Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

03 March 2015 | 2,082 views

Appie – Portable Android Security Testing Suite

Don't let a Dragon into your website!

Appie is a collection of software packages in a portable Windows format to help with Android security testing, specifically penetration testing Android applications. Appie since its latest release can also help with security assessments, forensics and malware analysis.

It is completely portable and can be carried on USB stick or your smartphone.

Appie – Android Portable Pen-testing Suite

Appie was designed to avoid the use of heavy/large VM machines and the associated images, instead choosing to run the apps on the host machine using a portable console emulator for Windows (cmder).

Various tools are included such as:

You can download Appie here:

Appie2.zip

Or read more here.

Advertisements



01 March 2015 | 2,240 views

CMSmap – Content Management System Security Scanner

CMSmap is a Python open source Content Management System security scanner that automates the process of detecting security flaws of the most popular CMSs. The main purpose of CMSmap is to integrate common vulnerabilities for different types of CMSs in a single tool.

At the moment, CMSs supported by CMSmap are WordPress, Joomla and Drupal. This is as opposed to tools like WPScan or Droopescan which just specialise in the security of a single CMS system.

CMSmap - Content Management System Security Scanner

Please note that this project is an early state. As such, you might find bugs, flaws or mulfunctions. Use it at your own risk!

Usage

You can grab CMSmap by cloning their Github repo:

Or read more here.


26 February 2015 | 822 views

Google Expands Pwnium Year Round With Infinite Bounty

There are various bug bounty programs, with Google being one of the forerunners in the field – Twitter was late to the party just joining in September 2014.

The latest development is that Google is stopping the annual Pwnium hack fest aimed at the Chromium project to stop bug hoarding, which makes Pwnium essentially a never ending hack-fest that anyone can submit to at any time.

Google Expands Pwnium Year Round With Infinite Bounty

Which makes sense for Google really, they get the bugs faster – with the chances that multiple people have spotted the same bugs (including the blackhat market), the sooner they fix stuff the better.

Google is vastly expanding its popular annual Pwnium hack fest, by allowing hackers to vie try for limitless amounts of cash every day of the year. The contest was previously held once a year at the CanSecWest conference in Canada, with millions in cash on offer to hackers who can take the shine off its Chromium project.

The Choc factory now wants hackers to submit their bad bugs and exploit code as soon as it surfaces, rather than hold it off for the one-day event. Chrome security hacker philanthropist Tim Willis says the “never-ending Pwnium” will cut down barriers for entry and incentives for bug hoarding.

“We’ve received some great entries over the years, but it’s time for something bigger,” Willis says. “Starting today, Pwnium will change its scope significantly, from a single-day competition held once a year at a security conference to a year round, worldwide opportunity for security researchers.

It seems like Google is willing to invest quite a lot of money in this, and the security of the browser. Also they’re probably banking on the fact most of the major bugs have already been found and paid out on – so they shouldn’t take too much of a hit.

And they can pay out over the year, rather than all on one day. Hey who am I kidding, they have more money than the GDP of many small countires – this is nothing to them.

“For those who are interested in what this means for the Pwnium rewards pool, we crunched the numbers and the results are in: it now goes all the way up to $∞ million.”

That infinity million was grounded by the top reward for any one bug being US$50,000, the lowest offering US$500. He says hackers with “Pwnium-quality” bug chains would likely hoard the report to claim a cash reward at the risk that code changes may require them to rework their efforts. Hackers too requested that they be able to report whenever they like through the Chrome Vulnerability Reward Program, Willis said.

Willis did not specifically rule out the one day CanSecWest contest although it appeared likely.

The infinite dollars is not for one bug though, it’s a theoretical amount if you discovered infinite different bugs in Chrome, you could get that much (with a cap at $50,000 maximum bounty for each single bug).

With the lowest being $500, that means for a mid-range bug you could be looking at a decent sum of money, worth a crack if it’s up your street skillset wise.

Source: The Register


24 February 2015 | 3,405 views

VScan – Open Source Vulnerability Management System

VScan is an open source Vulnerability Management System designed to make it easier for an organization to track vulnerability resolution and ensure anything found in their infrastructure is fixed.

VScan was created as after a vulnerability assessment it can sometimes be difficult to track the implementation of a security improvement program, so this tool can help you measure your progress and simplify the process of fixing any problems found.

VScan - Open Source Vulnerability Management System

Basically what you want to know is, how many vulnerabilities did we have before? And how many do we have now?

So that’s where VScan comes in, basically it’s a web front end for Nessus (or whatever else you want to plug in on the back end) and gives you scanning capabilities to online commercial scanners like Acunetix Online Vulnerability Scanner, with the ability to omit (false positives) or recheck issues after they’ve been fixed.

You can download VScan here:

VScan-BH_Arsenal.tar.gz

Or read more here.


