Security challenges for the summer

Hello! The summer is here and the holidays are near!

Planning something to do? Too much free time as you don't have to do any exams in September? Looking for something to learn? Me too! :)

Each summer I plan something to learn, something to investigate... basically something to help me enjoy my free time! This summer I'm going to focus on:

• Firefox addons development (Check this Hackbar Google Code website)
• HTML5

I'll also try to keep my mind fit by playing online challenges games. If you want to practice and learn about security you can check the following websites:

• The Bright Shadows
• Try2Hack
• Hack This Site

Enjoy and keep out of direct sunlight ;)

Web security news and the "Hack of the Year"

Long time since my last post but I was a bit busy on customer on-site testing. Nice days of application testing but now is time to write here again.

I read long ago a fantastic book about security named "The Art Of Intrusion" wrote by the (in)famous Kevin Mitnick. He told amazing histories about security and intrusions without giving too much technical details about them but the enough to understand the attack and catch the idea behind the security problem the system had. News about security are (sometimes) the same. I said "sometimes" because reporters who wrote about security doesn't really use to know anything about security, but this is something to another post...

Today I want to introduce you two websites about web security / cracking. The first one is a website that intends to collect all these web security incidents around the world. It's called The Web Hacking Incident Database and offers reports of the hacked websites around the world, including, in most of the cases, some technical information. It's worth a lecture to understand how important is the web security nowadays.

The other one is really a clone of the famous milw0rm website (I'm not going to link it because is currently abandoned) called Inj3ctor.They published a few days ago a paper claiming that they had hacked Facebook. Wooohhh... really? Let's go check the report:

• They start doing a port scan of facebook.com
• After that they do some simple Google search queries trying to identify some PHP errors because is well know that Facebook is developed in this language.
• A quick look into the robots.txt file can focus us into specific (and usually privates) web pages.
• After these tests against facebook.com they move to apps.facebook.com and detect some vulnerabilities in third parties applications. These applications are not developed by Facebook and are not hosted in the Facebook servers.

They got a lot of information from MySQL databases using simple SQL Injections and claim that the information they obtained is from Facebook. Ok, sometimes people get really excited too soon. In this case the called it: "Hack of the year!".

If you are going to call something the "Hack of the year" be sure it is... Because:

1. Facebook doesn't use MySQL, they use Cassandra.
2. The path showed in the PHP errors points clearly to another server (http://tomkincaid.dreamhosters.com/)
3. Wordpress? I'm pretty sure that is not any Wordpress installation running in the Facebook servers.
4. Don't say your exploit is the "Hack of the year", wait until the community say it: http://pwnie-awards.org/

That's all for now, more other day with an exciting project I want to release in any point next week :) Cheers!

Back from RootedCon 2010

I know, I didn't write anything about the Rootedcon as I promised last week but following the congress I came up with some new ideas and I have been busy coding them.

I don't know how to describe the congress. Simply amazing is a good approach. I met a lot of fantastic people and saw a lot of friends again. And, of course, we talked and learnt about security, so, what more I can ask for?

The first day (the Thursday) we had some less technical sessions about how to start a career as pentester and the actual situation of the national (Spanish) security. We also received a very interesting speach about computer forensics. The day ended in a pub near the congress place talking with the speakers and meeting people I only know from Internet.

Friday was a very intense day. The most technical sessions took place on this day. Also the CTF (Capture The Flag) tournament started. It was a shame that I was unable to participate, but I didn't want to miss any of the sessions, maybe next year! ;) We saw some 0-days exploits in the conferences: One for airodump, another for a support ActiveX program widely use in some big companies such as Telefonica and Symantec and others for the Oracle Financials 12. The most technical speach was the presentation of the Radare2 tool. Very low level programming and high level concepts which was difficult for me to understand. I'll try to download it and understand better how it works and how to use it.

Last day the sessions were very interesting too. Android forensic, metadata security, cryptography, botnets and one about hackers in the comics too! It was a very good mix of themes to finish the event. Also we had dinner with almost all the speakers so we kept talking about security even after three days. After dinner we went to a party but I'm not going to comment on this... ;)

I have to admit that after the congress I was really tired but also shocked! I met all these incredible people who know a lot about security making me realise that I need to keep studying and researching because out there are more things that I can imagine... and I want to learn them all!

P.S. I'll try to add the slides of the rest of the speaks when they release them. They release the slides today and you can see them online at Slideshare.

2010 CWE/SANS Top 25 Most Dangerous Programming Errors

A few weeks ago was released a new version of the "Top 25 Most Dangerous Programming Errors" list about coding bugs that the MITRE and SANS released last year. This new version comes with a better layout to a better understanding about the risks, the remedies and focus into the identification of the problem.

From my point of view is very interesting the table which defines the weakness by language. I miss the presence of ASP.Net in this list but it can be equated to JSP in most of the cases. In my experience as web pentester I have my own "personal ranking" of insecure web applications. From the most common secure applications to the less one are:

1. ASP.Net
2. JSP
3. Perl/Python
4. ASP
5. PHP

This is not a fact! It's only based on my personal experience in my years of web security testing. I'm open to discuss this ranking ;)

I'm also impressed to see how many of these coding bugs are specifically related to web (or mostly associated with web applications). Web applications are becoming more popular everyday (they are already) and with the rising of the cloud computing they are going to become more and more popular even in the Intranet applications.

