ctrl-alt-del.cc

Making new friends with kippo

Sat, 31 Jul 2010 01:59:22 +0000

Less than two weeks ago I've sent a tweet asking for honeypot recommendations. I wanted to play a bit with something new, something I never did before, mostly because I never had time for it (right, like I have it now). Anyway, thanks to all the great people that replied to my tweet I've learned a lot and found some great software. Now it's time to give something back to the community.

Kippo - simply amazing

First honeypot I've reached for was kippo. It is a medium interaction SSH honeypot designed to log brute force attacks and log the whole session as it goes - including timings, typos, etc. The magic sauce is that you can play the session back (with typos!) and see what the attackers are made of. Believe me - playing back those session is totally amazing! Some samples are available on project's page.
There are also other features to like, like trapping sessions and not disconnecting them even if bad guys do logout, logging ssh client used (very easy to tell scanning bots apart from real people), quite nice interaction and most of all easy way to extend your honeypot it with your own commands.

Coder vs Security - friend or foe?

Tue, 25 May 2010 10:45:22 +0000

Certainly 140 characters is not enough to express all the thoughts around recent CSRF flaw in OpenCart and how it was handled (in my humble opinion it even deserves nomination for Pwnie Awards), although some people had a good go at Daniel Kerr.

Above is just a selection of comments that you can find on Twitter and in all of this negative karma there is some good thing going on. This incident got quite a lot of people to write some really good posts about the incident. Some of my favorite posts are Humble Helps and Psychology of "Secure Code" - definitely worth reading.

Although I'm not an expert in either coding or security (but I did quite a lot of both) I think there is also a bit more to it.

RTFM - there's and app for that

Wed, 24 Mar 2010 14:31:06 +0000

What can be better to do on the tube than to kill some time reading manuals or books? Of course in IT quite a lot of that stuff comes as PDFs or other non-paper formats, so good eBook reader or an app for whatever terminal you have is an advantage.

During one of the DC4420 meetings one of the guys gave a very good recommendation for an iPhone app that copes very well with PDFs and some other formats. The app is called Good Reader and I have to say, it's really good (for what I need it to do).

Usually the problem is how to deliver the files of interest to the reder. You want to be able to read when off-line and have flexibility in delivery methods of course. Here is the thing that sold me to the Good Reader - you can upload the files over wifi directly to the iPhone, using nothing more than a web browser. Yes - the app functions as a web server to do it! Just to make sure it doesn't turn your phone into public web server, you have to confirm that you want to allow the given IP to connect and you get that question every time you turn the wifi upload option on.

AirView2 Spectrum Analyzer

Tue, 15 Dec 2009 22:42:13 +0000

Recently I had some serious problems with wi-fi at home - especially one of the laptops was dropping off and couldn't come back. Quick survey using Kismet and other tools to scan what's flying around has proven that my network is in less populated part of the spectrum (at least here) but still, problems are getting worse and worse.

I was fully aware of Wi-Spy by Metageek, seen it in action previously but never had a chance to buy one. Part of the decision was the price back then, maybe now it would be another game, but anyway - I got myself another device, made by well known wi-fi vendor Ubiquiti and it's called AirView2.

What's so special about this one? Why it's better than Wi-Spy?

First of all I didn't say it's better. It's different, woks with Linux, Mac OS X and Windows, has a nice price tag and does pretty much the same as Wi-Spy. Let's have a closer look then, shall we?

The Hex Factor at SANS London 2009

Sat, 05 Dec 2009 09:32:23 +0000

The competition is now officially over and I have to say it was AWESOME!

Those that made it to BruCON had a chance to play it, those that came to SANS London 2009 also had their fun, all the rest of you - bad luck :-/ maybe next time.

The Hex Factor was run for four evenings/nights at The Fox Bar and Restaurant located literally next to the Excel center where SANS courses were hosted. What can be better than beer, hacking and a spirit of competition?!

Tasks set by the authors were varied in difficulty and topics they covered. One category was about history and culture of hacking with a bit of general teaser tasks and was called Once Upon A Time, like finding a name of candy shop at , so that was a soft introduction.

My favorite category was Out Of The Box category (also known as Pure Leetness), where questions were really 'out of the box' and solving them was the best fun I had for a long time! First 100 points for finding a number 'hidden' in the message was really simple and here's how I did it:

I didn't have time to do the one for 200 points, but finally after some time I managed to solve the 300 points one - finding a secret number hidden in the PDF file - hats off to Didier Stevens for this task - it was amazing! Didier's blog was a great guide and help in the process.

CONFidence09.02 - post mortem

Sat, 28 Nov 2009 09:45:34 +0000

Well... my plan to blog live from the CONFidence was good but still remained to be more of a plan than a reality. Twitting went much better (possibly because you can twitt between chats with people, drinks, etc) so I'll wrap up what happened and how it went.

The conference was great - I really liked the lectures (those I actually made to), loved the chat with speakers and it was awesome to meet some old friends and make some new contacts. Overall, if you didn't come to Warsaw for CONFidence09.02 you missed quite a lot.

