BootStomp is a Python-based tool, with Docker support that helps you find two different classes of Android bootloader vulnerabilities and bugs. It looks for memory corruption and state storage vulnerabilities.
Note that BootStomp works with boot-loaders compiled for ARM architectures (32 and 64 bits both) and that results might slightly vary depending on angr and Z3’s versions. This is because of the time angr takes to analyze basic blocks and to Z3’s expression concretization results.
How does BootStomp find Android Bootloader Vulnerabilities?
BootStomp implements a multi-tag taint analysis resulting from a novel combination of static analyses and dynamic symbolic execution, designed to locate problematic areas where input from an attacker in control of the OS can compromise the bootloader’s execution or its security features.
Using the tool the team found six previously-unknown vulnerabilities (of which five have been confirmed by the respective vendors), as well as rediscovered one that had been previously reported. Some of these vulnerabilities would allow an attacker to execute arbitrary code as part of the bootloader (thus compromising the entire chain of trust), or to perform permanent denial-of-service attacks.
The vulnerabilities impact the Trusted Boot or Verified Boot mechanisms implemented by vendors to establish a Chain of Trust (CoT). The team using BootStomp discovered vulnerabilities in the bootloaders used by Huawei, Qualcomm, MediaTek, and NVIDIA.
The team analyzed bootloader implementations in many platforms, including Huawei P8 ALE-L23 (Huawei / HiSilicon chipset), Sony Xperia XA (MediaTek chipset), Nexus 9 (NVIDIA Tegra chipset), and two versions of the LK-based bootloader (Qualcomm).
How to use BootStomp
The easiest way to use BootStomp is to run it in a docker container. The folder docker contains an appropriate Dockerfile, these are the commands to use it:
# build the docker image
docker build -t bootstomp .
# run the docker image (if you need, use proper options to have persistent changes or shared files)
docker run -it bootstomp
# now you are inside a docker container
# run BootStomp's taint analysis on one of the examples
# this will take about 30 minutes
python taint_analysis/bootloadertaint.py config/config.huawei
# the last line of the output will be something like:
# INFO | 2017-10-14 01:54:10,617 | _CoreTaint | Results in /tmp/BootloaderTaint_fastboot.img_.out
# you can then "pretty print" the results using:
python taint_analysis/result_pretty_print.py /tmp/BootloaderTaint_fastboot.img_.out
For Android related security you can also check out:
You can download BootStomp here:
Or read more here.
Google is ramping up its campaign against HTTP only sites and is going to mark ALL Non-HTTPS sites insecure in July 2018 with the release of Chrome 68. It’s a pretty strong move, but Google and the Internet, in general, has been moving in this direction for a while.
It started with suggestions, then forced SSL on all sites behind logins, then mixed-content warnings, then showing HTTP sites are not-secured and now it’s going to be outright marked as insecure.
Three years ago, Google’s search engine began favouring in its results websites that use encrypted HTTPS connections.
Sites that secure their content get a boost over websites that used plain-old boring insecure HTTP. In a “carrot and stick” model, that’s the carrot: rewarding security with greater search visibility.
Later this year comes the stick. This summer, Google will mark non-HTTPS websites as insecure in its Chrome browser, fulfilling a plan rolled out in September 2016.
Starting with Chrome 68, due to hit the stable distribution channel on July 2018, visiting a website using an HTTP connection will prompt the message “Not secure” in the browser’s omnibox – the display and input field that accepts both URLs and search queries.
“Chrome’s new interface will help users understand that all HTTP sites are not secure, and continue to move the web toward a secure HTTPS web by default,”
I’m glad I updated this site to SSL before it became absolutely critical, and to be honest with Google Cloud, Amazon AWS and Lets Encrypt offering SSL termination for free, there’s no real excuse not to be on SSL anymore.
Because Chrome holds something like 56 percent of the global browser market share across mobile and desktop platforms, Google’s name-and-shame label is likely to be noticed by a great many Chrome users and by any websites those fans no longer visit due to security concerns.
While many websites will be affected, plenty are already in compliance. According to Google, 81 of the top 100 websites use HTTPS by default, over 68 percent of Chrome traffic on Android and Windows occurs over HTTPS, and over 78 percent of Chrome traffic on Chrome OS and macOS and iOS travels securely.
Google offers a free security auditing tool called Lighthouse that can help developers identify which website resources still load using insecure HTTP.
The Chocolate Factory’s shunning scheme follows a similar tack the company has taken to issue warnings to websites that rely on dodgy Symantec digital certificates.
I would imagine similar standards are going to be pushed out across the other browsers given the time and the fact Google is still the biggest search engine, they define how the web reacts.
Make sure your SSL install is secure using these:
The official blog by Google on this is here:
I personally think this is a step in the right direction and wonder why only 81 of the top 100 sites are on SSL.
Source: The Register
Altdns is a Subdomain Recon Tool in Python that allows for the discovery of subdomains that conform to patterns. The tool takes in words that could be present in subdomains under a domain (such as test, dev, staging) as well as takes in a list of subdomains that you know of.
