MySQL had a bad week, we’ll run down the list of the recently disclosed vulnerabilities, the SSH server that allows an attacker full root access, and a GPU password cracking monster.
Plus a big batch of your questions, and so much more!
The exploit uses the SSH USERAUTH CHANGE REQUEST method, and allows an attacker to authenticate with a blank password by sending an additional change request
The exploit allows a remote attacker to get a full root/administrator shell
You can work around this vulnerability by disabled ‘old-style’ password authentication as described here
A ShodanHQ search reveals at least 500 servers running vulnerable versions of Tectia SSH, but there are a far greater number of machines running the free SSH server
A bug in the way twitter handles incoming SMS messages count allow an attacker who knows your mobile phone number to post twitter messages as you, and to alter your profile and settings
Researcher Jonathan Rudenberg found and disclosed the vulnerability to Twitter in mid-August, Twitter officials asked him not to publish until the vulnerability was corrected. Five weeks later he asked for an update on the progress and never got a response, so he published the information on Tuesday on the Full Disclosure mailing list
The researcher also reported similar bugs to Facebook and Venmo, both of which corrected them quickly
Twitter has fixed part of the issue, users who text to a ‘short code’ are no longer vulnerable, but users who still use ‘long code’ are still at risk
Because of the way that SMS ‘short codes’ work, and the fact that most charge a fee for the service, it is not usually possible to spoof the source address when sending an SMS to a short code
Twitter recommends enabling the ‘pin code’ feature, but this feature is not available to users in the USA
Twitter has disabled the use of long codes for users who have a short code available
If you do not use the feature, it is recommend that you ensure that the SMS Commands interface is entirely disabled for your twitter account
This past week the Password^12 conference was held in Oslo, Norway
A bunch of new research was revealed
Jeremi Gosney demonstrated the use of Virtual OpenCL, a project out of Hebrew University which allows remote GPUs to be addressed as if they were local, simplifying the process of distributed GPU password cracking
Virtual OpenCL is currently closed source, limited to Linux 64bit and only works over high speed LANs (cannot be used over the internet)
Support for VCL has been added to oclHashcat, the password cracking application, by Jens Steube
oclHashcat can now support up to 128 AMD GPUs
Jeremi Gosney demonstrated their setup, which uses 25 AMD GPUs:
5x 4U servers, containing a total of
10x HD 7970s
4x HD 5970s (dual GPU)
3x HD 6990s (dual GPU)
1x HD 5870
Connected via 4x SDR Infiniband Interconnects
Uses 7kW of electricity
The cluster is able to brute force SHA1 hashes at 64 Gigahashes per second
MD5 180 G/s
NTLM 348 G/s
LMHash (windows xp) 20 G/s
md5crypt 77 M/s
sha512crypt only 364 K/s
bcrypt (cost=5) only 71 K/s
This means that a Windows XP password (LMHash is all uppercase, and breaks the password into two separate 7 character hashes) can be cracked in under 6 minutes (the entire key space)
Any 8 character NTLM password (Windows XP with LMHash disabled, or any newer version of windows) can be cracked in about 5.5 hours
Gosney was able to ultimately able to crack over 90% of all of the SHA1 hash values from the LinkedIn database leak
Jens Steube of Hashcat, also gave a presentation on a vulnerability in SHA1 that allows hashes to be calculated 21.1% faster by taking advantage of the mathematical properties of the XOR operation
Be sure to use HTTPS or SSH, do not upload your database over FTP or HTTP/WebDav without SSL, or someone could sniff your password database as you sync it
Your password database is now only as secure as the weakest device it is stored on, or the security of the server(s) it is stored on