Man-in-the-Middle – Jupiter Broadcasting

The Coffee Shop Problem | TechSNAP 413

Wes Payne — Thu, 03 Oct 2019 23:15:16 +0000

Show Notes: techsnap.systems/413

The post The Coffee Shop Problem | TechSNAP 413 first appeared on Jupiter Broadcasting.

Linux Action News 91

Angela Fisher — Mon, 04 Feb 2019 07:52:14 +0000

Episode Links:

linuxactionnews.com/91

The post Linux Action News 91 first appeared on Jupiter Broadcasting.

Pain the APT | LINUX Unplugged 285

chris — Wed, 23 Jan 2019 05:35:16 +0000

Show Notes/Links: linuxunplugged.com/285

The post Pain the APT | LINUX Unplugged 285 first appeared on Jupiter Broadcasting.

Signature Bloatware Updates | TechSNAP 270

chris — Thu, 09 Jun 2016 10:03:13 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

The bloatware shipping on those new computers is way, way worse than you probably thought, Internet exposed printers & the thrilling story of reverse engineering an ATM skimmer. Yes that’s really a thing.

Plus great questions, our answers & more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

Nice brand new computer you have there, would be a shame if something happened to it

“According to a report published by two-factor authentication service Duo Security, third-party updating tools installed by Dell, HP, Lenovo, Acer, and Asus (the top five Windows PC OEMs) are exposing their devices to man-in-the-middle attacks.”
“OEM PC vendors understandably need a way to maintain and install more of the aforementioned bloatware. The Duo Labs team investigated OEM software update tools spanning five vendors: Acer, Asus, Dell, HP, and Lenovo.”
“Implementing a robust, secure system for delivering software updates to users requires a thorough threat model, and a fundamental understanding of how to correctly make use of the various cryptosystems available to do so. Many OEM vendors don’t seem to understand or care about the need for building basic security measures into their software, resulting in software rife with vulnerabilities.”
“Whether it’s a creep on the coffee shop WiFi or a nation state sitting on all the right trunks, any software that downloads and executes arbitrary binaries is an enticing target to attackers. This is a well-established fact — in 2006, some dude broke Mozilla’s Auto-Update; in 2010, there was Evilgrade; in 2012, Flame malware authors discovered how to man-in-the-middle (MITM) Windows Update; and in January 2016, there was the Sparkle debacle. This shows that targeting the transmission of executable files on the wire is a no-brainer for attackers.”
“The scope of this research paper is limited to OEM updaters, although this wasn’t the only attack surface found on these systems. Basic reverse engineering uncovered flaws that affected every single vendor reviewed, often with a very low barrier to both discovery and exploitation.”
The results:
- Dell — One high-risk vulnerability involving lack of certificate best practices, known as eDellroot
- Hewlett Packard — Two high-risk vulnerabilities that could have resulted in arbitrary code execution on affected systems. In addition, five medium-to-low risk vulnerabilities were also identified.
Asus — One high-risk vulnerability that allows for arbitrary code execution, as well as one medium-severity local privilege escalation
Acer — Two high-risk vulnerabilities that allow for arbitrary code execution.
Lenovo — One high-risk vulnerability that allows for arbitrary code execution.
Other Findings:
“Every vendor shipped with a preinstalled updater, that had at least one vulnerability resulting in arbitrary remote code execution as SYSTEM, allowing for a complete compromise of the affected machine”
Every new machine came with crapware, and an auto-updated for the crapware. The auto-updated made the machine less secure, not more secure as it expected. Not to mention they that this report doesn’t actually look at the crapware itself
“There was a very low level of technical sophistication required – that is, it was trivial to exploit most of the vulnerabilities”
They didn’t have to try very hard, some of these updaters run a local http server that anything can connect to
“Vendors often failed to make even basic use of TLS, properly validate update integrity, or verify the authenticity of update manifest contents”
This means that a random person at the coffee shop, or the government, can pretend to be your OEMs update server, and feed you malware instead of security fixes
“Vendors sometimes had multiple software updaters for different purposes and different implementations, some more secure than others”
Multiple auto-updaters, that is what everyone wants
“The large attack surface presented by ancillary OEM software components makes updater-specific bugs easier to exploit in practice by providing the missing pieces of the puzzle through other tools bundled with their systems”
If the auto-updater isn’t buggy enough, the crapware provides everything else you need to compromise the system
“Microsoft offers ‘Signature Edition’ systems which are intended to be free of the third-party software that plagues so many OEM systems. However, OEM-supplied software updaters and support packages are often still present on these machines.”
So even if you pay extra for a brand new system free of crapware, it still has the auto-updater that makes the system insecure
Additional Coverage
Additional Coverage: Lenovo tells users to uninstall vulnerable updater

