Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

01 May 2014 | 753 views

Microsoft Confirms Internet Explorer 0-Day

Prevent Network Security Leaks with Acunetix

So during the past weekend, Microsoft confirmed an Internet Explorer 0-day that is actually being used in targeted online attacks.

Vulnerability in Internet Explorer Could Allow Remote Code Execution

It will be interesting to see if they push an out of band patch for this one or just wait for the next Patch Tuesday.

Internet Explorer 0-Day

It’s pretty serious as it effects the whole family including Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11.

On Saturday, late in the evening, Microsoft issued a public advisory confirming the existence of a new vulnerability in Internet Explorer that’s being used in targeted attacks online.

The vulnerability was disclosed by researchers at FireEye, who observed attacks against Internet Explorer versions 9 though 11. While criminals seem to be focused on the later releases, all versions of Internet Explorer are affected.

Exploits leveraging the use-after-free vulnerability will bypass protections in ASLR and DEP and gain code execution privileges.

In a blog post, FireEye explains:

“Threat actors are actively using this exploit in an ongoing campaign which we have named Operation Clandestine Fox. However, for many reasons, we will not provide campaign details. But we believe this is a significant zero day as the vulnerable versions represent about a quarter of the total browser market. We recommend applying a patch once available.”

The focus does seem to be on IE9 and 11 (which would be the most commonly used versions on newer operating systems (Windows 7 & 8).

EMET will help Microsoft says..

I would expect them to be pushing out a patch for this ASAP as it’s a pretty serious flaw.

In addition, FireEye researchers stated the group responsible for this exploit has had access to “a select number of browser-based 0-day exploits in the past.”

Moreover, the group is proficient at lateral movement, and have been difficult to track as they rarely reuse command and control infrastructure.

Until a patch is released, Microsoft has said that EMET will help mitigate attacks against this flaw.

Further, versions of Internet Explorer running with the default Enhanced Security Configuration are not at risk, provided that the malicious website used to target the vulnerability isn’t listed in the Trusted sites zone.

This is typically the case for Internet Explorer on Windows Server 2003, Windows Server 2008 (and 2008 R2), and Windows Server 2012 (and 2012 R2).

Microsoft hasn’t said if they will release an out-of-cycle patch for this flaw, only that they’ll take the “appropriate action” once the investigation is completed.

The next Patch Tuesday is due almost two weeks from now on Tuesday 13th May 2014, so that’s a fair bit of exposure if this exploit goes public.

We shall have to wait and see what happens, knowing Microsoft – not a lot.

Source: Network World



29 April 2014 | 1,165 views

BlindElephant – Web Application Fingerprinter

The BlindElephant Web Application Fingerprinter attempts to discover the version of a (known) web application by comparing static files at known locations against precomputed hashes for versions of those files in all all available releases. The technique is fast, low-bandwidth, non-invasive, generic, and highly automatable.

BlindElephant

BlindElephant can be used directly as a tool on the command line, or as a library to provide fingerprinting functionality to another program.

Features

  • Fast, low-resource approach (generally <6 seconds and < 400kb)
  • Support for 15 commonly deployed web apps (and hundreds of versions), and very easy to add support for more
  • Support for web app plugins (Drupal and WordPress currently, more with community input)

There are other similar projects such as:

- WAFP – Web Application Finger Printing Tool
- WhatWeb – Next Gen Web Scanner – Identify CMS (Content Management System)
- wig – WebApp Information Gatherer – Identify CMS
- Web-Sorrow v1.48 – Version Detection, CMS Identification & Enumeration
- Wappalyzer – Web Technology Identifier (Identify CMS, JavaScript etc.)

You can grab BlindElephant from the SVN repo here:

Or read more here.


24 April 2014 | 1,346 views

Viber Vulnerable To Man In The Middle Attack (MITM)

So this week, researchers at the University of New Haven have been focusing on Viber and have found that pretty much everything transferred and stored on the Viber service, except the messages themselves is not encrypted either in transit or at rest (doodles, images, location data & videos).

The implication of this is that the lack of encryption leaves Viber vulnerable to sniffing/snooping or MITM attacks via a rogue AP, a telco network or anyone else that can see the traffic in the pipe.

Viber Vulnerable to MITM

The same team published a similar WhatsApp location bug (the location image is sent unencrypted) last week on Youtube – WhatsApp Location Bug/Vulnerability.

Popular Whatsapp-like messaging service Viber is exposing users to man-in-the-middle and other attacks because it isn’t encrypting various data at rest and in transit, security researchers have warned.

