INCLUDE_DATA

Thoughts on Ching Tim Meng’s HITB 2008 Presentation

November 7th, 2008

So the last lab session I attended during HITB was Ching Tim Meng’s presentation on malware detection and removal with antivirus.

VIRUS! DIE!
VIRUS! DIE!

In his presentation, he purports that malware requires the stability of the system to survive, and defines malware as a “software designed to infiltrate or damage a system without the owner’s informed consent”. He goes on to list types of malware, including trojan horses, viruses, worms, logic bombs, etc.

I feel that he made one big mistake in that assumption. Let’s take for example -

I’m sure everyone remembers this little dialog box here. The Blaster Worm certainly did not require the stability of the system to survive. In fact, making the system unstable and unusable (after a minute) (without typing shutdown -a) was its primary and only goal.

Witty Worm

Witty Worm

Not too far back in 2004, Witty was discovered. And yes, it does destroy the system as well. In fact, it would corrupt the system so much to the extent that at one point, the worm itself would cease to exist.

I’m sure there are more of these malware out there that aren’t as well known, but they do, somehow or another, infect and corrupt your system, one way or another.

However, while his methods of removing malware are not always foolproof and his assumption isn’t exactly accurate either, I would say that his effort was commendable and his method was easy enough for most to understand.

HackInTheBox Day 2

October 30th, 2008

I would like to say that I enjoyed Day 1 more than I enjoyed Day 2. However, today sported rather interesting activities as well.

But first, some photos with / of TOOOL USA

Deviant, Babak, yours truly

Deviant, Babak, yours truly

Eric was busy

Eric was busy

It was perhaps the lab session which I had enjoyed the most.

Moving on to today’s activities - King Tuna and Q conducted the lab session for wireless and RFID.

Lab session conducted by Q and King Tuna

Lab session conducted by Q and King Tuna

It took some time on Windows to find the general placement of the access point. Luckily, they had a VMPlayer installer as well as a BackTrack3 image that I could use. Cracking WEP wasn’t supposed to be hard, but due to an oversight in the channel number, I monitored the wrong channel and there wasn’t enough time to complete the crack.

Ching Tim Meng conducted the malware-removal lab. It was a pretty basic session that consisted mostly of general malware techniques and malware removal procedures. Perhaps a better option would have been “Decompilers and Beyond” by Ilfak Guilfanov and pdp’s “Client-side Security”. I would definitely like to catch videos of their presentations once they are published (around December?).

Currently, I’m waiting to go to the airport to catch the 2215 flight to reach Singapore by 2310. Definitely a better option than the 6-hour coach ride. Yay for Tiger Airways.

HackInTheBox Day 1

October 30th, 2008

HITB 2008 is the first actual security conference that I have physically attended, although I have been watching videos and slides of various conferences, especially blackhat/defcon. There were a couple of interesting booths, namely CtF, Open Hack, Wireless Village and Lock Picking Village (LPV).

HITB Booth

HITB Booth

CtF in progress

CtF in progress

So HITB Day 1 commenced, with an introduction to Click-Jacking by Jeremiah Grossman as the first keynote address.

Jeremiah's Keynote Speech

Jeremiah's Keynote Speech

Before I go into the details of his keynote speech, I need to iterate, and reiterate, that the emcee’s distasteful slang, accent and speech is, in no way, a representation of how people from Singapore / Malaysia speak. Perhaps the organizers realized that as well as we never heard that speaking style again, after two of his narrations.

Jeremiah shared a couple of interesting PoCs for Click-Jacking, including but not limited to - tapping of webcams and microphones through Flash Player, allowing of access to the local machine (again, through Flash Player), etc.

See the "Always allow" radio button? Imagine it behind "Allow Site to Remember Login Combination?"

See the"Always allow" radio button? Imagine "Allow site to remember login credentials?" before that. Think Click-Jacking, think pwnt.

It was an interesting keynote address with interesting examples.

Marcus Ranum’s speech, on the contrary, was slightly boring in comparison. It was mainly theory and definitions, which didn’t interest me much.

There were two highlights of the event today (in my opinion).

1. Hacking Internet Kiosks by Paul Craig
Paul put together an interesting presentation on how to “hack” Internet kiosks - getting a shell, getting the taskbar to show, getting files downloaded / uploaded with notepad, bypassing kiosks blacklists, etc. He compiled an entire list of possible attacks in a simple AIO application - http://ikat.ha.cked.net/ - it even comes in a portable version! The presentation was attended by many and I’m sure everyone enjoyed it. Both the presenter and the content were deliciously juicy.