Day 1 summary
There was very nice presentation by Felix "FX" Lindner on how 'awesome' Cisco IOS is, Claudio Criscone (@paradoxengine) talked about security in virtualization environments, Frank Breedijk renamed hist AutoNessus to Seccubus (new twitter feed at @seccubus), Leonardo NVE Egea showed us how you can use the satellites to work as your downlink (and it seemed much easier than actually you would think), Pavol Luptak pretty much owned the RFID there (yes, the basic cloning kit is just €30), Elisa dropped the pressure a bit with Power Point Karaoke where Felix "FX" Lindner was presenting about detecting unknown alcohols, Raoul Chiesa gave great presentation about knitting (yes, knitting) and I was rolled into a presentation about IT slang/acronyms and there was something about insulting someone :-) and that was just the first day.

Day 2 summary
For those that survived the 'afterparty' on the evening/night/morning you had a chance to see nice explanation of the cold boot attack given by Nadia Heninger, Nick DePetrillo discussed 'what could go wrong' with intelligent power grids and believe me... there's a lot! Jacob Applebaum (@ioerror) gave us some TOR love and a lot of TOR laptop stickers. Alessio "mayhem" Penasilico (@mayhemspp) and Raoul Chiesa gave nice presentation on history of hacking telcos - there was some good info there... just before Raoul killed it all with final presentation dissecting the underground economy (with some slides show just after the cameras and other recording equipment was turned off). That was a really good one...

Finishing off, Frank has posted a bunch of posts about presentations we saw in Warsaw. They are:

Fusing 3rd party threat feeds to obtain better threat intelligence - Eddie Schwartz
Router Exploitation - Felix "FX" Lindner
My Seccubus slide deck (slides from Frank's presentation)
My TLS renegotiation vulnerability slides (Frank's lightning talk during one of the breaks)
Mifare Classic anaysis - Pavol Luptak
Power Hungy People - Nick DePetrillo
The Tor Project - Jacob Appelbaum
Underground economy - Raoul Chiesa

That's it for now - just make sure you get there next time :P

Claudio Criscione - Virtualization security

Thu, 19 Nov 2009 16:11:17 +0000

Claudio gave today brilliant presentation about virtualization security... Just a few bullet points from the presentation.

It turned out that VMWare hypervisor is running Tomcat to give you the admin interface - oldie (shall I read it 'unpatched') but goldie, right?
You can do MiTM against VMWare VI Client... and as presented at the demo, that works like a charm, plus...
... if you can MiTM you can pwn the box - clients.xml that is served by the server contains a URL of the client .exe to be executed - boom, you can change that!

Just to give you the idea - during live demo Claudio forced the admin PC (the one running VI Client) to format drive C: and there was no option to stop it, it pretty much kicked off right away.

There was much more than that - also Xen and Ubuntu got their share here but the practical demo was based on VMWare.

Lessons learned?
Treat VM hosts and their apps just as another computer, another system and make sure you secure them the same way as any other system. Think of patch management and what happens when you revert to a snapshot (it may be old and unpatched so you bring back unpatched or already compromised system), think of separation of duties and access (physical and logical).

CONFidence09.02 - day 1 kicked off

Thu, 19 Nov 2009 13:41:43 +0000

Almost half of the day at CONFidence09.02 has already passed. Some interesting stuff of course...

Starting with Dragorn's and RenderMan's "Wireless threats; They're not dead yet!" we've heard once again how bad and how dead WEP really is. Good refresher for some people I guess. Best part was discussing client side attacks via wifi - airpwn style but without goats this time, using malicious JS with such a nice feature like browser side caching, defeating SSL, hiding all of that in plain sight with call-home feature that will be very hard to notice in most of environments.

Then I skipped several presentations - I really needed a reboot :-)

Next one I made to was Felix "FX"Lindner talking about how sweet hacking Cisco IOS can be. Frank (@autonessus) has already blogged about this one so I'll just put a few notes here.

Cisco's HTTP admin interface runs off their understanding of HTTP and not Apache.
IOS doesn't have recovery procedure for software crashes due to it's monolithic structure - the only remedy is to reboot the whole box (quite easy to spot even by untrained admin - the networkz are down!) which takes time (even several minutes).
Cisco has added TCL scripting in some versions of IOS :-)

More to follow... and yes, we use #confidence0902 as hashtag.

Twitter, SPAM and zombie hookers

Tue, 27 Oct 2009 12:46:20 +0000

Came out of a blue - no context, nothing... BTW - we've got new URL shortening service.
All would be almost 'fine' but WTF is that? Not that I wouldn't guess but I'm just curious how owned you can get :-)

As a matter of fact, you can get owned pretty bad and what I've seen I would expect to be just a starter... the main course is coming soon!

WARNING: All the information provided in this post is available on the Internet. Links presented on screen shots should be considered malicious - do not visit them unless you really know what you are doing. You have been warned.

Windows 7 Haz Cheezburgerz!

Thu, 22 Oct 2009 23:32:10 +0000

Simply AWESOME!