Documents like this helps developers to build more secure applications and to application tester to identify and document better these bugs that makes our days :) Enjoy reading!

Testing and virtual machines

Sometimes I need to test specific software version or make a custom machines for a specific propose like developing in a particular language. For now I used my personal machine for it, but today I have discovered something that I'm planning  adapt to my day by day.

I was a bit lazy about creating virtual machines because I need to download a whole CD image, install it and later configure it. Today I discover TurnKey Linux website. They have a lot of virtual machines and ISO images of preconfigured Linux machines. They are based on Ubuntu 8.04 Server LTS so I have a platform I'm familiar with and very cool (and secure!) preconfigured options.

Well, maybe I'm being a bit enthusiastic but the LAMP machine looks really good in my initial tests. I'm planning to give in a try to other machines too like the Ruby On Rails machine or the Revision Control one.

These machines give me the ability to create fresh machines from scratch with a lot of dirty work already done. And I love it :)

If you are looking for more complex machines for testing you can found some preconfigured web security testing machines. They allow you to play with some vulnerable web pages and measure your skills without breaking the law.

• The OWASP is hosting a project called "Broken Web Applications Project" who offers a virtual machine to test different vulnerable software. You can check online the list of vulnerable applications included.
• Recently was released the version 1.0 of Web Security Dojo, which includes vulnerable applications and some web security related tools, as Brup proxy or w3af.

And it is all for today, I have some things to test... ;)

Mixed content in different browsers

In security, one of the most old and famous attacks is Man In The Middle attack. With this technique we can read all the packets the user is sending to a server and analyse it. The solution? Use a secure layer to encrypt all the traffic.

This, for web sites, require that the user browser use the HTTPS protocol. This relay in the authenticity of the server certificate and the trust relation between the browser and the certificate authority. It can be broken, but is not the point of this post, maybe for other one :)

If a website mix secure (HTTPS) and insecure (HTTP) content in the same page an attacker sniffing the net will be able to see, for example, our session cookie in clear text. This is a big risk if the attacker has control over the web content we are browsing (using a stored XSS attack) and insert some insecure reference on it to catch our cookie session.

The way the browsers controls this is different in each one, but always insecure. The last version of Internet Explorer can be configured to check if we are loading insecure resources and block them. The result is that we don't see the insecure images if we decide to block. But it's really blocking the resources or only hiding them?

I create a secure web page which load different (mixed) content. Using Wireshark to look the request my browser is doing I can determine that IE8 is currently making the request and, if the user decide to "block" it, only hide it.

 

This can make the user think he is safe when the request (and his cookie sessions) has been sended in clear text.

The other browser I tested is Firefox. When Firefox detect mixed content it load it and show an alert to the user to warn him about it. This is the same insecure process that Internet Explorer, but in this case the webpage is render normally so the user doesn't have the false security feeling when the images are blocked by IE.

I, a huge fan of Firefox and the possibility to expand it using addons, have created a Greasemonkey script to try to prevent this insecure behaviour of Firefox. It's called Mixed Content Protection and can be installed from the userscripts community web page. It requires Greasemonkey to work.

The script is very simple. It works only when we are accessing to HTTPS web pages and search for all the insecure references* in the HTML source code. It executes before the page loads, so it can change "on-the-fly" all these insecure references for the secure ones. If the secure object is not accessible it will not be loaded using a insecure protocol.

Currently it search for:

• All src attributes: img, iframe, object, script, etc.
• The href attribute of link tags for css files
• The insecure value in the param tag to the movie resource.

I think with these references it will cover mostly of the cases but, if you know any other resource can be loaded insecurely, please, feel free to comment me. Also it can fail in some cases, if you detect any issue please let me know :)

* Currently the script only works for the body tag elements, so any insecure reference in the header of the file will be load. It also doesn't work with resources loaded from Javascript or CSS files.

Thanks to Chema Alonso for draw my attention[Spanish blog, sorry] to this web browsers issue.

Will you tell your enemies where you are?

In the current society where everyone has a 3G mobile, a Facebook account, twitter username and more, sometimes we forgot about our privacy.

These days is becoming very popular the Foursquare web site. It's a very simple social game where you can tell your friends where you are. This is a nice way to meet new sites and catch your friends whatever they are. Foursquare also offers badges for different actions to incentive people to use their application. It also send tweets using our Twitter account telling our friends where are we if we configure it. It's funny!

But this can be a very high risk for our privacy. If our twitter account is public anyone can know at any time where we are. This principle is the one behind the Please Rob Me web page. They use a simple search on Twitter, 4sq -@foursquare, which returns all the automatic generate tweets from the Foursquare web site. These tweets are send when we check-in in a place. People telling everyone where they are? Scary... But wait! It's another web page that offers the same service. It is Gowalla and, again, we can know where is the people who is using this web site: gowal.la -@Gowalla

Right now it is more funny than dangerous but the important point behind this web page is that in the actual society the people give away their privacy. Some years ago (not too much, only 2 or 3...) our personal data was the most important thing for ourselves but nowadays we don't really care about it. We publicity everywhere where we are, what are we doing and, sometimes, pictures or videos.

Our recommendation is to keep your data the more private the applications allow you and try to think twice before posting any data (text, image or video) at Internet. Once posted sometimes is difficult to delete it...

Oh, by the way... I have a public twitter account! You can follow me at @p_laguna for all my security related tweets.