Another CA Compromised

itworld.com
Lucian Constantin, IDG News Service (December 08, 2011)

<Dutch SSL certificate provider Gemnet investigates website compromise>

[Video Link] Facebook Social XSS by Copy-Paste

Matt Jones (November 19, 2011)
(Video hosted on Facebook as public in Matt's gallery)

<Facebook Social XSS by Copy-Paste>

[Link] US Water Utility Pump Destroyed After Hack

PCMag.com
Chloe Albanesius (November 18, 2011)

<Illinois Water Utility Pump Destroyed After Hack>

[Link] SQL Injection Start to Finish Example

(Moderate SQL understanding expected)

Mathy Vanhoef (October 26, 2011)

<Exploiting 'INSERT INTO' SQL Injections Ninja Style >

[Link] EFF - How secure is HTTPS today? How often is it attacked?

<Peter Eckersley> - Technology Projects Director, Electronic Frontier Foundation (October 25, 2011)

< EFF - How secure is HTTPS today? How often is it attacked?>

Payload Anatomy of InMotion Hosting Defacements

The Attack

<InMotion Hosting> was hacked leaving more than 70,000 websites compromised on the weekend of September 23, 2011. One of many news articles that covered the attack:

(Article by Jack Phillips Sep 29, 2011)
<The Epoch Times: Hosting Firm InMotion Hacked, Thousands of Websites Defaced>

The Defacement

This attack appears to be a host-wide defacement. The defaced websites had hacked-by pages added to their site which credited "TiGER-M@TE":

(This is a screen shot of the defacement page, index.php )

From the perspective of the customer, there were no access, web, or ftp log entries. A file named hacked_page was dropped in to the root www directory and was propagated to all the immediate sub-directories as index.php.

<index.php contents>(pastebin.org)

Encoding

This PHP page contains only HTML and JavaScript. A close look at its contents shows that it uses some cleaver encoding in an attempt to avoid security fingerprinting, which could later allow for easy automated detection.

A common technique is to represent malicious JavaScript code in escaped hexadecimal character format, then pass that through JavaScript's unescape function at run time. First, this obscures the malicious code. With some small adjustments, the same encoded contents can be generated in many copies all uniquely different. But, with a little time one can decode the page's contents.

The unescape function decodes the URL escape character syntax as well as the JavaScript escape character syntax. The defacement page used both, one over top of the other:

found in index.php
(JavaScript escaped hexadecimal characters)

\x25\x33\x43\x25\x37\x33\x25\x36\x33\x25\x37\x32\x25\x36\x39\x25\x37\x30\x25\x37\x34

unescape's to...
(URL escaped hexadecimal characters)

%3C%73%63%72%69%70%74

unescape's to...
(The start of an HTML tag that will contain the malicious JavaScript)

<script

This is not a new technique and is easily decoded after the fact. After coding up a quick tool I was able to decode the page:

<index.php decoded>(pastebin.org)
(The decoded contents are noted in JavaScript comments.)

I've created an open source tool for decoding escaped hex, <Unescape>, so you can follow along.

Analyzing this shows that this page has five parts of interest:

• Connection to statistics tracking service
• Window animation and color cycling
• A base64 embedded GIF image (not hex-coded)
• "Hacked" image
• Playing of an embedded Flash file (apparently for auto playing audio)

Statistics tracking

Line #33 of the <decoded page> (line #11 originally) defines the function details. This function is set as an onclick event for the "TiGER-M@TE" text. The function open three web pages when triggered, two different statistics tracking service links at <zone-h> and one Google search of "Hacked by TiGER-M@TE" through <LMGTFY (Let Me Google That For You)> The statistics at zone-h can be viewed here:

<zone-h notifier: TIGER-M@TE>

<zone-h notifier: TIGER-M@TE special=1>

Window animation

Line #40 through #133 of the <decoded page> (also line #11 originally) defines a timed script of moving and resizing the browser window in some sort of animated show while cycling colors.

Embedded base64 GIF image

Line #148 of the <decoded page> (the end of line #11 originally) contains a GIF image embedded in the page using <base64(wiki)> encoding. This appears to merely be a faded line. As we'll seen next, maintaining image hosting seems like a challenge for the defacers.

