Diary of Michael Daw » Great Links

IIS 6.0 WebDav Exploit, Adobe 8-9.1 JavaScript Exploits, Cisco Works TFTPD Directory Traversal

dk — Thu, 21 May 2009 15:45:22 +0000

Microsoft IIS 6.0 with Webdav is vulnerable to an authentication bypass vulnerability. The exploit has already been made public:
http://www.milw0rm.com/exploits/8704

Proof of concept taken from above URL:

GET /prot%c0%afected/protected.zip HTTP/1.1
Translate: f
Connection: close
Host: servername

Adobe version 8-9.1 have been smacked with more JavaScript command execution bugs. A lot of vendors are starting to recommend disabling JavaScript, something I suggested back in 2007 when I released the Adobe JavaScript DB backdoor. Here are links to the 5 Adobe exploits released on Milw0rm thus far (2009):

2009-05-04	Adobe Acrobat Reader 8.1.2 – 9.0 getIcon() Memory Corruption Exploit	7501	R	D	Abysssec
2009-04-29	Adobe 8.1.4/9.1 customDictionaryOpen() Code Execution Exploit	8078	R	D	Arr1val
2009-04-29	Adobe Reader 8.1.4/9.1 GetAnnots() Remote Code Execution Exploit	7579	R	D	Arr1val
2009-03-24	Adobe Acrobat Reader JBIG2 Universal Exploit Bind Shell port 5500	8153	R	D	Black Security
2009-02-23	Adobe Acrobat Reader JBIG2 Local Buffer Overflow PoC #2 0day	26871	R	D	Guido Landi

You can disable Adobe Javascript as follows:
1. Launch Acrobat or Adobe Reader.
2. Select Edit>Preferences
3. Select the JavaScript Category
4. Uncheck the ‘Enable Acrobat JavaScript’ option
5. Click OK

Products that have TFTP services enabled and that run CiscoWorks Common Services versions 3.0.x, 3.1.x, and 3.2.x are vulnerable. Only CiscoWorks Common Services systems running on Microsoft Windows operating systems are affected.

CiscoWorks TFTP Directory Traversal Vulnerability. According to Cisco the following software types and versions are vulnerable:

Cisco Unified Service Monitor versions 1.0, 1.1, 2.0, and 2.1

CiscoWorks QoS Policy Manager versions 4.0 and 4.1

CiscoWorks LAN Management Solution versions 2.5, 2.6, and 3.0

Cisco Security Manager versions 3.0, 3.1, and 3.2

Cisco TelePresence Readiness Assessment Manager version 1.0

CiscoWorks Voice Manager versions 3.0 and 3.1

CiscoWorks Heath and Utilization Monitor versions 1.0 and 1.1

Cisco Unified Operations Manager versions 1.0, 1.1, 2.0 and 2.1

Cisco Unified Provisioning Manager versions 1.0, 1.1, 1.2 and 1.3

Workarounds
To mitigate this vulnerability, administrators can disable TFTP services by completing the following steps:
Step 1. Choose “Start > Settings > Control Panel > Administrative Tools > Services to access the Services window.
Step 2. Right-click “CWCS tftp service” and select “Properties”.
Step 3. Set the “Startup Type” to “Disabled”.
Step 4. Click the “Stop” button to stop the TFTP service.

Still waiting for details on a proof of concept for this.

TCP/IP Security Assessment, FreeBSD Telnet 0-Day, RainbowCrack 1.3, Nokia N95 DoS, Bounty for Worm Author

dk — Thu, 19 Feb 2009 09:59:43 +0000

TCP/IP Security Assessment

The United Kingdom’s Centre for the Protection of National Infrastructure has just released the document “Security Assessment of the Transmission Control Protocol (TCP)”.

I find the document title a little ambiguous, as a security assessment generally refers to active research where from my brief overview, is in fact more of a whitepaper giving an excellent overview of existing and well-known TCP/IP vulnerabilities (i.e. SYN flooding, Weak sequence numbers, port scanning techniques and more). It must be one of the best TCP/IP security overview whitepapers I’ve seen. Worth a read. Very nice work.

FreeBSD Telnet 0-Day

Kingcope Kingcope released a zero-day telnetd vulnerability, affecting FreeBSD 7.x. Telnetd allows environment variables to get passed to a remote session. FreeBSD made some recent changes which allowed Kingcope to set malicious environment variables using dynamic linker files (LD_PRELOAD). Interesting seeing Telnet in the news again after the 2007, Solaris 10 Telnet exploit (telnet -froot host). FreeBSD have made a fix available.

RainbowCrack 1.3 Released

RainbowCrack is a general propose implementation of Philippe Oechslin’s faster time-memory trade-off technique. In short, the RainbowCrack software is a hash cracker that use time-memory tradeoff algorithm.

