xs

Bruised, broke and def from Blackhat and Defcon

Hello fellow geeks,

Well, I made it back from Las Vegas and I have to say that I had a GREAT time. Black Hat 2004 and Defcon are worth the time and travel headaches.

I got to meet some pretty cool people. I meet Kevin Rose from TechTV on day 1 @ Defcon and got my picture taken with him. He was kinda cool in a dorky way.

8 days in Las Vegas was way to much. By day 5, I was already sick of the noise and broke as hell. Food was not as cheap as I thought it would be. The Hilton had a great buffet and the Star Trek experience was just COOL! I am happy to be back in Ohio... so I can geek out with my friends.

There where so many great presentations at both conferences that I have decided to add a few here for your viewing pleasure. Please feel free to download these papers and review them (just right click and save the file locally before viewing).

These papers are from my favorite presentations at Blackhat. I will be adding the Defcon papers very soon, so check back for more great hacking and security tips.

Later.

m@dn05

Download "You found that on Google"

Download "The Google Hackers Guide"

Download "Blind SQL injection automation techniques"

Download "Testing IKE implementations"

Download "Spam tracking and covert channels"

Download "The laws of vulnerabilities"

my.bunghole will kill your computer!

Who names computer viruses? This is a question that I have had for sometime now. I know that hackers are more creative than calling something zafi-b or Melissa. Hell, if I was to write a virus I would call it the my.bunghole.vbx so I could say that my.bunghole killed your computer. hehehe

CARO (Computer Antivirus Research Organisation), which almost all of the major AV vendors are members of, have a set of standards that are followed when naming new viruses. This also means that sometimes when a non-member releases info on a virus to the press, that the virus in question may have a different name than what the CARO decided upon.

OK, we have a majrity of the AV companies out there at least trying to set a standard around the naming of viruses, and then you have a select few companies who have decided to go on there own and do there own thing. So we get alot of confusion when a major virus outbreak occurs and networks experience downtime due to applying the wrong AV update. That sounds really smart!!!

When I read stuff like this, I think of the movie "Pump up the volume". Christian Slater, who was a radio pirate said "If you are not part of the solution... then you are part of the problem. Quit being part of the f*cking problem!" I could not agree more Christian.

I say support the AV companies who support CARO standards. They are the one's who are trying to make a difference and should get our business because of this.

Anyway, we have a new bug out in the wild and it is a multilingual virus. JOY!

Here is the write up on this nasty bug.

Enjoy.

Security firms have issued warnings over a multilingual computer virus that can shut down firewalls and disable anti-virus software. Zafi-b, which is also known as Hazafi or Erkez-b, spreads both as an email attachment and via peer-to-peer file-sharing systems, using techniques common to similar worms. The worm, first discovered last week and now spreading rapidly, is delivered in the form of a .pif, .exe or .com file.

Most interesting about the malware is its ability to speak in multiple tongues. Zafi replicates itself in Hungarian, German, Dutch, English, Italian, Swedish, Spanish, and Russian.

People are not expecting to get a virus in their own native tongue and so [they] drop their guard a little," said Conor Flynn, technical director of Irish e-security company Rits, who described Zafi-b as "smart...It also uses file names linked to the WinAmp music program and the Total Commander computer games."

Zafi-b is not the first bug with capability of speaking in different languages. Sober-d, released into the wild earlier this year, recognises German email addresses, so that text in emails was written entirely in German, rather than in the default language, English.

Like other email worms, Zafi-b harvests addresses from users' address books and then spreads by sending itself to those addresses. The new variant also disables tools central to the Microsoft Windows operating system such as the Registry Editor and Task Manager, preventing the use of these essential applications by other programs, said Finnish e-security company F-Secure.

Zafi-b accounted for more than 60 per cent of reports to Sophos's network of monitoring stations over 24 hours. Because Zafi-b can disable anti-virus programmes, computer users should update anti-virus signatures on perimeter machines connected to external networks on an hourly basis, said Rits' Flynn.

Zafi-a appeared in the wild in April to coincide with Hungary's accession into the EU; it contained a political message appealing to Hungarian patriotism. This first manifestation of the worm didn't appear outside the country as it only sent itself to .hu addresses. The Zafi.B variant contains a different political payload, this time demanding that the Hungarian government accommodates the homeless, tightens up the penal code and votes for the death penalty.

