http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2013-01-07 22:42:03 - From a malicious attacker : I had difficulty with this exercise and searched for an answer online but came up empty Here's my solution Many thanks to Mr Rolles for his assistance Problem p is prime a is not divisible by p By Fermat's Little Theorem a p - 1 1 mod p e is the smallest value such that a e 1 mod p and 0 e p Prove that p - 1 0 mod e Proof By the division algorithm, write p-1 k e r, where 0 r e Assume 0 r a ke r 1 mod p a ke a r 1 mod p since a e 1, a e k 1 also, giving a r 1 mod p Since r e and a e 1 mod p and e is the smallest value satisfying a e 1 mod p, a r 1 mod p is a contradiction Therefore, r must be 0, giving a ke a p-1 1 mod p ke p-1 ke 0 mod p-1 This proves that e divides p - 1 http://www.secuobs.com/revue/news/420301.shtmlhttp://www.secuobs.com/revue/news/420301.shtml Secuobs.com : 2012-08-05 15:54:54 - From a malicious attacker - When working outside the walled garden of byte code VMs and interpreted languages there is always the chance you might shoot yourself in the foot This usually results in a segfault As a courtesy, f0 can recover from segfaults f0 f0 1 2 3 4 We push some stuff on the stack and there it is f0 0 0x4 4 1 0x3 3 2 0x2 2 We invoke dict_get with ' ' It expects a pointer to a string the key to find but there are only a bunch of numbers on the stack f0 Segorimus Faultimium and subsequent recovery wh000ps we've triggered SIGSEGV let's try and recover hold on tight stack dump b78e0a1c 7b 00 00 00 7b 00 00 00 00 00 00 00 00 00 00 00 b78e0a2c 90 0f 8e b7 60 0f 8e b7 f4 5f 26 00 aa 02 00 00 b78e0a3c 04 00 00 00 04 00 00 00 0e 00 00 00 04 00 00 00 b78e0a4c 85 37 18 00 73 00 00 00 46 02 21 00 60 0f 8e b7 b78e0a5c 7b 00 00 00 f0 0c 8e b7 00 00 00 00 00 00 00 00 b78e0a6c 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 b78e0a7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b78e0a8c 00 00 00 00 d0 0e 8e b7 00 00 00 00 76 fb ff ff b78e0a9c 00 00 00 00 0a 00 00 00 cf 0e 8e b7 cf 0e 8e b7 b78e0aac 01 00 00 00 00 00 00 00 02 00 00 00 82 ef 14 00 b78e0abc 00 00 00 00 9b 98 04 08 e0 59 26 00 9c 98 04 08 b78e0acc 74 65 26 00 00 00 00 00 90 98 04 08 00 00 00 00 b78e0adc b8 0f 8e b7 90 98 04 08 09 00 00 00 00 00 00 00 b78e0aec 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b78e0afc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b78e0b0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eip 183785 esp b78e0f60 ebp b78e0f60 searching stack for recovery point 80492d3, 80493eb found it b78e0ff4 804936b restoring eip to 0x804936b Almost like we never left the resort f0 0 0x8048a70 134515312 1 0x3 3 2 0x2 2 f0 http://www.secuobs.com/revue/news/391748.shtmlhttp://www.secuobs.com/revue/news/391748.shtml Secuobs.com : 2012-08-05 05:02:29 - From a malicious attacker - create a block of code that fetches the address of a symbol in libc f0 dup 1 ' lib libcso6 dlopen 2 dra dlsym 2 dra sw name that block of code libc f0 'libc call the block with an argument of system to import it into our namespace f0 'system libc invoke system with an argument of ls f0 'ls system observe directory listing arch builtinso codeh defaultsh dicth f0 f0h inputc inputo maino strc stro builtinsc codec codeo dictc dicto f0c f0o inputh mainc Makefile strh f0 take a nap http://www.secuobs.com/revue/news/391708.shtmlhttp://www.secuobs.com/revue/news/391708.shtml Secuobs.com : 2012-08-04 22:51:50 - From a malicious attacker - I've been working on a new language that is forthy Here's an example of finding and invoking C functions with dlopen f0 f0 1 2 3 0 0x3 3 1 0x2 2 2 0x1 1 f0 sw f0 0 0x2 2 1 0x3 3 2 0x1 1 f0 1 ' lib libcso6 dlopen f0 0 0x81be138 136044856 1 0x81be108 136044808 2 0x1 1 f0 2 dra f0 0 0x81be138 136044856 1 0x2 2 2 0x3 3 f0 2 dra f0 0 0x81be138 136044856 1 0x1 1 f0 'printf sw 0 0x81be138 136044856 1 0x81be5d0 136046032 2 0x1 1 f0 dlsym f0 0 0xaeb670 11449968 1 0x81be138 136044856 2 0x81be5d0 136046032 f0 'printf f0 0 0x81be138 136044856 1 0x81be5d0 136046032 2 0x1 1 f0 'hey n printf hey nf0 f0 http://www.secuobs.com/revue/news/391697.shtmlhttp://www.secuobs.com/revue/news/391697.shtml Secuobs.com : 2012-08-03 03:51:49 - From a malicious attacker - def g i 0 while 1 yield i i 1 def a args print len args a 1 1 a 1, 2, 3 3 a g Killed http://www.secuobs.com/revue/news/391415.shtmlhttp://www.secuobs.com/revue/news/391415.shtml Secuobs.com : 2011-08-05 12:19:35 - From a malicious attacker - Ammonite is a security scanner extension for Fiddler that allows you to detect all the usual suspects including SQLi, XSS, file inclusion, buffer overflows etc It has some pretty cool features I haven't