RainbowCrack 1.3 has been formally released. It has some nice features including multicore processor support, improved hash algorithm and overlapped computation and harddisk read.

Nokia N95 DoS

jplopezy released a proof of concept exploit that supposedly crashes the Nokia N95. The vulnerability uses JavaScript’s setAttributeNode function, which is part of JavaScript’s XML DOM suite of functions. The PoC looks like this:
script r=document.getElementById('c'); a=r.setAttributeNode(); /script

$250,000 reward for Microsoft Worm Writer

A bounty has been set by Microsoft for information leading to the arrest of the Conficker worm author.

Conficker, also known as Downadup and Kido, has surprised many security experts with its success in propagating across the Internet. First discovered in November 2008, the worm has infected at least 11.4 million computer systems, according to a census of compromised Internet addresses carried out by SRI International.

Hacker News: Backtrack 4 Beta, Web Services Testing, Monster Hacked and More

dk — Wed, 11 Feb 2009 23:29:30 +0000

Backtrack 4 BETA released

The guys at Backtrack have released Backtrack 4 BETA. Cool changes include Kernel 2.6.28.1 with better hardware support, Pico e12, e16 support, better wireless injection support, RFID support and a bunch of new tools.

Fasttrack security tool gets spotlight

David Kennedy’s Fasttrack tool got high reviews after Shmoocon. It provides CLI and a cool web frontend. You can automate Metasploit, brute force weak sa passwords on MS SQL serve IP ranges, find SQL injection vulnerabilities with an INJECTME placeholder and more more. The tool is only available in Backtrack. A nice demo here.

SQL Map 0.6.4 released

Bernardo Damele releases Sqlmap version 0.6.4. New features include a better string comparison engine and some major bug fixes.

Monster gets hacked

Monster got hacked and had millions of hob seeker data stolen. Would hate to be the infosec manager. I don’t think data has been released about how the hack occured, however, contact and account details were lost, including user IDs, passwords, email addresses, names, phone numbers, and basic demographic data.

Next-Gen WordPress Vulnerability Scanner released

BlogSecurity releases next-gen WordPress scanner. The tool is still BETA but has some cool new features like an XML driven test engine allowing anyone to contribute tests. We hope to split this project off to other open source apps. as resources permit.

DNS DDoS Saga Continues

For those who haven’t heard, a few weeks ago reports started coming in of odd (.) DNS queries. It has since been found to be a distributed denial of service vulnerability targetting the Internet ROOT nameserver. The attack was actually working and the ROOT nameservers began to slow… SANS have released a tool to test your DNS server and include some config advice to fix it.

There are rumours that this attack may have been part of some mass DNS poisoning attack inspired by Dan Kaminsky’s DNS vulnerability research released last year.

Laramies Corner’s gives some nice links to web services pentesting

Christian Martorella over at Laramies Corner has put together some nice links for web services testing. Definately a page to keep bookmarked for quick reference.

Automated Web Vulnerability Scanner Comparison

anantasec posted a scanner comparison to the web security mailing list. I found it quite an interesting read. Its really useful if anyone is planning on forking out for one of these tools. A copy of the report is here.

Sex, Photos, Scandals…

wooshy — Tue, 09 Sep 2008 23:26:58 +0000

Well hopefully got your attention here! But the old adage that sex sells and sensationalism grabs punters is always relevant. And these are the little tricks that are used to get people click, download, install malware. In general, people have wised up about download and installing software through malicious hyperlinks in email and websites.
But users can still be fooled if the surrounding context around the malware entices you to install it. One way is the ‘pay-per-view’ technique, where a website or hyperlink states something like Sex Scandal campaign involving Barack Obama. Users will want to know, curiosity gets the better of them and possibly without thinking, they look at the video, which happens to install malware.
Another similar technique is being authoritative and stating you have to install plug-ins and software to use the application properly. This is the case for the Fake Twitter profile with the OrkutTron Trojan

Viva las vegas

wooshy — Tue, 05 Aug 2008 22:20:56 +0000

Anyone who is anyone is in Las Vegas right now. No, not for the world series of the poker but for the black hat security conference. It runs from August 2nd to 7th and looks like a who’s who of security bods are in attendance. But it’s really the sister conference that probably take note, the security industry’s version of wrestlemania, defcon, which conveniently runs from August 8-10. If you are like me and not lucky enough to go then at least check out those websites there’s some useful briefings allegedly.

If you want a laugh, the defcon 16 badge is in the open.

Getting Certified (Part II): Security Certs

wooshy — Sat, 28 Jun 2008 11:23:14 +0000

Well what about security certifications? There are useful guides to certifications at about.com and dmiessler.com. Arguably, the better internationally known certifications listed are CISSP and SCNP. One recent addition into this arena is the Certified Ethical Hacker (CEH). Their course outline provides a very good background on what you should know as a security tester. Whether the content is any good is another thing.