The mobile app allows users to send each other messages, videos, images and “doodles”, share GPS location details and make voice calls.

However, researchers at the University of New Haven Cyber Forensics Research and Education Group (UNHcFREG) found a “serious security flaw” in the way Viber receives videos, images and doodle files; the way it sends and receives location data; and the way it stores data on its Amazon servers.

The team’s experimental network created a rogue access point utilising a Windows 7 PC’s Virtual Wi-Fi Miniport Adapter and a first smartphone connected to the same network. It then connected a second smartphone outside the network via GSM and used it to exchange data with the first smartphone over Viber.

It said that with tools such as NetworkMiner, Wireshark, and NetWitness it was able to capture traffic sent over the test network.

The 2nd worry here is that the data is stored on Amazon servers unencrypted, is not deleted immediately and can be accessed without any authentication! That means as long as you can capture the URLs of the videos/files, you can just put them into your browser and download them directly from Amazon.

You can view the video posted by the team here:

Viber Security Vulnerabilities: Images, Doodles, Location and Videos sent over Viber is unencrypted

Specifically, the team claimed that images, doodles and videos received are unencrypted; location data sent and received is unencrypted; and data is stored on the Viber Amazon servers in unencrypted format.

Further, it said user data stored on Viber’s Amazon servers is not deleted immediately and that it can be easily accessed without any authentication mechanism – “simply visiting the intercepted link on a web browser gives us complete access to the data”.

The researchers added the following:

Anyone, including the service providers will be able to collect this information – and anyone that sets up a rogue AP, or any man-in-the middle attacks such as ARP poisoning will be able to capture this unencrypted traffic and view the images and videos received as well as the locations being sent or received by a phone.

UNHcFREG said it had already informed Viber of the security flaws but received no word back at the time of publishing. A video of the test (h/t The Hacker News) can be found here.

It recommended Viber ensure all data in transit is sent over an encrypted tunnel, that data is encrypted properly when saved and that it access to it must require authentication.

The Israeli-backed messaging service, based in Cyprus, was recently acquired for $900 million by Japanese e-commerce giant Rakuten in a bid to take the firm “to a different level”.

I would imagine with the press/media coverage this flaw is getting, Viber will have to fix this pretty sharp. Honestly with the processing power of phones now, encryption at all stages should no longer be an option or an afterthought – it should be mandatory in everything.

Seen as though they’ve taken a look at Viber and WhatsApp – I wonder what will be next? LINE, Wechat? KakaoTalk?

Source: The Register


22 April 2014 | 1,408 views

RAWR – Rapid Assessment of Web Resources

Introducing RAWR (Rapid Assessment of Web Resources). There’s a lot packed in this tool that will help you get a better grasp of the threat landscape that is your client’s web resources. It has been tested from extremely large network environments, down to 5 node networks. It has been fine-tuned to promote fast, accurate, and applicable results in usable formats. RAWR will make the mapping phase of your next web assessment efficient and get you producing positive results faster!

RAWR - Rapid Assessment of Web Resources

Along the same line as tools like EyeWitness – A Rapid Web Application Triage Tool – and others which are useful for the Information Gathering stage of a pen-test or vulnerability assessment.

Features

  • A customizable CSV containing ordered information gathered for each host, with a field for making notes/etc.
  • An elegant, searchable, JQuery-driven HTML report that shows screenshots, diagrams, and other information.
  • a CSV Treat Matrix for an easy view of open ports across all provided hosts. (Use -a to show all ports.)
  • Default password suggestions using a list compiled from several online sources.
  • Supports the use of a proxy (Burp, Zap, W3aF)
  • Captures/stores SSL Certificates, Cookies, and Cross-domain.xml
  • Customizable crawl of links within the host’s domain.
  • PNG Diagram of all pages found during crawl
  • List of links crawled in tiered format.
  • List of documents seen for each site.
  • Automation-Friendly output (JSON strings)

Requirements

  • nmap – at least 6.00 – required for SSL strength assessment
  • graphviz – site diagram from crawl (optional)
  • python-lxml – parsing xml & html
  • python-pygraphviz – site layout from crawl (optional)
  • phantomJS – tested with 1.9.1, can be downloaded/installed in local folder during –check-install

You can download RAWR 1.1 here by checking it out from Bitbucket:

Or read more here.


17 April 2014 | 940 views

Royal Canadian Mounted Police Arrest Heartbleed Hacker

The Heartbleed Bug was the big thing last week and honestly pretty much the biggest thing this year so far.