The new worm can also orchestrate distributed denial of service (DDoS) attacks aimed at shutting down Web sites operated by the Hungarian government and Hungarian anti-virus firms.

Skunkape's rule!

OK. I have always wanted to do a movie on Skunkapes. The Skunkape is a knockoff of Bigfoot and of course there are some definite similarities between the two (odor, ape like movement, only spotted by drunken rednecks). My movie would focus on the legend of the skunkape migration into Ohio and the expedition to find and kill the Central Ohio skunkape.

The party would be comprised of the best and brightest minds that the Saswanee trailer park has to offer. Red is our groups leader who loves to collect used Red Man pouches, thus his name. He also claims to have spotted the Ohio skunkape in a remote wooded area close to the Saswanee trailer park, while searching for the elusive 1981 limited edition Dukes of Hazard Redman pouch.

Our next party member is Betty Sue. She is the girlfriend of Red and has the worlds biggest hair. Yes, big hair is still in people! She works at the local diner and has plenty of time to read the Sun news to keep up on current skunkape sightings. She also likes to rebuild old Chevy carburetors in her spare time.

Next is Skip. Skip is the dirtiest man alive! Skip is also the grounds keeper at Heavenly rest cemetery and has also claimed to have seen the elusive skunkape. Skip's one driving goal on this expedition is to be the one who shoots the skunkape and sell his head so he can get a new set of tires on his old Ford pickup truck.

And finally there is Earl. Earl is unemployed and lives with his mother. Earl had a job at the local night crawler farm but was fired when the owner found Earl touching himself while looking at a picture of Buck Owens.

In the end, our prey would be nothing more than a fat hairy man who loved to run naked through the woods. He lived in a small shack near Saswanee trailer park, that was littered with porno magazines and little Debbie snack cakes.

Now, back to reality. We find that rednecks love to find a reason to party in there trailer parks. Looks like the legend of the skunkape will live on, at least as long as the Budweiser lasts.

Enjoy

Believers, skeptics celebrate legend of the skunk ape
By TRACY MIGUEL, tmiguel@naplesnews.com
June 13, 2004

The second annual Everglades Skunk Ape Festival attracted more than 100 believers and skeptics to a day of live music and food at the Trail Lakes Campground in Ochopee on Saturday.

Tales of South Florida’s skunk ape, a homegrown counterpart of Bigfoot in the Northwest, have circulated locally for decades.

The festivities began Friday night with live bands and about 75 people.

"It’s mainly about having a good time and a way for people to talk about what they have seen," said Collier County’s skunk ape expert and host of the festival, David Shealy.

Despite never having seen a skunk ape, Naples resident Ron Mitchell said there was great music and food.

"This really is Southern hospitality in Southwest Florida," said Mitchell, who was visiting the festival for the first time.

The event was a fun way to spend Saturday with family and friends, said Jonathan Thompson, who had camped at Trail Lakes Campground before.

Shealy’s first sighting of the skunk ape was 30 years ago. He was 10 years old, and he and his brother, Jack, were out hunting when they saw it.

Since then Shealy has devoted his time to showing his videos and pictures of the skunk ape to the public.

In the past, Shealy has appeared on TV shows such as "Inside Edition," "Extra," and "Unsolved Mysteries."

The skunk ape has characteristics which make it different from Bigfoot. It weighs about 300 pounds, has reddish-brown hair, is 7 feet tall and eats beans, said Shealy.

The skunk ape also has a distinctive odor.

"It smells like boiled eggs, toilet, dog breath, and paper bags that stick so much," said 12-year-old Hannah and Dylan Ward, 6.

Yet Shealy isn’t the only person who claims to have seen the skunk ape in the Everglades and Big Cypress.

"It sounds a bit stupid, but in the beginning of August 1998 I saw something strange and amazing, like a bear and half man, that walked like a monkey when I was camping here (Ochopee)," said Jurgen Hartmann, from Heidelberg, Germany.

Many first-time guests enjoyed their visit to Ochopee.

