Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

10 October 2013 | 1,249 views

AVG, Avira and WhatsApp Websites DNS Jacked By Pro-Palestinian Hacktivists

Prevent Network Security Leaks with Acunetix

There’s been a spate of these type of attacks this year, it seems like hackers are realizing the target servers and sites are pretty secure – so they are looking for other avenues to deface or spread their political messages.

DNS security has been overlooked for a long time, with most companies not using DNSSEC or any real protective measures. With DNS being such a critical service, this is rather worrying, as a tainted DNS record enables a hacker to take over an entire domain.

The websites of freebie antivirus vendors AVG and Avira as well as mobile messaging service WhatsApp appear to have been hit by a DNS redirection attack today which sent users to pro-Palestinian websites.

A team of hacktivists calling themselves KDMS have claimed credit for the hacks.

Visitors to avg.com were greeted by a rendition of the Palestinian national anthem (via an embedded YouTube video) and a message from a pro-Palestinian group calling itself the KDMS Team, instead of the usual security tips and links to anti-malware downloads.

“It’s clearly embarrassing for a security company to be hit in this fashion by hackers, but there is no indication that any customer information or sensitive data has been compromised,” writes Graham Cluley, a veteran of the antivirus industry turned independent security consultant. “It’s possible that the hackers managed to change the website’s DNS records, redirecting anyone who attempted to visit www.avg.com to a different IP address.”

It seems all 3 companies used Network Solutions as their DNS provider, so the flaw clearly lay there – what exactly happened hasn’t been disclosed (and honestly is unlikely to be disclosed).

The bad thing about DNS as well, is it takes time to change and propagate. So those people using ISPs that have aggressive DNS caching, might be seeing the hacked sites for quite some time.

Security experts were quick to discover that all three victims use hosting biz Network Solutions as their DNS provider. Hackers may have exploited security shortcomings at Network Solutions to alter DNS records and so gain control of their targets’ domains.

The KDMS team claims an affiliation with Anonymous Palestine. The same group pulled off a similar DNS hijack / redirection attack against the website of hosting firm leaseweb.com over the weekend.

LeaseWeb’s statement on the attack can be found here.

Leaseweb denied earlier reports that a vulnerability in its WHMCS billing and support system software might have been responsible for the hijack, but without naming a cause. The hosting firm is seeking to play down the significance of the attack, which it characterises as regrettable but superficial and quickly resolved.

You can also read more and see a screenshot of the hack at Graham Cluley’s blog here:

AVG and Avira anti-virus websites attacked by pro-Palestinian hackers

Let’s see if we see any more of these kind of attacks soon.

Source: The Register



07 October 2013 | 3,491 views

Mutillidae – Vulnerable Web-Application To Learn Web Hacking

OWASP Mutillidae II is a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiest to learn web hacking. Mutillidae can be installed on Linux and Windows using LAMP, WAMP, and XAMMP for users who do not want to administrate a webserver. It is pre-installed on SamuraiWTF, Rapid7 Metasploitable-2, and OWASP BWA. The existing version can be updated on pre-installed platforms. With dozens of vulns and hints to help the user; this is an easy-to-use web hacking environment designed for labs, security enthusiast, classrooms, CTF, and vulnerability assessment tool targets. Mutillidae has been used in graduate security courses, corporate web sec training courses, and as an “assess the assessor” target for vulnerability assessment software.

Features

  • Has over 35 vulnerablities and challenges. Contains at least one vulnearbility for each of the OWASP Top Ten 2007 and 2010
  • Actually Vulnerable (User not asked to enter “magic” statement)
  • Mutillidae can be installed on Linux, Windows XP, and Windows 7 using XAMMP making it easy for users who do not want to install or administrate their own webserver. Mutillidae is confirmed to work on XAMPP, WAMP, and LAMP. XAMPP is the “default” deployment.
  • Installs easily by dropping project files into the “htdocs” folder of XAMPP.
  • Will attempt to detect if the MySQL database is available for the user
  • Preinstalled on Rapid7 Metasploitable 2, Samurai Web Testing Framework (WTF), and OWASP Broken Web Apps (BWA)
  • Contains 2 levels of hints to help users get started
  • Includes bubble-hints to help point out vulnerable locations
  • Bubble-hints automatically give more information as hint level incremented
  • System can be restored to default with single-click of “Setup” button
  • User can switch between secure and insecure modes
  • Secure and insecure source code for each page stored in the same PHP file for easy comparison
  • Provides data capture page and stores captured data in database and file
  • Allows SSL to be enforced in order to practice SSL stripping
  • Used in graduate security courses, in corporate web sec training courses, and as an “assess the assessor” target for vulnerability software
  • Mutillidae has been tested/attacked with Cenzic Hailstorm ARC, W3AF, SQLMAP, Samurai WTF, Backtrack, HP Web Inspect, Burp-Suite, NetSparker Community Edition, and other tools