seen elsewhere My favs are exporting requests to python urllib2 code, breadth first vuln search, and scanner throttling In breadth first search mode, the scanner only looks for the first instance of a vuln for a given session This is great on a pentest where you don't have much time and want to get as deep as you can in the shortest possible time Throttling is useful in a variety of scenarios but the most common one is where you are testing in an unstable environment and too many requests per second knock the thing over or make your results unreliable It also fuzzes XML and JSON POST bodies which are now standard on most recently created apps http://www.secuobs.com/revue/news/321262.shtmlhttp://www.secuobs.com/revue/news/321262.shtml Secuobs.com : 2011-04-01 19:57:46 - From a malicious attacker - XCS or Cross-Cloud Scripting is one of the more recent threats affecting cloud applications delivered as a service enhancing RoI Applications exchange information in the cloud, specifically cross-cloud applications, in an effort to increase business and IT productivity, data productivity, context and business objects Before we can understand XCS, a thorough understanding of BI, SaaS and digital DNA must be grasped Cloud platforms and cloud infrastructure are relatively immature and suffer from the same vulnerabilities as traditional distributed point to point applications Complex data management and quality requirements dictate the methodologies employed by cloud products and service providers Agile software development processes must be tweaked to address the problem of XCS if the industry is to succeed Finally, Ask not what your cloud can do for you, but what you can do for your cloud http://www.secuobs.com/revue/news/295751.shtmlhttp://www.secuobs.com/revue/news/295751.shtml Secuobs.com : 2011-02-24 16:56:20 - From a malicious attacker - Django sites that run the built-in admin site prior to r15639 are vulnerable to user enumeration The Django team was notified and corrected this in SVN revision 15639 Details here http codedjangoprojectcom changeset 15639 By specifying a content type id of 3 and enumerating object IDs beginning with 1, the view responds with redirects containing usernames ex admin r 3 USERID No authentication is required to exploit this vulnerability Django sites should either upgrade to the latest SVN or manually modify django trunk django contrib admin sitespy changing url r' r P d P ', 'djangoviewsdefaultsshortcut' , to url r' r P d P ', wrap contenttype_viewsshortcut , http://www.secuobs.com/revue/news/287440.shtmlhttp://www.secuobs.com/revue/news/287440.shtml Secuobs.com : 2011-02-21 01:56:15 - From a malicious attacker - I don't know much about Objective-C and decided to get my learn on Here are some discoveries I made Objective-C is dynamic Objects and classes support some degree of introspection at runtime Methods messages are routed and dispatched They are not hardcoded addresses as in C Objective-C is message oriented All those fancy Object Oriented Message passing calls end up going through one of a few functions When you compile self printMessageWithString Hello World it is translated to something like objc_msgSend self, selector printMessageWithString , Hello World I borrowed those snippets from http cocoasamuraiblogspotcom 2010 01 understanding-objective-c-runtimehtml without permission This is good news It means just about every OO operation in ObjC will pass through this function Way to make hooking tracing easy I then asked Google if anyone else has been talking about this sort of thing It looks like I am late to the game - http wwwdribinorg dave blog archives 2006 04 22 tracing_objc Specifically If you set the NSObjCMessageLoggingEnabled environment variable to YES , the Objective-C runtime will log all dispatched Objective-C messages to a file named tmp msgSends- You can even enable message logging from within a debugging session using gdb call void instrumentObjcMessageSends YES It gets better The Apple objc runtime also includes support for a custom logger This might be useful logging the parameters of certain messages of interest I also found good general information on reversing objc here http culaternet wiki moincgi CocoaReverseEngineering New bits here are class-dump and FScript The former will dump a header file close enough for use, the latter through FScriptAnywhere allows you to introspect and modify apps at runtime http://www.secuobs.com/revue/news/286525.shtmlhttp://www.secuobs.com/revue/news/286525.shtml Secuobs.com : 2011-02-11 16:56:29 - From a malicious attacker - Often when doing mobile application assessments it is necessary to check