0×01) Scada and ICS for Security Experts: How to Avoid Cyberdouchery http://www.defcon.org/images/defcon-18/dc-18-presentations/Arlen/DEFCON-18-Arlen-SCADA-Cyberdouchery.pdf

0×02) Non-Executable Stack ARM Exploitation http://www.defcon.org/images/defcon-18/dc-18-presentations/Avraham/DEFCON-18-Avraham-Modern%20ARM-Exploitation-WP.pdf

0×03) Exploiting SCADA Systems http://www.defcon.org/images/defcon-18/dc-18-presentations/JBrown/DEFCON-18-Brown-SCADA.pdf

0×04) Function Hooking for OSX and Linux http://www.defcon.org/images/defcon-18/dc-18-presentations/Damato/DEFCON-18-Damato-Function-Hooking.pdf

0×05) Exploiting Internet Surveillance Systems http://www.defcon.org/images/defcon-18/dc-18-presentations/Decius/DEFCON-18-Decius-Exploiting-Internet-Surveillance-Systems.pdf

0×06) Katana – Portable Multi-Boot Security Suite http://www.defcon.org/images/defcon-18/dc-18-presentations/Dunning/DEFCON-18-Dunning-Katana.pdf

0×07) Hacking and protecting Oracle Database Vault http://www.defcon.org/images/defcon-18/dc-18-presentations/Martinez-Fayo/DEFCON-18-Martinez-Fayo-Oracle-Database-Vault.pdf

0×08) Mastering the Nmap Scripting Engine http://www.defcon.org/images/defcon-18/dc-18-presentations/Fyodor-Fifield/DEFCON-18-Fyodor-Fifield-NMAP.pdf

For more about Defcon, you can visit the official site: http://www.defcon.org/

As we’ve previously announced, SourceForge.net has been the target of a directed attack. We have completed the first round of analysis, and have a much more solid picture of what happened, the extent of the impact, our plan to reduce future risk of attack. We’re still working hard on fixing things, but we wanted to share what we know with the community.

We discovered the attack on Wednesday, and have been working hard to get things back in order since then. While several boxes were compromised we believe we caught things before the attack escalated beyond its first stages.

Our early assessment of which services and hosts were impacted, and the choice to disable CVS, ishell, file uploads, and project web updates appears to have prevented any further escalation of the attack or any data corruption activities.

We expect to continue work on validating data through the weekend, and begin restoring services early next week. There is a lot of data to be validated and these tests will take some time to run.  We’ll provide more timeline information as we have more information.

We recognize that we could get services back online faster if we cut corners on data validtion. We know downtime causes serious inconveniences for some of you. But given the negative consequences of corrupted data, we feel it’s vital to take the time to validate everything that could potentially have been touched.

Attack Description

The general course of the attack was pretty standard. There was a root privilege escalation on one of our platforms which permitted exposure of credentials that were then used to access machines with externally-facing SSH. Our network partitioning prevented escalation to other zones of our network.

This is the point where we found the attack, locked down servers, and began work on analysis and response.

Immediate Response

Our first action response included many of the standard steps:

* analysis of the attack and log files on the compromised servers
* methodically checking all other services and servers for exploits
* further network lockdown and updating of server credentials

Service shutdown

Once we knew the attack was present, we locked down the impacted hosts, so that we could reduce the risk of escalation, from those servers to other hosts, and prevent possible data gathering activities.

This strategy resulted in service downtime for:

* CVS Hosting
* ViewVC
* New Release upload capability
* ProjectWeb/shell

Password invalidation

Our analysis uncovered (among other things) a hacked SSH daemon, which was modified to do password capture. We don’t have reason to the attacker was successful in collecting passwords. But, the presence of this daemon and server level access to one-way hashed, and encrypted, password data led us to take the precautionary measure of invalidating all SourceForge user account passwords. Users have been asked to recover account access by email.

Data Validation

It’s better to be safe than sorry, so we’ve decided to perform a comprehensive validation of project data from file releases, to SCM commits. We will compare data agains pre-attack backups, and will identify changed and added. We will review that data, and will will also refer anything suspicious to individual project teams for further assessment as needed.

The validation work is a precaution, because while we don’t have evidence of any data tampering, we’d much prefer to burn a bunch of CPU cycles verifying everything than to discover later that some extra special trickery lead to some undetected badness.

Service Restoration

Now that most of the analysis is done, we’ve started the next stage of our efforts, which includes the obvious work of restoring compromised boxes from bare metal, and implementing a number of new controls to reduce likelihood of future attack.

We will of course also be updating the credentials which reside on these hosts and performed quite a few steps to further lock down access to these machines.

We are in process of bringing services back one by one, as data validation is completed, and we get the newly configured hosts online. We expect that data validation will progress through the weekend, and we’ll really start getting swinging on service restoration early next week.

File Release Services

Many folks have suggested that the most likely motivation for an attack against sourceforge would be to corrupt project releases.

We’ve found no evidence of this, but are taking extrodinary care to make sure that we don’t somehow distribute corrupted release files.

We are performing validation of data against stored hashes, backups, and additional data copies.

We expect to restore these services first, as soon as data validation is completed.

Project Web

One attack vector that impacts our services directly is the shared project web space. So, let’s talk about that in a bit more detail.

Sourceforge.net has been around a long time, and security decisions made a decade ago are now being reassessed. In most cases past decisions were made around the general principle that we trust open source developers to work together, play nice, and generally do the right thing. Services were rolled out based on widespread trust for the developer community. And that philosophy served us well.

But in the years since then, we’ve evolved from hundreds of sf.net users to millions, and in many cases it’s time to re-asses the balance between widespread trust and security. Project Web is a prime example of this, and we’ve been working at a deliberate pace to isolate project web space, and have begun rolling out the new “secure project web” service to many of our projects.