There’s quite a choice of these apps out there now, so if you’re trying to learn web hacking, or just hone your penetration testing skills, check the list here:

Vulnerable Web Application

You can download Mutillidae here:

LATEST-mutillidae-2.6.4.zip

Or read more here.


10 September 2013 | 1,837 views

Google’s Chrome Apps – Are They Worth The Risk?

So there’s been a bit of debate lately about Google’s Chrome apps after the launch, most of you have probably heard of Chrome OS a while back with a few Chromebooks popping up here and there. Chrome Apps are the next generation of browser apps that can be run offline and eventually will be cross platform (only Windows for now).

The concern is, that Google is opening us up to a whole new era of cross platform exploits/vulnerabilities – the likes we have come to know from Java and Flash.

Google has had a fairly decent security record with Chrome browser and not too terrible with Android, but with a whole new eco-system of apps opening up – it might be out of their control.

Google’s launch of Chrome Apps, a new breed of browser-based software that will run on top of any operating system, has left sceptical security experts wondering whether Google is creating a needless opening for cybercriminals.

Launched late last week, Chrome Apps is Google’s latest step toward embedding its many services in the operating systems of rivals Microsoft and Apple. The goal is make apps running on Google’s platform appear to run natively on either Windows or Mac OS X, respectively.

Even though Chrome Apps require Google’s Chrome Web browser, the software can run outside the browser and offline. Documents, photos and video can be saved on a computer’s hard drive, as well as Google’s cloud storage service, called Google Drive. Updates, including security patches, occur automatically.

Initially, Chrome Apps will run only on Windows and the Google Chromebook, a high-end laptop powered by Google’s Chrome OS. In the near future, Chrome Apps will also run on Mac OS X and Linux.

The strategy behind Chrome Apps is to merge the technology with the host OS, so users do not notice a difference. This all-in-one approach toward the user experience increases the likelihood people will use Google services, which means the company can gather more data to sell to advertisers.

“We want Chrome Apps to be so good you don’t even realize it’s something different,” Rahul Roy-Chowdhury, project manager for Chrome Apps, told The Verge.

From a security aspect it’s a little worrying that they want to make it seamless to the user, so they don’t even realize if they are in the browser, in an app, or it’s just part of the OS.

Another thing to consider is how robust the auto-update/patching features are, and can they really keep users safe? The new auto-updating versions of flash for example, the mechanism just isn’t that effective.

And the Chrome browser, has a tiny little marker in the top right when it needs an update, and has to be restarted – not super obvious to the average user IMHO.

While the goal makes good business sense, security experts worry that Google is creating a layer of complexity that will introduce a new set of vulnerabilities that cybercriminals can exploit. Much of the concern is based on the huge security headache caused by other cross-platform technologies for running applications, such as Adobe Flash and Java, which was developed by Sun Microsystems. Sun was acquired by Oracle in 2009.

“Sun pioneered the write once, infect everywhere model that Oracle has perpetuated,” said Randy Abrams, research director for security adviser NSS Labs.

Because Google gathers enormous amounts of user data, Chrome Apps are unlikely to be welcomed by companies, Abrams said. “There are serious concerns as to privacy and data leakage when it comes to Google,” he said. “Chrome Apps will be a huge concern for enterprises trying to protect intellectual property and other sensitive data, as well as a new security headache.”

Vulnerabilities are a given in every software, so it is important to look at the vendor’s track record for getting out patches quickly. While often criticized for making security blunders in Android, Google’s mobile operating system, the company has incorporated strong security in the Chrome browser and in its Web services.

“They have been really impressive on the security side,” said Wolfgang Kandek, chief technology officer for vulnerability management company Qualys.

The plus side for those of us in the industry, is that enterprise/commercial take-up of this technology is likely to be very low – as most people already have concerns regarding privacy when it comes to Google.

It’ll be interesting to see which way this goes, and of course we’ll have to wait until it’s been around a while and has mainstream usage before we can really judge any security concerns that come to light.