Clinton email server — may have had an internet based printer…

“The Associated Press today points to a remarkable footnote in a recent State Department inspector general report on the Hillary Clinton email scandal: The mail was managed from the vanity domain “clintonemail.com.” But here’s a potentially more explosive finding: A review of the historic domain registration records for that domain indicates that whoever built the private email server for the Clintons also had the not-so-bright idea of connecting it to an Internet-based printer.”
According to historic Internet address maps stored by San Mateo, Calif. based Farsight Security, among the handful of Internet addresses historically assigned to the domain “clintonemail.com” was the numeric address 24.187.234.188. The subdomain attached to that Internet address was….wait for it…. “printer.clintonemail.com”.
“Interestingly, that domain was first noticed by Farsight in March 2015, the same month the scandal broke that during her tenure as United States Secretary of State Mrs. Clinton exclusively used her family’s private email server for official communications.”
“I should emphasize here that it’s unclear whether an Internet-capable printer was ever connected to printer.clintonemail.com. Nevertheless, it appears someone set it up to work that way.”
“More importantly, any emails or other documents that the Clintons decided to print would be sent out over the Internet — however briefly — before going back to the printer. And that data may have been sniffable by other customers of the same ISP”
Not necessarily, it can depend on the setup. The reason you might expose a printer to the internet like that on purpose, is to allow printing while you are away from home, but it isn’t a good idea
“Not just because any idiot on the Internet can just waste all your toner. Some of these printers have simple vulnerabilities that leave them easy to be hacked into.”
That printer can then serve as an ‘island hopping’ beachhead, allowing the attacker to do this from an internal IP address that is likely to be trusted, and allowed through firewalls (you do want to be able to talk to the printer right?)
It does appear the Clintons had an SSL VPN, which is a good sign, although I would expect the printer to have been behind that