"This is Florida, a neat thing to come to and meet nice people," said Ryan Larry, from Naples.

The festival included live music by Hot Country and Southern Impact and a Ms. Skunk Ape contest, won by Missty Haney.

Backdoor man says "Have trojan will travel!"

A favorite way to compromise computer networks among less skilled hackers today is the use of trojan horse programs.

Trojan horse applications get there name from the ancient Greek siege of Troy. The Greeks tried for many years to get inside the walled city with little success. Finally the Greeks decided to use one more trick to capture Troy. They built the trojan horse. The Greeks would hide a hand full of men inside the horse, who would then open the city gates To the Trojans, the horse appeared to be an offering to the gods for forgiveness. The Trojans brought the horse inside of city of Troy as a war trophy and began to celebrate their great victory over Greece.

When night fell on Troy, the wooden horse opened up and Greek soldiers that had hidden inside of the horse opened the main gate and the waiting Greek army burned the city Troy to the ground.

So, the same is true with trojan horse programs. The trojan is designed to appear innocent in nature such as a picture, email, webpage etc. Trojans can be enbedded in almost anything that we find on networks or the internet today.

When a hacker gets a trojan on your machine, they can monitor almost anything you can think of. They can log everything you type on your keyboard, they can install apps remotely and view documents, log into servers or mainframes on your network and surf the web. Really anything you can do on your computer, the hacker can also do. Kinda scarey if you think about it. This one application can allow the hacker to bypass all of the wonderful perimiter defense systems that companies spend so much money on today (firewalls, proxy servers and IDS/IPS systems).

So, in this article we discover that the would be hacker is not the only one who can get access to your system. It appears that one of the top trojans used today (Backdoor.OptixPro.12) has a backdoor password that was built into it by the programmer (Sleaze). This would allow Sleaze to also log into your machine and use it for what ever reason he see's fit. The funny thing is that not even the original hacker who compromised the victim system would know about the system access. I doubt this will slow down the hacker underground from using this application, but to quote Rickie Ricardo from I love Lucy "Sleaze...You got some exlaining to do!"

The author of a free Trojan horse program favored by amateur computer intruders found himself with some explaining to do to the underground last month, after his users discovered he'd slipped a secret backdoor password into his popular malware, potentially allowing him to re-hack compromised hosts.

The program in question is Optix Pro (Backdoor.OptixPro.12), a full-featured backdoor that allows an intruder to easily control a compromised Windows machine remotely, from accessing or changing files, to capturing a user's keystrokes or spying on a victim through their webcam. Though some features could make Optix Pro usable as a legitimate remote management tool, others are clearly tailored to the underground, including a function that disables a machine's anti-virus and firewall software. The program has been downloaded nearly 270,000 times, according to a counter on the distribution site.

Like other species in a genus that includes BO2K, SubSeven, and Beast, the working end of Optix Pro is a server that the hacker must insinuate into a victim's computer, either through subterfuge - by misrepresenting it as an image file or an electronic greeting card - or by uploading it to an already-compromised machine. The hacker sets a password on the Optix Pro server, so that no other would-be intruders have the ability to slip through the open backdoor.

That is, none except for the author, a coder named "Sleaze" (he spells it "s13az3"), who secretly embedded in the program a random-looking 38-character "master password" that was known only to him.

Though the password was encrypted in the binary, at some point suspicious hackers teased the cleartext version from RAM, and it began circulating quietly in the underground, possibly as early as last year. Last month it surfaced on a hacker website, forcing Sleaze into an embarrassing admission. "I have never talked about master passwords before because I thought it best not to do so until one was ever found," Sleaze wrote, in a front page posting to the Optix Pro distribution site. "However, now I feel the time is right to confirm there is [one]."

In his defense, Sleaze noted, "I have never directly denied the existence of a master pass." He added that he never used the backdoor-within-a-backdoor to take over machines properly owned up by his users. He only included it for his own security.

If the FBI ever got too close to Sleaze he had intended to release the secret password to the world, causing Optix Pro to become less popular among intruders and easing the pressure from law enforcement. "That's when a master pass could potentially save a programmer," he wrote.

Merely writing a backdoor program is not illegal under US federal law, but arrests have been made in other countries, most recently Germany and Taiwan.

