Archive | 2015

Linode DDoS Attack – Merry Xmas Sysadmins

The New Acunetix V12 Engine


So the Linode DDoS attack – seems like this xmas has been a terrible time for sys admins, along with what happened to Steam and A Small Orange (100+ hours down).

Linode DDoS Attack - Merry Xmas

A whole lot of work during the most drunken holiday of the year, not fun. And yes it affected me too, work wise everything is hosted on Linode – and this site is also hosted on Linode. So I got spammed with SMS alerts from Dec 26th – Dec 28th (thankfully not on xmas day itself). The above image is actually my own screenshot I sent to the team to update everyone on the situation on boxing day.

And the attacks are still ongoing to some degree as you can see on the Linode status page here: http://status.linode.com/

Virtual server host Linode has been on and offline since Christmas Day as it weathers an ongoing denial-of-service attack. Four days in, its customers are getting grumpy.
Linode

Status page … Linode still suffering days after attacks began

“We are currently aware of a DoS attack that is affecting the Linode Manager/Website and our Dallas datacenter. This post will be updated as soon as we have more information to provide,” the biz said in the wee small hours of Christmas Day.

While billions settled in for the end-of-year festivities, floods of network traffic overwhelmed Linode’s systems in Dallas, Texas, and took parts of its website down. By 3am on the 26th, the waves of packets seemed to be dying down, but then the attackers shifted their sights to the company’s other data centers.


People were getting antsy all over and moving to other hosts like Digital Ocean, RamNode and Vultr.

Can’t blame them really, even if you had a hot fail-over in a different Linode DC – you’d likely still be affected.

Later that day, Linode’s data centers in Atlanta, Georgia, and Newark, New Jersey, took hits – as did the company’s London hosting center. The assailants then started hammering the Dallas data center again, effectively knocking people’s virtual servers offline.

Atlanta, Newark, and London were brought back online a day later, although the two US data centers, plus a third in Fremont, California, were soon floored again. Now it seems only the Dallas site is under attack, causing “degraded performance,” according to Linode.

Punters have been venting about the situation, with the linuxadmin and webdev subreddits getting complaints. With little more than stock statements coming out of Linode, some users are threatening to move to rival services, such as Vultr and DigitalOcean.

A spokesperson for Linode was not available for comment.

It seems like the attack is still being aimed at their biggest DC, which is Dallas and the home of the Linode site and manager. This means the Linode Manager, API and the Dallas DC itself are still suffering degraded performance – but are not totally offline.

The DDoS seems to be quite a broad, powerful attack against the entire Linode infrastructure – targeting various bits which can degrade an entire data centre and moving the attack upstream as it got blocked.

Source: The Register

Posted in: Web Hacking

Topic: Web Hacking


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


LaZagne – Password Recovery Tool For Windows & Linux

Use Netsparker


The LaZagne project is an open source password recovery tool used to retrieve passwords stored on a local computer. Each software stores its passwords using different techniques (plaintext, APIs, custom algorithms, databases and so on). This tool has been developed for the purpose of finding these passwords for the most commonly-used software. At this moment, it supports 22 Programs on Microsoft Windows and 12 on a Linux/Unix-Like operating systems.

LaZagne - Password Recovery Tool For Windows & Linux

It supports a whole bunch of software including things like CoreFTP, Cyberduck, FileZilla, PuttyCM, WinSCP, Chrome, Firefox, IE, Opera, Jitsi, Pidgin, Outlook, Thunderbird, Tortoise, Wifi passwords and more.

Usage

Retrieve version

Launch all modules

Launch only a specific module

Launch only a specific software script

Write all passwords found into a file (-w options)

Use a file for dictionary attacks (used only when it’s necessary: mozilla masterpassword, system hahes, etc.). The file has to be a wordlist in cleartext (no rainbow), it has not been optimized to be fast but could useful for basic passwords.

Change verbosity mode (2 different levels)

You can download laZagne here:

Windows – laZagne-Windows.zip
Source – Source-1.1.zip

Or read more here.

Posted in: Hacking Tools, Linux Hacking, Password Cracking, Windows Hacking

Topic: Hacking Tools, Linux Hacking, Password Cracking, Windows Hacking


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


Facebook Disabled Flash For Video Finally

The New Acunetix V12 Engine


So Facebook disabled Flash for video finally, sadly it’s still there for games but a large use case for it just went out the window. And really, it’s not surprising after the recent mega patch in Adobe Flash that fixed 78 CVE classified vulnerabilities.

Facebook Disabled Flash For Video Finally

There’s just no good reason for anyone to still be using Flash and browsers, if they don’t block it completely, should at minimum make it click to enable on a site by site basis.

That doesn’t guarantee safety though with Flash vulnerabilities floating around in drive-by malware hiding in Flash based ad units. Just say no to Flash.

Facebook has hammered another nail in to the coffin of Adobe Flash, by switching from the bug-ridden plug-in to HTML5 for all videos on the site.

The Social NetworkTM explained the move by saying “Moving to HTML5 best enables us to continue to innovate quickly and at scale, given Facebook’s large size and complex needs.”

