New distributed web application vulnerability scanner linked to search engine

• HyperionGray have announced a new project, where they have connected their open source distributed PunkSCAN webapp scanner to an Apache Hadoop Cluster and set it loose on the Internet
• The goal of the project is to highlight the abysmal state of security on the Internet
• The scanner finds sites that are vulnerable to SQL Injection, Blind SQL Injection, and Cross-Site Scripting
• This information is then stored in a database, and is searching using PunkSPIDER
• You can search by keyword in the URL or Title of the site and search by vulnerability types
• PunkSPIDER Search Engine
• PunkSPIDER is similar to another online search engine we have discussed previously, SHODAN is an online index of banner messages and version info
• Additional Coverage

How power failures can corrupt Flash SSDs

• Researchers at Ohio State University have conducted extensive testing of Flash SSD drives to determine how they react to unexpected power failures
• By creating a worst case scenario that involves many concurrent writes of incompressible data, and a direct loss of power (cutting power between the PSU and the SSD rather than cutting power to the PSU), the researchers were able to enumerate a number of possible failure scenarios
• The possible failures they looked for were:
  • Bit Corruption – Random bits in the data set incorrectly
  • Flying Writes – The correct data written to the wrong block/sector
  • Shorn Writes – A write is interrupted while overwriting a sector, leaving the sector with some of the new bits and some of the old bits
  • Metadata Corruption – The Flash Translation Layer (FTL, the complex firmware on an SSD that makes the NAND Flash chips appear like a regular hard drive) metadata is corrupted
  • Dead Device – The SSD no longer functions at all
  • Unserializability – The disk is in a state where writes were completed out of order
• Researchers tested 15 different SSDs and 2 regular spinning drives
• They did not release the manufacturer names or model numbers
• Additional Coverage
• Paper
• Erretum Insert
• A case of a similar problem? SSD suddenly only 34kb

Source code and possibly private keys for AMI BIOS/Firmware leaked

• Security researchers Brandan Wilson and Adam Caudill found some interesting things on an open FTP server in Taiwan
• On the FTP site they found numerous goodies, including internal emails, system images, high resolution PCB images, and Excel sheets loaded with private data
• In addition, they also found a directory named ‘code’, that contained the source code and a private key for the AMI Firmware
• According to AMI, the FTP site belongs to one of its customers, and the private key that was exposed is a testing key they use for all of their images, but they instruct all of their customers to generate their own keys and not use that testing key in production
• It is not clear if this is the case, one or more manufacturer making use of the AMI Firmware are using that testing key
• If that key is trusted in the wild, it means someone with access to this leaked source code could make a malicious firmware update that would be considered valid, it would also mean that the entire UEFI trust system for the affected machines could be invalid
• “The worst case is the creation of a persistent, Trojanized update that would allow remote access to the system at the lowest possible level,” Caudill said. “Another possibility would be the creation of an update that would render the system unbootable, requiring replacement of the mainboard.”
• “This kind of leak is a dream-come-true for advanced corporate espionage or intelligence operations,” Caudill wrote. “The ability to create a nearly undetectable, permanent hole in a system’s security is an ideal scenario for covert information collection.”

Feedback:

• Kasper Needs to Try FreeNAS

• ZFS n00b Questions

• New FreeNAS Release

• Voicemail from Tzvi

• Dammit Chris!!

Round-Up:

• Brazilian users unable to boot Windows after botched update
• Exclusive: Ongoing malware attack targeting Apache hijacks 20,000 sites
• 2013 CISPA passes Intelligence Committee, headed to House for vote
• Video streamer Vudu reports physical break-in, customer data stolen
• Advertising networks found ignoring Opt-Out requests
• Exploit for Apple iMessage can cause Denial of Service (crash the app and prevent the user from getting any future messages)
• US Government caught using Stringray (fake cell tower) devices to eaves drop on calls without a warrant
• Developer purposely leaves vulnerable application online, finds it compromised by friendly hacker within 24 hours
• Ubisoft UPlay service hacked, gives access to unreleased title Far Cry 3
• Japanese Crisis Management Office accidently tweets that DPRK Missiles are inbound to Japan, while testing ability to inform the public

The post FTP Treasure Trove | TechSNAP 105 first appeared on Jupiter Broadcasting.

Updated version of rouge Apache Module injects iframes, but hides from administrators

• The module, known as Linux/Chapro.A and alternately as Darkleech, is loaded into an Apache server and injects iframes into the pages that are served
• The iframes load content from malicious sites, usually the with intent of infecting the visitor with the Zeus trojan (Win32/Zbot), or another malware such as the new Sweet Orange exploit kit
• What makes this module exceedingly clever is that it uses a number of techniques to prevent itself from being discovered and to mask the source of the infection
• For starters, the module checks all open SSH sessions on the host server and will not serve the malware to any website visitors from those IP addresses
• The malware also looks at the user agent string, and purposely does not serve the malware to bots, crawlers (Attempting to avoid detection by the likes of Google’s Safe Browsing system) or machines that are not likely to be vulnerable (it purposely does not inject the iframe for browsers on OS X, Linux or BSD or mobile devices)
• The malware also does not attempt to infect the same user twice, via communications with a C&C server, the module decides whether or not to attempt to infect a user. This means that returning to the site if you are already infected, your IP address has been seen before or you are marked by a cookie, will return in you not being served the malware
• This remote C&C server also determines the content that is injected, allowing the controllers to change the iframe to point to a different exploit without having to change the apache module
• These factors make it much harder for server administrators to determine that it is infact their server that is injecting the iframe, not something on the users’ side, but also makes it harder for users and researchers to determine which site infected them, as they may not see the malicious content on a return visit
• As we know the Zeus trojan targets users of European and Russian banks, and attempts to steal users’ credentials
• Some banks have started adding warnings to their login screen, notifying users that the bank will never ask them for specific pieces of information, like their card PIN, or CVC/CVV value, however machines infected with the trojan do not see the warning, as it is removed by the malware
• The apache module has also been seen to deliver the Sweet Orange exploit kit
• The developers of the new sweet orange exploit kit claim an infection rate of 10–25%
• The developers have 45 dedicated IP addresses and 267 unique domains to allow them to avoid blacklists
• Researchers also found an alarmingly low detection rate when some of the domains and IPs were run through scanners
• It has yet to be seen if this new-comer can compete with the industry-dominating Blackhole Exploit Kit