Reverse engineering an ATM skimmer

“Brian Krebs has produced numerous articles on ATM skimmers. He has essentially become the “go to” journalist on ATM fraud. From reading his stuff, I have learned how the “bad guys” think when it comes to ATM fraud. In a nutshell, they are after two things:”
They want your card number
They want your PIN number
“To get your card number, the thieves have a few options. Traditionally, they affix a device to the ATM card reader that “skims” your card as it passes into the actual machine”
“The devices must look as close to the actual reader as possible so they don’t arouse suspicion. The blackhats go to great lengths to achieve this. Sometimes they will replace entire panels of the atm. They may even go as far as inserting a tiny card reader INSIDE the card slot. Alternatively, a thief may try to record the number “on the wire”. This is called “network skimming””
The post includes a video of a skimmer being installed in just a few seconds
Then it gets interesting, after having read all of Krebs advice, while visiting Indonesia, the author of the post encountered a skimmer
“A quick glance, and I suspected it was a skimmer immediately. It had a tiny switch, a port for a cable of some sort and I could see a faint blue light in the dark.”
“I was not sure what to do. I was tempted to leave it alone since it wasn’t mine and it could possibly be a legitimate piece of the ATM. But if it were a skimmer, I would be knowingly allowing people to get ripped off. I couldn’t allow that to happen, plus I wanted to take it home and see how it works!”
“We decided to take it. On our way out to dinner, Elizabeth and I discussed excitedly about how cool this is to be in the middle of a criminal conspiracy. “It feels like we are in a movie”, she said. We talked about how we think the crooks were getting the data. We talked about how we would report it to the authorities and take it apart. The movie kept getting more and more exciting in our imaginations. Then we got to the part of the movie where a group of men on motorcycles track us to our home and shoot us with automatic weapons.”
“By the time we got to the restaurant, we were pretty scared, A GSM-enabled device could feasibly phone home with its GPS coordinates. Just in case, we asked for some aluminum foil and made a makeshift Faraday cage. When it comes to Indonesian criminal gangs, you can never be too careful.”
“The next day we were still alive and not shot by a gang of criminals. We called the bank to report the device we found on their ATM. The CSR was pretty confused, but he took my name and number and dispatched a technician to look at the machine.”
This reaction is very common, and is starting to be troubling
After some deduction, he determined the ports on the side were for a USB cable
“Threading the braided wires into those tiny holes one at a time was an exercise in patience. After 40 minutes or so, I got them all aligned. I had to hold the wires in with my hand while I plugged the USB cable into my computer. I crossed my fingers and…. Skimmer device mounts as an external hard drive!”
“It mounts! I freak-out a little and begin copying the files from the device. There are two folders. One is named “Google Drive” and one is named “VIDEO”. The “Google Drive” folder was empty, but there is over 11GB of video files in the “VIDEO” folder. 45 minutes later, the files are still copying to my machine. The whole time I have to hold the cable and not move lest I break the transfer.”
“After it’s done, I shake out the cramps in my hand and go over the footage. The camera records 30 minute chunks of video whenever it detects movement. Most of the videos are of people typing in their pin numbers [upside down]”
“The device records sound. At first I thought it was a waste of storage to record this, but after looking at the footage, I realized how helpful the sound is. The beeps correspond to actual keypresses, so you can’t fool the skimmer by pretending to touch multiple keys. Also, the sound of money dispensing means that PIN is valid.”
When they tore the device apart, they found a cell phone battery, a control board, and a pinhole camera
“Googling the number from the controller board revealed that it is a commercially available board used in spy camera gear. The board was modified to include an external on/off switch, the stronger Samsung battery, and the aforementioned USB connection.”
“The overall design choices of the skimmer were actually pretty decent. As mentioned, at first I thought sound recording was a waste, but then found it to be useful for decoding PIN numbers as they are typed. I also initially thought that the cell phone battery was a lazy choice, like they just had one laying around. I have come to believe, however, that this is the best choice for a long-lasting and small-profile power source.”
The researcher did not find the actual card skimmer, but suspected that the data was being “network skimmed”
Going back a few days later, they found a fresh pin number camera installed

Feedback:

Round Up:

The post Signature Bloatware Updates | TechSNAP 270 first appeared on Jupiter Broadcasting.

Patch Your Password | TechSNAP 84

chris — Thu, 15 Nov 2012 20:59:13 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Allan will build the case for abandoning the password, the Skype flaw that will shock you,

And we discuss picking the right server OS, when to RAID or not to RAID, and a BIG batch of your questions, and our answers.

All that and more on this week’s TechSNAP!

Thanks to:

GoDaddy.com

Use our code tech495 to get a .COM for $4.95, or go20off5 to save 20% on your entire order!

Pick your code and save:
techsnap7: $7.49 .com
techsnap10: 10% off
techsnap11: $1.99 hosting for the first 3 months
techsnap20: 20% off 1, 2, 3 year hosting plans
techsnap40: $10 off $40
techsnap25: 25% off new Virtual DataCenter plans
techsnapx: 20% off .xxx domains

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Fill out my Wufoo form!

