A ring of Indonesian hackers on Monday claimed to have attacked a list of more than 120 Web sites as retribution for Malaysia’s alleged theft of Indonesian cultural items and abuse of migrant workers.
A statement was posted on a Blogspot blog titled "Terselubung" saying that a number of Malaysian Web sites had been hacked and defaced to “celebrate” Malaysia’s Independence Day, which fell on Monday August 31.
“Today, August 31, 2009, an uncreative country, a country who likes to steal Indonesian culture, a country whose citizen is the mastermind of bombings in Indonesia, a country who has tortured many of our sisters — the migrant workers who worked there, a country who abused our national anthem, a country who harassed Indonesia on the Internet, a country that has stolen Sipadan and Ligitan islands, a country which has trespassed our water illegally, a country which received their independence from Britain, is celebrating its anniversary,” the Web site stated.
From HITB website
If you want to see original article from Terselubung blog is here:
http://terselubung.blogspot.com/2009/08/perang-online-dengan-malaysia-di-mulai.html
Monday, August 31, 2009
Friday, August 28, 2009
DNSenum
DNSenum is a pentesting cool created to enumerate DNS info about domains.
The purpose of Dnsenum is to gather as much information as possible about a domain. The program currently performs the following operations:
1) Get the host's addresse (A record).
2) Get the namservers (threaded).
3) Get the MX record (threaded).
4) Perform axfr queries on nameservers (threaded).
5) Get extra names and subdomains via google scraping (google query = "allinurl: -www site:domain").
6) Brute force subdomains from file, can also perform recursion on subdomain that have NS records (all threaded).
7) Calculate C class domain network ranges and perform whois queries on them (threaded).
8) Perform reverse lookups on netranges ( C class or/and whois netranges) (threaded).
9) Write to domain_ips.txt file ip-blocks.
The purpose of Dnsenum is to gather as much information as possible about a domain. The program currently performs the following operations:
1) Get the host's addresse (A record).
2) Get the namservers (threaded).
3) Get the MX record (threaded).
4) Perform axfr queries on nameservers (threaded).
5) Get extra names and subdomains via google scraping (google query = "allinurl: -www site:domain").
6) Brute force subdomains from file, can also perform recursion on subdomain that have NS records (all threaded).
7) Calculate C class domain network ranges and perform whois queries on them (threaded).
8) Perform reverse lookups on netranges ( C class or/and whois netranges) (threaded).
9) Write to domain_ips.txt file ip-blocks.
Thursday, August 27, 2009
Hacking Exposed:Network Security Secrets and Solutions
I'm still reading this Hacking Exposed 6th Edition book. I hope i will finish this week.
Hacking Exposed established this entire genre of books. Now in its 6th (and 10th anniversary) edition, and having sold millions of copies throughout the world, the book remains the #1 best-selling computer security book in the world and it is still just as useful and valuable as it ever was. Kurtz, McClure, and Scambray have once again update this highly resected title to include the latest and greatest in attacks and exploits, as well as the cutting edge countermeasures and security controls you can implement to protect your PC or your network.
New and updated material:
-New chapter on hacking hardware, including lock bumping, access card cloning, RFID hacks, USB U3 exploits, and Bluetooth device hijacking
-Updated Windows attacks and countermeasures, including new Vista and Server 2008 vulnerabilities and Metasploit exploits
-The latest UNIX Trojan and rootkit techniques and dangling pointer and input validation exploits
-New wireless and RFID security tools, including multilayered encryption and gateways
-All-new tracerouting and eavesdropping techniques used to target network hardware and Cisco devices
-Updated DoS, man-in-the-middle, DNS poisoning, and buffer overflow coverage
-VPN and VoIP exploits, including Google and TFTP tricks, SIP flooding, and IPsec hacking
-Fully updated chapters on hacking the Internet user, web hacking, and securing code
Table of contents
Part I: Casing the Establishment
Chapter 1. Footprinting
Chapter 2. Scanning
Chapter 3. Enumeration
Part II: System Hacking
Chapter 4. Hacking Windows
Chapter 5. Hacking Unix
Part III: Infrastructure Hacking
Chapter 6. Remote Connectivityand VoIP Hacking
Chapter 7. Network Devices
Chapter 8. Wireless Hacking
Chapter 9. Hacking Hardware
Part IV: Application and Data Hacking
Chapter 10. Hacking Code
Chapter 11. Web Hacking
Chapter 12. Hacking the Internet User
Part V: Appendixes
Appendix A. Ports
Appendix B. Top 14 Security Vulnerabilities
Appendix C. Denial of Service (DoS) and Distributed Denial of Service (DDoS) Attacks
Index
Hacking Exposed established this entire genre of books. Now in its 6th (and 10th anniversary) edition, and having sold millions of copies throughout the world, the book remains the #1 best-selling computer security book in the world and it is still just as useful and valuable as it ever was. Kurtz, McClure, and Scambray have once again update this highly resected title to include the latest and greatest in attacks and exploits, as well as the cutting edge countermeasures and security controls you can implement to protect your PC or your network.
