Leaderboard

Introduction Ok. Dup? cum v-am obi?nuit îmi place s? aduc câte ceva mai diferit. Ast?zi vom discuta despre subiectul: "Cum putem sparge un cont (al unei victime) al oric?rui site web cu ajutorul ingineriei sociale". Dar punctul culminant nu este ingineria social?, ci metoda prin care ob?inem datele de autentificare în cazul cel mai bun (în plain text) sau putem s? ne mul?umim doar cu sesiunea acestuia (care este totodat? suficient? pentru a surfa în contul s?u). Concept Care este ideea. Poate c? mul?i dintre voi a?i auzit de Burp Suite. Este o platform? scris? în java, special creat? pentru cei care doresc s? fac? penetration testing. Ce m-a atras la prima vedere? O chestie interesant? legat? de proxy. Pe scurt s? cre?m un server proxy cu ajutorul aplica?iei prin care vom intercepta traficul victimelor ce folosesc proxy-ul nostru. Adic? s? facem sniffing, dar de la distan??. The Proof Pentru a realiza un exemplu cât mai frumos ?i clar, am luat leg?tura cu 311733 (c? era online pe chat ?i dornic s? ma ajute) pentru a se pune în postura de victim?. A?a c? am început prin a configura Burp Suite-ul ca în imaginea de aici. În acest moment mi-am transformat calculatorul într-un server proxy. Dup? ce am convins victima s? foloseasc? HTTP proxy-ul în browser-ul s?u, vom putea s?-i intercept?m nestingheri?i traficul ca în imaginea asta sau asta. Vedem sesiunea cu parola encriptat?, care sunt mai mult decât necesare pentru a ne îndeplini scopul. Social Engineering examples S? presupunem c? victima are nevoie urgent? de o metod? care s? îi ascund? pentru câteva momente identitatea, a?a c? voi îi ve?i propune s? foloseasc? un HTTP proxy securizat spunându-i c? e foarte bun c? l-a?i mai folosit ?i c? ave?i încredere în el. Dup? ce îl va configura, îî intercepta?i conturile (dac? datele de logare c?tre acele site-uri se transmit în plain text), sau ca în pozele de mai devreme, encriptate. Alte scenarii pot fi n?scocite în câteva minute deoarece nu d? nimic de b?nuit, gen: posta?i pe un forum HTTP proxy-ul iar cine îl folose?te devine victim?. Trimite?i c?tre un administrator al unui forum un mesaj privat c? nu ?ti?i dac? a?i configurat bine acel proxy s? îl verifice dac? este bun sau trebuie s? încerca?i altul s.a.m.d Sper c? v? va fi de folos pe viitor acest tutorial. Baft?.

Salut tuturor. Scuze c? am creat acest topic inutil ! Doar vreau s? v? anun? c? am fost ad?ugat în Hall of Fame la Apple. P.S: Nu vreau s? m? laud cu asta Am vrut s? fac o mic? reclam? la RST ! Si din câte v?d se pare c? mai avem un membru de aici in HoF ! V? mul?umesc pentru aten?ie !

to be seen...

