code security

Brocade brute forcer

During a pentest, I needed to test a Brocade SAN Switch. Since the Java webstart was quite slow, and I couldn’t find another script – I quickly coded this together to brute force passwords:

brocade_brute.rb

internet security

Install Burp CA certificate on Android Emulator

Android SecuritySome people ask me how they can “hijack” HTTPS API calls from an Android app. One of the best ways is to use PortSwiggers free Burp Suite, and hijack all traffic between your app and the server. One of the problems is, how do you add burp’s CA certificate to your android (emulator)? Burp’s help page simply says to look it up on google. Well, I hope this is one of the results showing up.

Note: This does not require any ADB pushes or so, and can be done in a few minutes. This was done under Ubuntu, using Android Emulator version 22.6.4. I’m uploading it into a Android 4.4.2 image running on a virtual Nexus 4.

Adding a CA certificate can be done in just a few steps, and will take a few minutes… read more »

misc

XKCD: hack the stars

This is pretty awesome, from the XKCD cartoons

misc

So true: code quality

codequality
From Lifehacker

security

Quis hackiet ipsos hackes?

acunetix Yesterday, Israeli security researched Danor Cohen reported that Acunetix’s web application security scanner has an exploitable vulnerability. Although the blog post is titled “Pwn the n00bs”, I’ve seen several origanizations use Acunetix to perform scans on (their own?) web applications.

Security bugs appear in all pieces of software; including security scanners and hacking tools. These tools often require to run as root (to perform privileged actions, such as putting a network interface into promiscious mode, etc). LiveUSB security distributions often run all commands as root and could pose a problem. Even though you are running a liveUSB environment, users often mount their HDD or external media to save files. Open source tools can often be fixed easily, but commercial software a la Acunetix usually relies on vendor update channels.

Be careful when running all software, even your security software/hacking tools can be vulnerable.

misc

HeartBleed: we’re sslcrewed

heartbleedThe year 2014 is only a hundred days old, and this is probably the security bug of the year. In case you haven’t heard it, and shame on you if you didnt. HeartBleed is an exploit on a OpenSSL’s TLS Heartbeat extensions. It goes well undetected, and nearly half a billion (yes, B) of websites are vulnerable. We’re not even talking about most other SSL services, embedded systems and so on. It allows an attacker to read chunks of memory (per 64 Kilobytes) which may contain SSL secret keys, passwords, messages, etc.

More technical information can be seen on heartbleed.com, and you can check your site using this site.

You can be sure that most blackhat parties, including several intelligence services have tried already to extract information from your SSL enabled websites. If not, you’ll see an increase in HTTPS connections this weekend. Patch your servers, chnge your certificates, change your passwords; all of them. If somebody was storing all your SSL data in the past, they will have a way to find the key to decrypt all of it now, it’s that bad.

Javascript security

the state of Mixed Mode

browsersecurity
When a browser grabs a webpage over HTTPS, *nobody* (aside from revelations that governments can see our SSL traffic) can see what’s happening between your browser and the target webserver.  You are protected against the prying eyes of an evil network admin, proxy admin or even government.

Modern websites often import JavaScripts files from multiple sources, to have extra functionality (Facebook’s like button, widgets) or entire frameworks such as JQuery or YUI.  If these JavaScript resources are loaded form a non-SSL location, we refer to this usually as Mixed Content mode.  I did some research to find out how browsers handle these things; both on desktops as well as mobiles.

Please run the tests on https://bloat.io/mm/, it looks *very* rudimentary, but I am gathering some information from different browsers.  Let the page load for a few seconds, and everything gets logged in a database.  As a “visual”, the more “warning icons” you see, the more vulnerable your browser is.

Don’t worry, it won’t try to exploit anything or crash.

misc

The closeness of software, and its dangers.

Craig of /dev/ttys0 has discovered an interesting backdoor in D-Link routers; by setting your user agent to a particular string it is possible to circumvent the admin authentication challenge.

While this is just one of the cases, who knows how many devices have been “backdoored” over the year, either by manufacturers; or by telecom operators (telco branded all-in-one access points). My advice to anyone, get your own device, or flash OpenWRT on it.

security

But the camera rocks

On my way home form a merely thought-inspiring movie, I passed by a few girls sharing a cigarette on your typical San Francisco cafe’s terrace. One of them was showing her (?) phone to the other, who told her friend “…but the camera rocks”.

