Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

05 September 2013 | 3,804 views

Just Crypt It – How To Send A File Securely Without Additional Software

Prevent Network Security Leaks with Acunetix

I’m pretty sure everyone has to send files to someone else online at some point, I’ve found myself having to do it quite often. And there’s always a quandary when it comes to sending something that is somewhat confidential. How do you secure it in transit?

We generally have a few options –

1) Passworded MS document (Excel/Word etc)
2) Passworded .zip file
3) Encrypt the file using something stronger (GPG/PGP or some kind of encrypted container)

As for 1) and 2) they aren’t really secure at all, and as for 3) whoever is receiving the file needs to have the same software installed and your key to decrypt it – which in the majority of cases isn’t going to work.

Then you need to find somewhere to upload it (Dropbox/FTP/Yousendit etc)

Pretty much everyone you know would look at you blankly if you asked them to install GnuPG.

So now a new tool is coming out called Just Crypt It which should solve all of our problems, if you are interested in finding out more you can check out the webinar here on Sept 7th at 1PM EST / 7PM CET (Saturday).

Just Crypt It

Sign-up For The Just Crypt It Webinar

See you there :)



10 July 2013 | 6,887 views

Smooth-Sec – IDS/IPS (Intrusion Detection/Prevention System) In A Box

We haven’t written about Smooth-Sec for a while since we first heard about it at v1 in March 2011.

For those who are not familiar, Smooth-Sec is a fully-ready IDS & IPS (Intrusion Detection & Prevention System) Linux distribution based on Debian 7 (wheezy), available for 32 and 64 bit architecture. The distribution includes the latest version of Snorby, Snort, Suricata, PulledPork and Pigsty. An easy setup process allows to deploy a complete IDS/IPS System within minutes, even for security beginners with minimal Linux experience.

  • Debian 7 Wheezy based
  • 32 and 64 bit iso available. Snorby V 2.6.2
  • Snort V 2.9.4.6
  • Suricata V 1.4.3
  • Pigsty V 0.1.0
  • PulledPork V 0.6.1

You can download Smooth Sec here –

32-Bit – smoothsec-3.0-i386.iso
64-Bit – smoothsec-3.0-amd64.iso

Or read more here.


18 June 2013 | 3,049 views

PRISM, Edward Snowden, Big Brother & More Stuff We Already Knew

So there’s been 100s of articles posted about PRISM, which also now has a lengthy Wikipedia article – PRISM (surveillance program). Apparently PRISM (2007-present) is the program that replaces the previous (2001-2007) NSA warrantless surveillance program.

So the US government has been watching everyone, no shit (Nineteen Eighty-Four?).

PRISM is a clandestine national security electronic surveillance program operated by the United States National Security Agency (NSA) since 2007. PRISM is a government codename for a data collection effort known officially as US-984XN. It is operated under the supervision of the United States Foreign Intelligence Surveillance Court pursuant to the Foreign Intelligence Surveillance Act (FISA).

The existence of the program was leaked by NSA contractor Edward Snowden and published by The Guardian and The Washington Post on June 6, 2013. A document included in the leak indicated that the PRISM SIGAD was “the number one source of raw intelligence used for NSA analytic reports.”The President’s Daily Brief, an all-source intelligence product, cited PRISM data as a source in 1,477 items in 2012. The leaked information came to light one day after the revelation that the United States Foreign Intelligence Surveillance Court had been requiring the telecommunications company Verizon to turn over to the NSA logs tracking all of its customers’ telephone calls on an ongoing daily basis.

It’s a revelation for a lot of people however, who are unaware of how easy it is to capture data online (that isn’t encrypted) – like e-mail for example. I’ve always told people don’t write anything in an e-mail that you wouldn’t write on a post-card – because reading them both is at about the same difficulty level.