Flash hasn’t been completely banished: Facebook says it is “continuing to work together with Adobe to deliver a reliable and secure Flash experience for games on our platform.”

Facebook’s Daniel Baulig writes that going to HTML5 means the company can “tap into the excellent tooling that exists in browsers, among the open source community, and at Facebook in general. Not having to recompile code and being able to apply changes directly in the browser allow us to move fast.”

“HTML5 made it possible for us to build a player that is fully accessible to screen readers and keyboard input,” Baulig added, going on to explain that the standard will make it easier to develop for people with visual impairments.


Less of the web is becoming reliant on Flash with video being one of the big hold outs, Youtube moved away earlier this year – but most WordPress plugins, private sites players and anyone else playing or streaming video still use Flash based players.

With a big site like Facebook going fully HTML5 for video, it should lead the way and push people in the right direction (hopefully).

But HTML5 is no panacea: Baulig wrote that “we noticed that a lot of the older browsers would simply perform worse using the HTML5 player than they had with the old Flash player.”

“We saw more errors, longer loading times, and a generally worse experience.”

The Social NetworkTM therefore moved to HTML5 for newer browsers some time ago, adding more browsers over time has improved its video player. As of December 19th, however, it’s all HTML5 all the time, no matter the browser with which you venture into The House That Zuck Built.

And The House always wins: Baulig says “People like, comment, and share more on videos after the switch, and users have been reporting fewer bugs. People appear to be spending more time with video because of it.”

As Baulig’s post points out, Facebook operates at unusual scale and therefore has unusual needs. Yet the site’s considerable influence means developers everywhere are likely to be asked to consider this decision before long, not least because YouTube’s also flushed Flash.

It’s one thing I am grateful to Apple for – leading the anti-Flash movement since the very beginning. Can’t blame them really, why implement such an insecure piece of software into your walled garden.

I don’t see the big Facebook games reimplementing in HTML5 any time soon unless Facebook forces their hand, I hope it’s already tabled though and Facebook has given a deadline to totally stop the use of Flash on the platform.

Source: The Register

Posted in: Exploits/Vulnerabilities

Topic: Exploits/Vulnerabilities


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


PowerSploit – A PowerShell Post-Exploitation Framework

Use Netsparker


PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. Basically, it is a PowerShell Post-Exploitation Framework that helps you with various tasks like DLL injection, invoking shellcode and setting up script persistence.

PowerSploit - A PowerShell Post-Exploitation Framework


It also includes reflective PE injection and can reflectively load Mimikatz into memory allowing you to dump credentials without writing anything to disk.

PowerSploit Features

PowerSploit has the modules categorised in the following groups:

  • Antivirus Bypass Find bytes of a file which has a matching signature in antivirus.
  • Code Execution Execute code on a target machine.
  • Exfiltration Create logons, get keystrokes, grab passwords, make a volume shadow copy etc.
  • Mayhem Cause general mayhem with PowerShell.
  • Persistence Maintain control to machine by adding persistence to scripts.
  • Privesc Tools to help with escalating privileges on a target.
  • Recon Tools to aid in the reconnaissance phase of a penetration test.
  • Script Modification Modify and/or prepare scripts for execution on a compromised machine..

How to use PowerSploit

Refer to the comment-based help in each individual script for detailed usage information.

To install this module, drop the entire PowerSploit folder into one of your module directories. The default PowerShell module paths are listed in the $Env:PSModulePath environment variable.

The default per-user module path is:

The default computer-level module path is:


To use the module, type:

To see the commands imported, type:

If you’re running PowerShell v3 and you want to remove the annoying ‘Do you really want to run scripts downloaded from the Internet’ warning, once you’ve placed PowerSploit into your module path, run the following one-liner:

For help on each individual command, Get-Help is your friend.

Note: The tools contained within this module were all designed such that they can be run individually. Including them in a module simply lends itself to increased portability.

You can download PowerSploit v3.0.0 here:

PowerSploit-v3.0.0.zip

Or read more here.

Posted in: Hacking Tools

Topic: Hacking Tools


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


Integrit – File Verification System

Use Netsparker


Integrit is a file verification system, a simple yet secure alternative to products like tripwire. It has a small memory footprint, uses up-to-date cryptographic algorithms, and has features that make sense (like including the MD5 checksum of newly generated databases in the report).

Integrit - File Verification System

The Integrit system detects intrusion by detecting when trusted files have been altered.

By creating an Integrit database (update mode) that is a snapshot of a host system in a known state, the host’s files can later be verified as unaltered by running integrit in check mode to compare current state to the recorded known state. Integrit can do a check and an update simultaneously.