2. Lock-Picking Lab by TOOOLS
At Track III, which, IMHO, is the best track to be in because of its hands-on experience that you will get there (which you cannot get from just watching videos), TOOOLS gave our lock picks and sample locks for us to try picking and introduced a couple of techniques. Overall, this lab was well-received and many loved it.

Tomorrow, I’ll mainly attend the lab sessions. I’m sure I’ll learn a lot from them.

HackInTheBox (HITB) Day 0

October 28th, 2008

So I haven’t been posting lately, but hey, I was busy. Now that the busy period’s over, I’ve finally got time to get down to Kuala Lumpur, Malaysia, with Chalit to attend the HackInTheBox Conference 2008.Tomorrow’s the start of the conference, but since it starts at 9, we decided to check in a day earlier to prevent the mad rush that we would have otherwise need to go through tomorrow.

I was hoping to get to meet Petko and discuss about HoH and stuff over lunch, but it’s too bad he couldn’t make it. Congratulations, pdp! I’m sure your kid’ll be pretty. :)

So, we booked Impiana Hotel, a lower-class hotel compared to Crowne Plaza Mutiara, where the conference is supposed to be carried out. Unlike most other hotels I inquired, this hotel does not have in-room WiFi access. It sports a single ethernet access point, which is supposed to provide a “high speed broadband connection”, but I guess that’s not exactly true, given that I’m downloading files from RapidShare at a mere 30kbps. It’s lucky that I inquired about the Internet access before booking, though. I came prepared. ;)

I’m all geared up for HITB tomorrow. Are you?

OOO Flame

September 15th, 2008

Apologies for not posting recently. I’ve been pretty busy (and still am) with a couple of new projects that require a lot of PR work from me.

Anyways, recently, there was an OOO flame on the SecurityFocus Pen-Test mailing list. Following that, a “real life scenario” was shared by Jon R. Kibler, CTO of Advanced Systems Engineering Technology, Inc.

I was teaching a pen-test bootcamp several years ago. One of the students (who I will call ‘Joe’) pooh-poohed the whole OOO message issue. He even indicated that he used them all the time, that they were harmless, and they saved him from getting calls to his cell phone at roaming rates when he was out of town. (This was back in the days before nationwide calling plans.)

I then sent Joe a test email message at his work email address. I got back an OOO message saying that he would be out of the office for two weeks of training and would only have very limited email at night. His
signature line showed that he was the dep-CSO for his organization.

I then displayed the email for the whole class to discuss. Next, I proposed that we demonstrate why OOO messages are an issue.

What I proposed was to social engineer the help desk into providing sensitive information. Rather arrogantly, he said, “Sure, why not? Those guys are well trained and would never fall for anything you could contrive.” We then got permission (in writing) from the CIO, the CSO, and the organization’s legal department to do the social engineering attack.

Next, I wrote up a script for a secretary (who I will call ‘Sue’) at that ed center to use to call the organization’s help desk. It basically went as follows:

Sue: “Hi, I’m Sue with abc training company. One of your employees, Joe, is taking a security course from us and he forgot that he was supposed to bring the /etc/shadow file from the user file store server. He needs it to use in class to test password cracking. He asked that you please gzip it and email it to him.”

Help Desk: “Okay, but I will have to check with his manager first.”

Sue: “Oh, Joe said that if you needed to verify that he was taking a course from us, just send him an email and the OOO reply it will have everything you need to know.”

Help Desk: “Alright, give me a minute. (Pause) Okay, I guess this has everything I need. But, it says that he has limited email access; does he want it sent to his office email address?”

(This just shows that help desks are trained to be helpful!!! Despite continual security awareness training, the possibility that this might be social engineering attack never even occurred to this guy!)

Sue: “No, I was just about to tell you that he asked to have you it send to his Hotmail address, which is: joe….@hotmail.com.”

Help Desk: “Okay, no problem, he should have it in about 5 minutes.”

Needless to say, we had just created the hotmail account a few minutes prior to the phone call.

In just a couple of minutes, we owned the shadow file from the file server where all user accounts have their data stored. In other words, we now pwned the passwords for every one of his users.

After that b-slap with a clue-by-4, Joe started singing a different tune.

Looks like an interesting story, except that I find a number of seeming loopholes in it. Or perhaps it’s just my bad understanding.

- The helpdesk operator knows how to operate Linux and retrieve the /etc/shadow file
- The helpdesk operator has access to the /etc/shadow file =O
- I don’t see any link between “having limited email at night” and the need to send it to a different email account.

Maybe it’s just me. Let’s see how the conversation evolves…

Deleting Files

September 1st, 2008

Yesterday, I read at Hacking Truths, an article entitled Delete an “UnDeletable” File. I largely disagree with the post and am thus making a post on how to delete most “undeletable” files on Windows systems.

Die, file, DIE!!!