17 February 2015 | 3,929 views

Windows Credentials Editor (WCE) – List, Add & Change Logon Sessions

Windows Credentials Editor (WCE) is a security tool to list logon sessions and add, change, list and delete associated credentials (ex.: LM/NT hashes, plaintext passwords and Kerberos tickets).

This tool can be used, for example, to perform pass-the-hash on Windows, obtain NT/LM hashes from memory (from interactive logons, services, remote desktop connections, etc.), obtain Kerberos tickets and reuse them in other Windows or Unix systems and dump cleartext passwords entered by users at logon.

Windows Credentials Editor (WCE) - List, Add & Change Logon Sessions

WCE is a security tool widely used by security professionals to assess the security of Windows networks via Penetration Testing. It supports Windows XP, 2003, Vista, 7, 2008 and Windows 8.

Features

  • Perform Pass-the-Hash on Windows
  • ‘Steal’ NTLM credentials from memory (with and without code injection)
  • ‘Steal’ Kerberos Tickets from Windows machines
  • Use the ‘stolen’ kerberos Tickets on other Windows or Unix machines to gain access to systems and services
  • Dump cleartext passwords stored by Windows authentication packages

WCE is aimed at security professionals and penetration testers. It is basically a post-exploitation tool to ‘steal’ and reuse NTLM hashes, Kerberos tickets and plaintext passwords which can then be used to compromise other machines. Under certain circumstances, WCE can allow you to compromise the whole Windows domain after compromising only one server or workstation.

You can download WCE here:

WCE v1.42beta (32-bit)
WCE v1.42beta (64-bit)

Or read more here.


12 February 2015 | 1,497 views

Facebook Launches ThreatExchange – Security Clearinghouse API

So Facebook has launched ThreatExchange, a social network for information security intelligence and cyberthreat sharing, how apt. They have signed up some fairly heavyweight partners from the get go with Bitly, Dropbox, Pinterest, Tumblr, Twitter and Yahoo! being involved initially.

With those kind of names, it’s a sure bet more people will jump on the bandwagon fairly shortly.

Facebook Launches ThreatExchange - Security Clearinghouse API

So yah, it’s gonna be successful – but is it going to be useful? ThreatExchange is an application programming interface that builds on Facebook’s internal threat system called ThreatData – which is basically a social system to share bad URLs and dangerous domains.

Facebook is teaming up with other big names on the interwebs to create a security information sharing portal, dubbed ThreatExchange*, which went live on Wednesday.

ThreatExchange is billed as a platform that enables security professionals to “share threat information more easily, learn from each other’s discoveries, and make their own systems safer”.

Facebook said that it’s built in a set of privacy controls so that “participants can help protect any sensitive data by specifying who can see the threat information they contribute.”

Threats like malware, spam and phishing typically go after multiple targets. Sharing threat intelligence improves collective defence against the bad guys, who are already collaborating, the argument goes.

The US Cyber Intelligence Sharing and Protection Act (CISPA), which allows private companies to share customer information with the NSA and others in the name of cybersecurity, has repeatedly failed to clear legislative hurdles.

Under that latest attempt to revive the proposed law, announced by President Obama last month, corporations and government would be obliged to share information about possible computer security vulnerabilities in order to make everyone more secure. The idea sounds like a winner but the problem is that organisations taking part will also pass on customer information to law enforcement, after taking “reasonable” steps to anonymise it. In return, they get threat intelligence from the Feds about the attack landscape.

Collaboration does work tho and with one of the biggest online entities leading it, the amount of data that this exercise should yield will be fairly impressive. What they’ve build is an API on top of ThreatData basically which allows access to the data in the system, and probably allows you to feed in bad URLs as well.

Business wise, should they giving this data away for free? Why not I say.

Privacy activists are dead against the idea, partly because experience has shown it’s very difficult to anonymise data in practice, as well as because of more general fears that information sharing represents another way for the NSA to hoover up yet more data into its vast data centre.

Groups like the Electronic Frontiers Foundation advocate use of information sharing hubs as an alternative. Facebook’s social network for threat sharing fits into that mould, when viewed from a charitable perspective. On the other hand, Facebook has a long history of shifting its privacy goalposts, at least with information supplied by consumers – and this makes the social network a mite difficult to trust.

Head honcho Mark Zuckerberg famously labelled early Facebookers “dumb fucks” for sharing their personal info on his network – which, let’s not forget, exists to allow its customers (i.e. advertisers) to sling better-targeted adverts at consumers.

Maybe Facebook is coming at ThreatExchange from a different angle. In fairness, other web 2.0 firms have already been convinced to collaborate with Facebook on ThreatExchange.