If it’s built with an architecture as secure as the Chrome browser, we should be pretty safe – but as always – we shall wait and see.

Source: Network World


05 September 2013 | 3,805 views

Just Crypt It – How To Send A File Securely Without Additional Software

I’m pretty sure everyone has to send files to someone else online at some point, I’ve found myself having to do it quite often. And there’s always a quandary when it comes to sending something that is somewhat confidential. How do you secure it in transit?

We generally have a few options –

1) Passworded MS document (Excel/Word etc)
2) Passworded .zip file
3) Encrypt the file using something stronger (GPG/PGP or some kind of encrypted container)

As for 1) and 2) they aren’t really secure at all, and as for 3) whoever is receiving the file needs to have the same software installed and your key to decrypt it – which in the majority of cases isn’t going to work.

Then you need to find somewhere to upload it (Dropbox/FTP/Yousendit etc)

Pretty much everyone you know would look at you blankly if you asked them to install GnuPG.

So now a new tool is coming out called Just Crypt It which should solve all of our problems, if you are interested in finding out more you can check out the webinar here on Sept 7th at 1PM EST / 7PM CET (Saturday).

Just Crypt It

Sign-up For The Just Crypt It Webinar

See you there :)


10 July 2013 | 6,903 views

Smooth-Sec – IDS/IPS (Intrusion Detection/Prevention System) In A Box

We haven’t written about Smooth-Sec for a while since we first heard about it at v1 in March 2011.

For those who are not familiar, Smooth-Sec is a fully-ready IDS & IPS (Intrusion Detection & Prevention System) Linux distribution based on Debian 7 (wheezy), available for 32 and 64 bit architecture. The distribution includes the latest version of Snorby, Snort, Suricata, PulledPork and Pigsty. An easy setup process allows to deploy a complete IDS/IPS System within minutes, even for security beginners with minimal Linux experience.

  • Debian 7 Wheezy based
  • 32 and 64 bit iso available. Snorby V 2.6.2
  • Snort V 2.9.4.6
  • Suricata V 1.4.3
  • Pigsty V 0.1.0
  • PulledPork V 0.6.1

You can download Smooth Sec here –

32-Bit – smoothsec-3.0-i386.iso
64-Bit – smoothsec-3.0-amd64.iso

Or read more here.


18 June 2013 | 3,050 views

PRISM, Edward Snowden, Big Brother & More Stuff We Already Knew

So there’s been 100s of articles posted about PRISM, which also now has a lengthy Wikipedia article – PRISM (surveillance program). Apparently PRISM (2007-present) is the program that replaces the previous (2001-2007) NSA warrantless surveillance program.

So the US government has been watching everyone, no shit (Nineteen Eighty-Four?).

PRISM is a clandestine national security electronic surveillance program operated by the United States National Security Agency (NSA) since 2007. PRISM is a government codename for a data collection effort known officially as US-984XN. It is operated under the supervision of the United States Foreign Intelligence Surveillance Court pursuant to the Foreign Intelligence Surveillance Act (FISA).

The existence of the program was leaked by NSA contractor Edward Snowden and published by The Guardian and The Washington Post on June 6, 2013. A document included in the leak indicated that the PRISM SIGAD was “the number one source of raw intelligence used for NSA analytic reports.”The President’s Daily Brief, an all-source intelligence product, cited PRISM data as a source in 1,477 items in 2012. The leaked information came to light one day after the revelation that the United States Foreign Intelligence Surveillance Court had been requiring the telecommunications company Verizon to turn over to the NSA logs tracking all of its customers’ telephone calls on an ongoing daily basis.

It’s a revelation for a lot of people however, who are unaware of how easy it is to capture data online (that isn’t encrypted) – like e-mail for example. I’ve always told people don’t write anything in an e-mail that you wouldn’t write on a post-card – because reading them both is at about the same difficulty level.

Most people think because they are logged onto Gmail/Hotmail etc using https, that their transmissions are secure. But unfortunately the majority of the e-mail infrastructure is using zero encryption – so all your messages are floating around in plain text, unless of course you are using PGP/GPG – they you are pretty safe. But how many people do that, and it requires both sender and receiver to using the same system.

There are of course specialist e-mail services for the paranoid like Hushmail Tormail.

It’s a big kick in the face for the US Government though with their hyperbole about freedom, now it turns out they are invading the whole World’s privacy and ignoring human rights.