Researcher exploits old design flaw in WordPress to turn it into an Island Hopping Machine

• WordPress and many other blogging platforms use a feature called ‘pingback’ to alert other blogs when they are being mentioned
• In WordPress this causes the blog being mentioned to add a link to the new blog post as a comment, making the connection bidirectional
• The way this works is upon receiving a pingback request the wordpress site will contact the URL included in the pingback and attempt to find links to itself and if found, add the requested comment
• The issue here is that the pingback request may not actually originate from the site mentioned in the pingback
• In a wordpress bug opened in 2007, the reporter describes a scenario where many wordpress sites could be asked to pull large files from a victim site, causing a bandwidth amplification attack on both the requesters and the responder. Additionally an extremely large number of wordpress sites could be used for a regular distributed denial of service attack against a target site
• The severity of this flaw was considered low and while some attempts to write patches to prevent large files from being returned were written for older versions of wordpress, it seemed that the feared attacks never surfaced and nothing was ever done about it
• However, new research by Bogdan Calin (the researcher that developed the ‘hijack your router via an email message to your iOS device’ attack) has found a more novel use for this flaw
• In addition to causing wordpress to execute his existing attacks against routers on the local networks of the wordpress sites he is attacking, he has also managed to map the various error messages wordpress returns to be able to explore and map the local network
• WordPress returns different error messages based on if the host of the requested pingback URL resolves or not or if the port connected to is open or not (connection refused, timeout, or connected)
• This allows anyone with access to the xmlrpc.php (which is typically publically exposed) to determine if specific hostnames (especially unqualified ones) such as svn, subversion, dev, fileserver, exchange, bugzilla, etc exist or not as well as do port scans (request a pingback to https://192.168.0.100:22/ and see which error message you get)

Some Samsung devices include full read/write access to all memory, allowing easy rooting and exploitation of the devices

• /dev/exynos-mem has world read/write permissions and seems to be very similar to /dev/mem
• The device seems to be used by the Camera and HDMI interfaces on the devices
• The exploit allows for dumping all device ram, kernel code injection, and possibly malicious app installation
• Additional Coverage
• A new app called ExynosAbuse APK chmod’s the device at boot to prevent world read/write access, however this may disable your camera and HDMI interfaces
• Samsung Exynos kernel exploit offers easy root and malware possibilities | Android Community
• Vulnerable devices include:
• Samsung Galaxy S II, S III and S III LTE
• Samsung Galaxy Camera
• Samsung Galaxy Note, Note II, and Note II LTE
• Samsung Galaxy Note 10.1
• Samsung Galaxy Tab 7.0 Plus
• Samsung Galaxy Tab 7.7
• Hardkernel ODROID-A and Hardkernel ODROID-X
• Lenovo K860
• Meizu MX 2-Core, Meizu MX 4-Core and Meizu MX2
• Newman N2
• ORIGEN 4 Dual and ORIGEN 4 Quad

Feedback:

• Hardware Monitoring under FreeBSD?
• Best FS for RAID?
• 3 Points of Note
• A better way to manage configuration for openvpn
• Domain Spotting

HALL OF SHAME:

• Alabama Department of Education USA Hall of shame

Round Up:

• It’s the 90s again, Excel macro viruses make a comeback disgused as Sudoku puzzles
• Java 7u10 (JDK 1.7.0_10-b18) includes new Java control panel option to disable running plugins in your browser
• Researchers find hash collision Denial of Service attack against Btrfs
• Wikipedia moving from MySQL to MariaDB
• Cox Comm. Injects Code Into Web Traffic To Announce Email Outage
• More attacks on SCADA systems, including the HVAC in your office building
• ISP Data caps generate record revenues while doing little to combat congestion
• SSD prices continue to drop while HDD prices remain inflated
• Online game HON (Heros of Newerth) has its password database leaked, live streaming players targeted. Some twitter accounts compromised (DON’T REUSE PASSWORDS!)
• Design flaw in Adobe Shockwave could allow attackers to purposefully cause Shockwave to install/use an older vulnerable version to view their content, allowing them to exploit already patched flaws
• Oracle posts policies for thier cloud offerings, many concerning aspects for potential enterprise customers
• Large donations from Mark Cuban and Markus ‘Notch’ Persson create ‘Mark Cuban Chair to Eliminate Stupid Patents’ at the EFF

The post WordPress LAN Recon | TechSNAP 89 first appeared on Jupiter Broadcasting.