And it turns out someone has been caught using the Heartbleed bug in a malicious way and in Canada no less. The young Heartbleed hacker goes is a 19 year old Stephen Arthuro Solis-Reyes and hails from London, Ontario.

It seems he was using Heartbleed against the tax system in Canada (CRA or the Canada Revenue Agency).

Hearbleed Hacker in Canada

Cops in Canada have arrested a teen they believe to be behind an attack on the country’s tax system using the Heartbleed bug.

The Royal Canadian Mounted Police (RCMP) said 19-year-old Stephen Arthuro Solis-Reyes of London, Ontario, was cuffed and charged with the unauthorized use of a computer and criminal mischief in relation to the theft of taxpayers’ personal records from the Canada Revenue Agency (CRA).

“The RCMP treated this breach of security as a high priority case and mobilized the necessary resources to resolve the matter as quickly as possible,” assistant commissioner Gilles Michaud said in a statement.

“Investigators from National Division, along with our counterparts in [Ontario] Division have been working tirelessly over the last four days analyzing data, following leads, conducting interviews, obtaining and executing legal authorizations and liaising with our partners.”

He must be pretty n00b tbh if he wasn’t proxying/bouncing his IP around/using TOR/VPNs etc and gets caught in 4 days. But the majority of people that get caught for ‘hacking’ are at that level – script kiddy level.

They get a tool like Heartbleed, and run it against a server without really understanding what is going on – and how easily they can be caught. And then boom – they are in prison trying not to drop the soap.

Solis-Reyes is alleged to have exploited the Heartbleed vulnerability, present in OpenSSL running on the CRA’s servers, to swipe 900 social insurance numbers. The CRA believes that whoever hacked the systems gathered the sensitive information during a six-hour window on April 9, which was after the first public reports of the flaw and before the computers were patched.

The attack marked one of the first known instances of hackers actively exploiting the Heartbleed condition in the wild to steal user data. Though if reports are to be believed, the NSA and (likely) other government organizations have been exploiting the flaw for years in order to gather intelligence info.

The RCMP reported that it arrested Solis-Reyes without incident on April 15. The Mounties also seized computer equipment from his home. He is scheduled to appear before a court in Ottawa on July 17 to begin trial.

The investigation is still ongoing, although the Mounties did not report of any other persons involved in the attack.

So far I haven’t seen anyone else getting arrested for exploiting Heartbleed, and by now Stephen is pretty much World famous. It’ll be interesting to see if any other cases come out, I’m not sure if social insurance numbers are valuable in Canada – or if you could do anything with them – or sell them?

Here’s the algorithm and analysis – Social Insurance Number Authentication

Source: The Register


15 April 2014 | 3,302 views

Kvasir – Penetration Testing Data Management Tool

Penetration Testing Data Management can be a nightmware, because well you generate a LOT of data and some information when conducing a penetration test, especially using tools – they return lots of actual and potential vulnerabilitites to review. Port scanners can return thousands of ports for just a few hosts. How easy is it to share all this data with your co-workers?

Kvasir - Penetration Testing Data Management Tool

Features

That’s what Kvasir is here to help you with. Here’s what you’ll need to get started:

  • The latest version of web2py
  • A database (PostgreSQL known to work)
  • A network vulnerability scanner (Nexpose/Nmap supported)
  • Additional python libraries
  • Kvasir is a web2py application and can be installed for each customer or task.

Tools Supported

At current release, Kvasir directly supports the following tools:

This design keeps data separated and from you accidentally attacking or reviewing other customers.

This tool was developed primarily for the Cisco Systems Advanced Services Security Posture Assessment (SPA) team. While not every method used by the SPA team may directly relate we hope that this tool is something that can be molded and adapted to fit almost any working scenario.

Installation

Kvasir was primarily designed for use on short customer-focused engagements. A directory ‘application’ for each customer would be used allowing for much stronger data separation.

For example lets assume two customers, Foo Widgets and Bar Napkins.

Data for each customer is stored in /opt/data/$CUSTOMERNAME

Install Kvasir in each customer’s directory:

Now symbolically link Kvasir to the web2py application directory:

Create unique databases:

Copy the kvasir.yaml.sample to kvasir.yaml and change the defaults:

Or read more here.


09 April 2014 | 4,207 views

Heartbleed Bug SSL Vulnerability – Everything You Need To Know

Introduction

So the Internet has been exploding this week due to the Heartbleed Bug in OpenSSL which effects a LOT of servers and websites and is being hailed by some as the worst vulnerability in the history of the Internet thus far.

Heartbleed Bug

The main info on the bug can be found at http://heartbleed.com/. In basic terms, it allows you to grab 64kb chunks of whatever is stored in RAM on the server as long as it’s using a vulnerable version of OpenSSL with Heartbeat enabled.

