Tuesday, August 30, 2011

Wireless fun with your Macbook

Since OSX Snow Leopard there is an Airport wireless API that allows some fun tricks but it takes some minor setup to use it properly...

First make sure you can easily run the new Airport API utility:

sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/sbin/airport

Now you have easy ability to scan and sniff packets:

airport scan

And the sexiest feature is to dump packets in monitor mode:
sudo -s airport sniff 11

Note that you still cannot actively inject and sniff without using a realtek USB wifi card.

To stop the airport utility from sniffing drop it into the background and kill the process ID:

sudo -s killall airport

So what kind of attacks are possible without injection? Well any wireless traffic (non encrypted via WEP/WPA/HTTPS) on the channel your sniffing you can then read with a packet inspection tool like tcpdump which comes by default on your Mac. A pcap will be saved in the /tmp directory, simply read it in with tcpdump to see what fun you captured!

Gregs-MacBook-Air:tmp gregmartin$ ls /tmp |grep air

To print the ASCII content of all HTTP traffic:
tcpdump -s0 -Anr /tmp/airportSniffmcg8L2.cap port 80


tcpdump -s0 -Anr /tmp/airportSniffmcg8L2.cap port 80 |grep -i pass

Here we see an Android phone at the Boingo wireless captive portal ready to log in!

Of course you can use any libpcap tool such as Wireshark to analyze the resulting file.

Friday, August 12, 2011

Why you don't steal from a hacker

So during the London riots I return home the next morning to find my flat ransacked and my Macbook Pro laptop stolen!
Police showed up, took a report and dusted for prints, performed typical forensics... One thing they did not expect was that I had installed the amazing open source tracking software from http://preyproject.com

Once I flagged my laptop as missing within Prey, I waited eagerly for the first report to come in. I was concerned he wouldn't be able to get past the login password but he was clever enough to add a new account: Here is how to create a new admin account on a Mac

Almost two weary days had gone by and I'm at dinner on a business trip in Luxembourg and I received an email which nearly knocked me out of my chair with excitement.

Next thing I did was buy a pack of smokes and run back to my hotel room so the games could begin... I cranked up the frequency of reports to one in every five minutes to try to get a screen capture of him using gmail or facebook so I could snag a name or login credentials.

After two hours hours of watching him surf religious revelation videos, shopping for Mercedes A class on autotrader he finally popped onto facebook! This was the treasure trove of information, at this point I had the following:

His Name: Sxxxxx Kxxxx
His School: xxxx School Class of 2009
His address: xxx N End Rd London W14
His IP Address: 90.201.72.xx
His wireless AP: SKY378xx
His Facebook Page: https://www.facebook.com/profile.php?id=101952xxx

Of course I had pictures of him from the webcam on my Macbook as well as his Facebook page, now I just had to pass the info on to London Metro police and get to bed at a decent hour as I had to run an all-day meeting the following morning!

The tip of the iceberg, now that all the details were collected, London Metro police could make their move!

And the icing on the cake... justice served. Add me on twitter @gregcmartin lets laugh together!

Monday, April 11, 2011

ArcOSI 2.8 released

Releasing a new and greatly enhanced version of ArcOSI tonight with the following new features:

Config file support
White listing
http and https proxy support
New feeds

Fixed numerous bugs and finally updated the Windows EXE version!

Snag a copy @ http://code.google.com/p/arcosi

Thursday, March 31, 2011

Samsung Key Logger Mess

So some brilliant writer for network world "Mohamed Hassan (CISSP)", reported based on his anti-virus tool having a false positive finding "Star Logger" key logger installed on his new Samsung Laptop. So the story quickly spread across the blogosphere including engadget and other high profile blogs then was amplified by twitter.

Apparently the AV he ran only looks for "c:\windows\SL" directory. What! This shows the terrible state of A/V software and how poor the detection signature actually can be. Seriously looking for the presence of a directory is extremely poor...