Security researcher Karsten Nohl says some SIM cards can be compromised because of wrongly configured Java Card software and weak encryption keys. Smartphones are susceptible to malware and carriers have enabled NSA snooping, but the prevailing wisdom has it there’s still one part of your mobile phone that remains safe and un-hackable: your SIM card. Yet after three years of research, German cryptographer Karsten Nohl claims to have finally found encryption and software flaws that could affect millions of SIM cards, and open up another route on mobile phones for surveillance and fraud. Nohl, who will be presenting his findings at the Black Hat security conference in Las Vegas on July 31, says his is the first hack of its kind in a decade, and comes after he and his team tested close to 1,000 SIM cards for vulnerabilities, exploited by simply sending a hidden SMS. The two-part flaw, based on an old security standard and badly configured code, could allow hackers to remotely infect a SIM with a virus that sends premium text messages (draining a mobile phone bill), surreptitiously re-direct and record calls, and — with the right combination of bugs — carry out payment system fraud. Payment fraud could be a particular problem for mobile phone users in Africa, where SIM-card based payments are widespread. The deployment of so-called NFC payment technology, already slow to take off, could also be at risk, Nohl says, as well as the ability for carriers to track charges to each caller’s account. There’s no obvious pattern to the flaw beyond the premise of an older encryption standard. “Different shipments of SIM cards either have [the bug] or not,” says Nohl, who is chief scientist at risk management firm Security Research Labs. “It’s very random.” In his study, Nohl says just under a quarter of all the SIM cards he tested could be hacked, but given that encryption standards vary widely between countries, he estimates an eighth of the world’s SIM cards could be vulnerable, or about half a billion mobile devices. Nohl, who was profiled by Forbes’ Andy Greenberg in 2011 for his work on breaking mobile encryption standards, believes it unlikely that cyber criminals have already found the bug. Now that word of the vulnerability is out, he expects it would take them at least six months to crack it, by which time the wireless industry will have implemented available fixes. That effort may already be underway. Nohl says at least two large carriers have already tasked their staff with finding a patch for the SIM vulnerability, which they will share with other operators through the wireless trade body GSMA. “Companies are surprisingly open to the idea of working cooperatively on security topics because the competition is somewhere else,” says Nohl. “The competition is organized crime, not AT&T versus T-Mobile.” (The situation in similarly in finance, where payment services like MasterCard, Visa, and American Express will work together under industry association EMVco to improve security standards for smart cards.) The market for SIMs is almost entirely fed by mobile carriers, and supplied by two leading global vendors, Gemalto and Oberthur Technologies. Both have profited heavily from the huge growth in mobile handsets: two years ago there were 1 billion SIM cards worldwide, and today there are more than 5 billion, says ABI Research analyst John Devlin, though the market is slowly reaching a plateau. SIMs are thought to be one of the most secure parts of a phone, he added, and as the carrier’s property, are “key to their relationship between you and I, the subscriber.” Vodafone would not answer questions about the level of encryption its SIM cards used, and referred all media questions to GSMA. Both Verizon and AT&T said they knew of Nohl’s research, but said their SIM profiles were not vulnerable to the flaw. AT&T added that it had used SIMs with triple Data Encryption Standards (3DES) for almost a decade; Verizon did not specify why its SIMs were not vulnerable. The London-based GSMA said it had looked at Nohl’s analysis and concurred that “a minority of SIMs produced against older standards could be vulnerable.” It said it had already provided guidance to network operators and SIM vendors who could be impacted by the flaw. “There is no evidence to suggest that today’s more secure SIMs, which are used to support a range of advanced services, will be affected,” a spokesperson added. Karsten Nohl Nohl says that while AT&T and Verizon may benefit from robust SIM encryption standards, other carriers will use straight Data Encryption Standards (DES), guidelines developed in the 1970s that are fundamental to why he was able to “get root” on dozens of SIMs cards. “Give me any phone number and there is some chance I will, a few minutes later, be able to remotely control this SIM card and even make a copy of it,” Nohl says. SIM cards are essentially mini-computers with their own operating system and pre-installed software. To maintain security, many rely on a cryptographic standard called DES (digital encryption standard), which was invented by IBM in the 1970s and improved by the NSA. Some networks, like AT&T and the four major carriers in Germany, have moved away from using the old version of the standard, but others have not. Though Nohl didn’t identify a pattern to vulnerable SIMs in terms of manufacturers, the ones he could hack all used the old encryption standard. Key to the hack is Java Card, a general