"Hacked" image

Line #183 of the <decoded page> (then end of line #15 originally) is some encoded JavaScript to add an image tag to a small image of the word "Hacked". This <image is hosted on Fotonons.ru> but the tag is crafted to fall back on <the same image hosted at BayImg.com>. This seems to highlight the perceived difficulty of maintaining image hosting during the peak of the defacement activity.

Embedded flash audio

The code inside the "mp3 code starts from here" HTML comments turned out to be the most complicated. This part was encoded in multiple layers and revealed a custom character transformation function. First the contents had some key characters escaped with JavaScript hex characters, the entire resulting contents was escaped with URL escaped hexadecimal characters, then the resulting contents was additionally escaped with JavaScript hex characters. Pealing this away reveals a dF function which provided a custom transformation decoder for decoding the accompanying section of escaped data:

<index.php decoded dF function>(pastebin.org)

This decoder merely did some basic arithmetic to each character's value. The final results start at line 200 of the <decoded page>. This resulting code adds the following flash file to the page for auto-play:

http://77.247.69.68/.../By_TiGER-M@TE.swf

The host 77.247.69.68 <resolves> to <Rackhosting.com> in Denmark. The link, with its peculiar "..." directory, seemed dead as as soon as tested.

Variable Names

The "_0x9355" style of JavaScript variable names imply that many documents where intended to be generated with unique variable names. This technique would act as an obfustication while attempting to evade fingerprinting by security applications such as anti-virus and intrusion detection services.

Summary

The index.php defacement page propagated nearly one hundred thousand times in recently compromised <InMotion Hosting> web sites display a decorative brand promotion while loading a flash file that appeared to be for audio, but was unrecovered. A statistics tracking service was used and a couple of mostly common techniques where used to obfusticate the JavaScript code in an apparent attempt to evade filtering and detection by security services.

UPDATES:

10/2/2011 - Added decoded dF function pastebin
10/8/2011 - Added open source Unescape tool.

[Link] Inserting fake certificates to sniff SSL and hijack DNS

seventhoctober.net (Aug 17, 2011)

<SSL MITM with an inserted CA and a DNS hijack>

[Link] How to find 0-day in browsers

abazhanyuk.com (August 7, 2011)

<How to find 0-day in browsers>

Adobe Reader Exploite Using Java Script

ADOBE READER 8

  Core Security Technologies reported a critical vulnerability to Adobe about it's Adobe Reader. Adobe has already released an update to address the vulnerability in version 8.1.2. The vulnerability was found in Foxit Reader (CVE-2008-1104) and later successfully tried in Adobe Reader. Adobe Reader and Foxit Reader both have different security approaches that lead people to think Adobe Reader wouldn't be affected.

Foxit Reader 2.3 build 2825 security bulletin from Secunia Research details the following:

"The vulnerability is caused due to a boundary error when parsing
format strings containing a floating point specifier in the
"util.printf()" JavaScript function. This can be exploited to cause a
stack-based buffer overflow via a specially crafted PDF file."
(Secunia Research, May 20, 2008)

Help Net Security's coverage of the Adobe Reader vulnerability added that the util.printf() function "converts the argument it receives to a String, using only the first 16 digits of the argument and padding the rest with a fixed value of “0” (0x30). By passing an overly long and properly formatted command to the function, it is possible to overwrite the program’s memory and control its execution flow."(Help Net Security)

Help Net Security - Critical vulnerability in Adobe Reader (Nov 4, 2008)
<http://www.net-security.org/secworld.php?id=6715>

Security Focus - Secunia Research: Foxit Reader "util.printf()" Buffer Overflow.
(May 20 2008)
<http://www.securityfocus.com/archive/1/archive/1/492289/100/0/threaded>

Will iPwn for Food

Will iPwn for Food

  Forbes reports on <(blog)Piergiorgio Zambrini>, 38 year old Italian systems engineer who created the first popular iPhone carrier break application named <Ziphone>. Zambrini is reported to be "revealing a bug that can crash the iPhone and, he says, other devices including iPods and Apple computers."(Buley)

  Zambrini is holding the details for Apple. Forbes reported this bug to be in the audio portion of Apple's video format, that able to crash Apple iPod and latest generation iPhone. Forbes says this bug is in a shared library used in most Apple operating systems(i.e., Mac) and has confirmed this claim on iPhones.

  Zambrini goes on in the interview with Forbes about wanting a job in the Apple security department and wanting to talk to Steve Jobs. Yeah, it got weird, but apparently Zambrini made a nice chunk off Ziphone already.