New and updated material:
-New chapter on hacking hardware, including lock bumping, access card cloning, RFID hacks, USB U3 exploits, and Bluetooth device hijacking
-Updated Windows attacks and countermeasures, including new Vista and Server 2008 vulnerabilities and Metasploit exploits
-The latest UNIX Trojan and rootkit techniques and dangling pointer and input validation exploits
-New wireless and RFID security tools, including multilayered encryption and gateways
-All-new tracerouting and eavesdropping techniques used to target network hardware and Cisco devices
-Updated DoS, man-in-the-middle, DNS poisoning, and buffer overflow coverage
-VPN and VoIP exploits, including Google and TFTP tricks, SIP flooding, and IPsec hacking
-Fully updated chapters on hacking the Internet user, web hacking, and securing code
Table of contents
Part I: Casing the Establishment
Chapter 1. Footprinting
Chapter 2. Scanning
Chapter 3. Enumeration
Part II: System Hacking
Chapter 4. Hacking Windows
Chapter 5. Hacking Unix
Part III: Infrastructure Hacking
Chapter 6. Remote Connectivityand VoIP Hacking
Chapter 7. Network Devices
Chapter 8. Wireless Hacking
Chapter 9. Hacking Hardware
Part IV: Application and Data Hacking
Chapter 10. Hacking Code
Chapter 11. Web Hacking
Chapter 12. Hacking the Internet User
Part V: Appendixes
Appendix A. Ports
Appendix B. Top 14 Security Vulnerabilities
Appendix C. Denial of Service (DoS) and Distributed Denial of Service (DDoS) Attacks
Index
Auto SQL injection co-opts thousands of sites
An automated attack using SQL injection has compromised tens of thousands of Web pages with code that tries to upload a data-stealing Trojan horse program to visitors' computers, security firm ScanSafe said last week.
The attack, which had inserted iframe scripts into as many as 130,000 Web pages as of Tuesday, uses the compromised pages to attempt to infect visitors with a backdoor Trojan horse that includes keylogging and download functionality, Mary Landesman, senior security researcher for ScanSafe, said in an e-mail interview on Tuesday. The initial Web site compromises appear to have been accomplished through an automated database injection attack, which matches with a trend seen by Landesman and others.
"SQL injection attacks are the most commonly observed compromise vector," Landesman stated. "Web attacks have been growing at the rate of 1 percent per day over the past year, with over half of all observed attacks the result of SQL injection."
Web attacks using SQL injection have become a lot more popular in recent years. Last week, a federal indictment of an alleged data thief stated that all five corporate victims -- including Heartland Payment Systems and Hannaford Bros. -- had initially been compromised through an SQL injection attack. In 2008, about 20 percent of the 5,600 vulnerabilities entered into the National Vulnerability Database were related to SQL injection, according to the service's statistics page.
In the latest spate of attacks, the Trojan horse programs downloaded to compromised computers are poorly recognized by most security software, Landesman said.
"Signature detection ranges, with a high of roughly 50 percent of signature vendors detecting some of the malware and a low of less than 10 percent," she said. "The attackers are continually swapping domains, using multiple exploits, and swapping out the eventual malware binaries to ensure low detection rates from signature-based technologies."
