BlackHat 2011 USA

I wanted to congratulate Ivan and Nicolas our winners of the SecuriTeam Secure Disclosure free entry and travel expenses to BlackHat Briefings 2011 (USA).

I hope to see the rest of our researchers there, I will be posting more details on our drink-o-party that is scheduled to occur during those two days.

Follow my twitter @nrathaus, or email me at noamr[]beyondsecurity@com for more details.

CONfidence 2011 Wrapup

As always it was a pleasure to go to CONfidence, the atmosphere in this event is unique and has a very un-commercial feel to it.

It started off with Lock Picking presentation by Deviant Ollam, which quite convincingly proved that your weakest point is physical security, and then gave everyone a run for their money with offering locks and lock picking tools to give people the feel of how easy (or in some cases not that difficult) it is to pick a lock – especially if it just looks tough but is actually a cheap knockoff.

The day then split to two distinctive tracks, I picked the Stuxnet one and learn less on that but more on cybercrime, cyberwarfare and how the United Nations Interregional Crime and Justice Research Institute is handling / looking out on that. Bottom line, a lot to do, little being done now and things are still shaking on the legal and control part of it – with many countries doing it and little threat of “political” issues for them.

After the launch break I got to hear a lecture about Gadu-Gadu vulnerabilities, unfortunately I did not catch the guy’s name so I cannot tell you what it is, but his lecture proved that XSS can be more than just a web site hack with Gadu-Gadu having XSS issues that would allow the execution of code. According to him, the vulnerabilities have been reported but discarded by the vendor as a non-threat, well no one in the audience felt that was a shocker.

Sitting on Mario Heiderich’s lecture proved to me once again that XSS is an endless mine of goodies, with SVG now becoming more and more acceptable, and having been built without much security in mind – SVG is the new XSS goldmine. So many issues, so little time to present them, should be Mario’s trademark :)

I didn’t have the time to sit on any other lectures during that day, so I will skip to day 2

Chris Valasek’s heap spraying and analysis proved once again that he should be dubbed the Heap Spray King with a new method to cause the apparently unexploitable hole in IIS FTP’s server to become exploitable by using ground breaking research of how to cause fragmentation and reassembly of heap blocks to allow in the end for the EIP to be under our control – with the promise to release the exploit – more to come from this great guy.

Alexey Sintsov showed us that even the most small and simple “holes” such as allowing to resolve hostnames on a compromised host can be easily turned to a full fledged remote controlling mechanism, though not new, the way it was presented showed that it is not just theoretical but actually quite easily made into practice.

Michele Orru presented his BeEF – Browser Exploitation Framework – and the ability to – once you have compromised a host by getting him to visit your website – control a remote browser and get it to do what you want. In his demo he compromised a host that had access to a vulnerable JBoss server and using the browser got the JBoss to reverse open a shell on the server – effectively gaining him root access – nice!

Aleksandr Matrosov, Eugene Rodionov showed how x64 operating systems are getting compromised by TDL rootkits and how they have researched cleanup methods – and successfully done so. Apparently the method of used by the TDL rootkit is going back to infecting your MBR – remember those methods? feels like a time warp.

Michał Sajdak proved that lack of security can even happen to security aware companies like CISCO or to their bought of companies Linksys – using simple methods of command injection (such as ;/bin/ls) he was able to completely compromise a CISCO device. A simple web scan of that application would have discovered this vulnerability – I cannot say why that product came to market with such an obvious vulnerability.

At that point again, I had to leave the conference.

It was great, see you next year.

Things I saw that were weird and cool at the same time:
1) The CONFidence treasure hunt was wacky, with tasks such as bring a nude stripper to gain points or have a tattoo of a sailor on your arm for double points
2) Wii and PS3 stations proved once again to be packed with hackers showing their skills
3) Barbecue and beer idea was a hit
4) Giving speakers a free beer as a drink on stage was weird but a good idea on how to release pressure from the speaker

Kindle Book Sharing

This post won’t be about security, but still something that is worth mentioning.