Forbes.com (Taylor Buley), Crashing The iPhone
[Feed]<http://www.forbes.com/technology/2008/11/03/apple-iphone-bug-tech-security-cz_tb_1103iphone.html?feed=rss_popstories> (Nov 3, 2008)

Clickjacking

Clickjacking

  Clickjacking is the buzz word for the week. Robert “RSnake” Hansen and Jeremiah Grossman had planned a presentation on clickjacking at the <world OWASP conference in New York>. After sharing the information with Adobe they were <asked to delay> releasing of details because of it's impact on one of their products.

  Clickjacking is underappreciated, but well known. Traditionally JavaScript had many implications in this area, but this does not require JavaScript. This zero day is purported as a fundamental flaw in how browsers handle web pages that affects all (or most all?) graphical browsers. From <Jeremiah Grossman on his blog>, "At the time, we believed our discoveries were more in line with generic Web browsers behavior, not traditional 'exploits,' and that guarding against clickjacking was largely the browser vendors' responsibility."

It's been said by many people that turning off JavaScript will not prevent this attack. The Firefox plugin/add-on <NoScript> does much more than micro-managing JavaScript. <ZDNet's Blog> posted the following email from <Firefox Noscript>:

Hi Ryan,
  I’ve seen a lot of speculation and confusion in the comments to your Clickjacking article about NoScript not being able to mitigate [the issue].
  I had access to detailed information about how this attack works and I can tell you the following:

1. It’s really scary
2. NoScript in its default configuration can defeat most of the possible attack scenarios (i.e. the most practical, effective and dangerous) — see this comment by Jeremiah Grossman himself.
3. For 100% protection by NoScript, you need to check the “Plugins|Forbid <IFRAME>” option.

Cheers,
Giorgio

Through <Jeremiah Grossman's blog> (referred to in the email above) and <Robert Hansen's blog at ha.cker.org> some information about the zero day can be found, but it seems the rest of the details have been kept pretty tight.

<Breaking Point Systems> has been speculating on this vulnerability and posted <source to some forms of web jacking>. Later they realized that these weren't exactly the zero day and then posted this <proof of concept "IFrame Trick"> which seems to fit the details of the vulnerability.

Fedora Servers Compromised

Fedora
redhat

  <Fedora announced> (Aug. 22, 2008) that some servers were illegally accessed 'last week'. One of the compromised servers was for signing Fedora packages. Despite being optimistic about the security of the passphrase used to secure the signing keys, Fedora has decided to convert to new signing keys.

  A RHL <security advisory> eludes to successfully compromised OpenSSH packages. "In connection with the incident, the intruder was able to sign a small number of OpenSSH packages relating only to Red Hat Enterprise Linux 4(i386 and x86_64 architectures only) and Red Hat Enterprise Linux 5 (x86_64 architecture only)"

  RHL released an update to OpenSSH to address this as well as <script> to detect these black listed packages.

BitTorrent's .torrent File Buffer Overflow Vulnerability

A critical vulnerability was found in uTorrent and BitTorrent. The torrent clients' processing of .torrent files fail to do proper bounds checking for the 'Created By' field. This allows a maliciously crafted .torrent file to do a buffer overflow. From there, arbitrary code execution is a step away.

Confirmed vulnerable versions (previous version are assumed but not confirmed to be vulnerable):

  uTorrent version 1.7.7 (Build 8179)
  BitTorrent versions 6.xx.

TorrentFreak urges users of uTorrent to upgrade to <uTorrent 1.8> and claims there is no upgrade/patch for the mainline BitTorrent client yet, but an update will be available soon.

<TorrentFreak - Critical Vulnerability Discovered in uTorrent>(August 12, 2008)

<Secunia - Security advisory for uTorrent>(August 12, 2008)
<Secunia - Security advisory for BitTorrent>(August 12, 2008)

Metasploit The Recent DNS Flaw

DNS
<Metasploit> plug-in that uses the <recent DNS poisoning flaw> to inject a malicious DNS entry.
<www.caughq.org/exploits/CAU-EX-2008-0002.txt>

DNS Design Flaw Allows Spoofing

DNS
(July 8, 2008) United States Computer Emergency Readiness Team (US-CERT) Vulnerability notice <#800113> regarding a DNS Cache Poisoning Issue.