This article from Securityfocus.com
The attack, which had inserted iframe scripts into as many as 130,000 Web pages as of Tuesday, uses the compromised pages to attempt to infect visitors with a backdoor Trojan horse that includes keylogging and download functionality, Mary Landesman, senior security researcher for ScanSafe, said in an e-mail interview on Tuesday. The initial Web site compromises appear to have been accomplished through an automated database injection attack, which matches with a trend seen by Landesman and others.
"SQL injection attacks are the most commonly observed compromise vector," Landesman stated. "Web attacks have been growing at the rate of 1 percent per day over the past year, with over half of all observed attacks the result of SQL injection."
Web attacks using SQL injection have become a lot more popular in recent years. Last week, a federal indictment of an alleged data thief stated that all five corporate victims -- including Heartland Payment Systems and Hannaford Bros. -- had initially been compromised through an SQL injection attack. In 2008, about 20 percent of the 5,600 vulnerabilities entered into the National Vulnerability Database were related to SQL injection, according to the service's statistics page.
In the latest spate of attacks, the Trojan horse programs downloaded to compromised computers are poorly recognized by most security software, Landesman said.
"Signature detection ranges, with a high of roughly 50 percent of signature vendors detecting some of the malware and a low of less than 10 percent," she said. "The attackers are continually swapping domains, using multiple exploits, and swapping out the eventual malware binaries to ensure low detection rates from signature-based technologies."
This article from Securityfocus.com
Friday, July 31, 2009
New security site ... http://triviasecurity.net
http://triviasecurity.net
My friends and I will launch this Trivia Security site next week...I hope you all can participate in this forum ....
http://triviasecurity.net
About Trivia Security:
Trivia Security was born in early 2003 with one goal to make it easier for the whole world and have everything under one site instead of spending hours searching. It was started by FreakXL as DerekDan joined the development process of Trivia Security at Lycos servers and as the development was near to finish in May of 2003 Trivia was moved to new server and a domain `triviasecurity.com` by DerekDan and now `triviasecurity.net`. aMado joined the Trivia Team and has contributed allot in the finishing stages. Without aMado Trivia Security wont be where it is right now.
My friends and I will launch this Trivia Security site next week...I hope you all can participate in this forum ....
http://triviasecurity.net
About Trivia Security:
Trivia Security was born in early 2003 with one goal to make it easier for the whole world and have everything under one site instead of spending hours searching. It was started by FreakXL as DerekDan joined the development process of Trivia Security at Lycos servers and as the development was near to finish in May of 2003 Trivia was moved to new server and a domain `triviasecurity.com` by DerekDan and now `triviasecurity.net`. aMado joined the Trivia Team and has contributed allot in the finishing stages. Without aMado Trivia Security wont be where it is right now.
Monday, July 27, 2009
Fuzzgrind
Fuzzgrind is a fully automatic fuzzing tool, generating test files with the purpose of discovering new execution paths likely to trigger bugs and potentially vulnerabilities.
It is based on the concept of symbolic execution. Thus, the tool starts from a file considered valid by the software under test, and analyses the execution path to extract any constraints tied to branch instructions followed by this software. By resolving constraints one by one, Fuzzgrind will alter the valid file to explore possible new branches of the software under test, in order to discover new vulnerabilities.
Fuzzgrind is licensed under the terms of the GNU GPL. Anybody is welcome to contribute!
It is based on the concept of symbolic execution. Thus, the tool starts from a file considered valid by the software under test, and analyses the execution path to extract any constraints tied to branch instructions followed by this software. By resolving constraints one by one, Fuzzgrind will alter the valid file to explore possible new branches of the software under test, in order to discover new vulnerabilities.
Fuzzgrind is licensed under the terms of the GNU GPL. Anybody is welcome to contribute!
Tuesday, March 24, 2009
FastTrack- Easier Penetration Testing Tool
Every IT professional,security engineer, security analyst and penetration tester are always looking for easier ways to perform penetration tests. I found this Fast-Track tool.
What is Fast-Track?
