Friday

Nmap 5.00 Released with new additions: ndiff, ncat; nse and better performance!!!



This is awesome news. Nmap version 5.00 has been released. It is the first major release since 4.50 in 2007. Here is a more detailed overview of the changes.

To have a quick glance, here are the top 5 improvements in Nmap 5:

  1. The new Ncat tool. It will do data transfer, redirection, and debugging.
  2. Ndiff is a scan comparison tool. It will make it easy to automatically scan your network daily and report on any changes
  3. Nmap's 5.0 performance has improved dramatically.
  4. Nmap Network Scanning, the official Nmap guide to network discovery and security scanning.
  5. The Nmap Scripting Engine (NSE) . It allows users to write (and share) simple scripts to automate a wide variety of networking tasks. New scripts include a whole bunch of MSRPC/NetBIOS attacks, queries, and vulnerability probes; open proxy detection; whois and AS number lookup queries; brute force attack scripts against the SNMP and POP3 protocols; and many more.
This just looks awesome. Playing with NMAP 5.0 goes on to my TODO list for the next month!

(Photo under creative commons from libraryman's photostream)

Wednesday

According to Child Support groups, Net filtering is a waste of money



Australia was one of the first countries to deploy massive Net filtering. The main reason was to fight online child pornography (as usual reason). Now the Children support groups are criticizing the measure.

In a joint statement with lobby group GetUp, both Save the Children Australia and the National Children's & Youth Law Centre believe the resources could be better spent on law enforcement agencies battling to eradicate child pornography on the internet. (from Australian IT)
So why have these Net filters at all? The following wikileaks article caught my eye: Australia secretly censors Wikileaks press release and Danish Internet censorship list, 16 Mar 2009

The first rule of censorship is that you cannot talk about censorship.

In late 2008, Wikileaks released the secret Internet censorship list for Denmark, together with a press release condemning the practice for lack of public or judicial oversight. Here's an extract from the press release:

The list is generated without judicial or public oversight and is kept secret by the ISPs using it. Unaccountability is intrinsic to such a secret censorship system.
Most sites on the list are still censored (i.e must be on the current list), even though many have clearly changed owners or were possibly even wrongly placed on the list, for example the Dutch transport company Vanbokhorst.
The list has been leaked because cases such as Thailand and Finland demonstrate that once a secret censorship system is established for pornographic content the same system can rapidly expand to cover other material, including political material, at the worst possible moment -- when government needs reform.
Two days ago Wikileaks released the secret Internet censorship list for Thailand. Of the 1,203 sites censored this year, all have the internally noted reason of "lese majeste" -- criticizing the Royal family. Like Denmark, the Thai censorship system was originally promoted as a mechanism to prevent the flow of child pornography. (Source: wikileaks)
Emphasis added by myself. So why do these lists need to be kept secret? When wikileaks released the secret Australian censorship list, it seemed that "half of the sites on the list are not related to child porn and include a slew of online poker sites, YouTube links, regular gay and straight porn sites, Wikipedia entries, euthanasia sites, websites of fringe religions such as satanic sites, fetish sites, Christian sites, the website of a tour operator and even a Queensland dentist." (source: boingboing.net)

So who decides what gets on this list. If they have the possibility, they WILL use these systems as "they" see fit. So common sense hasn't set in yet. The next country to jump into the deep end is New Zealand.

If you thought that net filtering and grandiose firewalls were the exclusive preserve of West Island (or "Australia", as the locals like to call it), think again. New Zealand is showing that it, too, is ready to play its part in the great Antipodean censorship stakes.

Last week, the Department of Internal Affairs (DIA) announced it was setting up a filter system that will allow internet service providers to stop people accessing child pornography.

The filter system has already been trialled in hundreds of thousands of New Zealand households, and Internal Affairs deputy secretary Keith Manch confirmed that the voluntary system will block access to around 7000 websites carrying images of child sexual abuse. (Full story at The Register)

In the end, criminals will circumvent these filters and citizens will be limited by secret black lists in what they can view and what not. Money down the drain. And a step closer to totalitarian states.