Will be interesting if Samsung sues anyone in this matter as this has not been positive PR for them. And all you blog slinging CISSP's need to slow your roll and stick to blogging about professional's research and not what your laptop's A/V client back.

Other fun A/V fail stories:
McAfee Kills Windows PC's by the thousands
Symantec Nukes Thousands of Chinese PC's


Sunday, March 27, 2011

Message from Comodo hacker

This was copied from: http://pastebin.com/74KXCaEZ


I'm writing this to the world, so you'll know more about me..

At first I want to give some points, so you'll be sure I'm the hacker:

I hacked Comodo from InstantSSL.it, their CEO's e-mail address mfpenco@mfpenco.com
Their Comodo username/password was: user: gtadmin password: [trimmed]
Their DB name was: globaltrust and instantsslcms

GlobalTrust.it had a dll called TrustDLL.dll for handling Comodo requests, they had resellers and their url was:

Enough said, huh? Yes, enough said, someone who should know already knows...Am I right Mr. Abdulhayoglu?

Anyway, at first I should mention we have no relation to Iranian Cyber Army, we don't change DNSes, we

just hack and own.

I see Comodo CEO and others wrote that it was a managed attack, it was a planned attack, a group of

cyber criminals did it, etc. etc. etc.

Let me explain:

a) I'm not a group of hacker, I'm single hacker with experience of 1000 hackers, I'm single programmer with

experience of 1000 programmers, I'm single planner/project manager with experience of 1000 project

managers, so you are right, it's managed by a group of hackers, but it was only I with experience of 1000


b) It was not really a managed hack. At first I decided to hack RSA algorithm, I did too much

investigation on SSL protocol, tried to find an algorithm for factoring integer, analyzed existing algorithms, for now I was not

able to do so, at least not yet, but I know it's not impossible and I'll prove it, anyway... I saw

that there is easier ways of doing it, like hacking a CA. I was looking to hack some CAs like Thawthe,

Verisign, Comodo, etc. I found some small vulnerabilities in their servers, but it wasn't enough to

gain access to server and sign my CSRs. During my search about InstantSSL of Comodo which signs CSRs immediately I found

InstantSSL.it which was doing it's job under control of Comodo.

After a little try, I analyzed their web server and easily (easy for me, so hard for others) I got FULL access on the server, after a little investigation on their

server, I found out that TrustDll.dll takes care of signing. It was coded in C# (ASP.NET).

I decompiled the DLL and I found username/password of their GeoTrust and Comodo reseller account.

GeoTrust reseller URL was not working, it was in ADTP.cs. Then I found out their Comodo account works

and Comodo URL is active. I logged into Comodo account and I saw I have right of signing using APIs. I

had no idea of APIs and how it works. I wrote a code for signing my CSRs using POST request to those

APIs, I learned their APIs so FAST and their TrustDLL.DLL was too old and was not working properly, it doesn't send all needed parameters,

it wasn't enough for signing a CSR. As I said, I rewrote the code for !AutoApplySSL and !PickUpSSL
APIs, first API returns OrderID of placed Order and second API returns entire signed

certificate if you pass OrderID from previous call. I learned all these stuff, re-wrote the code and

generated CSR for those sites all in about 10-15 minutes. I wasn't ready for these type of APIs, these

type of CSR generation, API calling, etc. But I did it very very fast.

Anyway, I know you are really shocked about my knowledge, my skill, my speed, my expertise and entire attack.

That's OK, all of it was so easy for me, I did more important things I can't talk about, so if you have to

worry, you can worry... I should mention my age is 21

Let's back to reason of posting this message.

I'm talking to the world, so listen carefully:

When USA and Israel creates Stuxnet, nobody talks about it, nobody blamed, nothing happened at all,

so when I sign certificates nothing should happen, I say that, when I sign certificates nothing should

happen. It's a simple deal.