There have been statements from Microsoft, Yahoo!, Google, Facebook, Apple & Dropbox stating they do not take part in PRISM and that they do not give any direct server access to any agencies.

The guy that kicked this whole thing off was Edward Snowden, who intentionally revealed his identity and is ready to deal with the consequences. More here – Edward Snowden: the whistleblower behind the NSA surveillance revelations.

He was basically a sys admin for a government contractor called Booz Allen Hamilton, parked under the NSA in Hawaii. As we all known, sys admins typically have full access to EVERYTHING, ever server, every system – as they need it to do their job.

Very few companies implement silos, or transparent encyrption to protect themselves from sys admins. More on that discussion here – Prism doesn’t have CIOs in a panic — yet .

Either way, it’s a pretty interesting story and it’s getting spectacular global press coverage – there’s plenty more to read if you’re interested.


12 June 2013 | 2,924 views

OWASP Bricks – Modular Deliberately Vulnerable Web Application

Bricks, a deliberately vulnerable web application built on PHP & MySQL focuses on variations of commonly seen application security vulnerabilities & exploits, which can be exploited using tools (Mantra & ZAP). The mission is to ‘break the bricks’.

Road Map

  1. Demonstrate maximum variations of most common vulnerabilities
  2. Help people to learn the need of secure codding practices and SSDLC
  3. Attract people to design more bricks
  4. Become a test bed for analyzing the performance of web application security scanners.
  5. Help people learn the manual method of testing the applications
  6. Demonstrate the possibilities of various security tools and techniques
  7. Become a platform to teach web application security in a class room/lab environment.

It’s a great way to learn the basics of web security, both from a developers perspective and from someone interesting in learning pen testing for web apps, if you want to check out more projects similar to Bricks, there a whole bunch here:

Vulnerable Web Application

You can download Bricks here:

OWASP Bricks – Torsa.zip

Or read more here.


30 May 2013 | 1,475 views

4 Former LulzSec Members Sentenced To Prison Time In The UK

It’s been a while since we’ve talked about any hacking related arrests, or in this case, imprisonments. In this case, it’s some ‘ex’ members of LulzSec, for the attacks they perpetrated in 2011.

The longest of the sentences being 32 months, almost 3 years for the guy that operated and managed the botnet used in some of the LulzSec attacks.

I wonder if all these successful prosecutions can be attributed to the former LulzSec leader, Sabu, who flipped and informed for the FBI.

Four British men associated with the LulzSec hacker collective received prison sentences Thursday for their roles in cyberattacks launched by the group against corporate and government websites in 2011.

Ryan Cleary, 21, Jake Davis, 20, Ryan Ackroyd, 26, and Mustafa Al-Bassam, 18, were sentenced Thursday in London’s Southwark Crown Court after previously pleading guilty to charges of carrying out unauthorized acts with the intention of impairing the operation of computers.

Davis, who was known online as “Topiary,” received a two-year prison sentence. He acted as a spokesperson for LulzSec, writing some of the hacker group’s announcements and managing its website and Twitter account.

Ackroyd, who posed as a 16-year-old girl online and used the alias “Kayla,” received a 30-month prison sentence, while Mustafa al-Bassam, who used the online alias “T-Flow,” received a 20-month suspended prison sentence and was ordered to perform 200 hours of unpaid community work.

Cleary, who used the online alias “Viral,” received a 32-month prison sentence. He was not one of the LulzSec core members, but was associated with the group and operated a botnet that was used to launch DDoS (distributed denial-of-service) attacks against LulzSec’s targets.

LulzSec’s members went on a hacking spree between May and June 2011, targeting various companies and government agencies. They used hacking methods and tools to break into websites and leak the information found in their databases, including the personal details of thousands of users, and also launched DDoS attacks to make websites inaccessible.

The attacks carried out were fairly widespread and included major corporations as well as US and UK governmental organizations. Data was captured and leaked and large scale sustained DDoS sustained were used against prominent sites.

We are still in a fairly immature legal situation for cyberattacks, so we tend to see sentences vary a lot. I’m pretty sure these guys will end up in some cushy white collar prison rather than in with hardcore criminals.

Some of LulzSec’s targets included Sony, Nintendo, News Corp., Bethesda Game Studios, the CIA, the FBI, the Arizona State Police and the U.K.’s Serious Organised Crime Agency (SOCA).

Andrew Hadik, a lawyer with the Crown Prosecution Service (CPS) in the U.K., characterized the actions of LulzSec’s members as “cowardly and vindictive.”

