Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

News bytes Sept-2011


Published on

Null + OWASP + SecurityXploded + Garage4hackjers Meet at Bangalore

Published in: Technology
  • Be the first to comment

  • Be the first to like this

News bytes Sept-2011

  1. 1. NewsBytes Aug-Sept<br />Ashwin Patil<br />GCIH,RHCE,CCNA<br />2+ in Infosec<br />
  2. 2. Announcements<br /><ul><li>Malcon 2011 : Call for Paper </li></ul><br />Venue: Mumbai , Nov -2011<br /><ul><li>CFP for nullcon 2012 (Tritiya) is open!!!</li></ul><br />Venue : Goa, Feb -2012<br /><ul><li>Cocon</li></ul><br />Venue: Cochin (Kochi), 7 and 8 Oct -2011<br />
  3. 3. Stop reading and Patch your Browser first<br /><ul><li>DigiNotar is a Dutch Certificate Authority. They sell SSL certificates.
  4. 4. Also works with govt on its PKI implementations
  5. 5. Certificate Authority (CA):: Issues Digital certificates a.k.a Trusted third Party
  6. 6. Breach discovered in CA infrastructure
  7. 7. Damage : Issued fraud certificates for nearly 531 domains
  8. 8. List Includes :</li></ul>*.*.com * Comodo Root CA Globalsign Root CA<br />*.*.org *.mozilla.orgCybertrust Root CA Thawte Root CA<br />*.google *.torproject.orgDigicert Root CA Verisign Root CA<br /> Equifax Root CA<br /> *<br /><ul><li> Browsers : Mozilla, Chrome,IE and Safari – Pulled it from CA store in latest versions</li></ul>-- Fsecure ,threatpost blogs<br />
  9. 9. Don’t want to break add ons ..<br />-- Mozilla Blog<br />
  10. 10. who and How ?<br /><ul><li>Called himself Comodohacker : Claimed the attack via Pastebin
  11. 11. Twitter Account : @ichsunx2</li></ul>Fox-It Security Firm Audit<br />Operation Black Tulip Incident Report revealed:<br /><ul><li>No secure central network logging is in place.
  12. 12. All CA [Certificate Authority] servers : Members of one Windows domain</li></ul>Possible to access them all using one obtained user/password combination. The [domain] password was not very strong and could easily be brute-forced.<br /><ul><li>Strong indications that the CA-servers were accessible over the network from the management LAN.
  13. 13. The software installed on the public web servers was outdated and not patched.
  14. 14. No antivirus protection was present on the investigated servers.
  15. 15. Domain admin Password of CA network shared by Comodohacker: Pr0d@dm1n </li></ul>-- SANS isc diary, pastebin<br />
  16. 16. Hushhh Nothing left to trust ?<br /><ul><li>Dutch Regulator Bars DigiNotar From Issuing Qualified Certificates
  17. 17. Avg. browser trust more than 600 CAs , bad history of not doing their job correctly</li></ul>Blackhat/Defcon talk:: <br />SSL and the Future of Authenticity<br />By Moxie Marlinspike:<br />Talk about replacing CA infrastructure<br />Issue with SSL : Authencity<br />Idea : Download the presented SSL certificate directly <br /> and then ask a series of trusted notaries to download the certificate <br /> and give it to you as well.<br />Convergence : Browser Addon.<br />--Threatpost<br />
  18. 18. Who is reading the email that you just sent<br /><ul><li>Peter Kim and Garret Gee of the Godai Group – Paper about doppelganger domains
  19. 19. Doppelganger Domains: Register a domain that`s like your target except for a typo.
  20. 20. Over 6 months – Grabbed 1,20,00 emails - 20 GB of data from fortune 500 companies
  21. 21. Email with sensitive info sent with typo or missing dot landed in wrong hands
  22. 22. Domain MITM : Set up email servers on typosquated domain and relay mail to correct recepient.
  23. 23. Targetted Attacks - APT
  24. 24. e.g. Orgn: Email domain->, </li></ul>Typosquatted registered domain:<br />-- wired, tekblog<br />
  25. 25. List of companies (in red) whose sub domains potentially vulnerable to attack<br />--Wired<br />
  26. 26. What you see is not what you get<br /><ul><li>New trick to cloak malicious files by disguising file extensions
  27. 27. Exploit named: Unitrix by Avast software
  28. 28. Abuses unicode for right to left languages
  29. 29. Exploit uses a hidden code (U+202E) that overrides </li></ul>right-to-left characters to display an executable file as something entirely different.<br />e.g. making jpg.exe to look safer like Photo_D18727_Collexe.jpg<br /><ul><li>Do not open attachment from unknown sources even if they look safer.
  30. 30. IE 9 – Application Reputation : Warns users of potentially dangerous files downloaded from internet.</li></ul>-- Avast Blogs<br />
  31. 31. Morto : RDP Worm<br /><ul><li> Infects Windows workstation and server with new spreading vector : RDP
  32. 32. Once infected, starts scanning local network for machines with RDP enabled
  33. 33. Try logging in with Administrator through list of common passwords
  34. 34. Copy itself to target machines via windows shares
  35. 35. Monitor traffic spike in logs on port 3389.</li></ul>-- Sectechno<br />
  36. 36. Mobile Phone monitoring service found<br /><ul><li> Chinese website offers mobile phone monitoring tools and services to customers access to the site’s backend to retrieve information.