that sensitive data is properly discarded when no longer in use This data is often found on the heap While it would be nice to dump core of a running process and strings grep the dump this is tough on a jailbroken iphone The gdb from Cydia does not include core dump commands generate-core-file, gcore Building gcore-arm from source is pretty easy with Xcode, however, it runs into trouble when making kernel syscalls on the iphone Specifically, task_for_pid fails I'm not sure why but I suspect it's related to some missing entitlements A concept I don't fully understand just yet Somehow Cydia's gdb has all the right entitlements It would be great if there was a gcore package from Cydia Anyway, here's a trick for finding the heap when you need to First, attach to your app running on the phone with gdb -p PID Set a breakpoint on malloc with break malloc Do something with the app so that the malloc breakpoint triggers Once triggered, run till return with 'finish' Inspect r0 with 'info reg r0' The r0 register stores a function's return value on ARM platforms The return value from malloc is an address somewhere on the heap To find the base of the heap, use info mach-regions RETURNVAL This should show the start and end of the region You can then dump the heap to a file with dump binary memory FILENAME STARTADDR ENDADDR http://www.secuobs.com/revue/news/284645.shtmlhttp://www.secuobs.com/revue/news/284645.shtml Secuobs.com : 2011-01-09 22:48:34 - From a malicious attacker - Here is one way to load an RSA public key from a string with M2Crypto in python from M2Crypto import RSA, BIO def _load_pub_key ks ks ksencode 'utf-8' return RSAload_pub_key_bio BIOMemoryBuffer ks If ks contains unicode characters the operation will fail hence the recoding of ks Verifying a signature is a little tricky The verify function is documented as accepting a data parameter The parameter name is misleading It is actually expecting data to contain a hash The same hash used to generate the signature Here is an example from M2Crypto import RSA, BIO k RSAload_key 'bank_certpem' data easy like sunday morning from hashlib import sha1 signature ksign sha1 data digest , 'sha1' kverify sha1 data digest , signature, 'sha1' 1 http://www.secuobs.com/revue/news/276976.shtmlhttp://www.secuobs.com/revue/news/276976.shtml Secuobs.com : 2010-12-24 16:45:41 - From a malicious attacker - Here's an interesting prime number generator that I created It avoids multiplication and modulo arithmetic It does not sieve a preallocated set of integers ex find all primes up to N You can serialize it and then resume generating no need to specify an upper bound Its internal state consists of 2 lists and an integer representing the current candidate The lists are a list of primes and a corresponding list of prime multiples For a given candidate, the algorithm compares the candidate to current prime multiples If the candidate is less than a multiple, the prime multiple is increased additively to its next multiple p p p where p is the prime root If the multiple is equal to the candidate, the candidate is not prime If there's no match, the candidate is prime and added to the list p 2 added to the list of multiples class PrimeGen p primes found m current multiple of each prime def prime self, i for j in xrange 0, len selfp if i i selfm j selfm j selfp j if i selfm j return 0 selfpappend i selfmappend i 2 return 1 def gen self A prime generator i 2 while 1 if selfprime i yield i i 1 The drawback is running time Sieves ex Eratosthenes are faster This one generates the first million primes 15,485,863 in about 10 minutes on modest hardware http://www.secuobs.com/revue/news/274100.shtmlhttp://www.secuobs.com/revue/news/274100.shtml Secuobs.com : 2010-12-22 16:47:34 - From a malicious attacker - Lately, I've become interested in integer factorization and have been playing with constraint solvers I started out with minion but quickly became frustrated Minion does not support nesting of constraints or custom constraints from what I can tell The set of equations I was working with were mostly comprised of terms that were either a b mod 10 or a b - a b mod 10 10 I would need to have all sorts of intermediate variables and constraints to express these terms Which isn't difficult, but would be tedious Enter python-constraint This module allowed me to write constraints that were easy to read It supports constraints expressed as lambda functions nameless functions in py Unfortunately, the performance of python-constraint is a bad joke I ended up writing a simple benchmark in py and minion to contrast the differences Here is the python benchmark It is nice and