“The harm they caused was foreseeable, extensive and intended,” Hadik said in a statement published on the CPS blog. “Indeed, they boasted of how clever they were with a complete disregard for the impact their actions had on real people’s lives.”

Companies suffered financial losses and serious damage to their reputations, while hundreds of thousands of innocent individuals had their private details exposed as a result of the group’s actions, he said.

Another LulzSec member named Cody Andrew Kretsinger, from Decatur, Illinois, who used the online alias “recursion,” was sentenced in April to one year in federal prison for his role in LulzSec’s attack against Sony Pictures.

Hector Xavier Monsegur, the former leader of LulzSec, known online as “Sabu,” was arrested in June 2011 and agreed to act as an informant for the FBI. Monsegur pleaded guilty to multiple hacking offenses in relation to the group’s activity and is scheduled to be sentenced in August.

It’ll be interesting to see what else turns up in the LulzSec case, today Jeremy “anarchaos” Hammond announced that he’s pleading guilty after being in prison for 15 months. He pleaded guilty because of the stacked damages figures, with the inflated figures he could face up to 30 years in prison.

Even with the plea bargain he still faces up to 10 years locked up and has agreed to pay $250,000 in restitution.

Source: Network World


14 May 2013 | 13,572 views

PentesterLab.com – Excercises To Learn Penetration Testing

PentesterLab is an easy and straight forwards way to learn the basics of penetration testing. It provides vulnerable systems in a virtual image, and accompanying exercises that can be used to test and understand vulnerabilities.

Just decide what course you want to follow, download the course and start learning. You can easily run the course using VMware, no Internet access is required.

PentesterLab.com

What will you learn?

  • Basics of Web
  • Basics of HTTP
  • Detection of common web vulnerabilities:
    • Cross-Site Scripting
    • SQL injections
    • Directory traversal
    • Command injection
    • Code injection
    • XML attacks
    • LDAP attacks
    • File upload
  • Basics of fingerprinting

Requirements

  • A computer with a virtualisation software
  • A basic understanding of HTTP
  • A basic understanding of PHP
  • Yes, that’s it!

You can download the materials and ISO images here:

web_for_pentester.pdf (2.4M)
web_for_pentester.iso (64-bit, 175M, MD5: f6e0df10de6d410293ba7a838d31f917)
web_for_pentester_i386.iso (32-bit, 172M, MD5: 5e6cdf5fa3356a4c08b34ccd076a63ae)

Or read more here.


26 April 2013 | 3,444 views

New eLearnSecurity Course – WAPT – Web Application Penetration Testing

eLearnSecurity is coming out with a new course, it’s intended to be a comprehensive training on web application penetration testing with large coverage of the newest attack vectors introduced by HTML5 and other W3C protocols.

Over 40 new labs in the Coliseum cloud based virtual lab are included in the course.

eLearnSecurity

Course Description

The Web Application Penetration Testing course (WAPT) is the online, self paced training course that provides all the necessary advanced skills to carry out a thorough and professional penetration test against modern web applications. Thanks to the extensive use of Coliseum Lab and the coverage of the latest researches in the web application security field, the WAPT course is not only the most practical training course on the subject but also the most up to date. The course, although based on the offensive approach, contains, for each chapter, advices and best practices to solve the security issues detected during the penetration test.

Target Audience & Pre-requisites

The WAPT training course benefits the career of penetration testers and IT Security personnel in charge of defending their organization web applications. This course allows organizations of all sizes assess and mitigate the risk at which their web applications are exposed, by building strong, practical inhouse skills. Penetration testing companies can train their teams with a comprehensive and practical training course without having to deploy internal labs that are often outdated and not backed by solid theoretical material.

The student willing to enroll in the course must possess a solid understanding of web applications and web application security models. No programming skills are required, however snippets of Javascript/HTML/PHP code will be used during the course.

eWPT Certification

eWPT Certification

The WAPT course leads to the eWPT certification. The certification can be obtained by successfully completing the requirements of a 100% practical exam consisting in a penetration test of a real world complex web application hosted in our eLearnSecurity Hera labs.

An eWPT voucher is included in all the plans of the WAPT course.

Get More Info

If you want to read more and see the full Syllabus, you can download this:

http://www.elearnsecurity.com/collateral/syllabus_wapt.pdf

The course will be launching on April 29th and you can register for the launch webinar here:

https://www3.gotomeeting.com/register/571727142