Show Notes:

Get TechSNAP on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Why a password isn’t good enough anymore

An article by Mat Honan, the Wired writer who had his entire online existence destroyed earlier this year
An attacker wanted to steal the twitter handle @mat, and so started by trying to do a password reset on twitter.
This directed the attacker to Mat’s gmail account
When trying to initiate a password reset set on the gmail account, he was directed to Mat’s Apple account
The attacker called Apple and using information about Mat from Twitter, Facebook, Google etc, he managed to reset the password for Mat’s Apple account
Using the Apple account, the attacker was able to disable and remotely wipe Mat’s Apple devices (iPhone, iPad and Macbook)
Once the attacker was in control of the Apple account, he was able to reset the password for the Gmail account
Then to reset the password for the Twitter account
Watch TechSNAP 70 for the full story
In this followup article we get an even closer look at what happened, and an in-depth analysis of other recent happenings
A lot of the problems discussed in the article are not weaknesses in passwords specifically, but in the people and systems that use them
Authentication Bypass – When an attacker finds a way to access an account or service without needing the password at all. We have seen this with Dropbox, Oracle and others in past episodes of TechSNAP, or the recent case with Skype, where it failed to properly authenticate you before allowing you to reset account, we’ll cover that later in this episode.
Brute Force – Accounts for services like POP3, FTP, SSH, and SIP are under constant attack, all day, every day. Attackers attempt to compromise the accounts in order to gain access for various reasons, from using the initial password as a stepping stone to gain access to more sensitive accounts, to using your machine to scan for yet more weak passwords, or as a source of spam. Attackers are constantly attempting common username and password combinations against every public facing server on the internet, using apps such as DenyHosts, Fail2Ban or SSHGuard to protect these servers is a must.
Database Compromise – Services such as Sony PSN, Gawker, LinkedIn, Yahoo, eHarmony, LastFM and others had their databases compromised, and their lists of passwords dumped online. Often these passwords were hashed (MD5, SHA1, SHA256), but not always. Even a hashed password is little protection, it doesn’t immediately disclose your password, but with tools like Rainbow Tables and GPU accelerated cracking, these hashes were quickly cracked and the plain text passwords posted online. Hopefully more services will start using properly secure Cryptographic Hashes (sha512crypt, bcrypt) that take tens of thousands of times more computational power for each attempt to crack a password. Some algorithms like bcrypt are also, thus far, immune to GPU acceleration, actually taking longer on a GPU than a CPU.
Disclosure – People often share their passwords, I don’t know how many facebook accounts have been ‘hacked’ by friends or ex’s because you willingly gave them your password, or you gave them the password to something else, and they used one of the other techniques described here to gain access to something you didn’t mean for them to have access to.
Eavesdropping – Someone could be listening on the wire (or in the air in the case of wireless or mobile data connections) and see your password as it goes between your computer and the remote service. Most services now login over SSL to prevent this, but older services such as FTP (still very popular for web hosting, where your password may be shared with the web hosting control panel that has access to reset your email password) are not encrypted.
Exposure – This is when you accidently give away your password, it happens on IRC at least once a week, someone attempts to enter the command to identify, but prefixes it with a space or something and ends up displaying their password to the entire chat room. Users will also sometimes accidentally enter their password in the username field, or their credit card number in the field that is for the ‘name as it appears on the card’, which causes it not to be treated with the same level of security.
Guessing and Inference – When people base their password on birthdays or pet’s names, they become easy to guess. If you compile a largish list of keywords about a person, including bands and songs they like, their family and friends names, important dates, sports teams etc, and run it through an app like John The Ripper, which will make variations of those passwords, including l33t speak transformations, adding numbers and symbols, are are likely to get a fairly high success rate. In addition to guessing, there is inference, if you know that Bob’s password for gmail is: bobisgreat@gmail then you can probably guess that his password for facebook is: bobisgreat@facebook. If there is a pattern or ‘system’ to your passwords, once someone compromises ONE of those passwords, they have a much greater chance of compromising them all.