Came via e-mail from one of 'marketing' guys so I don't know the real origin (except obvious one) but the sender's comment was spot on!

Look at the monster burger. It's five inches tall and of course is made with seven beef patties in honor of Windows 7. What's the message here? Eat this burger to feel as slow and bloated as Windows? I don't get it.

... and neither do I but as a poster it's a nice one for laugh. In fact Windows 7 is so much faster than Vista that there is nothing to compare ;-) so Burger King should be selling V-shaped burgers some time ago when Vista came out. Well - never mind... but thanks for this e-mail and a good laugh :-)

BTW. If there is a person that would understand what the advert is all about (and I don't mean translating the text) or can see the 'hidden message', please enlighten me :-)

RSA Security Bloggers Meet Up 2009 London

Thu, 22 Oct 2009 19:56:55 +0000

It's already a matter of past but still - the first official RSA Security Bloggers Meet Up 2009 in London was held in Fountains Abbey at 19:30 on 20 October 2009. It was a great evening - meeting people that live and share every bit of security related information they can - to educate and entertain :-)

I just want to say thank you to Dale Pearson of Security Active for getting all of it prepared and to all the sponsors - IronKey, ISACA, Qualys, RSA and others - for helping Dale and sponsoring the meet up. Dale has posted a summary and photos from the meet up at Security Active's blog. If I've missed anybody in above, please forgive me.

For me this meeting was a chance to see some people I've already met earlier (like @stefant and several others) and some I was trying to almost 'hunt down' in London for quite some time (@xme is perfect example here) so for me the meet up was a real success :-)

Thanks again and see you all next time!

UI mockups - nice and easy

Sat, 17 Oct 2009 20:37:30 +0000

I write code. Sometimes it will be a short script, sometimes a web app, next day it can be something with more traditional user interface but designing user interfaces is my worst nightmare. I can plan the whole app, write and test the code, but when it comes to UI design I just want to run away - it is simply not my game.

Usually when everything is finally ready (or so I think) somebody comes and says 'Oh! By the way - if you moved this part here, it would be better - easier to use' and quite often they are right, so I've started asking my potential users how they want it done before I actually create it at all, but for that I need simple drawings that would explain my idea - something they can look at and say if they like it or not. Preparing several sketches takes time, modifying them takes even more... but there is a tool that helps.

A humble screen shot is worth more than a thousand words...

As simple as that - prototype of simple blog layout in less than 10 minutes using Balsamiq Mockups for Desktop (demo version). Simple, nice to use, very effective!

Normally I wouldn't write about 'software' (especially commercial), but there is something special about this one....

wykop.pl owned - data stolen

Sun, 06 Sep 2009 22:24:37 +0000

The news of the day in Poland is that wykop.pl - polish site doing the same stuff as digg.com - got owned in a pretty bad way - database with user's login credentials and e-mail addresses was stolen. This post is a result of gathering info from public sites (in Polish - mostly off Dziennik Internautow which gave nice coverage) so all of it is already in public domain - otherwise I wouldn't quote any fragments or call on any information given here.

Info about breach goes public

Following what Dziennik Internautow wrote in their post, on 5 Sep 2009 a person using nickname Gimbus1xD has informed administrators of wykop.pl about the breach (no link - original post taken down) and about the fact, that some of the information stolen was already used to compromise account held with other websites, including allegro.pl (auction system like eBay). To prove his revelations, Gimbus1xD posted also screen shots of compromised Allegro account with transactions that happened two days earlier and another one with PHPMyAdmin browsing 'users' table.

The scary part here is that as Gimbus1xD wrote, about 40% of those passwords have been broken (despite being hashed) with simple dictionary and brute-force attacks because passwords were up to 7 characters long.

Allegedly the database is in the hands of vichan.net admins, which again allegedly shared 'unhashed' database with their moderators - including Gimbus1xD, who broke the news. So far it's not clear what made Gimbus1xD change his mind and make this information public.

That's not yet the end...

How mobile a mobile broadband may be?

Thu, 27 Aug 2009 22:26:39 +0000

Quite recently I had a chance to travel by train from London towards Manchester and back. The journey was not bad in fact - first class on Virgin Trains does the trick... even more when you have free wi-fi included and power sockets for almost all seats.

Microsoft's EPIC FAIL

Wed, 26 Aug 2009 14:37:30 +0000

Probably everyone has seen it already... It hit reddit.com yesterday getting to the top of the front page, BBC wrote about it, it was all over Twitter, and got even it's own video clip/mockup, etc. Simply ~~the best~~ FAIL!

BBC did a great job in capturing it (see BBC link above for full article) - I was too slow to do a screen shot this time :-/ I have removed the image from here - don't want to upset BBC by copying their content without permission (although probably I might call it on fair use policy - anyway just see the links above and that's it).

Funny enough link on reddit.com that points to dropbox.com is no longer valid (404 win!) and Microsoft has replaced the image to be as the original one (oops - forgot to resize orange bar below the text - that happens if you have rocket a up your ****), but no worries, you have faithful users on the Internet :-D