This new secure project web includes a new security model that moves us away from shared hosting while preserving the scalability we need for mass hosting.

Because of this attack we’ll be accelerating the rollout of Secure Project Web services as part of the process of bringing the project web service back online. This will allow us to provide both improved functionality, and better secruity.

CVS

CVS service is one of SourceForge.net’s oldest services and, due to limitations in CVS itself, cannot readily live on our scalable network storage solution. Validation of this data is going to require several days and we anticipate that this service will be restored sometime in the later part of week.

We are also considering the end-of-life of the CVS service and hope to have user support in migrating CVS users to Subversion in coming months. Subversion generally provides parity to CVS commands, and many of our users have made this transition successfully in the past.

From SVN, projects can move to Git if desired.

Looking forward

We are very much committed to the ongoing process of improving our security, and we will continue making behind the scenes improvements to our infrastructure on a regular basis. This isn’t a one time event, it’s a process, and we’re going to stay fully engaged over the long term.

I’d like to end with a more personal note, I’ve been working with our Ops team a lot this week, and I think we can all say that the patience and support that we’ve received from the community has been the best part of a very bad week.

Thanks again for all the support and encouragement.

source: http://sourceforge.net/blog/sourceforge-attack-full-report/

Announced at this week’s Black Hat conference in Washington, D.C., the tool, called Attack Surface Analyzer, helps determine when poorly designed applications widen the attack surface of a Windows system.

The tool is used to “ highlight the changes in system state, run-time parameters and securable objects on the Windows operating system,” according to a Security Development Lifecycle blog post. It identifies altered or new files, registry keys, services, ActiveX controls, listening ports, access control lists and other components that could increase an attack surface.

“ The tool takes snapshots of an organization’s system and compares these to identify changes,” the post said, citing a product description. “ [It] does not analyze a system based on signatures or known vulnerabilities; instead, it looks for classes of security weaknesses as applications are installed on the Windows operating system.”

The tool also produces a report detailing the changes that a particular application may have made to a system.

The Attack Surface Analyzer can be downloaded here.

Source: http://www.scmagazineus.com/microsoft-releases-free-secure-development-tool/article/194470/

Darnell Albert-El, 53, pleaded guilty to one count of intentionally damaging a protected computer without authorization on June 29. He was sentenced Friday in U.S. District Court for the Eastern District of Virginia and, in addition to the prison time, ordered to pay US$6,700 in restitution to Trans Marx, which sells discounted telecom equipment and supplies.

Albert-El, of Richmond, worked at Trans Marx from February to June 2008, according to court documents. Before he was fired, Albert-El had access to the Trans Marx computer network, including the company website hosted in Georgia, the DOJ said.

On July 25, Albert-El used a personal computer and an administrator account to access the computer hosting the company’s website, and he deleted about 1,000 files related to the Trans Marx website, the DOJ said.

In his plea agreement and an earlier interview with U.S. Federal Bureau of Investigation agents, Albert-El said he deleted the files because he was angry about being fired, the DOJ said.

Albert-El later told Trans Marx employees where backup tapes were located and offered to assist them in restoring the files, said his lawyer, Mary Maguire, while arguing in court documents for a lenient sentence.

Source:  http://www.computerworld.com/s/article/9194027/IT_director_gets_jail_term_for_hacking_former_employer_s_site

The first link downloads an .MSI file which runs a very short wizard. Tell it to proceed and then it’s done and you get an option to tell them what you think of it. The second link runs a different .MSI which undoes the fix. Note this link, because after the patch is available and you apply it you’ll want to run the undo Fix it so that you can use your help system again.

Using these links is a far better option than manual registry hacking. Windows XP users, start Fix iting.

The flaw is in the Help and Support Center, a relic of the time when Microsoft was trying to make everything on the computer a browser app. Help, Control Panel, Windows Update and other components were browser or browser-like apps. In order to access remote help, the Help and Support Center supports remote links to help using hcp:// addresses. Windows XP SP2 introduced a model whereby the program, when run with the /fromhcp parameter, runs in a special restricted mode where only links from addresses on a special whitelist can have privileged access. Ormandy’s vulnerability is a an implementation error which allows bypass of the whitelist. Read the FD posting if you want all the gory details, but the end result is arbitrary code execution from links on the web. Ormandy notified Microsoft about this bug on June 5, the Saturday before this last Patch Tuesday.

This afternoon the Microsoft Security Response Center responded with a blog entry. They criticize Ormandy for releasing the information without giving them a fair chance to evaluate it and then provide a registry hack to remove all hcp support. This blocks the vulnerability as well as useful hcp links, such as those in the Control Panel.

Ormandy also created an unofficial hotfix of his own and linked to it from his posting. A Secunia analysis of the issue claims that the hotfix does not sufficiently address the problem.

If you run Windows XP (and that’s your first mistake) you will be much better off following Microsoft’s registry mitigation technique, although I think you could probably get away with renaming the key rather than deleting it. This should make it easier to undo when the patch is available.

Ormandy posted the vulnerability report using his personal e-mail and probably considers that he is acting here in a private capacity, but don’t expect Microsoft to see it that way. Microsoft’s initial report on the bug refers to Ormandy as “ a Google security researcher” and the tweet announcing it says “ Information on the Windows Help vulnerability disclosed by Google.” People can have reasonable disagreements about the limits of full disclosure vs. “ responsible” disclosure, but I doubt Google would take kindly to a Microsoft researcher blind-siding them like this. For Ormandy to expect turnaround like this during a heavy Patch Tuesday is not reasonable. In fact, even Ormandy may be reconsidering the wisdom of his move.

Source from Here

http://www.phenoelit-us.org/dpl/dpl.html

Έχει λίστα με default passwords! Use it as you think better