Related posts:
(Photo under creative commons from S@Z's photostream)

Oracle & Microsoft Patch Tuesday and a Firefox 0-day



Yes, only a day after the discovery of an Internet Explorer ActiveX (Office) 0-day, it's time for black Tuesday with a surprise. (see previous post)

For the Microsoft patch overview, the one from Swa Fransen over at SANS ISC is still advisable.

Then Oracle followed suit with their quarterly patch cycle: http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujul2009.html

And to finish, an exploit was posted to milw0rm (who came back) that affects Firefox 3.5 and possible earlier versions. The mozilla blog above has a workaround by temporary disabling the javascript.options.jit.content setting in about:config. Additionally, using NoScript stops it as well, successfully detecting the PoC’s attempt to access file://.

Be safe.

Related posts:

(Photo under creative commons from Libby's photostream)

Fake OpenSSH 0-day, don't run 0pen0wn.c



There were some rumors of an 0-day OpenSSH vulnerability doing the rounds. It seems this was just a hoax. Compromised systems were due to brute force attacks.

Damien Miller (openSSH) responded that he still has not gotten a single piece of evidence of a 0-day exploit. He summarizes some of the possible attacks and argues that its very unlikely that openSSH can be compromized in those ways. It seems that the actual hacks were brute-force password attacks that actually succeeded. (Source: secgeeks)
Fueled by this hoax, the anti-sec group released some fake shellcode. As some victims that tried it and quickly found out, it will trash your system. So don't run it. If you want a detailed analysis of the shellcode disssasembled, Thierry Zoller posted a good analysis on his blog.

The anti-sec group is also known for the Astalavista and Imageshack incident. See also "Hacker group declares war on the security industry" (Heise)

(photo under creative commons from quinn.anya's photostream)

Tuesday

Active exploitation of Office Web Component ActiveX vulnerability. ISC level raised to yellow.



A critical security vulnerability in an Office Web Component that allows attackers to gain control of a Windows PC has been identified (Microsoft Security Advisory 973472). When using Internet Explorer, code execution is remote and may not require any user intervention.

According to Microsoft and the SANS Internet Storm Center, this vulnerability is being exploited in the wild. SANS ISC Threat level has been raised to yellow to raise awareness of this issue.

Currently there is no update but Microsoft has released a Fix-it tool to disable the vulnerable control in Internet Explorer.

This tool probably sets the two CLSIDs you need to set the killbit:

{0002E541-0000-0000-C000-000000000046}
{0002E559-0000-0000-C000-000000000046}

The following twitter account is relaying up to date information:

http://twitter.com/sans_isc_fast

The latest tweets reported millions of computers being infected in China. If you're not a twitter user, you can also monitor the Twitter account through this RSS feed.

Alternatively to setting killbits, you can switch to an alternative browser.

This advisory discusses the following software.

Affected Software

  • Microsoft Office XP Service Pack 3
  • Microsoft Office 2003 Service Pack 3
  • Microsoft Office XP Web Components Service Pack 3
  • Microsoft Office 2003 Web Components Service Pack 3
  • Microsoft Office 2003 Web Components for the 2007 Microsoft Office system Service Pack 1
  • Microsoft Internet Security and Acceleration Server 2004 Standard Edition Service Pack 3
  • Microsoft Internet Security and Acceleration Server 2004 Enterprise Edition Service Pack 3
  • Microsoft Internet Security and Acceleration Server 2006
  • Internet Security and Acceleration Server 2006 Supportability Update
  • Microsoft Internet Security and Acceleration Server 2006 Service Pack 1
  • Microsoft Office Small Business Accounting 2006
Non-Affected Software
  • Microsoft Office 2000 Service Pack 3
  • 2007 Microsoft Office Suite Service Pack 1 and 2007 Microsoft Office Suite Service Pack 2
  • Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1 and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 2
  • Microsoft Forefront Threat Management Gateway, Medium Business Edition
  • Microsoft Internet Security and Acceleration Server 2000 Service Pack 2
(Photo under creative commons from TedRheingold's photostream)

HostileWRT: the misconceptions about the Hadopi Router



So the three strike law has been passed in France (slashdot). In my previous blogpost I mentioned an article about the Hadopi router. A firmware made to infect routers, reroute traffic through other routers and infect those as well, just to challenge the Hadopi law.