readable import sysfrom constraint import p Problem paddVariables x , y , range 0, 999 paddVariable z , range 0, 999999 paddConstraint lambda x, y x 1 and y 1, x , y paddConstraint lambda x, y, z x y z, x , y , z paddConstraint lambda z z 123456, z print pgetSolution This little snippet took 17 minutes and 11 seconds to complete time benchpy 'y' 192, 'x' 643, 'z' 123456 real 17m16996suser 17m11200ssys 0m0392s And now, minion MINION 3 VARIABLES DISCRETE x 0999 DISCRETE y 0999 DISCRETE z 0999999 SEARCH VARORDER x, y PRINT x, y, z TUPLELIST CONSTRAINTS product x, y, z eq z, 123456 sumgeq x , 2 sumgeq y , 2 EOF Minion spits out a result in under 1 second Yipes Sol 192 643 123456Solution Number 1Time 0000000Nodes 2 Solve Time 0208013Total Time 0276017Total System Time 0288018Total Wall Time 0651100Maximum Memory kB 0Total Nodes 2Problem solvable yesSolutions Found 1 real 0m0680suser 0m0276ssys 0m0312s We have a winner Looks like I may need to dive into that tedious process of translating equations to minion http://www.secuobs.com/revue/news/273612.shtmlhttp://www.secuobs.com/revue/news/273612.shtml Secuobs.com : 2009-12-02 00:02:17 - From a malicious attacker - W3C introduces the FileReader object More here http://www.secuobs.com/revue/news/167500.shtmlhttp://www.secuobs.com/revue/news/167500.shtml Secuobs.com : 2009-11-17 15:54:28 - From a malicious attacker - SpyStudio Really nice API monitoring with python baked in http://www.secuobs.com/revue/news/161643.shtmlhttp://www.secuobs.com/revue/news/161643.shtml Secuobs.com : 2009-08-14 04:12:49 - From a malicious attacker - Useful attack affecting Linux hosts More here IMAGE http://www.secuobs.com/revue/news/130780.shtmlhttp://www.secuobs.com/revue/news/130780.shtml Secuobs.com : 2009-06-23 03:52:39 - From a malicious attacker - Details on the facebook hack are available from FBHive The vulnerabilityappears to have been patchedIMAGEhttp://www.secuobs.com/revue/news/112476.shtmlhttp://www.secuobs.com/revue/news/112476.shtml Secuobs.com : 2009-06-19 17:50:12 - From a malicious attacker - Found a nice writeup from SkullSecurity on the fairly recent WebDavauthentication bypass vulnerabilityIMAGEhttp://www.secuobs.com/revue/news/111582.shtmlhttp://www.secuobs.com/revue/news/111582.shtml Secuobs.com : 2009-06-19 14:18:17 - From a malicious attacker - I was recently introduced to a tool called FuzzGrind FuzzGrind smashestogether Valgrind, STP a constraint solver and a fuzzing engineIt's written in python bonus points I need more time to play withit, but it looks really promisingIMAGEhttp://www.secuobs.com/revue/news/111532.shtmlhttp://www.secuobs.com/revue/news/111532.shtml Secuobs.com : 2009-06-12 04:19:35 - From a malicious attacker - The sci-fi masterpiece Ender's Game details the formative years of thestory's hero - Ender Wiggin Upon entering battle school, he isimmediately made into an outcast by his superiors and begins an uphillclimb to gain power and a following Early on, he figures out that hecan send messages that appear to come from other students He doesthis by creating a new identity in the shcool computers and exploitingan implementation flaw within the system Ender leverages the weaknessto twist his opponent's words, humiliating his adversary and winningover his friendsThe 44th president has a LinkedIn profile and a Twitter account Howdo we know that it's actually Barack tweeting and making connectionsIgnoring the fact that an aid is probably responsible for managingBarack's online identities, what is to stop any barely computerliterate individual from setting up a facebook account in your nameHow long could an impostor go undetected Social networks naturallysupport multiplicities of an identity Take for example the many facesof Paris Hilton on LinkedInImpersonating online identities, or "Endering", uses personalinformation from one or more sources and turns that into an onlineidentity within a social network The potential sources vary wildlyand include court records, job boards, wikipedia, mailing lists,social networks, background checks, credit reports etc In itssimplest form, Endering involves an exact duplication of an existingonline identityEndering is actively being conducted on popular social networksTweeple were left confused in May of this year after witnessing whatappeared to be an MP's tweets indicating inside knowledge of anupcoming general election At least one Moroccan individual hasreceived Jail time for Endering Less extreme cases in the US haveresulted in Law SuitsEndering and its variations are attacks with political implicationsand consequences In practical terms, these attacks can be used tomarket products, stage