Early partners for ThreatExchange include Bit.ly, Dropbox, Pinterest, Tumblr, Twitter, and Yahoo. Facebook said that it expect new partners to jump on board as the platform grows. Information sharing has been going on in an ad-hoc basis in certain industries, particularly banking, for many years. Yet sharing e-mail and spreadsheets is too ad-hoc and inconsistent. It’s difficult to verify threats, to standardise formats, and for each company to protect its sensitive data. Commercial options can be expensive and many open standards require additional infrastructure, according to Facebook.

Facebook aims to plug the gap in existing approaches with builds on its internal ThreatData system to create a social platform designed for sharing indicators such as bad URLs and domains. Facebook is at pains to emphasise that it’s really serious about privacy, at least when it comes to the operation of ThreatExchange.

For the majority of netizens, this is good stuff – who doesn’t want to see less spam on Facebook and have malware threats auto-squashed? It’s a pretty healthy move for the Internet in general. I’m just interesting to see if anything else is going to spin off from this.

From the sign-up page, it seems like there’s an option to publish/push your own threat feed into ThreatExchange as well (hence the Exchange name I guess) so it’ll be interesting to see what happens from here on in.

Source: The Register


10 February 2015 | 1,593 views

Droopescan – Plugin Based CMS Security Scanner

Droopescan is a plugin-based CMS security scanner that that will help you with identifying issues with several CMSs, mainly Drupal & Silverstripe.

Droopescan aims to be the most accurate by default, while not overloading the target server due to excessive concurrent requests. Due to this, by default, a large number of requests will be made with four threads; change these settings by using the –number and –threads arguments respectively.

Droopescan - Plugin Based CMS Security Scanner

There are various other tools which perform similar functions such as CMS identification and issue detection:

WhatWeb – Identify CMS, Blogging Platform, Stats Packages & More
BlindElephant – Web Application Fingerprinter
wig – WebApp Information Gatherer – Identify CMS
Web-Sorrow v1.48 – Version Detection, CMS Identification & Enumeration
Wappalyzer – Web Technology Identifier (Identify CMS, JavaScript etc.)
WPScan – WordPress Security/Vulnerability Scanner

Droopescan is able to perform four kinds of tests:

  • Plugin checks: Performs several thousand HTTP requests and returns a listing of all plugins found to be installed in the target host.
  • Theme checks: As above, but for themes.
  • Version checks: Downloads several files and, based on the checksums of these files, returns a list of all possible versions.
  • Interesting url checks: Checks for interesting urls (admin panels, readme files, etc.)

Installation

Installation is easy using pip:

Manual installation is as follows:

The master branch corresponds to the latest release (what is in pypi). Development branch is unstable and all pull requests must be made against it.

You can download Droopescan following the instructions above or read more here.


05 February 2015 | 1,898 views

Anthem Hacked – US Health Insurance Provider Leaks 70 Million Records

Anthem Hacked! Everyone is screaming, I was like WTF is Anthem? Turns out it’s part of the 2nd largest health insurance provider in the US (Wellpoint) after United Healthcare – so it’s a pretty big deal with an estimated 70 Million people on its books.

Anthem Hacked - US Healthcare Provider Leaks Millions of Records

Of course according to them, “Anthem was the target of a very sophisticated external cyber attack” – yah, probably just a phishing e-mail or something right?

Hackers have invaded the servers of Anthem, a health insurer used by tens of millions of Americans, and stolen social security numbers, employment records, personal contact details and more. A veritable treasure trove for identity thieves.

Anthem, the US’s second biggest health insurer with about 70 million people on its books across the country, admitted late on Wednesday, Pacific time, that it has been comprehensively ransacked by criminals. Tens of millions of records are likely to have been obtained illegally as a result of the hack, Anthem warned.

If your plan is branded Anthem Blue Cross; Anthem Blue Cross and Blue Shield; Blue Cross and Blue Shield of Georgia; Empire Blue Cross and Blue Shield; Amerigroup; Caremore; Unicare; Healthlink; or DeCare, you are at risk – your data may have been taken by thieves.

Former Anthem customers are just as affected, we’re told. Jackpot.

The health giant, based in Indianapolis, has hired infosec biz Mandiant to work out which customers have had their files accessed. According to this official FAQ, “no diagnosis or treatment data was exposed” nor any credit card information.

It is not clear when the company’s databases were infiltrated nor precisely when the compromise was detected – just that it was discovered some time last week. Staff with high-level access to the IT systems have had their passwords reset, and those using single-factor authentication locked out, we’re told.

People whose records were slurped by the hackers will be warned by mail in the following days. Anthem is offering free credit and identity-theft monitoring cover to those hit by the network security breach.

If the statement by Anthem is true though, it’s not THAT bad for them as they haven’t lost any payment details (credit card numbers etc.) or any medical records. But identity theft wise it’s quite bad as they’ve lost names, social security numbers, addresses, contact details and so on.

As usual there’s no details on what actually went down, was this really a hack? Database compromise? Deep system access? Or access via vendor, or disgruntled employee? Not sure if we’ll ever get to learn more – but it’s happened.

