selinux – Jupiter Broadcasting

Need more help than a radio show can offer? Altispeed provides commercial IT services and they’re excited to offer you a great deal for listening to the Ask Noah Show. Call today and ask about the discount for listeners of the Ask Noah Show!

Altispeed Technologies

Contact Noah

asknoah [at] jupiterbroadcasting.com

— Twitter —
+ Noah – Kernellinux
+ Ask Noah Show
+ Altispeed Technologies
+ Jupiter Broadcasting

The post Security Enhanced Linux | Ask Noah 9 first appeared on Jupiter Broadcasting.

PIS Poor DNS | TechSNAP 268

chris — Thu, 26 May 2016 17:32:03 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Is the “Dark Cloud” hype, or a real technology? Using DNS tunneling for remote command and control & the big problem with 1-Day exploits.

Plus your great question, our answers, a breaking news roundup & more!

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

APT Groups still successfully exploiting Microsoft Office flaw patched 6 months ago

“A Microsoft Office vulnerability patched six months ago continues to be a valuable tool for APT gangs operating primarily in Southeast Asia and the Far East.”
“CVE-2015-2545 is a vulnerability discovered in 2015 and corrected with Microsoft’s update MS15-099. The vulnerability affects Microsoft Office versions 2007 SP3, 2010 SP2, 2013 SP1 and 2013 RT SP1.”
“The error enables an attacker to execute arbitrary code using a specially crafted EPS image file. The exploit uses PostScript and can evade Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) protection methods.”
One of the groups using the exploit targeted the Japanese military industrial complex
“In December 2015, Kaspersky Lab became aware of a targeted attack against the Japanese defense sector. In order to infect victims, the attacker sent an email with an attached DOCX file exploiting the CVE-2015-2545 vulnerability in Microsoft Office using an embedded EPS (Encapsulated Postscript) object. The EPS object contained a shellcode that dropped and loaded a 32-bit or 64-bit DLL file depending on the system architecture. This, in turn exploited another vulnerability to elevate privileges to Local System (CVE-2015-1701) and download additional malware components from the C&C server.”
“The C&C server used in the attack was located in Japan and appears to have been compromised. However, there is no indication that it has ever been used for any other malicious purpose. Monitoring of the server activity for a period of several months did not result in any new findings. We believe the attackers either lost access to the server or realized that it resulted in too much attention from security researchers, as the attack was widely discussed by the Japanese security community.”
The report details a number of different teams, with different targets
Some or all of the teams may be related
“The attackers used at least one known 1-day exploit: the exploit for CVE-2015-2545 – EPS parsing vulnerability in EPSIMP32.FLT module, reported by FireEye, and patched by Microsoft on 8 September 2015 with MS15-099. We are currently aware of about four different variants of the exploit. The original one was used in August 2015 against targets in India by the Platinum (TwoForOne) APT group.”
Kaspersky Lab Report

Krebs investigates the “Dark Cloud”