The whole story first launched by a French newspaper, seems to have been one big misconceptions. The Hadopi router firmware is actually HostileWRT, it's based on openWRT and can automate the cracking of wireless security passwords. It's intention was to prove the insecurity of wireless network and has nothing to do with the Hadopi law. Who, by the way has become worse, because in this form, instead of getting disconnected from the net, can lead up to 3 years in jail.

For other sources, check Be carefull what you read about the Hadopi router (CrunchGear).

(Photo under creative commons from inju's photostream)

Friday

Big Brother 2009: Has the rebellion started?



A lot of legislation and surveillance measures have appeared these last years that endanger the civil rights and liberties of the people. Measure like the EU Dataretention, internet filtering or the three strike law (for example in France: HADOPI) are all measures that are starting to make me shiver.

Are we slowly evolving to a censorship system akin to the Chinese Great Firewall? A lot of these measures are implemented either to combat child pornography or terrorism. But is it the right way? What are we sacrificing?

More and more awareness about this issue is being raised and more projects have started to circumvent censorship of any kind. The CCC already had Tor on a stick called the Freedom stick for the people in China and other repressive states.

Some of the internet filters are based on DNS filters which can easily be bypassed by setting up your own DNS server or using OpenDNS, a freely available DNS service.

Two recent projects have arisen as a protest against Dataretention and the three strike law respectively: Smallsister.org and the HADOPI router firmware (boingboing.net).

Smallsister is aimed at anonymizing email:

At this point one issue has caught our immediate attention and that is data retention. This legal tools forces Telephony and Internet Service Providers to store information on their users. For instance who is behind an Internet-address or a telephone number. Not only that it also requires to register who tried to call whom and who has been e-mail whom. For users that would mean that certain things can’t be secret anymore. For instance: a whistle blower should go through a great pain to reach a journalist to break a story that would correct wrong. Or what about a company that tries to do a deal and fears to be frustrated by a foreign government that would pass information on to a local, competing company (as happened with Airbus and Boeing for instance). We intend to do something about that. So we look at anomizing e-mail. (source: smallsister.org)
The HADOPI router is aimed at proving that an IP address is not a good identifier to link to people. Law cases of the RIAA suing people that didn't even own a computer proved that case quite well. Although I'm a bit divided by the method that the HADOPI firmware uses (cracking wireless keys) and re-routing packets through the routers of neighbours. (update here) It does prove a point that laws shouldn't be used to fix broken business models.

So are governments starting an uphill battle about control of the internet? I know only one thing, if kids can bypass school filters by using DNS VPNs and anonymous proxies, people will find a way to bypass this as well.

How can we educate governments that this is the wrong way?

(sarcasm) Yes, we are living in a world where people using linux are found to be suspicous! (/sarcasm) Click the link, it's a real story!

Related posts:
(Photo under creative commons from dolescum's photostream)

Thursday

Phrack magazine is still alive. Issue #66 released



Read issue 66 on phrack.org. Download as tar.gz

Topics:

  • Introduction
  • Phrack Prophile on The PaX Team
  • Phrack World News
  • Abusing the Objective C runtime
  • Backdooring Juniper Firewalls
  • Exploiting DLmalloc frees in 2009
  • Persistent BIOS infection
  • Exploiting UMA : FreeBSD kernel heap exploits
  • Exploiting TCP Persist Timer
  • Malloc Des-Maleficarum
  • A Real SMM Rootkit
  • Alphanumeric RISC ARM Shellcode
  • Power cell buffer overflow
  • Binary Mangling with Radare
  • Linux Kernel Heap Tampering Detection
  • Developing MacOs X Rootkits
  • How close are they of hacking your brain
Related posts:

NAT is not a security feature. RSNAKE releases RFC1918 paper



I have seen a lot of people saying to others that a NAT gateway acts as a kind passive firewall and helps a little bit with (home) security. Since your ports are not directly reachable from the internet.

