Showing posts with label Hacking. Show all posts
Showing posts with label Hacking. Show all posts
The following is complete speculation but wanted to at least start a discussion around what could have happened at Facebook today.
I don't think it was an honest mistake that caused the Facebook outage. With DNS reported down BGP routing issues and reports that even internal networks are affected, this looks bigger than a single mistake. Facebook most certainly has complicated network segmentation and redundancy in place for there internal and external networks.
Also, the timing is very suspect since it is the day after the Facebook Whistleblower interview on 60 Minutes.
If this isn't the work of a disgruntled employee, it is some sophisticated shit, and they have been living rent-free in the Facebook network for a long time. They got all the bytes they need and decided to blow that shit up after the interview.
I hope Facebook shares the details of the outage. If it was indeed an internal error that caused the outage it may be an eye opener for other large platforms to learn from the mistake. If it was nefarious activities that caused this, it could be an epic learning opportunity for the Cyber security world.
Either way please share the outcome Facebook....
So SolarStorm the SolarWinds supply chain hack... Yeah.... You might have heard about it?
SolarWinds supply chain was compromised. What that means is a trojanized version of a SolarWinds package was uploaded and distributed to their clients . The infected package contained malware named SUNBURST, and when clients installed the infected package it also installed the malware. The malware creates a backdoor to allow the bad actors to control the server, move laterally, and exfiltrate data. Basically what ever they want....
Updated Solarwinds Attack Lifecycle:
What should you do now:
As information starts to come out and the initial freak out calms down we are learning more about the impact of these exploits, and they are pretty huge. I wanted to gather a collection of information and vendor responses in one place to try to help fellow nerds have a resource of reliable information.
SolarWinds
- Security Advisory https://www.solarwinds.com/securityadvisory
Fireeye Links
- Initial write up about the Sunburst https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
- Counter Measures https://github.com/fireeye/sunburst_countermeasures
- Emergency Directive https://cyber.dhs.gov/ed/21-01/
Palo Alto Networks Unit 42
- Analysis of Sunburst https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/
- Information https://blog.checkpoint.com/2020/12/16/solarwinds-sunburst-attack-what-do-you-need-to-know/
Cisco Networks
Splunk
- Response and Identification tool https://www.splunk.com/en_us/blog/security/sunburst-backdoor-detections-in-splunk.html
Mcafee
Microsoft
- Pretty tough to get through :( https://www.microsoft.com/security/blog/2020/12/15/ensuring-customers-are-protected-from-solorigate/
- **Customer Guidance: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
Infoblox
Elasticsearch (Elastic Security)- Response and Identification tool https://www.elastic.co/blog/elastic-security-provides-free-and-open-protections-for-sunburst
Link to Blog post about Reverse Engineering the encoded DGAs:
Cynet
Symantec
CrowdStrike
- **Assessing the SolarWinds hack with their tool: https://www.crowdstrike.com/blog/tech-center/assess-solarwinds/
**Update**
I have noticed that after upgrading Ubuntu to 20.04 or 22.04 I have run into a little snag. It appears that the upgrade over rights the sysctl.conf file back to default values. The symptom is your wiregurad server will not be forwarded IP V4 or V6 traffic.
To resolve the issue perform the following steps.
- sudo nano /etc/sysctl.conf
- net.ipv4.ip_forward = 1
- sudo sysctl -p
WireGuard is a simple, fast, and secure VPN that utilizes state-of-the-art cryptography. With a small source code footprint, it aims to be faster and leaner than other VPN protocols such as OpenVPN and IPSec. WireGuard is still under development, but even in its non optimized state it is faster than the popular OpenVPN protocol. In fact it connects so quickly you'll likely find your self going to whats my IP to insure your traffic is actually being tunneled.
The WireGuard configuration is as simple as setting up SSH. A connection is established by an exchange of public keys between server and client. Only a client that has its public key in its corresponding server configuration file is allowed to connect. WireGuard sets up standard network interfaces (such as wg0 and wg1), which behave much like the commonly found eth0 interface. This makes it possible to configure and manage WireGuard interfaces using standard tools such as ifconfig and ip. I was going to post a guide but there are so many good guides already on the internet just google it. Also the official documentation is really good and has some install guides as well.
Enjoy, be safe, support and contribute to WireGuard.
The WireGuard configuration is as simple as setting up SSH. A connection is established by an exchange of public keys between server and client. Only a client that has its public key in its corresponding server configuration file is allowed to connect. WireGuard sets up standard network interfaces (such as wg0 and wg1), which behave much like the commonly found eth0 interface. This makes it possible to configure and manage WireGuard interfaces using standard tools such as ifconfig and ip. I was going to post a guide but there are so many good guides already on the internet just google it. Also the official documentation is really good and has some install guides as well.