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

Who needs the NSA when we have this eh?

So ya this is really serious, a scanner was released before anyone had chance to patch it and huge sites like Yahoo! Mail were vulnerable and exposing user passwords to anyone who used Heartbleed against it.

Everyone scrambled to fix it fast though, which is good – as it’s a major vulnerability. As can be seen in this picture, the plain text user passwords for Yahoo! mail were being leaked.

Hashing is irrelevant in this case, as the hash and hash comparison are done on the server side, so the plain text password is stored in memory at some point.

Yahoo! Heartbleed

The bad part of it is that there’s no way to tell if it’s been exploited as there’s no crash, no damage, it just spits out the data to whoever runs the exploit.

There’s a good analysis of the actual code involved here:

Diagnosis of the OpenSSL Heartbleed Bug

What Should I Do?

Well you need to check if any of the servers you manage or run are using a vulnerable version of OpenSSL, from my experience if you are still on Ubuntu 10.04 LTS you are safe from this, as it uses OpenSSL 0.9.8 without heartbeat functionality.

If you are using Ubuntu 12.04 LTS (any subversion) then you ARE vulnerable and need to update ASAP.

IF you want to scan your servers you can grab the scanning script here:

heartbleed.py

There are also a couple of online scanners you can use (just beware of false positives).

- http://rehmann.co/projects/heartbeat/
- http://filippo.io/Heartbleed/

On the server side, you can check your OpenSSL version with:

openssl version -a

Don’t pay attention to the version or date, but look at the build date – it should be AFTER April 7th.

Something like this would be a vulnerable version:

OpenSSL 1.0.1 14 Mar 2012
built on: Wed Jan 8 20:45:51 UTC 2014

After updating it should look like:

OpenSSL 1.0.1 14 Mar 2012
built on: Mon Apr 7 20:33:29 UTC 2014

How Do I Fix It?

For the majority of people, someone else probably hosts your sites and infrastructure, so you don’t need to worry that much – just change your passwords if you’re paranoid and make sure you enable 2 factor auth for anything that supports it.

Services like the Linode Nodebalancer with SSL termination have been updated, but do bear in mind your secret key could have been leaked (although, logically that’s pretty unlikely).

Linode – Heartbleed

On Ubuntu 12.04 it’s as simple as doing aptitude update; aptitude safe-upgrade -y; and then restarting all relevant services, or simply rebooting.

Ensure the build date is at minimum 2014-04-07.

If you want to check what services are using OpenSSL you can do:

lsof -n | grep ssl | grep DEL

That fixes the bug, but remember it doesn’t change the fact that your secret keys/passwords could have been leaked, there has also been reports of 2FA session tokens being leaked among other stuff.

So to be secure, you really need to revoke all your SSL certificates, regenerate a new private key and csr, and regenerate your SSL certs.

And of course, change all your passwords.

More Reading

- Amazon Linux AMIs are updated.
- Why Heartbleed is the most dangerous security flaw on the web
- Critical crypto bug exposes Yahoo Mail, other passwords Russian roulette-style
- Hacker News – The Heartbleed Bug
- Reddit – The Heartbleed Bug


07 April 2014 | 2,027 views

Sysdig – Linux System Troubleshooting Tool

Sysdig is open source, Linux System Troubleshooting Tool: capture system state and activity from a running Linux instance, then save, filter and analyze. Think of it as strace + tcpdump + lsof + awesome sauce. With a little Lua cherry on top.

Sysdig

Sysdig was born from a team’s constant frustration. System level troubleshooting is just way more of a pain than it should be — especially in distributed, virtualized, and cloud-based environments. So they took the lessons they learned while building network monitoring tools like WinPCap and Wireshark and created a new kind of system troubleshooting tool for Linux.

Sysdig captures system calls and other system level events using a linux kernel facility called tracepoints, which means much less overhead than strace.

It then “packetizes” this information, so that you can save it into trace files and filter it, a bit like you would do with tcpdump. This makes it very flexible to explore what processes are doing.

Sysdig is also packed with a set of scripts that make it easier to extract useful information and do troubleshooting.

To install Sysdig, just run this with sudo or as root:

Or read more here.


03 April 2014 | 693 views

Oracle Java Cloud Service Vulnerabilities Publicly Disclosed

Security researches from the Polish firm Security Explorations have released a massive slew of PoC code and technical details on 30 Oracle Java Cloud Service Vulnerabilities.