“Crooks who peddle stolen credit cards on the Internet face a constant challenge: Keeping their shops online and reachable in the face of meddling from law enforcement officials, security firms, researchers and vigilantes.”
“In this post, we’ll examine a large collection of hacked computers around the world that currently serves as a criminal cloud hosting environment for a variety of cybercrime operations, from sending spam to hosting malicious software and stolen credit card shops.”
How do you keep your site online while hosting it on hacked machines you do not control
How do you keep the data secure? Who is going to pay for stolen credit cards when they can just hack one of the compromised machines hosting your site?
“I first became aware of this botnet, which I’ve been referring to as the “Dark Cloud” for want of a better term, after hearing from Noah Dunker, director of security labs at Kansas City-based vendor RiskAnalytics. Dunker reached out after watching a Youtube video I posted that featured some existing and historic credit card fraud sites. He asked what I knew about one of the carding sites in the video: A fraud shop called “Uncle Sam,” whose home page pictures a pointing Uncle Sam saying “I want YOU to swipe.””
“I confessed that I knew little of this shop other than its existence, and asked why he was so interested in this particular crime store. Dunker showed me how the Uncle Sam card shop and at least four others were hosted by the same Dark Cloud, and how the system changed the Internet address of each Web site roughly every three minutes. The entire robot network, or “botnet,” consisted of thousands of hacked home computers spread across virtually every time zone in the world, he said.”
So, most of these hacked machines are likely just “repeaters”, accepting connections from end users and then relaying those connections back to the secret central server
This also works fairly well as a DDoS mitigation mechanism
“the Windows-based malware that powers the botnet assigns infected hosts different roles, depending on the victim machine’s strengths or weaknesses: More powerful systems might be used as DNS servers, while infected systems behind home routers may be infected with a “reverse proxy,” which lets the attackers control the system remotely”
“It’s unclear whether this botnet is being used by more than one individual or group. The variety of crimeware campaigns that RiskAnalytics has tracked operated through the network suggests that it may be rented out to multiple different cybercrooks. Still, other clues suggests the whole thing may have been orchestrated by the same gang.”
A more indepth report on the botnet is expected next week
“If you liked this story, check out this piece about another carding forum called Joker’s Stash, which also uses a unique communications system to keep itself online and reachable to all comers.”

Wekby APT gang using DNS tunneling for C&C

“Palo Alto Networks is reporting a shift in malware tactics used by the APT group Wekby that has added a rare but effective new tool to its bag of tricks. Wekby attackers are turning to the technique known as DNS tunneling in lieu of more conventional HTTP delivery of command and controls for remote access control of infected computer networks.”
“Wekby is a group that has been active for a number of years, targeting various industries such as healthcare, telecommunications, aerospace, defense, and high tech. The group is known to leverage recently released exploits very shortly after those exploits are available, such as in the case of HackingTeam’s Flash zero-day exploit.”
“The malware used by the Wekby group has ties to the HTTPBrowser malware family, and uses DNS requests as a command and control mechanism. Additionally, it uses various obfuscation techniques to thwart researchers during analysis. Based on metadata seen in the discussed samples, Palo Alto Networks has named this malware family ‘pisloader’.”
“The initial dropper contains very simple code that is responsible for setting persistence via the Run registry key, and dropping and executing an embedded Windows executable. Limited obfuscation was encountered, where the authors split up strings into smaller sub-strings and used ‘strcpy’ and ‘strcat’ calls to re-build them prior to use. They also used this same technique to generate garbage strings that are never used. This is likely to deter detection and analysis of the sample.”
“The payload is heavily obfuscated using a return-oriented programming (ROP) technique, as well as a number of garbage assembly instructions. In the example below, code highlighted in red essentially serves no purpose other than to deter reverse-engineering of the sample. This code can be treated as garbage and ignored. The entirety of the function is highlighted in green, where two function offsets are pushed to the stack, followed by a return instruction. This return instruction will point code execution first at the null function, which in turn will point code execution to the ‘next_function’. This technique is used throughout the runtime of the payload, making static analysis difficult.”
“The malware is actually quite simplistic once the obfuscation and garbage code is ignored. It will begin by generating a random 10-byte alpha-numeric header. The remaining data is base32-encoded, with padding removed. This data will be used to populate a subdomain that will be used in a subsequent DNS request for a TXT record.”
“The use of DNS as a C2 protocol has historically not been widely adopted by malware authors.”
“The use of DNS as a C2 allows pisloader to bypass certain security products that may not be inspecting this traffic correctly.”
“The C2 server will respond with a TXT record that is encoded similar to the initial request. In the response, the first byte is ignored, and the remaining data is base32-encoded. An example of this can be found below.”
The Malware also looks for specific flags in the DNS response, to prevent it being spoofed by a DNS server not run by the authors. Palo Alto Networks has reverse engineered the malware and found the special flags
The following commands, and their descriptions are supported by the malware:
- sifo – Collect victim system information
- drive – List drives on victim machine
- list – List file information for provided directory
- upload – Upload a file to the victim machine
- open – Spawn a command shell
“The Wekby group continues to target various high profile organizations using sophisticated malware. The pisloader malware family uses various novel techniques, such as using DNS as a C2 protocol, as well as making use of return-oriented programming and other anti-analysis tactics.”
Palo Alto Networks Report

Feedback:

Round up:

The post PIS Poor DNS | TechSNAP 268 first appeared on Jupiter Broadcasting.