purpose programming language used on 6 billion SIM cards. If operators need to update something on your SIM, for instance allowing interoperability with a carrier in another country, it will execute the right Java Card programs on your SIM by sending your mobile a binary SMS. This is a text message you will never see, sent through a method called over-the-air programming (OTA). In early 2011, Nohl’s team started toying with the OTA protocol and noticed that when they used it to send commands to several SIM cards, some would refuse the command due to an incorrect cryptographic signature, while a few of those would also put a cryptographic signature on this error message. With that signature and using a well known cryptographic method called rainbow tables, Nohl was able to crack the encryption key on the SIM card in about one minute. Carriers use this key to remotely program a SIM, and it is unique to each card. “Anybody who learns the key of a particular SIM can load any application on the SIM he wants, including malicious code,” says Jasper Van Woudenberg, CTO North America of smart-card security firm Riscure. “We had almost given up on the idea of breaking the most widely deployed use of standard cryptography,” says Nohl, but it felt “great” to finally gain control of a SIM after many months of unsuccessful testing. With the all-important (and till-now elusive) encryption key, Nohl could download a virus onto the SIM card that could send premium text messages, collect location data, make premium calls or re-route calls. A malicious hacker could eavesdrop on calls, albeit with the SIM owner probably noticing some suspiciously-slow connections. Nohl found a second bug. Unrelated to the weak encryption key, it allows even deeper hacking on SIMs and is caused, Nohl says, by a mistake on the part of SIM card manufacturers. Java Card uses a concept called sandboxing, in which pre-installed programs like a Visa or PayPal app are shielded from one another and the rest of the SIM card. The term comes from the idea of only allowing programs to “play with their own toys, in their own sandbox,” says Nohl. “This sandboxing mechanism is broken in the most widely-used SIM cards.” The researcher says he found a few instances where the protocols on the SIM card allowed the virus he had sent to a SIM, to check the files of a payment app that was also installed on the card. The way this works is somewhat complex, but Nohl’s virus essentially gave the infected Java software a command it could not understand or complete – eg. asking for the 12th item in a 10-item list, leading the software to forgo basic security checks and granting the virus full memory access, or “root,” in cyber security parlance. In sum, a malicious hacker who wanted to use this method might start with a list of 100 phones. They could send a binary SMS to all of them, using a programmable cell phone connected to a computer. They might get 25 responses with cryptographic signatures, and dismiss the half that use a stronger security standard. From the rest, Nohl surmises they could crack the encryption key of perhaps 13 SIM cards, and send them a virus that breaks through the Java Card sandbox barriers and reads payment app details, as well as the master key of the SIM card. Who’s to blame for this and who can fix it? Nohl says broken Java sandboxing is a shortcoming of leading SIM card vendors like Gemalto and Oberthur. Riscure’s Van Woudenberg agrees. Gemalto which made about half its $2.5 billion revenue in 2012 selling SIM cards, said in an email to Forbes that its SIMs were “consistent with state-of-the-art and applicable security guidelines,” and that it had been working closely with GSMA and other industry bodies to look into Nohl’s research. Gemalto’s CEO Olivier Piou has said publicly that there are no security issues with mobile payments, and his company says on its website that SIM cards are “virtually impossible to crack.” Despite this, Nohl believes badly-configured Java Card sandboxing “affects every operator who uses cards from two main vendors,” including carriers like AT&T and Verizon who use robust encryption standards. Are SIM cards with these 3DES standards vulnerable? Nohl suggests they might be, and that he’ll expound on the details at Black Hat. At minimum it seems that carriers should upgrade to newer encryptions quickly, not just for the safety of their subscribers, but future revenue too. Payment providers like MasterCard and Visa will need to use the OTA protocol to fill SIM cards with Java applications, like credit card applets, and enable NFC-based payments on phones in the future — and they’ll pay carriers for the privilege of being on the SIM. “Operators see this as valuable real estate,” says Nohl, referring to this OTA communication channel. Leaving aside what this means for consumer privacy, Nohl’s findings may leave some carriers grappling with new questions over the security (and value) of this real estate. “Carriers and SIM card manufacturers do need to step up their security game for when payments arrive,” says Van Woudenberg. Banks are slow and cautious with new technology as they wait for it be proven secure, he adds, but “the mobile world moves much faster, as time-to-market is for them more important.” As mobile payments bring these two worlds together, Nohl’s research has shown the process of proving out security on SIMs could be more challenging than the key players originally thought. Sursa