From these two lists that are provided as input to altdns, the tool then generates a massive output of “altered” or “mutated” potential subdomains that could be present. It saves this output so that it can then be used by your favourite DNS brute-forcing tool such as:
Features of altdns Subdomain Enumeration Tool
Alternatively, the -r flag can be passed to altdns so that once this output is generated, the tool can then resolve these subdomains (multi-threaded) and save the results to a file.
Altdns works best with large datasets. Having an initial dataset of 200 or more subdomains should churn out some valid subdomains via the alterations generated.
altdns Subdomain Recon Tool Usage
./altdns.py -i subdomains.txt -o data_output -w words.txt -r -s results_output.txt
subdomains.txt contains the known subdomains for an organization
data_output is a file that will contain the massive list of altered and permuted subdomains
words.txt is your list of words that you'd like to permute your current subdomains with (i.e. admin, staging, dev, qa) - one word per line
the -r command resolves each generated, permuted subdomain
the -s command tells altdns where to save the results of the resolved permuted subdomains. results_output.txt will contain the final list of permuted subdomains found that are valid and have a DNS record.
the -t command limits how many threads the resolver will use simultaneously
-d 184.108.40.206 overrides the system default DNS resolver and will use the specified IP address as the resolving server. Setting this to the authoritative DNS server of the target domain may increase resolution performance
You can download altdns here:
Or read more here.
So another 0-Day Flash Vulnerability is being exploited in the Wild, a previously unknown flaw which has been labelled CVE-2018-4878 and it affects 220.127.116.11 and earlier versions for both Windows and Mac (the desktop runtime) and for basically everything in the Chrome Flash Player (Windows, Mac, Linux and Chrome OS).
The full Adobe Security Advisory can be found here:
Adobe warned on Thursday that attackers are exploiting a previously unknown security hole in its Flash Player software to break into Microsoft Windows computers. Adobe said it plans to issue a fix for the flaw in the next few days, but now might be a good time to check your exposure to this still-ubiquitous program and harden your defenses.
Adobe said a critical vulnerability (CVE-2018-4878) exists in Adobe Flash Player 18.104.22.168 and earlier versions. Successful exploitation could allow an attacker to take control of the affected system.
The software company warns that an exploit for the flaw is being used in the wild, and that so far the attacks leverage Microsoft Office documents with embedded malicious Flash content. Adobe said it plans to address this vulnerability in a release planned for the week of February 5.
According to Adobe’s advisory, beginning with Flash Player 27, administrators have the ability to change Flash Player’s behavior when running on Internet Explorer on Windows 7 and below by prompting the user before playing Flash content. A guide on how to do that is here (PDF). Administrators may also consider implementing Protected View for Office. Protected View opens a file marked as potentially unsafe in Read-only mode.
The wild usage of the exploit seems to be in the Korean context with North Korean hackers using it against South Korean targets and apparently they have been using it since November 2017.
It’s a fairly complex attack chain so I’m surprised if it’s a very reliable exploit as it targets Flash content embedded in Microsoft Office documents.
Hopefully, most readers here have taken my longstanding advice to disable or at least hobble Flash, a buggy and insecure component that nonetheless ships by default with Google Chrome and Internet Explorer. More on that approach (as well as slightly less radical solutions) can be found in A Month Without Adobe Flash Player. The short version is that you can probably get by without Flash installed and not miss it at all.
For readers still unwilling to cut the Flash cord, there are half-measures that work almost as well. Fortunately, disabling Flash in Chrome is simple enough. Paste “chrome://settings/content” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.
By default, Mozilla Firefox on Windows computers with Flash installed runs Flash in a “protected mode,” which prompts the user to decide if they want to enable the plugin before Flash content runs on a Web site.
Another, perhaps less elegant, alternative to wholesale kicking Flash to the curb is to keeping it installed in a browser that you don’t normally use, and then only using that browser on sites that require Flash.
Most browsers of the current generation have either no Flash support at all, or make it “ask-first” when Flash content attempts to display. I would hazard a guess that this is why the attackers chose to target Flash embedded in Microsoft Office documents as it’s such ubiquitous software and not so regularly updated or patched by individuals or organsations.
It’s not the first Flash zero-day and it won’t be the last, we’ve reported on a few before, I think the impact should get less and less as more sites phase out Flash and move to native HTML5.
dorkbot is a modular command-line tool for Google dorking, which is performing vulnerability scans against a set of web pages returned by Google search queries in a given Google Custom Search Engine. How dorkbot works It is broken up into two sets of modules: Indexers – modules that issue a search query and return the […]
USBPcap is an open-source USB Packet Capture tool for Windows that can be used together with Wireshark in order to analyse USB traffic without using a Virtual Machine. Currently, the live capture can be done on “standard input” capture basis: you write a magic command in cmd.exe and you get the Wireshark to capture raw […]