Most people think because they are logged onto Gmail/Hotmail etc using https, that their transmissions are secure. But unfortunately the majority of the e-mail infrastructure is using zero encryption – so all your messages are floating around in plain text, unless of course you are using PGP/GPG – they you are pretty safe. But how many people do that, and it requires both sender and receiver to using the same system.

There are of course specialist e-mail services for the paranoid like Hushmail Tormail.

It’s a big kick in the face for the US Government though with their hyperbole about freedom, now it turns out they are invading the whole World’s privacy and ignoring human rights.

There have been statements from Microsoft, Yahoo!, Google, Facebook, Apple & Dropbox stating they do not take part in PRISM and that they do not give any direct server access to any agencies.

The guy that kicked this whole thing off was Edward Snowden, who intentionally revealed his identity and is ready to deal with the consequences. More here – Edward Snowden: the whistleblower behind the NSA surveillance revelations.

He was basically a sys admin for a government contractor called Booz Allen Hamilton, parked under the NSA in Hawaii. As we all known, sys admins typically have full access to EVERYTHING, ever server, every system – as they need it to do their job.

Very few companies implement silos, or transparent encyrption to protect themselves from sys admins. More on that discussion here – Prism doesn’t have CIOs in a panic — yet .

Either way, it’s a pretty interesting story and it’s getting spectacular global press coverage – there’s plenty more to read if you’re interested.


12 June 2013 | 2,923 views

OWASP Bricks – Modular Deliberately Vulnerable Web Application

Bricks, a deliberately vulnerable web application built on PHP & MySQL focuses on variations of commonly seen application security vulnerabilities & exploits, which can be exploited using tools (Mantra & ZAP). The mission is to ‘break the bricks’.

Road Map

  1. Demonstrate maximum variations of most common vulnerabilities
  2. Help people to learn the need of secure codding practices and SSDLC
  3. Attract people to design more bricks
  4. Become a test bed for analyzing the performance of web application security scanners.
  5. Help people learn the manual method of testing the applications
  6. Demonstrate the possibilities of various security tools and techniques
  7. Become a platform to teach web application security in a class room/lab environment.

It’s a great way to learn the basics of web security, both from a developers perspective and from someone interesting in learning pen testing for web apps, if you want to check out more projects similar to Bricks, there a whole bunch here:

Vulnerable Web Application

You can download Bricks here:

OWASP Bricks – Torsa.zip

Or read more here.


30 May 2013 | 1,473 views

4 Former LulzSec Members Sentenced To Prison Time In The UK

It’s been a while since we’ve talked about any hacking related arrests, or in this case, imprisonments. In this case, it’s some ‘ex’ members of LulzSec, for the attacks they perpetrated in 2011.

The longest of the sentences being 32 months, almost 3 years for the guy that operated and managed the botnet used in some of the LulzSec attacks.

I wonder if all these successful prosecutions can be attributed to the former LulzSec leader, Sabu, who flipped and informed for the FBI.

Four British men associated with the LulzSec hacker collective received prison sentences Thursday for their roles in cyberattacks launched by the group against corporate and government websites in 2011.

Ryan Cleary, 21, Jake Davis, 20, Ryan Ackroyd, 26, and Mustafa Al-Bassam, 18, were sentenced Thursday in London’s Southwark Crown Court after previously pleading guilty to charges of carrying out unauthorized acts with the intention of impairing the operation of computers.

Davis, who was known online as “Topiary,” received a two-year prison sentence. He acted as a spokesperson for LulzSec, writing some of the hacker group’s announcements and managing its website and Twitter account.

Ackroyd, who posed as a 16-year-old girl online and used the alias “Kayla,” received a 30-month prison sentence, while Mustafa al-Bassam, who used the online alias “T-Flow,” received a 20-month suspended prison sentence and was ordered to perform 200 hours of unpaid community work.

Cleary, who used the online alias “Viral,” received a 32-month prison sentence. He was not one of the LulzSec core members, but was associated with the group and operated a botnet that was used to launch DDoS (distributed denial-of-service) attacks against LulzSec’s targets.

