Microsoft asks web developers to 'bet on us'

Okay...so *usually*, i try not to feed too much off of simple articles on the web, but as I am flipping through the news journals, I have run across (yet) another interesting post. Before reading on ...yes...let's put this into perspective. Yes...Microsoft is the whipping boy, yes...they are the biggest...yes...they have the most to deal with (ok....so i made that last part up). Read on ....

[ Article ]

Apple's Leopard lasts '30 seconds' in hack contest

Apple's Leopard has been hacked within 30 seconds using a flaw in Safari, with rival operating systems Ubuntu and Windows Vista so far remaining impenetrable in the CanSecWest PWN to Own competition. Security firm Independent Security Evaluators (ISE) — the same company that discovered the first iPhone bug last year — has successfully compromised a fully patched Apple MacBook Air at the CanSecWest competition, winning $10,000 (£5,000;) as a result. Although the competition recorded the hack taking eight minutes, Charlie Miller, a principal analyst with ISE, told ZDNet.com.au that it took just 30 seconds and was achieved using a previously unknown flaw in Apple's Safari web browser.

[ Article ]

wep cracking 101

WEP was intended to provide confidentiality comparable to that of a traditional wired network. Several serious weaknesses were identified by cryptanalysts; a WEP connection can be cracked with readily available software within minutes. WEP was superseded by Wi-Fi Protected access (WPA) in 2003, followed by the full IEEE 802.11i standard (also known as WPA2) in 2004. Despite its weaknesses, WEP provides a level of security that may deter casual snooping. ( Source, Wikipedia )

Trust me when I say that this is not the most comprehensive posting on WEP cracking, but I received a request from a friend of mine to provide the "short and sweet" on WEP cracking ... so I thought i would share this very short tutorial. The sample I am going to provide has several limitations (ex. I am only demonstrating an attack using ARP replay attack (there are several other methods of attack)), but we are simply giving a brief overview. Video sample of instructions

There are four basic steps (well...at least in this example) to cracking a WEP key. The broad overview is as follows:

1. Setup network interface card to monitor mode with airmon-ng (madwifi drivers for packet injection)


2. Execute airodump-ng for sniffing wireless traffic and creation of "cap" file (to be used later with aircrack-ng)


3. Execute aireplay-ng to create traffic for the generation and capture of IV's (we will be using an ARP-Replay attack (-3))


4. Execute aircrack-ng against the generated cap file

Step One: Setting up your NIC with airmon-ng

• The first step (and often daunting for the experienced administrator) in our quest for cracking a WEP key is to setup the network interface card on your system. For our example, we are utilizing the Netgear 108 Wireless PC Card (WG511T) which is based on the atheros chipset for packet injection. To setup your NIC to monitor mode, we must first execute a couple of commands in order initialize our card. The first two commands you will execute are:
  
  # rmmod ath_pci
  # modprobe ath_pci

Once you have executed these two commands, your interface will be ready to use with the airmon-ng script for setting your card into monitor mode with use with the madwifi drivers for packet injection.

• The second step in setting up your NIC card is to engage the madwifi-ng drivers. Because the madwifi-ng drivers allow for multiple virual access points to be run, personally, I like to destroy and the create a new VAP on each session ... simply to make sure I understand what I have setup on the system. To do this, you will execute the following command:
  
  # airmon-ng stop ath0
  # airmon-ng start wifi0 1
  # macchanger -m 00:12:23:34:45:56 ath0
  
  This command(s) will destroy the current VAP and create a new parent VAP as well as, enable monitor mode on ath0 interface. You should now be able to execute the "iwconfig" command to verify that your ath0 interface is in monitor mode for sniffing wireless traffic.

Step Two: Discovering a target with airodump-ng

• The first step taken with airodump-ng is to initate a session so that you can obtain information regarding a target access point. You will launch airodump-ng with the following command:
  
  # airodump-ng ath0 (ath1,ath2,...)
  
  Once you have determined the target access point for your capture, you will perform the following setup.
  
  # airodump-ng -w FileToCrack -c targetAP_ChannelNumber ath0
  
  Once this process is started...move to step 3.

Step Three: Initiate aireplay-ng

• One purpose of aireplay-ng is to move the process of capturing IV's for cracking. This step will submit traffic to the access point so that it stimulates the AP into responding with initialization vectors in the ARP response. We are able to accomplish this with two simple steps. Keep in mind that we are ONLY demonstrating one single method of attack here (but it is (probably) the most popular method).For our example, we will assume that the target AP name is "tdurden" running on channel 6.
  
  # aireplay-ng -1 0 -e tdurden -a target_ap_mac -h our_mac_addr ath0
  
  Once this process successfully completes, initiate the following command.
  
  # aireplay-ng -3 -b target_ap_mac -h our_cards_mac_address ath0
  
  This will start the initiation of ARP requests to the access point. Once you have captured enough ARP requests, you may the use aircrack-ng to crack the WEP key based on the traffic capture of the .CAP file.

Step Four: Cracking our WEP key with aircrack-ng

• The final step is to initiate the aircrack-ng script against your .CAP file (generated by airodump-ng). Simply issue the following command:# aircrack-ng FileToCrack.cap
  
  If you have captured a sufficient number of IV's from the ARP-replay attack then you should have a successful decryption of the WEP key.