As yet, no one is saying publicly who is behind the attack nor how they managed to infiltrate Anthem’s networks. The insurer says it is “doing everything it can to ensure there is no further vulnerability to its database warehouses.”

Register staff are among those at risk: Anthem Blue Cross is our healthcare insurer in California. Tonight, we received this email from Anthem CEO Joseph Swedish:

Anthem Blue Cross was the target of a very sophisticated external cyber attack. These attackers gained unauthorized access to Anthem’s IT system and have obtained personal information from our current and former members such as their names, birthdays, medical IDs/social security numbers, street addresses, email addresses and employment information, including income data.

Based on what we know now, there is no evidence that credit card or medical information (such as claims, test results or diagnostic codes) were targeted or compromised.

“Anthem’s own associates’ personal information – including my own – was accessed during this security breach. We join you in your concern and frustration, and I assure you that we are working around the clock to do everything we can to further secure your data,” the chief exec added.

“I want to personally apologize to each of you for what has happened, as I know you expect us to protect your information.”

Indeed we did. Popping a huge healthcare insurer was only a matter of time: the data will be worth a pretty penny, and all of it sitting there, conveniently in one place, just waiting to be seized.

They have set up a dedicated website http://www.anthemfacts.com/ (that doesn’t even have a TITLE tag..) for some info or call 1-877-263-7995 – the FBI is already investigating. Maybe it was the Koreans?

We shall keep our ears open for developments on this as it’s a BIG leak – it’d be great to get some technical details of what went down.

Source: The Register


03 February 2015 | 3,411 views

SnoopyPro – Windows USB Sniffer Tool

SnoopyPro is a lightweight, standalone (no installation necessary) USB sniffer tool, it will log all data exchange between USB Device and its driver under a Windows environment. It definitely works on Windows XP, unsure about newer versions.

SnoopyPro - Windows USB Sniffer Tool

SnoopyPro allows you to intercept, display, record and analyze USB protocol and all the data transferred between any USB device connected to your PC and applications. It can be successfully used in application development, USB device driver or hardware development and offers the powerful platform for effective coding, testing and optimization.

USB monitor is rather pricey but it costs $65USD, perhaps it’s time for someone to write an updated open-source USB sniffing/monitoring tool.

You can download USBSnoop here:

SnoopyPro-0.22.zip

Or read more here.


30 January 2015 | 2,490 views

GHOST Vulnerability In glibc – Everything You Need To Know

So the big panic in the past week or so has been about this GHOST vulnerability in glibc which under certain circumstances can allow remote code execution (serious business!).

So we’ve had Heartbleed, POODLE and Shellshock and now we have awfully cute GHOST.

GHOST Vulnerability In glibc

What is it?

The CVE for GHOST is – CVE-2015-0235, the technical explanation:

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka “GHOST.”

The patches were released by major vendors on January 27th, so most people should be patched by now. It’s pretty widespread because basically every Linux system has GNU C Library or glibc, so before patching pretty much every Linux system is vulnerable (apart from Ubuntu 14.04 LTS which is safe out of the box).

This server is still on Ubuntu 10.04 LTS, the patching looks as below, this was the output before patching:

And after:

Which is the patched version for Ubuntu 10.04 LTS.

Qualys managed to develop an actual working exploit for this by sending a specially crafted e-mail to an unpatched machine they could get a remote Linux shell. They claim that this bypasses all existing protections (like ASLR, PIE and NX) on both 32-bit and 64-bit systems.

The full technical analysis can be found here: GHOST-CVE-2015-0235.txt

Who is affected?

The first vulnerable version of the GNU C Library affected by this is glibc-2.2, released on November 10, 2000. It was fixed on May 21, 2013 (between the releases of glibc-2.17 and glibc-2.18). Unfortunately, it was not recognized as a security threat; as a result, most stable and long-term-support distributions were left exposed including Debian 7 (wheezy), Red Hat Enterprise Linux 6 & 7, CentOS 6 & 7, Ubuntu 12.04, for example.

They also tested a lot of software and found most of the major ones are not vulnerable (so stop panicking) – apache, cups, dovecot, gnupg, isc-dhcp, lighttpd, mariadb/mysql, nfs-utils, nginx, nodejs, openldap, openssh, postfix, proftpd, pure-ftpd, rsyslog, samba, sendmail, sysklogd, syslog-ng, tcp_wrappers, vsftpd, and xinetd are not vulnerable to GHOST.

So yah, it’s not that easy to exploit, it’s not the end of the Internet as we know it.

What should we do?

Update your packages ASAP! On Ubuntu/Debian based systems that’s as easy as:

You can check the version using the command:

Honestly if you’re unpatched, you’re not super likely to get hit by this – but there is a small risk so if you can, do patch.