hilarious practical jokes, subvert employees,distribute propaganda, manipulate the press, recruit talent, monitoremployees, and moreMore ExamplesFake facebook student used to monitor student bodyNorthwestern officials declined to comment on whether they use orwould consider using a false Facebook account to gain access tostudents’ information But in general, they said, they would notrule out using information found through Facebook, or other Webcommunication, in disciplinary mattersGuyana President ImpersonatedFacebook said that under the network's terms of use members arebanned from attempting to "impersonate any person or entity"Stealing FriendsOnce your fake identity has been setup, you'll want to do somethingwith it Before you can do much of anything useful, you will need toconvince some of your target's associates to become your clone'sassociates A little research goes a long way here Some of the bestcandidates are those you can learn about from public sources but donot have accounts on the social network you're operating within Forexample, you want to impersonate the CEO of a company You know thatthe CEO is friends with a VP of the same company however the VP doesnot have a Facebook/LinkedIn/Hi5/YouNameIt accountAnother option is to hijack connections This one requires somegrifting but can be just as fruitful The associate being targetedalready has an account on the social network but you will need totrick them into becoming your associate, so in your invitation toconnect message, you let them know that your other account was hacked,you lost the password, or some other form of "my dog ate it" It'salready fairly common for this to happen without attackers beingthrown into the mixIMAGEhttp://www.secuobs.com/revue/news/108855.shtmlhttp://www.secuobs.com/revue/news/108855.shtml Secuobs.com : 2009-06-04 16:44:44 - From a malicious attacker - Yesterday, I set out to create a Python API for my Proxmark The toughestpart was selecting the right USB module My gut reaction said "PyUSB",but was rightly corrected by Didier that python-hid would be a betterfit since the Proxmark exports a HID interface The suggestion wassound logic, however, what appear to be implementation flaws in libhidupon which python-hid relies prevented me from using it with theProxmarkFor some reason, libhid was unable to retrieve the Proxmark's devicedescriptor and this would cause hid_force_open to fail Googlerevealed that other folks have had the same problem After pulling outmy hair with python-hid, I went back to my original candidate andthings just started working The first operation I implemented fortest purposes was the tune commandroot@stumpi:~/python-proxmark# cat tunepy # /usr/bin/env python# Copyright 2009, Rysc Corpfrom proxmark import *if __name__ == '__main__':pm3 = Proxmarkantennas = pm3tunefor ant in antennas:print antThe code above invokes the Proxmark API to display the voltage andimpedance measured on each antenna Sample output shown below:125kHz v=123mV z=1273 ohms134kHz v=0mV z=1273 ohms1356MHz v=99mV z=90 ohmsAnother snippet designed to mimic the loread command is shown belowpm3 = Proxmarksamples = pm3lf_read_125khzprint samplesWhich results in the list:-89, -128, -49, 109, 127, 107, 26, -42, , -22, -81I'm still not 100% confident in the routine that downloads samplesfrom the proxmark, it was ported from the C client In the next fewweeks, I'll be working to test ported commands and add decoding ASK,FSK etc routines in a separate Python moduleFor experimentation purposes, developing new routines in firmware isslow, which is where I hope Python will help It is a much simplerexercise implementing a HID tag decoder in Python versus in C with anARM as your target I also hope that having a base API in python willusher in a nicer user interface PyGTK anyone We'll seeIMAGEhttp://www.secuobs.com/revue/news/105805.shtmlhttp://www.secuobs.com/revue/news/105805.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - I almost lost my cool this morning wrangling with django's BS If you'veevery tried serializing a form's errors property, you'll know of whatI speak Namely: typemferrors y = dictmferrors typey simplejsondumpsyTraceback most recent call last:File "", line 1, in File "/usr/lib/python25/site-packages/django/utils/simplejson/__init__py", line 236, in dumpsreturn _default_encoderencodeobjFile "/usr/lib/python25/site-packages/django/utils/simplejson/encoderpy", line 366, in encodechunks = listselfiterencodeoFile "/usr/lib/python25/site-packages/django/utils/simplejson/encoderpy", line 308, in _iterencodefor chunk in self_iterencode_dicto, markers:File "/usr/lib/python25/site-packages/django/utils/simplejson/encoderpy", line 