Enjoy, be safe, support and contribute to WireGuard.
Mutual authentication or two-way authentication refers to two parties authenticating each other at the same time. Below is an excerpt from the Wikipedia page, they did a nice job explaining what mutual authentication is.
By default the TLS protocol only proves the identity of the server to the client using X.509 certificate and the authentication of the client to the server is left to the application layer (for example, username and passwords.) TLS also offers client-to-server authentication using client-side X.509 authentication. As it requires provisioning of the certificates to the clients and involves less user-friendly experience, it's rarely used in end-user applications. But at a small scale or proof of concept this is completely reasonable.
Mutual TLS authentication (mTLS) is much more widespread in business-to-business (B2B) applications, where a limited number of programmatic and homogeneous clients are connecting to specific web services, the operational burden is limited, and security requirements are usually much higher as compared to consumer environments. The factor that impacts scaling of this design is not the technology, devices are built to handle millions of SSL transactions, but the policy and procedures around the certificate management and client on-boarding.
In this example a client will be connecting to an Apache web server and authenticate using mutual TLS authentication.
First you must build the web server running SSL. You can find a lot of step by step articles online about how to build an Apache web server preferably on Linux. Also take a look at Lets Encrypt, it's a free SSL certificate issuer that is freaking awesome.
Once you have your web server up and running you will want your client to generate a certificate. This can be done using OpenSSL the de facto for everything SSL on the internet. There are some awesome guides on how to build out the mutual SSL authentication and the accompanying Apache config. The best one I found was on stefanocapitanio.com they do a great job of outlining each step that makes up the mutual TLS authentication. In this example I will Jump ahead to the certificate creation,
This will generate your private key and certificate. You will need to answer the following questions when prompted this makes up the attributes of your client certificate.
|
Here is an example what it will look like.
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:US
State or Province Name (full name) []:State
Locality Name (eg, city) []:City
Organization Name (eg, company) []:Anything
Organizational Unit Name (eg, section) []:Anything
Common Name (eg, fully qualified host name) []:Username
Email Address []:youremail
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:US
State or Province Name (full name) []:State
Locality Name (eg, city) []:City
Organization Name (eg, company) []:Anything
Organizational Unit Name (eg, section) []:Anything
Common Name (eg, fully qualified host name) []:Username
Email Address []:youremail
Next we will combine the Key and Certificate in PKCS#12 file:
|
Once you have generated and installed your client certificate you will want to send ONLY THE PUBLIC CERTIFICATE, in this case client-certificate.pem to the server admin. Your public certificate will be what is used to identify your machine when it attempts to connect tot he web server. Read up on the Apache man pages about he SSLVerifyClient options there is quit a but out there. This is a very basic config.
The server admin will place your certificate in their certificate store and configure Apache.
<VirtualHost *:443> ServerName secure.example.com DocumentRoot "/var/www/html" ServerAdmin [email protected] SSLEngine on SSLCertificateFile /home/sempla1/ssl/server-cert.pem SSLCertificateKeyFile /home/sempla1/ssl/private/server-key.pem SSLVerifyClient require SSLVerifyDepth 10 SSLCACertificateFile /home/sempla1/ssl/client-certificate.pem </VirtualHost> |
That's it I had a good time playing with this I hope you do as well.
This list is courtesy of @tarah on twitter.
The top 20 most common mobile phone PINs are:
1234
1111
0000
1212
7777
1004
2000
4444
2222
6969
9999
3333
5555
6666
1122
1313
8888
4321
2001
1010
26% of all phones are cracked w these codes.
Change to short passphrase: Settings>Passcode (iOS)/Security (Android)
<3 stay safe!
Two cool new exploits have been released complete with cool names and graphics. Welcome Meltdown and Spectre, these critical vulnerabilities exploit pretty much all modern processors. Even though these hardware vulnerabilities have been around forever, four independent groups of researchers discovered these vulnerabilities simultaneously. Meltdown and Spectre at a high level allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a malicious program can exploit Meltdown and Spectre to get hold of secrets stored in the memory of other running programs.
Meltdown and Spectre work on personal computers, mobile devices, and in the cloud. But what about our network and security equipment using modern processors, are they vulnerable? Below is a list I put together of links to vendors sites and their responses to the vulnerabilities. I imagine most of them will keep these pages up to date as they discover new information. This is a complicated and low level issue so most vendors are going to need time to really evaluate their products and create patches.