Now it seems that certain browsers, and with the current architecture of most RFC1918 networks, there is a high tendency for (bad) things to happen, like IP collisions. This also applies to VPN networks. This has severe implications from a security point of view. Have a look at this research published by Robert Hansen (aka RSnake)

The paper provides a description of the limitations of the attacks and the specific conditions which would make it possible. It is prudent to review the paper and see if this applies to you.

(Photo under creative commons from andy castro's photostream)

Patch apocalypse: Patch tuesday for Microsoft, Adobe, Safari and a 0-day. Oh my.



It's not a week to be happy about. Both for endusers and sysadmins. A lot of patches were released which even prompted the Symantec Threatlevel to be increased.

Adobe decided to also start their version of Patch Tuesday and the actually did: Adobe patches 13 critical Reader, Acrobat vulnerabilities (Zdnet) and check the monthly Microsoft Tuesday Coverage for June (Sourcefire). Microsoft hardly released any updates last month and it seems they wanted to make up for it this month. But they didn't release a patch for the 0-day in Directshow (Threatpost) so you might want to look at the workaround.

It's not only Microsoft woes, there was a Safari monster update (apple.com). You have to upgrade to version 4 to get rid of 5o security flaws. 50? Really?

Last but not least,Worpress released version 2.8 and Ubuntu launched several patches yesterday so install the updates.

Corporate users are advised to set up a decent patch and vulnerability management system. Have a look at the excellent NIST SP800-40v2 document. Don't just wait till the barbarians auditors are at the gate.

Home users, for those running windows, run Secunia OSI on a regular basis! It's really hard to track all those patches individually. How many non-IT people are subscribed to mailinglists?

I'm wondering in which way all those SDLC and application development best practices are paying off? I guess that complexity really is in direct opposite of security. New features anyone? Time to revert back to lynx! But it makes us wonder how linking or moving all those applications to cloud services in the future might lead to a general meltdown of the internet.

Just look at the exploited 0-day bug in the HyperVM from LXLab that led to the deletion of 100.000 website (source: ukfast.co.uk)

Related post:

(Photo under creative commons from blueforce4116's photostream)

Monday

Malware: the iPhone 3.0 firmware jailbreak. Be warned.



With just moments away from the Apple's next Worldwide Developers Conference, blackhats are using this occasion to launch a malware campaign.

A lot of iPhone users are familiar with quickpwn and yellowsn0w, two tools used to jailbreak/simunlock the iPhone. With the imminent release of the iPhone 3.0 firmware, users will be looking for an update of these tools. So be warned that there is a blog claiming to have a yellowsn0w version for 3.0 but it includes malware!!! AV detection is very poor. Have a look at this malwaredatabase.net article for details.

The iPhone dev team is the original author of this tool and their blog is at http://blog.iphone-dev.org/. On their website they are warning about other websites, ranking higher in Google search results then their own. Although they only make money from google hits, they are not affiliated with the team at all. So be careful where you download your tools from. Other wbesite might popup with more evil intents. For the record, they haven't released any tools for the 3.0 version yet.

Related posts:

(Photo under creative commons from patrick h. lauke's photostream)

After 2 years, the German hacker-tool law has proved useless



Two years ago, Germany passed a law that criminalized the making and distribution of security tools. Although it was an attempt to implement a part of the COE Treaty into German law, it completely missed the intended purpose and hurt legitimate security research.

Looking back, noone has been prosecuted under this law and it only scared whitehat hackers or companies to move (their tools) outside of Germany.

Read the following article from theregister.co.uk which has some good details on it.