LulzSec’s members went on a hacking spree between May and June 2011, targeting various companies and government agencies. They used hacking methods and tools to break into websites and leak the information found in their databases, including the personal details of thousands of users, and also launched DDoS attacks to make websites inaccessible.

The attacks carried out were fairly widespread and included major corporations as well as US and UK governmental organizations. Data was captured and leaked and large scale sustained DDoS sustained were used against prominent sites.

We are still in a fairly immature legal situation for cyberattacks, so we tend to see sentences vary a lot. I’m pretty sure these guys will end up in some cushy white collar prison rather than in with hardcore criminals.

Some of LulzSec’s targets included Sony, Nintendo, News Corp., Bethesda Game Studios, the CIA, the FBI, the Arizona State Police and the U.K.’s Serious Organised Crime Agency (SOCA).

Andrew Hadik, a lawyer with the Crown Prosecution Service (CPS) in the U.K., characterized the actions of LulzSec’s members as “cowardly and vindictive.”

“The harm they caused was foreseeable, extensive and intended,” Hadik said in a statement published on the CPS blog. “Indeed, they boasted of how clever they were with a complete disregard for the impact their actions had on real people’s lives.”

Companies suffered financial losses and serious damage to their reputations, while hundreds of thousands of innocent individuals had their private details exposed as a result of the group’s actions, he said.

Another LulzSec member named Cody Andrew Kretsinger, from Decatur, Illinois, who used the online alias “recursion,” was sentenced in April to one year in federal prison for his role in LulzSec’s attack against Sony Pictures.

Hector Xavier Monsegur, the former leader of LulzSec, known online as “Sabu,” was arrested in June 2011 and agreed to act as an informant for the FBI. Monsegur pleaded guilty to multiple hacking offenses in relation to the group’s activity and is scheduled to be sentenced in August.

It’ll be interesting to see what else turns up in the LulzSec case, today Jeremy “anarchaos” Hammond announced that he’s pleading guilty after being in prison for 15 months. He pleaded guilty because of the stacked damages figures, with the inflated figures he could face up to 30 years in prison.

Even with the plea bargain he still faces up to 10 years locked up and has agreed to pay $250,000 in restitution.

Source: Network World


14 May 2013 | 13,534 views

PentesterLab.com – Excercises To Learn Penetration Testing

PentesterLab is an easy and straight forwards way to learn the basics of penetration testing. It provides vulnerable systems in a virtual image, and accompanying exercises that can be used to test and understand vulnerabilities.

Just decide what course you want to follow, download the course and start learning. You can easily run the course using VMware, no Internet access is required.

PentesterLab.com

What will you learn?

  • Basics of Web
  • Basics of HTTP
  • Detection of common web vulnerabilities:
    • Cross-Site Scripting
    • SQL injections
    • Directory traversal
    • Command injection
    • Code injection
    • XML attacks
    • LDAP attacks
    • File upload
  • Basics of fingerprinting

Requirements

  • A computer with a virtualisation software
  • A basic understanding of HTTP
  • A basic understanding of PHP
  • Yes, that’s it!

You can download the materials and ISO images here:

web_for_pentester.pdf (2.4M)
web_for_pentester.iso (64-bit, 175M, MD5: f6e0df10de6d410293ba7a838d31f917)
web_for_pentester_i386.iso (32-bit, 172M, MD5: 5e6cdf5fa3356a4c08b34ccd076a63ae)

Or read more here.


26 April 2013 | 3,435 views

New eLearnSecurity Course – WAPT – Web Application Penetration Testing

eLearnSecurity is coming out with a new course, it’s intended to be a comprehensive training on web application penetration testing with large coverage of the newest attack vectors introduced by HTML5 and other W3C protocols.