"Fast-Track is a python based open-source project aimed at helping Penetration Testers in an effort to identify, exploit, and further penetrate a network. Fast-Track was originally conceived when I was on a penetration test and found that there was generally a lack of tools or automation in certain attacks that were normally extremely advanced and time consuming. In an effort to reproduce some of my advanced attacks and propagate it down to my team at SecureState, I ended up writing Fast-Track for the public. Many of the issues Fast-Track exploits are due to improper sanitizing of client-side data within web applications, patch management, or lack of hardening techniques. All of these are relatively simple to fix if you know what to look for, but as penetration testers are extremely common findings for us. Fast-Track arms the penetration tester with advanced attacks that in most cases have never been performed before. Sit back relax, crank open a can of jolt cola and enjoy the ride. "
I tried one of the powerful tool in Fast-Track, The SQLPwnage.
"This tool scans subnets looking for web servers. After found, it automatically starts to crawl the site looking or post parameters. Once a list of post parameters have been identified, Fast-Track will either try blind SQL injection or error based SQL injection and attempt to automatically exploit the system for you. If successful, whatever payload you specified will be delivered to you, this could be meterpreter, reverse shell, bind shell, reverse vnc, and much more. SQLPwnage will automatically re-enable xp cmdshell if disabled, try to elevate permissions, and use the hex to binary bypass explained in the SQL bruter section to deliver our payloads."
You can see this Video how to use SQLPwnage.
What is Fast-Track?
"Fast-Track is a python based open-source project aimed at helping Penetration Testers in an effort to identify, exploit, and further penetrate a network. Fast-Track was originally conceived when I was on a penetration test and found that there was generally a lack of tools or automation in certain attacks that were normally extremely advanced and time consuming. In an effort to reproduce some of my advanced attacks and propagate it down to my team at SecureState, I ended up writing Fast-Track for the public. Many of the issues Fast-Track exploits are due to improper sanitizing of client-side data within web applications, patch management, or lack of hardening techniques. All of these are relatively simple to fix if you know what to look for, but as penetration testers are extremely common findings for us. Fast-Track arms the penetration tester with advanced attacks that in most cases have never been performed before. Sit back relax, crank open a can of jolt cola and enjoy the ride. "
I tried one of the powerful tool in Fast-Track, The SQLPwnage.
"This tool scans subnets looking for web servers. After found, it automatically starts to crawl the site looking or post parameters. Once a list of post parameters have been identified, Fast-Track will either try blind SQL injection or error based SQL injection and attempt to automatically exploit the system for you. If successful, whatever payload you specified will be delivered to you, this could be meterpreter, reverse shell, bind shell, reverse vnc, and much more. SQLPwnage will automatically re-enable xp cmdshell if disabled, try to elevate permissions, and use the hex to binary bypass explained in the SQL bruter section to deliver our payloads."
You can see this Video how to use SQLPwnage.
Metasploit 3.2
The Metasploit Framework is a development platform for creating security tools and exploits. It's used by network security professionals to perform penetration tests, system administrators to verify patch installations, product vendors to perform regression testing, and security researchers world-wide.
Compare to Metasploit 3.0, in Metasploit 3.2, getting attack code onto a target machine will also be easier on Metasploit 3.2 with improvements to the Raw Packet Tools function. A new library call PacketFu is expected by Moore to achieve packet injection for both wired and wireless end points.It also provides improved support for exploiting multi-core CPU machines, which had been more difficult to attack with previous versions of Metasploit.
Metasploit is also able to take exploit code and weaponize it in an .EXE (executable file) that can be deployed by an attacker. Moore said the EXE template that created EXE attacks has been improved in Metasploit 3.2 in order to defeat AntiVirus vendor signature detection.
If you never try metasploit, you can download it here.
Compare to Metasploit 3.0, in Metasploit 3.2, getting attack code onto a target machine will also be easier on Metasploit 3.2 with improvements to the Raw Packet Tools function. A new library call PacketFu is expected by Moore to achieve packet injection for both wired and wireless end points.It also provides improved support for exploiting multi-core CPU machines, which had been more difficult to attack with previous versions of Metasploit.
Metasploit is also able to take exploit code and weaponize it in an .EXE (executable file) that can be deployed by an attacker. Moore said the EXE template that created EXE attacks has been improved in Metasploit 3.2 in order to defeat AntiVirus vendor signature detection.