If you want to share your Kindle content with your colleague? you can either loan it to him (but then he has two weeks to finish the book!) or you can just swap Kindles (devices) after deregistering them both, and reregistering them both, remember to put everything outside your Collections or they will get “lost” in the swapping.

I just tried it with a work colleague and it worked great!

Enjoy!

DD-WRT Fuzzing and Monitoring

We recently got a request for a vendor who has taken upon itself to add some interesting stuff to the DD-WRT router to provide him with some form of monitoring that would integrate with our beSTORM fuzzer.

Regular monitoring inherently built into beSTORM which include ARP, ICMP Echo, UDP/TCP Ping and remote debugging weren’t quite up to it – ARP, ICMP Echo and UDP/TCP ping could not tell the vendor when the router was expecting heavy load due to our test which was one of the criteria he has defined inside beSTORM as being an exception (a vulnerability).

Our typical backup option is a gdb-style remote debugger, but the DD-WRT’s debugger doesn’t easily provide that information, therefore we have built a simple monitoring agent that can connect to the DD-WRT web interface and query the load value of the router. When a certain value (above a certain number) is reached an exception is reported back to beSTORM.

This little neat trick allowed the vendor to identify several strange packets that can cause his modified router to become unresponsive (take more than a few seconds to respond), as well as detect when the router was responsive but the load on it was unusually high.

The script is now bundled with the full version of beSTORM, feel free to get the latest version and look into it. A trial is always available here. It’s also available below:

#!/usr/bin/perl
# Copyright Beyond Security 2011
# beSTORM support: support@beyondsecurity.com

use strict;
use Getopt::Long;
use LWP::UserAgent;
use IO::Socket;

my @children;
my $beSTORM_port = “6969”;
my $beSTORM_ip = “192.168.1.2”;
my $router_ip = “192.168.1.1”;
my $router_username = “root”;
my $router_password = “admin”;

my $pingTimeout = 1; #ping every x seconds
my $bContinue = 1; #Stay in loop.

#Install signal handlers
$SIG{ABRT} = \&signaled;
$SIG{INT} = \&signaled;
$SIG{HUP} = \&signaled;

my $options = { };
GetOptions(
‘host=s’ => \$options->{‘bH’},
‘port=i’ => \$options->{‘bP’},
“router=s” => \$options->{‘rH’},
“username=s” => \$options->{‘rU’},
“password=s” => \$options->{‘rP’},
);

#Sanity check
my $bPrintUsage = 0;
if (! $options->{‘bH’} ) {
$bPrintUsage = 1;
print “No host value has been provided\n”;
}
if (! $options->{‘rH’} ) {
$bPrintUsage = 1;
print “No router value has been provided\n”;
}

if ($bPrintUsage) {
usage();
exit 0;
}

$beSTORM_ip = $options->{‘bH’};
$beSTORM_port = $options->{‘bP’};
if (not defined $beSTORM_port) {
$beSTORM_port = 6969;
}

$router_ip = $options->{‘rH’};
$router_username = $options->{‘rU’};
if (not defined $router_username) {
$router_username = “root”;
}

$router_password = $options->{‘rP’};
if (not defined $router_password) {
$router_password = “admin”;
}

while ($bContinue) {
my $ua = LWP::UserAgent->new;
$ua->timeout(2);

my $URL = “http://$router_username:$router_password\@$router_ip” . “/Status_Router.live.asp”;
print “Connecting to: $URL\n”;
my $response = $ua->get($URL);

my $content = “”;
if ($response->is_success) {
$content = $response->decoded_content; # or whatever
}
else {
send_notification($beSTORM_ip, $beSTORM_port, “Failed to receive response from router’s web server: “.$response->status_line);
}

my $load = “”;
if($content =~ /, load average: ([^}]+)\}/gs) {
$load = $1;
} else {
print “Failed to find load average inside content: [$content]\n”;
send_notification($beSTORM_ip, $beSTORM_port, “Failed to locate load average value”);
}

print “$load\n”;
sleep(1);
}

###
#
sub send_notification {
my $Host = shift;
my $Port = shift;
my $Exception = shift;
print STDERR “\n\nSending to $Host:$Port this exception: [$Exception]\n\n\n”;

my $sock = IO::Socket::INET->new(
Proto => ‘udp’,
PeerPort => $Port,
PeerAddr => $Host,
) or die “Could not create socket: $!\n”;

print STDERR “Exception: [$Exception]\n”;
$sock->send($Exception) or die “Send error: $!\n”;