Key Logging – When an attacker, using hardware or software, is able to record the keys you type in your keyboard, thus capturing your password as you input it. Apps like LastPass may seem to help with this, but they usually use an OS API to simulate typing the keys to remain compatible with all applications. Clipboard scanners can also often catch passwords.
Man-in-the-Middle – An attack that intercepts your traffic and pretends to be the service you are trying to connect to, allowing it to capture your password, even if it was encrypted. SSL/TLS was designed to prevent Man-in-the-Middle attacks by verifying the identity of the remote server, however with Certificate Authority being compromised and issuing false certificates and tools such as SSLStrip to trick you into not using SSL, it is still possible for your communications to be intercepted.
Phishing – Emails meant to look like they are from an official source, whether is be eBay, PayPal or your bank, prompt you to login on a page that looks like the legitimate one, but is not. Once you enter your details, the attackers have all they need to know to compromise your real account. Combine this with the weak DKIM keys from a few weeks ago, a compromised Certificate Authority and a man-in-the-middle DNS attack, and you have no way of knowing that when you entered https://www.paypal.com in to your browser, you actually ended up on an attackers site instead.
Reply Attack – When an attacker is able to capture you authenticating in some secure manner, but is able to resend that same information and authenticate as you later, without ever knowing your password
Reuse – Using the same password on multiple sites means that when one of them is compromised, they all are. I keep telling you, use lastpass.
- Secret Questions – So, when you setup that new account and it prompts you for some secret questions/answers, consider carefully what you put down. You’re going to need to be able to remember it later to regain access to the account (or some accounts ask them when they suspect you are logging in from a different computer), but if they are simple ones that someone could look up via google or facebook (remember, the attacker could be someone you know, so your privacy settings on facebook might not be enough), then it isn’t good enough.
- Social Engineering – In the case of the Mat Honan compromise, the weakest link turned out to be AppleCare Support, they very much wanted to be helpful and allow him to recover his accounts, the only problem was, the caller was not Mat Honan, but the attacker, to managed to guess and trick his way through the security questions and gain control of the Apple and Amazon accounts.
- See some old Blog post by Allan for more reading at [GeekRoundTable] ](https://www.geekrt.com/read/88/Myths-of-Password-Security/) and AppFail
These issues are endemic across the entire internet, and it is important that you be aware of them and take steps to protect yourself as best you can
A comparison of two major password dumps has shown that half of all passwords were used on both sites, the problem of password reuse is growing rather than shrinking
Having a long and strong password is important, but you have to consider the other ways someone could compromise your account, the weakest link is the most likely avenue of attack
If you have the option, you should enable two-factor authentication, adding one more step makes the attackers job that much harder, but remember, this doesn’t mean you are immune, RSA and Blizzard authenticators have been compromised in the past when their seed values were stolen from the central databases.

Skype IDs hijackable by anyone who knows your email address

An attacker found a way to bypass the authentication in skype’s password reset system, and take over any target account for which the email address was known
The Instructions
Register for a new account, using the email address of the victim
Login to Skype using that new account
Initiate a password reset for the victim’s account
Skype will email the victim a password reset token, but the token will also pop up in the skype client for all accounts that use that email address, allowing the attacker to get the token
Use the token to reset the password of the victim account
Login to the victim’s account and remove their email address and add your own (one that no one knows) and you now own that account
Skype disabled the password reset system a few hours later, then fixed the issue and re-enabled the password reset system. Tokens are no longer displayed in logged-in skype clients. This makes sense, and I question why it was ever the other way around, because if you are logged in, you are unlikely to have forgotten your password (unless it was saved I guess).
Skype’s Reaction
NextWeb Coverage
NextWeb Followup

Feedback:

Round Up:

The post Patch Your Password | TechSNAP 84 first appeared on Jupiter Broadcasting.