Hackception | TTT 194

chris — Tue, 07 Jul 2015 11:26:00 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

A slick talking, high rolling hacking group “Hacking Team” gets hacked. Some of the details in the data dump expose issues in SELinux, Android & iOS. We share the details.

Big changes are coming to Firefox, 2TB SSDs coming to a desktop near you, Prime Day is near & more!

Direct Download:

RSS Feeds:

Become a supporter on Patreon

Show Notes:

— Episode Links —

The post Hackception | TTT 194 first appeared on Jupiter Broadcasting.

Fedora Takes the Lead | LINUX Unplugged 71

chris — Tue, 16 Dec 2014 19:24:43 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Our virtual LUG reviews Fedora 21 & why we’ve just witnessed one of the most ambitious transformation of any Linux distro of 2014.

Plus Dustin Kirkland from Canonical answers if Ubuntu Snappy could be the future of the entire Ubuntu project & what’s coming soon from the Xonotic project.

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

Show Notes:

Pre-Show:

Brewie: Worlds first fully automated home-brewery | Indiegogo

Brewie is a fully automated brewing machine with compact design. Perfect for beginners and experts.

Summary of Brewie specs

Specs listed for the Brewie include:

Processor — TI Sitara AM3358 (may change in commercial version)
Memory/storage — (not specified)
Display — 4.3-inch color LCD touchscreen
Wireless — 802.11b/g/n; RFID transceiver
Other I/O — USB port
Internal sensors — Level, current, and temperature
Brewing features:
- Solid state relay control
- Magnetic valves with brushless pumps
- Stainless steel containers
- 20,000-hour pumps
- Automatic water inlet
- Wort outlet (one button push)
- 2x automatic hop inserters
Other features (Beginner’s model) — 4x 5-liter kegs; 1x ingredient pad
Capacity — 20 liters (5.2 gal.)
Brewing time — 5-6 hours, plus approx. 14 days of fermentation.
Power — 230V/120VAC, 2000 W
Weight — 25 k (55 lbs)
Dimensions — 71.5 x 32.5 x 45cm (21.15 x 12.8 x 17.7 in.)
Operating system — Poky-based Linux; accessible from Android, iOS, and Windows Phone mobile apps, plus a general web interface

FU:

Anyone using Wallbag?
A Proper End of The Year on Linux

Ubuntu Snappy Core for the Desktop?

We ask Dustin Kirkland the Ubuntu Cloud Product Manager and Strategist at Canonical if his new baby could be the future of the Ubuntu Project.

Fedora 21 Community Review

It’s Here! Announcing Fedora 21! | Fedora Magazine

The Fedora Project is pleased to announce Fedora 21, the final release, ready to run on your desktops, servers, and in the cloud. Fedora 21 is a game-changer for the Fedora Project, and we think you’re going to be very pleased with the results.

tl;dr?

Impatient? Go straight to https://getfedora.org/ and get started. Otherwise, read on!

Fedora 21 Release Review: An Impressive Developer Workstation | Linux.com

Sans the Files bug, I found Fedora 21 to be an impressive release. I was able to get the desired software from RPMFusion. Online Accounts and Software are among the many gems that this community has developed and I wish other DEs adopt a similar approach to make people’s lives easier.

Runs Linux from the people:

Send in a pic/video of your runs Linux.
Please upload videos to YouTube and submit a link via email or the subreddit.

New Shows : Tech Talk Today (Mon – Thur)

Tech Talk Today Today | Jupiter Broadcasting

Support Jupiter Broadcasting on Patreon

Post-Show

4K Video Playback on two 1080P monitors with the X2Go Linux Terminal Server – YouTube

The post Fedora Takes the Lead | LINUX Unplugged 71 first appeared on Jupiter Broadcasting.