Over 40 new labs in the Coliseum cloud based virtual lab are included in the course.

eLearnSecurity

Course Description

The Web Application Penetration Testing course (WAPT) is the online, self paced training course that provides all the necessary advanced skills to carry out a thorough and professional penetration test against modern web applications. Thanks to the extensive use of Coliseum Lab and the coverage of the latest researches in the web application security field, the WAPT course is not only the most practical training course on the subject but also the most up to date. The course, although based on the offensive approach, contains, for each chapter, advices and best practices to solve the security issues detected during the penetration test.

Target Audience & Pre-requisites

The WAPT training course benefits the career of penetration testers and IT Security personnel in charge of defending their organization web applications. This course allows organizations of all sizes assess and mitigate the risk at which their web applications are exposed, by building strong, practical inhouse skills. Penetration testing companies can train their teams with a comprehensive and practical training course without having to deploy internal labs that are often outdated and not backed by solid theoretical material.

The student willing to enroll in the course must possess a solid understanding of web applications and web application security models. No programming skills are required, however snippets of Javascript/HTML/PHP code will be used during the course.

eWPT Certification

eWPT Certification

The WAPT course leads to the eWPT certification. The certification can be obtained by successfully completing the requirements of a 100% practical exam consisting in a penetration test of a real world complex web application hosted in our eLearnSecurity Hera labs.

An eWPT voucher is included in all the plans of the WAPT course.

Get More Info

If you want to read more and see the full Syllabus, you can download this:

http://www.elearnsecurity.com/collateral/syllabus_wapt.pdf

The course will be launching on April 29th and you can register for the launch webinar here:

https://www3.gotomeeting.com/register/571727142


18 April 2013 | 6,642 views

Large Scale Botnet Brute Force Password Cracking Against WordPress Sites

There have always been a lot of brute force attempts/bot scans and hacking attempts on WordPress hosted sites (due to flaws in the core and a multitude of insecure plugins) – this site being no exception (they’ve even done some minor damage before).

But things appear to have really ramped up recently with a large increase in brute force attacks on WordPress sites. It seems to be the work of a rather crude botnet, which hits up the normal admin username (along with a few others like test/root etc) with a bunch of common passwords. Once it gets in, it leaves a backdoor and adss itself to the botnet – and starts scanning for other victims.

Sucuri have confirmed that the number of brute force attacks in April is double than that of previous months in their blog post here – Mass WordPress Brute Force Attacks? – Myth or Reality

Hosting providers are reporting a major upsurge in attempts to hack into blogs and content management systems late last week, with WordPress installations bearing the brunt of the hackers’ offensive.

WordPress installations across the world were hit by a brute force botnet attack, featuring attempts to hack into installations using a combination of popular usernames (eg, “admin” and “user”) and an array of common passwords. Attacks of this type are commonplace; it is the sharp rise in volume late last week to around three times the normal volume rather than anything technically cunning or devious that has set alarm bells ringing.

The primary target appears to be WordPress installations but Joomla users also reportedly took a bit of a hammering.

Early suggestions are that hackers are looking to harvest “low-hanging fruit” as quickly as possible in order to gain access to a bank of compromised sites for follow-up malfeasance, which could be anything from hosting malware to publishing phishing pages or running some sort of denial of service attack. “It’s doorknob rattling, but on an industrial and international scale,” notes Paul Ducklin, Sophos’s head of technology for Asia Pacific.

This is a large scale attack though, well organized and very well distributed with over 90,000 IP addresses involved. So using something like the WordPress plugin Limit Login Attempts wouldn’t help much – as they are not sending many login requests from each IP address.

Cloudflare have already pushed out a block for this type of attack, both for paying and free customers – so if you’re using that you should be safe. (Patching the Internet in Realtime: Fixing the Current WordPress Brute Force Attack)

If you notice your admin login or blog in general is very sluggish, you might have already been hacked. The outgoing brute force attempts take a lot of server resources.