Luckily in most cases it is an attack that is performed through the management access, so if you follow the best practice of limiting device management access from only trusted IPs or networks you should be good until the patches are released.
PaloAlto Networks
"Our initial review of the vulnerabilities disclosed in the research concludes that all PAN-OS/Panorama platforms are not directly impacted by these attacks. There are no immediate plans to release a software update to PAN-OS in response to these issues at this time"F5
"ImpactFor products with None in the Versions known to be vulnerable column, there is no impact. For products with ** in the various columns, F5 is still researching the issue and will update this article after confirming the required information. F5 Technical Support has no additional information about this issue.
BIG-IP
All three vulnerabilities require an attacker capable of providing and running binary code of their choosing on the BIG-IP platform. This raises a high bar for attackers attempting to target BIG-IP systems over a network and would require an additional, un-patched, user-space remote code execution vulnerability to exploit these new issues. The only administrative roles on a BIG-IP system that can execute binary code or exploitable analogs, such as JavaScript, are the Administrator and Resource Administrator roles. These users already have nearly complete access to the system and all secrets on the system not protected by hardware-based encryption. F5 believes that the attack with the highest impact may occur in multi-tenancy Virtual Clustered Multiprocessing (vCMP) configurations, running single-core guests owned by different administrative domains on a single BIG-IP system. In this scenario, Spectre Variant 2 may allow an attacker in one administrative domain to collect privileged information from the host or guests owned by another administrative domain, if the attacker's guest is configured as a single-core guest. The BIG-IP system always maps both hyper-threads of a given core to any guest with the "Cores Per Guest" configuration set to 2 or more, but single-core guests may execute on the same processor core as another single-core guest or host code. This threat may be mitigated by setting the "Cores Per Guest" configuration to 2 or more for all guests."
Cisco
"Cisco is investigating its product line to determine which products may be affected by these vulnerabilities. As the investigation progresses, Cisco will update this advisory with information about affected products, including the Cisco bug ID for each affected product."Juniper
"Juniper SIRT is actively investigating the impact on Juniper Networks products and services.”Brocade
Citrix/Netscaler
"Citrix NetScaler SDX: Citrix believes that currently supported versions of Citrix NetScaler SDX are not at risk from malicious network traffic. However, in light of these issues, Citrix strongly recommends that customers only deploy NetScaler instances on Citrix NetScaler SDX where the NetScaler admins are trusted."
The show's technological accuracy is extraordinary. The tools and techniques are hyper-accurate, and their use of social engineering really exposes what's going on in todays world. Sure the show feeds into some Hacker stereotypes with the socially inept black hoodie wearing main character, but it probably helps sell it to the masses.
Beyond the technology the acting, writing, and production stands on its own as one of the best psycho thrillers I have seen on TV. You are the imaginary friend made up by Elliot the lead character. This immerses you into his world, and with House of Cards level inner monologue, you become an active part of his life. His paranoia becomes your paranoia as you are looking for clues or hints of whats going to happen next.
What should happen next? Everyone should watch this show. Mr. Robot shines a light onto real life events set in a fictional world. Evil Corp, fsociety these are fictional representation of companies and groups that are in our headlines every week. The genius of this show is its position to not only create this fictional world but draw on real life events as they happen, and I can't wait to see what happens next.
Links to other articles about the show:
- USA Network http://www.usanetwork.com/mrrobot?cid=ps_Mr-Robot__Launch_2015Q2_
- Wired Article http://www.wired.com/2015/07/mr-robot-fact-check/
- Forbes talks with Show Consultant http://onforb.es/1HiC4tN
The Driftnet software is very strait forward and easy to install, it does get a little tricky to capture traffic if you are on a switched network. One way to capture traffic on a switched LAN is by deploying ARP poisoning, there are different ways to do this but ettercap and it’s GUI is probably the easiest.
Disclaimer... Do not do this on a network you do not own. There are network monitor systems that can identify computers performing ARP attacks on public networks this could be illegal. You are performing a man in the middle attack and all traffic will traverse your laptop for that network segment.
Now on to installing the tools. Using Ubuntu you can actually go to software install and update, make sure you allow all software sources and search for ettercap. Installing ettercap this way will install the GUI portion automatically, if you use apt-get it may not be in the repository.
Driftnet is even easier to install either use the software install and update tool or go to terminal window and type sudo apt-get install driftnet. Once everything is installed you are ready to start playing.
in driftnet all you have to do is type this:
sudo driftnet -i <interface>
and ti launch ettercap
sudo ettercap -G
then in the GUI
sniff—>unified sniffing (click ok on your interface and press Ctrl and s at the same time)
Mitm—>arp poisoning—->check sniff remote connection
start—>start sniffing
Thats it just wait for the other people to surf the web and pics will start showing up.
hope you guys like.