It made me, continuing the movie’s aftermath realize how we’ve given up openness and privacy on our mobile devices, the modern equivalents of our dearest friends (who else do you check at night, early in the morning and take with you to the restroom?), for gimmicks such as cameras and polyphonic ringtones (ok, not anymore, but you get the idea).

Earlier I checked the website of Openmoko, whose goal was to “Free the phone”. Now it seems they have abolished these projects in favor of making a mobile wikipedia device, but I wish they or a similar body would take up the movement again.

We live in an ecosystem that has many “services” and closed systems; and we happily accept it. It’s ok to give up the freedom of tinkering with a mobile phone you just paid 500$ for, because it has cool apps the other platform doesn’t have, oh and of course, because “the camera rocks”.

I hope we start swaying towards openness again, and take back the right on our digital devices and lives, the same as we have with other, everyday, things. You buy a car, you’re allowed to open the hood and change pretty much everything about it, as long as it doesn’t affect it’s safety or the environment. You spend money on clothes but want to rip off the sleeves, nobody stops you. Let’s keep that in mind, and hold on to that. A device that his so dear to us should be transparent;. And I’m sure its camera would not be so bad either.

misc

How the semantic web should come back, and is.

The web has come a big way. Sir Tim Berners-Lee’s invention that changd the world has undergone a large metamorphosis in the way how it provides millions – and now billions – of human beings information, communication and entertainment.

Sites in the 90sEarly websites had a fair amount of content, but it was surrounded by flashing marquee’s, background MIDI sounds and non stop, animating gifs. That all paired with flashy color schemes and a Times New Roman fontface.

Fast forward a few years, and the world allowed a small company called Macromedia (later acquired by Adobe) to install a small plugin called “Flash” onto our computers which opened up a whole new dimension into web interactions. Many websites incorporated large amounts of “Flash” into their pages, or became a flash only website.

With the arrival of the iPhone and iPad, Flash has been pushed into a corner. The late Steve Jobs expressed that Flash was an inefficient way to make content look beautiful on battery powered devices, and the demise of flash has slowly begun.

Fast forward another few years, and we’re at the level of “content driven” websites. Websites are simpler than ever and the overall theme is becoming minimalistic. Since the majority of website have similar layouts, HTML5 included a few extra tags (<header>, <aside>, …) to ensure consistency throughout pages.

“Modern” CSS frameworks such as Twitter Bootstrap, Foundation or Base, go a few steps further; by streamlining naming conventions in CSS classes, we have similar “classes” that make links look like buttons, and navigation bars to stay on top of the screen when we scroll down and the like.

webskeletonBut is there a way to bring this to HTML5.1? Seeing that the majority (yes, there are always exceptions) have a navigation bar on top, fixed or not, a menu on the left or right and content on the other side, we should have a few extra tags there.

This could easily be fixed with a:

  <html>
  <head>...</head>
  <body>
    <header>
      <navbar fixed="true">
        <logo src="logo.gif" />
        <navitem href="/about">About Us</navitem>
        <navitem href="/services">Services</navitem>
        <navitem href="/content">Contact</navitem>
      </navbar>
    </header>
    <content>
      .. content goes here ..
    </content>
    <aside>
      <menu>
        <menuitem href="/profile">Your Profile</menuitem>
        <menuitem href="/favorites">Favorites</menuitem>
        <menuitem href="/cart">Cart</menuitem>
      </menu>
    </aside>
  </body>
</html>

In order to bring this in a correct way, let these HTML tags dictate what they are, yet let a user decide whether he or she has any preferences:

  • Do you want the top bar to be sticky?
  • Do you want the menu no top, left or right?
  • Do you like big butt(-and cannot lie?)-ons or a more “professional” look?

I’m not saying we should totally discard CSS and its visual capabilities, but I think we spend too much time coding and consuming styles that don’t really make a difference. Users of the Links browser, the few that remain, probably have the last laugh; although I’m sure they’re missing their frame sets.