If you never try metasploit, you can download it here.
Saturday, February 28, 2009
SecurixNSM 1.3
Securix-NSM is the successor of Knoppix-NSM. It's an extension of our NSMnow technology which has been integrated with the universal Debian foundation with a range of other tools to work from. Like it's predecessor Securix-NSM is dedicated to providing a framework for individuals wanting to learn about Network Security Monitoring (NSM) or who want to quickly and reliably deploy a NSM capability in their network.
Securix-NSM is now based on Debian Live, which means that you can test all the tools in a live Debian session running on the CD without the need for a HardDisk Drive (HDD) installation.
You can download ISO here.
Monday, February 16, 2009
Enjoy your Facebook!!!
Alright so here’s how to get into anyone’s tagged photos even if they are private for you.
The only restriction is that they have to actually have tagged photos, either tagged by others or tagged by themselves. You can only see the last 20 tagged photos by others and 20 tagged photos of themselves before an error pops up.
If you want to see the steps, here .
Saturday, February 07, 2009
Howto: Installing Squid Proxy in pfSense
This summary is not available. Please
click here to view the post.
Thursday, January 22, 2009
Time and Attack Mapper (TA-Mapper)
Time and Attack Mapper (alternatively known as TA-Mapper) is an effort estimator tool for blackbox security assessment (or Penetration Testing) of applications. This tool provides more accurate estimation when compared to rough estimation. Penetration testers who always has hard time explaining/justifying the efforts charged (or quoted) to their customers can find this tool handy by able to calculate efforts with greater accuracy required for application penetration testing. In addition, this tool helps application pen-testers in itemizing their penetration testing efforts into micro-level and provides more clarity of their pen-testing activities. In future I have plans to extend this tool ability to generate test cases.
More information, go to http://www.hackerscenter.com/
Wednesday, January 21, 2009
NSMnow 1.3
NSMnow is all about building an Network Security Monitoring (NSM) framework . It's very fast and easy without the messy patching and configuration of each tool needed to get the system up and running. It is build a sguil system with the minimum amount of fuss so you can actually focus on using sguil instead of building it.
More details, see this site: http://www.securixlive.com/
If you want to download: here
More details, see this site: http://www.securixlive.com/
If you want to download: here
Monday, October 27, 2008
Hex 2.0 Release!!
HeX is a project aimed at the NSM (Network Security Monitoring) community for use by network security analysts. The developers believe that simplicity and analysis work flow logic must be enhanced and emphasized through-out the process of designing this liveCD. Not only have they carefully chosen all the necessary applications and tools to be included to the liveCD, they have also tested them to make sure everything running as smooth as possible. In order to summarize the objective of HeX, they are trying to develop the first and foremost Network Security Monitoring & Network Based Forensics liveCD!
You can find information about Hex 2.0 here:
http://www.rawpacket.org/projects/hex/hex-livecd/version-20-release
You can find information about Hex 2.0 here:
http://www.rawpacket.org/projects/hex/hex-livecd/version-20-release
Friday, September 05, 2008
HITBSecConf2008 Kuala Lumpur, Malaysia
Event Details:
Venue: The Crowne Plaza Mutiara Kuala Lumpur
Date : 27-30 October 2008
For more details about this event, please visit:
Howto Setup Syslog Server in Ubuntu using Apache2
I will show you how to setup Syslog Server using Apache2 in Ubuntu Linux.
Make sure you set a static IP address in Ubuntu. Edit this file:
#vi /etc/network/interfaces
This is your network configuration file(/etc/network/interfaces):
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
iface eth0 inet static
address 192.168.1.10
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
gateway 192.168.1.1
After that, you need to prepare your Syslog Server:
#mkdir /logs
#vi /etc/syslog.conf
I logged everythings under folder/logs/logger.log. This is my syslog.conf file:
*.* /logs/logger.log
If you like to log everything from auth, cron, lpr error and only syslogs warnings then you have to add next lines to /etc/syslog.conf.