Access Denied
Cannot delete file: Cannot read from soruce file or disk
There has been a sharing violation
The source or desination file may be in use
The file is in use by another program or user
Make sure the disk is not full or write-protected and that the file is not currently in use

Usually, these error messages occur when another process is accessing the file, with or without you knowing it. However, Windows does have its false-detection times. Below are some methods that may assist you -

1. AUTOEXEC.BAT is your best friend

Windows, by default, includes a file called AUTOEXEC.BAT in your Windows root drive (C:\ by default). The .BAT extension refers to a MSDOS batch file and the file is executed right before a user logs on. In prior versions of Windows (Windows 95, Windows 98, Windows ME) executed AUTOEXEC.BAT right after Windows has booted up and CONFIG.SYS loaded. It is usually used to set environment variables and initiate drivers. This means that the file is run before any process starts.

Simply edit your AUTOEXEC.BAT file and include, on the first line -

del /s/f/q [Drive]:\[Folder]\[File].[Extension]

For example,

del /s/f/q C:\Unwanted\File.doc

Save it and restart your computer afterwards.

2. Processed misery

If you don’t feel like restarting your computer, you can, of course, attempt to identify the source of your misery and terminate it. ;)

Enabler is a tool whereby all processes running in the background are shown. It detects all dialogs/windows that are displayed and hidden and allows you to terminate them. If you have good idea of what process is causing your file to be “undeletable”, this might be your solution.

Unlocker is a tool which “unlocks” a file and avails it for deletion.  It is much more detailed and suited for file deletion than Enabler, showing you all the processes that are currently using your file, then allowing you to delete the file and even unload a DLL. Highly recommended!

Of course, if the above two methods are too elaborated for your liking, there’s always the Windows Task Manager and the option of ending explorer.exe. That might work for you too. :)

3. Being attached is tricky

This is something which I have learnt in my experiences of dealing with viruses and their un-terminate-able status. Apparently, processes can be “attached” to another. This particular virus I was trying to get rid of was attached to winlogon.exe, a SYSTEM process which cannot be terminated.

To solve this, use Process Explorer from Winternals (Microsoft). You can suspend the process in question, detatch the malicious bugger, terminate it and resume the process afterwards. Nifty, eh?

Displaying Version Numbers

August 29th, 2008

I just read that DarkFig from milw0rm released a PHP script that targets multiple vulnerabilities present in Invision Power Board (IPB), versions <= 2.3.5. I run an IPB forum together with a few other people and I noticed that right at the bottom, there’s this little footnote…

Powered By IP.Board 2.3.5 © 2008  IPS, Inc.

In all frustration, I told one of my guys to remove the version from the footer. After all, with almost 50,000 members, half of whom are probably easily irritable and irrational, it wouldn’t take too much of a genius to notice the same things I did and launch an attack.

In defence, he presented me with this argument - displaying the version number shows users that we are diiligent at patching our software, with 2.3.5 being the latest version available and we’ve got it. It gives them the sense of security and the “illusion” that we are responsible forum admins.

This lead me to think - is removing the version number from software that is exposed to the web (including, but not limited to web applications, server operating system, web backend, etc) just security through obscurity? Or is there really more to it?

When people say “security through obscurity is no security at all”, it probably holds true in the long term, whereby the number of attacking attempts and possible vulnerabilities found increases as time passes. In the short term, though, it might be better to always provide yourself with some time buffer. So, I say, spoof / remove version numbers from being displayed.

What are your views?

Installation Directories

August 28th, 2008

It has always been traditional that we delete installation folders upon the successful installation of a web application. Well, for me at least. Leaving it where it is (especially with directory listing turned on) is just suicide - possibilities are endless.

- Reset of admin account password
- Flushing of database
- Generation of publicly-accessible database dump
- Etc.

And that’s exactly what will happen to you if you think that you’re safe -

YourOwnBux installation screen at an undisclosed site

(Of course, I’ve informed the site administrator about it.)

I hope he’s learnt his lesson. And everyone else has learnt from his mistake too. :)

Edit: Yet another one

You'd think they'd at least follow instructions.

You'd think they'd follow instructions. But, no...

And again-

wooooot!

wooooot!

That aside, YourOwnBux has just suffered a full vulnerability disclosure from milw0rm. Expect more of its sites to get hacked pretty soon.

The New Blog Launched!

August 28th, 2008

Hi guys,

Tonight, Searix Security Solutions has a new home for its blog. This blog will be managed by multiple people and will include guest writers from various people in the industry from time to time. Of course, the main content would be relating to security. ;)

The blog will contain random bits and pieces of information, updated news about the IT security industry, our reviews of security-related software, events and services, and of course, it will feature out own research and products!

So, stick with us and stay up to date! :)