Pcmca is software that will attempt to automatically write an exploit for memory corruption bugs in software. Can greatly save time in reverse engineering.
The code is available at:
https://github.com/toucan-system/pmcma
while the main site is simply http://www.pmcma.org
It was presented at the blackhat conference in Vegas this year. Here are the slides and whitepaper!
http://www.pmcma.org/wp-content/uploads/2011/09/bhus_2011_brossard.pdf
http://www.pmcma.org/wp-content/uploads/2011/09/BHUS-2011_Brossard.pdf
+++
Okay, I am sure everyone has heard of the recent DigiNotar "Debacle" but if not here is a good link to tell you what is up.
https://blog.torproject.org/blog/diginotar-debacle-and-what-you-should-do-about-it
This next link is the raw spreadsheet data of the compromised certs!
https://svn.torproject.org/svn/projects/misc/diginotar/rogue-certs-2011-09-04.csv
and here is the tor projects latest blog post:
This is the list of CA roots that should probably never be trusted again:
DigiNotar Cyber CA
DigiNotar Extended Validation CA
DigiNotar Public CA 2025
DigiNotar Public CA - G2
Koninklijke Notariele Beroepsorganisatie CA
Stichting TTP Infos CA
The most egregious certs issued were for *.*.com and *.*.org while certificates for Windows Update and certificates for other hosts are of limited harm by comparison. The attackers also issued certificates in the names of other certificate authorities such as "VeriSign Root CA" and "Thawte Root CA" as we witnessed with ComodoGate, although we cannot determine whether they succeeded in creating any intermediate CA certs. That's really saying something about the amount of damage a single compromised CA might inflict with poor security practices and regular internet luck.
Of particular note is this certificate:
CN=*.RamzShekaneBozorg.com,SN=PK000229200006593,OU=Sare Toro Ham Mishkanam,L=Tehran,O=Hameye Ramzaro Mishkanam,C=IR
The text here appears to be be an entry like any other but it is infact a calling card from a Farsi speaker. RamzShekaneBozorg.com is not a valid domain as of this writing.
Thanks to an anonymous Farsi speaker, I now understand that the above certificate is actually a comment to anyone who bothers to read between the lines:
"RamzShekaneBozorg" is "great cracker"
"Hameyeh Ramzaro Mishkanam" translates to "I will crack all encryption"
"Sare Toro Ham Mishkanam" translates to "i hate/break your head"
Sunday, September 4, 2011
Wednesday, August 31, 2011
Kernel.org Box Hacked and Using Googles Bandwidth to DDOS
first off, here is some pretty clever usage of the newly popular G+
---
The vulnerable pages are “/_/sharebox/linkpreview/“ and “gadgets/proxy?“
Is possible to request any file type, and G+ will download and show all the content. So, if you parallelize so many requests, is possible to DDoS any site with Google bandwidth. Is also possible to start the attack without be logged in G+.
http://www.ihteam.net/advisory/make-requests-through-google-servers-ddos/
small shell script to do the dirty work:
http://www.ihteam.net/advisories/_154785695367_+ddos.sh
before we get to the kernel.org hack, here is a couple of other recent articles of interest.
MAC address spoofing attacks against port security:
http://www.usenix.org/events/woot11/tech/final_files/Buhr.pdf
Understanding the LFH:
http://www.illmatics.com/Understanding_the_LFH.pdf
Remotely Exploiting the PHY layer. Inject RAW frames into wireless networks.
http://travisgoodspeed.blogspot.com/2011/09/remotely-exploiting-phy-layer.html
IE JavaScript Heap Spray stage 1 exploit explained
http://picturoku.blogspot.com/2011/09/diaries-of-vulnerability-take-2.html
http://threatpost.com/en_us/blogs/hackers-pushing-voip-audit-tools-malicious-attacks-083111
http://www.symantec.com/connect/blogs/morto-worm-sets-dns-record
http://www.itproportal.com/2011/08/09/android-based-hacking-toolkit-anti-unveiled-defcon/
and although Apache just released a patch today(which OS X will not have available yet) here is a PHP IP range scanner for the DoS.
http://apache-range-exploit.com/
i have to admit, i lol'ed at this. here is the pastebin!
---------- Forwarded message ----------
From: J.H.
Date: 2011/8/29
Subject: [kernel.org users] [KORG] Master back-end break-in
To: users@kernel.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Afternoon Everyone,
As you can guess from the subject line, I've not had what many would
consider a "good" day. Earlier today discovered a trojan existing on
HPA's personal colo machine, as well as hera. Upon some investigation
there are a couple of kernel.org boxes, specifically hera and odin1,
with potential pre-cursors on demeter2, zeus1 and zeus2, that have been
hit by this.
As it stands right now, HPA is working on cleaning his box, and
I'm working on hera (odin1 and zeus1 are out of rotation still for other
reasons), mainly so that if one of us finds something of interest, we
can deal with it and compare notes on the other box.
Points of interest:
- - Break-in seems to have initially occurred no later than August 12th
- - Files belonging to ssh (openssh, openssh-server and openssh-clients)
were modified and running live. These have been uninstalled and
removed, all processes were killed and known good copies were
reinstalled. That said all users may wish to consider taking this
opportunity to change their passwords and update ssh keys (particularly
if you had an ssh private key on hera). This seems to have occurred on
or around August 19th.
- - A trojan startup file was added to rc3.d
- - User interactions were logged, as well as some exploit code. We have
retained this for now.
- - Trojan initially discovered due to the Xnest /dev/mem error message
w/o Xnest installed; have been seen on other systems. It is unclear if
systems that exhibit this message are susceptible, compromised or not.
If you see this, and you don't have Xnest installed, please investigate.