  37. 37. Not so cheap - cost from US$300–540.
  38. 38. User must first sent an MMS with malware as an attachment to victim
  39. 39. Once Installed, reports about activities will be sent to backend service which can be accessed by customer through portal.
  40. 40. Currently for Symbian and windows mobile users, can be provided to android users with NICKISPY malware.
  41. 41. NICKISPY android malware: Monitors SMS, phone calls , locations, email messages.</li></ul>-- Trendmicro<br />
  42. 42. Linux Breaches<br /><ul><li>Attackers have compromised a number of servers at that house the Linux kernel source code and were able to modify a number of files and log user activity on the machines
  43. 43. Inserteda Trojan startup file into the startup scripts rc3.d on one of the servers so that it would run whenever the machine was started.
  44. 44. Files belonging to ssh (openssh, openssh-server and openssh-clients) were modified.
  45. 45. Kernel source code repositories are not affected
  46. 46. Week later, taken offline due to a security breach</li></ul>-- h-online,<br />
  47. 47. Life After Anonymous<br /><ul><li>Interview with the former Hacker @SparkyBlaze from Anonymous crew
  48. 48. Taken by Cisco employee who runs @CiscoSecuritytwitter account
  49. 49. Biggest Issue : Social Engineering </li></ul>“ It all comes down to lies, everyone does it and some people get good at it.”<br /><ul><li>Advice : Stay away from Black Hat hacking .</li></ul>-- Cisco security Blogs<br />
  50. 50. News Overview<br /><ul><li> Provides anonymisation proxies rent computers infected with the TDL4Bot for use.
  51. 51. Downloaded utorrent client between 4:10 am to 6:20 am Pacific time on 13thsept- You Are INFECTED with malware
  52. 52. Web server compromised, replaced windows executable with malware
  53. 53. Mebromi- new Rootkit discovered by Chinese AV vendor 360 targetting mainly Award BIOS users.
  54. 54. Persists even if harddrive is physically replaced.
  55. 55. Package :: BIOS Rootkit + MBR Rootkit + Kernel mode rootkit + PE File infector + Trojan downloader</li></ul>DeepSafe : <br /><ul><li> Hardware assisted security products
  56. 56. Provides trusted view of system event below OS
  57. 57. Will embed within ESXi, Xen, KVM and Hyper-V hyperwisors too </li></ul>--theregister, softpedia, h-online news,<br />
  58. 58. News Overview<br /><ul><li>First Zeustrojan and now Spyeyetrojan infected android mobiles found.
  59. 59. Malware masquerades as a security app and can intercept incoming SMS text messages.
  60. 60. Don’t exploit vuln in device, user have to manually download and install the app to get infected
  61. 61. Free t-shirt facebook scam takes advantage of email upload
  62. 62. Uses users fb email address to upload content from mobile devices
  63. 63. QR Tags Can Be Rigged To Attack Smartphones
  64. 64. PoC hack showed scanning QR code with embedded URL directed to spoofed site and fed malware.
  65. 65. Another update to Apache due to byte range flaw, version 2.2.21
  66. 66. Version 2.2.20 fixedsDoS vulnerability
  67. 67. Apache Killer tool vulnerability was released to exploit DoS.
  68. 68. Windows 8 demonstrated at Microsoft's BUILD conference.
  69. 69. Picture passwords, faster boot time, built in AV, boot from usb flash drive and new friendlier blue screen of death
  70. 70. Developer preview is available free for download</li></ul>-- h-online news, foxnews, zscaler, theregister<br />
  71. 71. Security Tools Overview<br /><ul><li>OWASP-GoatDroid: Training environment for exploring Android mobile application security
  72. 72. DroidBox: Sandbox for Android platform</li></ul> Dynamic analysis of android applications<br /><ul><li>APKInspector : Static analysis for Android platform
  73. 73. AnDOSid : DOS Tool for Android
  74. 74. OWADE (Offline Windows Analyzer and Data Extractor) : Cloud based forensics
  75. 75. Threat Modeling Tool v3.1.8, MiniFuzz Tool v1.5.5, RegExFuzz Tool v1.1.0 : </li></ul> Updated SDL tools by Microsoft<br /><ul><li>Data-sound-poc: Exfilterate data out of network over a voice connection
  76. 76. fuzzdb: Open Source database of malicious and malformed input test cases.
  77. 77. OSForensics: OS Forensics tool for digital investigations.
  78. 78. minibis: Automated malware analysis based on paper "Mass Malware Analysis: A Do-It-Yourself Kit“
  79. 79. WebSurgery: Web Application Security Testing Suite</li></li></ul><li>Security Reading <br /><ul><li>Understanding and Selecting SIEM/Log Management (PDF)
  80. 80. How Microsoft Develops Security Patches
  81. 81. Google Report: How Web Attackers Evade Malware Detection
  82. 82. Dissecting Andro Malware
  83. 83. A summary of PDF tricks: data encodings, JavaScript, or PDF structure
  84. 84. Clubhack Magazine : Sept 2011: Theme – Malware </li></li></ul><li>Thank You<br />Comments ,Feedbacks, Suggestions<br />Twitter : @ashwinpatil<br />LinkedIn :<br />