I heard that some stupids tried to ask about it from Iran's ambassador in UN, really? How smartass you are?
Where were you when Stuxnet created by Israel and USA with millions of dollar budget, with access to SCADA systems and Nuclear softwares? Why no one asked a question from Israel and USA ambassador to UN?
So you can't ask about SSL situtation from my ambassador, I answer your question about situtation: "Ask about Stuxnet from USA and Israel", this is your answer, so don't waste my Iran's ambassador's worthy time.

When USA and Isrel can read my emails in Yahoo, Hotmail, Skype, Gmail, etc. without any simple

little problem, when they can spy using Echelon, I can do anything I can. It's a simple rule. You do,

I do, that's all. You stop, I don't stop. It's a rule, rule #1 (My Rules as I rule to internet, you should know it


Rule#2: So why all the world worried, internet shocked and all writers write about it, but nobody

writes about Stuxnet anymore? Nobody writes about HAARP, nobody writes about Echelon... So nobody

should write about SSL certificates.

Rule#3: Anyone inside Iran with problems, from fake green movement to all MKO members and two faced

terrorists, should afraid of me personally. I won't let anyone inside Iran, harm people of Iran, harm

my country's Nuclear Scientists, harm my Leader (which nobody can), harm my President, as I live, you

won't be able to do so. as I live, you don't have privacy in internet, you don't have security in

digital world, just wait and see...By the way, you already have seen it or you are blind, is there any larger target than a CA in internet?

Rule#4: Comodo and other CAs in the world: Never think you are safe, never think you can rule the

internet, ruling the world with a 256 digit number which nobody can find it's 2 prime factors (you think so), I'll show

you how someone in my age can rule the digital world, how your assumptions are wrong, you already understood it, huh?

Rule#5: To microsoft, mozilla and chrome who updated their softwares as soon as instructions came from

CIA. You are my targets too. Why Stuxnet's Printer vulnerability patched after 2 years? Because it was

needed in Stuxnet? So you'll learn sometimes you have to close your eyes on some stuff in internet,

you'll learn... You'll understand... I'll bring equality in internet. My orders will equal to CIA orders,

lol ;)

Rule#6: I'm a GHOST

Rule#7: I'm unstoppable, so afraid if you should afraid, worry if you should worry.

My message to people who have problem with Islamic Republic of Iran, SSL and RSA certificates are broken, I did it one time, make sure I'll do it again, but this time nobody will notice it.
I see some people suggests using VPNs, some people suggests TOR, some other suggests UltraSurf, etc. Are you sure you are safe using those? RSA 2048 was not able to resist in front of me, do you think UltraSurf can?

If you was doing a dirty business in internet inside Iran, I suggest you to quit your job, listen to sound of most of people of Iran, otherwise you'll be in a big trouble, also you can leave digital world
and return to using abacus.

A message in Persian: Janam Fadaye Rahbar

[UPDATE 1]: Also check this: http://pastebin.com/DBDqm6Km

Tuesday, February 22, 2011

Webinar: Integrating Open Source Intelligence with ArcOSI

Join me today for a webinar of how integrating Open Source Intelligence within ArcSight ESM using ArcOSI.

If you would like to register: http://www.arcsight.com/webinars/watch/integrating-open-source-intelligence-osint/

Topics we will cover:

What is OSINT and how has it become a powerful SIEM use cases for 2011. The following webinar will cover:
• Why A/V does not cut it anymore
• How to detect the new threat: APT, client-side, malware
• What OSINT is
• An introduction to ArcSight Open Source Intelligence (ArcOSI)

Thursday, January 13, 2011

ArcOSI 2.1 Released!

Just uploaded the newest version of ArcOSI Open Source Intelligence Utility for use with ArcSight ESM. I've added several new malware domain feeds and improved the code to handle connection errors, etc. I'm making time for this project now and will soon add support very soon for proxy and proxy-auth as this has been requested numerous times!

Thanks to everyone who has tested and just a reminder feel free to reach out directly if you have any issues, feedback or requests.