MS15-034 online checking tool

lockA friend and colleague of mine, Bhadresh, made a quick page to check whether your IIS site is vulnerable to the MS15-034 (CVE-2015-1635), the HTTP.sys remote code execution vulnerability. Check now, and make sure you don’t fall into the hands of blackhats.

You can test it at: http://sys.flurk.org/ms15-034/


The need for emergency access codes

dauod“I have nothing to hide.” is one of the more recent empty responses when conversing about privacy. We’re not all criminals, but we all have something to hide.

Whether it’s a snoopy spouse, an unfair employer or a threatening government cellphones are now -more than ever- secure from physical access. Having a pin code on your old nokia phone little over a decade ago labeled you as “paranoid”. Since smartphones are the equivalent of our parallel lives, they have more access to our information and thus are a much more sought after target to untangle ones “secrets”.

Recently, Time magazine published an article how iPhone’s fingerprint reader does not protect you against the 5th amendment, the protection against self incrimination. Key codes, luckily, do.

This would bare the question to allow multiple keycodes; one to unlock your data. One to censor it, and optionally to remove it. Say you have a smarthphone, and it’s code is 1111. You use it every day to access your contacts, emails and other data. You should be able to set up a 2nd passcode, say 1234 that would purge a certain set of data. In a riot, if the police asks for you to unlock your phone, you type 1234, and it shows a clean phone, filters out some of the questionable text and phone records you have.

code security

Brocade brute forcer

During a pentest, I needed to test a Brocade SAN Switch. Since the Java webstart was quite slow, and I couldn’t find another script – I quickly coded this together to brute force passwords:


internet security

Install Burp CA certificate on Android Emulator

Android SecuritySome people ask me how they can “hijack” HTTPS API calls from an Android app. One of the best ways is to use PortSwiggers free Burp Suite, and hijack all traffic between your app and the server. One of the problems is, how do you add burp’s CA certificate to your android (emulator)? Burp’s help page simply says to look it up on google. Well, I hope this is one of the results showing up.

Note: This does not require any ADB pushes or so, and can be done in a few minutes. This was done under Ubuntu, using Android Emulator version 22.6.4. I’m uploading it into a Android 4.4.2 image running on a virtual Nexus 4.

Adding a CA certificate can be done in just a few steps, and will take a few minutes… read more »


XKCD: hack the stars

This is pretty awesome, from the XKCD cartoons


So true: code quality

From Lifehacker


Quis hackiet ipsos hackes?

acunetix Yesterday, Israeli security researched Danor Cohen reported that Acunetix’s web application security scanner has an exploitable vulnerability. Although the blog post is titled “Pwn the n00bs”, I’ve seen several origanizations use Acunetix to perform scans on (their own?) web applications.

Security bugs appear in all pieces of software; including security scanners and hacking tools. These tools often require to run as root (to perform privileged actions, such as putting a network interface into promiscious mode, etc). LiveUSB security distributions often run all commands as root and could pose a problem. Even though you are running a liveUSB environment, users often mount their HDD or external media to save files. Open source tools can often be fixed easily, but commercial software a la Acunetix usually relies on vendor update channels.

Be careful when running all software, even your security software/hacking tools can be vulnerable.


HeartBleed: we’re sslcrewed

heartbleedThe year 2014 is only a hundred days old, and this is probably the security bug of the year. In case you haven’t heard it, and shame on you if you didnt. HeartBleed is an exploit on a OpenSSL’s TLS Heartbeat extensions. It goes well undetected, and nearly half a billion (yes, B) of websites are vulnerable. We’re not even talking about most other SSL services, embedded systems and so on. It allows an attacker to read chunks of memory (per 64 Kilobytes) which may contain SSL secret keys, passwords, messages, etc.

More technical information can be seen on heartbleed.com, and you can check your site using this site.

You can be sure that most blackhat parties, including several intelligence services have tried already to extract information from your SSL enabled websites. If not, you’ll see an increase in HTTPS connections this weekend. Patch your servers, chnge your certificates, change your passwords; all of them. If somebody was storing all your SSL data in the past, they will have a way to find the key to decrypt all of it now, it’s that bad.

Javascript security

the state of Mixed Mode

When a browser grabs a webpage over HTTPS, *nobody* (aside from revelations that governments can see our SSL traffic) can see what’s happening between your browser and the target webserver.  You are protected against the prying eyes of an evil network admin, proxy admin or even government.

Modern websites often import JavaScripts files from multiple sources, to have extra functionality (Facebook’s like button, widgets) or entire frameworks such as JQuery or YUI.  If these JavaScript resources are loaded form a non-SSL location, we refer to this usually as Mixed Content mode.  I did some research to find out how browsers handle these things; both on desktops as well as mobiles.

Please run the tests on https://bloat.io/mm/, it looks *very* rudimentary, but I am gathering some information from different browsers.  Let the page load for a few seconds, and everything gets logged in a database.  As a “visual”, the more “warning icons” you see, the more vulnerable your browser is.

Don’t worry, it won’t try to exploit anything or crash.


The closeness of software, and its dangers.

Craig of /dev/ttys0 has discovered an interesting backdoor in D-Link routers; by setting your user agent to a particular string it is possible to circumvent the admin authentication challenge.

While this is just one of the cases, who knows how many devices have been “backdoored” over the year, either by manufacturers; or by telecom operators (telco branded all-in-one access points). My advice to anyone, get your own device, or flash OpenWRT on it.