- - It *appears* that 3.1-rc2 might have blocked the exploit injector, we
don't know if this is intentional or a side affect of another bugfix or
change.
- - System is being verified from backups, signatures, etc. As of right
now things look correct, however we may take the system down soon to do
a full reinstall and for more invasive checking.
- - As a precaution a number of packages have been removed from the
system, if something was removed that you were using please let us know
so we can put it back.
- - At this time we do not know the vector that was used to get into the
systems, but the attackers had gained root access level privileges.
That's what we know right now, some of the recent instabilities may have
been caused by these intrusions, and we are looking into everything.
If you are on the box, keep an eye out, and if you see something please
let us know immediately.
Beyond that, verify your git trees and make sure things are correct.
- - John 'Warthog9' Hawley
Chief Kernel.org Administrator
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk5a5U0ACgkQ/E3kyWU9dif+1ACfYPlgq/keFrFO77AmQVduKGwx
TAcAnRAu6nHt74+5aC+fPeb8aT0hcy2K
=Semd
-----END PGP SIGNATURE-----
---
The vulnerable pages are “/_/sharebox/linkpreview/“ and “gadgets/proxy?“
Is possible to request any file type, and G+ will download and show all the content. So, if you parallelize so many requests, is possible to DDoS any site with Google bandwidth. Is also possible to start the attack without be logged in G+.
http://www.ihteam.net/advisory/make-requests-through-google-servers-ddos/
small shell script to do the dirty work:
http://www.ihteam.net/advisories/_154785695367_+ddos.sh
before we get to the kernel.org hack, here is a couple of other recent articles of interest.
MAC address spoofing attacks against port security:
http://www.usenix.org/events/woot11/tech/final_files/Buhr.pdf
Understanding the LFH:
http://www.illmatics.com/Understanding_the_LFH.pdf
Remotely Exploiting the PHY layer. Inject RAW frames into wireless networks.
http://travisgoodspeed.blogspot.com/2011/09/remotely-exploiting-phy-layer.html
IE JavaScript Heap Spray stage 1 exploit explained
http://picturoku.blogspot.com/2011/09/diaries-of-vulnerability-take-2.html
http://threatpost.com/en_us/blogs/hackers-pushing-voip-audit-tools-malicious-attacks-083111
http://www.symantec.com/connect/blogs/morto-worm-sets-dns-record
http://www.itproportal.com/2011/08/09/android-based-hacking-toolkit-anti-unveiled-defcon/
and although Apache just released a patch today(which OS X will not have available yet) here is a PHP IP range scanner for the DoS.
http://apache-range-exploit.com/
i have to admit, i lol'ed at this. here is the pastebin!
---------- Forwarded message ----------
From: J.H.
Date: 2011/8/29
Subject: [kernel.org users] [KORG] Master back-end break-in
To: users@kernel.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Afternoon Everyone,
As you can guess from the subject line, I've not had what many would
consider a "good" day. Earlier today discovered a trojan existing on
HPA's personal colo machine, as well as hera. Upon some investigation
there are a couple of kernel.org boxes, specifically hera and odin1,
with potential pre-cursors on demeter2, zeus1 and zeus2, that have been
hit by this.
As it stands right now, HPA is working on cleaning his box, and
I'm working on hera (odin1 and zeus1 are out of rotation still for other
reasons), mainly so that if one of us finds something of interest, we
can deal with it and compare notes on the other box.
Points of interest:
- - Break-in seems to have initially occurred no later than August 12th
- - Files belonging to ssh (openssh, openssh-server and openssh-clients)
were modified and running live. These have been uninstalled and
removed, all processes were killed and known good copies were
reinstalled. That said all users may wish to consider taking this
opportunity to change their passwords and update ssh keys (particularly
if you had an ssh private key on hera). This seems to have occurred on
or around August 19th.
- - A trojan startup file was added to rc3.d
- - User interactions were logged, as well as some exploit code. We have
retained this for now.
- - Trojan initially discovered due to the Xnest /dev/mem error message
w/o Xnest installed; have been seen on other systems. It is unclear if
systems that exhibit this message are susceptible, compromised or not.
If you see this, and you don't have Xnest installed, please investigate.
- - It *appears* that 3.1-rc2 might have blocked the exploit injector, we
don't know if this is intentional or a side affect of another bugfix or
change.
- - System is being verified from backups, signatures, etc. As of right
now things look correct, however we may take the system down soon to do
a full reinstall and for more invasive checking.
- - As a precaution a number of packages have been removed from the
system, if something was removed that you were using please let us know
so we can put it back.
- - At this time we do not know the vector that was used to get into the
systems, but the attackers had gained root access level privileges.
That's what we know right now, some of the recent instabilities may have
been caused by these intrusions, and we are looking into everything.
If you are on the box, keep an eye out, and if you see something please
let us know immediately.
Beyond that, verify your git trees and make sure things are correct.
- - John 'Warthog9' Hawley
Chief Kernel.org Administrator
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk5a5U0ACgkQ/E3kyWU9dif+1ACfYPlgq/keFrFO77AmQVduKGwx
TAcAnRAu6nHt74+5aC+fPeb8aT0hcy2K
=Semd
-----END PGP SIGNATURE-----
Friday, August 12, 2011
Anonymous targetting facebook in November?
real? fake?
http://pastebin.com/nzaNLWfF
heres some speculation from a third party
http://venturebeat.com/2011/08/10/anonymous-fights-with-itself-over-killing-facebook/
http://pastebin.com/nzaNLWfF
heres some speculation from a third party
http://venturebeat.com/2011/08/10/anonymous-fights-with-itself-over-killing-facebook/
Subscribe to:
Posts (Atom)