274, in _iterencode_dictfor chunk in self_iterencodevalue, markers:File "/usr/lib/python25/site-packages/django/utils/simplejson/encoderpy", line 305, in _iterencodefor chunk in self_iterencode_listo, markers:File "/usr/lib/python25/site-packages/django/utils/simplejson/encoderpy", line 203, in _iterencode_listfor chunk in self_iterencodevalue, markers:File "/usr/lib/python25/site-packages/django/utils/simplejson/encoderpy", line 316, in _iterencodefor chunk in self_iterencode_defaulto, markers:File "/usr/lib/python25/site-packages/django/utils/simplejson/encoderpy", line 322, in _iterencode_defaultnewobj = selfdefaultoFile "/usr/lib/python25/site-packages/django/utils/simplejson/encoderpy", line 343, in defaultraise TypeError"%r is not JSON serializable" % o,TypeError: is not JSON serializableArrrgh My workaround for the time being is supremely uglydef getErrorDicterrors:errorstr = reprerrorserrors = evalerrorstrreturn errorsIMAGEhttp://www.secuobs.com/revue/news/104022.shtmlhttp://www.secuobs.com/revue/news/104022.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - InputZero is a market place for information security services designedwith convenience in mind for both organizations seeking services andconsultants delivering them The site does not require registration,however, projects and consultants are moderated in that both must beapproved before participating Approved consultants can respond toprojects with quotes by sending email to an input0com hosted addressQuotes are forwarded onto project owners After which pointcommunication between project owners and consultants is directIMAGEhttp://www.secuobs.com/revue/news/104021.shtmlhttp://www.secuobs.com/revue/news/104021.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - I didn't know I needed a shape shifting car until todayhttp://blogwiredcom/cars/2008/06/bmw-builds-a-cahtmlIMAGEhttp://www.secuobs.com/revue/news/104020.shtmlhttp://www.secuobs.com/revue/news/104020.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - Scroll down to the bottom of the best book dedication everIMAGEhttp://www.secuobs.com/revue/news/104019.shtmlhttp://www.secuobs.com/revue/news/104019.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - Click Jacking is not a new attack, RSnake and Jeremiah Grossman justbrought it some public attention I remember the day I was introducedto a similar version of the attack by a friend a few years ago I wasdumbstruck that such a simple attack actually worked In the exampleshown to me, a frame from one domain was intercepting the keystrokesof another frame from a separate domainThese attacks can be mitigated by including frame busting code inwebsites This is javascript code you place on your site that detectswhether the page is being loaded in a frame, an example of which isshown belowif topframeslength=0toplocation=selfdocumentlocation;Click Jacking never seemed to catch on in the underground since thereare simpler attacks that work just as well, like phishing Instead ofhijacking a login form, you just reproduce one I have compiled a listof popular online banking sites below that do not contain framebusting codeSunTrustPNC BankWamuMetTTD AmeritradeJP Morgan ChaseSites with BustersTo their credit, the following sites were found to contain framebustersBank of America, Wachovia, Wells Fargo, Citi, E*Trade, ING Direct,HSBC Bank USAIMAGEhttp://www.secuobs.com/revue/news/104018.shtmlhttp://www.secuobs.com/revue/news/104018.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - Looks like we should either brace for a sockstress release or someone isexploiting the hype behind the recently half-disclosed TCP bugsOminous photo aside, I don't know quite what to make of this site Dueto the site verbiage being an apparent reproduction of dialog betweenFyodor and the researchers, I'm guessing its bogus A Unicornscanrelease is featured right next to a presently defunct sockstressdownload linkhttp://wwwsockstresscom/releases/sockstress-010tgzUpdate: Looks like they made friends with the site ownerIMAGEhttp://www.secuobs.com/revue/news/104017.shtmlhttp://www.secuobs.com/revue/news/104017.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - Cisco posted a public response to the sockstress TCP bugs recentlyhalf-disclosed by Outpost24 Cisco's response doesn't really add much,but does confirm a few things Attacks can't be spoofed as they mustcomplete the TCP 3-way duh More importantly,The TCP vulnerabilities that Outpost24 announced are an extensionof well-known weaknesses in the TCP protocolNothing new here For now, Cisco recommends limiting TCP conversationsto trusted sources where possible as a mitigation for coreinfrastructure They are still exploring how these bugs affect theirproductsIMAGEhttp://www.secuobs.com/revue/news/104016.shtmlhttp://www.secuobs.com/revue/news/104016.