auth.* /logs/logger.log
cron.* /logs/logger.log
kern.* /logs/logger.log
lpr.3 /logs/logger.log
syslog.4 /logs/logger.log
Edit ksyslogd file (/etc/init.d/ksyslogd)
#vi /etc/init.d/ksyslogd
You need to change this line SYSLOGD=”” to SYSLOGD=”-r -m0”
Restart your network:
#/etc/init.d/networking restart
After that, install Apache2
#apt-get install apache2 php5 libapache2-mod-php5 mysql-server mysql-client php5-mysql
Check your hostname (/etc/hostname) and make sure you have to put your local IP address in /etc/hosts. This is my /etc/hosts file:
127.0.0.1 localhost squid.cybersp.com
127.0.1.1 ubuntu
192.168.1.10 squid squid.cybersp.com
192.168.1.11 squid squid.cybersp.com
Modify your /etc/apache2/ports.conf and i decided to host on port 8080.
And go to apache2 site-available directory:
#cd /etc/apache2/sites-available
#touch squid.cybersp.com
Now edit squid.cybersp.com file
#vi /etc/apache2/sites-available/squid.cybersp.com
and make sure it looks like this:
ServerAdmin izhar@cybersp.com
ServerAlias squid.cybersp.com
DirectoryIndex index.php
DocumentRoot /logs
#touch index.php
#vi index.php
Make sure you set a static IP address in Ubuntu. Edit this file:
#vi /etc/network/interfaces
This is your network configuration file(/etc/network/interfaces):
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
iface eth0 inet static
address 192.168.1.10
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
gateway 192.168.1.1
After that, you need to prepare your Syslog Server:
#mkdir /logs
#vi /etc/syslog.conf
I logged everythings under folder/logs/logger.log. This is my syslog.conf file:
*.* /logs/logger.log
If you like to log everything from auth, cron, lpr error and only syslogs warnings then you have to add next lines to /etc/syslog.conf.
auth.* /logs/logger.log
cron.* /logs/logger.log
kern.* /logs/logger.log
lpr.3 /logs/logger.log
syslog.4 /logs/logger.log
Edit ksyslogd file (/etc/init.d/ksyslogd)
#vi /etc/init.d/ksyslogd
You need to change this line SYSLOGD=”” to SYSLOGD=”-r -m0”
Restart your network:
#/etc/init.d/networking restart
After that, install Apache2
#apt-get install apache2 php5 libapache2-mod-php5 mysql-server mysql-client php5-mysql
Check your hostname (/etc/hostname) and make sure you have to put your local IP address in /etc/hosts. This is my /etc/hosts file:
127.0.0.1 localhost squid.cybersp.com
127.0.1.1 ubuntu
192.168.1.10 squid squid.cybersp.com
192.168.1.11 squid squid.cybersp.com
Modify your /etc/apache2/ports.conf and i decided to host on port 8080.
And go to apache2 site-available directory:
#cd /etc/apache2/sites-available
#touch squid.cybersp.com
Now edit squid.cybersp.com file
#vi /etc/apache2/sites-available/squid.cybersp.com
and make sure it looks like this:
ServerAdmin izhar@cybersp.com
ServerAlias squid.cybersp.com
DirectoryIndex index.php
DocumentRoot /logs
Ok, now go to sites-enabled directory:
#cd /etc/apache2/sites-enabled
#ln -s /etc/apache2/sites-available/squid.cybersp.com squid.cybersp.com
Go to /logs directory and create an index.php file:
#cd /logs#touch index.php
#vi index.php
This is my index.php under /logs directory:
Now, restart your Apache:
#/etc/init.d/apache2 force-reload
Try to visit your Browser:
http://192.168.1.10:8080
Now, you have a Syslog Server. TRY IT!!!
Wednesday, April 25, 2007
Compromising Windows Vista Security using Vboot Kit
Vbootkit is a bootkit that is able to load from Windows Vista boot-sectors. Vbootkit is developed by Nitin Kumar and Vipin Kumar, security consultant from NV Labs. It is one of Window's Vista bootkit that is used to hijack Vista's booting process right from the beginning. Vbootkit testing was performed on Windows Vista RC1(build 5600) & Windows Vista RC2(build 5744).
