at least suffered some kind of breach – they claim user data for only one user was accessed and no payment details or password information was leaked. So it doesn’t seem to serious, but Spotify are reacting responsibly (which is good to see), disclosing the breach and taking action to make sure it doesn’t go any deeper.

As in most cases, once a malicious hacker or intruder has some kind of access, they will dig in deeper and eventually hit the motherload (like in the case of eBay for example).

Spotify Hacked

It seems to be something to do with the Android version of Spotify as they are asking users to download a new version (with completely new access tokens I assume), and re-enter their login credentials.

Spotify will ask all Android users of its streaming service to download a new version of its app after its internal systems were compromised.

The European music company disclosed the breach in a blog post on Tuesday. No password, financial, or payment information appears to have been accessed, and it only affected one user.

“We take these matters very seriously and as a general precaution will be asking certain Spotify users to re-enter their username and password to log in over the coming days,” explained Spotify’s chief technology officer, Oskar Stal, in a blog post. “As an extra safety step, we are going to guide Android app users to upgrade over the next few days.”

Though the breach was of a small scale, Spotify reacted quickly.

“As soon as we were aware of this issue we immediately launched an investigation. Information security and data protection are of great importance to us at Spotify,” the company explained in a more detailed FAQ on the breach.

Spotify has more than 40 million users and a big chunk of them are on Android, so this breach could have possibly exposed something fairly serious. But no real technical details have been released (as per norm) so we can’t really tell exactly what happened.

You can read the official blog post from the CTO here – Important Notice to Our Users

“Our evidence shows that only one Spotify user’s data has been accessed and this did not include any password, financial or payment information. We have reached out to this one individual. Based on our findings, we are not aware of any increased risk to users as a result of this incident.”

Given the tendency for breaches to quickly cascade into severe hacks, the company has chosen to react swiftly to try and quash any hacking attempts, we reckon.

“We do not believe this incident will affect your phone in any way. However, as an extra safety step, we are going to guide Android app users to upgrade over the next few days,” the company wrote.

However, users will lose all their offline playlists when they download the new app, so will have to re-download the songs to their phone. “We apologize for any inconvenience this causes, but hope you understand this is a necessary precaution to safeguard the quality of our service and protect our users.”

Whatever occurred, it doesn’t seem to effect iOS or Windows users at all and the general user base is not being asked to reset the passwords (nor even the Android users) so it does seem the user database is safe for the time being.

We will have to wait and see if any more details are forthcoming and if it turns out the hack went any deeper than currently publicised.

Source: The Register


30 May 2014 | 3,143 views

Bro – Passive Open-Source Network Traffic Analyzer

While focusing on network security monitoring, Bro provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Bro has successfully bridged the traditional gap between academia and operations since its inception. Today, it is relied upon operationally in particular by many scientific environments for securing their cyberinfrastructure. Bro’s user community includes major universities, research labs, supercomputing centers, and open-science communities.

Bro IDS Network Security Monitor

Bro is a passive, open-source network traffic analyzer. It is primarily a security monitor that inspects all traffic on a link in depth for signs of suspicious activity. More generally, however, Bro supports a wide range of traffic analysis tasks even outside of the security domain, including performance measurements and helping with trouble-shooting.

Features

  • Deployment
    • Runs on commodity hardware on standard UNIX-style systems (including Linux, FreeBSD, and MacOS).
    • Fully passive traffic analysis off a network tap or monitoring port.
    • Standard libpcap interface for capturing packets.
    • Real-time and offline analysis.
    • Cluster-support for large-scale deployments.
    • Unified management framework for operating both standalone and cluster setups.
    • Open-source under a BSD license.
  • Analysis
    • Comprehensive logging of activity for offline analysis and forensics.
    • Port-independent analysis of application-layer protocols.
    • Support for many application-layer protocols (including DNS, FTP, HTTP, IRC, SMTP, SSH, SSL).
    • Analysis of file content exchanged over application-layer protocols, including MD5/SHA1 computation for fingerprinting.
    • Comprehensive IPv6 support.
    • Tunnel detection and analysis (including Ayiya, Teredo, GTPv1). Bro decapsulates the tunnels and then proceeds to analyze their content as if no tunnel was in place.
    • Extensive sanity checks during protocol analysis.
    • Support for IDS-style pattern matching.
  • Scripting Language
    • Turing-complete language for expression arbitrary analysis tasks.
    • Event-based programming model.
    • Domain-specific data types such as IP addresses (transparently handling both IPv4 and IPv6), port numbers, and timers.
    • Extensive support for tracking and managing network state over time.
  • Interfacing
    • Default output to well-structured ASCII logs.
    • Alternative backends for ElasticSearch and DataSeries. Further database interfaces in preparation.
    • Real-time integration of external input into analyses. Live database input in preparation.
    • External C library for exchanging Bro events with external programs. Comes with Perl, Python, and Ruby bindings.
    • Ability to trigger arbitrary external processes from within the scripting language.

You can download The Bro here:

bro-2.2.tar.gz

Or read more here.