Abstract: While we can empathize with the desire to keep hacker tools out of the hands of script kiddies who intend harm, and keep black hat hackers from developing and distributing ever more sophisticated hacker tools and zero day attacks, the problem remains that these same tools can be and are used for good purposes by good people. While the statute attempts to focus on bad people with bad intent, it lacks the precision to do so.
Related posts:
(Photo under creative commons from Chris Daniel's photostream)

Sunday

Why I stopped blogging



Well, actually I didn't stop blogging. But in these last 2 months I didn't find enough time for it. Although my blog is like a child to me, but I had to de-prioritize it for a while. Why is my blog that important to me? Web 2.0 brought me into contact with some very interesting people and it's an adventure! I like being part of these communities and to share experiences and information.

But on the other hand, I wanted to start a hacker and security conference in Belgium. And with some other people, we kickstarted BruCON. As it's our first edition, most people don't know us (yet).
We are not aiming to be a big commercial event but a community driven one. Where people can come and share ideas, information and join projects. But somehow, we need a venue and the only way to get some interesting speakers is to handle some of their travel costs. So even as a non-profit organization, we need to charge some income. If I was rich and had the money, I would let everyone in for free. You would surprised at the cost of a decent venue.

Searching a venue, gathering speakers, coordination things, .... it all seems like trivial tasks but it took a lot of my time. It's not my (day) job to do this and I will never be compensated for it. But I felt that we needed a platform in Belgium where certain things can be discussed.

So amongst other things, I had to sacrifice my time to blog. Currently, things are getting back on track for BruCON and some volunteers have showed up for which I'm very grateful. So I hope to pick up blogging again. I hope I haven't lost too many readers.

So welcome back! And have a look at BruCON since it seems like it's going to be an awesome event!

(Photo under creative commons from ktpupp's photostream)

Monday

Business continuity and useful resources about the N1H1 Swine Flu.



First of all, there is nothing (today) to worry about. But it doesn't hurt to be prepared and to keep an eye on the situation. Potentially, it can become a risk. At this point, the highest risk is scammers/blackhats using this event to send out spam to people to sell them medication (McAfee Avertlabs).

But things might get a bit worse because a lot of domains were registered last weekend containing the words swine flu. Although F-Secure didn't find any malware, this might change and these sites can be used in a Blackhat SEO campain. Visit their site for a list of domains.

Additional resource: Swine Flu Phishing Attacks and Email Scams (US CERT)

Should this fly really become a pandemic, it can be an operational risk of course. Having your NOC or other critical personnel sick at home, can bring some issues. So let's have a look at some interesting resources to keep an eye on this and prepare yourself.

First is this excellent SANS page, courtesy of Stephen Northcut: World Wide Pandemic Watch Version 1.8

Abstract:

The purpose of this document is to prepare IT and IT Security people to brief management. We put this news aggregation together and have made it as accurate as possible. I have tried to be careful with the credits to the internet sources aggregated here. No rights are claimed, feel free to repost, copy, link to, harvest information from this document. Just try to be as accurate as you can and be careful about believing everything you read, the two best information sources are WHO and CDC. If you have additional information I would love to hear from you, I am http://twitter.com/stephennorthcut on twitter and stephen@sans.edu for email.
Next, this Google map gives a geographical view of outbreaks and related news.

I really liked this Business Pandemic Influenza Planning Checklist (PDF - 284.24 KB)

For web 2.0 peeps; follow these twitter accounts : @veratect and @cdcemergency

And last but not least, specifically for Belgium: the site to use is www.influenza.be. Start with the 2 FAQS: Mexicaanse griep and Grieppandemie. Check their website for the latest press releases.

27/04/2009 Influenza
26/04/2009 FAVV
25/04/2009 Influenza

So stay calm and be alert is the message here. The influenza agency can be contacted on the following number during office hours for questions or reports: 0800/ 99 7777

(Photo under creative commons from toastforbrekkie's photostream)