from the blackhat reject bin

so maybe this is obvious, i donno...

the talk started when i told my buddy (@zenfosec) that i had this password for the firewall for this big .com site... it was one of those "it's always been that" passwords... pure speculation, anyway...

so at the end of the gig while presenting my report, i suggested they rotate the password, since they gave it to an external party. the admin laughs, and he's like "you can only get to the box from inside once i pull the rule for you".

i'm a big advocate of dropping the whole "inside" / "outside" terminology for substantial networks. the fundamental protection measures are so cheap in true cost, and the risk/benefit is clear. anywho...

so my buddy says "yea, until you client side him" ;)

so that was the crux of the talk. when you get client-sided by xss or flash vulns or whatever, your internal network can be attacked.

this idea really built off the nifty modem csrf pointed out by nathan... so let's just extend it. what if there's auth required on the device? can we attack it when we're XSSing and/or CSRFing?

blah blah, slides about xss and csrf history, and traditional distinctions, etc...

so anyway, the hostile code can blindly assume gateways are .1 or .254 on the local /24 (re: the timely rsnake comments on the pervasive homogenous rfc 1918 networks) or you can do a little work and find them.

once found, gateways can be attacked w/ a csrf via the client-side. if the gateway requires auth, it can be brute forced. i didn't do much with forms based because i was really curious about http basic auth. this lead me to realize you can pass http basic auth creds to the gateway:

<img src="https://username:password@u.r.gate.way/known/path/img.gif">

***update*** - i thought this auth method was really nifty when i thought about it and tested it, and just two days ago realized that the gnucitizen crew used the same method in their AttackAPI.. mb others did before that too. anywho, just wanted to give credit

generate tons of code brute the passwords with known usernames and image paths for common gateway models. you are auth'd, you detect it and initiate a second stage which leaks out the creds and/or performs a csrf to enable wan management.

bruting will work because people feel like inside is safe and they don't take reasonable precautions like password rotation, password complexity, and human monitoring of interesting log events like days of failed password attempts on the firewall.

i haven't come across similar ramblings on the web yet, so i wanted to share :)

thanks for stickin w/ me if you read this far ;)

botnet foo

so there's an interesting thread on the incidents mailing list talking about bruteforce ssh attacks...

yea yea, old news...

but what's interesting isn't the brute ssh stuff, but the level of sophistication and coordination in the botnet itself. i'd only recently heard of denyhosts, which is a blacklist of known-hostile IP addresses that attack ssh servers. if a new IP fails logins to an ssh server, it gets added to the list...

it seems that this botnet is actively trying to get around this defense mechanism by coordinating attacks so that different login attempts come from different IP addresses. so you'll see an attempt pattern like this:

x.x.x.x: user=alice
y.y.y.y: user=bob
z.z.z.z: user=charlie

the really nifty bit is that state is apparently maintained as the botnet iterates through the dictionary of users... one admin reported that if you blacklist ssh from all but a few /8's, the attacks will cease for a while, but eventually one will come from the whitelisted IP address block and will be the next alphabetical username...

i really need to get a gig as an engineer at an ISP so i can spend some time writing code to identify and disrupt botnets... more needs to be done in that area... but yet again, there is this whole debate about the ethics of dismantling botnets... i haven't thought about it enough yet, but there are clearly important points on both sides of the issue. but lets cut through all of that high-brow legalese and ethical stuff (i'd rather go listen to Jennifer Granick talk about this stuff at bh/dc this year instead of flaming over it anyway;) and cut right to something more grounded...

comcast is talking about bandwidth caps and charges for overusage... so, tell me, what is going to happen when your grandmas bot infested box is spewing spam and she gets a big old bill from comcast...?