Other options are:

AIDE – Advanced Intrusion Detection Environment
Tiger – Unix Security Audit & Intrusion Detection Tool
Samhain v.2.5.9c – Open Source Host-Based Intrusion Detection System (HIDS)
OSSEC HIDS – Open Source Host-based Intrusion System

Usage

Using a product like Integrit for intrusion detection is a continuous process, involving a sequence something like the following:

  1. Generate a new current-state database while checking against an old known-state database that has been protected from modification (This step can be done unattended, since the report that integrit generates at runtime includes the MD5 checksum of the newly-generated current-state database. The output should be directed to a remote host, e.g., via a trusted sendmail binary.) *
  2. Read the report, possibly using UN*X or XML tools to massage it into a form to your liking (There is an example GUI viewer for integrit’s XML output in the examples directory of the distribution.)
  3. If the report looks fine, copy the new database to a secure server for export via read-only NFS, or a secure medium that can be made read-only.
  4. Verify that the current md5sum of the database you just copied over matches the MD5 checksum in the report. (This shows that no one has tampered with the database since the report and the new database were generated.)
  5. Everything’s OK, so the new database will be the known-state database the next time you repeat this process.

* You may use a script to renice the Integrit process and possibly do a sequence of runs, each with a different configuration file.

Output

The human-readable format is intended for quick scanning on a viewer with a large number of columns (like an xterm with maximized width).

Other popular file integrity verification systems split the information between a list of files that have changed at the top of the report and a more detailed section showing the nature of the changes at the bottom of the report. Instead, integrit provides all the information for each file as it learns it.

Besides saving on runtime memory usage, the big advantage of this approach is that the person reading the output never has to skip to the end of the report to learn the exact nature of a change.

You can download integrit here:

integrit-4.1.tar.gz

Or read more here.

Posted in: Countermeasures, Security Software

Topic: Countermeasures, Security Software


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


Critical Remote Root Zero-Day In FireEye Appliances

The New Acunetix V12 Engine


So FireEye doesn’t have a particularly good reputation in the security community, it’s generally not handled responsible disclosure well and it’s even taken a security firm (ERNW) to court over a vulnerability disclosure.

And now there’s another critical remote root zero-day in FireEye appliances – which is scary, as these are high end devices protecting large corporations and governments from zero-days and they don’t even harden their own devices properly?

Critical Remote Root Zero-Day In FireEye Appliances

FireEye ended up making some defensive post about the whole matter here – Bug Bounties, (Non) Lawsuits and Working with the Research Community and it does seems they are at least making an effort. But maybe that’s just because it’s Google this time and not some small security company they can push around.

Simply just sending an email or getting a user to click on a link was enough to exploit a critical remote code execution vulnerability in FireEye appliances and compromise networks protected by the security products.

The flaw was identified earlier this month by Google Project Zero researchers Tavis Ormandy and Natalie Silvanovich. The issue affected FireEye’s Network Security (NX), Email Security (EX), Malware Analysis (AX), and File Content Security (FX) products and it was permanently patched by the vendor within two days with the release of security content version 427.334. Temporary mitigations were rolled out by the company within hours.

The vulnerability, dubbed “666” because of its ID in the Project Zero issue tracker, plagued a module designed to analyze Java Archive (JAR) files. An attacker simply needed to send a specially crafted JAR file across a network protected by FireEye appliances. If the malicious file pretended to use string obfuscation, it would get executed by the FireEye product, Ormandy said in a blog post.

An attacker could have exploited the vulnerability by sending an email containing such a JAR file to the targeted organization — it’s worth noting that the email would not have to be read for the malicious code to get executed — or by getting a user to click on a link pointing to a crafted JAR file.


The vulnerability itself is pretty interesting, and just shows how poorly segmented the malware being scanned is from the actual device OS itself (No VM? No Sandbox? Come on..).

You can trick the ‘security’ appliance into executing a JAR file just by pretending to use string obfuscation – boom it’s owned. And apparently there’s a linked privelege escalation vulnerability too, which gives you complete control of the box.

The post about the vuln in detail is here: FireEye Exploitation: Project Zero’s Vulnerability of the Beast

FireEye appliances are installed on the internal network and they passively monitor traffic. The products monitor FTP, HTTP, SMTP and other traffic and when a file transfer is detected, the file is automatically extracted and scanned for malware. This made it possible for the RCE vulnerability found by Google researchers to be exploited without user interaction.

Project Zero researchers also discovered a privilege escalation vulnerability that could have been exploited to obtain root access to a FireEye device. However, the details of this security hole have not been disclosed because the vendor has yet to release a permanent fix.

A malicious actor could have used these two vulnerabilities to load a persistent rootkit on the affected appliance, intercept traffic, steal sensitive information, insert backdoors, and move laterally across a network.

“Because FireEye devices typically have a secondary internet-connected interface for updates and management, the issue could even be wormable across the internet,” Ormandy explained.

“We are thankful for the opportunity to support the Google team in this process, will continue to support their efforts, and fully support the broader security research community’s efforts to test and improve our products,” FireEye representatives told SecurityWeek last week after the existence of the vulnerability came to light.

The flaws have already been patched by FireEye (they took quick action this time, and not of the legal kind) – but the effectiveness of the patch is totally dependent on everyone using the device applying the update.

Now they are extending an offer to update devices that are out of their service contract, which is nice. But my question generally is, will people even know there’s a serious vulnerability in their appliance?

We shall have to wait and see if this causes any actual mess.

Source: SecurityWeek

Posted in: Countermeasures, Exploits/Vulnerabilities

Topic: Countermeasures, Exploits/Vulnerabilities


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.