WordPress founder Matt Mullenweg said that the attack illustrates the need to use a distinct username and a hard-to-guess password, common-sense advice that applies to using web services in general, not just for blog administration.

Olli-Pekka Niemi, vulnerability expert at security biz Stonesoft, outlined the range of possible motives behind the attack.

“A concern of this attack is that by compromising WordPress blogs attackers may be able to upload malicious content and embed this into the blog,” Niemi said. “When readers visit the blogs in question they would be then be subject to attack, come under compromise and develop into botnets. The attacks against the word press blogs seem to be distributed, with automated attacks coming from multiple sources.”

Matt Middleton-Leal, UK & Ireland regional director of corporate security dashboard firm Cyber-Ark, said hacks on corporate blogs might be used as an access point to hack into other (more sensitive) enterprise systems. Weak passwords need to be changed pronto, he argues.

“Common usernames and weak passwords are extremely risky online, however, the dangers are compounded if users re-use the same login credentials for other sites. Once the bad guys have cracked a username and password, it’s extremely common that they’ll attempt to use the same combination for additional sites in the attempt to fraudulently use accounts, or access information such as credit card details or corporate data.

“If WordPress users have been targeted in this attack, they should immediately seek to change their username and password details for their WordPress account, but also for any other accounts for which they use the same credentials,” he added.

There’s not a lot of info going around on what happens after a site has been compromised, in technical terms anyway – so I can’t really comment on that. But if you have decent file permissions, a strong password, you have already deleted the admin user long ago you should be safe.

If you want to add another level, just htpasswd protect your wp-admin directory. That will stop this (and any other similar attacks) dead in it’s tracks.

Stay safe fellow WordPress users.

Source: The Register


03 April 2013 | 5,503 views

HoneyDrive Desktop v0.2 Released – Honeypot LiveCD

HoneyDrive is a virtual appliance (OVA) with Xubuntu Desktop 12.04 32-bit edition installed. It contains various honeypot software packages such as Kippo SSH honeypot, Dionaea malware honeypot, Honeyd low-interaction honeypot, Glastopf web honeypot along with Wordpot, Thug honeyclient and more. Additionally it includes useful pre-configured scripts and utilities to analyze, visualize and process the data it can capture, such as Kippo-Graph, Honeyd-Viz, and much more. Lastly, many other helpful security, forensics and malware related tools are also present in the distribution.

We wrote about HoneyDrive when it first surfaced and was quite unpolished, it’s come a long way since then! Here’s the original post:

HoneyDrive – Honeypots In A Box

The feature set is a lot more complete now, with a whole range of different honeypots available and some useful tools too:

  • Virtual appliance based on Xubuntu 12.04 Desktop.
  • Distributed as a single OVA file, ready to be imported.
  • Full LAMP stack installed (Apache 2, MySQL 5), plus tools such as phpMyAdmin.
  • Kippo SSH Honeypot, plus Kippo-Graph, Kippo2MySQL and other helpful scripts.
  • Dionaea malware honeypot, plus phpLiteAdmin and other helpful scripts.
  • Honeyd low-interaction honeypot, plus Honeyd2MySQL, Honeyd-Viz and other helpful scripts.
  • LaBrea sticky honeypot, Tiny Honeypot, IIS Emulator, INetSim and SimH.
  • A full suite of security, forensics and anti-malware tools for network monitoring, malicious shellcode and PDF analysis, such as ntop, p0f, EtherApe, nmap, DFF, Wireshark, ClamAV, ettercap, Automater, UPX, pdftk, Flasm, pdf-parser, Pyew, dex2jar and more.
  • Firefox plugins pre-installed, plus extra helpful software such as GParted, Terminator, VYM, Xpdf and more.

You can download HoneyDrive v0.2 here:

HoneyDrive_0.2_Nectar_edition.ova

Or read more here.