Rival hackware coder and self-described grey hat hacker "illwill," himself no stranger to security company threat profiles, says untrustworthy code has beset the underground for years: the popular SubSeven backdoor also included a secret password, he said, as does the more obscure Infector. "It's kind of a big deal to the kiddies," he wrote in an IM interview. "The authors see it as a way to control what they create, or let their 'krew' get in on the victims that other people get."

In a disclaimer evocative of advisories from more mainstream software vendors, Sleaze pointed out in his posting that the backdoor password in circulation only works on an older, unsupported versions of the Trojan horse, and that the latest version of Optix Pro uses stronger encryption to protect a different master password. "So make sure you update!," he wrote.

At least one security expert says there's a lesson to be learned from the whole affair. "It obviously says you should always use open-source Trojans," says Mark Loveless, a senior security analyst with Bindview Corporation. "That's the moral. You can't even trust Windows malware."

Rouge wireless AP's

So, when I hear the word "rouge" I always get wood. I mean how cool does that sound "We have detected a rouge AP on our perimeter". Reminds me of a Tom Clancy movie with Jack Ryan chasing the Russian sub skipper.

So, wireless is the new wave for businesses but companies are in such a hurry to deploy it that they rarely harden the AP's. In the end, a company will pay a price for this lack of foresight. Lowes had this problem and if their IT staff had not been proactively monitoring logs, they could have lost 2.5 million dollars in stolen credit card info. All this through an unsecured wireless AP that allowed the hacker to get access to the credit card db.

Enjoy

Wireless LANs will continue to be a major security headache for businesses over the next few years, despite the introduction of improved security standards. Inadequate policies and poor installation, rather than inherent security weaknesses, are the main problem.

The misconfiguration of WLAN access points and client software will account for 70 per cent of successful WLAN attacks in the next two years, according to Gartner. Updated security policies that address the particular demands of the mobile workplace must drive security for WLANs and personal digital assistants (PDAs), the analyst firm advises..

"Whether hackers are able to enter a company's WLAN through an unprotected AP (access point) or through a peer workstation, once they are associated with the network, they will be difficult to detect because they may not be visible in or near the network site," said John Pescatore, Gartner veep. "A clever hacker will play it safe and use the company's resources quietly, and as a result, may never be found."

Businesses must ensure there are no unauthorized (rogue) wireless access points on their network and that APs are configured securely. In dense environments, companies must ensure that their users don't connect to the networks of other companies or vice versa. The least expensive - and least effective - way of doing this is to buy a wireless sniffer handheld and walk the perimeter of the network. The most expensive - and most secure - is to install wireless intrusion detection sensors, according to Gartner

Internet Exploder does it again!

So, here is another reason why you should not use Internet Explorer and Outlook and why these applications suck. These vulnerabilities (I referee to IE and outlook) can help the potential hacker bypass many of the perimeter defenses that businesses spend so much money on.

Just another example why people should start looking at Linux.

Enjoy

Detailed information on a brace of unpatched vulnerabilities in Internet Explorer has been posted onto a dull disclosure mailing list. The flaws involve a cross-zone scripting vuln and a bug in IE's Local Resource Access and pose an "extremely critical" risk to Windows users, according to security firm Secunia. The vulnerabilities affect both Internet Explorer 6 and Outlook.

Secunia has confirmed the vulnerabilities in a fully patched system with Internet Explorer 6.0. Improved security features in the XP SP2 reportedly block exploitation but users would be ill advised to rely on beta code for protection. SP2 doesn't help users of earlier versions of Windows who are also at risk.

The vulnerabilities are actively being exploited in the wild to install adware on users' systems, security researchers warn. Other exploits - include computer viruses - based on the same techniques of tricking users into visiting a maliciously constructed website housing malign script could follow.

Etienne Greeff, director at MIS Corporate Defence Solutions, said: "This is a very sophisticated exploit using encryption and stealth technologies to deliver its payload, using previously unknown vulnerabilities to work."

Windows users should disable Active Scripting support for all but trusted websites until Microsoft releases patches to address the vulnerabilities. The vulnerabilities were publicised by a Dutch 'white hat hacker' called Jelmer, who came across an example of an exploit of the flaws already in circulation last weekend.