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - OK, maybe 5 minutes not 60 seconds You've just finished getting a sitedeveloped or maybe you're thinking about ordering something onlineYou're curious as to whether the site is full of security holes HereI'll discuss the intuition I've developed in assessing sites over theyears These are general indicators to watch out for that usually gohand in hand with security problems They are all easy to spot anddon't require any technical skills to speak ofMickey Mouse Look and FeelThis one is touchy-feely, but has never let me down I can generallytell 2 minutes into an assessment whether the site is going to be fullof holes If the site looks like it was thrown together by a teenageron summer break, chances are there will be problems a-plentySpurious ErrorsIf you're casually browsing the site and encounter detailed errormessages which make no sense to you, that's a problem These errormessages leak information about the internals of an applicationhackers will find useful You can also try to evoke errors by enteringdata containing quote, semicolon, less-than/greater-tan, "/", orpercent charactersNumber of InputsDoes the application contain lots of forms Every input to anapplication is another exposure Sites with lots of forms or inputsare more likely to contain security problemsEmail Me My PasswordIf the site has a "send me my password via email" button or emails youa password after registration, pwnageHidden FieldsBrowse to the busiest pages in the site and view the HTML source byright clicking on the page Do a quick search for "hidden", hiddenfields are generally abused by developers and lead to securityproblemsLogin with QuotesTry logging in with the password ' or 1=1 -- If the login succeeds oryou see lots of errors there could be a problem Don't try this one ona site that's not your ownSetting PasswordsTry setting your password to your username or your usernameconcatenated with "123" If the site allows you to do so, there willbe pwnageThese signs only provide a general idea of what you're working withMost sites contain security problems and so the absence of theseindicators does not imply that a site is secureIMAGEhttp://www.secuobs.com/revue/news/104015.shtmlhttp://www.secuobs.com/revue/news/104015.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - I've been running a little experiment for the last 24 hours Theadventure began with wondering what these people brute forcing SSHaccounts were after To quench my curiosity, I rigged together a smallSSH server that permits anyone to login It then logs commands Sofar, every single bruter has connected with libssh and disconnectedright after successfully authenticating I assume they'll be backlater on Hopefully I'll see some commands soonIMAGEhttp://www.secuobs.com/revue/news/104014.shtmlhttp://www.secuobs.com/revue/news/104014.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - It's been a little over a week since I launched InputZero and things areslowly moving along I had to fix some very annoying issues with spamblacklists the day after launching, but that was a good learningexperience Those BLs are pretty stupidInputZero was my first django application to be completed there aremany more in the works I listed it on django sites and posted aboutit on LinkedInI have no marketing budget, so if this thing ever gets legs it will befrom the great consultants who continue to sign up If you believe inthe cause, please link to InputZero, every little bit counts Asconsultants, we number fifteen strong right now Hopefully the sitewill gain exposure and people will start posting more projects soonIMAGEhttp://www.secuobs.com/revue/news/104013.shtmlhttp://www.secuobs.com/revue/news/104013.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - After 61 separate successful brute logins in 48 hrs, there have been nocommands Not nearly as entertaining as I had plannedIMAGEhttp://www.secuobs.com/revue/news/104012.shtmlhttp://www.secuobs.com/revue/news/104012.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - If, as a consultant, you're having trouble confirming your email addressit may be because you're attempting to reply to the confirmationemail Don't reply Instead of replying click the confirmation linkinside the email If you are having trouble getting a confirmationemail in the first place, please let me know My email is base64encoded in the footer of this pageIMAGEhttp://www.secuobs.com/revue/news/104011.shtmlhttp://www.secuobs.com/revue/news/104011.