If you want to get the vbootkit white-paper and presentation slides, you can visit here:
http://www.nvlabs.in/?q=node/27
If you want to get the vbootkit white-paper and presentation slides, you can visit here:
http://www.nvlabs.in/?q=node/27
Tuesday, April 24, 2007
U.S. Army team wants second chance at Hack In The Box (HITB) Kuala Lumpur???
A team of U.S. Army hackers will attend the Hack In The Box (HITB) Security Conference 2007 in Kuala Lumpur later this year, seeking redemption after falling short at a hacker competition in Dubai earlier this month.
http://www.networkworld.com/news/2007/042407-us-army-team-wants-second.html
I want to see them this year in KL.....
http://www.networkworld.com/news/2007/042407-us-army-team-wants-second.html
I want to see them this year in KL.....
Saturday, April 21, 2007
Port 443
SANS inform that there is a significant increase in port 443 scans. They said if you see attacks against https servers, please let them know. If you see something like that, I think you can send your web server logs/IDS logs/Firewall logs to them to confirm whether there is an attack or not.
http://isc.sans.org/diary.html?storyid=2673
Last year, I got the same problems at my client site. One of my team reported to my Security Consultant that she detected series of Attack Response alerts from our Snort IDS. This alert involves 443 port (https). So we analyzed that alert and checked the source IP because the 443 service comes from that source IP. After analyzing that alert, we confirmed that there is no SSL/https related services available on the source IP. It looks like a normal website. There is no https service available on that IP. If there is https service, it should be encrypted. We want to analyze details and make decision about that alert, but we didn't have more resources. Maybe attacker was compromised earlier and installed backdoor/trojan/malware at that IP and used it to communicate through 443 port? Or maybe misconfiguration?? See this link:
http://blog.hazrulnz.net/121/finally-2.html
From my experience, this question is not easy to answer if you only have Snort alerts. It will make this question too difficult to answer. Looking at the alerts, there is nothing else we can do. You cannot give right answer to this question.
That's why I like to use Sguil. Sguil is an open source suite for performing NSM (Network Security Monitoring). NSM equips security staff to deal with the inevitable consequences of too few resources and too many responsibilities. NSM collects the data needed to generate better assessment, detection, and response processes, resulting in decreased impact from unauthorized activities.
http://isc.sans.org/diary.html?storyid=2673
Last year, I got the same problems at my client site. One of my team reported to my Security Consultant that she detected series of Attack Response alerts from our Snort IDS. This alert involves 443 port (https). So we analyzed that alert and checked the source IP because the 443 service comes from that source IP. After analyzing that alert, we confirmed that there is no SSL/https related services available on the source IP. It looks like a normal website. There is no https service available on that IP. If there is https service, it should be encrypted. We want to analyze details and make decision about that alert, but we didn't have more resources. Maybe attacker was compromised earlier and installed backdoor/trojan/malware at that IP and used it to communicate through 443 port? Or maybe misconfiguration?? See this link:
http://blog.hazrulnz.net/121/finally-2.html
From my experience, this question is not easy to answer if you only have Snort alerts. It will make this question too difficult to answer. Looking at the alerts, there is nothing else we can do. You cannot give right answer to this question.
That's why I like to use Sguil. Sguil is an open source suite for performing NSM (Network Security Monitoring). NSM equips security staff to deal with the inevitable consequences of too few resources and too many responsibilities. NSM collects the data needed to generate better assessment, detection, and response processes, resulting in decreased impact from unauthorized activities.
Tuesday, April 03, 2007
Exploiting Microsoft ANI Vulnerability in 10 minutes
Trirat Puttaraksa posted about Microsoft ANI vulnerability and how to exploit it in 10 minutes. He started to write this exploit after doing a lot of researches about Exploiting the ANI vulnerability on Vista , Windows Animated Cursor Stack Overflow Vulnerability and Analysis of ANI “anih” Header Stack Overflow Vulnerability.
http://sf-freedom.blogspot.com/2007/04/ani-again-exploiting-microsoft-ani.html
http://sf-freedom.blogspot.com/2007/04/ani-again-exploiting-microsoft-ani.html
Subscribe to:
Posts (Atom)
Posts