Când este vorba de o echip?, atât repro?urile cât ?i laudele sunt primite tot în echip?. E ?i vina administratorului deoarece el ?i-a ales aceast? echip?. Dac? o s? te ui?i s? vezi cine este în staff: https://rstforums.com/forum/showgroups.php, o s? observi c? sunt mul?i. El trebuie s? fac? prima mutare. Dac? cei actuali nu mai sunt în stare s? modereze, s? fie da?i afar? ?i s? vin? un nou val de oameni cu principii care s? men?in? ordinea. Nu trebuie s? fie luat? în primul moment o m?sur?. Este ok dac? ?i dupa 5 reply-uri se face ceva. S? se baneze ?i s? fie mutate la co? sau sterse acele thread-uri infecte ce nu au ce c?uta pe un forum de securitate.

Nu am cerut s? am vreo func?ie pompoas?, am zis s? ajut comunitatea având de început doar 3 lucruri (s? pot da avertismente, s? pot edita ?i s? pot închide un thread), care sunt ustensilele principale pentru a face o treab? bun? ?i nu de mântuial?. Am f?cut asta pentru c? m-am autosezizat în spirit de ajutor. V? sim?iti deranja?i de ceea ce spun? Schimba?i-v? voi ?i face?i-v? treaba cum trebuie ca s? fie un loc primitor pentru cei care au poten?ial. Ceea ce fac eu acum nu se nume?te lingu?eal?, ci din contra. Nytro, în acest thread nu este vorba doar de realiz?ri (aplica?ii create, ajutor reciproc, etc) ci ?i de treaba voastr? ce o ave?i aici. Nu face?i nimic impotriva celor care nu merit? s? fie aici ?i atunci când cineva se ofer? s? ajute îl elimina?i din calcule din prima. Baft? ?i fi?i mai receptivi.

STEAM GIVEAWAY - #1 Vad ca sunt pe plac concursurile mele, asa ca m-am decis sa mai fac. Am 800$ in Steam Wallet, din care 50$ o sa impart cu voi. Concursul va fi constituit de 2 parti. Part 1 - Graphic Creation - 35$ Aceasta parte va fi una care sa ma ajute si pe mine. Construiti-mi un wallpaper / gasiti-mi unul care sa indeplineasca urmatoarele CERINTE: Culori principale: albastru (70%), alb (20%), alte culori care sa se potriveasca (10%) 1440x900 Fara vectori grafici, cum ar fi logouri, sigle etc. Vreau ceva text-based Sa aiba ca tema principala securitatea informatica Postati-le aici, ca un link, cand ajung la ceva care imi place opresc concursul si castigatorul va fi contactat de mine pentru a isi alege jocurile . Part 2 - Luck - BONUS - 15$ - WON BY WTF123 Aici o sa fiu putin mai creativ. Trebuie sa postati o anumita ora, de format hh:mm, inclusa intre orele 10:00 si 15:00. Cine nimereste primul aceeasi ora ca si mine, va castiga. Intervalul de minute este de 20, deci orele pot fi de tip 10:00, 10:20, 10:40 etc. Screenshot by Lightshot Deci, ghiciti ora din acel screenshot dupa regulile mele. UN USER POATE AVEA MAXIM 3 INCERCARI, DECI PUTETI POSTA MAXIM 3 ORE. Userii noi, care nu au contribuit cu nimic comunitatii nu pot participa la nici unul dintre concursuri. Postati va rog dupa modelul acesta: Particip la concursul 1/2 : Intrarile mele (link catre wallpaper / cele 3 ore) : Succes tuturor! UPDATE #1: Ofer cate un joc de pana la 5$, pe STEAM, pentru cele mai bune idei pt. concursuri viitoare . UPDATE #2: Inca astept entryuri pentru Graphic Creation, dar am schimbat tema. Vreau ceva intunecat, negru, un exemplu e wallpaperul celor de la Cyber Smart Defence. Se accepta vectori grafici. CONCURSURILE VIITOARE 1. Voi crea un campionat de League Of Legends, cu premii substantiale pe Steam . 2. Random pe steamgifts.com