Video sample of instructions

I'm addicted to Mac

78%How Addicted to Apple Are You?

ajax security (book release)

Billy Hoffman and Bryan Sullivan released a new book on AJAX Security this last month (or so). For those of you who aren't familiar with Billy and Bryan, they are/were involved in the SPI Dynamics group before being acquired by HP Software in late 2007. I would highly recommend that you grab a copy of this book for your library.

AJAX Security Book

[Ripped from Amazon]

Billy Hoffman is the lead researcher for HP Security Labs of HP Software. At HP, Billy focuses on JavaScript source code analysis, automated discovery of Web application vulnerabilities, and Web crawling technologies. He has worked in the security space since 2001 after he wrote an article on cracking software for 2600, “The Hacker Quarterly,” and learned that people would pay him to be curious. Over the years Billy has worked a variety of projects including reverse engineering file formats, micro-controllers, JavaScript malware, and magstripes. He is the creator of Stripe Snoop, a suite of research tools that captures, modifies, validates, generates, analyzes, and shares data from magstripes.

Bryan Sullivan is a software development manager for the Application Security Center division of HP Software. He has been a professional software developer and development manager for over 12 years, with the last five years focused on the Internet security software industry. Prior to HP, Bryan was a security researcher for SPI Dynamics, a leading Web application security company acquired by HP in August 2007.While at SPI, he created the DevInspect product, which analyzes Web applications for security vulnerabilities during development. Bryan is a frequent speaker at industry events, most recently AjaxWorld, Black Hat, and RSA. He was involved in the creation of the Application Vulnerability Description Language (AVDL) and has three patents on security assessment and remediation methodologies pending review.

Give yourself a little time with SQL Injection

I was recently involved in web application assessment and discovered something that I wanted to pass along. Keep in mind that this has probably been utilized before, but it is something that I just noticed so … I wanted to throw it out for your amusement.

To set the stage, I had been looking at this application for quite some time and had an idea that SQL Injection might exist, but I was having much difficulty determining if the injection was actually present. The application was catching errors, displaying 404’s, (etc) and really not displaying any good data to make a decision. So …. the question was … if the application is catching our errors and really not giving us anything to work with … how could we ask the question to the database to indicate if we were actually getting our requests processed by the database server?

Answer? Time.

Since the application is catching all of our attempts and not providing any good feedback the thought was … let’s come up with a way to have the database provide us an “indirect” response. To do this, I tried “waitfor”. WAITFOR specifies a time, time interval, or event that triggers the execution of a statement block, stored procedure, or transaction.

Syntax: WAITFOR { DELAY ‘time’ TIME ‘time’ }

To implement ‘waitfor’, simply tag it onto the end of the injection test you’re trying to accomplish. For example, if you’re injection string is:

30000' union select 1,email,password from Customers --

By implementing ‘waitfor’, your string might appear as….

30000' union select 1,email,password from Customers waitfor delay ‘0:0:30' --

Keep in mind that while the injection results might not appear to your screen, you will experience a delay of the response back to the browser. The point here is to demonstrate that:

1. Our injection is being accepted by the database server
2. The injection is executing.

So, while our injection string might not render results to the screen, we can test that the database server is executing our injection strings.

"Hacker Safe" Site Hacked, Data Stolen

It's simply amazing to me that folks will fall for the marketing literature. Hacker Safe? I think not....

http://www.cioinsight.com/article2/0,1540,2246925,00.asp

Vidalia Project

Thank you, Baby Jesus!

I'm sure that many of you have seen this software (and i'm sure i'll hear about it), but I had to point out what could be one of the coolest tools out there for your warped heads. The tools is called Vidalia and it's found at http://vidalia-project.net/ . Seriously one of the nicer tools ....it has options that will absolutely help you with your anonymity.

Here's a rundown of what i have found....

1. Tor: A tool-set for a wide range of organizations and people that want to improve their safety and security on the Internet. Using Tor can help you anonymize web browsing and publishing, instant messaging, IRC, SSH, and other applications that use the TCP protocol. Tor also provides a platform on which software developers can build new applications with built-in anonymity, safety, and privacy features.
2. Bandwidth monitor: Okay ...so it's not that spectacular, but a nice touch.
3. New Identity: I haven't been able to research this and exactly how it works, but i would guess that this function generally kills and creates a new Tor circuit. I'll have more information on this later (and will post it), but it definitely works.

This is a must download!

Top 15 SQL Injection Scanners

Keep in mind that I have played with most of the tools out on the web for SQL Injection, but these guys published this pretty nice list of SQL Injection scanners. I will say that there are a couple of commercial scanners that will rip the pants off of most of these, but again, you pay to play.

The Top 15 SQL Injection Scanners page is definitely something work seeking out. One addition to the list would be SQLiX which can be found on the OWASP page -- nice little tool if you're looking for something perl based.

Still Secure (Personal Edition)

For those of you who may have been living on the moon, I wanted to point out that Still Secure offers a great personal solution for you to run at home. Based on the snort IDS, Strata Guard is now available for download ...i highly recommend trying this out. Take me out back and shoot me, but I'm a huge believer in companies giving back to the little guys and when companies like still secure make such a great offering (for free), it's more than worth noting here.

You may get to the site by following: [ Download ]