Java Cloud Vulnerabilities

It seems like they had already reported them to Oracle, but weren’t happy with how things were handled, so have decided to go public with the weaknesses. They gave them a fair amount of time too, over 2 months to address the issues in the cloud data centers.

As a fairly new service though, it seems Oracle is having some issues with policies and handling incidents like this for their cloud service.

Security researchers released technical details and proof-of-concept code for 30 security issues affecting Oracle’s Java Cloud Service, some of which could allow attackers to compromise business-critical Java applications deployed on it.

Researchers from Polish security firm Security Explorations, who found many Java vulnerabilities in the past, decided to publicly disclose the Java Cloud Service security weaknesses because they weren’t satisfied with how Oracle handled their private report.

“Two months after the initial report, Oracle has not provided information regarding successful resolution of the reported vulnerabilities in their commercial cloud data centers (US1 and EMEA1 respectively),” Adam Gowdiak, the CEO and founder of Security Explorations, said Wednesday via email.

“Instead, a year and a half after the commercial availability of the service, Oracle communicates that it is still working on cloud vulnerability handling policies,” he said. “Additionally, the company openly admits that it cannot promise whether it will be communicating resolution of security vulnerabilities affecting their cloud data centers in the future.”

The Oracle Java Cloud Service allows customers to run Java applications on WebLogic server clusters in data centers operated by Oracle. The service provides “enterprise security, high availability, and performance for business-critical applications,” Oracle says on its website.

According to a disclosure timeline published by Security Explorations, the company notified Oracle of 28 security issues on Jan. 31 and another two issues on Feb. 2.

It seems like Oracle has a fair amount of security measures built into the Java cloud (whitelisting, sandboxes etc) – but they don’t work properly. Which in my view, is often more dangerous than having none at all.

If people know there are no security measures, they will act and configure accordingly – especially for tech-centric platforms like this. But when the vendor, in this case Oracle, claims there are strong security measures in place – people will tend to relax their own implementation a little.

The reported issues include bypasses of the Java security sandbox, bypasses of the Java API whitelisting rules, the use of shared WebLogic server administrator passwords, the availability of security-sensitive plaintext user passwords in Policy Store, the use of outdated Java SE software on the service that was lacking around 150 security fixes, and issues that enable a remote code execution attack against a WebLogic server instance used by other Oracle Java Cloud users.

“We found a way for a given user of Oracle Java Cloud service to gain access to applications and data of another user of the service in the same regional data center,” Gowdiak said. “By access we mean the possibility to read and write data, but also execute arbitrary (including malicious) Java code on a target WebLogic server instance hosting other users’ applications; all with Weblogic server administrator privileges. That alone undermines one of key principles of a cloud environment — security and privacy of users data.”

Potential attackers only need one-time access to the service to learn its specifics and can later break into all Java Cloud user accounts from the public Internet, Gowdiak said. Attacks can also be carried out from trial accounts because there’s no separation between trial users and paying customers in the regional data centers, he said.

Oracle confirmed the 30 vulnerabilities on Feb. 12, but failed to provide Security Explorations with a monthly report on their status in March, as it had been agreed, Gowdiak said.

They are some quite serious issues too, allowed users to gain access to userspace of another user in the same regional DC. Oracle has confirmed the vulnerabilities, but as of yet – has failed to provide any status updates regarding fixes/improvements/patches etc.

The attacks can also be carried out from a trial user account as there is no separation between trial users and paying customers. It seems like a generally poor architecture and sloppy design by Oracle – I hope this makes them really step up their game.

Source: Network World


01 April 2014 | 1,484 views

Agnitio v2.1 Released – Manual Security Code Review Tool

A tool to help developers and security professionals conduct manual security code reviews in a consistent and repeatable way. Agnitio aims to replace the adhoc nature of manual security code review documentation, create an audit trail and reporting.

It hasn’t been updated for a fair while sadly, and v2.1 was released in 2011 – but still it’s a useful tool and a decent update. The last time we wrote about it was when Agnitio v2.0 was released back in August 2011.

Agnitio - Security Code Review

The major changes in v2.1 are listed below:

  • Windows x64 support
  • Automatically decompile Android .apk application to easily analyse the apps source code
  • Application profiles now have an application type of either web or mobile which allows only relevant checklist items to be displayed during the security code review
  • Create new checklist questions and mark them as web or mobile
  • C# and Java rules from the OWASP Code Crawler project have been imported into the Agnitio database and linked to relevant checklist questions

You can download Agnitio v2.1 here:

x64 – Agnitio x64.zip
x86 – Agnitio x86.zip

Or read more here.