Also have a look at Bruce Schneier’s thoughts on security certifications, along with Marcus Rankum’s counterpoint.

Then there are government certifications. In the UK, they apply to security companies and personnel that may work on government projects, which usually are not for public consumption. These accreditation allow cleared companies to work on these projects whilst adhering to some stringent rules. The thought process for this is that the government get an independent review of their systems from their pool of accredited testers. The Communications-Electronics Security Group (CESG) set the precedence for security of communications and data. They have a number accreditation schemes for companies. They include CESG Listed Adviser Scheme (CLAS), which focuses in the audit and policy side of security and CHECK which provides a more technical audit and healthcheck of systems. Although the latter is being phased out by Council of Registered Ethical Security Testers (CREST)
On the other side of the pond, it is a bit unclear who would be allowed to work on government projects but it appears they have agencies just for that very thing. For example, the states have National Institute of Standards and Technology (NIST) who offer services including Federal Information Processing Standard Publications. Canada have a similar agency setup in Communications Security Establishment Canada (CSEC).

Getting Certified (Part I): General Thoughts

wooshy — Sat, 28 Jun 2008 11:20:52 +0000

Like with other fields in the computer industry, the big question is do you want/need to get certified?

Experience counts for a lot and one argument is, the material covered by the certification quickly becomes irrelevant and you have to keep shelling out money to keep up with the accreditation. For example, I have a Sun Java 2 Programmer certification from many, many years ago. But that is not going to do me any good right now, even though I do have base Java knowledge, Java and me like a separated/divorced couple have grown apart! Another train of thought is that certain vendors push their certification too hard and now so many people have the qualification, it cheapens the qualification.
However, having a recent qualification should at least illustrate that you have the base knowledge and cannot hurt your CV credentials.

Big players like Checkpoint, Cisco, IBM, Microsoft, Oracle, Redhat and Sun (Java) have established programs. Other players (particularly open-source) are still setting up such as PHP and Perl.

Dos and Don’ts of Firewalling

wooshy — Sat, 21 Jun 2008 22:53:53 +0000

Firewalls are usually your first line of defence and often in an n-tier environment, your second and third line too. As someone told me, you are only as secure as your weakest link. And as Anne Robinson would tell you, humans are the weakest link. Firewalls need policies in place created by you’ve guessed it humans.
But all is not lost! There are good guides on creating decent policies from seclists.org, principle logic and the whitepaper from windowsecurity.com.

Let’s take it from security assessment point of view. You have been given a firewall configuration. You can use the above guides to make some suggestions about policies. Now I don’t profess to be a know-it-all at firewalls but you should look for and be suspicious of any traffic that is permitted between two interfaces. Permit and any rules are always suspicious! Is the traffic encrypted? Is it using a standard port? Are the interfaces in question externally interfacing? Any non-standard/unfamiliar ports should be looked into and establish what they are exactly used for, if this is possible. It maybe that these ports are related to the vendor software. In which case, you should look up any weaknesses relating to the port service offered by the vendor. For example, if there is a rule for SIP (port 5060) then they maybe vulnerable to this cisco advisory.

Top 10 Weird Disasters

wooshy — Wed, 18 Jun 2008 08:04:10 +0000

The weirdest data disasters… It’s a bit like when I was in school and my cat ate my homework… really it did happen! This is courtesy of silicon

10. All in a spin: A customer who told engineers she had ‘washed away all her data’ after putting a USB stick through a cycle in her washing machine.
9. Feeding time: A father who, while feeding his baby daughter, forgot about the USB stick in his top pocket. As he leant over the high-chair the device fell into a dish of apple puree.
8. Row, row your boat: A fisherman took his laptop in his rowing boat. Both he and the laptop went overboard, taking all his data to the bottom of a lake.
7. Honeymoon hell: One wedding photographer overwrote the photos of one wedding with another event – and needed to escape the wrath of the newly weds.
6. Melting point: During an experiment, a scientist spilt acid on an external hard drive and burnt away his important data.
5. Shattering blow: In the middle of an argument, a businessman threw a USB stick at his partner, with the device ending up in several pieces on the floor. Unfortunately it contained valuable company plans.
4. Fire alarm: A fire destroyed an office, sparing only a few CDs which had melted to the inside of their cases.
3. Ooooops: A scientist was fed up with his hard drive squeaking, so drilled a hole through the casing and poured in oil – which stopped both the squeaking and the hard drive.
2. Here goes…: To test the functionality of a parachute, a camera was dropped from a plane. The parachute failed and the camera shattered into several pieces but the device’s memory stick was reassembled and the footage was recovered.

And the number one weird and wonderful data disaster is…
1. Data repellent: After discovering ants had taken up residence in his external hard drive, a photographer took the cover off and sprayed the interior with insect repellent. The ants were killed off and the data was eventually recovered.

All the hardware on the list was recovered, the company said.