$bContinue = 0;
}

sub usage
{
print “\nUsage: $0 –host [–port ] –router \n\n”;
print “\t–host beSTORM client host\n”;
print “\t–port beSTORM client UDP port for exception information (default 6969)\n”;
print “\t–router the Router being monitored\n”;
print “\t–username used by the router to authenticate (root)\n”;
print “\t–password used by the router to authenticate (admin)\n”;
}

#Ping beSTORM host that we are alive every $timeout
sub start_notifier
{
my $timeout = shift;
if (! defined $beSTORM_ip) {return; };

my $pid= fork();
if ($pid < 0) { die "Could not fork\n"; } if ($pid > 0)
{
push @children, $pid;
}
#Child
if ($pid == 0)
{
print “Starting beSTORM notifier. Will send heartbeat to $beSTORM_ip every $timeout second(s)\n”;
while ($bContinue)
{
my $sock = IO::Socket::INET->new(Proto => ‘udp’,
PeerAddr => $beSTORM_ip,
PeerPort => ‘6970’,
Type => SOCK_DGRAM,
) or die “socket: $@”;
print $sock “NOOP”;
close $sock;
sleep($timeout);
}
print “beSTORM notifier Stopped\n”;
exit 0;
}
}

sub stop_notifier
{
my $sig = shift;
print “Shutting down beSTORM notifier (it may take up to 5 seconds to stop)\n”;
if (@children)
{
print “Signaling: (@children) with sig $sig\n”;
kill $sig, @children;
}
}

sub signaled
{
my $sig = shift;
print “Recieved signal $sig. Shutting down\n”;
stop_notifier($sig);
$bContinue = 0;
}

#The end

CanSecWest, chrome 0-days, breaking the Blackberry fortress

CanSecWest was fun, met a lot of people researchers, consultants and customers. Lot of them came to hear good quality lectures and I believe they have found them.

Quite a few came to see the buzz around Pwn2Own and I don’t think they could have missed the shouts of victory and the press eagerly interviewing them after their triumphant wins. I also had a chance to meet a few of our SSD researchers which shared some thoughts on the Pwn2Own even highligting the fact that 15K isn’t that much anymore for a IE8 vulnerability that can bunk its protected mode, or get you elevated privileges on the Chrome browser – I have to agree on that. This probably means there are a few chrome 0-days out there, but they are simply being sold for larger amounts of money.
Also got a chance to talk to a few of the mobile researchers that were quite impressed with the BlackBerry find, highlighting how ground breaking that was, as being the first publicly done and documented breach into the BlackBerry “fortress” – I am not sure if it is in fact the first one but it was impressive none-the-less.

For all those that came and talked to us in our booth about the SecuriTeam Secure Disclosure, just in case you didn’t write it down, the way to reach our program is by emailing SSD@beyondsecurity.com, we also offer our existing researchers a 1,000 USD bring-a-friend offer – if you need more details email me.

Thanks,
Noam

noamr[]beyondsecurity[@]com

CanSecWest 2011 Winner

Hi,

We have a winner to our SSD Researcher [name removed], he gets a free entry and flight expenses to CanSecWest.

A big thank you to all our researchers that have worked with us in the past year, we have notified the winner of the prize, if he wants we will publish his name.

We still have the tshirt contest going on, if you want your free entry to CanSecWest, give it a try.

Thanks,
Noam

Win Free Registration to CanSecWest

Hi,

Help us design our (CanSecWest)link t-shirt and win a free registration to the event plus $250 for expenses.

We will be giving away a t-shirt to booth visitors and if your idea is the best we will use it at the show.

The design should be in one color and fit on the back of the shirt. It can be something related to network security and could be text, an image or a cartoon.

Not planning to go to CanSecWest? Send in your idea anyway. If we use it we’ll send you the $250 and give the ticket to the second place design.

Noam.