Another Defcon and Holly Shit there where lot of people. I registered Friday morning and they had run out of badges. Defcon has out grown the Rio, and to support that theory where rumors the Con would be moving. For conventions over 14,000 attendees the options narrow. On the Defcon Wikipedia page and the Defcon DC News site they list Defcon 23 will be at both the Paris and Bally's hotels. Not sure how that will workout, but it definitely needs a larger facility. This may be mis information though, remember Defcon is canceled every year.
The theme this year at least the talks I attended was Botnets... Botnets... Botnets... The first talk I attended was Domain Name Problems and Solutions with Dr. Paul Vixie. His talk was a deep dive into how Botnets and other nefarious entities are exploiting DNS. The industries movement to provide convenient and low priced DNS names are fueling the fire. He also went into analysis of DNS meta data and how it is used in DNS RPZ or a (DNS Firewall.)
Don't DDOS Me Bro: Practical DDOS Defense presented by Blake Self and Cisco Ninja, was one of the better talks I attended. They spoke about Layer7 DDOS detection and defense, and brought some real world data from their site soldierx.com. They presented some examples of multi layer defenses from F5 rules to Apache tools. They also released their DDOS monitoring tool RoboAmp that will run on a Raspberry Pi.
Lastly and trust me it was a tough talk to get to was Catching Malware En Masse: DNS and IP Style. OpenDNS presented tools and techniques they have developed to identify bonnet and malware traffic on the internet. They also presented an awesome 3D visualization engine they use to graph and identify this rouge DNS and IP traffic.
Between the parting and binge consumption there was a lot to take away from this years Defcon. It was good catching up with old friends and meeting new ones, and I can wait till next year.
Ever wanted to mess with those wifi leaching neighbors? Joshua Wright at willhackforsushi.com put together an awesome tool kit that enables you to really screw with your neighbors. All you need is a virtual machine, I used it in parallels on a mac, and your everyday hacker wifi adapter like a Alfa AWUS036H.
Joshua's project plays some really fun tricks with URL rewriting and HTML content manipulation. Here is a link to his presentation at SANS Security East Jan 18, 2013.
Download and give it a try it's a great example of some man in the middle HTML goodness. http://neighbor.willhackforsushi.com/
It's that time of year again, start planning for Defcon. For those of you that maybe haven't been before here is a little guide to help you plan.
When is Defcon: Defcon attendance has been growing every year, and for the first time it will be hosted at two hotels, Paris and Bally's. Its normally held towards the end of July or beginning of August. It's a good idea to get there a day early to buy SWAG and get your badge because it gets super busy the day of.
How Much is Defcon: The registration fee has gone up a little over the last few years, but they will post the fee as we get closer to the Con. Oh ya, like most everything at Defcon - don't use the ATM. Cash only.
- Registration: $230
- Hotel: Defcon room rates differ depending when you book, but Defcon usually negotiates a good price.
Where to Stay: Staying at the hosting hotel is a must. It's nice to just head up to your room between talks, and attending the late night festivities are a breeze since you only have stumble to the elevators. Reserve your rooms early for Defcon, as some of us experienced the hotels sells out quick.
Added bonus; If you stay at hosting hotels Defcon will stream the talks and schedules to the hotel rooms. This is not guaranteed this year since we will be in a new venue.
What to Bring: A few essentials I bring to Vegas.
- Snacks because eating at the CON can get kinda pricy, plus a lot people save the money for drinking.
- Buy a cheap throw away cooler for refreshments and ICE
- A laptop "AT YOUR OWN RISK" If you bring your laptop do not bring it to the Con, leave it in your room and even then disable your wifi, bluetooth, and do not use the hotel internet. Defcon's network, including the hotels, have been deemed the most hostile network in the world. Even the cellular network is risky and it usually sucks anyway. That being said, if you have a fresh wiped laptop and you want to partake in the festivities bring it just dont use it for anything other then hacking, and reformat when you get home.
- Cell Phone, if you have an old school flip phone bring it. If you bring your smart phone make sure to turn off the radios, i.e. wifi, bluetooth, etc. Nothing is safe.
- Asprin for obvious reasons
- Your finest hacker tees, there kinda a big thing, and a comfortable pair of shoe. You will be standing in some lines, imagine a disneyland for hackers...
Everyone interested in technology should go at least once.
Here is the link http://bit.ly/dEiSzJ