20 March 2013 | 2,552 views

Andrew Auernheimer AKA Weev Gets 41 Months Jail Time For GET Requests

This is a pretty sad case, and one which I’m sure all of us have followed since it first started. Surprisingly it hasn’t gotten a whole lot of media attention, but then this legal precedent sticks it to the man and has some consequences regarding the infosec industry – and who would want to publicize that right?

For those not familiar with the case and what went down, what Weev did was access a publicly available API and retrieved a bunch of publicly readable data.

Yah that’s it basically, but according to the US legal system and their interpretation of the CFAA (Computer Fraud and Abuse Act) – this deserves some fairly serious jail time.

Andrew Auernheimer, a member of the grey-hat hacking collective Goatse Security, has been sent down for three years and five months in the slammer after he helped leak users’ private email addresses via a flaw in AT&T’s servers.

Auernheimer, known online as Weev, received his sentence wearing shackles after he tried to bring a mobile phone into the courtroom. After completing his term he will have to pay over $72,000 in restitution to AT&T and undergo three years of supervised release.

“I didn’t come here today to ask for forgiveness,” Auernheimer told US District Judge Susan Wigenton, Bloomberg reports. “The Internet is bigger than any law can contain. Many, many governments that have attempted to restrict the freedoms of the Internet have ended up toppled.”

In 2010, Auernheimer found a flaw in a public-facing AT&T server that could be used, via the iPad’s integrated circuit card identifier (ICC-ID), to uncover the names and email addresses of 114,067 early adopters of Apple’s 3G-equipped fondleslab. His colleague Daniel Spitler wrote a PHP script called “iPad 3G Account Slurper” to harvest the data, and then handed it over to online magazine Gawker.

The data caused huge embarrassment to AT&T and Apple, since it included the personal emails of then-White House Chief of Staff Rahm Emanuel, New York Mayor Michael Bloomberg, film mogul Harvey Weinstein, and several high-ranking US Army officials. AT&T fixed the flaw, and there’s no evidence Auernheimer did anything more than highlight the sloppy coding.

Something else which I personally find weird about this case is that Weev didn’t even write or execute the program that did the harvesting of the ‘sensitive’ information from AT&T, it was Daniel Spitler.

So how does Auernheimer end up in the hot seat for it? For being a troll and a public figure I guess. His lawyer did try to explain that he was accessing information on a publicly available Internet server – there was no password cracking or software hacking involved.

His defense lawyers argued that he was accessing information on a public web server and that if this was a crime then most internet users are guilty too. This cut little ice with the presiding judge.

“While you consider yourself to be a hero of sorts, without question the evidence that came out at trial reflected criminal conduct,” Judge Wigenton said in imposing the sentence. “You’ve shown absolutely no remorse. You’ve taken no responsibility for these criminal acts whatsoever. You’ve shown no contrition whatsoever.”

Auernheimer’s colleague Spitler now looks likely to face a similar sentence after pleading guilty, andsome in the security field are warning that the verdict will have a deadening effect of flaw exposure. Former National Security Agency (NSA) programmer and now Apple-cracker and security consultant Charlie Miller said the decision was highly troublesome.

In this hack’s opinion, Auernheimer’s sentence is far too severe. You could argue that he should have submitted the flaw to AT&T, waited for the problem to be fixed, and then reaped the publicity. He could also have profited from selling the flaw on the grey or black markets, but chose not to go for the money, but to get embarrassment value instead.

“My regret is being nice enough to give AT&T a chance to patch before dropping the dataset to Gawker. I won’t nearly be as nice next time,” he said in a Reddit forum.

I guess he won’t have to serve the full sentence (if he behaves himself), but he’s still facing a fair old stretch in the slammer. It seems more like a grudge sentence than anything else, because he took no responsibility, wouldn’t apologise and has shown zero remorse.

Judges can get ticked off by such behaviour. Oh well, poor Weev – either way I’m pretty sure we haven’t heard the last of him.

Source: The Register