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - Sockstress made it into the NIST CVE database today It's official now,the Intertubes are closed for businessIMAGEhttp://www.secuobs.com/revue/news/104010.shtmlhttp://www.secuobs.com/revue/news/104010.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - I released a new version of the site earlier this evening This versionhas three times the RSS actionIMAGEhttp://www.secuobs.com/revue/news/104009.shtmlhttp://www.secuobs.com/revue/news/104009.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - This post provides step by step instructions on how to create 64-bitapplications using Visual C++ 2008 Express Edition There are a largenumber of related posts on forums and other venues, but these don'treally boil things downStep 0: Install VS 2008 ExpressDownload and install Visual C++ 2008 Express EditionStep 1: Install Platform SDKInstall the appropriate Platform SDK For example, if you run Vista,install the Vista Platform SDK This package will contain IA64versions of the VC tool chainStep 2: Launch Platform SDK Command LineLaunch a Platform SDK command shell by clicking Start - MicrosoftWindows SDK - CMD Shell Note that I typed 'cl' in the command promptand got back information indicating that this version of cl targetsx64Step 3: Launch VC Express From Command LineLaunch VCExpress from the Platform SDK command like this:cd C:Program Files x86Microsoft Visual Studio 90Common7IDEVCExpressexe /useenvThe location of your VCExpressexe may be different After enteringthe command, Visual C++ Express should pop up Most of the work isdone at this point, there are just a few project configuration tweaksto makeStep 4: Verify Environment PathsVerify that the VC++ paths are correct by going to Tools - Options -Projects et Solutions - VC++ Directories Your settings shouldresemble those shown in the screenshots belowNote that the executable paths include the x64 tool chainsInclude paths are shown to the left and library paths shown below onthe rightStep 5: Configuration TweaksOne you've verified that paths are setup correctly, it's time to makea few small changes Change the target machine to be x64 as shownbelow These have to be made per project, so open up a project you'dlike to build targeting x64 In my case, I just created a dummyapplication using a Win32 templateOpen the properties page of the project right click the project inthe browser bar on the left and click properties You should seesomething looking like the screenshot belowNext, verify that Debug Information Format is set to Zi, as shownbelowFinally, ensure that Register Output is set to "No" as shown belowYou should be all set now Build the solution and see for yourselfAs fate would have it, I found a good reference from Intel for doingsomething very close to what I outlined Wish I had found that beforeI wrote this post :IMAGEhttp://www.secuobs.com/revue/news/104008.shtmlhttp://www.secuobs.com/revue/news/104008.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - Learned something new today On x64, it's not possible to jmp directly toa 64 bit address as you might be used to on x86 with a single jmpinstruction Hooking functions on x86 was relatively simple withrespect to the trampoline All you needed was a JMP to the installedhook, totalling 5 bytes After poring over the IA64 reference and afew Google searches, the best trampoline I could find wasmov rax, 0x4142434445464748jmp raxWhen assembled, the above bit of code amounts to 12 bytes Using yasm,I got the following machine code0000000: 48b8 4847 4645 4443 4241 ffe0 HHGFEDCBAI kept the faith that there was a possibly smaller alternative,however, after checking with EasyHook it seems this is the defactostandard I'm no NET coder, but I managed to find my way to itstrampoline installation logic in DriverShared/LocalHook/installc atline 278RtlCopyMemoryHook-OldProc + RelocSize, Jumper_x64, 12;RtlCopyMemoryHook-OldProc + RelocSize + 2, etRelAddr, 8;The definition of Jumper_x64 matches right up with my yasm outputJumper_x6412 = {0x48, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xe0};IMAGEhttp://www.secuobs.com/revue/news/104007.shtmlhttp://www.secuobs.com/revue/news/104007.shtml Secuobs.com : 2009-05-31 19:44:45 - From a malicious attacker - Well, Kris finally gave his presentation on exploiting Intel CPU bugs atHITBSec Got word from ol that I received an honorable mention --Thanks Kris Would've been cool to get out to HITB, but alas, I ampoor and need to work : Slides are hereIMAGEhttp://www.secuobs.com/revue/news/104006.shtmlhttp://www.secuobs.com/revue/news/104006.shtml