"It is a fundamental issue affecting the design. Because the system is behaving exactly like it is supposed to behave, the same bug will show up in vendor after vendor after vendor.", says Dan Kaminsky, director of penetration testing, at the <IOActive> security firm. Kaminsky found this flaw more than six months ago while doing non-security related research of the DNS system.

A number of software vendors released patches Tuesday, July 8th. A patch <was released>(July 8, 2008) by Microsoft, being it's scheduled update day, and a patch <was also released> (July 8, 2008) for the Berkeley Internet Name Domain (BIND) server. The <Security Focus article> (July 8, 2008) claims both Cisco and Juniper also acknowledged flawed systems (but haven't released patches).

Automated SQL Injection Mass Attack Hits IIS Websites

“Exploits of a Mom” by <xkcd>

  An automated attack against Microsoft’s IIS servers has hit some 500,000 websites. Websites affected include the United Nations, UK Government sites and the U.S. Department of Homeland Security.

  These attacks targeted Microsoft IIS servers which allow generic SQL commands that don’t require specific table-level arguments. The attack targets IIS servers which run ASP allowing them to pollute database servers in a generic way that doesn't require prior knowledge of the database's table and field structure.

  The attacking script injects malicious JavaScript code into every text field of the database. The JavaScript then loads an external script that can compromise a user’s PC. So far there have been no details about who is behind the attacks.

<Wired Blog - Massive Attack: Half A Million Microsoft-Powered Sites Hit With SQL Injection> (4/28/2008)
<Hackademix - Mass Attack FAQ> (4/26/2008)

Hotmail CAPTCHA Massacre

<Recent reports> of streamlined Windows Live CAPTCHA bot attacks are slamming Hotmail. <New reports> show this process in action with success rates purported one in 8 to 10 attempts being successful (10 - 15%). One bot can <reportedly> create at least 1,440 accounts a day. These accounts are then used for mass mail spamming.

SQL Exploit by Recent Example

  Oklahoma sets up a <sex offender violent offender site>. Right off the bat you can see the site is still managed by numskulls. On their front page 'Notice to public:' has a broken non-breaking-space HTML tag hanging out.
  Apparently until several people stressed the problem and severity, the site sent and accepted SQL queries with no sanitation through web requests. This allowed anyone with minimal SQL knowledge to retrieve social security numbers and other personal information of tens of thousands of people on this registry.

<The Daily WTF>
(contains some examples as well as details)

Find sites with similarly poor design with a crafted Google search:
<Google Search Example>

XSS Cross- Site Scripting Explained

I've read about cross-site scripting techniques for years, but when I ran across an IBM article about XSS posted on <tweako>, it stuck out as a great explanation.

<IBM Rational AppScan: Cross-site scripting explained>

RFID Credit Cards

  RFID is becoming more popular for many things. Credit cards using RFID technology sporting names like 'EZ Pass', 'quick pass', and 'speed pass' are growing. A recent Boing Boing <video netcast episode> is re-raising concerns about the security of such cards.
  An older <The New York Times report> featured tests on 20 cards from Visa, MasterCard and American Express, showed that the data was being broadcast in plain text. This data frequently includes the card holder's full name, sometimes even the card number and expiration date.

  A common misconception is that RFID is totally insecure by nature. This isn't true. RFID's are just a family of inexpensive devices that broadcast via radio frequencies. Other than their price, these devices are most notable for their tiny size and ability to be self-powered. These devices can capture power from the radio frequency of a requesting device, powering it's self, to make a radio frequency reply.
  This misconception comes from frequent news headlines where a poor attempt, or no attempt, was made to protect the data or signals a RFID made. These signals are easily captured, but encryption techniques can be used to protect this data. Designers frequently don't bother.
  In some cases, like this credit card situation, an ideally secure encryption scheme may require more elaborate equipment for legitimate readers, possibly an expensive central payment system. This could defeat the entire purpose of making transactions fast.

  Some effort should be made using one of many encryption techniques to protect this data. Although the card number maybe be useless without the security code, a plain text card holder's name is surely a bad idea.

  A Boing Boing TV <video netcast episode> claims a suitable RFID reader can be purchased for as low as $8 from eBay. Some lady with her hair dyed till its falling out, and a dude who has never washed his hair, demonstrate reading a card through your pocket with a similar device. Their demonstration revealed that the full goods may still be broadcast in plain text by these type of cards.