Wardriver gets busted, now looking for soap on a rope

In a rare wireless hacking conviction, a Michigan man entered a guilty plea last Friday in federal court in Charlotte, North Carolina for his role in a scheme to steal credit card numbers from the Lowe's chain of home improvement stores by taking advantage of an unsecured Wi-Fi network at a store in suburban Detroit.

Brian Salcedo, 21, faces an a unusually harsh 12 to 15 year prison term under federal sentencing guidelines, based largely on a stipulation that the potential losses in the scheme exceeded $2.5m. But Salcedo has agreed to cooperate with the government in the prosecution of one or more other suspects, making him eligible for a sentence below the guideline range.

One of Salcedo's two codefendants, 20-year-old Adam Botbyl, is scheduled to plead guilty Monday, assistant U.S. attorney Matthew Martins confirmed. Botbyl faces 41 to 51 months in prison, but also has a cooperation deal with the prosecutors, according to court filings. The remaining defendant, 23-year-old Paul Timmins, is scheduled for arraignment on 28 June.

In 2000, as a juvenile, Salcedo was one of the first to be charged under Michigan's state computer crime law, for allegedly hacking a local ISP.

According to statements provided by Timmins and Botbyl following their arrest, as recounted in an FBI affidavit filed in the case, the pair first stumbled across an unsecured wireless network at the Southfield, Michigan Lowe's last spring, while "driving around with laptop computers looking for wireless Internet connections," i.e., wardriving. The two said they did nothing malicious with the network at that time.

It was six months later that Botbyl and his friend Salcedo hatched a plan to use the network to steal credit card numbers from the hardware chain, according to the affidavit.

FBI Stakeout
The hackers used the wireless network to route through Lowe's corporate data center in North Carolina and connect to the local networks at stores in Kansas, North Carolina, Kentucky, South Dakota, Florida, and two stores in California. At two of the stores - in Long Beach, California and Gainseville, Florida - they modified a proprietary piece of software called "tcpcredit" that Lowe's uses to process credit card transactions, building in a virtual wiretap that would store customer's credit card numbers where the hackers could retrieve them later.

At some point, Lowe's network administrators and security personnel detected and began monitoring the intrusions, and called in the FBI. In November, a Bureau surveillance team staked out the Southfield Lowe's parking lot, and spotted a white Grand Prix with suspicious antennas and two young men sitting inside, one of them typing on a laptop from the passenger seat, according to court documents. The car was registered to Botbyl.

After 20 minutes, the pair quit for the night, and the FBI followed them to a Little Ceasar's pizza restaurant, then to a local multiplex. While the hackers took in a film, Lowe's network security team poured over log files and found the bugged program, which had collected only six credit card numbers.

FBI agents initially identified Timmins as Botbyl's as the passenger in the car, apparently mistakenly, and both men were arrested on 10 November. Under questioning, Botbyl and Timmins pointed the finger at Salcedo. Timmins had allegedly provided the two hackers with an 802.11b card, and had knowledge of what his associates were up to.

Botbyl and Timmins, known online as "noweb4u" and "itszer0" respectively, are part of the Michigan 2600 hacker scene - an informal collection of technology aficionados.

The Lowe's Wi-Fi system was installed to allow scanners and telephones to connect to the store's network without the burden of cables, according to the indictment.

CISA exam blues

So, I am studying for this certification exam and I must say that this is a rough process. I passed the CISSP exam last year and that process was very difficult to say the least, but this certification is a little bit different.

It deals with auditing Information Systems, which in of itself sounds cool. The thing is that there is alot more to auditing a network than launching VA tools like Nessus against targets and probing for system holes. Reviewing processes, standards, guidelines etc all go into the audit process. This means lots of paperwork. YUK! Not to mention any federal legislation that you have to follow like GLBA, SOX, SB1386 or HIPPA (my favorite).

So, while I am digging through these mounds of paperwork in an effort to understand more about auditing, I realize that I am lossing the feeling in the right side of my brain. No offense to the accountants of the world.

Anyway, this Saturday is the big day and I hope to go in the examination and SLAM dunk this test.

Wish me luck.

Tim