Look out

got Metasploit running on my iphone4 after a few tweaks..

To jailbreak or not to jailbreak the iPhone 3G

I am blogging right now through my newly jailbroken iPhone 3g with 2.1 firmware... using some blogging application and typing on the tiny keyboard you may ask? Not today, I am infact using PDAnet a free Internet sharing app for jailbroken iPhones which allows you to connect your laptop pc (any variety) to your iPhone via ad-hoc wireless networking and then gain access to the Internet through your phones 3g or edge connection.

I can say this app alone is reason enough to jailbreak your iPhone... I mean, Starbucks coffee is expensive enough, paying for their Internet access is a slap in the face.

So what other wonderful goodies are available exclusively to a jailbroken iPhone? Well this is an Information Security blog so how could I not talk about the excellent new Stumbler Plus app. It is a full featured wardriving and wireless network auditing tool (GUI) and it is really quite sweet. Here are some features:

1. Finds hidden SSID's
2. Reverses AP MAC Addresses automatically to the Vendor name (COOL!)
3. Records Signal Strength, Encryption Type, and Long/Lat via GPS!

Only downsides I have found is there is no automatic feature to keep scanning while you drive, it requires you to repeatedly hit the scan button, also it doesn't seem to have a save or email results feature.

So those are the two killer jailbreak apps currently out for the iPhone 3g. I am sure some of you will wonder why I didn't mention nmap and metasploit, but if you have tried to use either on the buggy xterm app and tiny keyboard, it is not something to be desired. Maybe I will create a one button GUI version of metasploit that uses autopwn... hrmm my list of projects are getting out of control

Kaminsky DNS Cache Poisoning PoC Exploit in Metasploit SVN

Looks like Druid and HDM have release a proof of concept exploit in Metasploit to attack nameserver's using Kaminsky's now leaked vulnerability. This is huge because not only is the attack unbelievably easy execute, 95% of the Internet is still vulnerable!

This is a historical moment in IT Security and will be a very, very busy day for those of us on the defense side.

Exploit Code:

http://www.caughq.org/exploits/CAU-EX-2008-0002.txt

http://www.caughq.org/exploits/CAU-EX-2008-0003.txt

Or simply grab the latest metasploit:

svn co http://metasploit.com/svn/framework3/trunk/

Snort signatures I wrote for Emerging Threats:

alert udp any 53 -> $HOME_NET any (msg:"ET CURRENT_EVENTS DNS Query Responses with 3 RR's set (50+ in 2 seconds) - possible NS RR Cache Poisoning Attempt"; content: "|85 00 00 01 00 01 00 01|"; offset: 2; within: 8; threshold: type both, track by_src,count 50, seconds 2; classtype:bad-unknown; reference:url,infosec20.blogspot.com/2008/07/kaminsky-dns-cache-poisoning-poc.html; sid:2008447; rev:10;)

alert udp any 53 -> $HOME_NET any (msg:"ET CURRENT_EVENTS DNS Query Responses with 3 RR's set (50+ in 2 seconds) - possible A RR Cache Poisoning Attempt"; content: "|81 80 00 01 00 01 00 01|"; offset: 2; within: 8; threshold: type both, track by_src, count 50, seconds 2; classtype:bad-unknown; reference:url,infosec20.blogspot.com/2008/07/kaminsky-dns-cache-poisoning-poc.html; sid:2008457; rev:10;)


*** Update ***
New metasploit module out this morning which allows you to overwrite cache poisoning the NS record for an entire domain. This means if you have evil NS server to take requests you mass own entire domains such as google, microsoft, etc. Scary stuff.

http://blog.wired.com/27bstroke6/2008/07/dns-exploit-in.html